39 Commits

• feat(app-server, core): add more spans (#14479)

  ## Description
  
  This PR expands tracing coverage across app-server thread startup, core
  session initialization, and the Responses transport layer. It also gives
  core dispatch spans stable operation-specific names so traces are easier
  to follow than the old generic `submission_dispatch` spans.
  
  Also use `fmt::Display` for types that we serialize in traces so we send
  strings instead of rust types

  Owen Lin · 2026-03-13 13:16:33 -07:00
  014e19510d
• fix: move inline codex-rs/core unit tests into sibling files (#14444)

  ## Why
  PR #13783 moved the `codex.rs` unit tests into `codex_tests.rs`. This
  applies the same extraction pattern across the rest of `codex-rs/core`
  so the production modules stay focused on runtime code instead of large
  inline test blocks.
  
  Keeping the tests in sibling files also makes follow-up edits easier to
  review because product changes no longer have to share a file with
  hundreds or thousands of lines of test scaffolding.
  
  ## What changed
  - replaced each inline `mod tests { ... }` in `codex-rs/core/src/**`
  with a path-based module declaration
  - moved each extracted unit test module into a sibling `*_tests.rs`
  file, using `mod_tests.rs` for `mod.rs` modules
  - preserved the existing `cfg(...)` guards and module-local structure so
  the refactor remains structural rather than behavioral
  
  ## Testing
  - `cargo test -p codex-core --lib` (`1653 passed; 0 failed; 5 ignored`)
  - `just fix -p codex-core`
  - `cargo fmt --check`
  - `cargo shear`

  Michael Bolin · 2026-03-12 08:16:36 -07:00
  0c8a36676a
• Add under-development original-resolution view_image support (#13050)

  ## Summary
  
  Add original-resolution support for `view_image` behind the
  under-development `view_image_original_resolution` feature flag.
  
  When the flag is enabled and the target model is `gpt-5.3-codex` or
  newer, `view_image` now preserves original PNG/JPEG/WebP bytes and sends
  `detail: "original"` to the Responses API instead of using the legacy
  resize/compress path.
  
  ## What changed
  
  - Added `view_image_original_resolution` as an under-development feature
  flag.
  - Added `ImageDetail` to the protocol models and support for serializing
  `detail: "original"` on tool-returned images.
  - Added `PromptImageMode::Original` to `codex-utils-image`.
    - Preserves original PNG/JPEG/WebP bytes.
    - Keeps legacy behavior for the resize path.
  - Updated `view_image` to:
  - use the shared `local_image_content_items_with_label_number(...)`
  helper in both code paths
    - select original-resolution mode only when:
      - the feature flag is enabled, and
      - the model slug parses as `gpt-5.3-codex` or newer
  - Kept local user image attachments on the existing resize path; this
  change is specific to `view_image`.
  - Updated history/image accounting so only `detail: "original"` images
  use the docs-based GPT-5 image cost calculation; legacy images still use
  the old fixed estimate.
  - Added JS REPL guidance, gated on the same feature flag, to prefer JPEG
  at 85% quality unless lossless is required, while still allowing other
  formats when explicitly requested.
  - Updated tests and helper code that construct
  `FunctionCallOutputContentItem::InputImage` to carry the new `detail`
  field.
  
  ## Behavior
  
  ### Feature off
  - `view_image` keeps the existing resize/re-encode behavior.
  - History estimation keeps the existing fixed-cost heuristic.
  
  ### Feature on + `gpt-5.3-codex+`
  - `view_image` sends original-resolution images with `detail:
  "original"`.
  - PNG/JPEG/WebP source bytes are preserved when possible.
  - History estimation uses the GPT-5 docs-based image-cost calculation
  for those `detail: "original"` images.
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/13050
  - ⏳ `2` https://github.com/openai/codex/pull/13331
  - ⏳ `3` https://github.com/openai/codex/pull/13049

  Curtis 'Fjord' Hawthorne · 2026-03-03 15:56:54 -08:00
  b92146d48b
• Enable request_user_input in Default mode (#12735)

  ## Summary
  - allow `request_user_input` in Default collaboration mode as well as
  Plan
  - update the Default-mode instructions to prefer assumptions first and
  use `request_user_input` only when a question is unavoidable
  - update request_user_input and app-server tests to match the new
  Default-mode behavior
  - refactor collaboration-mode availability plumbing into
  `CollaborationModesConfig` for future mode-related flags
  
  ## Codex author
  `codex resume 019c9124-ed28-7c13-96c6-b916b1c97d49`

  Charley Cunningham · 2026-02-25 15:20:46 -08:00
  2f4d6ded1d
• chore: change catalog mode to enum (#12656)

  make presence of custom catalog more clear by changing to enum instead
  of bool.

  sayan-oai · 2026-02-24 19:33:32 -08:00
  e6bb5d8553
• fix: also try matching namespaced prefix for modelinfo candidate (#12658)

  #### What
  Try matching `\w+`-namespaced model after `longest prefix` as heuristic
  to match `ModelInfo` from list of candidates.
  
  This shouldn't regress existing behavior:
  - `gpt-5.2-codex` -> `gpt-5.2` if `gpt-5.2-codex` not present
  - `gpt-5.3` -> `gpt-5` if `gpt-5.3` not present
  - `gpt-9` still doesn't match anything
  
  while being more forgiving for custom prefixes:
  - `oai/gpt-5.3-codex` -> `gpt-5.3-codex`
  
  #### Tests
  Added unit test.

  sayan-oai · 2026-02-24 10:57:26 -08:00
  0b6c2e5652
• chore: rm hardcoded PRESETS list (#12650)

  rm `PRESETS` list harcoded in `model_presets` as we now have bundled
  `models.json` with equivalent info.
  
  update logic to rely on bundled models instead, update tests.

  sayan-oai · 2026-02-23 22:35:51 -08:00
  7e46e5b9c2
• client side modelinfo overrides (#12101)

  TL;DR
  Add top-level `model_catalog_json` config support so users can supply a
  local model catalog override from a JSON file path (including adding new
  models) without backend changes.
  
  ### Problem
  Codex previously had no clean client-side way to replace/overlay model
  catalog data for local testing of model metadata and new model entries.
  
  ### Fix
  - Add top-level `model_catalog_json` config field (JSON file path).
  - Apply catalog entries when resolving `ModelInfo`:
    1. Base resolved model metadata (remote/fallback)
    2. Catalog overlay from `model_catalog_json`
  3. Existing global top-level overrides (`model_context_window`,
  `model_supports_reasoning_summaries`, etc.)
  
  ### Note
  Will revisit per-field overrides in a follow-up
  
  ### Tests
  Added tests

  sayan-oai · 2026-02-19 10:38:57 -08:00
  d54999d006
• chore: rm remote models fflag (#11699)

  rm `remote_models` feature flag.
  
  We see issues like #11527 when a user has `remote_models` disabled, as
  we always use the default fallback `ModelInfo`. This causes issues with
  model performance.
  
  Builds on #11690, which helps by warning the user when they are using
  the default fallback. This PR will make that happen much less frequently
  as an accidental consequence of disabling `remote_models`.

  sayan-oai · 2026-02-17 11:43:16 -08:00
  41800fc876
• fix: show user warning when using default fallback metadata (#11690)

  ### What
  It's currently unclear when the harness falls back to the default,
  generic `ModelInfo`. This happens when the `remote_models` feature is
  disabled or the model is truly unknown, and can lead to bad performance
  and issues in the harness.
  
  Add a user-facing warning when this happens so they are aware when their
  setup is broken.
  
  ### Tests
  Added tests, tested locally.

  sayan-oai · 2026-02-15 18:46:05 -08:00
  060a320e7d
• fix(core) model_info preserves slug (#11602)

  ## Summary
  Preserve the specified model slug when we get a prefix-based match
  
  ## Testing
  - [x] added unit test
  
  ---------
  
  Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>

  Dylan Hurd · 2026-02-12 09:43:32 -08:00
  f39f506700
• Add logs to model cache (#11551)
  Ahmed Ibrahim · 2026-02-11 23:25:31 -08:00
  21ceefc0d1
• Remove test-support feature from codex-core and replace it with explicit test toggles (#11405)

  ## Why
  
  `codex-core` was being built in multiple feature-resolved permutations
  because test-only behavior was modeled as crate features. For a large
  crate, those permutations increase compile cost and reduce cache reuse.
  
  ## Net Change
  
  - Removed the `test-support` crate feature and related feature wiring so
  `codex-core` no longer needs separate feature shapes for test consumers.
  - Standardized cross-crate test-only access behind
  `codex_core::test_support`.
  - External test code now imports helpers from
  `codex_core::test_support`.
  - Underlying implementation hooks are kept internal (`pub(crate)`)
  instead of broadly public.
  
  ## Outcome
  
  - Fewer `codex-core` build permutations.
  - Better incremental cache reuse across test targets.
  - No intended production behavior change.

  Michael Bolin · 2026-02-10 22:44:02 -08:00
  476c1a7160
• Disable dynamic model refresh for custom model providers (#11239)

  The dynamic model refresh feature (`https://api.openai.com/v1/models`
  endpoint) is currently gated on a runtime check for an auth method other
  than API Key. It should be gated on a check specifically for ChatGPT
  Auth because some custom model providers (e.g. for local models) use no
  auth mechanism. A call to `self.auth_manager.auth_mode()` will return
  `None` in this case.
  
  Addresses #11213

  Eric Traut · 2026-02-09 21:36:09 -08:00
  bb974c78de
• Remove offline fallback for models (#11238)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-02-09 16:58:54 -08:00
  a1abd53b6a
• Use longest remote model prefix matching (#11228)

  Match model metadata by longest matching remote slug prefix before local
  fallback.
  
  - Update `get_model_info` to prefer the most specific remote slug prefix
  for the requested model.
  - Add an integration test to assert `gpt-5.3-codex-test` resolves to
  `gpt-5.3-codex` over `gpt-5.3`.

  Ahmed Ibrahim · 2026-02-09 15:05:56 -08:00
  481145e959
• fix(auth): isolate chatgptAuthTokens concept to auth manager and app-server (#10423)

  So that the rest of the codebase (like TUI) don't need to be concerned
  whether ChatGPT auth was handled by Codex itself or passed in via
  app-server's external auth mode.

  Owen Lin · 2026-02-05 10:46:06 -08:00
  3582b74d01
• Require models refresh on cli version mismatch (#10414)
  Ahmed Ibrahim · 2026-02-02 18:55:25 -08:00
  b8addcddb9
• chore: rename ChatGpt -> Chatgpt in type names (#10244)

  When using ChatGPT in names of types, we should be consistent, so this
  renames some types with `ChatGpt` in the name to `Chatgpt`. From
  https://rust-lang.github.io/api-guidelines/naming.html:
  
  > In `UpperCamelCase`, acronyms and contractions of compound words count
  as one word: use `Uuid` rather than `UUID`, `Usize` rather than `USize`
  or `Stdin` rather than `StdIn`. In `snake_case`, acronyms and
  contractions are lower-cased: `is_xid_start`.
  
  This PR updates existing uses of `ChatGpt` and changes them to
  `Chatgpt`. Though in all cases where it could affect the wire format, I
  visually inspected that we don't change anything there. That said, this
  _will_ change the codegen because it will affect the spelling of type
  names.
  
  For example, this renames `AuthMode::ChatGPT` to `AuthMode::Chatgpt` in
  `app-server-protocol`, but the wire format is still `"chatgpt"`.
  
  This PR also updates a number of types in `codex-rs/core/src/auth.rs`.

  Michael Bolin · 2026-01-30 11:18:39 -08:00
  e6d913af2d
• feat: refactor CodexAuth so invalid state cannot be represented (#10208)

  Previously, `CodexAuth` was defined as follows:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L39-L46
  
  But if you looked at its constructors, we had creation for
  `AuthMode::ApiKey` where `storage` was built using a nonsensical path
  (`PathBuf::new()`) and `auth_dot_json` was `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L212-L220
  
  By comparison, when `AuthMode::ChatGPT` was used, `api_key` was always
  `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L665-L671
  
  https://github.com/openai/codex/pull/10012 took things further because
  it introduced a new `ChatgptAuthTokens` variant to `AuthMode`, which is
  important in when invoking `account/login/start` via the app server, but
  most logic _internal_ to the app server should just reason about two
  `AuthMode` variants: `ApiKey` and `ChatGPT`.
  
  This PR tries to clean things up as follows:
  
  - `LoginAccountParams` and `AuthMode` in `codex-rs/app-server-protocol/`
  both continue to have the `ChatgptAuthTokens` variant, though it is used
  exclusively for the on-the-wire messaging.
  - `codex-rs/core/src/auth.rs` now has its own `AuthMode` enum, which
  only has two variants: `ApiKey` and `ChatGPT`.
  - `CodexAuth` has been changed from a struct to an enum. It is a
  disjoint union where each variant (`ApiKey`, `ChatGpt`, and
  `ChatGptAuthTokens`) have only the associated fields that make sense for
  that variant.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10208).
  * #10224
  * __->__ #10208

  Michael Bolin · 2026-01-30 09:33:23 -08:00
  377ab0c77c
• feat(app-server): support external auth mode (#10012)

  This enables a new use case where `codex app-server` is embedded into a
  parent application that will directly own the user's ChatGPT auth
  lifecycle, which means it owns the user’s auth tokens and refreshes it
  when necessary. The parent application would just want a way to pass in
  the auth tokens for codex to use directly.
  
  The idea is that we are introducing a new "auth mode" currently only
  exposed via app server: **`chatgptAuthTokens`** which consist of the
  `id_token` (stores account metadata) and `access_token` (the bearer
  token used directly for backend API calls). These auth tokens are only
  stored in-memory. This new mode is in addition to the existing `apiKey`
  and `chatgpt` auth modes.
  
  This PR reuses the shape of our existing app-server account APIs as much
  as possible:
  - Update `account/login/start` with a new `chatgptAuthTokens` variant,
  which will allow the client to pass in the tokens and have codex
  app-server use them directly. Upon success, the server emits
  `account/login/completed` and `account/updated` notifications.
  - A new server->client request called
  `account/chatgptAuthTokens/refresh` which the server can use whenever
  the access token previously passed in has expired and it needs a new one
  from the parent application.
  
  I leveraged the core 401 retry loop which typically triggers auth token
  refreshes automatically, but made it pluggable:
  - **chatgpt** mode refreshes internally, as usual.
  - **chatgptAuthTokens** mode calls the client via
  `account/chatgptAuthTokens/refresh`, the client responds with updated
  tokens, codex updates its in-memory auth, then retries. This RPC has a
  10s timeout and handles JSON-RPC errors from the client.
  
  Also some additional things:
  - chatgpt logins are blocked while external auth is active (have to log
  out first. typically clients will pick one OR the other, not support
  both)
  - `account/logout` clears external auth in memory
  - Ensures that if `forced_chatgpt_workspace_id` is set via the user's
  config, we respect it in both:
  - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC
  error back to the client)
  - `account/chatgptAuthTokens/refresh` (fails the turn, and on next
  request app-server will send another `account/chatgptAuthTokens/refresh`
  request to the client).

  Owen Lin · 2026-01-29 23:46:04 +00:00
  81a17bb2c1
• Remove WebSocket wire format (#10179)

  I'd like WireApi to go away (when chat is removed) and WebSockets is
  still responses API just over a different transport.

  pakrym-oai · 2026-01-29 13:50:53 -08:00
  fbb3a30953
• Use collaboration mode masks without mutating base settings (#9806)

  Keep an unmasked base collaboration mode and apply the active mask on
  demand. Simplify the TUI mask helpers and update tests/docs to match the
  mask contract.

  Ahmed Ibrahim · 2026-01-25 07:35:31 +00:00
  58450ba2a1
• Select default model from filtered presets (#9782)

  Pick the first available preset after auth filtering for default
  selection.

  Ahmed Ibrahim · 2026-01-23 12:18:36 -08:00
  45fe58159e
• merge remote models (#9547)

  We have `models.json` and `/models` response
  Behavior:
  1. New models from models endpoint gets added
  2. Shared models get replaced by remote ones
  3. Existing models in `models.json` but not `/models` are kept
  4. Mark highest priority as default

  Ahmed Ibrahim · 2026-01-20 14:02:07 -08:00
  56fe5e7bea
• feat: metrics on remote models (#9528)
  jif-oai · 2026-01-20 13:02:55 +00:00
  6bbf506120
• Expose collaboration presets (#9421)

  Expose collaboration presets for clients
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Ahmed Ibrahim · 2026-01-17 12:32:50 -08:00
  8f0e0300d2
• change api default model (#9188)
  Ahmed Ibrahim · 2026-01-13 22:33:34 -08:00
  b9ff4ec830
• Renew cache ttl on etag match (#9174)

  so we don't do unnecessary fetches

  Ahmed Ibrahim · 2026-01-14 01:21:41 +00:00
  4d787a2cc2
• clean models manager (#9168)

  Have only the following Methods:
  - `list_models`: getting current available models
  - `try_list_models`: sync version no refresh for tui use
  - `get_default_model`: get the default model (should be tightened to
  core and received on session configuration)
  - `get_model_info`: get `ModelInfo` for a specific model (should be
  tightened to core but used in tests)
  - `refresh_if_new_etag`: trigger refresh on different etags
  
  Also move the cache to its own struct

  Ahmed Ibrahim · 2026-01-13 16:55:33 -08:00
  7e33ac7eb6
• Add 5s timeout to models list call + integration test (#8942)

  - Enforce a 5s timeout around the remote models refresh to avoid hanging
  /models calls.

  Ahmed Ibrahim · 2026-01-08 18:06:10 -08:00
  81caee3400
• Immutable CodexAuth (#8857)

  Historically we started with a CodexAuth that knew how to refresh it's
  own tokens and then added AuthManager that did a different kind of
  refresh (re-reading from disk).
  
  I don't think it makes sense for both `CodexAuth` and `AuthManager` to
  be mutable and contain behaviors.
  
  Move all refresh logic into `AuthManager` and keep `CodexAuth` as a data
  object.

  pakrym-oai · 2026-01-08 11:43:56 -08:00
  634764ece9
• Stop using AuthManager as the source of codex_home (#8846)
  pakrym-oai · 2026-01-07 18:56:20 +00:00
  018de994b0
• Merge Modelfamily into modelinfo (#8763)

  - Merge ModelFamily into ModelInfo
  - Remove logic for adding instructions to apply patch
  - Add compaction limit and visible context window to `ModelInfo`

  Ahmed Ibrahim · 2026-01-07 10:35:09 -08:00
  9179c9deac
• Enable model upgrade popup even when selected model is no longer in picker (#8802)

  With `config.toml`:
  ```
  model = "gpt-5.1-codex"
  ```
  (where `gpt-5.1-codex` has `show_in_picker: false` in
  [`model_presets.rs`](https://github.com/openai/codex/blob/main/codex-rs/core/src/models_manager/model_presets.rs);
  this happens if the user hasn't used codex in a while so they didn't see
  the popup before their model was changed to `show_in_picker: false`)
  
  The upgrade picker used to not show (because `gpt-5.1-codex` was
  filtered out of the model list in code). Now, the filtering is done
  downstream in tui and app-server, so the model upgrade popup shows:
  
  <img width="1503" height="227" alt="Screenshot 2026-01-06 at 5 04 37 PM"
  src="https://github.com/user-attachments/assets/26144cc2-0b3f-4674-ac17-e476781ec548"
  />

  charley-oai · 2026-01-06 19:32:27 -08:00
  3389465c8d
• hard disable remote models refresh when feature is disabled (#8687)

  We were refreshing on tag mismatch even with feature is disabled

  Ahmed Ibrahim · 2026-01-02 15:22:51 -08:00
  6846bc1115
• Refresh on models etag mismatch (#8491)

  - Send models etag
  - Refresh models on 412
  - This wires `ModelsManager` to `ModelFamily` so we don't mutate it
  mid-turn

  Ahmed Ibrahim · 2026-01-01 11:41:16 -08:00
  66b7c673e9
• Remove reasoning format (#8484)

  This isn't very useful parameter. 
  
  logic:
  ```
  if model puts `**` in their reasoning, trim it and visualize the header.
  if couldn't trim: don't render
  if model doesn't support: don't render
  ```
  
  We can simplify to:
  ```
  if could trim, visualize header.
  if not, don't render
  ```

  Ahmed Ibrahim · 2025-12-23 16:01:46 -08:00
  40de81e7af
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7