1074 Commits

• Add text element metadata to protocol, app server, and core (#9331)

  The second part of breaking up PR
  https://github.com/openai/codex/pull/9116
  
  Summary:
  
  - Add `TextElement` / `ByteRange` to protocol user inputs and user
  message events with defaults.
  - Thread `text_elements` through app-server v1/v2 request handling and
  history rebuild.
  - Preserve UI metadata only in user input/events (not `ContentItem`)
  while keeping local image attachments in user events for rehydration.
  
  Details:
  
  - Protocol: `UserInput::Text` carries `text_elements`;
  `UserMessageEvent` carries `text_elements` + `local_images`.
  Serialization includes empty vectors for backward compatibility.
  - app-server-protocol: v1 defines `V1TextElement` / `V1ByteRange` in
  camelCase with conversions; v2 uses its own camelCase wrapper.
  - app-server: v1/v2 input mapping includes `text_elements`; thread
  history rebuilds include them.
  - Core: user event emission preserves UI metadata while model history
  stays clean; history replay round-trips the metadata.

  charley-oai · 2026-01-15 17:26:41 -08:00
  1fa8350ae7
• fix: send non-null content on elicitation Accept (#9196)

  ## Summary
  
  - When a user accepts an MCP elicitation request, send `content:
  Some(json!({}))` instead of `None`
  - MCP servers that use elicitation expect content to be present when
  action is Accept
  - This matches the expected behavior shown in tests at
  `exec-server/tests/common/lib.rs:171`
  
  ## Root Cause
  
  In `codex-rs/core/src/codex.rs`, the `resolve_elicitation` function
  always sent `content: None`:
  
  ```rust
  let response = ElicitationResponse {
      action,
      content: None,  // Always None, even for Accept
  };
  ```
  
  ## Fix
  
  Send an empty object when accepting:
  
  ```rust
  let content = match action {
      ElicitationAction::Accept => Some(serde_json::json!({})),
      ElicitationAction::Decline | ElicitationAction::Cancel => None,
  };
  ```
  
  ## Test plan
  
  - [x] Code compiles with `cargo check -p codex-core`
  - [x] Formatted with `just fmt`
  - [ ] Integration test `accept_elicitation_for_prompt_rule` (requires
  MCP server binary)
  
  Fixes #9053

  Yuvraj Angad Singh · 2026-01-15 14:20:57 -08:00
  004a74940a
• remove needs_follow_up error log (#9272)
  pap-openai · 2026-01-15 21:20:54 +00:00
  d886a8646c
• [search] allow explicitly disabling web search (#9249)

  moving `web_search` rollout serverside, so need a way to explicitly
  disable search + signal eligibility from the client.
  
  - Add `x‑oai‑web‑search‑eligible` header that signifies whether the
  request can have web search.
  - Only attach the `web_search` tool when the resolved `WebSearchMode` is
  `Live` or `Cached`.

  sayan-oai · 2026-01-15 11:28:57 -08:00
  169201b1b5
• Support SKILL.toml file. (#9125)

  We’re introducing a new SKILL.toml to hold skill metadata so Codex can
  deliver a richer Skills experience.
  
  Initial focus is the interface block:
  ```
  [interface]
  display_name = "Optional user-facing name"
  short_description = "Optional user-facing description"
  icon_small = "./assets/small-400px.png"
  icon_large = "./assets/large-logo.svg"
  brand_color = "#3B82F6"
  default_prompt = "Optional surrounding prompt to use the skill with"
  ```
  
  All fields are exposed via the app server API.
  display_name and short_description are consumed by the TUI.

  xl-openai · 2026-01-15 11:20:04 -08:00
  42fa4c237f
• Propagate MCP disabled reason (#9207)

  Indicate why MCP servers are disabled when they are disabled by
  requirements:
  
  ```
  ➜  codex git:(main) ✗ just codex mcp list
  cargo run --bin codex -- "$@"
      Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.27s
       Running `target/debug/codex mcp list`
  Name         Command          Args  Env  Cwd  Status                                                                  Auth
  docs         docs-mcp         -     -    -    disabled: requirements (MDM com.openai.codex:requirements_toml_base64)  Unsupported
  hello_world  hello-world-mcp  -     -    -    disabled: requirements (MDM com.openai.codex:requirements_toml_base64)  Unsupported
  
  ➜  codex git:(main) ✗ just c
  cargo run --bin codex -- "$@"
      Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.90s
       Running `target/debug/codex`
  ╭─────────────────────────────────────────────╮
  │ >_ OpenAI Codex (v0.0.0)                    │
  │                                             │
  │ model:     gpt-5.2 xhigh   /model to change │
  │ directory: ~/code/codex/codex-rs            │
  ╰─────────────────────────────────────────────╯
  
  /mcp
  
  🔌  MCP Tools
  
    • No MCP tools available.
  
    • docs (disabled)
      • Reason: requirements (MDM com.openai.codex:requirements_toml_base64)
  
    • hello_world (disabled)
      • Reason: requirements (MDM com.openai.codex:requirements_toml_base64)
  ```

  gt-oai · 2026-01-15 17:24:00 +00:00
  f6df1596eb
• Changed codex resume --last to honor the current cwd (#9245)

  This PR changes `codex resume --last` to work consistently with `codex
  resume`. Namely, it filters based on the cwd when selecting the last
  session. It also supports the `--all` modifier as an override.
  
  This addresses #8700

  Eric Traut · 2026-01-15 17:05:08 +00:00
  ae96a15312
• feat: add interrupt capabilities to send_input (#9276)
  jif-oai · 2026-01-15 14:59:07 +00:00
  faeb08c1e1
• feat: add agent roles to collab tools (#9275)

  Add `agent_type` parameter to the collab tool `spawn_agent` that
  contains a preset to apply on the config when spawning this agent

  jif-oai · 2026-01-15 13:33:52 +00:00
  05b960671d
• Add text element metadata to types (#9235)

  Initial type tweaking PR to make the diff of
  https://github.com/openai/codex/pull/9116 smaller
  
  This should not change any behavior, just adds some fields to types

  charley-oai · 2026-01-14 16:41:50 -08:00
  4a9c2bcc5a
• add WebSearchMode enum (#9216)

  ### What
  Add `WebSearchMode` enum (disabled, cached live, defaults to cached) to
  config + V2 protocol. This enum takes precedence over legacy flags:
  `web_search_cached`, `web_search_request`, and `tools.web_search`.
  
  Keep `--search` as live.
  
  ### Tests
  Added tests

  sayan-oai · 2026-01-14 12:51:42 -08:00
  5e426ac270
• Rename hierarchical_agents to child_agents_md (#9215)

  Clearer name

  pakrym-oai · 2026-01-14 19:14:24 +00:00
  e6d2ef432d
• feat: adding piped process to replace PTY when needed (#8797)
  jif-oai · 2026-01-14 18:44:04 +00:00
  577e1fd1b2
• s/mcp_server_requirements/mcp_servers (#9212)

  A simple `s/mcp_server_requirements/mcp_servers/g` for an unreleased
  feature. @bolinfest correctly pointed out, it's already in
  `requirements.toml` so the `_requirements` is redundant.

  gt-oai · 2026-01-14 18:41:52 +00:00
  fe1e0da102
• feat: add collab prompt (#9208)

  Adding a prompt for collab tools. This is only for internal use and the
  prompt won't be gated for now as it is not stable yet.
  
  The goal of this PR is to provide the tool required to iterate on the
  prompt

  jif-oai · 2026-01-14 09:58:15 -08:00
  3d322fa9d8
• feat: emit events around collab tools (#9095)

  Emit the following events around the collab tools. On the `app-server`
  this will be under `item/started` and `item/completed`
  ```
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabAgentSpawnBeginEvent {
      /// Identifier for the collab tool call.
      pub call_id: String,
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Initial prompt sent to the agent. Can be empty to prevent CoT leaking at the
      /// beginning.
      pub prompt: String,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabAgentSpawnEndEvent {
      /// Identifier for the collab tool call.
      pub call_id: String,
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the newly spawned agent, if it was created.
      pub new_thread_id: Option<ThreadId>,
      /// Initial prompt sent to the agent. Can be empty to prevent CoT leaking at the
      /// beginning.
      pub prompt: String,
      /// Last known status of the new agent reported to the sender agent.
      pub status: AgentStatus,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabAgentInteractionBeginEvent {
      /// Identifier for the collab tool call.
      pub call_id: String,
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the receiver.
      pub receiver_thread_id: ThreadId,
      /// Prompt sent from the sender to the receiver. Can be empty to prevent CoT
      /// leaking at the beginning.
      pub prompt: String,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabAgentInteractionEndEvent {
      /// Identifier for the collab tool call.
      pub call_id: String,
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the receiver.
      pub receiver_thread_id: ThreadId,
      /// Prompt sent from the sender to the receiver. Can be empty to prevent CoT
      /// leaking at the beginning.
      pub prompt: String,
      /// Last known status of the receiver agent reported to the sender agent.
      pub status: AgentStatus,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabWaitingBeginEvent {
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the receiver.
      pub receiver_thread_id: ThreadId,
      /// ID of the waiting call.
      pub call_id: String,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabWaitingEndEvent {
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the receiver.
      pub receiver_thread_id: ThreadId,
      /// ID of the waiting call.
      pub call_id: String,
      /// Last known status of the receiver agent reported to the sender agent.
      pub status: AgentStatus,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabCloseBeginEvent {
      /// Identifier for the collab tool call.
      pub call_id: String,
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the receiver.
      pub receiver_thread_id: ThreadId,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema, TS)]
  pub struct CollabCloseEndEvent {
      /// Identifier for the collab tool call.
      pub call_id: String,
      /// Thread ID of the sender.
      pub sender_thread_id: ThreadId,
      /// Thread ID of the receiver.
      pub receiver_thread_id: ThreadId,
      /// Last known status of the receiver agent reported to the sender agent before
      /// the close.
      pub status: AgentStatus,
  }
  ```

  jif-oai · 2026-01-14 17:55:57 +00:00
  6a939ed7a4
• tui: double-press Ctrl+C/Ctrl+D to quit (#8936)

  ## Problem
  
  Codex’s TUI quit behavior has historically been easy to trigger
  accidentally and hard to reason
  about.
  
  - `Ctrl+C`/`Ctrl+D` could terminate the UI immediately, which is a
  common key to press while trying
    to dismiss a modal, cancel a command, or recover from a stuck state.
  - “Quit” and “shutdown” were not consistently separated, so some exit
  paths could bypass the
    shutdown/cleanup work that should run before the process terminates.
  
  This PR makes quitting both safer (harder to do by accident) and more
  uniform across quit
  gestures, while keeping the shutdown-first semantics explicit.
  
  ## Mental model
  
  After this change, the system treats quitting as a UI request that is
  coordinated by the app
  layer.
  
  - The UI requests exit via `AppEvent::Exit(ExitMode)`.
  - `ExitMode::ShutdownFirst` is the normal user path: the app triggers
  `Op::Shutdown`, continues
  rendering while shutdown runs, and only ends the UI loop once shutdown
  has completed.
  - `ExitMode::Immediate` exists as an escape hatch (and as the
  post-shutdown “now actually exit”
  signal); it bypasses cleanup and should not be the default for
  user-triggered quits.
  
  User-facing quit gestures are intentionally “two-step” for safety:
  
  - `Ctrl+C` and `Ctrl+D` no longer exit immediately.
  - The first press arms a 1-second window and shows a footer hint (“ctrl
  + <key> again to quit”).
  - Pressing the same key again within the window requests a
  shutdown-first quit; otherwise the
    hint expires and the next press starts a fresh window.
  
  Key routing remains modal-first:
  
  - A modal/popup gets first chance to consume `Ctrl+C`.
  - If a modal handles `Ctrl+C`, any armed quit shortcut is cleared so
  dismissing a modal cannot
    prime a subsequent `Ctrl+C` to quit.
  - `Ctrl+D` only participates in quitting when the composer is empty and
  no modal/popup is active.
  
  The design doc `docs/exit-confirmation-prompt-design.md` captures the
  intended routing and the
  invariants the UI should maintain.
  
  ## Non-goals
  
  - This does not attempt to redesign modal UX or make modals uniformly
  dismissible via `Ctrl+C`.
  It only ensures modals get priority and that quit arming does not leak
  across modal handling.
  - This does not introduce a persistent confirmation prompt/menu for
  quitting; the goal is to keep
    the exit gesture lightweight and consistent.
  - This does not change the semantics of core shutdown itself; it changes
  how the UI requests and
    sequences it.
  
  ## Tradeoffs
  
  - Quitting via `Ctrl+C`/`Ctrl+D` now requires a deliberate second
  keypress, which adds friction for
    users who relied on the old “instant quit” behavior.
  - The UI now maintains a small time-bounded state machine for the armed
  shortcut, which increases
    complexity and introduces timing-dependent behavior.
  
  This design was chosen over alternatives (a modal confirmation prompt or
  a long-lived “are you
  sure” state) because it provides an explicit safety barrier while
  keeping the flow fast and
  keyboard-native.
  
  ## Architecture
  
  - `ChatWidget` owns the quit-shortcut state machine and decides when a
  quit gesture is allowed
    (idle vs cancellable work, composer state, etc.).
  - `BottomPane` owns rendering and local input routing for modals/popups.
  It is responsible for
  consuming cancellation keys when a view is active and for
  showing/expiring the footer hint.
  - `App` owns shutdown sequencing: translating
  `AppEvent::Exit(ShutdownFirst)` into `Op::Shutdown`
    and only terminating the UI loop when exit is safe.
  
  This keeps “what should happen” decisions (quit vs interrupt vs ignore)
  in the chat/widget layer,
  while keeping “how it looks and which view gets the key” in the
  bottom-pane layer.
  
  ## Observability
  
  You can tell this is working by running the TUIs and exercising the quit
  gestures:
  
  - While idle: pressing `Ctrl+C` (or `Ctrl+D` with an empty composer and
  no modal) shows a footer
  hint for ~1 second; pressing again within that window exits via
  shutdown-first.
  - While streaming/tools/review are active: `Ctrl+C` interrupts work
  rather than quitting.
  - With a modal/popup open: `Ctrl+C` dismisses/handles the modal (if it
  chooses to) and does not
  arm a quit shortcut; a subsequent quick `Ctrl+C` should not quit unless
  the user re-arms it.
  
  Failure modes are visible as:
  
  - Quits that happen immediately (no hint window) from `Ctrl+C`/`Ctrl+D`.
  - Quits that occur while a modal is open and consuming `Ctrl+C`.
  - UI termination before shutdown completes (cleanup skipped).
  
  ## Tests
  
  - Updated/added unit and snapshot coverage in `codex-tui` and
  `codex-tui2` to validate:
    - The quit hint appears and expires on the expected key.
  - Double-press within the window triggers a shutdown-first quit request.
  - Modal-first routing prevents quit bypass and clears any armed shortcut
  when a modal consumes
      `Ctrl+C`.
  
  These tests focus on the UI-level invariants and rendered output; they
  do not attempt to validate
  real terminal key-repeat timing or end-to-end process shutdown behavior.
  
  ---
  Screenshot:
  <img width="912" height="740" alt="Screenshot 2026-01-13 at 1 05 28 PM"
  src="https://github.com/user-attachments/assets/18f3d22e-2557-47f2-a369-ae7a9531f29f"
  />

  Josh McKinney · 2026-01-14 17:42:52 +00:00
  4283a7432b
• Use current model for review (#9179)

  Instead of having a hard-coded default review model, use the current
  model for running `/review` unless one is specified in the config.
  
  Also inherit current reasoning effort

  pakrym-oai · 2026-01-14 08:59:41 -08:00
  92472e7baa
• feat: add support for read-only bind mounts in the linux sandbox (#9112)

  ### Motivation
  
  - Landlock alone cannot prevent writes to sensitive in-repo files like
  `.git/` when the repo root is writable, so explicit mount restrictions
  are required for those paths.
  - The sandbox must set up any mounts before calling Landlock so Landlock
  can still be applied afterwards and the two mechanisms compose
  correctly.
  
  ### Description
  
  - Add a new `linux-sandbox` helper `apply_read_only_mounts` in
  `linux-sandbox/src/mounts.rs` that: unshares namespaces, maps uids/gids
  when required, makes mounts private, bind-mounts targets, and remounts
  them read-only.
  - Wire the mount step into the sandbox flow by calling
  `apply_read_only_mounts(...)` before network/seccomp and before applying
  Landlock rules in `linux-sandbox/src/landlock.rs`.

  viyatb-oai · 2026-01-14 08:30:46 -08:00
  e1447c3009
• feat: add auto refresh on thread listeners (#9105)

  This PR is in the scope of multi-agent work. 
  
  An agent (=thread) can now spawn other agents. Those other agents are
  not attached to any clients. We need a way to make sure that the clients
  are aware of the new threads to look at (for approval for example). This
  PR adds a channel to the `ThreadManager` that pushes the ID of those
  newly created agents such that the client (here the app-server) can also
  subscribe to those ones.

  jif-oai · 2026-01-14 16:26:01 +00:00
  bcd7858ced
• chore: clamp min yield time for empty write_stdin (#9156)

  After evals, 0 impact on performance

  jif-oai · 2026-01-14 16:25:40 +00:00
  32b1795ff4
• fix: drop double waiting header in TUI (#9145)
  jif-oai · 2026-01-14 09:52:34 +00:00
  7532f34699
• feat: only source shell snapshot if the file exists (#9197)
  jif-oai · 2026-01-14 01:28:25 -08:00
  bc6d9ef6fc
• feat: return an error if the image sent by the user is a bad image (#9146)

  ## Before
  When we detect an `InvalidImageRequest`, we replace the image by a
  placeholder and keep going
  
  ## Now
  In such `InvalidImageRequest`, we check if the image is due to a user
  message or a tool call output. For tool call output we still replace it
  with a placeholder to avoid breaking the agentic loop bu tif this is
  because of a user message, we send an error to the user

  jif-oai · 2026-01-14 09:07:45 +00:00
  dc3deaa3e7
• fix: shell snapshot clean-up (#9155)

  Clean all shell snapshot files corresponding to sessions that have not
  been updated in 7 days
  Those files should never leak. The only known cases were it can leak are
  during non graceful interrupt of the process (`kill -9, `panic`, OS
  crash, ...)

  jif-oai · 2026-01-14 09:05:46 +00:00
  6fbb89e858
• feat: add sourcing of rc files to shell snapshot (#9150)
  jif-oai · 2026-01-14 08:58:10 +00:00
  258fc4b401
• change api default model (#9188)
  Ahmed Ibrahim · 2026-01-13 22:33:34 -08:00
  b9ff4ec830
• chore: clarify default shell for unified_exec (#8997)

  The description of the `shell` arg for `exec_command` states the default
  is `/bin/bash`, but AFAICT it's the user's default shell.
  
  Default logic
  [here](https://github.com/openai/codex/blob/2a06d64bc996e4d848b95285700b195c2852a42f/codex-rs/core/src/tools/handlers/unified_exec.rs#L123).
  
  EDIT: #9004 has an alternative where we inform the model of the default
  shell itself.

  sayan-oai · 2026-01-13 21:37:41 -08:00
  5675af5190
• Improve handling of config and rules errors for app server clients (#9182)

  When an invalid config.toml key or value is detected, the CLI currently
  just quits. This leaves the VSCE in a dead state.
  
  This PR changes the behavior to not quit and bubble up the config error
  to users to make it actionable. It also surfaces errors related to
  "rules" parsing.
  
  This allows us to surface these errors to users in the VSCE, like this:
  
  <img width="342" height="129" alt="Screenshot 2026-01-13 at 4 29 22 PM"
  src="https://github.com/user-attachments/assets/a79ffbe7-7604-400c-a304-c5165b6eebc4"
  />
  
  <img width="346" height="244" alt="Screenshot 2026-01-13 at 4 45 06 PM"
  src="https://github.com/user-attachments/assets/de874f7c-16a2-4a95-8c6d-15f10482e67b"
  />

  Eric Traut · 2026-01-13 17:57:09 -08:00
  31d9b6f4d2
• Renew cache ttl on etag match (#9174)

  so we don't do unnecessary fetches

  Ahmed Ibrahim · 2026-01-14 01:21:41 +00:00
  4d787a2cc2
• [CODEX-4427] improve parsed commands (#8933)

  **make command summaries more accurate by distinguishing
  list/search/read operations across common CLI tools.**
  - Added parsing helpers to centralize operand/flag handling (cd_target,
  sed_read_path, first_non_flag_operand, single_non_flag_operand,
  parse_grep_like, awk_data_file_operand, python_walks_files,
  is_python_command) and reused them in summarize_main_tokens/shell
  parsing.
  - Newly parsed list-files commands: git ls-files, rg --files (incl.
  rga/ripgrep-all), eza/exa, tree, du, python -c file-walks, plus fd/find
  map to ListFiles when no query.
  - Newly parsed search commands: git grep, grep/egrep/fgrep, ag/ack/pt,
  rg/rga files-with-matches flags (-l/-L, --files-with-matches,
  --files-without-match), with improved flag skipping to avoid
  misclassifying args as paths.
  - Newly parsed read commands: bat/batcat, less, more, awk <file>, and
  more flexible sed -n range + file detection.
  - refine “small formatting command” detection for awk/sed, handle cd
  with -- or multiple operands, keep pipeline summaries focused on primary
  command.

  Ahmed Ibrahim · 2026-01-13 16:59:33 -08:00
  c96c26cf5b
• clean models manager (#9168)

  Have only the following Methods:
  - `list_models`: getting current available models
  - `try_list_models`: sync version no refresh for tui use
  - `get_default_model`: get the default model (should be tightened to
  core and received on session configuration)
  - `get_model_info`: get `ModelInfo` for a specific model (should be
  tightened to core but used in tests)
  - `refresh_if_new_etag`: trigger refresh on different etags
  
  Also move the cache to its own struct

  Ahmed Ibrahim · 2026-01-13 16:55:33 -08:00
  7e33ac7eb6
• Restrict MCP servers from requirements.toml (#9101)

  Enterprises want to restrict the MCP servers their users can use.
  
  Admins can now specify an allowlist of MCPs in `requirements.toml`. The
  MCP servers are matched on both Name and Transport (local path or HTTP
  URL) -- both must match to allow the MCP server. This prevents
  circumventing the allowlist by renaming MCP servers in user config. (It
  is still possible to replace the local path e.g. rewrite say
  `/usr/local/github-mcp` with a nefarious MCP. We could allow hash
  pinning in the future, but that would break updates. I also think this
  represents a broader, out-of-scope problem.)
  
  We introduce a new field to Constrained: "normalizer". In general, it is
  a fn(T) -> T and applies when `Constrained<T>.set()` is called. In this
  particular case, it disables MCP servers which do not match the
  allowlist. An alternative solution would remove this and instead throw a
  ConstraintError. That would stop Codex launching if any MCP server was
  configured which didn't match. I think this is bad.
  
  We currently reuse the enabled flag on MCP servers to disable them, but
  don't propagate any information about why they are disabled. I'd like to
  add that in a follow up PR, possibly by switching out enabled with an
  enum.
  
  In action:
  
  ```
  # MCP server config has two MCPs. We are going to allowlist one of them.
  ➜  codex git:(gt/restrict-mcps) ✗ cat ~/.codex/config.toml | grep mcp_servers -A1
  [mcp_servers.hello_world]
  command = "hello-world-mcp"
  --
  [mcp_servers.docs]
  command = "docs-mcp"
  
  # Restrict the MCPs to the hello_world MCP.
  ➜  codex git:(gt/restrict-mcps) ✗ defaults read com.openai.codex requirements_toml_base64 | base64 -d
  [mcp_server_allowlist.hello_world]
  command = "hello-world-mcp"
  
  # List the MCPs, observe hello_world is enabled and docs is disabled.
  ➜  codex git:(gt/restrict-mcps) ✗ just codex mcp list
  cargo run --bin codex -- "$@"
      Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.25s
       Running `target/debug/codex mcp list`
  Name         Command          Args  Env  Cwd  Status    Auth
  docs         docs-mcp         -     -    -    disabled  Unsupported
  hello_world  hello-world-mcp  -     -    -    enabled   Unsupported
  
  # Remove the restrictions.
  ➜  codex git:(gt/restrict-mcps) ✗ defaults delete com.openai.codex requirements_toml_base64
  
  # Observe both MCPs are enabled.
  ➜  codex git:(gt/restrict-mcps) ✗ just codex mcp list
  cargo run --bin codex -- "$@"
      Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.25s
       Running `target/debug/codex mcp list`
  Name         Command          Args  Env  Cwd  Status   Auth
  docs         docs-mcp         -     -    -    enabled  Unsupported
  hello_world  hello-world-mcp  -     -    -    enabled  Unsupported
  
  # A new requirements that updates the command to one that does not match.
  ➜  codex git:(gt/restrict-mcps) ✗ cat ~/requirements.toml
  [mcp_server_allowlist.hello_world]
  command = "hello-world-mcp-v2"
  
  # Use those requirements.
  ➜  codex git:(gt/restrict-mcps) ✗ defaults write com.openai.codex requirements_toml_base64 "$(base64 -i /Users/gt/requirements.toml)"
  
  # Observe both MCPs are disabled.
  ➜  codex git:(gt/restrict-mcps) ✗ just codex mcp list
  cargo run --bin codex -- "$@"
      Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.75s
       Running `target/debug/codex mcp list`
  Name         Command          Args  Env  Cwd  Status    Auth
  docs         docs-mcp         -     -    -    disabled  Unsupported
  hello_world  hello-world-mcp  -     -    -    disabled  Unsupported
  ```

  gt-oai · 2026-01-13 19:45:00 +00:00
  2651980bdf
• fix: drop session span at end of the session (#9126)
  Anton Panasenko · 2026-01-13 11:36:00 -08:00
  51d75bb80a
• add generated jsonschema for config.toml (#8956)

  ### What
  Add JSON Schema generation for `config.toml`, with checked‑in
  `docs/config.schema.json`. We can move the schema elsewhere if preferred
  (and host it if there's demand).
  
  Add fixture test to prevent drift and `just write-config-schema` to
  regenerate on schema changes.
  
  Generate MCP config schema from `RawMcpServerConfig` instead of
  `McpServerConfig` because that is the runtime type used for
  deserialization.
  
  Populate feature flag values into generated schema so they can be
  autocompleted.
  
  ### Tests
  Added tests + regenerate script to prevent drift. Tested autocompletions
  using generated jsonschema locally with Even Better TOML.
  
  
  
  https://github.com/user-attachments/assets/5aa7cd39-520c-4a63-96fb-63798183d0bc

  sayan-oai · 2026-01-13 10:22:51 -08:00
  40e2405998
• ollama: default to Responses API for built-ins (#8798)

  This is an alternate PR to solving the same problem as
  <https://github.com/openai/codex/pull/8227>.
  
  In this PR, when Ollama is used via `--oss` (or via `model_provider =
  "ollama"`), we default it to use the Responses format. At runtime, we do
  an Ollama version check, and if the version is older than when Responses
  support was added to Ollama, we print out a warning.
  
  Because there's no way of configuring the wire api for a built-in
  provider, we temporarily add a new `oss_provider`/`model_provider`
  called `"ollama-chat"` that will force the chat format.
  
  Once the `"chat"` format is fully removed (see
  <https://github.com/openai/codex/discussions/7782>), `ollama-chat` can
  be removed as well
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  Devon Rifkin · 2026-01-13 09:51:41 -08:00
  fe03320791
• Support response.done and add integration tests (#9129)

  The agent loop using a persistent incremental web socket connection.

  pakrym-oai · 2026-01-13 16:12:30 +00:00
  2d56519ecd
• nit: collab send input cleaning (#9147)
  jif-oai · 2026-01-13 15:15:41 +00:00
  97f1f20edb
• chore: better error handling on collab tools (#9143)
  jif-oai · 2026-01-13 13:56:11 +00:00
  3b8d79ee11
• Updated heuristic for tool call summary to detect file modifications (#9109)

  This PR attempts to address #9079

  Eric Traut · 2026-01-13 08:00:13 +00:00
  3c8fb90bf0
• Use markdown for migration screen (#8952)

  Next steps will be routing this to model info

  Ahmed Ibrahim · 2026-01-13 07:41:42 +00:00
  325ce985f1
• Send message by default mid turn. queue messages by tab (#9077)

  https://github.com/user-attachments/assets/03838730-4ddc-44df-a2c7-cb8ecda78660

  Ahmed Ibrahim · 2026-01-12 23:06:35 -08:00
  cbca43d57a
• Websocket append support (#9128)

  Support an incremental append request in websocket transport.

  pakrym-oai · 2026-01-13 06:07:13 +00:00
  e726a82c8a
• fix: prompt for unsafe commands on Windows (#9117)
  Michael Bolin · 2026-01-12 21:30:09 -08:00
  ddae70bd62
• Reuse websocket connection (#9127)

  Reuses the connection but still sends full requests.

  pakrym-oai · 2026-01-13 03:30:09 +00:00
  d75626ad99
• Add model client sessions (#9102)

  Maintain a long-running session.

  pakrym-oai · 2026-01-13 01:15:56 +00:00
  490c1c1fdd
• Assemble sandbox/approval/network prompts dynamically (#8961)

  - Add a single builder for developer permissions messaging that accepts
  SandboxPolicy and approval policy. This builder now drives the developer
  “permissions” message that’s injected at session start and any time
  sandbox/approval settings change.
  - Trim EnvironmentContext to only include cwd, writable roots, and
  shell; removed sandbox/approval/network duplication and adjusted XML
  serialization and tests accordingly.
  
  Follow-up: adding a config value to replace the developer permissions
  message for custom sandboxes.

  Ahmed Ibrahim · 2026-01-12 23:12:59 +00:00
  87f7226cca
• feat: hot reload mcp servers (#8957)

  ### Summary
  * Added `mcpServer/refresh` command to inform app servers and active
  threads to refresh mcpServer on next turn event.
  * Added `pending_mcp_server_refresh_config` to codex core so that if the
  value is populated, we reinitialize the mcp server manager on the thread
  level.
  * The config is updated on `mcpServer/refresh` command which we iterate
  through threads and provide with the latest config value after last
  write.

  Shijie Rao · 2026-01-12 11:17:50 -08:00
  3e91a95ce1
• nit: add docstring (#9099)

  Add docstring on `ToolHandler` trait

  jif-oai · 2026-01-12 17:40:52 +00:00
  898e5f82f0
• Add static mcp callback uri support (#8971)

  Currently the callback URI for MCP authentication is dynamically
  generated. More specifically, the callback URI is dynamic because the
  port part of it is randomly chosen by the OS. This is not ideal as
  callback URIs are recommended to be static and many authorization
  servers do not support dynamic callback URIs.
  
  This PR fixes that issue by exposing a new config option named
  `mcp_oauth_callback_port`. When it is set, the callback URI is
  constructed using this port rather than a random one chosen by the OS,
  thereby making callback URI static.
  
  Related issue: https://github.com/openai/codex/issues/8827

  WhammyLeaf · 2026-01-12 16:57:04 +00:00
  d5562983d9