checkpoint: into wallentx/termux-target from release/0.146.0 @ 8f8bb5e80a0b - #329
Merged
unemployabot[bot] merged 35 commits intoJul 24, 2026
Conversation
## Why Codex and SQLite data can use separate home directories, but state consumers could reconstruct database paths from the Codex home instead of consistently using the resolved SQLite configuration. ## What changed - Pass `SqliteConfig` through the core, rollout, state runtime, and thread store instead of passing a directory and rebuilding the configuration downstream. - Use that shared configuration for state, logs, memories, goals, and paginated thread-history database access, including integrity checks and cleanup. - Reject state database handles whose SQLite configuration does not match the requesting store. ## Testing Add coverage with separate Codex and SQLite homes that verifies startup backfill, thread listing, and paginated history all use the configured SQLite directory. GitOrigin-RevId: 1de1cdd1d6ff1d70bbb6c360c8352e6543fb8ebf
…34995) ## Why The TUI must inspect the default execution environment before loading its final configuration. Initializing the environment manager at that point can give startup services the bootstrap HTTP policy instead of the effective policy after managed requirements are applied. ## What changed - Split environment discovery from manager construction so callers can inspect the default environment without starting remote connections. - Build the environment manager after final configuration loading and pass its resolved `HttpClientFactory` through all construction paths. - Add shared test support for managers that use the legacy default HTTP policy. ## Testing - Cover connection-free environment discovery and explicit HTTP policy propagation. - Verify TUI startup services use the final managed `respect_system_proxy` value. GitOrigin-RevId: 928fa31e6b4bcfbe1a121cade2f351427fdfa0f4
## What changed - Wrap `CodexErrorDetails` and an optional retry delay in `CodexErr`, allowing any mapped error to preserve server-provided retry timing. - Generate the payload-free `CodexErrKind` classification alongside the error details and reuse it for analytics. - Update error handling sites to inspect `CodexErr::details()` while preserving existing display, debug, protocol mapping, and retryability behavior. ## Testing - Add coverage for legacy debug formatting, error-specific retryability, and retry-delay propagation through API error mapping. GitOrigin-RevId: d3ab8a305f2a2ee21d0c0a8c8c388b06dda9c59a
## Why Skill catalog rendering can shorten descriptions or omit enabled skills to fit the model context budget. Surface these reductions so users know when the model-visible catalog has lost detail. ## What changed - Emit a warning with the omitted skill count whenever entries do not fit. - Warn when description shortening averages more than 100 characters per skill. - Deduplicate executor catalog warnings across repeated world-state builds in a turn. ## Testing - Cover the description-shortening threshold and omission warning text. - Verify warnings through extension and production-turn catalogs, including per-turn deduplication. GitOrigin-RevId: bd7fc3482e5dfd8c79072f772a2f54aa502478d9
## What changed - Dispatch app-server turn interrupts in the background so the TUI can keep processing thread events while an interrupt is pending. - Coalesce repeated interrupt requests for the same active turn and clear the pending state when the turn completes or the thread closes. - Preserve the retry for stale active-turn IDs, surface interrupt failures as warning notifications instead of exiting the TUI, and reset backtrack state whenever an interrupt is handled. ## Testing - Add an app-server integration test covering nonblocking event handling, repeated-request coalescing, and pending-state cleanup. - Verify that interrupting without an active turn clears backtrack state. GitOrigin-RevId: 9ada247a739e2e0a63b425f75ebd6d054167d825
## What changed - Add a configurable `toggle_side_conversation` TUI action, bound to `ctrl-/` by default, to switch between a side conversation and its parent without closing either. - Show the active binding in the footer and distinguish switching from closing with `ctrl-c`. - Allow starting a replacement side conversation from the parent, while cleaning up the previous side thread and preserving it if cleanup fails. - Clean up retained side conversations when shutting down the current thread. ## Testing - Cover shortcut remapping, conflicts, and compatibility with existing `ctrl-/` and `ctrl-7` bindings. - Cover side-thread replacement and footer states for both the parent and side conversation. GitOrigin-RevId: a621c21e1c45ba73197d59750b2e05efa5ee1081
## What changed - Add nullable `iconSmallUrl` and `iconLargeUrl` fields to the v2 `SkillInterface` protocol and generated schemas. - Populate the fields from remote plugin catalog metadata while returning null values for local skill interfaces. - Document the new `plugin/read` response fields. ## Testing - Extend the remote `plugin/read` test to verify both icon URLs are returned. GitOrigin-RevId: 0a631a0121627d944a84e542728a506823ff2738
## Why Persisted item snapshots can be updated after their initial projection while retaining their creation order. Callers need a way to read those updates incrementally without replaying every item. ## What changed - Track the rollout ordinal of each item's latest snapshot separately from its creation ordinal. - Let thread-store callers filter items after an exclusive update watermark and sort pages by either creation or update ordinal. - Keep existing app-server reads creation-ordered, reject incremental reads across forked lineages, and preserve compatibility with older writers. ## Testing - Cover update-watermark filtering, pagination, sort directions, per-turn reads, cursor validation, forked lineages, migration compatibility, and refreshed item snapshots. GitOrigin-RevId: d57de849abec27f788e9c384dbff073a0aca1053
…#35015) ## Why The snapshot-backed `apps/installed` duration metric needs dimensions that can be compared with the legacy `app/list` baseline. ## What changed - Label snapshot-backed duration samples with `path=installed` and add the legacy-compatible `reload` dimension alongside the detailed refresh fields. - Record duration samples only for successful responses so failed requests do not enter the success latency distribution. ## Testing Added unit coverage for the duration metric dimensions on refreshed and non-refreshed requests, and for omitting samples on failed requests. GitOrigin-RevId: 0755dcaaa94f1d973adfc62a27ea97e3e01edc8b
## What changed - Build a set of active, verified curated and remote plugin roots from loaded plugins. - Resolve direct and safely wrapped script commands to a plugin ID and normalized plugin-relative path. - Leave complex or ambiguous commands, local overrides, missing files, overlapping roots, and symlink escapes unattributed. - Add a shared validator for the safe cross-platform shape of serialized plugin-relative paths. ## Testing - Cover trusted-root selection, supported interpreters and shell wrappers, normalized paths, and fail-closed cases. GitOrigin-RevId: 6e4199a241fd6dfadfec3df0845e7cb615352a49
## What changed - Resolve shell and unified-exec commands against the trusted plugin roots loaded for each turn. - Add optional `pluginId` and safe plugin-relative `scriptPath` fields to command execution items and legacy execution events, and propagate them through app-server notifications. - Include the attribution in command execution analytics while rejecting absolute, unsafe, and unattributed script paths. ## Testing - Cover attribution for cached curated and remote plugin scripts from command execution through core and app-server events. - Verify analytics serialization and unsafe-path filtering. GitOrigin-RevId: 02fac3a233284ccfc6642fa502a95f1881dba83d
## Why Reporting key event types can leak an exit-shortcut release into the parent shell in iTerm2 and can cause tmux's `xterm` extended-key format to lose Shift+Enter. ## What changed - Select keyboard enhancement flags using the detected terminal and tmux extended-key format. - Disable event-type reporting for iTerm2 and tmux's `xterm` format while retaining alternate-key reporting. - Preserve event-type reporting for other terminals and tmux's `csi-u` format so repeat events remain distinguishable. ## Testing Added unit coverage for iTerm2, Kitty, unknown terminals, and both tmux extended-key formats. GitOrigin-RevId: 03a6b9d5443f626da5279413a14933af2a0ec3e5
## Why Delegated HTTP requests need to honor the same outbound proxy policy as the Codex process that starts the exec server. ## What changed - Pass the configured `HttpClientFactory` through local and remote exec-server startup and use route-aware client pools for delegated HTTP and local MCP requests. - Preserve per-request timeouts and follow-or-stop redirect behavior while keeping request URLs and sensitive response headers out of diagnostics. ## Testing - Cover configured system-proxy routing across the exec-server transport. - Cover both redirect policies and verify that success and failure logs do not expose request or response secrets. GitOrigin-RevId: 4af6aec1d265c4db62dfcb6e1fb076fb31736137
## Why After a remote plugin install refreshes the Apps tool catalog, a later MCP runtime publication must not restore the catalog from the previous connection. ## What changed - Rebuild the MCP runtime with fresh connections when hard-refreshing Apps tools, using the latest desired runtime configuration. - Refresh the Apps catalog on the newly published connection so subsequent runtime updates retain it. ## Testing Extend the remote plugin install test to verify that both newly available and missing Apps tools remain consistent after an unrelated runtime configuration refresh. GitOrigin-RevId: 5b675d53d56379ab67fab09512fc2ad0ffcb8535
## What changed - Add optional `plugin_id` and `script_path` fields to execution approval and guardian assessment events. - Propagate validated plugin attribution through delegated approvals, guardian-reviewed command items, app-server notifications, thread history, and rollout traces. - Preserve attribution on both started and completed command items, including declined commands. ## Testing - Extend core, app-server, thread-history, and rollout-trace tests to cover plugin attribution propagation and serialization. GitOrigin-RevId: 723684d010cab04142918d7a95e06ed95d008da1
## Why Paginated threads allow only one app-server process to write at a time. Archive and delete operations must not mutate a thread or its spawned descendants while another process owns any of them. ## What changed - Acquire paginated writer locks for the full archive or deletion set before changing rollout files, including descendants whose rollout has not materialized yet. - Add a batch archive store operation so ownership conflicts are detected before any thread in the subtree is archived. - Return ownership conflicts as JSON-RPC invalid-request errors and document the behavior. ## Testing - Cover archive and deletion conflicts for owned threads and descendants, including unmaterialized rollouts. - Verify deletion still removes rollouts with unreadable metadata. GitOrigin-RevId: f62a3e0c1ee2631cea48dd9145b588a1486e2425
## What changed - Parse the `browser_use.disable_auto_review` setting from layered `requirements.toml` configuration. - Return the setting as `browserUse.disableAutoReview` from `configRequirements/read` and publish it in the generated JSON and TypeScript schemas. ## Testing - Add an app-server RPC test covering the Browser Use requirement. GitOrigin-RevId: 5749d5bc17bcc5b582bf7ed59b8e5b72d6c8f7fc
…penai#35034) ## Why Noise environment registry requests need to follow the exec server's effective outbound proxy policy without exposing registry URLs or response headers in HTTP diagnostics. ## What changed - Build the registry client from the supplied `HttpClientFactory` and use a route-aware API client with redirects and request logging disabled. - Defer construction of the Noise connection provider until the outbound HTTP policy is available. - Map route-aware request failures into registry errors while retaining timeout detection across response body reads. ## Testing Add coverage for system-proxy routing, sensitive registry metadata redaction, stalled response-body timeouts, and prepared Noise configuration validation. GitOrigin-RevId: d312dfe037f72732085bf38109af44df76ed0b53
…35036) ## Why Guardian review commands can run without the proxy-port environment used to configure the parent session. Reconciling persistent Windows sandbox settings for those commands can discard the parent's proxy configuration. ## What changed - Add a session-level Windows sandbox proxy-settings mode and use `Preserve` for guardian review sessions while keeping `Reconcile` as the default. - Carry the mode through unified exec and the exec-server sandbox context to Windows process launches. - In preserve mode, reuse the proxy settings recorded by the existing sandbox setup marker. ## Testing Added coverage for guardian session configuration, exec-server transport, and preserving an existing setup marker when proxy-port environment variables are absent. GitOrigin-RevId: 214655c6e6d97360906431773dc0de0fdda2db6e
## What changed - Record `codex.apps.read.duration_ms` when `app/read` returns a response. - Tag the duration by the request's `include_tools` value. - Move the `app/read` handler into its own request-processor module. GitOrigin-RevId: e1563cd41c72ad03e7f5d5d33cd8a3b35e27984b
## What changed - Add `GuardianV2` to the feature registry for automatic approval reviews. - Expose it as `features.guardianv2` in the configuration schema. - Keep the under-development feature disabled by default. GitOrigin-RevId: 92fa107e3ff1396a75a28a071353743a7bb48c43
## What changed - Add a default-on `tools.update_plan.enabled` configuration option. - Omit `update_plan` from the visible and registered tool sets when the option is disabled. ## Testing - Cover configuration resolution and tool registration for the disabled setting. GitOrigin-RevId: c13aa463a6911956fca9f0ef5b74841b543798c4
## Why Remote environment connections need to honor Codex's effective outbound proxy policy, including when a rendezvous connection reconnects. ## What changed - Pass the configured `HttpClientFactory` into remote environment transports and use `WebSocketConnector` for exec-server and rendezvous WebSockets. - Resolve proxy routes asynchronously so these connections can use the configured system proxy. - Add connector options that preserve Tungstenite's default TLS behavior and enable `TCP_NODELAY` for latency-sensitive rendezvous traffic. ## Testing - Verify prepared remote environments connect through a configured system proxy. - Verify initial and reconnected encrypted relay peers use the system proxy. - Cover default TLS selection and opt-in `TCP_NODELAY` behavior in the WebSocket client. GitOrigin-RevId: 8a8da2116e37cb3a891269d0c0b037986fecdd3c
## What changed - Rename `ReqwestHttpClient` to `RouteAwareHttpClient` to reflect that delegated HTTP uses Codex's shared route-aware transport. - Use `codex_http_client` response and error types plus transport-neutral `http` and `url` types, removing the exec server's direct `reqwest` dependency. ## Testing - Cover fragment stripping and Unicode hostname normalization for delegated HTTP requests. GitOrigin-RevId: 8b0fc60a76004feb57198bfb4afb1371c9ceb1bd
## What changed - Add the disabled-by-default `deferred_tool_world_state` feature, which exposes deferred tool namespaces and their descriptions to the model in a `<tools>` world-state section. - Emit added and removed namespace updates as tool availability changes, bound the rendered context size, and persist nonempty state across thread resumes. - Omit empty tool state while retaining deferred tool discovery through `tool_search`. ## Testing - Cover initial, unchanged, removed, recovered, empty, and resumed namespace state, along with description truncation and rendered-size limits. GitOrigin-RevId: 867e599666dc3569eb0789ba78aaa40254253a6f
## Why Deferred tool world state already advertises the available tool sources, so repeating them in the `tool_search` description adds redundant context. ## What changed - Omit the source listing from `tool_search` when `DeferredToolWorldState` is enabled while preserving the tool discovery instructions. - Include the source-listing mode in the tool search handler cache key so the description is rebuilt when the feature state changes. ## Testing Added coverage for source omission, cache invalidation when the feature is toggled, and the resulting request payload. GitOrigin-RevId: f7dc0c4f3351a7c7daadec936b26a080202730bc
## What changed - Include CLI snapshot files in Bazel test runfiles. - Restrict the Windows sandbox binary test target to Windows. - Label boolean and optional arguments in the affected CLI tests. GitOrigin-RevId: c248396c51d881c38856739d7d9b653dcde1823e
## What changed - Add a `--listen` option that accepts `stdio`, `stdio://`, or a `ws://IP:PORT` endpoint, while retaining stdio as the default. - Serve the existing length-prefixed protocol in binary WebSocket messages, with isolated connections, shared host limits, and a `/readyz` endpoint. - Reject browser-origin handshakes and contain malformed frames to the affected connection. ## Testing - Cover listen URL parsing and complete-frame encoding and decoding. - Exercise readiness, cell execution, tool callbacks, large frames, concurrent connections, malformed frames, and origin rejection through the WebSocket listener. GitOrigin-RevId: 01c8be4c6256b8ce4a3a0002440dcb3294e5f887
## What changed - Add `--code-mode-host ws://...` and `wss://...` support to `codex app-server`, gated by the `code_mode_host` feature. When omitted, app-server continues to start a local host. - Share one remote WebSocket connection across the process's threads, using the configured HTTP client's proxy and TLS policy and preserving the existing framed host protocol. - Reject invalid host URLs, bound WebSocket frame sizes, close connections cleanly, and return an error when a connection exceeds 1,024 pending delegate calls without disconnecting it. ## Testing - Cover CLI validation, WebSocket protocol execution and shutdown, connection sharing across app-server threads, and delegate-call capacity recovery. GitOrigin-RevId: 715e82d4d9db1e7e2f91b754a777dcab504e2ae4
# Conflicts: # codex-rs/cli/src/main.rs # codex-rs/tui/src/lib.rs
Termux rust-v0.146.0-alpha.6
…nt/wallentx_termux-target_from_release_0.146.0_8f8bb5e80a0b
unemployabot
Bot
deleted the
checkpoint/wallentx_termux-target_from_release_0.146.0_8f8bb5e80a0b
branch
July 24, 2026 18:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Termux release checkpoint
release/0.146.08f8bb5e80a0b0a147e98925879db719bc356e766wallentx/termux-targetThis PR carries release-train conflict fixes and follow-up changes back into the reusable Termux patch branch.
Release-only workflow files and metadata under
.githubwere restored to the destination branch versions before opening this PR.