434 Commits

• [plugins] Enforce marketplace source policy at runtime (#29691)

  ## Summary
  
  - project effective marketplace/plugin config through the enterprise
  source policy so blocked installed plugins become inactive
  - filter plugin list/read/discovery and CLI marketplace source/snapshot
  reporting using the same policy
  - enforce source admission for background marketplace cache refreshes
  - continue refreshing/upgrading independent marketplaces and plugins
  when one entry fails, returning per-entry errors
  - include policy-projected plugin state in cache and refresh keys so
  requirement changes invalidate stale results
  
  ## Stack
  
  This is PR 2 of 2 and is based on #29690. Review the admission model and
  source matcher in #29690 first; this PR contains only runtime
  enforcement.
  
  ## Test plan
  
  - `just test -p codex-core-plugins` (287 tests)
  - `just test -p codex-cli
  plugin_list_ignores_implicit_system_marketplace_roots_without_manifests`
  - `cargo check -p codex-cli -p codex-app-server --tests`

  xl-openai · 2026-06-27 15:22:05 -07:00
  9dbdb4e2c0
• app-server: structure and test JSON shutdown logs (#30314)

  ## Why
  
  `LOG_FORMAT=json` and `RUST_LOG` are supported by app-server, but the
  behavior was only covered indirectly. We should verify the actual JSONL
  written by both user-facing entry points: `codex app-server` and the
  standalone `codex-app-server` binary.
  
  The existing processor shutdown message also always said the channel
  closed, even though the processor can exit for several different
  reasons. Structured fields make that event more accurate and useful to
  log consumers.
  
  ## What changed
  
  - Record the processor `exit_reason`, remaining connection count, and
  forced-shutdown state as structured tracing fields.
  - Add a shared process-test helper that enables JSON logging, validates
  every stderr line as JSON, and verifies the top-level timestamp is RFC
  3339.
  - Cover both `codex app-server` and `codex-app-server`, asserting the
  stable `level`, `fields`, and `target` payload.
  
  ## Test plan
  
  - `just test -p codex-app-server
  standalone_app_server_emits_json_info_events`
  - `just test -p codex-cli app_server_emits_json_info_events`

  Michael Bolin · 2026-06-26 18:19:56 -07:00
  4f1b5a4b73
• [codex] Support npm marketplace plugin sources (#29375)

  ## Why
  
  Marketplace source deserialization treated `{"source":"npm", ...}` as
  unsupported. The loader logged and skipped the entry, so npm-backed
  plugins never appeared in `plugin list --available` and `plugin add`
  returned "plugin not found".
  
  Codex plugins are installed from a plugin root, not from an npm
  dependency tree. For npm-backed marketplace entries, Codex should fetch
  the published package contents without running package scripts or
  installing unrelated dependencies.
  
  ## What changed
  
  - Add `npm` marketplace plugin sources with `package`, optional semver
  `version` or version range, and optional HTTPS `registry`.
  - Reject unsafe npm source fields before materialization, including
  invalid package names, non-semver version selectors, plaintext or
  credential-bearing registry URLs, and registry query/fragment data.
  - Materialize npm plugins with `npm pack --ignore-scripts`, then unpack
  the resulting tarball through the existing hardened plugin bundle
  extractor.
  - Enforce npm archive and extracted-size limits, require the standard
  npm `package/` archive root, and verify the extracted `package.json`
  name matches the requested package before installing.
  - Keep plugin listings, install-source descriptions, CLI JSON/human
  output, app-server v2 `PluginSource`, TUI source summaries, regenerated
  schema fixtures, and app-server documentation in sync.
  
  ## Impact
  
  Marketplaces can distribute Codex plugins from public or configured
  private HTTPS npm registries using the same install flow as existing
  materialized plugin sources. `npm` must be available on `PATH` when an
  npm-backed plugin is installed.
  
  Fixes #27831
  
  ## Validation
  
  - `just write-app-server-schema`
  - `just test -p codex-core-plugins -p codex-app-server-protocol -p
  codex-app-server -p codex-cli`
    - npm/schema/core-plugin coverage passed in the run.
  - The full focused command finished with `1739 passed`, `11 failed`, and
  `6 timed out`; the failures were unrelated local app-server environment
  failures from `sandbox-exec: sandbox_apply: Operation not permitted`
  plus one missing `test_stdio_server` helper binary.
  - Installed an npm-published Codex plugin package through a throwaway
  local marketplace and throwaway `CODEX_HOME` to exercise the real npm
  materialization path end to end.

  charlesgong-openai · 2026-06-26 17:24:46 -04:00
  6509f3148a
• [codex] Surface MCP reauthentication-required startup failures (#29877)

  ## Summary
  
  - distinguish expired, non-refreshable stored MCP OAuth credentials from
  first-time missing credentials
  - carry a typed `failureReason: "reauthenticationRequired"` on the
  existing `mcpServer/startupStatus/updated` notification only when user
  action is required
  - keep the public MCP auth-status API unchanged and regenerate the
  app-server protocol schemas and documentation
  
  ## Why
  
  An MCP server with an expired access token and no usable refresh token
  currently fails startup without giving clients a reliable, typed
  recovery signal.
  
  The existing startup-status notification is the natural place to carry
  this state. Its nullable `failureReason` keeps the recovery reason
  attached to the failed startup transition without adding a one-off
  notification. Internally, Codex distinguishes first-time login from
  reauthentication and emits the reason only when the startup error itself
  requires authentication.
  
  ## User impact
  
  App clients can prompt an existing user to reconnect an MCP server when
  automatic recovery is impossible by handling a failed
  `mcpServer/startupStatus/updated` notification whose `failureReason` is
  `reauthenticationRequired`. Starting, ready, cancelled, unrelated
  failures, and first-time setup carry no reauthentication reason.
  
  ## Companion app PR
  
  - openai/openai#1069582
  
  ## Validation
  
  - `just test -p codex-app-server-protocol` — 248 passed; schema fixture
  tests passed
  - `cargo check -p codex-app-server -p codex-tui`
  - `just test -p codex-rmcp-client -p codex-mcp` — 184 passed, 2 skipped
  - `just test -p codex-protocol -p codex-app-server-protocol -p
  codex-mcp` — 579 passed
  - `just write-app-server-schema`
  - `just fmt`

  felixxia-oai · 2026-06-25 21:50:36 +00:00
  a6d20ed297
• [codex] Observe remote exec-server lifecycle (#27470)

  ## Summary
  
  - Record bounded duration and outcome metrics for remote environment
  registration and Noise rendezvous connection attempts.
  - Count reconnects by bounded reason: disconnect, connection failure, or
  rejected registration.
  - Trace registration at the owning client boundary without exporting raw
  environment or registration identifiers.
  - Replace the stale pre-Noise WebSocket observability design with the
  current remote transport model.
  
  ## Stack
  
  Review and land this stack in order:
  
  1. #27466 — trace exec-server JSON-RPC requests
  2. #27467 — record bounded connection, request, and process lifecycle
  metrics
  3. #27470 — observe remote registration and Noise rendezvous lifecycle
  **(this PR)**
  
  ## Validation
  
  - `just test -p codex-exec-server --lib` (149 passed)
  - `just test -p codex-cli --test exec_server` (4 passed)
  - `just argument-comment-lint`
  - `just bazel-lock-check`
  - `just fix -p codex-exec-server -p codex-cli`
  - `just fmt`

  richardopenai · 2026-06-25 13:42:40 -07:00
  3b22498f69
• cli: rename sandbox permission profile flag (#30095)

  ## Why
  
  `codex sandbox` accepts a single named permissions profile, so the
  existing plural `--permissions-profile` spelling is misleading. The
  canonical flag and its help text should use the singular form without
  breaking scripts that already use the old spelling.
  
  ## What changed
  
  - Make `--permission-profile` the canonical flag for all sandbox
  backends.
  - Keep `--permissions-profile` as a hidden backwards-compatible alias.
  - Cover the canonical spelling, legacy alias, and help visibility with
  regression tests.
  
  ## Testing
  
  Ran `just c sandbox --help` and verified I saw:
  
  ```shell
    -P, --permission-profile <NAME>
            Named permissions profile to apply from the active configuration stack
  ```

  Michael Bolin · 2026-06-25 11:25:19 -07:00
  31b99f65cf
• [codex] Record exec-server lifecycle metrics (#27467)

  ## Summary
  
  - Record bounded connection, request, and process lifecycle metrics.
  - Report active gauges from callbacks on every collection, including
  delta exports.
  - Serialize active-count updates so concurrent starts and finishes
  cannot publish stale values.
  - Serialize process exit, explicit termination, and shutdown through the
  process registry so exactly one completion result wins.
  - Keep the implementation small with single-owner RAII guards and one
  real OTLP/HTTP integration test using the existing `wiremock`
  dependency.
  
  ## Root cause
  
  Process exit and session shutdown previously used cloned completion
  state. That avoided duplicate emission, but it duplicated lifecycle
  ownership and made the ordering harder to reason about. The process
  registry mutex already defines the lifecycle ordering, so the final
  implementation stores the metric guard and termination flag directly on
  the process entry. Whichever path claims the entry first owns the
  completion result.
  
  Production metric export uses delta temporality. Event-only synchronous
  gauge recordings disappear after the next collection when no count
  changes, so active counts now use observable callbacks that report
  current state on every collection.
  
  The cleanup also removes the constant `result="accepted"` connection
  tag, redundant route and response assertions, a custom HTTP collector,
  and fallback initialization machinery that did not add behavior.
  
  ## Stack
  
  Review and land this stack in order:
  
  1. #27466 — trace exec-server JSON-RPC requests
  2. #27467 — record bounded connection, request, and process lifecycle
  metrics **(this PR)**
  3. #27470 — observe remote registration and Noise rendezvous lifecycle
  
  ## Validation
  
  - `just test -p codex-exec-server --lib` (158 passed)
  - `just test -p codex-cli --test exec_server` (3 passed)
  - `just test -p codex-otel
  observable_gauge_is_collected_on_every_delta_snapshot` (1 passed)
  - `CARGO_BUILD_JOBS=1 just fix -p codex-otel -p codex-exec-server`
  - `just fmt`
  - `git diff --check`

  richardopenai · 2026-06-25 11:02:11 -07:00
  2dec46e30a
• Support OAuth for HTTP MCP servers from selected executor plugins (#28529)

  ## Why
  
  #28522 routes selected-plugin HTTP MCP traffic through the owning
  executor, but OAuth bootstrap and refresh still used host-local clients.
  Executor-only servers therefore cannot complete discovery or login
  through the same network boundary as the MCP connection.
  
  ## What changed
  
  - adapt `codex_exec_server::HttpClient` to RMCP 1.8's `OAuthHttpClient`
  contract
  - let RMCP own discovery, dynamic registration, PKCE, token exchange,
  and refresh
  - route auth status, persisted-token startup, and app-server login
  through the server runtime while preserving the existing local discovery
  path
  - add optional `threadId` to `mcpServer/oauth/login` and echo it in the
  completion notification
  - implement RMCP's redirect policy and 1 MiB OAuth response limit over
  executor HTTP
  - cover selected-thread OAuth discovery and login through an
  executor-only route
  
  Depends on #28522.

  jif · 2026-06-25 10:31:17 +01:00
  b215961a56
• Represent MCP authentication with an enum (#29924)

  ## Why
  
  MCP authentication has distinct OAuth and ChatGPT-session flows.
  Representing that choice as `use_chatgpt_auth` makes one flow implicit
  and allows the configuration model to express the distinction only
  through a boolean.
  
  ChatGPT credential forwarding also needs a first-party trust boundary. A
  configurable `chatgpt_base_url` controls routing, but must not grant an
  MCP server permission to receive session credentials.
  
  This change builds on #29733, where the boolean was introduced.
  
  ## What changed
  
  - Replace `use_chatgpt_auth` with an `auth` field backed by the
  exhaustive `McpServerAuth` enum.
  - Support `auth = "oauth"` and `auth = "chatgpt"`, with OAuth remaining
  the default.
  - Trust only the origin derived from the existing hardcoded
  `CHATGPT_CODEX_BASE_URL` when granting ChatGPT auth to an MCP server.
  - Keep configured bearer tokens and authorization headers ahead of the
  selected authentication flow.
  - Update config writers, schema output, fixtures, and integration-test
  setup to use the enum.
  
  ## Verification
  
  Integration coverage exercises the complete streamable HTTP startup path
  in two independent configurations:
  
  - A directly constructed MCP configuration verifies that matching an
  overridden `chatgpt_base_url` does not grant ChatGPT auth.
  - A persisted `config.toml` containing an attacker-controlled
  `chatgpt_base_url` and `auth = "chatgpt"` verifies the same boundary
  through normal config parsing.
  
  Both tests complete MCP initialization and tool listing and assert that
  the full captured request sequence contains no authorization headers.
  Separate integration coverage verifies that configured authorization
  takes precedence over ChatGPT auth.

  Ahmed Ibrahim · 2026-06-24 19:51:51 -07:00
  f8937b7d86
• Allow ChatGPT-hosted MCP servers to use session auth (#29733)

  ## Why
  
  ChatGPT session authentication was inferred from the reserved Codex Apps
  server name. That couples credential routing to Codex Apps-specific
  behavior and prevents other MCP endpoints hosted by ChatGPT from
  explicitly using the current session.
  
  The opt-in also needs a clear security boundary: an arbitrary MCP
  configuration must not be able to redirect ChatGPT credentials to
  another origin.
  
  ## What changed
  
  - Add `use_chatgpt_auth` to HTTP MCP server configuration, defaulting to
  `false`.
  - Honor the setting only when the parsed server URL has the same HTTP(S)
  origin as the configured `chatgpt_base_url`; otherwise remove the
  capability before startup.
  - Resolve bearer tokens and static or environment-backed authorization
  headers before selecting authentication, with configured authorization
  taking precedence over ChatGPT session auth.
  - Enable the setting for the built-in Codex Apps and hosted plugin
  runtime endpoints while keeping Codex Apps caching and tool
  normalization scoped to the reserved server.
  - Persist the setting through MCP config rewrite paths and expose it in
  the generated config schema.
  - Load the current login state for `codex mcp list` so reported auth
  status matches runtime behavior.
  
  ## Verification
  
  Core integration coverage exercises the complete streamable HTTP MCP
  startup path and verifies that:
  
  - a same-origin opted-in server receives the current ChatGPT access
  token;
  - an explicitly configured authorization header takes precedence;
  - a different-origin server completes MCP initialization and tool
  listing without receiving any ChatGPT authorization header.

  Ahmed Ibrahim · 2026-06-24 19:21:28 -07:00
  4c0706e24a
• feat(remote-control): add daemon pairing command (#29913)

  ## Why
  
  Users who run Codex remote control through daemon mode can keep the
  daemon running, but they do not have a CLI path to mint the short-lived
  manual pairing code needed to connect another device. Without this
  command, they need to speak app-server JSON-RPC directly.
  
  Related: #25675
  
  ## What Changed
  
  - Added `codex remote-control pair`, which connects to the existing
  daemon control socket and calls `remoteControl/pairing/start` with
  `manualCode: true`.
  - Kept the command non-lifecycle-mutating: it does not start, enable, or
  restart the daemon.
  - Human output labels the manual code as `Pairing code: ...`; `--json`
  preserves the full pairing response.
  - Added daemon socket-client, CLI formatting, and parser coverage.
  
  ## Verification
  
  - `remote_control_client::tests::start_pairing_requests_manual_code`
  verifies the daemon client sends `{ "manualCode": true }` and parses the
  complete response.
  -
  `remote_control_cmd::tests::remote_control_pairing_human_output_labels_the_manual_code`
  verifies the human-facing output.

  Anton Panasenko · 2026-06-24 18:00:06 -07:00
  f4e6aa70e5
• Keep executor plugin MCP paths URI-native (#29628)

  ## Why
  
  Executor-owned plugin roots are `PathUri`, but MCP config normalization
  still converts them into a native `Path` using the app-server host's
  rules. Relative `cwd` values can therefore resolve against the wrong
  filesystem when host and executor path conventions differ.
  
  This PR keeps executor MCP paths URI-native until the selected
  environment launches the server, while retaining the existing host
  parser behavior.
  
  ## What changed
  
  - Keep one shared MCP normalization path with narrow host-`Path` and
  executor-`PathUri` entrypoints.
  - Preserve native host resolution for locally installed plugin MCP
  configs.
  - For executor configs, default `cwd` to the plugin root and resolve
  relative working directories with the root URI's path convention.
  - Accept explicit executor `file:` URIs only when they remain within the
  selected plugin root.
  - Preserve the selected environment id and existing remote
  environment-variable ownership rules.
  - Route the executor plugin provider through the URI-native entrypoint
  without converting the root on the host.
  - Ensure `codex doctor` does not probe executor-owned stdio commands or
  foreign working directories on the host.
  - Cover foreign Windows roots, relative and absolute executor working
  directories, traversal rejection, runtime resolution, and doctor
  behavior.
  
  ```text
  plugin root:    file:///C:/plugins/demo
  configured cwd: scripts
                    |
                    v
  resolved cwd:  file:///C:/plugins/demo/scripts
                    |
                    v
  launch through the selected executor
  ```
  
  No new provider or filesystem abstraction is introduced.
  
  ## Stack
  
  1. #29614 — add lexical `PathUri` containment.
  2. #29620 — share URI-native manifest path resolution.
  3. #28918 — keep selected plugin roots and resources URI-native.
  4. #29626 — load executor skills without host path conversion.
  5. **This PR** — resolve executor MCP working directories without host
  path conversion.

  jif · 2026-06-24 09:46:07 +01:00
  3e39e92f03
• [plugins] Enforce marketplace source admission requirements (#29753)

  ## Why
  
  Managed marketplace source requirements only become effective when every
  local marketplace mutation path applies the same admission decision.
  This change centralizes that decision so CLI, app-server, and
  external-agent migration flows cannot add, install from, or refresh a
  disallowed source.
  
  ## What changed
  
  - Match exact normalized Git repository URLs with an optional exact
  `ref`.
  - Match Git hosts with managed regular expressions.
  - Match local marketplaces by exact absolute path.
  - Preserve the expected path/name boundary for managed OpenAI
  marketplaces.
  - Enforce source admission during marketplace add, plugin install, and
  configured Git marketplace upgrade.
  - Continue upgrading independent marketplaces when one source is
  rejected and return a per-marketplace error.
  - Load the effective requirements stack at CLI, app-server, and
  external-agent migration entry points.
  
  This PR does not filter already configured marketplaces at runtime; that
  remains in draft follow-up #29691.
  
  ## Stack
  
  This is PR 2 of 3 and is based on #29690, which introduces the
  requirements data shape and merge behavior.
  
  ## Test plan
  
  - Source matcher coverage for Git URL/ref, host-pattern, local-path, and
  managed marketplace cases.
  - Marketplace add and plugin install coverage for allowed and rejected
  sources.
  - Marketplace upgrade coverage for rejection and per-marketplace
  continuation.

  xl-openai · 2026-06-23 20:13:11 -07:00
  4fe02f4fcf
• auth: move domain mode below app wire types (#29721)

  ## Why
  
  Authentication mode is a domain concept used by login, model selection,
  telemetry, and transports. Keeping the canonical type in app-server
  protocol forces those lower-level crates to depend on an unrelated wire
  API.
  
  ## What changed
  
  - Added canonical `codex_protocol::auth::AuthMode` domain values.
  - Kept the app-server wire DTO unchanged and added an explicit app-side
  conversion.
  - Removed production app-server-protocol dependencies from login,
  model-provider-info, models-manager, and otel call paths.
  
  ## Stack
  
  This is PR 2 of 6, stacked on [PR
  #29714](https://github.com/openai/codex/pull/29714). Review only the
  delta from `codex/split-json-rpc-protocols`. Next: [PR
  #29722](https://github.com/openai/codex/pull/29722).
  
  ## Validation
  
  - Auth and login coverage passed in the focused protocol/domain test
  run.
  - App-server account and auth conversion coverage passed.

  Adam Perry @ OpenAI · 2026-06-24 03:10:20 +00:00
  31372078d1
• [codex] Preserve proxy state for filesystem sandbox helpers (#29671)

  ## Why
  
  Filesystem helpers intentionally run with a minimal environment that
  excludes proxy variables. After filesystem operations started using the
  Windows sandbox wrapper, the wrapper derived an empty proxy
  configuration from that helper environment and compared it with the
  persistent sandbox setup marker. When the marker contained proxy ports,
  every filesystem operation appeared to require a firewall update, which
  could launch elevated setup, show a UAC or loader dialog, and fail
  operations such as `apply_patch` with error 1223.
  
  Filesystem helpers do not use network access, so they should preserve
  the proxy/firewall state established by normal sandboxed process
  launches.
  
  ## What changed
  
  - Add an explicit Windows sandbox proxy-settings mode for reconciling or
  preserving persistent proxy state.
  - Use preserve mode for filesystem helpers while normal process launches
  continue to reconcile proxy settings from their environment.
  - Carry the selected proxy state consistently through setup validation,
  elevated setup, and non-elevated ACL refreshes.
  - Cover wrapper argument propagation and marker-derived proxy
  preservation.
  
  ## Validation
  
  - `cargo build -p codex-cli --bin codex`
  - `just test -p codex-windows-sandbox
  preserving_proxy_settings_uses_the_existing_marker`
  - `just test -p codex-windows-sandbox windows_wrapper_args_round_trip`
  - `just test -p codex-windows-sandbox
  setup_request_prefers_explicit_proxy_settings`
  - `just test -p codex-sandboxing transform_for_direct_spawn_windows`
  - `just test -p codex-exec-server fs_sandbox::tests`
  - Ran the same sandboxed `fs/writeFile` reproduction against published
  `0.142.0-alpha.6` and the new CLI. The published CLI launched elevated
  setup and failed with `ShellExecuteExW ... 1223`; the new CLI completed
  without elevation.
  
  Related to #28359.

  iceweasel-oai · 2026-06-23 12:29:46 -07:00
  18fe1d9fe3
• Prepare managed network sandbox context (#29456)

  ## Why
  
  Managed network configures commands to use local HTTP and SOCKS proxies.
  For commands delegated to the exec server, the proxy environment and the
  sandbox policy were prepared separately. On macOS, that meant a command
  could receive `HTTPS_PROXY=http://127.0.0.1:43123` while Seatbelt still
  denied access to port `43123`.
  
  ## What changed
  
  `NetworkProxy` now prepares the command environment and sandbox context
  together from the same runtime snapshot:
  
  ```text
  Prepared managed network
  ├── command environment: HTTPS_PROXY=http://127.0.0.1:43123
  └── sandbox context: allow outbound to 127.0.0.1:43123
  ```
  
  That context travels with remote exec requests. The exec server
  preserves the managed proxy and CA environment, and macOS Seatbelt
  allows only the prepared loopback proxy ports without enabling broad
  network access or local binding.
  
  The protocol field is optional and the existing enforcement flag remains
  in place, preserving compatibility with callers that do not send the new
  context.

  jif · 2026-06-23 20:07:09 +01:00
  e476fc16ce
• Allow codex sandbox to consume MCP sandbox state (#29358)

  ## Summary
  
  - let `codex sandbox` accept the JSON value from
  `codex/sandbox-state-meta`
  - require the payload `permissionProfile` instead of falling back to
  ambient permissions
  - reuse the existing macOS, Linux, and Windows launch paths, treating
  external sandbox state conservatively as read-only
  - let opaque forwarders add runtime read roots and disable direct
  network access without decoding the payload
  
  Builds on #29113, which is now on `main`.
  
  ## Tests
  
  - `just test -p codex-cli debug_sandbox::tests`
  - `cargo build -p codex-rmcp-client --bin test_stdio_server`
  - `just test -p codex-core
  stdio_mcp_tool_call_includes_sandbox_state_meta`
  - `just test -p codex-mcp`
  - `just fmt`

  jif · 2026-06-23 10:17:52 +02:00
  d2484697b1
• mcp: accept foreign absolute cwd for remote stdio (#29493)

  ## Why
  
  Remote stdio MCP servers can run in an environment whose path convention
  differs from the Codex host. A Windows cwd such as
  `C:\Users\openai\share` is absolute for the executor but was rejected by
  a POSIX orchestrator.
  
  Built on #29501, now merged, which only clarifies the host-native
  `PathUri` constructor name.
  
  ## What changed
  
  - Deserialize MCP cwd values as `LegacyAppPathString` so config does not
  apply host path rules.
  - Interpret that spelling as host-native for local launches and convert
  it to `PathUri` at executor launch.
  - Skip host filesystem and command resolution checks for remote stdio in
  `codex doctor`.
  - Add host-independent config and executor-boundary coverage using the
  foreign path convention for each test platform.
  
  ## Validation
  
  - `just test -p codex-utils-path-uri -p codex-config -p codex-mcp -p
  codex-rmcp-client` (408 passed)
  - `just test -p codex-cli -p codex-rmcp-client` (372 passed)
  - `cargo check --workspace --tests`
  - `just test` (11,311 passed; 43 unrelated environment/timing failures)
  - `just fix -p codex-cli -p codex-config -p codex-core -p codex-mcp -p
  codex-mcp-extension -p codex-rmcp-client -p codex-tui`

  Adam Perry @ OpenAI · 2026-06-23 01:33:51 +00:00
  67009bc53f
• PAC 2 - Add shared auth system proxy contract (#26707)

  ## Summary
  
  Stacked on #26706.
  
  Adds the shared auth/system-proxy contract that later platform resolver
  PRs plug into. This PR moves Codex-owned auth and startup HTTP clients
  through a common route-aware boundary, but does not yet add Windows or
  macOS system proxy resolution.
  
  The default path remains unchanged when `respect_system_proxy` is absent
  or disabled.
  
  ## Implementation
  
  - Adds `codex-client/src/outbound_proxy.rs` with the shared
  route-selection model:
    - `OutboundProxyConfig`;
    - `ClientRouteClass`;
    - `RouteFailureClass`;
    - `build_reqwest_client_for_route`.
  - Preserves the existing reqwest/default-client behavior when no route
  config is supplied.
  - Uses the fixed MVP routing policy when route config is supplied:
  platform system/PAC/WPAD discovery, then explicit env proxy variables,
  then direct connection.
  - Keeps platform-specific system discovery behind the shared client
  boundary. This PR provides the contract and fallback behavior; later
  resolver PRs plug in Windows and macOS discovery.
  - Adds `login::AuthRouteConfig` so auth call sites depend on a small
  policy type instead of platform resolver details.
  - Maps the resolved `Config.respect_system_proxy` boolean into
  `AuthRouteConfig` for auth-owned clients.
  - Wires the route config through browser login, device-code login,
  access-token login, login status, logout/revoke, token refresh, API-key
  exchange, app-server account login, TUI/app startup, cloud-config
  bootstrap, cloud tasks, plugin auth, and exec startup config loading.
  
  ## End-user behavior
  
  - No behavior changes by default.
  - When `respect_system_proxy = true`, auth-owned clients opt into the
  shared route-aware client path.
  - On platforms without a resolver implementation in this PR, system
  discovery is unavailable and the route-aware path falls back to explicit
  env proxy handling, then direct connection.
  - Custom CA handling remains separate from proxy route selection and
  still runs through the shared client builder.
  - No proxy URLs, PAC contents, or resolved platform details are exposed
  through the public config surface introduced here.
  
  ## Tests
  
  Adds or updates coverage for:
  
  - preserving default auth-client fallback behavior when no route config
  is provided;
  - injected environment-proxy fallback without mutating process
  environment;
  - existing login-server E2E flows using explicit `auth_route_config:
  None` to guard unchanged default behavior;
  - updated auth manager, login, logout, cloud-config, startup, and
  plugin-auth call sites passing route config explicitly.

  canvrno-oai · 2026-06-22 13:03:11 -07:00
  1659c4a629
• Persist session IDs across thread resume (#29327)

  ## Summary
  
  A cold-resumed subagent kept its durable thread ID but could receive a
  new session ID, splitting one agent tree across multiple sessions after
  a restart.
  
  Persist the root session ID in every rollout `SessionMeta`, carry it
  through thread creation, and restore it before initializing the resumed
  `Session` and `AgentControl`.
  
  ## Behavior
  
  For a nested agent tree:
  
  ```text
  root session R
    parent thread P
      child thread C
  ```
  
  The child rollout stores:
  
  ```text
  session_id:       R
  parent_thread_id: P
  id:               C
  ```
  
  After a cold resume, the child still belongs to root session `R` while
  its immediate parent remains `P`. The integration coverage uses distinct
  values for all three IDs so it catches restoring the session from
  `parent_thread_id`.
  
  ## Legacy rollouts
  
  Previous rollouts have `id` but no `session_id`. `SessionMetaLine`
  deserialization treats a missing `session_id` as `id`, keeping those
  files readable, listable, and resumable. When a legacy subagent is
  resumed through its root, that synthesized child ID no longer overrides
  the inherited root-scoped `AgentControl`. New rollouts always persist
  the explicit root session ID.

  jif · 2026-06-22 09:36:08 +02:00
  6d15bb3d17
• Scope network approvals by environment (#28899)

  Stacked on #28766.
  
  ## Why
  
  Network approvals are environment-scoped: allowing a host in one
  execution environment should not allow the same host in another
  environment.
  
  #28766 adds the inert IDs and constructor plumbing. This PR applies the
  behavior on top.
  
  ## What changed
  
  - Route managed network traffic through per-environment HTTP and SOCKS
  proxy listeners.
  - Stamp HTTP, HTTPS CONNECT, SOCKS TCP, and SOCKS UDP policy requests
  with the source environment at the proxy boundary.
  - Carry the selected execution environment through shell, unified exec,
  zsh-fork, and sandbox transform paths.
  - Include the environment in pending, approved-for-session, and
  denied-for-session network approval cache keys.
  - Include the environment in approval IDs and approval prompts.
  - Preserve legacy fallback for unattributed requests, but deny when
  active-call attribution is ambiguous.
  - Fail closed if an environment-specific proxy endpoint cannot be
  prepared.
  
  ## Validation
  
  - just fmt
  - CI will run tests and clippy

  jif · 2026-06-19 13:49:45 +02:00
  bd5d31b250
• feat: opt ChatGPT auth into agent identity (#19049)

  ## Stack
  
  This is PR 2 of the simplified HAI single-run-task stack:
  
  - [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
  assertion and task-registration primitives, including the shared
  run-task helper used by existing Agent Identity JWT auth.
  - [#19049](https://github.com/openai/codex/pull/19049)
  Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
  Agent Identity runtime auth and its single run task.
  - [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
  provider auth that uses one backend-owned task id for first-party
  inference and compaction requests.
  
  [#19054](https://github.com/openai/codex/pull/19054) collapsed out of
  the active stack because the simplified design no longer needs a
  separate background/control-plane task helper.
  
  ## Summary
  
  This PR adds the disabled-by-default path for normal ChatGPT-login Codex
  sessions to obtain Agent Identity runtime auth through the Codex
  backend. Existing Agent Identity JWT startup mode remains a separate
  path and does not require the feature flag.
  
  What changed:
  
  - adds the experimental `use_agent_identity` feature flag and config
  schema entry
  - adds an explicit `AgentIdentityAuthPolicy` so call sites choose
  `JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
  - stores standalone Agent Identity JWT credentials separately from
  backend-registered Agent Identity records
  - persists the registered Agent Identity record, private key, and single
  run task id in `auth.json` so process restarts reuse the same identity
  - derives the agent/task registration base URL from ChatGPT/Codex auth
  config while keeping JWT JWKS lookup separate
  - provisions and caches ChatGPT-derived Agent Identity runtime auth when
  `use_agent_identity` is enabled
  - reuses the shared run-task registration helper from PR1 rather than
  adding a second task-registration path
  
  This PR intentionally does not switch model inference over to
  `AgentAssertion` auth. The provider-auth integration lands in the next
  PR.
  
  ## Testing
  
  - `just test -p codex-login`

  Adrian · 2026-06-18 14:05:27 -07:00
  ec848dde0e
• [codex] Initialize exec-server OpenTelemetry at startup (#25019)

  ## Summary
  
  - Initialize stderr tracing and the configured OpenTelemetry provider
  for local and remote `codex exec-server` startup.
  - Instrument the local and remote server entrypoints with a root runtime
  span.
  - Keep raw Noise environment, registration, and stream identifiers out
  of exported spans while preserving them in local debug events.
  - Keep telemetry setup in a focused CLI module instead of growing the
  top-level command entrypoint.
  
  ## Stack
  
  - Previous: none (`#27058` has merged)
  - Next: #27466
  
  ## Validation
  
  - `just test -p codex-exec-server --lib` (139 passed)
  - `just test -p codex-cli --test exec_server` (3 passed)
  - `just bazel-lock-check`
  - `just fix -p codex-exec-server -p codex-cli`
  - `just fmt`
  
  ---------
  
  Co-authored-by: Richard Lee <richardlee@openai.com>

  starr-openai · 2026-06-18 11:03:42 -07:00
  4c7228e423
• feat: add run task identity primitives (#19047)

  ## Stack
  
  This is PR 1 of the simplified HAI single-run-task stack:
  
  - [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
  assertion and task-registration primitives, including the shared
  run-task helper used by existing Agent Identity JWT auth.
  - [#19049](https://github.com/openai/codex/pull/19049)
  Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
  Agent Identity runtime auth and its single run task.
  - [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
  provider auth that uses one backend-owned task id for first-party
  inference and compaction requests.
  
  [#19054](https://github.com/openai/codex/pull/19054) collapsed out of
  the active stack because the simplified design no longer needs a
  separate background/control-plane task helper.
  
  ## Summary
  
  The simplified POC shape is one backend-owned task per Agent Identity
  run. This PR makes the first layer match that final shape directly
  instead of introducing task targets, caller-owned external task refs, or
  intermediate wrappers that later PRs would need to undo.
  
  What changed:
  
  - keeps the `AgentAssertion` wire payload as `agent_runtime_id`,
  `task_id`, `timestamp`, and `signature`
  - exposes `register_agent_task` as the single task-registration helper
  for both existing Agent Identity JWT auth and the ChatGPT-registration
  path added later in the stack
  - makes task registration send only the signed registration timestamp;
  the backend owns the returned opaque task id
  - removes the unused target/task-kind/external-task-ref surfaces from
  `codex-agent-identity`
  - keeps Agent Identity JWT JWKS lookup separate from agent/task
  registration URL derivation
  - updates Agent Identity JWT auth to register one run task during auth
  construction and share that task across cloned auth handles
  
  This PR intentionally does not enable ChatGPT-derived Agent Identity.
  That opt-in and config gate are added in the next PR.
  
  ## Testing
  
  - `just test -p codex-agent-identity`

  Adrian · 2026-06-17 11:23:39 -07:00
  d9e0551564
• [codex] Load API curated marketplace by auth (#28383)

  ## Summary
  - choose the local OpenAI curated marketplace manifest based on auth:
  Codex backend auth gets the existing marketplace, direct provider auth
  gets `api_marketplace.json`
  - include Bedrock API key auth in the direct-provider API marketplace
  path
  - safely skip the API marketplace when `api_marketplace.json` is absent
  
  ## Validation
  - `just fmt`
  - `git diff --check origin/main...HEAD`
  - CI should run the full validation
  
  ## Manual Testing
  
  ### - New api marketplace not available for API key sign
  1. Safely not display anything from api marketplace
  <img width="1161" height="289" alt="Screenshot 2026-06-15 at 21 37 43"
  src="https://github.com/user-attachments/assets/a5f16642-8a20-4ac1-a0de-1274a4c7b5b2"
  />
  
  ### - New api marketplace for API key sign in
  1. Setup api_marketplace.json
  ```
  {
    "name": "openai-curated",
    "interface": {
      "displayName": "Codex official"
    },
    "plugins": [
      {
        "name": "linear",
        "source": {
          "source": "local",
          "path": "./plugins/linear"
        },
        "policy": {
          "installation": "AVAILABLE",
          "authentication": "ON_INSTALL"
        },
        "category": "Productivity"
      }
    ]
  }
  ```
  
  2. Log in with API key, observe that only the defined plugin from
  api_marketplace.json is available from "Codex Official" (outside of
  local testing marketplaces)
  <img width="1167" height="446" alt="Screenshot 2026-06-15 at 21 16 53"
  src="https://github.com/user-attachments/assets/7cf61477-d826-4ef6-bc05-0a23ac1c0259"
  />
  
  also checked functionality on codex app
  
  ### - SiWC users 
  Still uses 'default' marketplace.json and renders all plugins
  <img width="1171" height="502" alt="Screenshot 2026-06-15 at 21 40 25"
  src="https://github.com/user-attachments/assets/d212ea9b-0aa5-470b-8ea4-450efe65bb2b"
  />
  
  also checked functionality on codex app
  
  
  ## Notes
  - `just test -p codex-core-plugins` was started locally before splitting
  branches, but I stopped relying on local tests per follow-up and left
  final validation to PR CI.

  felixxia-oai · 2026-06-16 01:16:11 +00:00
  02dce8eb8d
• exec-server: default remote transport to Noise (#26245)

  ## Why
  
  The transport in
  [openai/codex#26242](https://github.com/openai/codex/pull/26242) needs
  to be used by every remote orchestrator-to-executor connection before
  JSON-RPC traffic starts.
  
  ## Changes
  
  - Generates one executor Noise identity when remote exec-server starts
  and registers its public key.
  - Creates a harness identity for each physical remote environment
  connection.
  - Fetches a fresh registry bundle before connecting and validates the
  authenticated harness key before completing the executor handshake.
  - Multiplexes encrypted logical streams over the existing executor
  WebSocket.
  - Adds bounded stream, handshake-failure, and reassembly state.
  - Adds safe lifecycle diagnostics without logging keys, authorizations,
  plaintext, or ciphertext.
  - Covers reconnects, replay rejection, validation failure, framing
  limits, and encrypted JSON-RPC tool traffic.
  
  ## Stack
  
  1. [openai/codex#26242](https://github.com/openai/codex/pull/26242):
  Noise channel and relay transport
  2. **[openai/codex#26245](https://github.com/openai/codex/pull/26245)**:
  remote registration and runtime activation
  
  ## Verification
  
  - `just test -p codex-exec-server`
  - `just fix -p codex-exec-server`
  - `just bazel-lock-check`
  - `cargo shear`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-06-15 17:39:00 -07:00
  6e50b22e55
• Add hidden Windows sandbox wrapper entrypoint (#28358)

  ## Why
  
  This is the second PR in the Windows fs-helper sandbox stack. The
  fs-helper path needs a Windows sandbox launcher that has the same
  argv-shaped contract as macOS `sandbox-exec` and `codex-linux-sandbox`,
  but this PR only introduces that hidden launcher. It does not route
  fs-helper through it yet.
  
  The hidden launcher still needs to be policy-complete before later
  direct-spawn callers use it. In particular, it has to carry the same
  Windows sandbox policy details that the existing spawn paths already
  understand: proxy enforcement, read/write root overrides, and
  deny-read/deny-write overrides.
  
  ## What Changed
  
  - Added the hidden `codex.exe --run-as-windows-sandbox` arg1 dispatch
  path.
  - Added `windows-sandbox-rs/src/wrapper.rs`, which parses the wrapper
  argv, launches the requested command through the shared Windows sandbox
  session runner from PR1, and forwards stdio.
  - Added `create_windows_sandbox_command_args_for_permission_profile()`
  so later direct-spawn callers can build the wrapper argv consistently.
  - Made the wrapper argv round-trip the full Windows sandbox policy
  surface it needs later: workspace roots, environment, permission
  profile, sandbox level, private desktop, proxy enforcement, read/write
  root overrides, and deny-read/deny-write overrides.
  - Carried `proxy_enforced` through the shared Windows session request so
  proxy-managed executions continue to use the offline/elevated sandbox
  identity.
  - Added wrapper argument round-trip coverage for the full policy fields.
  
  ## Verification
  
  - `just test -p codex-windows-sandbox windows_wrapper_args_round_trip`
  - `just test -p codex-arg0`
  - `just test -p codex-core exec::tests::windows_`
  - `just fix -p codex-windows-sandbox -p codex-core -p codex-cli`
  
  Local note: the full `just fmt` command still fails on this workstation
  in non-Rust formatter setup (`uv` cache access denied and missing
  `dotslash`/buildifier), but the Rust formatter phase completed.

  iceweasel-oai · 2026-06-15 21:30:32 +00:00
  fbbe7706d6
• Extract shared Windows sandbox session runner (#28357)

  ## Why
  
  This is the first PR in a stack for the Windows fs-helper sandbox fix.
  Before changing fs-helper behavior, this pulls the reusable Windows
  sandbox session launch pieces out of the debug CLI path so later PRs can
  call the same backend selection and stdio forwarding logic.
  
  Keeping this as a pure refactor makes the later security fix easier to
  review: `codex sandbox windows` should continue to launch the same
  elevated or restricted-token backend, just through shared APIs in
  `windows-sandbox-rs` instead of code local to
  `cli/src/debug_sandbox.rs`.
  
  ## What Changed
  
  - Added `WindowsSandboxSessionRequest` and
  `spawn_windows_sandbox_session_for_level()` in `windows-sandbox-rs` to
  share the elevated-vs-legacy session launch decision.
  - Moved the Windows sandbox stdio forwarding helpers from
  `cli/src/debug_sandbox.rs` into
  `windows-sandbox-rs/src/stdio_bridge.rs`.
  - Updated `codex sandbox windows` to call the shared session launcher
  and stdio bridge.
  - Added unit coverage for the moved stdio forwarding helpers.
  
  ## Verification
  
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - `just test -p codex-windows-sandbox stdio_bridge::tests`
  - `just fix -p codex-windows-sandbox -p codex-sandboxing -p
  codex-exec-server -p codex-arg0 -p codex-core -p codex-file-system`
  - The new `stdio_bridge` tests also passed as part of `just test -p
  codex-windows-sandbox` on the stack tip. That full local run still fails
  in pre-existing legacy session integration tests with
  `CreateRestrictedToken failed: 87` on this workstation.

  iceweasel-oai · 2026-06-15 18:30:48 +00:00
  c3415f76c9
• feat: use encrypted local secrets for MCP OAuth (#27541)

  ## Summary
  
  - store MCP OAuth credentials in the configured auth credential backend
  - support encrypted-local OAuth storage, including legacy keyring
  migration
  - propagate the credential backend through MCP refresh, session, CLI,
  and app-server paths
  
  ## Stack
  
  1. #27504 — config and feature flag
  2. #27535 — auth-specific secret namespaces
  3. #27539 — encrypted CLI auth storage
  4. this PR — encrypted MCP OAuth storage
  
  This is a parallel review stack; the original #17931 remains unchanged.
  
  ## Tests
  
  - `just test -p codex-rmcp-client` (the transport round-trip test passed
  after building the required `codex` binary and retrying)
  - `just test -p codex-mcp`
  - `just test -p codex-app-server
  refresh_config_uses_latest_auth_keyring_backend`
  - `just test -p codex-core
  refresh_mcp_servers_is_deferred_until_next_turn`
  - `just test -p codex-cli mcp`
  - `just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli
  -p codex-app-server -p codex-protocol`
  - `just bazel-lock-check`

  Celia Chen · 2026-06-12 22:03:51 +00:00
  9915d34684
• feat: use encrypted local secrets for CLI auth (#27539)

  ## Why
  
  Windows Credential Manager limits generic credential blobs to 2,560
  bytes. Large serialized ChatGPT auth payloads can exceed that limit, so
  keyring-mode CLI auth needs a backend that keeps only the encryption key
  in the OS keyring and stores the payload in Codex's encrypted
  local-secrets file.
  
  This is the third PR in the encrypted-auth stack:
  
  1. #27504 — feature and config selection
  2. #27535 — auth-specific local-secrets namespaces
  3. This PR — CLI auth implementation and activation
  4. MCP OAuth implementation and activation
  
  ## What Changed
  
  - Added encrypted CLI-auth storage using the `CliAuth` secrets
  namespace.
  - Preserved direct keyring storage for platforms/configurations where it
  remains selected.
  - Selected the backend consistently for login, logout, refresh,
  device-code login, auth loading, and login restrictions.
  - Threaded resolved bootstrap/full config through CLI, exec, TUI,
  app-server account handling, cloud config, and cloud tasks.
  - Removed stale `auth.json` fallback data after successful encrypted
  saves and removed encrypted, direct-keyring, and fallback data during
  logout.
  - Added storage and integration coverage for both direct and encrypted
  keyring modes.
  
  MCP OAuth persistence is intentionally left to the next PR.
  
  ## Validation
  
  - `just test -p codex-login` — 131 passed
  - `just test -p codex-cli` — 280 passed
  - `just test -p codex-app-server v2::account` — 25 passed
  - `just test -p codex-cloud-config service` — 21 passed, 7 skipped
  - `just fix -p codex-login`
  - `just fix -p codex-cli`
  - `just fmt`

  Celia Chen · 2026-06-12 21:23:50 +00:00
  56c97e3b5c
• [login] revoke existing auth before starting login (#27674)

  ## Why
  
  `codex login` previously persisted newly issued OAuth credentials and
  only then attempted to revoke the superseded refresh token. The old
  credential must be revoked before a replacement browser or device-code
  flow starts, and successful login must not perform any post-login
  revocation attempt.
  
  ## What changed
  
  - Revoke and clear existing stored auth before browser or device-code
  CLI login begins.
  - Remove superseded-token detection and revocation from the shared token
  persistence path; successful login now only saves the new credentials.
  - Read the raw configured auth store during CLI cleanup so
  environment-provided auth cannot mask the stored refresh token.
  - Preserve `auto` storage fallback semantics when keyring deletion fails
  by clearing the fallback auth file.
  - Add a process-level CLI regression test that requires the revoke
  request to precede every device-login request and occur exactly once.
  
  If replacement login is canceled or fails, the previous local
  credentials have already been cleared. Remote revocation remains best
  effort, matching explicit logout behavior.
  
  ## Validation
  
  ### Process-level before/after reproduction
  
  I compiled the real `codex` CLI from the pre-fix parent (`14df0e8833`)
  and from the PR implementation (`25c002f23b`; the login behavior is
  unchanged at the current head), then ran the same device-code flow
  against a local HTTP mock OAuth authority.
  
  Each run:
  
  1. Used a fresh temporary `CODEX_HOME` configured with
  `cli_auth_credentials_store = "file"`.
  2. Seeded that temporary home with managed ChatGPT auth containing
  `old-access` and `old-refresh` tokens.
  3. Pointed `CODEX_REVOKE_TOKEN_URL_OVERRIDE` at the mock `/oauth/revoke`
  endpoint.
  4. Ran the compiled CLI as:
  
     ```shell
     CODEX_HOME=<temporary-home> \
       CODEX_REVOKE_TOKEN_URL_OVERRIDE=<mock-issuer>/oauth/revoke \
  <compiled-codex> login --device-auth --experimental_issuer <mock-issuer>
     ```
  
  5. Recorded every request received by the mock authority. The mock
  marked `new-access` valid when `/oauth/token` issued it and invalidated
  it if `/oauth/revoke` arrived afterward, reproducing the observed
  session-invalidating failure mode. After login exited, the harness also
  verified the persisted refresh token and probed a protected endpoint
  with `new-access`.
  
  | Build | Observed request order | CLI/persistence result | `new-access`
  probe |
  | --- | --- | --- | --- |
  | Pre-fix | `usercode → device token → OAuth token →
  revoke(old-refresh)` | Exit `0`; `new-refresh` persisted | `401` |
  | PR | `revoke(old-refresh) → usercode → device token → OAuth token` |
  Exit `0`; `new-refresh` persisted | `200` |
  
  The PR run therefore issued exactly one revocation request, before any
  request that initiated the replacement login, and issued no revocation
  after token exchange.
  
  ### Regression coverage
  
  
  `codex-rs/cli/tests/login.rs::device_login_revokes_existing_auth_before_requesting_new_tokens`
  runs the real first-party `codex` binary against a `wiremock` OAuth
  server with an isolated temporary `CODEX_HOME`. It asserts:
  
  - the exact request sequence is `/oauth/revoke`,
  `/api/accounts/deviceauth/usercode`, `/api/accounts/deviceauth/token`,
  then `/oauth/token`;
  - there is exactly one revoke request and its body contains
  `old-refresh` with the `refresh_token` hint;
  - the completed login persists `new-refresh`.
  
  Local validation:
  
  - `just test -p codex-login` — 130 passed
  - `just test -p codex-cli` — 280 passed, including the new process-level
  regression test
  - `just bazel-lock-check`

  cooper-oai · 2026-06-12 12:38:30 -07:00
  d1aaf789ad
• feat(app-server): persist remote-control desired state (#27445)

  ## Why
  
  Remote-control runtime enablement and persisted enrollment preference
  were represented by separate flags. That made startup rehydration, RPC
  persistence, and new-enrollment seeding race with one another, and it
  did not cleanly distinguish runtime-only CLI or daemon starts from
  durable app-server RPC changes.
  
  ## What Changed
  
  - Replace the parallel enablement, seed, and rehydration flags with one
  transport-owned `RemoteControlDesiredState`.
  - Add nullable enrollment-scoped persistence and preserve existing
  preferences during enrollment upserts.
  - Rehydrate plain startup only after auth and client scope resolve,
  without overwriting a concurrent RPC transition.
  - Make ordinary `remoteControl/enable` and `remoteControl/disable`
  durable while retaining `ephemeral: true` for runtime-only callers.
  - Have the daemon explicitly request ephemeral enablement and regenerate
  the app-server schemas.
  
  ## Verification
  
  - Covered migration and `NULL`/`0`/`1` persistence round trips.
  - Covered plain-start rehydration and runtime-only versus durable
  enrollment seeding.
  - Covered durable enable, durable disable, and ephemeral enable through
  app-server RPC.
  - Covered the daemon's exact `{ "ephemeral": true }` request payload.
  
  Related issue: N/A (internal remote-control persistence architecture
  change).

  Anton Panasenko · 2026-06-11 21:28:52 -07:00
  d61dfeb23a
• [codex-rs] enforce PAT workspace restrictions (#27450)

  ## Summary
  
  - validate a hydrated personal access token's workspace against
  `forced_chatgpt_workspace_id` before persisting `codex login
  --with-access-token`
  - apply the same PAT-only check when restricted auth managers load
  environment, ephemeral, or persisted credentials
  - enforce PAT workspace restrictions in the existing central
  login-restriction path
  - leave Agent Identity and cloud bootstrap behavior unchanged
  
  ## Scope
  
  This is intentionally the small PAT-only change. It does not attempt the
  broader auth-manager/bootstrap unification; that needs separate design
  work.
  
  ## Validation
  
  - `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/codex-pat-target just test
  -p codex-login -p codex-cli` (410 passed)
  - `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/codex-pat-target just fix
  -p codex-login -p codex-cli`
  - `just fmt`
  - `git diff --check`
  
  Context: https://openai.slack.com/archives/D0AUPLV03RQ/p1781138331548269

  cooper-oai · 2026-06-11 14:17:37 -07:00
  b5f1bb75d4
• [codex] Load user instructions through an injected provider (#27101)

  ## Why
  
  We want to remove implicit use of `$CODEX_HOME` from `codex-core` and
  make embedders responsible for supplying user-level instructions. This
  also ensures user instructions load when no primary environment is
  selected.
  
  ## What changed
  
  Stacked on #27415, which makes `codex exec` surface thread-scoped
  runtime warnings.
  
  - Added `UserInstructionsProvider` to `codex-extension-api`, with
  absolute source attribution and recoverable loading warnings.
  - Added `codex-home` with the filesystem-backed provider for
  `AGENTS.override.md` and `AGENTS.md`, preserving precedence, fallback,
  trimming, lossy UTF-8 handling, and the existing uncapped global
  instruction size.
  - Removed global instruction loading from `Config` and require
  `ThreadManager` callers to inject a provider.
  - Load provider instructions once for each fresh root runtime, including
  runtimes without a primary environment. Running sessions retain their
  snapshot, while child agents inherit the parent snapshot without
  invoking the provider.
  - Keep provider instructions separate while loading project `AGENTS.md`,
  then assemble the model-visible instructions with the existing ordering,
  source attribution, warning, and turn-context behavior.
  - Wired the Codex home provider through the CLI, app server, MCP server,
  core facade, and thread-manager sample.
  
  ## Validation
  
  - `just test -p codex-home -p codex-extension-api`
  - `just test -p codex-core agents_md`
  - `just test -p codex-core guardian`
  - `just test -p codex-app-server
  thread_start_without_selected_environment_includes_only_global_instruction_source`
  - `just test -p codex-exec warning`
  - `just bazel-lock-check`

  Adam Perry @ OpenAI · 2026-06-11 19:28:47 +00:00
  236b50125d
• Print TUI session info on fatal exits (#27417)

  ## Summary
  
  TUI exits printed the resume/session summary only after checking the
  exit reason. On fatal exits, both CLI wrappers wrote the error and
  called `process::exit(1)` immediately, so an active session that ended
  on a fatal error could skip the session information entirely.
  
  This change prints the normal exit summary before returning the fatal
  nonzero exit code. If a fatal exit has a known thread id but no
  resumable rollout hint, it prints `Session ID: <id>` instead of staying
  silent. It also flushes stdout before `process::exit(1)` so the summary
  line is not lost during process teardown.
  
  ## Implementation
  
  - Apply the fatal-exit ordering fix in both `codex` and standalone
  `codex-tui`.
  - Keep normal user-requested exit behavior unchanged.
  - Preserve the existing resume hint when a rollout is resumable, and use
  the raw thread id only as a fatal-exit fallback.

  Eric Traut · 2026-06-11 09:56:09 -07:00
  9d88e299a7
• feat: add Bedrock API key as a managed auth mode (#27443)

  ## Why
  
  Codex needs to manage Amazon Bedrock API key credentials through the
  existing auth lifecycle instead of introducing a separate auth manager
  or provider-specific credential file. Treating Bedrock API key login as
  a primary auth mode gives it the same persistence, keyring, reload, and
  logout behavior as the existing OpenAI API key and ChatGPT modes.
  
  The credential is valid only for the `amazon-bedrock` model provider.
  OpenAI-compatible providers must reject this auth mode rather than
  treating the Bedrock key as an OpenAI bearer token.
  
  ## What changed
  
  - Added `bedrockApiKey` as an app-server `AuthMode` and
  `CodexAuth::BedrockApiKey` as a primary `AuthManager` mode.
  - Added `BedrockApiKeyAuth`, containing the API key and AWS region, to
  the existing `AuthDotJson` payload stored in `$CODEX_HOME/auth.json` or
  the configured keyring backend.
  - Added `login_with_bedrock_api_key(...)`, parallel to
  `login_with_api_key(...)`, which replaces the current stored login with
  Bedrock credentials.
  - Reused generic auth reload and logout behavior instead of adding a
  Bedrock-specific auth manager or logout path.
  - Updated login restrictions, status reporting, diagnostics, telemetry
  classification, generated app-server schemas, and auth fixtures for the
  new mode.
  - Added explicit errors when Bedrock API key auth is selected with an
  OpenAI-compatible model provider.
  
  This PR establishes managed storage and auth-mode behavior. Routing the
  managed key and region into Amazon Bedrock requests will be in follow-up
  PRs.

  Celia Chen · 2026-06-10 20:42:38 -07:00
  06afd63f4a
• Add session delete commands in CLI and TUI (#27476)

  ## Summary
  
  The app server exposes `thread/delete`, but users cannot invoke it from
  the CLI or TUI. Because deletion is irreversible, the user-facing
  commands need deliberate confirmation and safer handling of name-based
  targets.
  
  - Add `codex delete <SESSION>` with interactive confirmation,
  restricting `--force` to UUID targets.
  - Resolve exact names across active and archived sessions, including
  renamed sessions, and validate prompted UUID targets before
  confirmation.
  - Add a `/delete` command with a confirmation popup that warns the
  current session and its subagent threads will be permanently deleted.
  
  ## Manual testing
  
  - Deleted by UUID with `--force` and verified the rollout, session-index
  entry, and database row were removed.
  - Exercised name-based confirmation for both cancellation and
  affirmative deletion; cancellation preserved the session and
  confirmation removed it.
  - Verified deletion refuses to proceed without `--force`, while
  `--force` rejects names, including duplicate names.
  - Verified duplicate-name confirmation displays the concrete UUID
  selected.
  - Deleted an archived session by name.
  - Verified an already-missing UUID fails before displaying a
  confirmation prompt.
  - Exercised `/delete` in the TUI: the popup defaults to No, cancellation
  preserves the session, and confirmation deletes the session and exits.
  - Verified that `codex delete` works for both archived and non-archived
  sessions.

  Eric Traut · 2026-06-10 18:04:02 -07:00
  9d87b771ce
• [codex] Skip local curated discovery for remote plugins (#27311)

  ## Summary
  
  - skip the local `openai-curated` marketplace before marketplace loading
  when tool-suggest discovery uses remote plugins
  - preserve existing marketplace listing behavior for all other callers
  and when remote plugins are disabled
  - add regression coverage proving the curated marketplace is excluded
  before its malformed manifest can be read
  
  ## Why
  
  Tool-suggest discovery previously loaded every local `openai-curated`
  plugin manifest and only discarded that marketplace afterward when
  remote plugins were enabled. The remote catalog is used in that mode, so
  the local scan consumed CPU without contributing discoverable plugins.
  
  ## Impact
  
  Remote-plugin tool suggestion discovery no longer reads the local
  curated marketplace and its plugin manifests. `openai-bundled`,
  configured marketplaces, normal `plugin/list` behavior, and local
  curated discovery when remote plugins are disabled are unchanged.
  
  ## Validation
  
  - `just test -p codex-core-plugins
  list_marketplaces_can_skip_openai_curated_before_loading`
  - `just test -p codex-core
  list_tool_suggest_discoverable_plugins_omits_openai_curated_when_remote_enabled`
  - `just fmt`
  - `git diff --check`

  xl-openai · 2026-06-10 13:11:09 -07:00
  7011044c1c
• [codex] add /import for external agents (#27071)

  ## Why
  
  External-agent import should be discoverable and deliberate without
  blocking startup or claiming the public `codex [PROMPT]` CLI namespace.
  The slash command keeps the flow local to the interactive TUI and reuses
  the existing app-server import API.
  
  ## What changed
  
  - add the user-facing `/import` slash command
  - detect external-agent importable items only when the command is
  invoked
  - run imports through the embedded local app-server
  - show start and completion messages, refresh configuration, and block
  duplicate imports while one is pending
  - reject the flow for unsupported remote and local-daemon sessions
  
  ## Validation
  
  - `just test -p codex-tui external_agent_config_migration` (10 passed)
  - manually exercised an isolated TUI fixture with existing
  external-agent setup and session data using a fresh `CODEX_HOME`
  - verified picker customization, plugin and session detection, import
  completion, repeated invocation, and imported-session resume context
  - the broader `just test -p codex-tui` run passed 2,805 tests, with 2
  unrelated guardian feature-flag failures and 4 skipped tests
  
  ## Draft follow-ups
  
  - review whether completion messaging should remain attached to the
  initiating chat if the user switches chats during an import
  - review shutdown semantics for an in-progress background import
  
  ## Stack
  
  1. [#27064](https://github.com/openai/codex/pull/27064): remove the
  startup migration flow
  2. [#27065](https://github.com/openai/codex/pull/27065): extract the
  picker renderer
  3. [#27070](https://github.com/openai/codex/pull/27070): add the
  external-agent import picker UX
  4. [#27071](https://github.com/openai/codex/pull/27071): expose the flow
  through `/import`
  
  **This PR is stack item 4.** Draft while the lower stack dependencies
  are reviewed.

  stefanstokic-oai · 2026-06-10 15:53:15 -04:00
  b4445f2758
• [codex] Move release platform rules into bazel package (#27321)

  ## Intent
  
  Keep release-specific Bazel helpers out of the shared Rust crate
  definitions and colocate them with Bazel platform configuration.
  
  ## Implementation
  
  Moves `multiplatform_binaries` and its platform list from `defs.bzl`
  into `bazel/platforms/release_binaries.bzl` and updates the CLI load
  site. Behavior is unchanged.
  
  ## Validation
  
  - `bazel query //codex-rs/cli:release_binaries`
  
  Stack: 1 of 6.

  Adam Perry @ OpenAI · 2026-06-10 19:45:29 +00:00
  1deae7bd4a
• fix: Auto-recover from corrupted sqlite databases (#26859)

  Further investigation of the sqlite incidents showed that the problems
  are due to corruption from the older version of SQLite that we recently
  upgraded, and that the data is truly corrupted in the root database --
  recovery of all data is not possible. Given that the data is
  reconstructable from the rollouts on disk, we should just auto-backup
  the database and let codex rebuild the rollout info from the disk
  rollouts.
  
  The new behavior is that appserver auto-backs-up and rebuilds (with logs
  reflecting that behavior). The CLI now pops a message letting you know
  this happened and the paths of the backed-up corrupt db and the new
  database. There is also context added so that the desktop app can read
  the rebuild info from it and inform the user with it.

  David de Regt · 2026-06-10 11:24:29 -07:00
  3691fe5b76
• feat(doctor): report editor and pager environment (#27081)

  ## Background
  
  This was prompted by
  [#26858](https://github.com/openai/codex/issues/26858), where the
  attached doctor report did not include the editor selection and I had to
  [ask which editor was in
  use](https://github.com/openai/codex/issues/26858#issuecomment-4653829891)
  before investigating the external-editor newline issue. Capturing these
  variables in doctor makes that context available up front in future
  reports.
  
  `codex doctor` is intended to capture enough local context to diagnose
  startup and terminal behavior, but it did not report the environment
  variables that select an external editor or configure command pagers.
  
  The TUI [prefers `VISUAL` over
  `EDITOR`](https://github.com/openai/codex/blob/56554904babcaacf4444a2cc90716880837dff7c/codex-rs/tui/src/external_editor.rs#L31-L38),
  so missing or unexpected values can explain why the external-editor
  shortcut fails or launches the wrong command. Pager values are also
  useful inherited-shell context even though [unified exec normalizes its
  effective pager variables to
  `cat`](https://github.com/openai/codex/blob/56554904babcaacf4444a2cc90716880837dff7c/codex-rs/core/src/unified_exec/process_manager.rs#L60-L70).
  
  These variables can contain arbitrary command arguments or inline
  environment assignments. The human report is local, but `codex doctor
  --json` may be attached to feedback, so the machine-readable report
  should not include their raw contents.
  
  ## What Changed
  
  - Report `VISUAL` and `EDITOR` in the system environment details, using
  `not set` when either variable is absent.
  - Report inherited `PAGER`, `GIT_PAGER`, `GH_PAGER`, and `LESS` values
  when present.
  - Preserve full values in local human output while reducing these fields
  to `set` or `not set` in redacted JSON output.
  - Add structured check, JSON-redaction, rendered-output, and snapshot
  coverage.
  
  ## How to Test
  
  1. From `codex-rs`, run Codex with explicit editor and pager variables:
  
     ```sh
  env VISUAL='code --wait' EDITOR=vim PAGER='less -R' GIT_PAGER=delta
  GH_PAGER=less LESS=-FRX \
       cargo run -p codex-cli --bin codex -- doctor --no-color
     ```
  
  2. Confirm the `system` details show the full values for all six
  variables.
  3. Unset the pager variables and rerun the command. Confirm pager rows
  are omitted while missing editor variables are shown as `not set`.
  4. Run the same configured environment with `doctor --json`. Confirm
  each configured editor or pager field is reported as `set` and none of
  the raw commands or arguments appear in the JSON.
  
  Targeted tests:
  
  - `just test -p codex-cli` (279 tests passed)

  Felipe Coury · 2026-06-08 15:43:08 -07:00
  0473a5cc52
• Enforce configured network proxy in codex sandbox (#27035)

  ## Why
  
  `codex sandbox` can start a network proxy from a configured permission
  profile. Previously, sandbox-level containment was tied to managed
  network requirements rather than whether a proxy was actually active.
  This meant config-driven proxy policies were not consistently enforced
  as the sandbox's only network path.
  
  ## What changed
  
  - Enable proxy-only network containment whenever `codex sandbox` starts
  a network proxy.
  - Apply the same active-proxy check to the macOS and Linux sandbox
  paths.
  - Add a Linux regression test that verifies a sandboxed command cannot
  establish a direct connection while the configured proxy is active.
  
  ## Test plan
  
  - `just test -p codex-cli debug_sandbox::tests`
  - `sandbox_with_network_proxy_blocks_direct_loopback_access` runs on
  Linux to cover the config-driven proxy path end to end.

  viyatb-oai · 2026-06-08 14:03:37 -07:00
  85fd52f7e4
• cli: add -P sandbox permissions profile alias (#27054)

  ## Why
  
  `codex sandbox --permissions-profile` is useful when running commands
  under a named permissions profile, but the long option is cumbersome for
  a debugging-oriented command. `-p` is already used for the config
  profile selector, so `-P` gives the permissions profile selector a
  compact, non-conflicting alias.
  
  ## What Changed
  
  - Added `short = 'P'` to the `permissions_profile` option for the macOS,
  Linux, and Windows sandbox command structs in
  [`codex-rs/cli/src/lib.rs`](https://github.com/openai/codex/blob/6d9f9c5cdcaa0a156aa2dabbde259ae5e9e8bc0b/codex-rs/cli/src/lib.rs#L29-L112).
  - Added parser coverage for `codex sandbox -P :workspace -- echo` in
  [`codex-rs/cli/src/main.rs`](https://github.com/openai/codex/blob/6d9f9c5cdcaa0a156aa2dabbde259ae5e9e8bc0b/codex-rs/cli/src/main.rs#L2883-L2896).
  
  ## Verification
  
  - `just test -p codex-cli` passed, including the new
  `sandbox_parses_permissions_profile_short_alias` parser test.

  Michael Bolin · 2026-06-08 20:59:23 +00:00
  e0ee491df3
• [plugins] Expose marketplace source in marketplace list JSON (#27009)

  ## Summary
  - Follow-up to #26417 and #26631
  - Add `marketplaceSource` to `codex plugin marketplace list --json`
  entries for configured marketplaces
  - Reuse the existing `marketplaceSource` shape from `codex plugin list
  --json`
  - Keep human-readable marketplace list output unchanged
  - Add CLI coverage for configured local and git marketplace sources
  
  Example:
  
  ```json
  {
    "marketplaces": [
      {
        "name": "debug",
        "root": "/path/to/.codex/.tmp/marketplaces/debug",
        "marketplaceSource": {
          "sourceType": "git",
          "source": "https://example.com/acme/agent-skills.git"
        }
      }
    ]
  }
  ```
  
  ## Validation
  - `just fmt`
  - `just fix -p codex-cli`
  - `just test -p codex-cli marketplace_list`
  - `just test -p codex-cli`

  mpc-oai · 2026-06-08 13:37:55 -05:00
  0aa9931aea
• fix(tui): accept prompts with resume and fork (#26818)

  ## Why
  
  Interactive `codex resume` and `codex fork` expose both a session ID
  positional and an initial prompt positional. With `--last`, Clap still
  assigns the first positional to the session ID, so a command such as
  `codex fork --last "/compact focus on auth"` either fails parsing or
  attempts to look up the prompt as a session ID instead of sending it to
  the latest session.
  
  This makes it impossible to select the latest session and immediately
  provide a follow-up prompt, even though `codex exec resume --last`
  already supports that workflow.
  
  <img width="1746" height="1024" alt="CleanShot 2026-06-06 at 17 00
  47@2x"
  src="https://github.com/user-attachments/assets/86885c07-a23c-48ee-b0ee-47f2484f6eb7"
  />
  
  ## What Changed
  
  - Reinterpret the first positional as the initial prompt when
  interactive `resume --last` or `fork --last` is used and no explicit
  second prompt was parsed.
  - Preserve the existing `resume SESSION_ID PROMPT` and `fork SESSION_ID
  PROMPT` behavior.
  - Add parser-level regression coverage for latest-session and
  explicit-session prompt forms.
  
  ## How to Test
  
  1. Start an interactive session, exit it, then run `codex resume --last
  "continue from the latest session"`.
  2. Confirm Codex resumes the latest session and submits the supplied
  prompt instead of treating it as a session ID.
  3. Run `codex fork --last "take a different approach"`.
  4. Confirm Codex forks the latest session and submits the supplied
  prompt.
  5. Also verify `codex resume SESSION_ID "continue here"` and `codex fork
  SESSION_ID "branch here"` still target the explicit session and submit
  the prompt.
  
  Targeted tests:
  - `just test -p codex-cli` (267 passed)

  Felipe Coury · 2026-06-07 17:34:35 -04:00
  e093d81982
• [codex-rs] support v2 personal access tokens (#25731)

  ## Summary
  
  - add v2 personal access token support for `codex login
  --with-access-token` and `CODEX_ACCESS_TOKEN`
  - classify opaque `at-` tokens separately from legacy Agent Identity
  JWTs
  - hydrate required ChatGPT account metadata through AuthAPI
  `/v1/user-auth-credential/whoami`
  - use PATs directly as bearer tokens while preserving existing ChatGPT
  account surfaces
  - expose PAT-backed auth as the explicit `personalAccessToken`
  app-server auth mode
  
  ## Implementation
  
  PAT auth is intentionally small and stateless. Loading a PAT performs
  one AuthAPI metadata request, stores the hydrated metadata in the
  in-memory auth object, and redacts the secret from debug output. Legacy
  Agent Identity JWT handling remains unchanged. The shared access-token
  classifier lives in a private neutral module because it dispatches
  between both credential types.
  
  PAT hydration fails closed when AuthAPI omits any required metadata,
  including email. Hydrated metadata is intentionally not persisted:
  startup performs a live `whoami` preflight so revoked tokens or changed
  account metadata are not accepted from a stale cache.
  
  ## Workspace restriction scope
  
  This change intentionally does **not** apply
  `forced_chatgpt_workspace_id` to PAT authentication. The setting is a
  client-side config guardrail, not an authorization boundary, and PAT
  does not currently require workspace-ID parity. The PAT login and
  `CODEX_ACCESS_TOKEN` paths therefore validate through AuthAPI without
  threading workspace-restriction state through access-token loading.
  Existing workspace checks for non-PAT auth remain on their established
  paths.
  
  ## App-server compatibility
  
  The public app-server `AuthMode` is shared across v1 and v2, and
  PAT-backed auth reports `personalAccessToken` through both APIs.
  Following human review, this intentionally removes the temporary v1
  compatibility mapping that reported PATs as `chatgpt`; the deprecated v1
  API is kept in parity with v2 rather than maintaining a separate closed
  enum. Clients with exhaustive auth-mode handling in either API version
  must add the new case and should generally treat it as ChatGPT-backed
  unless they need PAT-specific behavior.
  
  The v1 auth-status response still omits the raw PAT when `includeToken`
  is requested because that response cannot carry the account metadata
  needed to reuse the credential safely. Persisted PAT auth also omits the
  new enum value so older Codex builds can deserialize `auth.json` and
  infer PAT auth from the credential field after a rollback.
  
  ## Validation
  
  Latest review-fix validation:
  
  - `CARGO_INCREMENTAL=0 just test -p codex-login` (126 passed)
  - `CARGO_INCREMENTAL=0 just test -p codex-cli` (263 passed)
  - `CARGO_INCREMENTAL=0 just test -p codex-cli
  stored_auth_validation_handles_personal_access_token`
  - `CARGO_INCREMENTAL=0 just test -p codex-app-server-protocol` (226
  passed)
  - `CARGO_INCREMENTAL=0 just test -p codex-models-manager
  refresh_available_models_uses_remote_only_catalog_for_chatgpt_auth`
  - `CARGO_INCREMENTAL=0 just test -p codex-tui
  existing_non_oauth_chatgpt_login_counts_as_signed_in`
  - `CARGO_INCREMENTAL=0 just fix -p codex-login -p
  codex-app-server-protocol -p codex-models-manager -p codex-tui -p
  codex-cli`
  - `just fmt`
  - `git diff --check`
  
  The broader `codex-tui` suite previously compiled and ran 2,834 tests.
  Three unrelated environment-sensitive guardian/IDE-socket tests failed
  after retries; the PAT-relevant TUI coverage passed.

  cooper-oai · 2026-06-05 17:36:18 -07:00
  df7818c7d1
• Add JSON output for plugin subcommands (#26631)

  ## Summary
  - Follow-up to #25330 and #26417
  - Add `--json` output for `codex plugin add` and `codex plugin remove`
  - Add `--json` output for `codex plugin marketplace
  add/list/upgrade/remove`
  - Keep existing human-readable output unchanged
  - Keep existing error handling/stderr behavior unchanged; `--json`
  changes successful stdout output only
  - Align marketplace add/remove JSON field names with the existing
  app-server protocol shape
  - Add CLI coverage for plugin and marketplace JSON outputs
  
  ## Validation
  - `just fmt`
  - `just fix -p codex-cli`
  - `just test -p codex-cli`

  mpc-oai · 2026-06-05 14:40:31 -05:00
  bb7d19bc24
• Open Windows app workspaces via deep link (#26500)

  ## Summary
  
  Fixes #26423.
  
  On Windows, `codex app PATH` detected Codex Desktop and launched the app
  shell target, then only printed a manual instruction to open the
  workspace. The Desktop app already supports
  `codex://threads/new?path=...`, so the CLI can open the requested
  workspace directly.
  
  This updates the Windows launcher to normalize the workspace path,
  encode it into a `codex://threads/new` deep link, and open that URL when
  Codex Desktop is installed. The installer fallback still opens the
  Windows installer and prints the workspace path for after installation.

  Eric Traut · 2026-06-05 08:32:42 -07:00
  e781816ead
• Expose configured marketplace source in plugin list JSON (#26417)

  ## Summary
  - Follow-up to #25330
  - Add `marketplaceSource` to `codex plugin list --json` entries for
  configured marketplaces
  - Keep the existing per-plugin `source` field unchanged; this still
  reports the local plugin source path
  - Include only the configured marketplace `sourceType` and `source` from
  `config.toml`
  - Keep human-readable output unchanged
  - Add CLI coverage for configured local and git marketplace sources
  
  Example:
  
  ```json
  {
    "source": {
      "source": "local",
      "path": "/path/to/.codex/.tmp/marketplaces/debug/plugins/sample"
    },
    "marketplaceSource": {
      "sourceType": "git",
      "source": "https://example.com/acme/agent-skills.git"
    }
  }
  ```
  
  ## Validation
  - `just fmt`
  - `just fix -p codex-cli`
  - `just test -p codex-cli plugin_list`

  mpc-oai · 2026-06-04 12:20:32 -05:00
  cdc1d592df