Repository navigation
chore(stable): refresh fork from upstream rust-v0.161.0 - #194
Merged
Merged
Conversation
## Why Skill invocation analytics only needs the repository's origin URL, but `collect_git_info` also checks the repository and reads its commit and branch. ## What changed Extract and export `get_git_origin_url` and use it directly in skill analytics to skip the extra Git commands. Reuse the helper in `collect_git_info`, preserving URL sanitization and command timeouts. GitOrigin-RevId: f878936937d0ff8c6313bb8168448e0b25ba1a39
## What changed Use a shared subscription label mapping for status and analytics views. Rename `Pro Extra` to `Pro 200`, `Pro Standard` to `Pro 100`, and `Pro Max` to `Pro 500`, while preserving the existing differences between status and analytics labels for other plans. ## Testing Update the status plan-label test expectations for the three Pro tiers. GitOrigin-RevId: 47af1e7d56ef9f7701caff8af315f530087920b8
## Why An offline secondary executor can stall Guardian approval revalidation while diff display setup searches for Git roots, even when the review concerns another executor. ## What changed Use each environment's working directory as the diff display root for Guardian sessions, regardless of `CwdRelativeTurnDiffs`, so this setup does not wait for remote Git discovery. ## Testing Add a regression test that withdraws authorization during a pending approval and disconnects an unrelated secondary executor. Verify that Guardian retries with the updated authorization and denies the request. GitOrigin-RevId: 3661759119935c68539e9eab8df2e862987d0d92
## Why Every thread state mutation scanned all tracked runtimes to recount running turns while holding the state lock. This count supports graceful restart draining introduced in openai#12517. ## What changed Maintain `running_turn_count` in `ThreadWatchState`, adjusting it when a runtime's `running` flag changes or a running thread is removed. Publish the cached count while preserving notifications only when the count changes. ## Testing Extend the running-turn watch test to cover duplicate starts, two simultaneous running threads, and removal of a running thread, with counts checked against the runtime map. GitOrigin-RevId: e7d7ebb33b9ff4d24dc70d8f01ae981378fed5f8
…enai#49089) ## Why Follow-up directives contain display labels and prompt attributes. Show the labels without exposing directive syntax or prompt text in rendered responses and streaming previews. ## What changed - Render `:codex-followup[label]{prompt="..."}` as its label, preserving inline Markdown styling and source offsets. - Replace recognized follow-up directives with their labels when copying whole responses, while retaining the original source. - Withhold unfinished directives in rich streaming previews and avoid cropping into prompt attributes when the preview window advances. - Preserve literal code, escaped directives, and malformed source when rendering completed messages or copying responses. ## Testing Add regression coverage for label formatting, nested brackets and backticks, literal and malformed directives, whole-response copying, and streaming holdback across long prompts and preview window boundaries. GitOrigin-RevId: dce61d1164de0a576fe95fb2c67b177a1ed414e8
…enai#49093) ## What changed - Replace plan-specific and Fast-mode promotions with the desktop app tip for the current platform, while preserving announcement priority and random-tip fallback. - Share desktop app tips between the preferred slot and random tip pool, including Windows. Keep Linux app tips limited to graphical sessions outside WSL. - Clarify installation and launch instructions for macOS, Windows, and Linux, and format launcher commands as code. - Remove the Fast-mode status plumbing used by tooltip selection. ## Testing Add snapshots for all three platform tips at a narrow terminal width. Update tests to cover plan-independent tip selection and platform availability. GitOrigin-RevId: 34bbc95c47c83618f9ac1691a1b69ca4690b8665
## Why Usage-limit failures during manual or post-turn compaction did not notify turn lifecycle extensions, leaving them unable to react to these errors. ## What changed Emit the turn error lifecycle notification for `UsageLimitExceeded` in both compaction paths. Preserve the completed answer after post-turn compaction fails, and avoid duplicating the error already emitted by manual compaction. GitOrigin-RevId: f31155e5991d762a0779030921aedbd1f818cfbb
…ai#49098) ## Why Remote controllers cannot resolve a sandbox-compatible PowerShell executable on the execution host. ## What changed Apply the existing PowerShell fallback during exec-server request preparation for the `Elevated` and `Mxc` Windows sandbox backends. Match `pwsh` and `powershell` executable names case-insensitively and replace inaccessible Store PowerShell paths when a compatible executable is available. ## Testing Add Windows RPC regression tests for lowercase and mixed-case PowerShell aliases with a restricted server `PATH`, verifying successful command execution in the `Mxc` sandbox. GitOrigin-RevId: 365541af2f026a662b1988429f5d182c98e4a236
## Why Repeated plugin discovery and loading reparse unchanged manifests and repeat warnings for invalid fields. ## What changed - Share a manifest cache through `PluginStore` across marketplace listing, plugin loading, capability inspection, and tool suggestion metadata. - Reuse successful parses by plugin root, manifest path, and content digests, including the Codex overlay. Reread files on each load so manifest edits and overlay changes or removal remain visible. - Bound the cache to 128 entries and bypass caching for inputs larger than 64 KiB. Retry failed parses and share entries across store clones while keeping independent stores isolated. - Reuse loaded manifest data when loading apps and MCP metadata. ## Testing Add unit coverage for parse reuse, warning deduplication, revision invalidation, repair after parse failures, equivalent Windows paths, store isolation, and oversized inputs. Add an app-server regression test that verifies repeated `plugin/list` requests observe manifest and overlay revisions in one running server. GitOrigin-RevId: ed082cd7d198015cd8ed35db7f2af74e13f49915
## Why Each call to `PluginsConfigInput::remote_plugin_service_config` created a new HTTP client pool, preventing connection reuse across service configurations. ## What changed Share one lazily initialized, route-aware pool across a `PluginsConfigInput` and its clones. Newly constructed inputs retain separate pools, while service configurations continue to use the current endpoint and product SKU and requests use the supplied authentication. ## Testing Add tests for lazy initialization, pool sharing across repeated calls and early clones, isolation between new inputs, and requests using updated endpoints, product SKUs, and authentication with the shared pool. GitOrigin-RevId: 3e929c34052798779a4f153e4db03b3f75b6f87d
…penai#49102) ## Why Changing an existing database from `FULL` to `INCREMENTAL` auto-vacuum requires a writer lock and can block pool initialization. SQLx also retries connection initialization failures, masking the original error as `PoolTimedOut`. ## What changed Preserve existing auto-vacuum modes when opening writable pools, while continuing to initialize empty databases with incremental auto-vacuum. Return the first connection initialization error directly to the caller, retaining SQLx's normal error handling for later lazy connections. ## Testing Add regression tests for fresh database settings, opening an existing `FULL` auto-vacuum database under a write lock, and preserving the WAL conversion lock error while allowing a subsequent open to succeed after the lock is released. GitOrigin-RevId: b586c68e43a5a0d3b47268378716919d01b749cf
) ## Why Hash-based sharding does not account for differences in test duration. Use estimated test time to balance the Windows Bazel workload across shards. ## What changed - Add checked-in duration weights and a deterministic selector that assigns the longest targets first to the least-loaded shard. - Assign every queried target exactly once, default missing weights to one second, and ignore stale weights. - Run queries and selection in the foreground so failures stop the job before tests run with a partial target list. - Emit LF-delimited target labels for Git Bash and report estimated shard loads on stderr. ## Testing Add seven passing selector tests covering deterministic coverage and balancing, missing and stale weights, invalid inputs, duration-file overrides, and CLI output. Run them on the first Windows CI shard. GitOrigin-RevId: d415ae093bfe57794ee53a2eb9d712022202dad8
## Why Reconnecting paused all recovered input, including queued messages that had never been sent. Those messages can resume automatically once any uncertain submissions are resolved. ## What changed - Track unsent and unconfirmed messages separately. Reconcile submitted prompts and steers using exact client message IDs from restored history, buffered events, and later receipts. - Remove confirmed submissions from the recovered queue and resume unsent input after replay. Keep uncertain submissions paused without resending them, and show a notice identifying the message whose delivery could not be confirmed. - Preserve pauses for unavailable conversations, pending compact/review requests, and existing input recovery failures. - Simplify reconnect status text and remove blanket disconnect/reconnect transcript notices. ## Testing Update reconnect integration tests and snapshots for automatic queue resumption. Add coverage for matching and unrelated receipts, missing history, late confirmations across navigation, pending compaction, and preservation of image-failure recovery pauses. GitOrigin-RevId: d0b9aa43c4019d472985d12bbce8ba9bbfb9253b
## Why The command center seeded only ten recent sessions, with no way to browse older history from the task list. ## What changed - Add a keyboard-selectable “Show more” row that discovers up to ten more tasks, with loading and retry states that remain accessible during search. - Retain per-source cursors and buffered rows across requests, merging interactive and non-interactive history by recency without discarding existing tasks on failure. - Refill vacancies after tasks are archived or deleted, and prevent stale refreshes from restoring removed tasks. - Limit routine detail refreshes to recent and loaded tasks, plus explicitly targeted threads, as retained history grows. ## Testing Add regression coverage for pagination across mixed sources, cursor retries without row loss, automatic refill, queued pagination, and “Show more” navigation, loading, search, and retry rendering. GitOrigin-RevId: 0bfcc970c9adf0c8d509b275a92ecf01c29595ad
## What changed - Publish released mouse selections from both transcript views to X11 `PRIMARY` as plain text, even when copy-on-select is disabled. Preserve configured `CLIPBOARD` copying when it is enabled. - Paste `PRIMARY` into the editable fullscreen composer on middle-click, including while a transcript selection remains active. - Limit support to local Linux X11 sessions, excluding Wayland, SSH, tmux, WSL, and VS Code terminals. - Retain the latest deferred selection publication and order it before a pending `PRIMARY` read, while giving explicit copies priority. Cancel stale deferred work when its selection or paste target is invalidated. - Clarify that scrollback mode uses native terminal copy, paste, and scrollback. ## Testing Add regression tests for selection publication with copy-on-select enabled and disabled, publication-before-read ordering, explicit-copy priority, cancellation of deferred work, and middle-click paste invalidation. GitOrigin-RevId: 6ba7bddffda60183b7f9ad5cd69a97da8a4a8dcd
Set `chatgpt_base_url` to the supplied mock server URI in `make_remote_compaction_session`. GitOrigin-RevId: de5c6e208fd104cbe07a8873e7e33c108dac7a57
## Why Sessions can share an analytics client while using different product SKUs. Analytics requests need per-thread attribution to reflect each session's configuration. ## What changed - Register each thread's `apps_mcp_product_sku` and send `X-OpenAI-Product-Sku` on analytics requests grouped by product, without changing authentication. - Send product groups concurrently while preserving event order within each group. - Flush buffered tool events before changing or evicting their product attribution, and clear attribution when a session disables analytics. - Bound retained thread registrations and concurrent product groups. Drop attribution when registration cannot be queued or a batch exceeds the product-group limit. ## Testing Add tests for shared-session attribution, clearing attribution on resume with analytics disabled, buffered events across product changes, queue overflow recovery, registry limits, and concurrent delivery with preserved event order. GitOrigin-RevId: 25a98788cd44d4a85f97ee87aadf3a6909607f6a
Clarify in the `requires_openai_auth` field documentation and configuration schema that credentials use the backend selected by `cli_auth_credentials_store`, rather than always being stored in `auth.json`. Also clarify that `env_key` specifies the environment variable containing the API key. GitOrigin-RevId: e65753a72258e43b24c4e40b51ff26830c5b3756
## Why Responses stopped by `content_filter` previously followed generic stream-error retry handling without guidance about the block. Retried requests need instructions to explain the limitation and offer a permitted alternative. ## What changed - Recognize content-filter failures as a distinct error while preserving retryability and the existing public error representation. - Append developer guidance to the conversation after each sampling block, retaining delivered output and using the existing retry handling. - Support a model catalog override through `model_messages.content_filter_guidance`. Missing, null, blank, or values exceeding 512 UTF-8 bytes fall back to bundled guidance. - The bundled guidance tells the model to avoid reproducing or working around blocked content, briefly explain the limitation, offer a permitted alternative, and continue unrelated authorized work. ## Testing Add a scenario and request-history snapshot covering repeated blocks, catalog guidance on each retry, retained partial output, and eventual completion. Add error-mapping assertions for retryability, public error classification, and error text. GitOrigin-RevId: ba0c201b3a5a3acf5cfa971332027240e0690225
…i#49127) ## Why Skills available from both cloud and executor providers consume duplicate catalog space, leaving less room for descriptions of unique skills. ## What changed - Prefer model-visible cloud skills over executor listings with the same `plugin:skill` name before allocating the metadata budget. - Preserve aliases from the full visible executor inventory so filtering duplicates does not renumber remaining packages. Continue choosing full locators when they fit the budget better. - Keep executor packages available through `skills.list` and `skills.read`, and retain executor listings when cloud skills are disabled. ## Testing Add regression tests and a model-request snapshot covering description retention, stable aliases across turns, executor availability changes, package reads, and full-locator selection after deduplication. GitOrigin-RevId: 477e4cf16b8968dbe61438dd5af1eca9cbfa78c8
…penai#49130) ## What changed Move content-filter guidance recording from the sampling loop into `handle_response_stream_error`. Pass `StepContext` so the handler can resolve model-specific guidance and record it before retry decisions for sampling requests. Keep remote compaction excluded from guidance recording and update callers and the existing retry-deadline test to use the new signature. GitOrigin-RevId: 030bde1d4f1597fc4f3971ad837478e5304c5aa9
## Why Providers with `model_catalog_url` could advertise bundled models absent from their catalog or reuse stale models after a failed refresh. Model metadata could also match by prefix or namespaced suffix instead of the provider's exact model ID. ## What changed - Suppress bundled model fallback and merging for explicit provider catalogs, including when discovery is disabled. - Require unique, non-empty catalog slugs and match metadata by exact model ID. - Serialize explicit catalog refreshes and invalidate in-memory and persisted catalog entries after fetch failures, preventing stale cache reuse. - Report a clear configuration error when startup has no available model, while allowing an explicitly configured `model`. ## Testing Add regression coverage for exact model matching, hidden catalog entries, cache invalidation across restart and recovery, invalid slugs, and empty-catalog startup with and without an explicit model. Update app-server model-list expectations and verify the TUI configuration error. GitOrigin-RevId: ac323a94178e3c48df8d4a159a86fdbac20b03a2
…ai#49136) ## What changed Render macOS Option shortcuts as `⌥t` and `ctrl+⌥t` instead of `⌥+t` and `ctrl+⌥+t`. Keep `+` separators after text modifier labels such as `ctrl`, `shift`, and `alt`. ## Testing Update key-label and chord assertions and UI snapshots to expect the compact labels across shortcut help, navigation hints, and tooltips. GitOrigin-RevId: 7d52088ebce3dfa3f8bdad65eb159ca0fead8a31
…49138) ## Why Turn error hooks receive only a `CodexErrorInfo` category, which omits backend metadata such as usage-limit reset times and rate-limit snapshots. ## What changed Add borrowed `CodexErrorDetails` to `TurnErrorInput` and pass the original details through turn and compaction error notifications, alongside the existing error category. ## Testing Add coverage for usage-limit metadata during sampling, manual compaction, and post-turn compaction, including preservation of completed answers and existing error events. Extend lifecycle tests to verify that an `InvalidImageRequest` retains its details when surfaced as `BadRequest`. GitOrigin-RevId: 6f2058992126da0f69508ef51998e7581557deea
…penai#49144) ## Why Forwarding local defaults as request overrides can replace server defaults or saved thread settings for reasoning summaries and verbosity. ## What changed Only forward `model_reasoning_summary` and `model_verbosity` as shared thread request overrides when their winning configuration layer is a session flag or an explicitly selected user profile. Use the effective values from that layer, and omit values whose winning source is ordinary user or project configuration. Preserve the existing reasoning-summary defaults for new embedded threads. ## Testing Add coverage for profile, project, and CLI precedence. Extend outbound model request tests to verify that remote-mode thread start and resume preserve server reasoning summary and verbosity settings despite conflicting local values. GitOrigin-RevId: 5e14254a51ed7506118a46847bb7466ab58908ef
…penai#49145) ## What changed Omit the reasoning summaries setting from the model details when connected to a remote server or local background server. Continue displaying it when no server connection is present. ## Testing Expand status snapshots to cover no server connection, a remote server, and a local background server, including the reasoning summary setting visibility in each case. GitOrigin-RevId: f7213e7ad7439107705461ccf4e070501729113b
Replace the trailing-slash removal loop in `normalize_base_url` with
`trim_end_matches('/')`, preserving existing behavior.
Add regression coverage for unchanged URLs, single and repeated trailing
slashes, empty and slash-only inputs, and ChatGPT URLs with and without
`/backend-api`.
GitOrigin-RevId: db71e80c4dcaac33b308a45684b14e7edbd71528
…enai#49153) ## Why Copying text selected within a blockquote adds Markdown quote markers that are not part of the selected content. ## What changed Return plain text for selections containing only quoted content, preserving literal `>` characters and selected whitespace. For quoted tables and task lists, remove quote prefixes while retaining table reconstruction and checkbox states. Selections spanning quoted and unquoted content continue to preserve Markdown structure. Preserve the existing logical source when marking list separator lines as omitted from Markdown copying. ## Testing Add coverage for partial and nested blockquote selections, quoted tables and task lists at narrow and wide widths and after rewrapping, and copying a mouse-selected blockquote. GitOrigin-RevId: 5ac0c8c47a77937e5a35c376d8908065217ad2dc
## What changed - Skip folder trust prompts for locally discovered projectless directories without a saved trust decision. Apply workspace-write permissions and granular approval defaults only when local execution, configuration, and managed policy allow them. - Prompt for Windows sandbox setup when needed before enabling implicit workspace-write permissions. - Restore saved task permissions on resume unless explicitly overridden, and keep ordinary turns from overwriting the server's saved permission profile. Track explicit approval reviewer choices separately from restored permissions. - Let `/cd` request folder trust with a “Keep current directory” option. Recheck task activity and background terminals before switching, and enforce destination permission requirements. ## Testing Add regression coverage for projectless defaults and session transitions, explicit permission overrides, saved profile preservation, trust discovery, destination policy conflicts, and the directory consent and Windows sandbox prompts. GitOrigin-RevId: cf74f5a90245f2aee96caa80d76de64da6ec1ebd
(cherry picked from commit 33f8881513eda8e5a6904a5fd9e6e437300716f3)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Refresh the fork's stable line from upstream's latest non-alpha Rust release without losing shipped fork behavior, migration identity, or fork-owned tooling. Cargo Shear exposed missing registrations for maintained fork hooks and unused source files after upstream cleanup; the follow-up restores the hooks, removes only independently verified obsolete files, and the current PR head passes Cargo Shear.
Summary
Merge upstream
rust-v0.161.0(peeled commit979011409de0a60b52f179721948e65531d26144) into the fork's prior stable SHA3480a962a6d2a8bceaf61f6bbe09d34e855d54c2. The merge commit isaf5ee5d5b98093cd6e7747f4557b91faae2a6b91. The refresh resolved 414 unmerged index entries across 413 paths and audited the combined/remerge diff and upstream changes to conflicted files.ema_authcleanup. That upstream security change is covered by its tests.cargo shear --deny-warningsnow reports no issues locally and in required CI. The maintained hook registrations are restored, and only independently verified obsolete upstream-retired source files were removed.0067remain intact; the incoming archive-sort migration duplicates shipped0067byte-for-byte and is omitted.thread/prediction/requestremains a protocol-only stub, as described in upstream commit Add experimental thread prediction protocol types openai/codex#49480.Fork-contract preservation audit
codex-rickpackaging, versioning, and releasecore-foundation, macOS ACLs, andStableSignedCodex; integrates upstream storage telemetry and error redaction.enable_mcp_approvals, and mode filters while integrating upstream model-catalog and remote-board settings.0067and omits the duplicate incoming0058.No maintained fork surface was intentionally dropped. The full behavioral inventory and merge checklist are in
codex-rs/core/templates/fork/delta_inventory.md, including therust-v0.161.0migration entry and realtime handoff merge checks.Validation
just test -p codex-tui: 20 passed, 5,994 skipped, including LocalDaemon resume, Daybreak, voice, composer, greeting, and whimsy coverage.just test -p codex-core guardian_authorization_revision_survives_compaction_not_user_input: 1 passed, 5,408 skipped.cargo check -p codex-app-serverandcargo check -p codex-clipassed at PR head5cdfc31418ef37e12b0558ceebaa696b6371d21b, using shared target/Users/rick/Github/codex/codex-rs/target.just write-app-server-schemaplusjust write-config-schemapassed and produced no generated-file drift.cargo shear --deny-warningspassed on the integrated branch; required PR CI checks, including Format and cargo-shear, are green.just fix -p codex-tuiandjust fix -p codex-corepassed. Finaljust fmtpassed, andjust bazel-lock-updatecompleted with no lockfile drift.An unscoped
just fixattempt was limited by missing local GStreamer pkg-config development metadata and a Rusty V8 artifact request returning HTTP 404. The scoped checks passed, and product dependency/security defaults remain unchanged. The focused tests ran before required final fix/fmt mechanics; repository policy does not allow rerunning tests after fix/fmt.