7919 Commits

This Branch

This Branch

All Branches

• Use Shift+Left to edit queued messages in tmux (#15480)

  ## Summary
  - use Shift+Left to edit the most recent queued message when running
  under tmux
  - mirror the same binding change in the app-server TUI
  - add tmux-specific tests and snapshot coverage for the rendered
  queued-message hint
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui
  - cargo test -p codex-tui-app-server
  - just argument-comment-lint -p codex-tui -p codex-tui-app-server
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-22 21:19:31 -07:00
  5e3793def2
• core: snapshot fork startup context injection (#15443)

  ## Summary
  - add a snapshot-style core test for fork startup context injection
  followed by first-turn diff injection
  - capture the current duplicated startup-plus-turn context behavior
  without changing runtime logic
  
  ## Testing
  - not run locally; relying on CI
  - just fmt
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-22 18:24:14 -07:00
  85065ea1b8
• Remove smart_approvals alias migration (#15464)

  Remove the legacy `smart_approvals` config migration from core config
  loading.
  
  This change:
  - stops rewriting `smart_approvals` into `guardian_approval`
  - stops backfilling `approvals_reviewer = "guardian_subagent"`
  - replaces the migration tests with regression coverage that asserts the
  deprecated key is ignored in root and profile scopes
  
  Verification:
  - `just fmt`
  - `cargo test -p codex-core smart_approvals_alias_is_ignored`
  - `cargo test -p codex-core approvals_reviewer_`
  - `just argument-comment-lint`
  
  Notes:
  - `cargo test -p codex-core` still hits an unrelated existing failure in
  `tools::js_repl::tests::js_repl_imported_local_files_can_access_repl_globals`;
  the JS REPL kernel exits after `mktemp` fails under the current
  environment.
  
  Enhancement request: requested cleanup to delete the `smart_approvals`
  alias migration; no public issue link is available.
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-22 17:10:42 -07:00
  e830000e41
• chore(exec_policy) ExecPolicyRequirementScenario tests (#15415)

  ## Summary
  Consolidate exec_policy_tests on `ExecApprovalRequirementScenario` for
  consistency.
  
  ## Testing
  - [x] These are tests

  Dylan Hurd · 2026-03-22 08:07:43 -07:00
  31728dd460
• [apps] Improve app tools loading for TUI. (#15376)

  - [x] Remove the app tools copy in TUI and reference the core tools
  instead, this reduces tools/list calls from 4 to just 1.

  Matthew Zeng · 2026-03-22 00:17:48 -07:00
  19702e190e
• Remove legacy auth and notification handling from tui_app_server (#15414)

  ## Summary
  - remove `tui_app_server` handling for legacy app-server notifications
  - drop the local ChatGPT auth refresh request path from `tui_app_server`
  - remove the now-unused refresh response helper from local auth loading
  
  Split out of #15106 so the `tui_app_server` cleanup can land separately
  from the larger `codex-exec` app-server migration.

  Eric Traut · 2026-03-21 15:06:10 -06:00
  cf0223887f
• Add JIT entitlement for macosx (#15409)

  Without this entitlement, hardened mac os release binaries are unable to
  allocate the executable memory for the JIT compiled JS.
  
  Tested with local signing.  Without entitlement I reproduce the error:
  ```
  #
  # Fatal process out of memory: Failed to reserve virtual memory for CodeRange
  #
  ==== C stack trace ===============================
  
      0   codex                               0x00000001075d1acc codex + 85760716
      1   codex                               0x00000001075d6a64 codex + 85781092
      2   codex                               0x00000001075c7100 codex + 85717248
      3   codex                               0x0000000107637394 codex + 86176660
      4   codex                               0x0000000107823cfc codex + 88194300
      5   codex                               0x000000010777c438 codex + 87508024
      6   codex                               0x000000010777d130 codex + 87511344
      7   codex                               0x0000000107c87a54 codex + 92797524
      8   codex                               0x0000000107641188 codex + 86217096
      9   codex                               0x00000001076412d8 codex + 86217432
      10  codex                               0x0000000107553908 codex + 85244168
      11  codex                               0x000000010465f124 codex + 36008228
      12  codex                               0x000000010466a0d0 codex + 36053200
      13  codex                               0x000000010466ce78 codex + 36064888
      14  codex                               0x000000010734edb0 codex + 83127728
      15  libsystem_pthread.dylib             0x00000001810d3c08 _pthread_start + 136
      16  libsystem_pthread.dylib             0x00000001810ceba8 thread_start + 8
  zsh: trace trap  target/release/codex exec --enable code_mode_only --enable code_mode --
  ```
  
  With the entitlement the exec succeeds.

  Channing Conger · 2026-03-21 13:43:14 -07:00
  c23566b3af
• Remove legacy app-server notification handling from tui_app_server (#15390)

  As part of moving the TUI onto the app server, we added some temporary
  handling of some legacy events. We've confirmed that these do not need
  to be supported, so this PR removes this support from the
  tui_app_server, allowing for additional simplifications in follow-on
  PRs. These events are needed only for very old rollouts. None of the
  other app server clients (IDE extension or app) support these either.
  
  ## Summary
  - stop translating legacy `codex/event/*` notifications inside
  `tui_app_server`
  - remove the TUI-side legacy warning and rollback buffering/replay paths
  that were only fed by those notifications
  - keep the lower-level app-server and app-server-client legacy event
  plumbing intact so PR #15106 can rebase on top and handle the remaining
  exec/lower-layer migration separately

  Eric Traut · 2026-03-21 12:29:33 -06:00
  b0236501e2
• chore(context) Include guardian approval context (#15366)

  ## Summary
  Include the guardian context in the developer message for approvals
  
  ## Testing
  - [x] Updated unit tests

  Dylan Hurd · 2026-03-21 16:31:22 +00:00
  0d9bb8ea58
• [plugins] Fix plugin explicit mention context management. (#15372)

  - [x] Fix plugin explicit mention context management.

  Matthew Zeng · 2026-03-21 00:29:29 -07:00
  06e06ab173
• Code mode on v8 (#15276)

  Moves Code Mode to a new crate with no dependencies on codex. This
  create encodes the code mode semantics that we want for lifetime,
  mounting, tool calling.
  
  The model-facing surface is mostly unchanged. `exec` still runs raw
  JavaScript, `wait` still resumes or terminates a `cell_id`, nested tools
  are still available through `tools.*`, and helpers like `text`, `image`,
  `store`, `load`, `notify`, `yield_control`, and `exit` still exist.
  
  The major change is underneath that surface:
  
  - Old code mode was an external Node runtime.
  - New code mode is an in-process V8 runtime embedded directly in Rust.
  - Old code mode managed cells inside a long-lived Node runner process.
  - New code mode manages cells in Rust, with one V8 runtime thread per
  active `exec`.
  - Old code mode used JSON protocol messages over child stdin/stdout plus
  Node worker-thread messages.
  - New code mode uses Rust channels and direct V8 callbacks/events.
  
  This PR also fixes the two migration regressions that fell out of that
  substrate change:
  
  - `wait { terminate: true }` now waits for the V8 runtime to actually
  stop before reporting termination.
  - synchronous top-level `exit()` now succeeds again instead of surfacing
  as a script error.
  
  ---
  
  - `core/src/tools/code_mode/*` is now mostly an adapter layer for the
  public `exec` / `wait` tools.
  - `code-mode/src/service.rs` owns cell sessions and async control flow
  in Rust.
  - `code-mode/src/runtime/*.rs` owns the embedded V8 isolate and
  JavaScript execution.
  - each `exec` spawns a dedicated runtime thread plus a Rust
  session-control task.
  - helper globals are installed directly into the V8 context instead of
  being injected through a source prelude.
  - helper modules like `tools.js` and `@openai/code_mode` are synthesized
  through V8 module resolution callbacks in Rust.
  
  ---
  
  Also added a benchmark for showing the speed of init and use of a code
  mode env:
  ```
  $ cargo bench -p codex-code-mode --bench exec_overhead -- --samples 30 --warm-iterations 25 --tool-counts 0,32,128
  Finished [`bench` profile [optimized]](https://doc.rust-lang.org/cargo/reference/profiles.html#default-profiles) target(s) in 0.18s
       Running benches/exec_overhead.rs (target/release/deps/exec_overhead-008c440d800545ae)
  exec_overhead: samples=30, warm_iterations=25, tool_counts=[0, 32, 128]
  scenario       tools samples    warmups      iters      mean/exec       p95/exec       rssΔ p50       rssΔ max
  cold_exec          0      30          0          1         1.13ms         1.20ms        8.05MiB        8.06MiB
  warm_exec          0      30          1         25       473.43us       512.49us      912.00KiB        1.33MiB
  cold_exec         32      30          0          1         1.03ms         1.15ms        8.08MiB        8.11MiB
  warm_exec         32      30          1         25       509.73us       545.76us      960.00KiB        1.30MiB
  cold_exec        128      30          0          1         1.14ms         1.19ms        8.30MiB        8.34MiB
  warm_exec        128      30          1         25       575.08us       591.03us      736.00KiB      864.00KiB
  memory uses a fresh-process max RSS delta for each scenario
  ```
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Channing Conger · 2026-03-20 23:36:58 -07:00
  e4eedd6170
• Pass platform param to featured plugins (#15348)
  alexsong-oai · 2026-03-21 01:42:40 +00:00
  ec32866c37
• fix(core) disable command_might_be_dangerous when unsandboxed (#15036)

  ## Summary
  If we are in a mode that is already explicitly un-sandboxed, then
  `ApprovalPolicy::Never` should not block dangerous commands.
  
  ## Testing
  - [x] Existing unit test covers old behavior
  - [x] Added a unit test for this new case

  Dylan Hurd · 2026-03-21 01:28:25 +00:00
  60c59a7799
• chore(core) update prefix_rule guidance (#15231)

  ## Summary
  Small tweaks to the prefix_rule guidance.
  
  ## Testing
  - [x] in progress

  Dylan Hurd · 2026-03-20 15:57:06 -07:00
  7754dd1b89
• fix: allow restricted filesystem profiles to read helper executables (#15114)

  ## Summary
  
  This PR fixes restricted filesystem permission profiles so Codex's
  runtime-managed helper executables remain readable without requiring
  explicit user configuration.
  
  - add implicit readable roots for the configured `zsh` helper path and
  the main execve wrapper
  - allowlist the shared `$CODEX_HOME/tmp/arg0` root when the execve
  wrapper lives there, so session-specific helper paths keep working
  - dedupe injected paths and avoid adding duplicate read entries to the
  sandbox policy
  - add regression coverage for restricted read mode with helper
  executable overrides
  
  ## Testing 
  before this change: got this error when executing a shell command via
  zsh fork:
  ```
  "sandbox error: sandbox denied exec error, exit code: 127, stdout: , stderr: /etc/zprofile:11: operation not permitted: /usr/libexec/path_helper\nzsh:1: operation not permitted: .codex/skills/proxy-a/scripts/fetch_example.sh\n"
  ```
  
  saw this change went away after this change, meaning the readable roots
  and injected correctly.

  Celia Chen · 2026-03-20 15:51:06 -07:00
  9eef2e91fc
• Gate tui /plugins menu behind flag (#15285)

  Gate /plugins menu behind `--enable plugins` flag

  canvrno-oai · 2026-03-20 15:49:04 -07:00
  10a936d127
• Add realtime transcript notification in v2 (#15344)

  - emit a typed `thread/realtime/transcriptUpdated` notification from
  live realtime transcript deltas
  - expose that notification as flat `threadId`, `role`, and `text` fields
  instead of a nested transcript array
  - continue forwarding raw `handoff_request` items on
  `thread/realtime/itemAdded`, including the accumulated
  `active_transcript`
  - update app-server docs, tests, and generated protocol schema artifacts
  to match the delta-based payloads
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-20 15:30:48 -07:00
  3431f01776
• chore(core) Remove Feature::PowershellUtf8 (#15128)

  ## Summary
  This feature has been enabled for powershell for a while now, let's get
  rid of the logic
  
  ## Testing
  - [x] Unit tests

  Dylan Hurd · 2026-03-20 22:03:31 +00:00
  ea8b07e680
• [apps] Use ARC for yolo mode. (#15273)

  - [x] Use ARC for yolo mode.

  Matthew Zeng · 2026-03-20 21:13:20 +00:00
  dd88ed767b
• Add v8-poc consumer of our new built v8 (#15203)

  This adds a dummy v8-poc project that in Cargo links against our
  prebuilt binaries and the ones provided by rusty_v8 for non musl
  platforms. This demonstrates that we can successfully link and use v8 on
  all platforms that we want to target.
  
  In bazel things are slightly more complicated. Since the libraries as
  published have libc++ linked in already we end up with a lot of double
  linked symbols if we try to use them in bazel land. Instead we fall back
  to building rusty_v8 and v8 from source (cached of course) on the
  platforms we ship to.
  
  There is likely some compatibility drift in the windows bazel builder
  that we'll need to reconcile before we can re-enable them. I'm happy to
  be on the hook to unwind that.

  Channing Conger · 2026-03-20 12:08:25 -07:00
  1350477150
• Bump aws-lc-rs (#15337)

  Bump our dep.
  
  RUSTSEC-2026-0048
  Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0048

  Channing Conger · 2026-03-20 18:59:13 +00:00
  a941d8439d
• Pin Python SDK app-server stdio to UTF-8 on Windows (#15244)

  ## TL;DR
  Pin the Python app-server SDK subprocess pipes to UTF-8 so Windows users
  on non-UTF-8 locales do not hit `UnicodeDecodeError` when the `codex`
  child emits UTF-8 text.
  
  - add `encoding="utf-8"` to the `subprocess.Popen(...)` call in
  `AppServerClient.start()`
  - add a focused regression test that asserts the client launches the
  subprocess with UTF-8 text I/O
  - validates with `python -m pytest
  sdk/python/tests/test_client_rpc_methods.py
  sdk/python/tests/test_client_process_launch.py
  sdk/python/tests/test_public_api_runtime_behavior.py`
  
  Fixes #14311.

  Shaqayeq · 2026-03-20 18:26:24 +00:00
  9e31aeadce
• feat: change multi-agent to use path-like system instead of uuids (#15313)

  This PR add an URI-based system to reference agents within a tree. This
  comes from a sync between research and engineering.
  
  The main agent (the one manually spawned by a user) is always called
  `/root`. Any sub-agent spawned by it will be `/root/agent_1` for example
  where `agent_1` is chosen by the model.
  
  Any agent can contact any agents using the path.
  
  Paths can be used either in absolute or relative to the calling agents
  
  Resume is not supported for now on this new path

  jif-oai · 2026-03-20 18:23:48 +00:00
  79ad7b247b
• Add remote test skill (#15324)

  Teach codex to run remote tests.

  pakrym-oai · 2026-03-20 10:37:57 -07:00
  4ddde54c19
• try to fix bazel (#15328)

  Fix Bazel macOS CI failures caused by the llvm module's pinned macOS SDK
  URL returning 403 Forbidden from Apple's CDN.
  
  Bump llvm to 0.6.8, switch to the new osx.from_archive(...) /
  osx.frameworks(...) API, and refresh MODULE.bazel.lock so Bazel uses the
  updated SDK archive configuration.

  jif-oai · 2026-03-20 10:18:19 -07:00
  b9fa08ec61
• Add temporary app-server originator fallback for codex-tui (#15218)

  ## Summary
  - make app-server treat `clientInfo.name == "codex-tui"` as a legacy
  compatibility case
  - fall back to `DEFAULT_ORIGINATOR` instead of sending `codex-tui` as
  the originator header
  - add a TODO noting this is a temporary workaround that should be
  removed later
  
  ## Testing
  - Not run (not requested)

  Eric Traut · 2026-03-20 10:51:21 -06:00
  4f28b64abc
• Add remote env CI matrix and integration test (#14869)

  `CODEX_TEST_REMOTE_ENV` will make `test_codex` start the executor
  "remotely" (inside a docker container) turning any integration test into
  remote test.

  pakrym-oai · 2026-03-20 08:02:50 -07:00
  ba85a58039
• feat: prefer git for curated plugin sync (#15275)

  start with git clone, fallback to http.

  xl-openai · 2026-03-20 00:06:24 -07:00
  e5f4d1fef5
• Feat/restore image generation history (#15223)

  Restore image generation items in resumed thread history

  Won Park · 2026-03-19 22:57:16 -07:00
  461ba012fc
• Add guardian follow-up reminder (#15262)

  ## Summary
  - add a short guardian follow-up developer reminder before reused
  reviews
  - cache prior-review state on the guardian session instead of rescanning
  full history on each request
  - update guardian follow-up coverage and snapshot expectations
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-19 22:35:52 -07:00
  b3a4da84da
• feat: Add One-Time Startup Remote Plugin Sync (#15264)

  For early users who have already enabled apps, we should enable plugins
  as part of the initial setup.

  xl-openai · 2026-03-20 05:01:39 +00:00
  b1570d6c23
• Disable hooks on windows for now (#15252)

  We'll verify a bit later that all of this works correctly and re-enable

  Andrei Eternal · 2026-03-19 21:31:56 -07:00
  cc192763e1
• Initial plugins TUI menu - list and read only. tui + tui_app_server (#15215)

  ### Preliminary /plugins TUI menu
  - Adds a preliminary /plugins menu flow in both tui and tui_app_server.
  - Fetches plugin list data asynchronously and shows loading/error/cached
  states.
    - Limits this first pass to the curated ChatGPT marketplace.
    - Shows available plugins with installed/status metadata.
  - Supports in-menu search over plugin display name, plugin id, plugin
  name, and marketplace label.
  - Opens a plugin detail view on selection, including summaries for
  Skills, Apps, and MCP Servers, with back navigation.
  
  ### Testing
    - Launch codex-cli with plugins enabled (`--enable plugins`).
    - Run /plugins and verify:
        - loading state appears first
        - plugin list is shown
        - search filters results
  - selecting a plugin opens detail view, with a list of
  skills/connectors/MCP servers for the plugin
        - back action returns to the list.
  - Verify disabled behavior by running /plugins without plugins enabled
  (shows “Plugins are disabled” message).
  - Launch with `--enable tui_app_server` (and plugins enabled) and repeat
  the same /plugins flow; behavior should match.

  canvrno-oai · 2026-03-19 21:28:33 -07:00
  f7201e5a9f
• Use released DotSlash package for argument-comment lint (#15199)

  ## Why
  The argument-comment lint now has a packaged DotSlash artifact from
  [#15198](https://github.com/openai/codex/pull/15198), so the normal repo
  lint path should use that released payload instead of rebuilding the
  lint from source every time.
  
  That keeps `just clippy` and CI aligned with the shipped artifact while
  preserving a separate source-build path for people actively hacking on
  the lint crate.
  
  The current alpha package also exposed two integration wrinkles that the
  repo-side prebuilt wrapper needs to smooth over:
  - the bundled Dylint library filename includes the host triple, for
  example `@nightly-2025-09-18-aarch64-apple-darwin`, and Dylint derives
  `RUSTUP_TOOLCHAIN` from that filename
  - on Windows, Dylint's driver path also expects `RUSTUP_HOME` to be
  present in the environment
  
  Without those adjustments, the prebuilt CI jobs fail during `cargo
  metadata` or driver setup. This change makes the checked-in prebuilt
  wrapper normalize the packaged library name to the plain
  `nightly-2025-09-18` channel before invoking `cargo-dylint`, and it
  teaches both the wrapper and the packaged runner source to infer
  `RUSTUP_HOME` from `rustup show home` when the environment does not
  already provide it.
  
  After the prebuilt Windows lint job started running successfully, it
  also surfaced a handful of existing anonymous literal callsites in
  `windows-sandbox-rs`. This PR now annotates those callsites so the new
  cross-platform lint job is green on the current tree.
  
  ## What Changed
  - checked in the current
  `tools/argument-comment-lint/argument-comment-lint` DotSlash manifest
  - kept `tools/argument-comment-lint/run.sh` as the source-build wrapper
  for lint development
  - added `tools/argument-comment-lint/run-prebuilt-linter.sh` as the
  normal enforcement path, using the checked-in DotSlash package and
  bundled `cargo-dylint`
  - updated `just clippy` and `just argument-comment-lint` to use the
  prebuilt wrapper
  - split `.github/workflows/rust-ci.yml` so source-package checks live in
  a dedicated `argument_comment_lint_package` job, while the released lint
  runs in an `argument_comment_lint_prebuilt` matrix on Linux, macOS, and
  Windows
  - kept the pinned `nightly-2025-09-18` toolchain install in the prebuilt
  CI matrix, since the prebuilt package still relies on rustup-provided
  toolchain components
  - updated `tools/argument-comment-lint/run-prebuilt-linter.sh` to
  normalize host-qualified nightly library filenames, keep the `rustup`
  shim directory ahead of direct toolchain `cargo` binaries, and export
  `RUSTUP_HOME` when needed for Windows Dylint driver setup
  - updated `tools/argument-comment-lint/src/bin/argument-comment-lint.rs`
  so future published DotSlash artifacts apply the same nightly-filename
  normalization and `RUSTUP_HOME` inference internally
  - fixed the remaining Windows lint violations in
  `codex-rs/windows-sandbox-rs` by adding the required `/*param*/`
  comments at the reported callsites
  - documented the checked-in DotSlash file, wrapper split, archive
  layout, nightly prerequisite, and Windows `RUSTUP_HOME` requirement in
  `tools/argument-comment-lint/README.md`

  Michael Bolin · 2026-03-20 03:19:22 +00:00
  fa2a2f0be9
• Split exec process into local and remote implementations (#15233)

  ## Summary
  - match the exec-process structure to filesystem PR #15232
  - expose `ExecProcess` on `Environment`
  - make `LocalProcess` the real implementation and `RemoteProcess` a thin
  network proxy over `ExecServerClient`
  - make `ProcessHandler` a thin RPC adapter delegating to `LocalProcess`
  - add a shared local/remote process test
  
  ## Validation
  - `just fmt`
  - `CARGO_TARGET_DIR=~/.cache/cargo-target/codex cargo test -p
  codex-exec-server`
  - `just fix -p codex-exec-server`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-03-20 03:13:08 +00:00
  96a86710c3
• Split features into codex-features crate (#15253)

  - Split the feature system into a new `codex-features` crate.
  - Cut `codex-core` and workspace consumers over to the new config and
  warning APIs.
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 20:12:07 -07:00
  2e22885e79
• fix: Distinguish missing and empty plugin products (#15263)

  Treat [] as no product allowed, empty as all products allowed.

  xl-openai · 2026-03-19 20:02:40 -07:00
  35f8b87a5b
• core: add a full-buffer exec capture policy (#15254)
  Michael Bolin · 2026-03-20 02:38:12 +00:00
  a3e59e9e85
• [plugins] Install MCPs when calling plugin/install (#15195)

  - [x] Auth MCPs when installing plugins.

  Matthew Zeng · 2026-03-19 19:36:58 -07:00
  0a344e4fab
• Move auth code into login crate (#15150)

  - Move the auth implementation and token data into codex-login.
  - Keep codex-core re-exporting that surface from codex-login for
  existing callers.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 18:58:17 -07:00
  2aa4873802
• V8 Bazel Build (#15021)

  Alternative approach, we use rusty_v8 for all platforms that its
  predefined, but lets build from source a musl v8 version with bazel for
  x86 and aarch64 only. We would need to release this on github and then
  use the release.

  Channing Conger · 2026-03-19 18:05:23 -07:00
  ded7854f09
• Refactor ExecServer filesystem split between local and remote (#15232)

  For each feature we have:
  1. Trait exposed on environment
  2. **Local Implementation** of the trait
  3. Remote implementation that uses the client to proxy via network
  4. Handler implementation that handles PRC requests and calls into
  **Local Implementation**

  pakrym-oai · 2026-03-19 17:08:04 -07:00
  403b397e4e
• changed save directory to codex_home (#15222)

  saving image gen default save directory to
  codex_home/imagegen/thread_id/

  Won Park · 2026-03-19 15:16:26 -07:00
  6b8175c734
• feat(app-server): add mcpServer/startupStatus/updated notification (#15220)

  Exposes the legacy `codex/event/mcp_startup_update` event as an API v2
  notification.
  
  The legacy event has this shape:
  ```
  #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
  pub struct McpStartupUpdateEvent {
      /// Server name being started.
      pub server: String,
      /// Current startup status.
      pub status: McpStartupStatus,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
  #[serde(rename_all = "snake_case", tag = "state")]
  #[ts(rename_all = "snake_case", tag = "state")]
  pub enum McpStartupStatus {
      Starting,
      Ready,
      Failed { error: String },
      Cancelled,
  }
  ```

  Owen Lin · 2026-03-19 15:09:59 -07:00
  9e695fe830
• Plumb MCP turn metadata through _meta (#15190)

  ## Summary
  
  Some background. We're looking to instrument GA turns end to end. Right
  now a big gap is grouping mcp tool calls with their codex sessions. We
  send session id and turn id headers to the responses call but not the
  mcp/wham calls.
  
  Ideally we could pass the args as headers like with responses, but given
  the setup of the rmcp client, we can't send as headers without either
  changing the rmcp package upstream to allow per request headers or
  introducing a mutex which break concurrency. An earlier attempt made the
  assumption that we had 1 client per thread, which allowed us to set
  headers at the start of a turn. @pakrym mentioned that this assumption
  might break in the near future.
  
  So the solution now is to package the turn metadata/session id into the
  _meta field in the post body and pull out in codex-backend.
  
  - send turn metadata to MCP servers via `tools/call` `_meta` instead of
  assuming per-thread request headers on shared clients
  - preserve the existing `_codex_apps` metadata while adding
  `x-codex-turn-metadata` for all MCP tool calls
  - extend tests to cover both custom MCP servers and the codex apps
  search flow
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  nicholasclark-openai · 2026-03-19 22:05:13 +00:00
  2bee37fe69
• feat: expose needs_auth for plugin/read. (#15217)

  So UI can render it properly.

  xl-openai · 2026-03-19 15:02:45 -07:00
  2254ec4f30
• adding full imagepath to tui (#15154)

  adding full path to TUI so image is open-able in the TUI after being
  generated. LImited to VSCode Terminal for now.

  Won Park · 2026-03-19 21:29:22 +00:00
  27977d6716
• add specific tool guidance for Windows destructive commands (#15207)

  updated Windows shell/unified_exec tool descriptions:
  
  `exec_command`
  ```text
  Runs a command in a PTY, returning output or a session ID for ongoing interaction.
  
  Windows safety rules:
  - Do not compose destructive filesystem commands across shells. Do not enumerate paths in PowerShell and then pass them to `cmd /c`, batch builtins, or another shell for deletion or moving. Use one shell end-to-end, prefer native PowerShell cmdlets such as `Remove-Item` / `Move-Item` with `-LiteralPath`, and avoid string-built shell commands for file operations.
  - Before any recursive delete or move on Windows, verify the resolved absolute target paths stay within the intended workspace or explicitly named target directory. Never issue a recursive delete or move against a computed path if the final target has not been checked.
  ```
  
  `shell`
  ```text
  Runs a Powershell command (Windows) and returns its output. Arguments to `shell` will be passed to CreateProcessW(). Most commands should be prefixed with ["powershell.exe", "-Command"].
  
  Examples of valid command strings:
  
  - ls -a (show hidden): ["powershell.exe", "-Command", "Get-ChildItem -Force"]
  - recursive find by name: ["powershell.exe", "-Command", "Get-ChildItem -Recurse -Filter *.py"]
  - recursive grep: ["powershell.exe", "-Command", "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"]
  - ps aux | grep python: ["powershell.exe", "-Command", "Get-Process | Where-Object { $_.ProcessName -like '*python*' }"]
  - setting an env var: ["powershell.exe", "-Command", "$env:FOO='bar'; echo $env:FOO"]
  - running an inline Python script: ["powershell.exe", "-Command", "@'\nprint('Hello, world!')\n'@ | python -"]
  
  Windows safety rules:
  - Do not compose destructive filesystem commands across shells. Do not enumerate paths in PowerShell and then pass them to `cmd /c`, batch builtins, or another shell for deletion or moving. Use one shell end-to-end, prefer native PowerShell cmdlets such as `Remove-Item` / `Move-Item` with `-LiteralPath`, and avoid string-built shell commands for file operations.
  - Before any recursive delete or move on Windows, verify the resolved absolute target paths stay within the intended workspace or explicitly named target directory. Never issue a recursive delete or move against a computed path if the final target has not been checked.
  ```
  
  `shell_command`
  ```text
  Runs a Powershell command (Windows) and returns its output.
  
  Examples of valid command strings:
  
  - ls -a (show hidden): "Get-ChildItem -Force"
  - recursive find by name: "Get-ChildItem -Recurse -Filter *.py"
  - recursive grep: "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"
  - ps aux | grep python: "Get-Process | Where-Object { $_.ProcessName -like '*python*' }"
  - setting an env var: "$env:FOO='bar'; echo $env:FOO"
  - running an inline Python script: "@'\nprint('Hello, world!')\n'@ | python -"
  
  Windows safety rules:
  - Do not compose destructive filesystem commands across shells. Do not enumerate paths in PowerShell and then pass them to `cmd /c`, batch builtins, or another shell for deletion or moving. Use one shell end-to-end, prefer native PowerShell cmdlets such as `Remove-Item` / `Move-Item` with `-LiteralPath`, and avoid string-built shell commands for file operations.
  - Before any recursive delete or move on Windows, verify the resolved absolute target paths stay within the intended workspace or explicitly named target directory. Never issue a recursive delete or move against a computed path if the final target has not been checked.
  ```

  iceweasel-oai · 2026-03-19 21:09:34 +00:00
  69750a0b5a
• Move terminal module to terminal-detection crate (#15216)

  - Move core/src/terminal.rs and its tests into a standalone
  terminal-detection workspace crate.
  - Update direct consumers to depend on codex-terminal-detection and
  import terminal APIs directly.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 14:08:04 -07:00
  7eb19e5319
• feat(tracing): tag app-server turn spans with turn_id (#15206)

  So we can find and filter spans by `turn.id`.
  
  We do this for the `turn/start`, `turn/steer`, and `turn/interrupt`
  APIs.

  Owen Lin · 2026-03-19 13:07:19 -07:00
  668330acc1