7919 Commits

This Branch

This Branch

All Branches

• core: make test-log a dev dependency (#18846)

  The `test-log` crate is only used by `codex-core` tests, so it does not
  need
  to be part of the normal `codex-core` dependency graph. Keeping
  `test-log` in
  `dev-dependencies` removes it from normal `codex-core` builds and keeps
  the
  production dependency set a little smaller.
  
  Verification:
  
  - `cargo tree -p codex-core --edges normal --invert test-log`
  - `cargo check -p codex-core --lib`
  - `cargo test -p codex-core --lib`

  Michael Bolin · 2026-04-21 09:48:31 -07:00
  b06fc8bd0d
• feat: baseline lib (#18848)

  This add with 2 entry point:
  * `reset_git_repository` that takes a directory and set it as a new git
  root
  * `diff_since_latest_init` this returns the diff for a given directory
  since the last `reset_git_repository`

  jif-oai · 2026-04-21 17:24:30 +01:00
  bf2a34b4b2
• build: reduce Rust dev debuginfo (#18844)

  ## What changed
  
  This PR makes the default Cargo dev profile use line-tables-only debug
  info:
  
  ```toml
  [profile.dev]
  debug = 1
  ```
  
  That keeps useful backtraces while avoiding the cost of full variable
  debug
  info in normal local dev builds.
  
  This also makes the Bazel CI setting explicit with `-Cdebuginfo=0` for
  target
  and exec-configuration Rust actions. Bazel/rules_rust does not read
  Cargo
  profiles for this setting, and the current fastbuild action already
  emitted
  `--codegen=debuginfo=0`; the Bazel part of this PR makes that choice
  direct in
  our build configuration.
  
  ## Why
  
  The slow codex-core rebuilds are dominated by debug-info codegen, not
  parsing
  or type checking. On a warm-dependency package rebuild, the baseline
  codex-core compile was about 39.5s wall / 38.9s rustc total, with
  codegen_crate around 14.0s and LLVM_passes around 13.4s. Setting
  codex-core
  to line-tables-only debug info brought that to about 27.2s wall / 26.7s
  rustc
  total, with codegen_crate around 3.1s and LLVM_passes around 2.8s.
  
  `debug = 0` was only about another 0.7s faster than `debug = 1` in the
  codex-core measurement, so `debug = 1` is the better default dev
  tradeoff: it
  captures nearly all of the compile-time win while preserving basic
  debuggability.
  
  I also sampled other first-party crates instead of keeping a
  codex-core-only
  package override. codex-app-server showed the same pattern: rustc total
  dropped from 15.85s to 10.48s, while codegen_crate plus LLVM_passes
  dropped
  from about 13.47s to 3.23s. codex-app-server-protocol had a smaller but
  still
  real improvement, 16.05s to 14.58s total, and smaller crates showed
  modest
  wins. That points to a workspace dev-profile policy rather than a
  hand-maintained list of large crates.
  
  ## Relationship to #18612
  
  [#18612](https://github.com/openai/codex/pull/18612) added the
  `dev-small`
  profile. That remains useful when someone wants a working local build
  quickly
  and is willing to opt in with `cargo build --profile dev-small`.
  
  This PR is deliberately less aggressive: it changes the common default
  dev
  profile while preserving line tables/backtraces. `dev-small` remains the
  explicit "build quickly, no debuggability concern" path.
  
  ## Other investigation
  
  I looked for another structural win comparable to
  [#16631](https://github.com/openai/codex/pull/16631) and
  [#16630](https://github.com/openai/codex/pull/16630), but did not find
  one.
  The attempted TOML monomorphization changes were noisy or worse in
  measurement, and the async task changes reduced some instantiations but
  only
  translated to roughly a one-second improvement while being much more
  disruptive. The debug-info setting was the one repeatable, material win
  that
  survived measurement.
  
  ## Verification
  
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - `cargo check -p codex-core --lib`
  - `cargo test -p codex-core --lib`
  - Bazel `aquery --config=ci-linux` confirmed `--codegen=debuginfo=0` and
    `-Cdebuginfo=0` for `//codex-rs/core:core`
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18844).
  * #18846
  * __->__ #18844

  Michael Bolin · 2026-04-21 09:00:40 -07:00
  53cf12cd52
• Move external agent config out of core (#18850)

  ## Summary
  - Move external agent config migration logic and tests from `codex-core`
  into `app-server/src/config`.
  - Keep the migration service crate-private to app-server and update the
  API adapter imports.
  - Remove stale core re-exports and expose only the needed marketplace
  source helper.
  
  ## Testing
  - `cargo test -p codex-app-server config::external_agent_config`
  - `just fmt`
  - `just fix -p codex-app-server`
  - `just fix -p codex-core`
  - `git diff --check`

  pakrym-oai · 2026-04-21 08:33:58 -07:00
  833212115e
• fix(tui): disable enhanced keys for VS Code WSL (#18741)

  Fixes https://github.com/openai/codex/issues/13638
  
  ## Why
  
  VS Code's integrated terminal can run a Linux shell through WSL without
  exposing `TERM_PROGRAM` to the Linux process, and with crossterm
  keyboard enhancement flags enabled that environment can turn dead-key
  composition into malformed key events instead of composed Unicode input.
  Codex already handles composed Unicode correctly, so the fix is to avoid
  enabling the terminal mode that breaks this path for the affected
  terminal combination.
  
  ## What Changed
  
  - Automatically skip crossterm keyboard enhancement flags when Codex
  detects WSL plus VS Code, including a Windows-side `TERM_PROGRAM` probe
  through WSL interop.
  - Add `CODEX_TUI_DISABLE_KEYBOARD_ENHANCEMENT` so users can
  force-disable or force-enable the keyboard enhancement policy for
  diagnosis.
  
  ## Verification
  
  - Added unit coverage for env parsing, VS Code detection, and the WSL/VS
  Code auto-disable policy.
  - `cargo check -p codex-tui` passed.
  - `./tools/argument-comment-lint/run.py -p codex-tui -- --tests` passed.
  - `cargo test -p codex-tui` was attempted locally, but the checkout
  failed during linking before tests executed because V8 symbols from
  `codex-code-mode` were unresolved for `arm64`.

  Felipe Coury · 2026-04-21 09:57:51 -03:00
  1101dec9ae
• show bash mode in the TUI (#18271)

  ## What
  
  - Explicitly show our "bash mode" by changing the color and adding a
  callout similar to how we do for `Plan mode (shift + tab to cycle)`
  - Also replace our `›` composer prefix with a bang `!`
  
  
  ![](https://github.com/user-attachments/assets/f5549c75-3a03-433d-aa57-e4c6d0682c49)
  
  ## Why
  
  - It was unclear that we had a Bash mode
  - This feels more responsive
  - It looks cool!
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Abhinav · 2026-04-21 00:15:49 -07:00
  ef071cf816
• [codex] Tighten code review skill wording (#18818)

  ## Summary
  
  This updates the code review orchestrator skill wording so the
  instruction explicitly requires returning every issue from every
  subagent.
  
  ## Impact
  
  The change is limited to `.codex/skills/code-review/SKILL.md` and
  clarifies review aggregation behavior for future Codex-driven reviews.
  
  ## Validation
  
  No tests were run because this is a markdown-only skill wording change.

  pakrym-oai · 2026-04-21 00:04:04 -07:00
  a3ed5068c1
• [tool search] support namespaced deferred dynamic tools (#18413)

  Deferred dynamic tools need to round-trip a namespace so a tool returned
  by `tool_search` can be called through the same registry key that core
  uses for dispatch.
  
  This change adds namespace support for dynamic tool specs/calls,
  persists it through app-server thread state, and routes dynamic tool
  calls by full `ToolName` while still sending the app the leaf tool name.
  Deferred dynamic tools must provide a namespace; non-deferred dynamic
  tools may remain top-level.
  
  It also introduces `LoadableToolSpec` as the shared
  function-or-namespace Responses shape used by both `tool_search` output
  and dynamic tool registration, so dynamic tools use the same wrapping
  logic in both paths.
  
  Validation:
  - `cargo test -p codex-tools`
  - `cargo test -p codex-core tool_search`
  
  ---------
  
  Co-authored-by: Sayan Sisodiya <sayan@openai.com>

  pash-openai · 2026-04-21 14:13:08 +08:00
  dc1a8f2190
• chore: enable await-holding clippy lints (#18698)

  Follow-up to https://github.com/openai/codex/pull/18178, where we said
  the await-holding clippy rule would be enabled separately.
  
  Enable `await_holding_lock` and `await_holding_invalid_type` after the
  preceding commits fixed or explicitly documented the current offenders.

  Michael Bolin · 2026-04-21 06:06:05 +00:00
  1dcea729d3
• chore: document intentional await-holding cases (#18423)

  ## Why
  
  This PR prepares the stack to enable Clippy await-holding lints that
  were left disabled in #18178. The mechanical lock-scope cleanup is
  handled separately; this PR is the documentation/configuration layer for
  the remaining await-across-guard sites.
  
  Without explicit annotations, reviewers and future maintainers cannot
  tell whether an await-holding warning is a real concurrency smell or an
  intentional serialization boundary.
  
  ## What changed
  
  - Configures `clippy.toml` so `await_holding_invalid_type` also covers
  `tokio::sync::{MutexGuard,RwLockReadGuard,RwLockWriteGuard}`.
  - Adds targeted `#[expect(clippy::await_holding_invalid_type, reason =
  ...)]` annotations for intentional async guard lifetimes.
  - Documents the main categories of intentional cases: active-turn state
  transitions that must remain atomic, session-owned MCP manager accesses,
  remote-control websocket serialization, JS REPL kernel/process
  serialization, OAuth persistence, external bearer token refresh
  serialization, and tests that intentionally serialize shared global or
  session-owned state.
  - For external bearer token refresh, documents the existing
  serialization boundary: holding `cached_token` across the provider
  command prevents concurrent cache misses from starting duplicate refresh
  commands, and the current behavior is small enough that an explicit
  expectation is easier to maintain than adding another synchronization
  primitive.
  
  ## Verification
  
  - `cargo clippy -p codex-login --all-targets`
  - `cargo clippy -p codex-connectors --all-targets`
  - `cargo clippy -p codex-core --all-targets`
  - The follow-up PR #18698 enables `await_holding_invalid_type` and
  `await_holding_lock` as workspace `deny` lints, so any undocumented
  remaining offender will fail Clippy.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18423).
  * #18698
  * __->__ #18423

  Michael Bolin · 2026-04-20 22:41:54 -07:00
  d62421d322
• Organize context fragments (#18794)

  Organize context fragments under `core/context`. Implement same trait on
  all of them.

  pakrym-oai · 2026-04-20 22:39:17 -07:00
  4c2e730488
• Add remote_sandbox_config to our config requirements (#18763)

  ## Why
  
  Customers need finer-grained control over allowed sandbox modes based on
  the host Codex is running on. For example, they may want stricter
  sandbox limits on devboxes while keeping a different default elsewhere.
  
  Our current cloud requirements can target user/account groups, but they
  cannot vary sandbox requirements by host. That makes remote development
  environments awkward because the same top-level `allowed_sandbox_modes`
  has to apply everywhere.
  
  ## What
  
  Adds a new `remote_sandbox_config` section to `requirements.toml`:
  
  ```toml
  allowed_sandbox_modes = ["read-only"]
  
  [[remote_sandbox_config]]
  hostname_patterns = ["*.org"]
  allowed_sandbox_modes = ["read-only", "workspace-write"]
  
  [[remote_sandbox_config]]
  hostname_patterns = ["*.sh", "runner-*.ci"]
  allowed_sandbox_modes = ["read-only", "danger-full-access"]
  ```
  
  During requirements resolution, Codex resolves the local host name once,
  preferring the machine FQDN when available and falling back to the
  cleaned kernel hostname. This host classification is best effort rather
  than authenticated device proof.
  
  Each requirements source applies its first matching
  `remote_sandbox_config` entry before it is merged with other sources.
  The shared merge helper keeps that `apply_remote_sandbox_config` step
  paired with requirements merging so new requirements sources do not have
  to remember the extra call.
  
  That preserves source precedence: a lower-precedence requirements file
  with a matching `remote_sandbox_config` cannot override a
  higher-precedence source that already set `allowed_sandbox_modes`.
  
  This also wires the hostname-aware resolution through app-server,
  CLI/TUI config loading, config API reads, and config layer metadata so
  they all evaluate remote sandbox requirements consistently.
  
  ## Verification
  
  - `cargo test -p codex-config remote_sandbox_config`
  - `cargo test -p codex-config host_name`
  - `cargo test -p codex-core
  load_config_layers_applies_matching_remote_sandbox_config`
  - `cargo test -p codex-core
  system_remote_sandbox_config_keeps_cloud_sandbox_modes`
  - `cargo test -p codex-config`
  - `cargo test -p codex-core` unit tests passed; `tests/all.rs`
  integration matrix was intentionally stopped after the relevant focused
  tests passed
  - `just fix -p codex-config`
  - `just fix -p codex-core`
  - `cargo check -p codex-app-server`

  Abhinav · 2026-04-21 05:05:02 +00:00
  ab26554a3a
• feat(auto-review) Handle request_permissions calls (#18393)

  ## Summary
  When auto-review is enabled, it should handle request_permissions tool.
  We'll need to clean up the UX but I'm planning to do that in a separate
  pass
  
  ## Testing
  - [x] Ran locally
  <img width="893" height="396" alt="Screenshot 2026-04-17 at 1 16 13 PM"
  src="https://github.com/user-attachments/assets/4c045c5f-1138-4c6c-ac6e-2cb6be4514d8"
  />
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-04-20 21:48:57 -07:00
  86535c9901
• chore(app-server) linguist-generated (#18807)

  ## Summary
  Start marking app-server schema files as
  [linguist-generated](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github),
  so we can more easily parse reviews

  Dylan Hurd · 2026-04-20 21:42:00 -07:00
  543a08dac9
• Fallback display names for TUI skill mentions (#18786)

  This updates TUI skill mentions to show a fallback label when a skill
  does not define a display name, so unnamed skills remain understandable
  in the picker without changing behavior for skills that already have
  one.
  
  <img width="1028" height="198" alt="Screenshot 2026-04-20 at 6 25 15 PM"
  src="https://github.com/user-attachments/assets/84077b85-99d0-4db9-b533-37e1887b4506"
  />

  canvrno-oai · 2026-04-20 20:46:55 -07:00
  2cc146f5ea
• Make MCP resource read threadless (#18292)

  ## Summary
  
  Making thread id optional so that we can better cache resources for MCPs
  for connectors since their resource templates is universal and not
  particular to projects.
  
  - Make `mcpServer/resource/read` accept an optional `threadId`
  - Read resources from the current MCP config when no thread is supplied
  - Keep the existing thread-scoped path when `threadId` is present
  - Update the generated schemas, README, and integration coverage
  
  ## Testing
  - `just write-app-server-schema`
  - `just fmt`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-mcp`
  - `cargo test -p codex-app-server --test all mcp_resource`
  - `just fix -p codex-mcp`
  - `just fix -p codex-app-server-protocol`
  - `just fix -p codex-app-server`

  Matthew Zeng · 2026-04-20 19:59:36 -07:00
  1132ef887c
• fix(guardian) Dont hard error on feature disable (#18795)

  ## Summary 
  This shouldn't error for now
  
  ## Test plan
  - [x] Updated unit test

  Dylan Hurd · 2026-04-20 19:54:39 -07:00
  58e7605efc
• protocol: preserve glob scan depth in permission profiles (#18713)

  ## Why
  
  #18274 made `PermissionProfile` the canonical file-system permissions
  shape, but the round-trip from `FileSystemSandboxPolicy` to
  `PermissionProfile` still dropped one piece of policy metadata:
  `glob_scan_max_depth`.
  
  That field is security-relevant for deny-read globs such as `**/*.env`.
  On Linux, bubblewrap sandbox construction uses it to bound unreadable
  glob expansion. If a profile copied from active runtime permissions
  loses this value and is submitted back as an override, the resulting
  `FileSystemSandboxPolicy` can behave differently even though the visible
  permission entries look equivalent.
  
  ## What changed
  
  - Add `glob_scan_max_depth` to protocol `FileSystemPermissions` and
  preserve it when converting to/from `FileSystemSandboxPolicy`.
  - Keep legacy `read`/`write` JSON for simple path-only permissions, but
  force canonical JSON when glob scan depth is present so the metadata is
  not silently dropped.
  - Carry `globScanMaxDepth` through app-server
  `AdditionalFileSystemPermissions`, generated JSON/TypeScript schemas,
  and app-server/TUI conversion call sites.
  - Preserve the metadata through sandboxing permission normalization,
  merging, and intersection.
  - Carry the merged scan depth into the effective
  `FileSystemSandboxPolicy` used for command execution, so bounded
  deny-read globs reach Linux bubblewrap materialization.
  
  ## Verification
  
  - `cargo test -p codex-sandboxing glob_scan -- --nocapture`
  - `cargo test -p codex-sandboxing policy_transforms -- --nocapture`
  - `just fix -p codex-sandboxing`
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18713).
  * #18288
  * #18287
  * #18286
  * #18285
  * #18284
  * #18283
  * #18282
  * #18281
  * #18280
  * #18279
  * #18278
  * #18277
  * #18276
  * #18275
  * __->__ #18713

  Michael Bolin · 2026-04-20 19:42:45 -07:00
  3d2f123895
• feat: Support more plugin MCP file shapes. (#18780)

  Update core-plugins MCP loading to accept either an mcpServers object or
  a top-level server map in .mcp.json

  xl-openai · 2026-04-20 19:42:01 -07:00
  6e9e2c2eef
• refactor: narrow async lock scopes (#18418)

  ## Why
  
  This is part of the follow-up work from #18178 to make Codex ready for
  Clippy's
  [`await_holding_lock`](https://rust-lang.github.io/rust-clippy/master/index.html#await_holding_lock)
  /
  [`await_holding_invalid_type`](https://rust-lang.github.io/rust-clippy/master/index.html#await_holding_invalid_type)
  lints.
  
  This bottom PR keeps the scope intentionally small:
  `NetworkProxyState::record_blocked()` only needs the state write lock
  while it mutates the blocked-request ring buffer and counters. The debug
  log payload and `BlockedRequestObserver` callback can be produced after
  that lock is released.
  
  ## What changed
  
  - Copies the blocked-request snapshot values needed for logging while
  updating the state.
  - Releases the `RwLockWriteGuard` before logging or notifying the
  observer.
  
  ## Verification
  
  - `cargo test -p codex-network-proxy`
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18418).
  * #18698
  * #18423
  * __->__ #18418

  Michael Bolin · 2026-04-21 02:23:30 +00:00
  ff05532723
• [1/4] Add executor HTTP request protocol (#18581)

  ### Why
  Remote streamable HTTP MCP needs a transport-shaped executor primitive
  before the MCP client can move network I/O to the executor. This layer
  keeps the executor unaware of MCP and gives later PRs an ordered
  streaming surface for response bodies.
  
  ### What
  - Add typed `http/request` and `http/request/bodyDelta` protocol
  payloads.
  - Add executor client helpers for buffered and streamed HTTP responses.
  - Route body-delta notifications to request-scoped streams with sequence
  validation and cleanup when a stream finishes or is dropped.
  - Document the new protocol constants, transport structs, public client
  methods, body-stream lifecycle, and request-scoped routing helpers.
  - Add in-memory JSON-RPC client coverage for streamed HTTP response-body
  notifications, with comments spelling out what the test proves and each
  setup/exercise/assert phase.
  
  ### Stack
  1. #18581 protocol
  2. #18582 runner
  3. #18583 RMCP client
  4. #18584 manager wiring and local/remote coverage
  
  ### Verification
  - `just fmt`
  - `cargo check -p codex-exec-server -p codex-rmcp-client --tests`
  - `cargo check -p codex-core --test all` compile-only
  - `git diff --check`
  - Online full CI is running from the `full-ci` branch, including the
  remote Rust test job.
  
  Co-authored-by: Codex <noreply@openai.com>
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-21 02:21:08 +00:00
  d6af7a6c03
• feat: add a built-in Amazon Bedrock model provider (#18744)

  ## Why
  
  Codex needs a first-class `amazon-bedrock` model provider so users can
  select Bedrock without copying a full provider definition into
  `config.toml`. The provider has Codex-owned defaults for the pieces that
  should stay consistent across users: the display `name`, Bedrock
  `base_url`, and `wire_api`.
  
  At the same time, users still need a way to choose the AWS credential
  profile used by their local environment. This change makes
  `amazon-bedrock` a partially modifiable built-in provider: code owns the
  provider identity and endpoint defaults, while user config can set
  `model_providers.amazon-bedrock.aws.profile`.
  
  For example:
  
  ```toml
  model_provider = "amazon-bedrock"
  
  [model_providers.amazon-bedrock.aws]
  profile = "codex-bedrock"
  ```
  
  ## What Changed
  
  - Added `amazon-bedrock` to the built-in model provider map with:
    - `name = "Amazon Bedrock"`
    - `base_url = "https://bedrock-mantle.us-east-1.api.aws/v1"`
    - `wire_api = "responses"`
  - Added AWS provider auth config with a profile-only shape:
  `model_providers.<id>.aws.profile`.
  - Kept AWS auth config restricted to `amazon-bedrock`; custom providers
  that set `aws` are rejected.
  - Allowed `model_providers.amazon-bedrock` through reserved-provider
  validation so it can act as a partial override.
  - During config loading, only `aws.profile` is copied from the
  user-provided `amazon-bedrock` entry onto the built-in provider. Other
  Bedrock provider fields remain hard-coded by the built-in definition.
  - Updated the generated config schema for the new provider AWS profile
  config.

  Celia Chen · 2026-04-21 00:54:05 +00:00
  cefcfe43b9
• /statusline & /title - Shared preview values (#18435)

  This PR makes the `/statusline` and `/title` setup UIs share one
  preview-value source instead of each surface using its own examples.
  Both pickers now render consistent live values when available, and
  stable placeholders when they are not. It also resolves live preview
  values at the shared preview-item layer, so `/title` preview can use
  real runtime values for title-specific cases like status text, task
  progress, and project-name fallback behavior.
  
  - Adds a shared preview data model for status surfaces
  - Maps status-line items and terminal-title items onto that shared
  preview list
  - Feeds both setup views from the same chatwidget-derived preview data,
  with terminal-title-specific formatting applied before `/title` preview
  renders
  - Keeps project-root preview aligned with status-line behavior while
  project in /title keeps its title fallback/truncation behavior
  - Adds snapshot coverage for live-only, hardcoded-only, and mixed cases
  
  Test Steps
  - Open Codex TUI and launch `/statusline`.
  - Toggle and reorder items, then verify the preview uses current session
  values when possible, and placeholder values for missing values (ex: no
  thread ID).
  - Open `/title` and verify it shows the same normalized values,
  including live status/task-progress values when available.

  canvrno-oai · 2026-04-20 17:46:11 -07:00
  9a2b34213b
• [codex] Send realtime transcript deltas on handoff (#18761)

  ## Summary
  - Track how many realtime transcript entries have already been attached
  to a background-agent handoff.
  - Attach only entries added since the previous handoff as
  `<transcript_delta>` instead of resending the accumulated transcript
  snapshot.
  - Update the realtime integration test so the second delegation carries
  only the second transcript delta.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-api`
  - `cargo test -p codex-core
  inbound_handoff_request_sends_transcript_delta_after_each_handoff`
  - `cargo build -p codex-cli -p codex-app-server`
  
  ## Manual testing
  Built local debug binaries at:
  - `codex-rs/target/debug/codex`
  - `codex-rs/target/debug/codex-app-server`

  guinness-oai · 2026-04-20 16:46:15 -07:00
  ca3246f77a
• Warn when trusting Git subdirectories (#18602)

  Addresses #18505
  
  ## Summary
  
  When Codex is launched from a subdirectory of a Git repository, the
  onboarding trust prompt says it is trusting the current directory even
  though the persisted trust target is the repository root. That can make
  the scope of the trust decision unclear.
  
  This updates the TUI trust prompt to show a yellow note only when the
  current directory differs from the resolved trust target, explaining
  that trust applies to the repository root and displaying that root. It
  also removes the stale onboarding TODO now that the warning is
  implemented.

  Eric Traut · 2026-04-20 16:43:21 -07:00
  216e7a0a56
• fix: fix stale proxy env restoration after shell snapshots (#17271)

  ## Summary
  
  This fixes a stale-environment path in shell snapshot restoration. A
  sandboxed command can source a shell snapshot that was captured while an
  older proxy process was running. If that proxy has died and come back on
  a different port, the snapshot can otherwise put old proxy values back
  into the command environment, which is how tools like `pip` end up
  talking to a dead proxy.
  
  The wrapper now captures the live process environment before sourcing
  the snapshot and then restores or clears every proxy env var from the
  proxy crate's canonical list. That makes proxy state after shell
  snapshot restoration match the current command environment, rather than
  whatever proxy values happened to be present in the snapshot. On macOS,
  the Codex-generated `GIT_SSH_COMMAND` is refreshed when the SOCKS
  listener changes, while custom SSH wrappers are still left alone.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-20 16:39:17 -07:00
  33fa952426
• [6/6] Fail exec client operations after disconnect (#18027)

  ## Summary
  - Reject new exec-server client operations once the transport has
  disconnected.
  - Convert pending RPC calls into closed errors instead of synthetic
  server errors.
  - Cover pending read and later write behavior after remote executor
  disconnect.
  
  ## Verification
  - `just fmt`
  - `cargo check -p codex-exec-server`
  
  ## Stack
  ```text
  @  #18027 [6/6] Fail exec client operations after disconnect
  │
  o  #18212 [5/6] Wire executor-backed MCP stdio
  │
  o  #18087 [4/6] Abstract MCP stdio server launching
  │
  o  #18020 [3/6] Add pushed exec process events
  │
  o  #18086 [2/6] Support piped stdin in exec process API
  │
  o  #18085 [1/6] Add MCP server environment config
  │
  o  main
  ```
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-20 23:24:06 +00:00
  9ef1cab6f7
• Fix exec inheritance of root shared flags (#18630)

  Addresses #18113
  
  Problem: Shared flags provided before the exec subcommand were parsed by
  the root CLI but not inherited by the exec CLI, so exec sessions could
  run with stale or default sandbox and model configuration.
  
  Solution: Move shared TUI and exec flags into a common option block and
  merge root selections into exec before dispatch, while preserving exec's
  global subcommand flag behavior.

  Eric Traut · 2026-04-20 16:12:17 -07:00
  0f1c9b8963
• Refactor TUI app module into submodules (#18753)

  ## Why
  
  The TUI app module had grown past the 512K source-file cap enforced by
  CI/CD. This keeps the app entry point below that limit while preserving
  the existing runtime behavior and test surface.
  
  ## What changed
  
  - Kept the top-level `App` state and run-loop wiring in
  `tui/src/app.rs`.
  - Split app responsibilities into focused private submodules under
  `tui/src/app/`, covering event dispatch, thread routing, session
  lifecycle, config persistence, background requests, startup prompts,
  input, history UI, platform actions, and thread event buffering.
  - Moved the existing app-level tests into `tui/src/app/tests.rs` and
  reused the existing snapshot location rather than adding new tests or
  snapshots.
  - Added module header comments for `app.rs` and the new submodules.
  
  ## Follow-up
  
  A future cleanup can move narrow unit tests from `tui/src/app/tests.rs`
  into the specific app submodules they exercise. This PR keeps the
  existing app-level tests together so the refactor stays focused on the
  source-file split.
  
  ## Verification
  
  - `cargo test -p codex-tui --lib
  app::tests::agent_picker_item_name_snapshot`
  - `cargo test -p codex-tui --lib app::tests::clear_ui`
  - `cargo test -p codex-tui --lib
  app::tests::ctrl_l_clear_ui_after_long_transcript_reuses_clear_header_snapshot`
  - `just fix -p codex-tui`
  
  Full `cargo test -p codex-tui` still fails on model-catalog drift
  unrelated to this refactor, including stale
  `gpt-5.3-codex`/`gpt-5.1-codex` snapshot and migration expectations now
  resolving to `gpt-5.4`.

  Eric Traut · 2026-04-20 16:10:35 -07:00
  2af4f15479
• Add session config loader interface (#18208)

  ## Why
  
  Cloud-hosted sessions need a way for the service that starts or manages
  a thread to provide session-owned config without treating all config as
  if it came from the same user/project/workspace TOML stack.
  
  The important boundary is ownership: some values should be controlled by
  the session/orchestrator, some by the authenticated user, and later some
  may come from the executor. The earlier broad config-store shape made
  that boundary too fuzzy and overlapped heavily with the existing
  filesystem-backed config loader. This PR starts with the smaller piece
  we need now: a typed session config loader that can feed the existing
  config layer stack while preserving the normal precedence and merge
  behavior.
  
  ## What Changed
  
  - Added `ThreadConfigLoader` and related typed payloads in
  `codex-config`.
  - `SessionThreadConfig` currently supports `model_provider`,
  `model_providers`, and feature flags.
  - `UserThreadConfig` is present as an ownership boundary, but does not
  yet add TOML-backed fields.
  - `NoopThreadConfigLoader` preserves existing behavior when no external
  loader is configured.
    - `StaticThreadConfigLoader` supports tests and simple callers.
  
  - Taught thread config sources to produce ordinary `ConfigLayerEntry`
  values so the existing `ConfigLayerStack` remains the place where
  precedence and merging happen.
  
  - Wired the loader through `ConfigBuilder`, the config loader, and
  app-server startup paths so app-server can provide session-owned config
  before deriving a thread config.
  
  - Added coverage for:
    - translating typed thread config into config layers,
  - inserting thread config layers into the stack at the right precedence,
  - applying session-provided model provider and feature settings when
  app-server derives config from thread params.
  
  ## Follow-Ups
  
  This intentionally stops short of adding the remote/service transport.
  The next pieces are expected to be:
  
  1. Define the proto/API shape for this interface.
  2. Add a client implementation that can source session config from the
  service side.
  
  ## Verification
  
  - Added unit coverage in `codex-config` for the loader and layer
  conversion.
  - Added `codex-core` config loader coverage for thread config layer
  precedence.
  - Added app-server coverage that verifies session thread config wins
  over request-provided config for model provider and feature settings.

  Rasmus Rygaard · 2026-04-20 23:05:49 +00:00
  7b994100b3
• Add Code Review skill (#18746)

  Adds a skill that centralizes rules used during code review for codex.

  pakrym-oai · 2026-04-20 16:01:16 -07:00
  513dc28717
• uds: add async Unix socket crate (#18254)

  ## Summary
  - add a codex-uds crate with async UnixListener and UnixStream wrappers
  - expose helpers for private socket directory setup and stale socket
  path checks
  - migrate codex-stdio-to-uds onto codex-uds and Tokio-based stdio/socket
  relaying
  - update the CLI stdio-to-uds command path for the async runner
  
  ## Tests
  - cargo test -p codex-uds -p codex-stdio-to-uds
  - cargo test -p codex-cli
  - just fmt
  - just fix -p codex-uds
  - just fix -p codex-stdio-to-uds
  - just fix -p codex-cli
  - just bazel-lock-check
  - git diff --check

  Ruslan Nigmatullin · 2026-04-20 15:59:05 -07:00
  97d4b42583
• Add realtime silence tool (#18635)

  ## Summary
  
  Adds a second realtime v2 function tool, `remain_silent`, so the
  realtime model has an explicit non-speaking action when the
  collaboration mode or latest context says it should not answer aloud.
  This is stacked on #18597.
  
  ## Design
  
  - Advertise `remain_silent` alongside `background_agent` in realtime v2
  conversational sessions.
  - Parse `remain_silent` function calls into a typed
  `RealtimeEvent::NoopRequested` event.
  - Have core answer that function call with an empty
  `function_call_output` and deliberately avoid `response.create`, so no
  follow-up realtime response is requested.
  - Keep the event hidden from app-server/TUI surfaces; it is operational
  plumbing, not user-visible conversation content.

  guinness-oai · 2026-04-20 15:43:20 -07:00
  1029742cf7
• Read conversation summaries through thread store (#18716)

  Migrate the conversation summary App Server methods to ThreadStore
  
  Because this app server api allows explicitly fetching the thread by
  rollout path, intercept that case in the app server code and (a) route
  directly to underlying local thread store methods if we're using a local
  thread store, or (b) throw an unsupported error if we're using a remote
  thread store. This keeps the thread store API clean and all filesystem
  operations inside of the local thread store, which pushing the
  "fundamental incompatibility" check as early as possible.

  Tom · 2026-04-20 22:39:10 +00:00
  a718b6fd47
• feat: cascade thread archive (#18112)

  Cascade the thread archive endpoint to all the sub-agents in the agent
  tree
  
  Fix: https://github.com/openai/codex/issues/17867
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-20 23:38:18 +01:00
  660153b6de
• Use app server metadata for fork parent titles (#18632)

  ## Problem
  The TUI resolved fork parent titles from local CODEX_HOME metadata,
  which could show missing or stale titles when app-server metadata is
  authoritative.
  
  This is a lingering bug left over from the migration of the TUI to the
  app-server interface. I found it when I asked Codex to review all places
  where the TUI code was still directly accessing the local CODEX_HOME.
  
  ## Solution
  Route fork parent title metadata through the app-server session state
  and render only that supplied title, with focused snapshot coverage for
  stale local metadata.
  
  ## Testing
  I manually tested by renaming a thread then forking it and confirming
  that the "forked from" message indicated the parent thread's name.

  Eric Traut · 2026-04-20 15:37:31 -07:00
  b8e78e8869
• [codex] prefer inherited spawn agent model (#18701)

  This updates the spawn-agent tool contract so subagents are presented as
  inheriting the parent model by default. The visible model list is now
  framed as optional overrides, the model parameter tells callers to leave
  it unset and the delegation guidance no longer nudges models toward
  picking a smaller/mini override.
  
  Fixes reports that 5.4 would occasionally pick 5.2 or lower as
  sub-agents.

  Thibault Sottiaux · 2026-04-20 22:34:08 +00:00
  54bd07d28c
• fix(tui): keep /copy aligned with rollback (#18739)

  ## Why
  
  Fixes #18718.
  
  After rewinding a thread, `/copy` could still copy the latest assistant
  response from before the rewind. The transcript cells were rolled back,
  but the copy source was a single `last_agent_markdown` cache that was
  not synchronized with backtracking, so the visible conversation and
  copied content could diverge.
  
  ## What changed
  
  `ChatWidget` now keeps a bounded copy history for the most recent 32
  assistant responses, keyed by the visible user-turn count. When local
  rollback trims transcript cells, the copy cache is trimmed to the same
  surviving user-turn count so `/copy` uses the latest visible assistant
  response.
  
  If the user rewinds past the retained copy window, `/copy` now reports:
  
  ```text
  Cannot copy that response after rewinding. Only the most recent 32 responses are available to /copy.
  ```
  
  The change also adds coverage for copying the latest surviving response
  after rollback and for the over-limit rewind message.
  
  ## Verification
  
  - Manually resumed a synthetic 35-turn session, rewound within the
  retained window, and verified `/copy` copied the surviving response.
  - Manually rewound past the retained window and verified `/copy` showed
  the 32-response limit message.
  - `cargo test -p codex-tui slash_copy`
  - `just fix -p codex-tui`
  - `cargo insta pending-snapshots`
  
  Note: `cargo test -p codex-tui` currently fails on unrelated model
  catalog and snapshot drift around the default model changing to
  `gpt-5.4`; the focused `/copy` tests pass after fixing the new test
  setup.

  Felipe Coury · 2026-04-20 19:24:10 -03:00
  cebe57b723
• Add experimental remote thread store config (#18714)

  Add experimental config to use remote thread store rather than local
  thread store implementation in app server

  Tom · 2026-04-20 22:20:39 +00:00
  46e5814f77
• Fix stale model test fixtures (#18719)

  Fixes stale test fixtures left after the active bundled model catalog
  updates in #18586 and #18388. Those changes made `gpt-5.4` the current
  default and removed several older hardcoded slugs, which left Windows
  Bazel shards failing TUI and config tests.
  
  What changed:
  - Refresh TUI model migration, availability NUX, plan-mode, status, and
  snapshot fixtures to use active bundled model slugs.
  - Update the config edit test expectation for the TOML-quoted
  `"gpt-5.2"` migration key.
  - Move the model catalog tests into
  `codex-rs/tui/src/app/tests/model_catalog.rs` so touching them does not
  trip the blob-size policy for `app.rs`.
  
  Verification:
  - CI Bazel/lint checks are expected to cover the affected test shards.

  Ahmed Ibrahim · 2026-04-20 21:52:30 +00:00
  cc96a03f10
• Surface TUI skills refresh failures (#18627)

  ## Why
  
  `skills/list` refreshes are best-effort metadata updates. If one fails
  during startup or thread switching, the TUI should keep running and show
  enough detail to diagnose the app-server failure instead of leaving the
  user with only a log entry.
  
  This addresses the recoverability and observability issue reported in
  #16914.
  
  ## What Changed
  
  - Preserve the full startup `skills/list` error chain before sending it
  back through the app event queue.
  - Surface failed skills refreshes as recoverable TUI error messages
  while still logging the warning.
  
  This is related to the recent bug fix from [PR
  #18370](https://github.com/openai/codex/pull/18370).

  Eric Traut · 2026-04-20 14:43:04 -07:00
  baa5dd7b29
• Update realtime handoff transcript handling (#18597)

  ## Summary
  
  This PR aims to improve integration between the realtime model and the
  codex agent by sharing more context with each other. In particular, we
  now share full realtime conversation transcript deltas in addition to
  the delegation message.
  
  realtime_conversation.rs now turns a handoff into:
  ```
  <realtime_delegation>
    <input>...</input>
    <transcript_delta>...</transcript_delta>
  </realtime_delegation>
  ```
  
  ## Implementation notes
  
  The transcript is accumulated in the realtime websocket layer as parsed
  realtime events arrive. When a background-agent handoff is requested,
  the current transcript snapshot is copied onto the handoff event and
  then serialized by `realtime_conversation.rs` into the hidden realtime
  delegation envelope that Codex receives as user-turn context.
  
  For Realtime V2, the session now explicitly enables input audio
  transcription, and the parser handles the relevant input/output
  transcript completion events so the snapshot includes both user speech
  and realtime model responses. The delegation `<input>` remains the
  actual handoff request, while `<transcript_delta>` carries the
  surrounding conversation history for context.
  
  Reviewers should note that the transcript payload is intended for Codex
  context sharing, not UI rendering. The realtime delegation envelope
  should stay hidden from the user-facing transcript surface, while still
  being included in the background-agent turn so Codex can answer with the
  same conversational context the realtime model had.

  guinness-oai · 2026-04-20 14:04:09 -07:00
  126bd6e7a8
• chore(guardian) disable mcps and plugins (#18722)

  ## Summary
  Disables apps, plugins, mcps for the guardian subagent thread
  
  ## Testing
  - [x] Added unit tests

  Dylan Hurd · 2026-04-20 13:43:50 -07:00
  14ebfbced9
• [codex-analytics] guardian review analytics schema polishing (#17692)

  ## Why
  
  Guardian review analytics needs a Rust event shape that matches the
  backend schema while avoiding unnecessary PII exposure from reviewed
  tool calls. This PR narrows the analytics payload to the fields we
  intend to emit and keeps shared Guardian assessment enums in protocol
  instead of duplicating equivalent analytics-only enums.
  
  ## What changed
  
  - Uses protocol Guardian enums directly for `risk_level`,
  `user_authorization`, `outcome`, and command source values.
  - Removes high-risk reviewed-action fields from the analytics payload,
  including raw commands, display strings, working directories, file
  paths, network targets/hosts, justification text, retry reason, and
  rationale text.
  - Makes `target_item_id` and `tool_call_count` nullable so the Codex
  event can represent cases where the app-server protocol or producer does
  not have those values.
  - Keeps lower-risk structured reviewed-action metadata such as sandbox
  permissions, permission profile, `tty`, `execve` source/program, network
  protocol/port, and MCP connector/tool labels.
  - Adds an analytics reducer/client test covering `codex_guardian_review`
  serialization with an optional `target_item_id` and absent removed
  fields.
  
  ## Verification
  
  - `cargo test -p codex-analytics
  guardian_review_event_ingests_custom_fact_with_optional_target_item`
  - `cargo fmt --check`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/17692).
  * #17696
  * #17695
  * #17693
  * __->__ #17692

  rhan-oai · 2026-04-20 13:08:17 -07:00
  7f53e47250
• [codex] Fix high severity dependency alerts (#18167)

  ## Summary
  - Pin vulnerable npm dependencies through the existing root
  `resolutions` mechanism so the lockfile moves only to patched versions.
  - Refresh `pnpm-lock.yaml` for `@modelcontextprotocol/sdk`,
  `handlebars`, `path-to-regexp`, `picomatch`, `minimatch`, `flatted`,
  `rollup`, and `glob`.
  - Bump `quinn-proto` from `0.11.13` to `0.11.14` and refresh
  `MODULE.bazel.lock`.
  
  ## Testing
  - `corepack pnpm --store-dir .pnpm-store install --frozen-lockfile
  --ignore-scripts`
  - `corepack pnpm audit --audit-level high` (passes; remaining advisories
  are low/moderate)
  - `corepack pnpm -r --filter ./sdk/typescript run build`
  - `corepack pnpm exec eslint 'src/**/*.ts' 'tests/**/*.ts'`
  - `cargo check --locked`
  - `cargo build -p codex-cli`
  - `bazel --output_user_root=/tmp/bazel-codex-dependabot
  --ignore_all_rc_files mod deps --lockfile_mode=error`
  - `just fmt`
  
  Note: `corepack pnpm -r --filter ./sdk/typescript run test` was also
  attempted after building `codex`; it is blocked on this workstation by
  host-managed Codex MDM/auth state (`approval_policy` restrictions and
  ChatGPT/API-key mismatch), not by this dependency change.

  caseysilver-oai · 2026-04-20 11:59:50 -07:00
  fe04d75e0f
• Update models.json (#18388)

  Automated update of models.json.
  
  ---------
  
  Co-authored-by: aibrahim-oai <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>

  github-actions[bot] · 2026-04-20 11:46:52 -07:00
  4676cb5ff8
• [codex] Fix agent identity auth test fixture (#18697)

  ## Summary
  - Add the missing `background_task_id: None` field to the
  `AgentIdentityAuthRecord` fixture introduced in `auth_tests.rs`.
  
  ## Why
  - Current `main` fails Bazel/rust-ci compile paths after the
  background-task auth field landed and a later auth test fixture
  constructed `AgentIdentityAuthRecord` without that new field.
  - I intentionally removed the earlier broader CI-stability edits from
  this PR. The code-mode timeout, external-agent migration snapshot, and
  MCP resource timeout failures appear to be general/flaky or unrelated to
  the agent identity merge stack rather than cleanly caused by it.
  
  ## Validation
  - `cargo test -p codex-login
  dummy_chatgpt_auth_does_not_create_cwd_auth_json_when_identity_is_set --
  --nocapture`
  - `just fmt`

  Adrian · 2026-04-20 11:05:58 -07:00
  6b17adc231
• Remove simple TUI legacy_core reexports (#18631)

  ## Problem
  The TUI still imported path utilities and config-loader symbols through
  app-server-client's legacy_core facade even though those APIs already
  exist in utility/config crates. This is part of our ongoing effort to
  whittle away at these old dependencies.
  
  ## Solution
  Rewire imports to avoid the TUI directly importing from the core crate
  and instead import from common lower-level crates. This PR doesn't
  include any functional changes; it's just a simple rewiring.

  Eric Traut · 2026-04-20 10:48:27 -07:00
  164b6a0c78
• Wire the PatchUpdated events through app_server (#18289)

  Wires patch_updated events through app_server. These events are parsed
  and streamed while apply_patch is being written by the model. Also adds 500ms of buffering to the patch_updated events in the diff_consumer.
  
  The eventual goal is to use this to display better progress indicators in
  the codex app.

  Akshay Nathan · 2026-04-20 10:44:03 -07:00
  34a3e85fcd
• Update models.json (#18586)

  - Replace the active models-manager catalog with the deleted core
  catalog contents.
  - Replace stale hardcoded test model slugs with current bundled model
  slugs.
  - Keep this as a stacked change on top of the cleanup PR.

  Ahmed Ibrahim · 2026-04-20 10:27:01 -07:00
  316cf0e90b