- Parse git blame author-mail to derive @handle for users.noreply.github.com
- Store on bug and inject line when not present
- Keep efficient: reuse existing blame run; no extra git calls
- Linkify File & Lines preserved
- Add aggregated token usage to Security Review results and show in summary
- Remove/restore report sections per requests: drop Configuration and Extensibility; remove Risks and Gaps; restore Security Findings header
- Simplify findings table by removing Recommendation column
- Inline GitHub links for File & Lines using single commit tree hash per run
- Keep headings and content aligned with appsec review expectations
Also ran fmt/clippy and updated tests to pass.
- Move dedup step ahead of risk rerank to avoid redundant rerank and improve grouping
- Normalize severities before dedup; filter to High/Medium/Low
- After rerank, re-normalize, rewrite severity in markdown, and filter again if needed
- Minor fix in triage_chunk log initialization
Tests: cargo test -p codex-tui (passed)
Note these two types were identical, so it seems clear to standardize on the one in `codex_protocol` and eliminate the `Into` stuff.
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/5218).
* #5222
* __->__ #5218
1. If Codex detects that a `codex mcp add -url …` server supports oauth,
it will auto-initiate the login flow.
2. If the TUI starts and a MCP server supports oauth but isn't logged
in, it will give the user an explicit warning telling them to log in.
Tightened the CLI integration tests to stop relying on wall-clock
sleeps—new fs watcher helper waits for session files instead of timing
out, and SSE mocks/fixtures make the flows deterministic.
keep a 1 cell margin at the right edge of the screen in the composer
(and in the user message in history).
this lets us print clear-to-EOL 1 char before the end of the line in
history, so that resizing the terminal will keep the background color
(at least in iterm/terminal.app). it also stops the cursor in the
textarea from floating off the right edge.
---------
Co-authored-by: joshka-oai <joshka@openai.com>
Add proper feature flag instead of having custom flags for everything.
This is just for experimental/wip part of the code
It can be used through CLI:
```bash
codex --enable unified_exec --disable view_image_tool
```
Or in the `config.toml`
```toml
# Global toggles applied to every profile unless overridden.
[features]
apply_patch_freeform = true
view_image_tool = false
```
Follow-up:
In a following PR, the goal is to have a default have `bundles` of
features that we can associate to a model
