7919 Commits

This Branch

This Branch

All Branches

• fix: avoid invoking git before project trust is established (#13804)

  ## Summary
  - resolve trust roots by inspecting `.git` entries on disk instead of
  spawning `git rev-parse --git-common-dir`
  - keep regular repo and linked-worktree trust inheritance behavior
  intact
  - add a synthetic regression test that proves worktree trust resolution
  works without a real git command
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-core resolve_root_git_project_for_trust`
  - `cargo clippy -p codex-core --all-targets -- -D warnings`
  - `cargo test -p codex-core` (fails in this environment on unrelated
  managed-config `DangerFullAccess` tests in `codex::tests`,
  `tools::js_repl::tests`, and `unified_exec::tests`)

  viyatb-oai · 2026-03-06 17:46:23 -08:00
  5deaf9409b
• feat(app-server-protocol): address naming conflicts in json schema exporter (#13819)

  This fixes a schema export bug where two different `WebSearchAction`
  types were getting merged under the same name in the app-server v2 JSON
  schema bundle.
  
  The problem was that v2 thread items use the app-server API's
  `WebSearchAction` with camelCase variants like `openPage`, while
  `ThreadResumeParams.history` and
  `RawResponseItemCompletedNotification.item` pull in the upstream
  `ResponseItem` graph, which uses the Responses API snake_case shape like
  `open_page`. During bundle generation we were flattening nested
  definitions into the v2 namespace by plain name, so the later definition
  could silently overwrite the earlier one.
  
  That meant clients generating code from the bundled schema could end up
  with the wrong `WebSearchAction` definition for v2 thread history. In
  practice this shows up on web search items reconstructed from rollout
  files with persisted extended history.
  
  This change does two things:
  - Gives the upstream Responses API schema a distinct JSON schema name:
  `ResponsesApiWebSearchAction`
  - Makes namespace-level schema definition collisions fail loudly instead
  of silently overwriting

  Owen Lin · 2026-03-07 01:33:46 +00:00
  90469d0a23
• app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

  * Add an ability to stream stdin, stdout, and stderr
  * Streaming of stdout and stderr has a configurable cap for total amount
  of transmitted bytes (with an ability to disable it)
  * Add support for overriding environment variables
  * Add an ability to terminate running applications (using
  `command/exec/terminate`)
  * Add TTY/PTY support, with an ability to resize the terminal (using
  `command/exec/resize`)

  Ruslan Nigmatullin · 2026-03-06 17:30:17 -08:00
  e9bd8b20a1
• Allow full web search tool config (#13675)

  Previously, we could only configure whether web search was on/off.
  
  This PR enables sending along a web search config, which includes all
  the stuff responsesapi supports: filters, location, etc.

  Rohan Mehta · 2026-03-07 00:50:50 +00:00
  61098c7f51
• fix(core): skip exec approval for permissionless skill scripts (#13791)

  ## Summary
  
  - Treat skill scripts with no permission profile, or an explicitly empty
  one, as permissionless and run them with the turn's existing sandbox
  instead of forcing an exec approval prompt.
  - Keep the approval flow unchanged for skills that do declare additional
  permissions.
  - Update the skill approval tests to assert that permissionless skill
  scripts do not prompt on either the initial run or a rerun.
  
  ## Why
  
  Permissionless skills should inherit the current turn sandbox directly.
  Prompting for exec approval in that case adds friction without granting
  any additional capability.

  Celia Chen · 2026-03-06 16:40:41 -08:00
  8b81284975
• feat: Add curated plugin marketplace + Metadata Cleanup. (#13712)

  1. Add a synced curated plugin marketplace and include it in marketplace
  discovery.
  2. Expose optional plugin.json interface metadata in plugin/list
  3. Tighten plugin and marketplace path handling using validated absolute
  paths.
  4. Let manifests override skill, MCP, and app config paths.
  5. Restrict plugin enablement/config loading to the user config layer so
  plugin enablement is at global level

  xl-openai · 2026-03-06 19:39:35 -05:00
  0243734300
• chore(otel): rename OtelManager to SessionTelemetry (#13808)

  ## Summary
  This is a purely mechanical refactor of `OtelManager` ->
  `SessionTelemetry` to better convey what the struct is doing. No
  behavior change.
  
  ## Why
  
  `OtelManager` ended up sounding much broader than what this type
  actually does. It doesn't manage OTEL globally; it's the session-scoped
  telemetry surface for emitting log/trace events and recording metrics
  with consistent session metadata (`app_version`, `model`, `slug`,
  `originator`, etc.).
  
  `SessionTelemetry` is a more accurate name, and updating the call sites
  makes that boundary a lot easier to follow.
  
  ## Validation
  
  - `just fmt`
  - `cargo test -p codex-otel`
  - `cargo test -p codex-core`

  Owen Lin · 2026-03-06 16:23:30 -08:00
  289ed549cf
• fix: include libcap-dev dependency when creating a devcontainer for building Codex (#13814)

  I mainly use the devcontainer to be able to run `cargo clippy --tests`
  locally for Linux.
  
  We still need to make it possible to run clippy from Bazel so I don't
  need to do this!

  Michael Bolin · 2026-03-06 16:21:14 -08:00
  3794363cac
• Add realtime startup context override (#13796)

  - add experimental_realtime_ws_startup_context to override or disable
  realtime websocket startup context
  - preserve generated startup context when unset and cover the new
  override paths in tests

  Ahmed Ibrahim · 2026-03-06 16:00:30 -08:00
  a11c59f634
• config: add initial support for the new permission profile config language in config.toml (#13434)

  ## Why
  
  `SandboxPolicy` currently mixes together three separate concerns:
  
  - parsing layered config from `config.toml`
  - representing filesystem sandbox state
  - carrying basic network policy alongside filesystem choices
  
  That makes the existing config awkward to extend and blocks the new TOML
  proposal where `[permissions]` becomes a table of named permission
  profiles selected by `default_permissions`. (The idea is that if
  `default_permissions` is not specified, we assume the user is opting
  into the "traditional" way to configure the sandbox.)
  
  This PR adds the config-side plumbing for those profiles while still
  projecting back to the legacy `SandboxPolicy` shape that the current
  macOS and Linux sandbox backends consume.
  
  It also tightens the filesystem profile model so scoped entries only
  exist for `:project_roots`, and so nested keys must stay within a
  project root instead of using `.` or `..` traversal.
  
  This drops support for the short-lived `[permissions.network]` in
  `config.toml` because now that would be interpreted as a profile named
  `network` within `[permissions]`.
  
  ## What Changed
  
  - added `PermissionsToml`, `PermissionProfileToml`,
  `FilesystemPermissionsToml`, and `FilesystemPermissionToml` so config
  can parse named profiles under `[permissions.<profile>.filesystem]`
  - added top-level `default_permissions` selection, validation for
  missing or unknown profiles, and compilation from a named profile into
  split `FileSystemSandboxPolicy` and `NetworkSandboxPolicy` values
  - taught config loading to choose between the legacy `sandbox_mode` path
  and the profile-based path without breaking legacy users
  - introduced `codex-protocol::permissions` for the split filesystem and
  network sandbox types, and stored those alongside the legacy projected
  `sandbox_policy` in runtime `Permissions`
  - modeled `FileSystemSpecialPath` so only `ProjectRoots` can carry a
  nested `subpath`, matching the intended config syntax instead of
  allowing invalid states for other special paths
  - restricted scoped filesystem maps to `:project_roots`, with validation
  that nested entries are non-empty descendant paths and cannot use `.` or
  `..` to escape the project root
  - kept existing runtime consumers working by projecting
  `FileSystemSandboxPolicy` back into `SandboxPolicy`, with an explicit
  error for profiles that request writes outside the workspace root
  - loaded proxy settings from top-level `[network]`
  - regenerated `core/config.schema.json`
  
  ## Verification
  
  - added config coverage for profile deserialization,
  `default_permissions` selection, top-level `[network]` loading, network
  enablement, rejection of writes outside the workspace root, rejection of
  nested entries for non-`:project_roots` special paths, and rejection of
  parent-directory traversal in `:project_roots` maps
  - added protocol coverage for the legacy bridge rejecting non-workspace
  writes
  
  ## Docs
  
  - update the Codex config docs on developers.openai.com/codex to
  document named `[permissions.<profile>]` entries, `default_permissions`,
  scoped `:project_roots` syntax, the descendant-path restriction for
  nested `:project_roots` entries, and top-level `[network]` proxy
  configuration
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13434).
  * #13453
  * #13452
  * #13451
  * #13449
  * #13448
  * #13445
  * #13440
  * #13439
  * __->__ #13434

  Michael Bolin · 2026-03-06 15:39:13 -08:00
  f82678b2a4
• docs: remove auth login logging plan (#13810)

  ## Summary
  
  Remove `docs/auth-login-logging-plan.md`.
  
  ## Why
  
  The document was a temporary planning artifact. The durable rationale
  for the
  auth-login diagnostics work now lives in the code comments, tests, PR
  context,
  and existing implementation notes, so keeping the standalone plan doc
  adds
  duplicate maintenance surface.
  
  ## Testing
  
  - not run (docs-only deletion)
  
  Co-authored-by: Codex <noreply@openai.com>

  Josh McKinney · 2026-03-06 23:32:53 +00:00
  8ba718a611
• Clarify js_repl binding reuse guidance (#13803)

  ## Summary
  
  Clarify the `js_repl` prompt guidance around persistent bindings and
  redeclaration recovery.
  
  This updates the generated `js_repl` instructions in
  `core/src/project_doc.rs` to prefer this order when a name is already
  bound:
  
  1. Reuse the existing binding
  2. Reassign a previously declared `let`
  3. Pick a new descriptive name
  4. Use `{ ... }` only for short-lived scratch scope
  5. Reset the kernel only when a clean state is actually needed
  
  The prompt now also explicitly warns against wrapping an entire cell in
  block scope when the goal is to reuse names across later cells.
  
  ## Why
  
  The previous wording still left too much room for low-value workarounds
  like whole-cell block wrapping. In downstream browser rollouts, that
  pattern was adding tokens and preventing useful state reuse across
  `js_repl` cells.
  
  This change makes the preferred behavior more explicit without changing
  runtime semantics.
  
  ## Scope
  
  - Prompt/documentation change only
  - No runtime behavior changes
  - Updates the matching string-backed `project_doc` tests

  Curtis 'Fjord' Hawthorne · 2026-03-06 15:19:06 -08:00
  d6c8186195
• utils/pty: add streaming spawn and terminal sizing primitives (#13695)

  Enhance pty utils:
  * Support closing stdin
  * Separate stderr and stdout streams to allow consumers differentiate them
  * Provide compatibility helper to merge both streams back into combined one
  * Support specifying terminal size for pty, including on-demand resizes while process is already running
  * Support terminating the process while still consuming its outputs

  Ruslan Nigmatullin · 2026-03-06 15:13:12 -08:00
  5b04cc657f
• feat: add auth login diagnostics (#13797)

  ## Problem
  
  Browser login failures historically leave support with an incomplete
  picture. HARs can show that the browser completed OAuth and reached the
  localhost callback, but they do not explain why the native client failed
  on the final `/oauth/token` exchange. Direct `codex login` also relied
  mostly on terminal stderr and the browser error page, so even when the
  login crate emitted better sign-in diagnostics through TUI or app-server
  flows, the one-shot CLI path still did not leave behind an easy artifact
  to collect.
  
  ## Mental model
  
  This implementation treats the browser page, the returned `io::Error`,
  and the normal structured log as separate surfaces with different safety
  requirements. The browser page and returned error preserve the detail
  that operators need to diagnose failures. The structured log stays
  narrower: it records reviewed lifecycle events, parsed safe fields, and
  redacted transport errors without becoming a sink for secrets or
  arbitrary backend bodies.
  
  Direct `codex login` now adds a fourth support surface: a small
  file-backed log at `codex-login.log` under the configured `log_dir`.
  That artifact carries the same login-target events as the other
  entrypoints without changing the existing stderr/browser UX.
  
  ## Non-goals
  
  This does not add auth logging to normal runtime requests, and it does
  not try to infer precise transport root causes from brittle string
  matching. The scope remains the browser-login callback flow in the
  `login` crate plus a direct-CLI wrapper that persists those events to
  disk.
  
  This also does not try to reuse the TUI logging stack wholesale. The TUI
  path initializes feedback, OpenTelemetry, and other session-oriented
  layers that are useful for an interactive app but unnecessary for a
  one-shot login command.
  
  ## Tradeoffs
  
  The implementation favors fidelity for caller-visible errors and
  restraint for persistent logs. Parsed JSON token-endpoint errors are
  logged safely by field. Non-JSON token-endpoint bodies remain available
  to the returned error so CLI and browser surfaces still show backend
  detail. Transport errors keep their real `reqwest` message, but attached
  URLs are surgically redacted. Custom issuer URLs are sanitized before
  logging.
  
  On the CLI side, the code intentionally duplicates a narrow slice of the
  TUI file-logging setup instead of sharing the full initializer. That
  keeps `codex login` easy to reason about and avoids coupling it to
  interactive-session layers that the command does not need.
  
  ## Architecture
  
  The core auth behavior lives in `codex-rs/login/src/server.rs`. The
  callback path now logs callback receipt, callback validation,
  token-exchange start, token-exchange success, token-endpoint non-2xx
  responses, and transport failures. App-server consumers still use this
  same login-server path via `run_login_server(...)`, so the same
  instrumentation benefits TUI, Electron, and VS Code extension flows.
  
  The direct CLI path in `codex-rs/cli/src/login.rs` now installs a small
  file-backed tracing layer for login commands only. That writes
  `codex-login.log` under `log_dir` with login-specific targets such as
  `codex_cli::login` and `codex_login::server`.
  
  ## Observability
  
  The main signals come from the `login` crate target and are
  intentionally scoped to sign-in. Structured logs include redacted issuer
  URLs, redacted transport errors, HTTP status, and parsed token-endpoint
  fields when available. The callback-layer log intentionally avoids
  `%err` on token-endpoint failures so arbitrary backend bodies do not get
  copied into the normal log file.
  
  Direct `codex login` now leaves a durable artifact for both failure and
  success cases. Example output from the new file-backed CLI path:
  
  Failing callback:
  
  ```text
  2026-03-06T22:08:54.143612Z  INFO codex_cli::login: starting browser login flow
  2026-03-06T22:09:03.431699Z  INFO codex_login::server: received login callback path=/auth/callback has_code=false has_state=true has_error=true state_valid=true
  2026-03-06T22:09:03.431745Z  WARN codex_login::server: oauth callback returned error error_code="access_denied" has_error_description=true
  ```
  
  Succeeded callback and token exchange:
  
  ```text
  2026-03-06T22:09:14.065559Z  INFO codex_cli::login: starting browser login flow
  2026-03-06T22:09:36.431678Z  INFO codex_login::server: received login callback path=/auth/callback has_code=true has_state=true has_error=false state_valid=true
  2026-03-06T22:09:36.436977Z  INFO codex_login::server: starting oauth token exchange issuer=https://auth.openai.com/ redirect_uri=http://localhost:1455/auth/callback
  2026-03-06T22:09:36.685438Z  INFO codex_login::server: oauth token exchange succeeded status=200 OK
  ```
  
  ## Tests
  
  - `cargo test -p codex-login`
  - `cargo clippy -p codex-login --tests -- -D warnings`
  - `cargo test -p codex-cli`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - manual direct `codex login` smoke tests for both a failing callback
  and a successful browser login
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Josh McKinney · 2026-03-06 15:00:37 -08:00
  4e68fb96e2
• chore(otel): reorganize codex-otel crate (#13800)

  ## Summary
  This is a structural cleanup of `codex-otel` to make the ownership
  boundaries a lot clearer.
  
  For example, previously it was quite confusing that `OtelManager` which
  emits log + trace event telemetry lived under
  `codex-rs/otel/src/traces/`. Also, there were two places that defined
  methods on OtelManager via `impl OtelManager` (`lib.rs` and
  `otel_manager.rs`).
  
  What changed:
  - move the `OtelProvider` implementation into `src/provider.rs`
  - move `OtelManager` and session-scoped event emission into
  `src/events/otel_manager.rs`
  - collapse the shared log/trace event helpers into
  `src/events/shared.rs`
  - pull target classification into `src/targets.rs`
  - move `traceparent_context_from_env()` into `src/trace_context.rs`
  - keep `src/otel_provider.rs` as a compatibility shim for existing
  imports
  - update the `codex-otel` README to reflect the new layout
  
  ## Why
  `lib.rs` and `otel_provider.rs` were doing too many different jobs at
  once: provider setup, export routing, trace-context helpers, and session
  event emission all lived together.
  
  This refactor separates those concerns without trying to change the
  behavior of the crate. The goal is to make future OTEL work easier to
  reason about and easier to review.
  
  ## Notes
  - no intended behavior change
  - `OtelManager` remains the session-scoped event emitter in this PR
  - the `otel_provider` shim keeps downstream churn low while the
  internals move around
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-otel`
  - `just fix -p codex-otel`

  Owen Lin · 2026-03-06 14:58:18 -08:00
  dd4a5216c9
• Codex/winget auto update (#12943)

  Publish CLI releases to winget.
  
  Uses https://github.com/vedantmgoyal9/winget-releaser to greatly reduce
  boilerplate needed to create winget-pkgs manifets

  iceweasel-oai · 2026-03-06 14:04:30 -08:00
  8ede18011a
• fix: reject global wildcard network proxy domains (#13789)

  ## Summary
  - reject the global `*` domain pattern in proxy allow/deny lists and
  managed constraints introduced for testing earlier
  - keep exact hosts plus scoped wildcards like `*.example.com` and
  `**.example.com`
  - update docs and regression tests for the new invalid-config behavior

  viyatb-oai · 2026-03-06 21:06:24 +00:00
  9a4787c240
• fix bazel build (#13787)

  I believe this broke in https://github.com/openai/codex/pull/13772.

  Michael Bolin · 2026-03-06 12:12:20 -08:00
  7a5aff4972
• fix: move unit tests in codex-rs/core/src/codex.rs into their own file (#13783)

  This is analogous to https://github.com/openai/codex/pull/13780.

  Michael Bolin · 2026-03-06 11:56:49 -08:00
  488875f24d
• fix: move unit tests in codex-rs/core/src/config/mod.rs into their own file (#13780)

  At over 7,000 lines, `codex-rs/core/src/config/mod.rs` was getting a bit
  unwieldy.
  
  This PR does the same type of move as
  https://github.com/openai/codex/pull/12957 to put unit tests in their
  own file, though I decided `config_tests.rs` is a more intuitive name
  than `mod_tests.rs`.
  
  Ultimately, I'll codemod the rest of the codebase to follow suit, but I
  want to do it in stages to reduce merge conflicts for people.

  Michael Bolin · 2026-03-06 11:21:58 -08:00
  39869f7443
• Reduce SQLite log retention to 10 days (#13781)

  ## Summary
  - reduce the SQLite-backed log retention window from 90 days to 10 days
  
  ## Testing
  - just fmt
  - cargo test -p codex-state
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-06 11:15:28 -08:00
  ad98504d74
• feat: structured plugin parsing (#13711)

  #### What
  
  Add structured `@plugin` parsing and TUI support for plugin mentions.
  
  - Core: switch from plain-text `@display_name` parsing to structured
  `plugin://...` mentions via `UserInput::Mention` and
  `[$...](plugin://...)` links in text, same pattern as apps/skills.
  - TUI: add plugin mention popup, autocomplete, and chips when typing
  `$`. Load plugin capability summaries and feed them into the composer;
  plugin mentions appear alongside skills and apps.
  - Generalize mention parsing to a sigil parameter, still defaults to `$`
  
  <img width="797" height="119" alt="image"
  src="https://github.com/user-attachments/assets/f0fe2658-d908-4927-9139-73f850805ceb"
  />
  
  Builds on #13510. Currently clients have to build their own `id` via
  `plugin@marketplace` and filter plugins to show by `enabled`, but we
  will add `id` and `available` as fields returned from `plugin/list`
  soon.
  
  ####Tests
  
  Added tests, verified locally.

  sayan-oai · 2026-03-06 11:08:36 -08:00
  8a54d3caaa
• chore: improve DB flushing (#13620)

  This branch:
  * Avoid flushing DB when not necessary
  * Filter events for which we perfom an `upsert` into the DB
  * Add a dedicated update function of the `thread:updated_at` that is
  lighter
  
  This should significantly reduce the DB lock contention. If it is not
  sufficient, we can de-sync the flush of the DB for `updated_at`

  jif-oai · 2026-03-06 19:58:14 +01:00
  0e41a5c4a8
• Move sqlite logs to a dedicated database (#13772)

  ## Summary
  - move sqlite log reads and writes onto a dedicated `logs_1.sqlite`
  database to reduce lock contention with the main state DB
  - add a dedicated logs migrator and route `codex-state-logs` to the new
  database path
  - leave the old `logs` table in the existing state DB untouched for now
  
  ## Testing
  - just fmt
  - cargo test -p codex-state
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-06 10:54:20 -08:00
  4e6c6193a1
• app-server: Emit thread/name/updated event globally (#13674)
  Ruslan Nigmatullin · 2026-03-06 10:25:18 -08:00
  51fcdc760d
• feat(otel, core): record turn TTFT and TTFM metrics in codex-core (#13630)

  ### Summary
  This adds turn-level latency metrics for the first model output and the
  first completed agent message.
  - `codex.turn.ttft.duration_ms` starts at turn start and records on the
  first output signal we see from the model. That includes normal
  assistant text, reasoning deltas, and non-text outputs like tool-call
  items.
  - `codex.turn.ttfm.duration_ms` also starts at turn start, but it
  records when the first agent message finishes streaming rather than when
  its first delta arrives.
  
  ### Implementation notes
  The timing is tracked in codex-core, not app-server, so the definition
  stays consistent across CLI, TUI, and app-server clients.
  
  I reused the existing turn lifecycle boundary that already drives
  `codex.turn.e2e_duration_ms`, stored the turn start timestamp in turn
  state, and record each metric once per turn.
  
  I also wired the new metric names into the OTEL runtime metrics summary
  so they show up in the same in-memory/debug snapshot path as the
  existing timing metrics.

  Owen Lin · 2026-03-06 10:23:48 -08:00
  3449e00bc9
• fix(app-server): fix turn_start_shell_zsh_fork_executes_command_v2 flake (#13770)

  This fixes a flaky `turn_start_shell_zsh_fork_executes_command_v2` test.
  
  The interrupt path can race with the follow-up `/responses` request that
  reports the aborted tool call, so the test now allows that extra no-op
  response instead of assuming there will only ever be one request. The
  assertions still stay focused on the behavior the test actually cares
  about: starting the zsh-forked command correctly.
  
  Testing:
  - `just fmt`
  - `cargo test -p codex-app-server --test all
  suite::v2::turn_start_zsh_fork::turn_start_shell_zsh_fork_executes_command_v2
  -- --exact --nocapture`

  Owen Lin · 2026-03-06 10:10:16 -08:00
  6c98a59dbd
• Clarify sandbox permission override helper semantics (#13703)

  ## Summary
  Today `SandboxPermissions::requires_additional_permissions()` does not
  actually mean "is `WithAdditionalPermissions`". It returns `true` for
  any non-default sandbox override, including `RequireEscalated`. That
  broad behavior is relied on in multiple `main` callsites.
  
  The naming is security-sensitive because `SandboxPermissions` is used on
  shell-like tool calls to tell the executor how a single command should
  relate to the turn sandbox:
  - `UseDefault`: run with the turn sandbox unchanged
  - `RequireEscalated`: request execution outside the sandbox
  - `WithAdditionalPermissions`: stay sandboxed but widen permissions for
  that command only
  
  ## Problem
  The old helper name reads as if it only applies to the
  `WithAdditionalPermissions` variant. In practice it means "this command
  requested any explicit sandbox override."
  
  That ambiguity made it easy to read production checks incorrectly and
  made the guardian change look like a standalone `main` fix when it is
  not.
  
  On `main` today:
  - `shell` and `unified_exec` intentionally reject any explicit
  `sandbox_permissions` request unless approval policy is `OnRequest`
  - `exec_policy` intentionally treats any explicit sandbox override as
  prompt-worthy in restricted sandboxes
  - tests intentionally serialize both `RequireEscalated` and
  `WithAdditionalPermissions` as explicit sandbox override requests
  
  So changing those callsites from the broad helper to a narrow
  `WithAdditionalPermissions` check would be a behavior change, not a pure
  cleanup.
  
  ## What This PR Does
  - documents `SandboxPermissions` as a per-command sandbox override, not
  a generic permissions bag
  - adds `requests_sandbox_override()` for the broad meaning: anything
  except `UseDefault`
  - adds `uses_additional_permissions()` for the narrow meaning: only
  `WithAdditionalPermissions`
  - keeps `requires_additional_permissions()` as a compatibility alias to
  the broad meaning for now
  - updates the current broad callsites to use the accurately named broad
  helper
  - adds unit coverage that locks in the semantics of all three helpers
  
  ## What This PR Does Not Do
  This PR does not change runtime behavior. That is intentional.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-06 09:57:48 -08:00
  cb1a182bbe
• feat: limit number of rows per log (#13763)

  avoid DB explosion. This is a temp solution

  jif-oai · 2026-03-06 18:51:42 +01:00
  c8f4b5bc1e
• feat: drop discrepency metrics (#13753)
  jif-oai · 2026-03-06 18:32:25 +01:00
  f891f516a5
• feat: drop sqlite db feature flag (#13750)
  jif-oai · 2026-03-06 17:57:52 +01:00
  fa16c26908
• [rmcp-client] Recover from streamable HTTP 404 sessions (#13514)

  ## Summary
  - add one-time session recovery in `RmcpClient` for streamable HTTP MCP
  `404` session expiry
  - rebuild the transport and retry the failed operation once after
  reinitializing the client state
  - extend the test server and integration coverage for `404`, `401`,
  single-retry, and non-session failure scenarios
  
  ## Testing
  - just fmt
  - cargo test -p codex-rmcp-client (the post-rebase run lost its final
  summary in the terminal; the suite had passed earlier before the rebase)
  - just fix -p codex-rmcp-client

  Casey Chow · 2026-03-06 10:02:42 -05:00
  b3765a07e8
• fix: windows normalization (#13742)
  jif-oai · 2026-03-06 15:50:44 +01:00
  5d4303510c
• Add timestamps to feedback log lines (#13688)

  `/feedback` uploads can include `codex-logs.log` from the in-memory
  feedback logger path. That logger was emitting level + message without a
  timestamp, which made some uploaded logs much harder to inspect. This
  change makes the feedback logger use an explicit timer so
  feedback-captured log lines include timestamps consistently.
  
  This is not Windows-specific code. The bug showed up in Windows reports
  because those uploads were hitting the feedback-buffer path more often,
  while Linux/macOS reports were typically coming from the SQLite feedback
  export, which already prefixes timestamps.
  
  Here's an example of a log that is missing the timestamps:
  
  ```
  TRACE app-server request: getAuthStatus
  TRACE app-server request: model/list
   INFO models cache: evaluating cache eligibility
   INFO models cache: attempting load_fresh
   INFO models cache: loaded cache file
   INFO models cache: cache version mismatch
   INFO models cache: no usable cache entry
  DEBUG 
   INFO models cache: cache miss, fetching remote models
  TRACE windows::current_platform is called
  TRACE Returning Info { os_type: Windows, version: Semantic(10, 0, 26200), edition: Some("Windows 11 Professional"), codename: None, bitness: X64, architecture: Some("x86_64") }
  ```

  Eric Traut · 2026-03-06 07:34:59 -07:00
  b5f475ed16
• feat: prune old memories in DB (#13734)

  To save memory

  jif-oai · 2026-03-06 15:10:49 +01:00
  8ad768eb76
• feat: status line with real data (#13619)
  jif-oai · 2026-03-06 11:01:40 +01:00
  b6d43ec8eb
• [elicitations] Switch to use MCP style elicitation payload for mcp tool approvals. (#13621)

  - [x] Switch to use MCP style elicitation payload for mcp tool
  approvals.
  - [ ] TODO: Update the UI to support the full spec.

  Matthew Zeng · 2026-03-06 01:50:26 -08:00
  98dca99db7
• Enabling CWD Saving for Image-Gen (#13607)

  Codex now saves the generated image on to your current working
  directory.

  Won Park · 2026-03-06 00:47:21 -08:00
  ee1a20258a
• change sound (#13697)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-03-05 22:48:49 -08:00
  6638558b88
• check app auth in plugin/install (#13685)

  #### What
  on `plugin/install`, check if installed apps are already authed on
  chatgpt, and return list of all apps that are not. clients can use this
  list to trigger auth workflows as needed.
  
  checks are best effort based on `codex_apps` loading, much like
  `app/list`.
  
  #### Tests
  Added integration tests, tested locally.

  sayan-oai · 2026-03-06 06:45:00 +00:00
  014a59fb0b
• fix(tui) remove config check for trusted setting (#11874)

  ## Summary
  Simplify the trusted directory flow. This logic was originally designed
  several months ago, to determine if codex should start in read-only or
  workspace-write mode. However, that's no longer the purpose of directory
  trust - and therefore we should get rid of this logic.
  
  ## Testing
  - [x] Unit tests pass

  Dylan Hurd · 2026-03-05 22:29:34 -08:00
  4c9b1c38f6
• copy current exe to CODEX_HOME/.sandbox-bin for apply_patch (#13669)

  We do this for codex-command-runner.exe as well for the same reason.
  Windows sandbox users cannot execute binaries in the WindowsApp/
  installed directory for the Codex App. This causes apply-patch to fail
  because it tries to execute codex.exe as the sandbox user.

  iceweasel-oai · 2026-03-05 22:15:10 -08:00
  14de492985
• refactor: remove proxy admin endpoint (#13687)

  ## Summary
  - delete the network proxy admin server and its runtime listener/task
  plumbing
  - remove the admin endpoint config, runtime, requirement, protocol,
  schema, and debug-surface fields
  - update proxy docs to reflect the remaining HTTP and SOCKS listeners
  only

  viyatb-oai · 2026-03-05 22:03:16 -08:00
  6a79ed5920
• fix: accept two macOS automation input shapes for approval payload compatibility (#13683)

  ## Summary
  This PR:
  1. fixes a deserialization mismatch for macOS automation permissions in
  approval payloads by making core parsing accept both supported wire
  shapes for bundle IDs.
  2. added `#[serde(default)]` to `MacOsSeatbeltProfileExtensions` so
  omitted fields deserialize to secure defaults.
  
  
  ## Why this change is needed
  `MacOsAutomationPermission` uses `#[serde(try_from =
  "MacOsAutomationPermissionDe")]`, so deserialization is controlled by
  `MacOsAutomationPermissionDe`. After we aligned v2
  `additionalPermissions.macos.automations` to the core shape, approval
  payloads started including `{ "bundle_ids": [...] }` in some paths.
  `MacOsAutomationPermissionDe` previously accepted only `"none" | "all"`
  or a plain array, so object-shaped bundle IDs failed with `data did not
  match any variant of untagged enum MacOsAutomationPermissionDe`. This
  change restores compatibility by accepting both forms while preserving
  existing normalization behavior (trim values and map empty bundle lists
  to `None`).
  
  ## Validation
  
  saw this error went away when running
  ```
  cargo run -p codex-app-server-test-client -- \
      --codex-bin ./target/debug/codex \
      -c 'approval_policy="on-request"' \
      -c 'features.shell_zsh_fork=true' \
      -c 'zsh_path="/tmp/codex-zsh-fork/package/vendor/aarch64-apple-darwin/zsh/macos-15/zsh"' \
      send-message-v2 --experimental-api \
      'Use $apple-notes and run scripts/notes_info now.'
  ```
  :
  ```
  Error: failed to deserialize ServerRequest from JSONRPCRequest
  
  Caused by:
      data did not match any variant of untagged enum MacOsAutomationPermissionDe
  ```

  Celia Chen · 2026-03-06 06:02:33 +00:00
  f9ce403b5a
• chore: remove unused legacy macOS permission types (#13677)

  ## Summary
  
  This PR removes legacy macOS permission model types from
  `codex-rs/protocol/src/models.rs`:
  
  - `MacOsPermissions`
  - `MacOsPreferencesValue`
  - `MacOsAutomationValue`
  
  The protocol now relies on the current `MacOsSeatbeltProfileExtensions`
  model for macOS permission data.

  Celia Chen · 2026-03-06 05:32:40 +00:00
  fb9fcf060f
• support plugin/list. (#13540)

  Introduce a plugin/list which reads from local marketplace.json.
  Also update the signature for plugin/install.

  xl-openai · 2026-03-05 21:58:50 -05:00
  520ed724d2
• tui: sort resume picker by last updated time (#13654)

  ## Summary
  - default the resume picker sort key to UpdatedAt instead of CreatedAt
  - keep Tab sort toggling behavior and update the test expectation for
  the new default
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-05 18:23:44 -08:00
  56420da857
• Add timestamped SQLite /feedback logs without schema changes (#13645)

  ## Summary
  - keep the SQLite schema unchanged (no migrations)
  - add timestamps to SQLite-backed `/feedback` log exports
  - keep the existing SQL-side byte cap behavior and newline handling
  - document the remaining fidelity gap (span prefixes + structured
  fields) with TODOs
  
  ## Details
  - update `query_feedback_logs` to format each exported line as:
    - `YYYY-MM-DDTHH:MM:SS.ffffffZ {level} {message}`
  - continue scoping rows to requested-thread + same-process threadless
  logs
  - continue capping in SQL before returning rows
  - keep the existing fallback behavior unchanged when SQLite returns no
  rows
  - update parity tests to normalize away the new timestamp prefix while
  we still only store `message`
  
  ## Follow-up
  - TODO already in code: persist enough span/event metadata in SQLite to
  reproduce span prefixes and structured fields in `/feedback` exports
  
  ## Testing
  - `cargo test -p codex-state`
  - `just fmt`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-05 16:53:37 -08:00
  9f91c7f90f
• fix(tui): clean up pending steer preview wrapping (#13642)

  ## Summary
  - render pending steer previews with a single `pending steer:` prefix
  instead of repeating it for each source line
  - reuse the same truncation path for pending steers and queued drafts so
  multiline previews behave consistently
  - add snapshot coverage for the multiline pending steer case
  
  Before
  <img width="969" height="219" alt="Screenshot 2026-03-05 at 3 55 11 PM"
  src="https://github.com/user-attachments/assets/b062c9c8-43d3-4a52-98e0-3c7643d1697b"
  />
  
  After
  <img width="965" height="203" alt="Screenshot 2026-03-05 at 3 56 08 PM"
  src="https://github.com/user-attachments/assets/40935863-55b3-444f-9e14-1ac63126b2e1"
  />
  
  ## Codex author
  `codex resume 019cc054-385e-79a3-bb85-ec9499623bd8`
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-05 16:51:40 -08:00
  e15e191ff7
• Replay thread rollback from rollout history (#13615)

  - Replay thread rollback from the persisted rollout history instead of
  truncating in-memory state.\n- Add rollback coverage, including
  rollback-behind-compaction snapshot coverage.

  Ahmed Ibrahim · 2026-03-05 16:40:09 -08:00
  629cb15bc6