Commit Graph

683 Commits

Author SHA1 Message Date
Thibault Sottiaux
c81e1477ae fix: improve custom prompt documentation and actually use prompt descriptions (#5332)
Expand the custom prompts documentation and link it from other guides. Show saved prompt metadata in the slash-command popup, with tests covering description fallbacks.
2025-10-18 15:58:31 -07:00
kh.ai
32eb5adfd3 tui: dedupe/group bugs before risk rerank; normalize+filter pre and post rerank
- Move dedup step ahead of risk rerank to avoid redundant rerank and improve grouping
- Normalize severities before dedup; filter to High/Medium/Low
- After rerank, re-normalize, rewrite severity in markdown, and filter again if needed
- Minor fix in triage_chunk log initialization

Tests: cargo test -p codex-tui (passed)
2025-10-18 14:37:41 -07:00
Thibault Sottiaux
11c019d6c5 fix: handle missing resume session id gracefully (#5329)
Exit when a requested resume session is missing after restoring the
terminal and print a helpful message instructing users how to resume
existing sessions.

Partially addresses #5247.
2025-10-18 11:55:24 -07:00
kh.ai
ea2246082d Improve security review markdown polishing retries 2025-10-17 20:07:42 -07:00
MomentDerek
98c6dfa537 fix: diff_buffers clear-to-end when deleting wide graphemes (#4921)
Fixes #4870  #4717 #3260 #4431 #2718 #4898 #5036

- Fix the chat composer “phantom space” bug that appeared when
backspacing CJK (and other double-width) characters after the composer
got a uniform background in 43b63ccae89c….
- Pull diff_buffers’s clear-to-end logic forward to iterate by display
width, so wide graphemes are counted correctly when computing the
trailing column.
- Keep modifier-aware detection so styled cells are still flushed, and
add a regression test (diff_buffers_clear_to_end_starts_after_wide_char)
that covers the CJK deletion scenario.

---------

Co-authored-by: Josh McKinney <joshka@openai.com>
2025-10-17 19:03:36 -07:00
kh.ai
2b2577144c Sync bug markdown with reranked severity 2025-10-17 18:25:53 -07:00
kh.ai
633be44842 Add security review follow-up prompts 2025-10-17 17:55:26 -07:00
Thibault Sottiaux
0e08dd6055 fix: switch rate limit reset handling to timestamps (#5304)
This change ensures that we store the absolute time instead of relative
offsets of when the primary and secondary rate limits will reset.
Previously these got recalculated relative to current time, which leads
to the displayed reset times to change over time, including after doing
a codex resume.

For previously changed sessions, this will cause the reset times to not
show due to this being a breaking change:
<img width="524" height="55" alt="Screenshot 2025-10-17 at 5 14 18 PM"
src="https://github.com/user-attachments/assets/53ebd43e-da25-4fef-9c47-94a529d40265"
/>

Fixes https://github.com/openai/codex/issues/4761
2025-10-17 17:39:37 -07:00
kh.ai
eb5b793ea2 wip 2025-10-17 14:55:46 -07:00
kh.ai
c0ccfeea76 Enhance auto scope keyword expansion 2025-10-17 14:52:36 -07:00
Gabriel Peal
6b0c486861 [MCP] Render full MCP errors to the model (#5298)
Previously, the model couldn't see why MCP tool calls failed, many of
which were the model using the parameters incorrectly. A common failure
is the model stringifying the json for the notion-update-page tool which
it then couldn't correct.

I want to do some system prompt massaging around this as well. However,
it is crucial that the model sees the error so it can fix it.

Before:
<img width="2984" height="832" alt="CleanShot 2025-10-17 at 13 02 36"
src="https://github.com/user-attachments/assets/709a3d27-b71b-4d8d-87b6-9b2d7fe4e6f2"
/>

After:
<img width="2488" height="1550" alt="CleanShot 2025-10-17 at 13 01 18"
src="https://github.com/user-attachments/assets/13a0b7dc-fdad-4996-bf2d-0772872c34fc"
/>

🎉 
<img width="1078" height="568" alt="CleanShot 2025-10-17 at 13 09 30"
src="https://github.com/user-attachments/assets/64cde8be-9e6c-4e61-b971-c2ba22504292"
/>


Fixes #4707
2025-10-17 17:47:50 -04:00
kh.ai
6040759357 Improve security review markdown outputs 2025-10-17 12:20:50 -07:00
kh.ai
62cedda883 Add security review follow-up flow 2025-10-17 12:17:40 -07:00
kh.ai
0b8a3ecc19 Reword bug-sweep autoscope prompt to focus on critical code paths 2025-10-17 11:23:04 -07:00
kh.ai
a915190b38 Cap auto-scope suggestions to up to 20 directories 2025-10-17 11:20:59 -07:00
kh.ai
b567e5628d Fix inline report markdown encoding 2025-10-17 11:15:23 -07:00
kh.ai
3a90a112c4 Detect abbreviations in auto-scope prompts 2025-10-17 10:24:45 -07:00
kh.ai
ad88013ac4 Provide default auto-scope prompt and confirmation dialog 2025-10-17 10:20:52 -07:00
kh.ai
1cf533496d Restore auto-scope confirmation dialog 2025-10-17 10:11:15 -07:00
kh.ai
33e1730cd7 Inline security report viewer JS deps 2025-10-17 10:08:33 -07:00
kh.ai
e4cbd96b04 Auto-scope confirmation now displays LLM-chosen directories directly 2025-10-17 10:01:51 -07:00
kh.ai
23169b8a96 Improve default autoscope prompts for scoped reviews 2025-10-17 09:51:25 -07:00
kh.ai
9f091e7b37 Allow cancelling in-progress security review with Ctrl-C 2025-10-17 09:38:17 -07:00
kh.ai
b6bdc7292b Default scoped review prompts when no paths provided 2025-10-17 09:32:42 -07:00
kh.ai
226ef2e7d5 Restrict security review autoscope to scoped options 2025-10-17 09:28:32 -07:00
kh.ai
c2a6347cdc Provide default scope prompts for auto scope confirmation 2025-10-17 09:22:56 -07:00
kh.ai
88ccfb46b7 Restore /secreview command and security review UI 2025-10-17 09:07:52 -07:00
Michael Bolin
50f53e7071 feat: add path field to ParsedCommand::Read variant (#5275)
`ParsedCommand::Read` has a `name` field that attempts to identify the
name of the file being read, but the file may not be in the `cwd` in
which the command is invoked as demonstrated by this existing unit test:


0139f6780c/codex-rs/core/src/parse_command.rs (L250-L260)

As you can see, `tui/Cargo.toml` is the relative path to the file being
read.

This PR introduces a new `path: PathBuf` field to `ParsedCommand::Read`
that attempts to capture this information. When possible, this is an
absolute path, though when relative, it should be resolved against the
`cwd` that will be used to run the command to derive the absolute path.

This should make it easier for clients to provide UI for a "read file"
event that corresponds to the command execution.
2025-10-17 06:19:54 +00:00
Gabriel Peal
40fba1bb4c [MCP] Add support for resources (#5239)
This PR adds support for [MCP
resources](https://modelcontextprotocol.io/specification/2025-06-18/server/resources)
by adding three new tools for the model:
1. `list_resources`
2. `list_resource_templates`
3. `read_resource`

These 3 tools correspond to the [three primary MCP resource protocol
messages](https://modelcontextprotocol.io/specification/2025-06-18/server/resources#protocol-messages).

Example of listing and reading a GitHub resource tempalte
<img width="2984" height="804" alt="CleanShot 2025-10-15 at 17 31 10"
src="https://github.com/user-attachments/assets/89b7f215-2e2a-41c5-90dd-b932ac84a585"
/>

`/mcp` with Figma configured
<img width="2984" height="442" alt="CleanShot 2025-10-15 at 18 29 35"
src="https://github.com/user-attachments/assets/a7578080-2ed2-4c59-b9b4-d8461f90d8ee"
/>

Fixes #4956
2025-10-17 01:05:15 -04:00
Gabriel Peal
bdda762deb [MCP] Allow specifying cwd and additional env vars (#5246)
This makes stdio mcp servers more flexible by allowing users to specify
the cwd to run the server command from and adding additional environment
variables to be passed through to the server.

Example config using the test server in this repo:
```toml
[mcp_servers.test_stdio]
cwd = "/Users/<user>/code/codex/codex-rs"
command = "cargo"
args = ["run", "--bin", "test_stdio_server"]
env_vars = ["MCP_TEST_VALUE"]
```

@bolinfest I know you hate these env var tests but let's roll with this
for now. I may take a stab at the env guard + serial macro at some
point.
2025-10-17 00:24:43 -04:00
pakrym-oai
da5492694b Add log upload support (#5257) 2025-10-16 21:03:23 -07:00
kh.ai
3b7f4d25ef Add report generation for bug sweep 2025-10-16 20:25:27 -07:00
Gabriel Peal
a5d48a775b [MCP] Allow specifying custom headers with streamable http servers (#5241)
This adds two new config fields to streamable http mcp servers:
`http_headers`: a map of key to value
`env_http_headers` a map of key to env var which will be resolved at
request time

All headers will be passed to all MCP requests to that server just like
authorization headers.

There is a test ensuring that headers are not passed to other servers.

Fixes #5180
2025-10-16 23:15:47 -04:00
Dylan
78f2785595 feat(tui): Add confirmation prompt for enabling full access approvals (#4980)
## Summary
Adds a confirmation screen when a user attempts to select Full Access
via the `/approvals` flow in the TUI.

If the user selects the remember option, the preference is persisted to
config.toml as `full_access_warning_acknowledged`, so they will not be
prompted again.


## Testing
- [x] Adds snapshot test coverage for the approvals flow and the
confirmation flow
<img width="865" height="187" alt="Screenshot 2025-10-08 at 6 04 59 PM"
src="https://github.com/user-attachments/assets/fd1dac62-28b0-4835-ba91-5da6dc5ec4c4"
/>



------
https://chatgpt.com/codex/tasks/task_i_68e6c5c458088322a28efa3207058180

---------

Co-authored-by: Fouad Matin <169186268+fouad-openai@users.noreply.github.com>
Co-authored-by: Fouad Matin <fouad@openai.com>
2025-10-16 17:31:46 -07:00
Dylan
4b01f0f50a fix: tui default trusted settings should respect workspace write config (#3341)
## Summary
When using the trusted state during tui startup, we created a new
WorkspaceWrite policy without checking the config.toml for a
`sandbox_workspace_write` field. This would result in us setting the
sandbox_mode as workspace-write, but ignoring the field if the user had
set `sandbox_workspace_write` without also setting `sandbox_mode` in the
config.toml. This PR adds support for respecting
`sandbox_workspace_write` setting in config.toml in the trusted
directory flow, and adds tests to cover this case.

## Testing
- [x] Added unit tests
2025-10-16 11:23:38 -07:00
Thibault Sottiaux
86ba270926 fix: skip /init when AGENTS.md already exists (#5242)
This change aborts /init if an AGENTS.md already exists to avoid plainly
overwriting it.

<img width="581" height="24" alt="Screenshot 2025-10-15 at 9 43 07 PM"
src="https://github.com/user-attachments/assets/f8be51f7-dcb1-4f90-8062-18d4e852300a"
/>
2025-10-15 22:24:46 -07:00
dedrisian-oai
272e13dd90 feat: Auto update approval (#5185)
Adds an update prompt when the CLI starts:

<img width="1410" height="608" alt="Screenshot 2025-10-14 at 5 53 17 PM"
src="https://github.com/user-attachments/assets/47c8bafa-7bed-4be8-b597-c4c6c79756b8"
/>
2025-10-15 16:11:20 -07:00
joshka-oai
18d00e36b9 feat(tui): warn high effort rate use (#5035)
Highlight that selecting a high reasoning level will hit Plus plan rate
limits faster.
2025-10-15 14:57:05 -07:00
Jeremy Rose
17550fee9e add ^Y and kill-buffer to textarea (#5075)
## Summary
- add a kill buffer to the text area and wire Ctrl+Y to yank it
- capture text from Ctrl+W, Ctrl+U, and Ctrl+K operations into the kill
buffer
- add regression coverage ensuring the last kill can be yanked back

Fixes #5017


------
https://chatgpt.com/codex/tasks/task_i_68e95bf06c48832cbf3d2ba8fa2035d2
2025-10-15 14:39:55 -07:00
Michael Bolin
995f5c3614 feat: add Vec<ParsedCommand> to ExecApprovalRequestEvent (#5222)
This adds `parsed_cmd: Vec<ParsedCommand>` to `ExecApprovalRequestEvent`
in the core protocol (`protocol/src/protocol.rs`), which is also what
this field is named on `ExecCommandBeginEvent`. Honestly, I don't love
the name (it sounds like a single command, but it is actually a list of
them), but I don't want to get distracted by a naming discussion right
now.

This also adds `parsed_cmd` to `ExecCommandApprovalParams` in
`codex-rs/app-server-protocol/src/protocol.rs`, so it will be available
via `codex app-server`, as well.

For consistency, I also updated `ExecApprovalElicitRequestParams` in
`codex-rs/mcp-server/src/exec_approval.rs` to include this field under
the name `codex_parsed_cmd`, as that struct already has a number of
special `codex_*` fields. Note this is the code for when Codex is used
as an MCP _server_ and therefore has to conform to the official spec for
an MCP elicitation type.
2025-10-15 13:58:40 -07:00
Jeremy Rose
9b53a306e3 Keep backtrack Esc hint gated on empty composer (#5076)
## Summary
- only prime backtrack and show the ESC hint when the composer is empty
- keep the composer-side ESC hint unchanged when drafts or attachments
exist and cover it with a regression test

Fixes #5030

------
https://chatgpt.com/codex/tasks/task_i_68e95ba59cd8832caec8e72ae2efeb55
2025-10-15 13:57:50 -07:00
Jeremy Rose
0016346dfb tui: ^C in prompt area resets history navigation cursor (#5078)
^C resets the history navigation, similar to zsh/bash.

Fixes #4834

------
https://chatgpt.com/codex/tasks/task_i_68e9674b6ac8832c8212bff6cba75e87
2025-10-15 13:57:44 -07:00
Michael Bolin
f38ad65254 chore: standardize on ParsedCommand from codex_protocol (#5218)
Note these two types were identical, so it seems clear to standardize on the one in `codex_protocol` and eliminate the `Into` stuff.

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/5218).
* #5222
* __->__ #5218
2025-10-15 13:00:22 -07:00
Jeremy Rose
9be704a934 tui: reserve 1 cell right margin for composer and user history (#5026)
keep a 1 cell margin at the right edge of the screen in the composer
(and in the user message in history).

this lets us print clear-to-EOL 1 char before the end of the line in
history, so that resizing the terminal will keep the background color
(at least in iterm/terminal.app). it also stops the cursor in the
textarea from floating off the right edge.

---------

Co-authored-by: joshka-oai <joshka@openai.com>
2025-10-14 18:02:11 +00:00
Jeremy Rose
d6c5df9a0a detect Bun installs in CLI update banner (#5074)
## Summary
- detect Bun-managed installs in the JavaScript launcher and set a
dedicated environment flag
- show a Bun-specific upgrade command in the update banner when that
flag is present

Fixes #5012

------
https://chatgpt.com/codex/tasks/task_i_68e95c439494832c835bdf34b3b1774e

---------

Co-authored-by: Michael Bolin <mbolin@openai.com>
2025-10-14 17:49:44 +00:00
jif-oai
57584d6f34 fix: the 7 omitted lines issue (#5141)
Before, the CLI was always showing `... +7 lines` (with the 7 constant)
due to a double truncation

<img width="263" height="127" alt="Screenshot 2025-10-13 at 10 28 11"
src="https://github.com/user-attachments/assets/49a92d2b-c28a-4e2f-96d1-1818955470b8"
/>
2025-10-14 18:15:47 +01:00
jif-oai
5346cc422d feat: discard prompt starting with a slash (#5048)
This is does not consider lines starting with a space or containing
multiple `/` as commands
<img width="550" height="362" alt="Screenshot 2025-10-13 at 10 00 08"
src="https://github.com/user-attachments/assets/17f7347f-db24-47cb-9845-b0eb6fb139cb"
/>
2025-10-14 09:47:20 +01:00
Jeremy Rose
90af046c5c tui: include the image name in the textarea placeholder (#5056)
Fixes #5013
2025-10-10 09:56:18 -07:00
jif-oai
961ed31901 feat: make shortcut works even with capslock (#5049)
Shortcut where not working in caps-lock. Fixing this
2025-10-10 14:35:28 +00:00
jif-oai
f98fa85b44 feat: message when stream get correctly resumed (#4988)
<img width="366" height="109" alt="Screenshot 2025-10-09 at 17 44 16"
src="https://github.com/user-attachments/assets/26bc6f60-11bc-4fc6-a1cc-430ca1203969"
/>
2025-10-10 09:07:14 +00:00