3718 Commits

This Branch

This Branch

All Branches

• feat(windows) start powershell in utf-8 mode (#7902)

  ## Summary
  Adds a FeatureFlag to enforce UTF8 encoding in powershell, particularly
  Windows Powershell v5. This should help address issues like #7290.
  
  Notably, this PR does not include the ability to parse `apply_patch`
  invocations within UTF8 shell commands (calls to the freeform tool
  should not be impacted). I am leaving this out of scope for now. We
  should address before this feature becomes Stable, but those cases are
  not the default behavior at this time so we're okay for experimentation
  phase. We should continue cleaning up the `apply_patch::invocation`
  logic and then can handle it more cleanly.
  
  ## Testing
  - [x] Adds additional testing

  Dylan Hurd · 2025-12-22 09:36:44 -08:00
  33e1d0844a
• chore(deps): bump openssl-sys from 0.9.109 to 0.9.111 in /codex-rs (#8416)

  Bumps [openssl-sys](https://github.com/rust-openssl/rust-openssl) from
  0.9.109 to 0.9.111.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/rust-openssl/rust-openssl/releases">openssl-sys's
  releases</a>.</em></p>
  <blockquote>
  <h2>openssl-sys-v0.9.111</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Fix a few typos (most of them found with codespell) by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2502">rust-openssl/rust-openssl#2502</a></li>
  <li>Use SHA256 test variant instead of SHA1 by <a
  href="https://github.com/abbra"><code>@​abbra</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2504">rust-openssl/rust-openssl#2504</a></li>
  <li>pin home to an older version on MSRV CI by <a
  href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2509">rust-openssl/rust-openssl#2509</a></li>
  <li>Implement set_rsa_oaep_label for AWS-LC/BoringSSL by <a
  href="https://github.com/goffrie"><code>@​goffrie</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2508">rust-openssl/rust-openssl#2508</a></li>
  <li>sys/evp: add EVP_MAC symbols by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2510">rust-openssl/rust-openssl#2510</a></li>
  <li>CI: bump LibreSSL 4.x branches to latest releases by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2513">rust-openssl/rust-openssl#2513</a></li>
  <li>Fix unsound OCSP find_status handling of optional next_update field
  by <a href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2517">rust-openssl/rust-openssl#2517</a></li>
  <li>Release openssl v0.10.75 and openssl-sys v0.9.111 by <a
  href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2518">rust-openssl/rust-openssl#2518</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/abbra"><code>@​abbra</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2504">rust-openssl/rust-openssl#2504</a></li>
  <li><a href="https://github.com/goffrie"><code>@​goffrie</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2508">rust-openssl/rust-openssl#2508</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/rust-openssl/rust-openssl/compare/openssl-sys-v0.9.110...openssl-sys-v0.9.111">https://github.com/rust-openssl/rust-openssl/compare/openssl-sys-v0.9.110...openssl-sys-v0.9.111</a></p>
  <h2>openssl-sys-v0.9.110</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>[AIX] use /usr to find_openssl_dir by <a
  href="https://github.com/daltenty"><code>@​daltenty</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2401">rust-openssl/rust-openssl#2401</a></li>
  <li>Improve support for OPENSSL_NO_COMP and OPENSSL_NO_SRTP by <a
  href="https://github.com/justsmth"><code>@​justsmth</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2423">rust-openssl/rust-openssl#2423</a></li>
  <li>Add aws-lc-fips feature to allow linking the aws-lc-fips-sys crate
  by <a href="https://github.com/skmcgrail"><code>@​skmcgrail</code></a>
  in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2424">rust-openssl/rust-openssl#2424</a></li>
  <li>variety of fixes for warnings in new rust by <a
  href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2427">rust-openssl/rust-openssl#2427</a></li>
  <li>Some API adjustments for LibreSSL 4.2.0 by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2426">rust-openssl/rust-openssl#2426</a></li>
  <li>Update OpenSSL documentation URLs to new docs.openssl.org domain by
  <a href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2430">rust-openssl/rust-openssl#2430</a></li>
  <li>pkey_ctx: add ability to generate DSA params &amp; keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2432">rust-openssl/rust-openssl#2432</a></li>
  <li>Run tests on windows-11-arm by <a
  href="https://github.com/saschanaz"><code>@​saschanaz</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2407">rust-openssl/rust-openssl#2407</a></li>
  <li>pkey_ctx: add ability to generate EC params &amp; keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2434">rust-openssl/rust-openssl#2434</a></li>
  <li>pkey_ctx: add ability to generate DH params &amp; keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2433">rust-openssl/rust-openssl#2433</a></li>
  <li>pkey_ctx: add ability to generate RSA keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2431">rust-openssl/rust-openssl#2431</a></li>
  <li>expose more verifier flags/errors for libressl by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2441">rust-openssl/rust-openssl#2441</a></li>
  <li>sys/evp: set/get params bindings by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2436">rust-openssl/rust-openssl#2436</a></li>
  <li>Add support for argon2d and argon2i variants by <a
  href="https://github.com/greateggsgreg"><code>@​greateggsgreg</code></a>
  in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2416">rust-openssl/rust-openssl#2416</a></li>
  <li>Bump actions/checkout from 4 to 5 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
  in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2443">rust-openssl/rust-openssl#2443</a></li>
  <li>Update bindgen; Update MSRV to 1.70 by <a
  href="https://github.com/justsmth"><code>@​justsmth</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2438">rust-openssl/rust-openssl#2438</a></li>
  <li>macros: fully qualify imports by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2445">rust-openssl/rust-openssl#2445</a></li>
  <li>Disable AES-CFB128 ciphers for BoringSSL by <a
  href="https://github.com/alebastr"><code>@​alebastr</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2447">rust-openssl/rust-openssl#2447</a></li>
  <li>Fix missing &quot;__off_t&quot; on NetBSD 10 by <a
  href="https://github.com/alebastr"><code>@​alebastr</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2448">rust-openssl/rust-openssl#2448</a></li>
  <li>ML-KEM/ML-DSA part 1: openssl-sys changes by <a
  href="https://github.com/swenson"><code>@​swenson</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2450">rust-openssl/rust-openssl#2450</a></li>
  <li>sys: add symbols to construct an EVP_PKEY from a param builder by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2453">rust-openssl/rust-openssl#2453</a></li>
  <li>ec-point: add set_affine_coordinates by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2455">rust-openssl/rust-openssl#2455</a></li>
  <li>openssl-sys: add more functions to replace non-deprecated ones by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2457">rust-openssl/rust-openssl#2457</a></li>
  <li>ML-KEM/ML-DSA part 2: param builder by <a
  href="https://github.com/swenson"><code>@​swenson</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2451">rust-openssl/rust-openssl#2451</a></li>
  <li>ML-KEM/ML-DSA part 3: param array locate octet string by <a
  href="https://github.com/swenson"><code>@​swenson</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2458">rust-openssl/rust-openssl#2458</a></li>
  <li>sys: add encoder &amp; decoder symbols by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2454">rust-openssl/rust-openssl#2454</a></li>
  <li>Add bindings for SSL_CIPHER_get_protocol_id by <a
  href="https://github.com/jedenastka"><code>@​jedenastka</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2462">rust-openssl/rust-openssl#2462</a></li>
  <li>sys/evp: add EVP_PKEY_eq and EVP_PKEY_parameters_eq by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2463">rust-openssl/rust-openssl#2463</a></li>
  <li>openssl-sys: make it work without deprecated symbols by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2452">rust-openssl/rust-openssl#2452</a></li>
  <li>drop old libressl versions by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2473">rust-openssl/rust-openssl#2473</a></li>
  <li>Remove support for LibreSSL &lt; 2.8 by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2475">rust-openssl/rust-openssl#2475</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/09b90d036ec5341deefb7fce86748e176379d01a"><code>09b90d0</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2518">#2518</a>
  from alex/bump-for-release</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/26533f3027b893c52f1cbc40263900af57db5311"><code>26533f3</code></a>
  Release openssl v0.10.75 and openssl-sys v0.9.111</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/395eccaa49c9f77da27c64ba94c137b9aa27cc64"><code>395ecca</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2517">#2517</a>
  from alex/claude/fix-ocsp-find-status-011CUqcGFNKeKJ...</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/cc2686771eae1a0dbb8783844aa4553b7f79144a"><code>cc26867</code></a>
  Fix unsound OCSP find_status handling of optional next_update field</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/95aa8e864296ef209ebba037ca6cd826adbda87a"><code>95aa8e8</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2513">#2513</a>
  from botovq/libressl-stable</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/e735a321ffda5b38475c2c6b15f8737115d2cc98"><code>e735a32</code></a>
  CI: bump LibreSSL 4.x branches to latest releases</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/21ab91de2dda42515293dd69278347339453d824"><code>21ab91d</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2510">#2510</a>
  from huwcbjones/huw/sys/evp-mac</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/d9161dcac16361ea79766629b45950da13f2c017"><code>d9161dc</code></a>
  sys/evp: add EVP_MAC symbols</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/3fd4bf2c86e23c1953783d1d29996dfd8dab173f"><code>3fd4bf2</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2508">#2508</a>
  from goffrie/oaep-label</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/52022fd4725d60e59f68f35e148f47158909bc9c"><code>52022fd</code></a>
  Implement set_rsa_oaep_label for AWS-LC/BoringSSL</li>
  <li>Additional commits viewable in <a
  href="https://github.com/rust-openssl/rust-openssl/compare/openssl-sys-v0.9.109...openssl-sys-v0.9.111">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=openssl-sys&package-manager=cargo&previous-version=0.9.109&new-version=0.9.111)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:40:18 -07:00
  b24b7884c7
• chore(deps): bump clap from 4.5.47 to 4.5.53 in /codex-rs (#8414)

  Bumps [clap](https://github.com/clap-rs/clap) from 4.5.47 to 4.5.53.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/clap-rs/clap/releases">clap's
  releases</a>.</em></p>
  <blockquote>
  <h2>v4.5.53</h2>
  <h2>[4.5.53] - 2025-11-19</h2>
  <h3>Features</h3>
  <ul>
  <li>Add <code>default_values_if</code>,
  <code>default_values_ifs</code></li>
  </ul>
  <h2>v4.5.52</h2>
  <h2>[4.5.52] - 2025-11-17</h2>
  <h3>Fixes</h3>
  <ul>
  <li>Don't panic when <code>args_conflicts_with_subcommands</code>
  conflicts with an <code>ArgGroup</code></li>
  </ul>
  <h2>v4.5.51</h2>
  <h2>[4.5.51] - 2025-10-29</h2>
  <h3>Fixes</h3>
  <ul>
  <li><em>(help)</em> Correctly calculate padding for short flags that
  take a value</li>
  <li><em>(help)</em> Don't panic on short flags using
  <code>ArgAction::Count</code></li>
  </ul>
  <h2>v4.5.50</h2>
  <h2>[4.5.50] - 2025-10-20</h2>
  <h3>Features</h3>
  <ul>
  <li>Accept <code>Cow</code> where <code>String</code> and
  <code>&amp;str</code> are accepted</li>
  </ul>
  <h2>v4.5.48</h2>
  <h2>[4.5.48] - 2025-09-19</h2>
  <h3>Documentation</h3>
  <ul>
  <li>Add a new CLI Concepts document as another way of framing clap</li>
  <li>Expand the <code>typed_derive</code> cookbook entry</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/clap-rs/clap/blob/master/CHANGELOG.md">clap's
  changelog</a>.</em></p>
  <blockquote>
  <h2>[4.5.53] - 2025-11-19</h2>
  <h3>Features</h3>
  <ul>
  <li>Add <code>default_values_if</code>,
  <code>default_values_ifs</code></li>
  </ul>
  <h2>[4.5.52] - 2025-11-17</h2>
  <h3>Fixes</h3>
  <ul>
  <li>Don't panic when <code>args_conflicts_with_subcommands</code>
  conflicts with an <code>ArgGroup</code></li>
  </ul>
  <h2>[4.5.51] - 2025-10-29</h2>
  <h3>Fixes</h3>
  <ul>
  <li><em>(help)</em> Correctly calculate padding for short flags that
  take a value</li>
  <li><em>(help)</em> Don't panic on short flags using
  <code>ArgAction::Count</code></li>
  </ul>
  <h2>[4.5.50] - 2025-10-20</h2>
  <h3>Features</h3>
  <ul>
  <li>Accept <code>Cow</code> where <code>String</code> and
  <code>&amp;str</code> are accepted</li>
  </ul>
  <h2>[4.5.49] - 2025-10-13</h2>
  <h3>Fixes</h3>
  <ul>
  <li><em>(help)</em> Correctly wrap when ANSI escape codes are
  present</li>
  </ul>
  <h2>[4.5.48] - 2025-09-19</h2>
  <h3>Documentation</h3>
  <ul>
  <li>Add a new CLI Concepts document as another way of framing clap</li>
  <li>Expand the <code>typed_derive</code> cookbook entry</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/clap-rs/clap/commit/3716f9f4289594b43abec42b2538efd1a90ff897"><code>3716f9f</code></a>
  chore: Release</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/613b69a6b7bff729b7a363fa0c91fd03f48d12c3"><code>613b69a</code></a>
  docs: Update changelog</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/d117f7acdeedebaf5fd7847debb15c834423f159"><code>d117f7a</code></a>
  Merge pull request <a
  href="https://redirect.github.com/clap-rs/clap/issues/6028">#6028</a>
  from epage/arg</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/cb8255d2f3c7f12ebf07ec1c55ac98b6848599a9"><code>cb8255d</code></a>
  feat(builder): Allow quoted id's for arg macro</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/1036060f1319412d3d50d821a7b39a0a0122f0f7"><code>1036060</code></a>
  Merge pull request <a
  href="https://redirect.github.com/clap-rs/clap/issues/6025">#6025</a>
  from AldaronLau/typos-in-faq</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/2fcafc0aee6380e1f0c44a3e927cef1bfc88930e"><code>2fcafc0</code></a>
  docs: Fix minor grammar issues in FAQ</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/a380b65fe9eceade90bce8aeb13c205265fcceee"><code>a380b65</code></a>
  Merge pull request <a
  href="https://redirect.github.com/clap-rs/clap/issues/6023">#6023</a>
  from epage/template</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/4d7ab1483cd0f0849668d274aa2fb6358872eca9"><code>4d7ab14</code></a>
  chore: Update from _rust/main template</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/b8a7ea49d973a35bb6b3f43506b8319f340a20a4"><code>b8a7ea4</code></a>
  chore(deps): Update Rust Stable to v1.87 (<a
  href="https://redirect.github.com/clap-rs/clap/issues/18">#18</a>)</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/f9842b3b3f920ef64c5fc06298b4762018d88809"><code>f9842b3</code></a>
  chore: Avoid MSRV problems out of the box</li>
  <li>Additional commits viewable in <a
  href="https://github.com/clap-rs/clap/compare/clap_complete-v4.5.47...clap_complete-v4.5.53">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=clap&package-manager=cargo&previous-version=4.5.47&new-version=4.5.53)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:39:16 -07:00
  8d5ab97f2b
• chore(deps): bump landlock from 0.4.2 to 0.4.4 in /codex-rs (#8413)

  Bumps [landlock](https://github.com/landlock-lsm/rust-landlock) from
  0.4.2 to 0.4.4.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/landlock-lsm/rust-landlock/releases">landlock's
  releases</a>.</em></p>
  <blockquote>
  <h2>v0.4.4</h2>
  <p>See <a href="https://crates.io/crates/landlock/0.4.4">crate's
  metadata</a> and related <a
  href="https://docs.rs/landlock/0.4.4/landlock/">documentation</a>.</p>
  <h2>What's Changed</h2>
  <p>See summary in <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md#v044">CHANGELOG.md</a></p>
  <ul>
  <li>Bump MSRV to 1.68 by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/112">landlock-lsm/rust-landlock#112</a></li>
  <li>Generate 64-bit and 32-bit bindings by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/111">landlock-lsm/rust-landlock#111</a></li>
  <li>Print hints about Landlock ABI version by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/103">landlock-lsm/rust-landlock#103</a></li>
  <li>Improve LandlockStatus by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/113">landlock-lsm/rust-landlock#113</a></li>
  <li>Bump to v0.4.4 by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/114">landlock-lsm/rust-landlock#114</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/landlock-lsm/rust-landlock/compare/v0.4.3...v0.4.4">https://github.com/landlock-lsm/rust-landlock/compare/v0.4.3...v0.4.4</a></p>
  <h2>v0.4.3</h2>
  <p>See <a href="https://crates.io/crates/landlock/0.4.3">crate's
  metadata</a> and related <a
  href="https://docs.rs/landlock/0.4.3/landlock/">documentation</a>.</p>
  <h2>What's Changed</h2>
  <p>See summary in <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md#v043">CHANGELOG.md</a></p>
  <ul>
  <li>tests: add case for AccessFs::from_file by <a
  href="https://github.com/n0toose"><code>@​n0toose</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/92">landlock-lsm/rust-landlock#92</a></li>
  <li>docs: add more background to PathBeneath example by <a
  href="https://github.com/n0toose"><code>@​n0toose</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/94">landlock-lsm/rust-landlock#94</a></li>
  <li>docs: extend CONTRIBUTING.md file by <a
  href="https://github.com/n0toose"><code>@​n0toose</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/95">landlock-lsm/rust-landlock#95</a></li>
  <li>Implement common traits for public types by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/108">landlock-lsm/rust-landlock#108</a></li>
  <li>Bump to v0.4.3 by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/109">landlock-lsm/rust-landlock#109</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/n0toose"><code>@​n0toose</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/92">landlock-lsm/rust-landlock#92</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/landlock-lsm/rust-landlock/compare/v0.4.2...v0.4.3">https://github.com/landlock-lsm/rust-landlock/compare/v0.4.2...v0.4.3</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md">landlock's
  changelog</a>.</em></p>
  <blockquote>
  <h2><a
  href="https://github.com/landlock-lsm/rust-landlock/releases/tag/v0.4.4">v0.4.4</a></h2>
  <h3>New API</h3>
  <ul>
  <li>Added support for all architectures ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/111">#111</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/111">landlock-lsm/rust-landlock#111</a>)).</li>
  <li>Added <code>LandlockStatus</code> type to query the running kernel
  and display information about available Landlock features ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/103">#103</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/103">landlock-lsm/rust-landlock#103</a>)
  and [PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/113">#113</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/113">landlock-lsm/rust-landlock#113</a>)).</li>
  </ul>
  <h3>Dependencies</h3>
  <ul>
  <li>Bumped MSRV to Rust 1.68 ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/112">#112</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/112">landlock-lsm/rust-landlock#112</a>)).</li>
  </ul>
  <h3>Testing</h3>
  <ul>
  <li>Extended CI to build and test on i686 architecture ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/111">#111</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/111">landlock-lsm/rust-landlock#111</a>)).</li>
  </ul>
  <h3>Example</h3>
  <ul>
  <li>Enhanced sandboxer example to print helpful hints about Landlock
  status ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/103">#103</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/103">landlock-lsm/rust-landlock#103</a>)).</li>
  </ul>
  <h2><a
  href="https://github.com/landlock-lsm/rust-landlock/releases/tag/v0.4.3">v0.4.3</a></h2>
  <h3>New API</h3>
  <ul>
  <li>Implemented common traits (e.g., <code>Debug</code>) for public
  types ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/108">#108</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/108">landlock-lsm/rust-landlock#108</a>)).</li>
  </ul>
  <h3>Documentation</h3>
  <ul>
  <li>Extended <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CONTRIBUTING.md">https://github.com/landlock-lsm/rust-landlock/blob/main/CONTRIBUTING.md</a>
  documentation with additional testing and development guidelines ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/95">#95</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/95">landlock-lsm/rust-landlock#95</a>)).</li>
  <li>Added more background information to <a
  href="https://landlock.io/rust-landlock/landlock/fn.path_beneath_rules.html"><code>path_beneath_rules()</code></a>
  documentation ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/94">#94</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/94">landlock-lsm/rust-landlock#94</a>)).</li>
  </ul>
  <h3>Testing</h3>
  <ul>
  <li>Added test case for <code>AccessFs::from_file()</code> method ([PR
  <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/92">#92</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/92">landlock-lsm/rust-landlock#92</a>)).</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/89c56e2db04cf0a4d63e192e7b4371af516a1ccc"><code>89c56e2</code></a>
  lib: Bump to v0.4.4</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/4fbfbbc4c7d2e6db2642ec44ef1c8a78e7048479"><code>4fbfbbc</code></a>
  compat: Improve LandlockStatus</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/ec5e00b83bd2c6308967174c8910e86853e6b955"><code>ec5e00b</code></a>
  compat,sandboxer: Add LandlockStatus and print hints</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/f79da1808500110fd71f2b80e7ca81770b6bf2df"><code>f79da18</code></a>
  uapi: Generate bindings for all architectures</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/d29be586a50b0278822aee84a420b0cd22607a5b"><code>d29be58</code></a>
  cargo: Bump MSRV to 1.68</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/229f152d86c37e8881ea37dd6e29668f298d9056"><code>229f152</code></a>
  lib: Bump to v0.4.3</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/19f01a99752607e0f6b1872edf86690982c0e920"><code>19f01a9</code></a>
  compat: Implement common traits for public types</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/cb60a12f9b3d7fe55839863e8746ede6c3c77290"><code>cb60a12</code></a>
  contributing: Extend documentation</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/aa4029d129f5db8519027f15a1618c9d79c2e19b"><code>aa4029d</code></a>
  fs: Add more background to path_beneath_rules() doc</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/a7c2b3fe37f2d35f2359c4b1b5152258a474dbb1"><code>a7c2b3f</code></a>
  fs: Add test case for AccessFs::from_file</li>
  <li>See full diff in <a
  href="https://github.com/landlock-lsm/rust-landlock/compare/v0.4.2...v0.4.4">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=landlock&package-manager=cargo&previous-version=0.4.2&new-version=0.4.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:35:23 -07:00
  6c8470953f
• chore(deps): bump test-log from 0.2.18 to 0.2.19 in /codex-rs (#8412)

  Bumps [test-log](https://github.com/d-e-s-o/test-log) from 0.2.18 to
  0.2.19.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/d-e-s-o/test-log/releases">test-log's
  releases</a>.</em></p>
  <blockquote>
  <h2>v0.2.19</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Adjusted <code>tracing</code> output to log to
  <code>stderr</code></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/dbdr"><code>@​dbdr</code></a> made their
  first contribution in <a
  href="https://redirect.github.com/d-e-s-o/test-log/pull/64">d-e-s-o/test-log#64</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/d-e-s-o/test-log/compare/v0.2.18...v0.2.19">https://github.com/d-e-s-o/test-log/compare/v0.2.18...v0.2.19</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/d-e-s-o/test-log/blob/main/CHANGELOG.md">test-log's
  changelog</a>.</em></p>
  <blockquote>
  <h2>0.2.19</h2>
  <ul>
  <li>Adjusted <code>tracing</code> output to log to
  <code>stderr</code></li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/b4cd4a3ab6cb86ff3729189fd2d7fbc3628943f6"><code>b4cd4a3</code></a>
  Bump version to 0.2.19</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/bafe834fe78c71b0472a1ff2f050a1d39f715e20"><code>bafe834</code></a>
  Emit tracing output to stderr</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/9e7aafbdcce972b9fd9c9bdb2dcfd4869dfd4a77"><code>9e7aafb</code></a>
  Bump actions/checkout from 5 to 6</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/7fc59759d8e27146cf90f8f858c900094c90a509"><code>7fc5975</code></a>
  Suggest using [dev-dependencies] instead of [dependencies] in
  README.md</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/25e7c367e6f106fdb92cc1f68d166d2a8bc7aa78"><code>25e7c36</code></a>
  Bump actions/checkout from 4 to 5</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/b6339268716592ee65db1cdb549c93b1b28d4404"><code>b633926</code></a>
  Address clippy reported issue</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/628feeea5abe02fbed854a6c201b8dfc84613787"><code>628feee</code></a>
  Don't specify patch level for dev-dependencies</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/d1a217e2e464905a3cddaa569d2382decf439df8"><code>d1a217e</code></a>
  Update rstest requirement from 0.25.0 to 0.26.1</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/a2c6ba206eee3ca7d8286b353a70f70318ff824a"><code>a2c6ba2</code></a>
  Document private items in documentation CI job</li>
  <li>See full diff in <a
  href="https://github.com/d-e-s-o/test-log/compare/v0.2.18...v0.2.19">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=test-log&package-manager=cargo&previous-version=0.2.18&new-version=0.2.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:34:39 -07:00
  334dbe51c6
• chore(deps): bump peter-evans/create-pull-request from 7 to 8 (#8410)

  Bumps
  [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
  from 7 to 8.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
  releases</a>.</em></p>
  <blockquote>
  <h2>Create Pull Request v8.0.0</h2>
  <h2>What's new in v8</h2>
  <ul>
  <li>Requires <a
  href="https://github.com/actions/runner/releases/tag/v2.327.1">Actions
  Runner v2.327.1</a> or later if you are using a self-hosted runner for
  Node 24 support.</li>
  </ul>
  <h2>What's Changed</h2>
  <ul>
  <li>chore: Update checkout action version to v6 by <a
  href="https://github.com/yonas"><code>@​yonas</code></a> in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4258">peter-evans/create-pull-request#4258</a></li>
  <li>Update actions/checkout references to <a
  href="https://github.com/v6"><code>@​v6</code></a> in docs by <a
  href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4259">peter-evans/create-pull-request#4259</a></li>
  <li>feat: v8 by <a
  href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
  <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4260">peter-evans/create-pull-request#4260</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/yonas"><code>@​yonas</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4258">peter-evans/create-pull-request#4258</a></li>
  <li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4259">peter-evans/create-pull-request#4259</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/peter-evans/create-pull-request/compare/v7.0.11...v8.0.0">https://github.com/peter-evans/create-pull-request/compare/v7.0.11...v8.0.0</a></p>
  <h2>Create Pull Request v7.0.11</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>fix: restrict remote prune to self-hosted runners by <a
  href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
  <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4250">peter-evans/create-pull-request#4250</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/peter-evans/create-pull-request/compare/v7.0.10...v7.0.11">https://github.com/peter-evans/create-pull-request/compare/v7.0.10...v7.0.11</a></p>
  <h2>Create Pull Request v7.0.10</h2>
  <p>⚙️ Fixes an issue where updating a pull request failed when targeting
  a forked repository with the same owner as its parent.</p>
  <h2>What's Changed</h2>
  <ul>
  <li>build(deps): bump the github-actions group with 2 updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
  in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4235">peter-evans/create-pull-request#4235</a></li>
  <li>build(deps-dev): bump prettier from 3.6.2 to 3.7.3 in the npm group
  by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
  in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4240">peter-evans/create-pull-request#4240</a></li>
  <li>fix: provider list pulls fallback for multi fork same owner by <a
  href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
  <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4245">peter-evans/create-pull-request#4245</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/obnyis"><code>@​obnyis</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4064">peter-evans/create-pull-request#4064</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/peter-evans/create-pull-request/compare/v7.0.9...v7.0.10">https://github.com/peter-evans/create-pull-request/compare/v7.0.9...v7.0.10</a></p>
  <h2>Create Pull Request v7.0.9</h2>
  <p>⚙️ Fixes an <a
  href="https://redirect.github.com/peter-evans/create-pull-request/issues/4228">incompatibility</a>
  with the recently released <code>actions/checkout@v6</code>.</p>
  <h2>What's Changed</h2>
  <ul>
  <li>~70 dependency updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
  <li>docs: fix workaround description about <code>ready_for_review</code>
  by <a href="https://github.com/ybiquitous"><code>@​ybiquitous</code></a>
  in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/3939">peter-evans/create-pull-request#3939</a></li>
  <li>Docs: <code>add-paths</code> default behavior by <a
  href="https://github.com/joeflack4"><code>@​joeflack4</code></a> in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/3928">peter-evans/create-pull-request#3928</a></li>
  <li>docs: update to create-github-app-token v2 by <a
  href="https://github.com/Goooler"><code>@​Goooler</code></a> in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4063">peter-evans/create-pull-request#4063</a></li>
  <li>Fix compatibility with actions/checkout@v6 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4230">peter-evans/create-pull-request#4230</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/joeflack4"><code>@​joeflack4</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/3928">peter-evans/create-pull-request#3928</a></li>
  <li><a href="https://github.com/Goooler"><code>@​Goooler</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4063">peter-evans/create-pull-request#4063</a></li>
  <li><a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/peter-evans/create-pull-request/pull/4230">peter-evans/create-pull-request#4230</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/peter-evans/create-pull-request/commit/98357b18bf14b5342f975ff684046ec3b2a07725"><code>98357b1</code></a>
  feat: v8 (<a
  href="https://redirect.github.com/peter-evans/create-pull-request/issues/4260">#4260</a>)</li>
  <li><a
  href="https://github.com/peter-evans/create-pull-request/commit/41c0e4b7899a4a0922bf899d64c5f25738cfe356"><code>41c0e4b</code></a>
  Update actions/checkout references to <a
  href="https://github.com/v6"><code>@​v6</code></a> in docs (<a
  href="https://redirect.github.com/peter-evans/create-pull-request/issues/4259">#4259</a>)</li>
  <li><a
  href="https://github.com/peter-evans/create-pull-request/commit/994332de4c8124517167807167073cf397678768"><code>994332d</code></a>
  chore: Update checkout action version to v6 (<a
  href="https://redirect.github.com/peter-evans/create-pull-request/issues/4258">#4258</a>)</li>
  <li>See full diff in <a
  href="https://github.com/peter-evans/create-pull-request/compare/v7...v8">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=peter-evans/create-pull-request&package-manager=github_actions&previous-version=7&new-version=8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:31:58 -07:00
  5a0b5d1bd1
• chore: drop undo from the docs (#8431)
  jif-oai · 2025-12-22 15:09:48 +00:00
  45727b9ed3
• docs: add developer_instructions config option and update descriptions (#8376)

  Updates the configuration documentation to clarify and improve the
  description of the `developer_instructions` and `instructions` fields.
  
  Documentation updates:
  
  * Added a description for the `developer_instructions` field in
  `docs/config.md`, clarifying that it provides additional developer
  instructions.
  * Updated the comments in `docs/example-config.md` to specify that
  `developer_instructions` is injected before `AGENTS.md`, and clarified
  that the `instructions` field is ignored and that `AGENTS.md` is
  preferred.
  
  ___
  
  ref #7973 
  
  Thanks to @miraclebakelaser for the message. I have double-confirmed
  that developer instructions are always injected before user
  instructions. According to the source code
  [codex_core::codex::Session::build_initial_context](https://github.com/openai/codex/blob/rust-v0.77.0-alpha.2/codex-rs/core/src/codex.rs#L1279),
  we can see the specific order of these instructions.

  Robby He · 2025-12-22 07:37:37 -07:00
  372de6d2c5
• chore: un-ship undo (#8424)
  jif-oai · 2025-12-22 09:53:03 +01:00
  7a8407bbb6
• fix(tui2): constrain transcript mouse selection bounds (#8419)

  Ignore mouse events outside the transcript region so composer/footer
  interactions do not start or mutate transcript selection state.
  
  A left-click outside the transcript also cancels any active selection.
  Selection changes schedule a redraw because mouse events don't
  inherently trigger a frame.

  Josh McKinney · 2025-12-22 00:11:36 -08:00
  4e6d6cd798
• test(tui2): re-enable ANSI for VT100 tests (#8423)

  Codex Unified Exec injects NO_COLOR=1 (and TERM=dumb) into shell tool
  commands to keep output stable. Crossterm respects NO_COLOR and
  suppresses ANSI escapes, which breaks our VT100-backed tests that assert
  on parsed ANSI color output (they see vt100::Color::Default everywhere).
  
  Force ANSI color output back on in the VT100 test backend by overriding
  crossterm's memoized NO_COLOR setting in VT100Backend::new. This keeps
  Unified Exec behavior unchanged while making the VT100 tests meaningful
  and deterministic under Codex.
  
  > [!WARNING]  
  > it's possible that this might be a race condition problem for this and
  need to be solved a different way. Feel free to revert if it causes the
  opposite problem for other tests that assume NOCOLOR is set. If it does
  then we need to probably add some extra AGENTS.md lines for how to run
  tests when using unified exec.
  
  (this same change was made in tui, so it's probably safe).

  Josh McKinney · 2025-12-22 00:00:32 -08:00
  3c353a3aca
• Update ghost_commit flag reference to undo (#8091)

  Minor documentation update to fix #7966 (documentation of undo flag).

  Charlie Weems · 2025-12-21 23:27:54 -08:00
  99cbba8ea5
• fix: do not panic on alphas (#8406)

  alphas are used sometimes as stable release

  Ahmed Ibrahim · 2025-12-22 00:20:53 +00:00
  aa83d7da24
• Point skills docs to developer documentation site (#8407)
  Eric Traut · 2025-12-21 16:18:58 -08:00
  d281bcfcd4
• Remove plan from system skills (#8374)

  Removes plan from system skills. It has been rewritten into
  `create-plan` for evaluation and feedback:
  https://github.com/openai/skills/pull/22

  Gav Verma · 2025-12-20 19:42:53 -08:00
  fab1ded484
• Chore: remove rmcp feature and exp flag usages (#8087)

  ### Summary
  With codesigning on Mac, Windows and Linux, we should be able to safely
  remove `features.rmcp_client` and `use_experimental_use_rmcp_client`
  check from the codebase now.

  Shijie Rao · 2025-12-20 14:18:00 -08:00
  987dd7fde3
• feat(tui2): tune scrolling inpu based on (#8357)

  ## TUI2: Normalize Mouse Scroll Input Across Terminals (Wheel +
  Trackpad)
  
  This changes TUI2 scrolling to a stream-based model that normalizes
  terminal scroll event density into consistent wheel behavior (default:
  ~3 transcript lines per physical wheel notch) while keeping trackpad
  input higher fidelity via fractional accumulation.
  
  Primary code: `codex-rs/tui2/src/tui/scrolling/mouse.rs`
  
  Doc of record (model + probe-derived data):
  `codex-rs/tui2/docs/scroll_input_model.md`
  
  ### Why
  
  Terminals encode both mouse wheels and trackpads as discrete scroll
  up/down events with direction but no magnitude, and they vary widely in
  how many raw events they emit per physical wheel notch (commonly 1, 3,
  or 9+). Timing alone doesn’t reliably distinguish wheel vs trackpad, so
  cadence-based heuristics are unstable across terminals/hardware.
  
  This PR treats scroll input as short *streams* separated by silence or
  direction flips, normalizes raw event density into tick-equivalents,
  coalesces redraws for dense streams, and exposes explicit config
  overrides.
  
  ### What Changed
  
  #### Scroll Model (TUI2)
  
  - Stream detection
    - Start a stream on the first scroll event.
    - End a stream on an idle gap (`STREAM_GAP_MS`) or a direction flip.
  - Normalization
  - Convert raw events into tick-equivalents using per-terminal
  `tui.scroll_events_per_tick`.
  - Wheel-like vs trackpad-like behavior
  - Wheel-like: fixed “classic” lines per wheel notch; flush immediately
  for responsiveness.
  - Trackpad-like: fractional accumulation + carry across stream
  boundaries; coalesce flushes to ~60Hz to avoid floods and reduce “stop
  lag / overshoot”.
  - Trackpad divisor is intentionally capped: `min(scroll_events_per_tick,
  3)` so terminals with dense wheel ticks (e.g. 9 events per notch) don’t
  make trackpads feel artificially slow.
  - Auto mode (default)
    - Start conservatively as trackpad-like (avoid overshoot).
  - Promote to wheel-like if the first tick-worth of events arrives
  quickly.
  - Fallback for 1-event-per-tick terminals (no tick-completion timing
  signal).
  
  #### Trackpad Acceleration
  
  Some terminals produce relatively low vertical event density for
  trackpad gestures, which makes large/faster swipes feel sluggish even
  when small motions feel correct. To address that, trackpad-like streams
  apply a bounded multiplier based on event count:
  
  - `multiplier = clamp(1 + abs(events) / scroll_trackpad_accel_events,
  1..scroll_trackpad_accel_max)`
  
  The multiplier is applied to the trackpad stream’s computed line delta
  (including carried fractional remainder). Defaults are conservative and
  bounded.
  
  #### Config Knobs (TUI2)
  
  All keys live under `[tui]`:
  
  - `scroll_wheel_lines`: lines per physical wheel notch (default: 3).
  - `scroll_events_per_tick`: raw vertical scroll events per physical
  wheel notch (terminal-specific default; fallback: 3).
  - Wheel-like per-event contribution: `scroll_wheel_lines /
  scroll_events_per_tick`.
  - `scroll_trackpad_lines`: baseline trackpad sensitivity (default: 1).
  - Trackpad-like per-event contribution: `scroll_trackpad_lines /
  min(scroll_events_per_tick, 3)`.
  - `scroll_trackpad_accel_events` / `scroll_trackpad_accel_max`: bounded
  trackpad acceleration (defaults: 30 / 3).
  - `scroll_mode = auto|wheel|trackpad`: force behavior or use the
  heuristic (default: `auto`).
  - `scroll_wheel_tick_detect_max_ms`: auto-mode promotion threshold (ms).
  - `scroll_wheel_like_max_duration_ms`: auto-mode fallback for
  1-event-per-tick terminals (ms).
  - `scroll_invert`: invert scroll direction (applies to wheel +
  trackpad).
  
  Config docs: `docs/config.md` and field docs in
  `codex-rs/core/src/config/types.rs`.
  
  #### App Integration
  
  - The app schedules follow-up ticks to close idle streams (via
  `ScrollUpdate::next_tick_in` and `schedule_frame_in`) and finalizes
  streams on draw ticks.
    - `codex-rs/tui2/src/app.rs`
  
  #### Docs
  
  - Single doc of record describing the model + preserved probe
  findings/spec:
    - `codex-rs/tui2/docs/scroll_input_model.md`
  
  #### Other (jj-only friendliness)
  
  - `codex-rs/tui2/src/diff_render.rs`: prefer stable cwd-relative paths
  when the file is under the cwd even if there’s no `.git`.
  
  ### Terminal Defaults
  
  Per-terminal defaults are derived from scroll-probe logs (see doc).
  Notable:
  
  - Ghostty currently defaults to `scroll_events_per_tick = 3` even though
  logs measured ~9 in one setup. This is a deliberate stopgap; if your
  Ghostty build emits ~9 events per wheel notch, set:
  
    ```toml
    [tui]
    scroll_events_per_tick = 9
    ```
  
  ### Testing
  
  - `just fmt`
  - `just fix -p codex-core --allow-no-vcs`
  - `cargo test -p codex-core --lib` (pass)
  - `cargo test -p codex-tui2` (scroll tests pass; remaining failures are
  known flaky VT100 color tests in `insert_history`)
  
  ### Review Focus
  
  - Stream finalization + frame scheduling in `codex-rs/tui2/src/app.rs`.
  - Auto-mode promotion thresholds and the 1-event-per-tick fallback
  behavior.
  - Trackpad divisor cap (`min(events_per_tick, 3)`) and acceleration
  defaults.
  - Ghostty default tradeoff (3 vs ~9) and whether we should change it.

  Josh McKinney · 2025-12-20 12:48:12 -08:00
  63942b883c
• chore: enusre the logic that creates ConfigLayerStack has access to cwd (#8353)

  `load_config_layers_state()` should load config from a
  `.codex/config.toml` in any folder between the `cwd` for a thread and
  the project root. Though in order to do that,
  `load_config_layers_state()` needs to know what the `cwd` is, so this PR
  does the work to thread the `cwd` through for existing callsites.
  
  A notable exception is the `/config` endpoint in app server for which a
  `cwd` is not guaranteed to be associated with the query, so the `cwd`
  param is `Option<AbsolutePathBuf>` to account for this case.
  
  The logic to make use of the `cwd` will be done in a follow-up PR.

  Michael Bolin · 2025-12-19 20:11:27 -08:00
  a6974087e5
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• bump cargo-deny-action ver (#8345)
  sayan-oai · 2025-12-19 15:23:02 -08:00
  797a68b9f2
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• feat: move file name derivation into codex-file-search (#8334)

  ## Summary
  
    - centralize file name derivation in codex-file-search
    - reuse the helper in app-server fuzzy search to avoid duplicate logic
    - add unit tests for file_name_from_path
  
    ## Testing
  
    - cargo test -p codex-file-search
    - cargo test -p codex-app-server

  RQfreefly · 2025-12-19 12:50:55 -08:00
  ec3738b47e
• feat(tui2): coalesce transcript scroll redraws (#8295)

  Problem
  - Mouse wheel events were scheduling a redraw on every event, which
  could backlog and create lag during fast scrolling.
  
  Solution
  - Schedule transcript scroll redraws with a short delay (16ms) so the
  frame requester coalesces bursts into fewer draws.
  
  Why
  - Smooths rapid wheel scrolling while keeping the UI responsive.
  
  Testing
  - Manual: Scrolled in iTerm and Ghostty; no lag observed.
  - `cargo clippy --fix --all-features --tests --allow-dirty
  --allow-no-vcs -p codex-tui2`

  Josh McKinney · 2025-12-19 12:19:01 -08:00
  1d4463ba81
• Update models.json (#8168)

  Automated update of models.json.
  
  Co-authored-by: aibrahim-oai <219906144+aibrahim-oai@users.noreply.github.com>

  github-actions[bot] · 2025-12-19 12:06:34 -08:00
  e3d3445748
• fix: enable resume_warning that was missing from mod.rs (#8333)

  This test was introduced in https://github.com/openai/codex/pull/6507,
  but was not included in `mod.rs`. It does not appear that it was getting
  compiled?

  Michael Bolin · 2025-12-19 19:21:47 +00:00
  0a7021de72
• feat: make ConstraintError an enum (#8330)

  This will make it easier to test for expected errors in unit tests since
  we can compare based on the field values rather than the message (which
  might change over time). See https://github.com/openai/codex/pull/8298
  for an example.
  
  It also ensures more consistency in the way a `ConstraintError` is
  constructed.

  Michael Bolin · 2025-12-19 19:03:50 +00:00
  7e5c343ef5
• Fix: /undo destructively interacts with git staging (#8214) (#8303)

  Fixes #8214 by removing the '--staged' flag from the undo git restore
  command. This ensures that while the working tree is reverted to the
  snapshot state, the user's staged changes (index) are preserved,
  preventing data loss. Also adds a regression test.

  GalaxyDetective · 2025-12-19 10:07:41 -08:00
  014235f533
• Fix link to contributing.md in experimental.md (#8311)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  jdijk-deventit · 2025-12-19 09:42:56 -08:00
  b15b5082c6
• Update system skills from OSS repo (#8328)

  https://github.com/openai/skills/tree/main/skills/.system

  Gav Verma · 2025-12-19 09:31:04 -08:00
  37071e7e5c
• Revert "Keep skills feature flag default OFF for windows." (#8325)

  Reverts openai/codex#8308

  xl-openai · 2025-12-19 16:22:14 +00:00
  eeda6a5004
• Keep skills feature flag default OFF for windows. (#8308)

  Keep windows OFF first.

  xl-openai · 2025-12-18 21:57:15 -08:00
  6f94a90797
• Fix admin skills. (#8305)

  We were assembling the skill roots in two different places, and the
  admin root was missing in one of them. This change centralizes root
  selection into a helper so both paths stay in sync.

  xl-openai · 2025-12-19 04:10:19 +00:00
  339b052d68
• Add short descriptions to system skills (#8301)
  Gav Verma · 2025-12-19 02:44:53 +00:00
  f4371d2f6c
• Support admin scope skills. (#8296)

  a new scope reads from /etc/codex

  xl-openai · 2025-12-19 02:28:56 +00:00
  8120c8765b
• skills feature default on. (#8297)

  skills default on.

  xl-openai · 2025-12-18 18:26:46 -08:00
  d35337227a
• Fix tests (#8299)

  Fix broken tests.

  xl-openai · 2025-12-19 02:07:23 +00:00
  ba835c3c36
• UI tweaks on skills popup. (#8250)

  Only display the skill name (not the folder), and truncate the skill
  description to a maximum of two lines.

  xl-openai · 2025-12-19 01:16:51 +00:00
  dcc01198e2
• feat: collapse "waiting" of unified_exec (#8257)

  Screenshots here but check the snapshot files to see it better
  <img width="712" height="408" alt="Screenshot 2025-12-18 at 11 58 02"
  src="https://github.com/user-attachments/assets/84a2c410-0767-4870-84d1-ae1c0d4c445e"
  />
  <img width="523" height="352" alt="Screenshot 2025-12-18 at 11 17 41"
  src="https://github.com/user-attachments/assets/d029c7ea-0feb-4493-9dca-af43a0c70c52"
  />

  jif-oai · 2025-12-18 17:03:43 -08:00
  6c76d17713
• feat: introduce ExternalSandbox policy (#8290)

  ## Description
  
  Introduced `ExternalSandbox` policy to cover use case when sandbox
  defined by outside environment, effectively it translates to
  `SandboxMode#DangerFullAccess` for file system (since sandbox configured
  on container level) and configurable `network_access` (either Restricted
  or Enabled by outside environment).
  
  as example you can configure `ExternalSandbox` policy as part of
  `sendUserTurn` v1 app_server API:
  
  ```
   {
              "conversationId": <id>,
              "cwd": <cwd>,
              "approvalPolicy": "never",
              "sandboxPolicy": {
                    "type": ""external-sandbox",
                    "network_access": "enabled"/"restricted"
              },
              "model": <model>,
              "effort": <effort>,
              ....
          }
  ```

  Anton Panasenko · 2025-12-18 17:02:03 -08:00
  3429de21b3
• chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder (#8276)

  https://github.com/openai/codex/pull/8235 introduced `ConfigBuilder` and
  this PR updates all call non-test call sites to use it instead of
  `Config::load_from_base_config_with_overrides()`.
  
  This is important because `load_from_base_config_with_overrides()` uses
  an empty `ConfigRequirements`, which is a reasonable default for testing
  so the tests are not influenced by the settings on the host. This method
  is now guarded by `#[cfg(test)]` so it cannot be used by business logic.
  
  Because `ConfigBuilder::build()` is `async`, many of the test methods
  had to be migrated to be `async`, as well. On the bright side, this made
  it possible to eliminate a bunch of `block_on_future()` stuff.

  Michael Bolin · 2025-12-18 16:12:52 -08:00
  3d4ced3ff5
• fix: remove duplicate shell_snapshot FeatureSpec (#8274)

  regression: #8199
  
  Signed-off-by: Koichi Shiraishi <zchee.io@gmail.com>

  Koichi Shiraishi · 2025-12-18 15:55:47 -08:00
  2d9826098e
• fix: change codex/sandbox-state/update from a notification to a request (#8142)

  Historically, `accept_elicitation_for_prompt_rule()` was flaky because
  we were using a notification to update the sandbox followed by a `shell`
  tool request that we expected to be subject to the new sandbox config,
  but because [rmcp](https://crates.io/crates/rmcp) MCP servers delegate
  each incoming message to a new Tokio task, messages are not guaranteed
  to be processed in order, so sometimes the `shell` tool call would run
  before the notification was processed.
  
  Prior to this PR, we relied on a generous `sleep()` between the
  notification and the request to reduce the change of the test flaking
  out.
  
  This PR implements a proper fix, which is to use a _request_ instead of
  a notification for the sandbox update so that we can wait for the
  response to the sandbox request before sending the request to the
  `shell` tool call. Previously, `rmcp` did not support custom requests,
  but I fixed that in
  https://github.com/modelcontextprotocol/rust-sdk/pull/590, which made it
  into the `0.12.0` release (see #8288).
  
  This PR updates `shell-tool-mcp` to expect
  `"codex/sandbox-state/update"` as a _request_ instead of a notification
  and sends the appropriate ack. Note this behavior is tied to our custom
  `codex/sandbox-state` capability, which Codex honors as an MCP client,
  which is why `core/src/mcp_connection_manager.rs` had to be updated as
  part of this PR, as well.
  
  This PR also updates the docs at `shell-tool-mcp/README.md`.

  Michael Bolin · 2025-12-18 15:32:01 -08:00
  46baedd7cb
• Support skills shortDescription. (#8278)

  Allow SKILL.md to specify a more human-readable short description as
  skill metadata.

  xl-openai · 2025-12-18 23:13:18 +00:00
  358a5baba0
• Update system skills bundled with codex-rs (#8253)

  Synced with https://github.com/openai/skills/tree/main/skills/.system

  Gav Verma · 2025-12-18 14:30:00 -08:00
  1cd1cf17c6
• chore: upgrade rmcp crate from 0.10.0 to 0.12.0 (#8288)

  Version `0.12.0` includes
  https://github.com/modelcontextprotocol/rust-sdk/pull/590, which I will
  use in https://github.com/openai/codex/pull/8142.
  
  Changes:
  
  - `rmcp::model::CustomClientNotification` was renamed to
  `rmcp::model::CustomNotification`
  - a bunch of types have a `meta` field now, but it is `Option`, so I
  added `meta: None` to a bunch of things

  Michael Bolin · 2025-12-18 14:28:46 -08:00
  53f53173a8
• Set exclude to true by default in app server (#8281)
  Andrew Ambrosino · 2025-12-18 14:28:30 -08:00
  9fb9ed6cea
• model list (#8286)

  <img width="200" alt="7ff2254b-e96f-42fc-8232-b4e76cb26248"
  src="https://github.com/user-attachments/assets/1f56799d-e2cd-4b69-9290-854943f7c6b6"
  />

  pakrym-oai · 2025-12-18 14:13:49 -08:00
  8f0b383621
• feat(app-server): add v2 deprecation notice (#8285)

  Add a v2 event for deprecation notices so we can get rid of
  `codex/event/deprecation_notice`.

  Owen Lin · 2025-12-18 21:45:36 +00:00
  d7ae342ff4
• feat: add support for /etc/codex/requirements.toml on UNIX (#8277)

  This implements the new config design where config _requirements_ are
  loaded separately (and with a special schema) as compared to config
  _settings_. In particular, on UNIX, with this PR, you could define
  `/etc/codex/requirements.toml` with:
  
  ```toml
  allowed_approval_policies = ["never", "on-request"]
  ```
  
  to enforce that `Config.approval_policy` must be one of those two values
  when Codex runs.
  
  We plan to expand the set of things that can be restricted by
  `/etc/codex/requirements.toml` in short order.
  
  Note that requirements can come from several sources:
  
  - new MDM key on macOS (not implemented yet)
  - `/etc/codex/requirements.toml`
  - re-interpretation of legacy MDM key on macOS
  (`com.openai.codex/config_toml_base64`)
  - re-interpretation of legacy `/etc/codex/managed_config.toml`
  
  So our resolution strategy is to load TOML data from those sources, in
  order. Later TOMLs are "merged" into previous TOMLs, but any field that
  is already set cannot be overwritten. See
  `ConfigRequirementsToml::merge_unset_fields()`.

  Michael Bolin · 2025-12-18 13:36:55 -08:00
  2f048f2063
• feat: add /ps (#8279)

  See snapshots for view of edge cases
  This is still named `UnifiedExecSessions` for consistency across the
  code but should be renamed to `BackgroundTerminals` in a follow-up
  
  Example:
  <img width="945" height="687" alt="Screenshot 2025-12-18 at 20 12 53"
  src="https://github.com/user-attachments/assets/92f39ff2-243c-4006-b402-e3fa9e93c952"
  />

  jif-oai · 2025-12-18 21:09:06 +00:00
  4fb0b547d6