codex

[search] allow explicitly disabling web search (#9249 )

moving `web_search` rollout serverside, so need a way to explicitly
disable search + signal eligibility from the client.

- Add `x‑oai‑web‑search‑eligible` header that signifies whether the
request can have web search.
- Only attach the `web_search` tool when the resolved `WebSearchMode` is
`Live` or `Cached`.

sayan-oai · 2026-01-15 11:28:57 -08:00

169201b1b5

add WebSearchMode enum (#9216 )

### What
Add `WebSearchMode` enum (disabled, cached live, defaults to cached) to
config + V2 protocol. This enum takes precedence over legacy flags:
`web_search_cached`, `web_search_request`, and `tools.web_search`.

Keep `--search` as live.

### Tests
Added tests

sayan-oai · 2026-01-14 12:51:42 -08:00

5e426ac270

Use current model for review (#9179 )

Instead of having a hard-coded default review model, use the current
model for running `/review` unless one is specified in the config.

Also inherit current reasoning effort

pakrym-oai · 2026-01-14 08:59:41 -08:00

92472e7baa

fix: drop session span at end of the session (#9126 )

Anton Panasenko · 2026-01-13 11:36:00 -08:00

51d75bb80a

renaming: task to turn (#8963 )

jif-oai · 2026-01-09 17:31:17 +00:00

1aed01e99f

clean: all history cloning (#8916 )

jif-oai · 2026-01-08 18:17:18 +00:00

69898e3dba

feat: add a few metrics (#8910 )

jif-oai · 2026-01-08 15:39:57 +00:00

5522663f92

fix: include project instructions in /review subagent (#8899 )

Include project-level AGENTS.md and skills in /review sessions so the
review sub-agent uses the same instruction pipeline as standard runs,
keeping reviewer context aligned with normal sessions.

Thibault Sottiaux · 2026-01-08 13:31:01 +00:00

be212db0c8

feat: metrics capabilities (#8318 )

Add metrics capabilities to Codex. The `README.md` is up to date.

This will not be merged with the metrics before this PR of course:
https://github.com/openai/codex/pull/8350

jif-oai · 2026-01-08 11:47:36 +00:00

634650dd25

chore: drop useless feature flags (#8850 )

jif-oai · 2026-01-07 19:54:32 +00:00

1253d19641

chore: unify conversation with thread name (#8830 )

Done and verified by Codex + refactor feature of RustRover

jif-oai · 2026-01-07 17:04:53 +00:00

116059c3a0

chore: rename unified exec sessions (#8822 )

Renaming done by Codex

jif-oai · 2026-01-07 16:12:47 +00:00

4cef89a122

Rename OpenAI models to models manager (#8346 )

# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.

Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00

f0dc6fd3c7

feat: add config to disable warnings around ghost snapshot (#8178 )

jif-oai · 2025-12-17 18:50:22 +00:00

3d92b443b0

Revert "chore: review in read-only (#7593 )" (#8127 )

This reverts commit 291b54a762.

This commit was intended to prevent the model from making code changes
during `/review`, which is sometimes does. Unfortunately, it has other
unintended side effects that cause `/review` to fail in a variety of
ways. See #8115 and #7815. We've therefore decided to revert this
change.

Eric Traut · 2025-12-16 12:01:54 -08:00

bbc5675974

nit: trace span for regular task (#8053 )

Logs are too spammy

---------

Co-authored-by: Anton Panasenko <apanasenko@openai.com>

jif-oai · 2025-12-16 16:53:15 +00:00

d7482510b1

feat: close unified_exec at end of turn (#8052 )

jif-oai · 2025-12-16 12:16:43 +00:00

ae57e18947

feat: ghost snapshot v2 (#8055 )

This PR updates ghost snapshotting to avoid capturing oversized
untracked artifacts while keeping undo safe. Snapshot creation now
builds a temporary index from `git status --porcelain=2 -z`, writes a
tree and detached commit without touching refs, and records any ignored
large files/dirs in the snapshot report. Undo uses that metadata to
preserve large local artifacts while still cleaning up new transient
files.

jif-oai · 2025-12-15 11:14:36 +01:00

0d9801d448

feat: config ghost commits (#7873 )

jif-oai · 2025-12-15 09:13:06 +01:00

4274e6189a

[codex] add otel tracing (#7844 )

Anton Panasenko · 2025-12-12 17:07:17 -08:00

ad7b9d63c3

Remote compact for API-key users (#7835 )

pakrym-oai · 2025-12-12 10:05:02 -08:00

b3ddd50eee

feat: warning for long snapshots (#7870 )

jif-oai · 2025-12-11 12:42:47 +00:00

b2280d6205

make model optional in config (#7769 )

- Make Config.model optional and centralize default-selection logic in
ModelsManager, including a default_model helper (with
codex-auto-balanced when available) so sessions now carry an explicit
chosen model separate from the base config.
- Resolve `model` once in `core` and `tui` from config. Then store the
state of it on other structs.
- Move refreshing models to be before resolving the default model

Ahmed Ibrahim · 2025-12-10 11:19:00 -08:00

cb9a189857

refactoring with_escalated_permissions to use SandboxPermissions instead (#7750 )

helpful in the future if we want more granularity for requesting
escalated permissions:
e.g when running in readonly sandbox, model can request to escalate to a
sandbox that allows writes

zhao-oai · 2025-12-10 17:18:48 +00:00

e0fb3ca1db

chore: review in read-only (#7593 )

jif-oai · 2025-12-04 10:01:12 -08:00

291b54a762

Migrate model family to models manager (#7565 )

This PR moves `ModelsFamily` to `openai_models`. It also propagates
`ModelsManager` to session services and use it to drive model family. We
also make `derive_default_model_family` private because it's a step
towards what we want: one place that gives model configuration.

This is a second step at having one source of truth for models
information and config: `ModelsManager`.

Next steps would be to remove `ModelsFamily` from config. That's massive
because it's being used in 41 occasions mostly pre launching `codex`.
Also, we need to make `find_family_for_model` private. It's also big
because it's being used in 21 occasions ~ all tests.

Ahmed Ibrahim · 2025-12-03 18:49:47 -08:00

cee37a32b2

fix: Features should be immutable over the lifetime of a session/thread (#7540 )

I noticed that `features: Features` was defined on `struct
SessionConfiguration`, which is commonly owned by `SessionState`, which
is in turn owned by `Session`.

Though I do not believe that `Features` should be allowed to be modified
over the course of a session (if the feature state is not invariant, it
makes it harder to reason about), which argues that it should live on
`Session` rather than `SessionState` or `SessionConfiguration`.

This PR moves `Features` to `Session` and updates all call sites. It
appears the only place we were mutating `Features` was:

- in tests
- the sub-agent config for a review task:


https://github.com/openai/codex/blob/3ef76ff29d5eed258fb6b8550e0e2b973d0dca21/codex-rs/core/src/tasks/review.rs#L86-L89

Note this change also means it is no longer an `async` call to check the
state of a feature, eliminating the possibility of a
[TOCTTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use)
error between checking the state of a feature and acting on it:


https://github.com/openai/codex/blob/3ef76ff29d5eed258fb6b8550e0e2b973d0dca21/codex-rs/core/src/codex.rs#L1069-L1076

Michael Bolin · 2025-12-03 16:12:31 -08:00

1cfc967eb8

feat: detached review (#7292 )

jif-oai · 2025-11-28 11:34:57 +00:00

aaec8abf58

feat: update process ID for event handling (#7261 )

jif-oai · 2025-11-25 14:21:05 -08:00

28ff364c3a

feat: update process_exec_tool_call() to take a cancellation token (#6972 )

This updates `ExecParams` so that instead of taking `timeout_ms:
Option<u64>`, it now takes a more general cancellation mechanism,
`ExecExpiration`, which is an enum that includes a
`Cancellation(tokio_util::sync::CancellationToken)` variant.

If the cancellation token is fired, then `process_exec_tool_call()`
returns in the same way as if a timeout was exceeded.

This is necessary so that in #6973, we can manage the timeout logic
external to the `process_exec_tool_call()` because we want to "suspend"
the timeout when an elicitation from a human user is pending.








---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/6972).
* #7005
* #6973
* __->__ #6972

Michael Bolin · 2025-11-20 16:29:57 -08:00

f56d1dc8fc

increasing user shell timeout to 1 hour (#7025 )

setting user shell timeout to an unreasonably high value since there
isn't an easy way to have a command run without timeouts

currently, user shell commands timeout is 10 seconds

zhao-oai · 2025-11-20 13:39:16 -08:00

c30ca0d5b6

feat: warning large commits (#6838 )

jif-oai · 2025-11-19 10:22:10 +00:00

956d3bfac6

Move shell to use truncate_text (#6842 )

Move shell to use the configurable `truncate_text`

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

Ahmed Ibrahim · 2025-11-19 01:56:08 -08:00

efebc62fb7

Run remote auto compaction (#6879 )

pakrym-oai · 2025-11-19 00:43:58 -08:00

75f38f16dd

fix(tui) ghost snapshot notifications (#6881 )

## Summary
- avoid surfacing ghost snapshot warnings in the TUI when snapshot
creation fails, logging the conditions instead
- continue to capture successful ghost snapshots without changing
existing behavior

## Testing
- `cargo test -p codex-core` *(fails:
default_client::tests::test_create_client_sets_default_headers,
default_client::tests::test_get_codex_user_agent,
exec::tests::kill_child_process_group_kills_grandchildren_on_timeout)*

------
[Codex
Task](https://chatgpt.com/codex/tasks/task_i_691c02238db08322927c47b8c2d72c4c)

Dylan Hurd · 2025-11-18 23:23:00 -08:00

84458f12f6

fix: local compaction (#6844 )

jif-oai · 2025-11-18 22:18:10 +00:00

c56d0c159b

feat: review in app server (#6613 )

jif-oai · 2025-11-18 21:58:54 +00:00

8ddae8cde3

feat: remote compaction (#6795 )

Co-authored-by: pakrym-oai <pakrym@openai.com>

jif-oai · 2025-11-18 16:51:16 +00:00

838531d3e4

[app-server] feat: add v2 command execution approval flow (#6758 )

This PR adds the API V2 version of the command‑execution approval flow
for the shell tool.

This PR wires the new RPC (`item/commandExecution/requestApproval`, V2
only) and related events (`item/started`, `item/completed`, and
`item/commandExecution/delta`, which are emitted in both V1 and V2)
through the app-server
protocol. The new approval RPC is only sent when the user initiates a
turn with the new `turn/start` API so we don't break backwards
compatibility with VSCE.

The approach I took was to make as few changes to the Codex core as
possible, leveraging existing `EventMsg` core events, and translating
those in app-server. I did have to add additional fields to
`EventMsg::ExecCommandEndEvent` to capture the command's input so that
app-server can statelessly transform these events to a
`ThreadItem::CommandExecution` item for the `item/completed` event.

Once we stabilize the API and it's complete enough for our partners, we
can work on migrating the core to be aware of command execution items as
a first-class concept.

**Note**: We'll need followup work to make sure these APIs work for the
unified exec tool, but will wait til that's stable and landed before
doing a pass on app-server.

Example payloads below:
```
{
  "method": "item/started",
  "params": {
    "item": {
      "aggregatedOutput": null,
      "command": "/bin/zsh -lc 'touch /tmp/should-trigger-approval'",
      "cwd": "/Users/owen/repos/codex/codex-rs",
      "durationMs": null,
      "exitCode": null,
      "id": "call_lNWWsbXl1e47qNaYjFRs0dyU",
      "parsedCmd": [
        {
          "cmd": "touch /tmp/should-trigger-approval",
          "type": "unknown"
        }
      ],
      "status": "inProgress",
      "type": "commandExecution"
    }
  }
}
```

```
{
  "id": 0,
  "method": "item/commandExecution/requestApproval",
  "params": {
    "itemId": "call_lNWWsbXl1e47qNaYjFRs0dyU",
    "parsedCmd": [
      {
        "cmd": "touch /tmp/should-trigger-approval",
        "type": "unknown"
      }
    ],
    "reason": "Need to create file in /tmp which is outside workspace sandbox",
    "risk": null,
    "threadId": "019a93e8-0a52-7fe3-9808-b6bc40c0989a",
    "turnId": "1"
  }
}
```

```
{
  "id": 0,
  "result": {
    "acceptSettings": {
      "forSession": false
    },
    "decision": "accept"
  }
}
```

```
{
  "params": {
    "item": {
      "aggregatedOutput": null,
      "command": "/bin/zsh -lc 'touch /tmp/should-trigger-approval'",
      "cwd": "/Users/owen/repos/codex/codex-rs",
      "durationMs": 224,
      "exitCode": 0,
      "id": "call_lNWWsbXl1e47qNaYjFRs0dyU",
      "parsedCmd": [
        {
          "cmd": "touch /tmp/should-trigger-approval",
          "type": "unknown"
        }
      ],
      "status": "completed",
      "type": "commandExecution"
    }
  }
}
```

Owen Lin · 2025-11-18 00:23:54 +00:00

cecbd5b021

feat: better UI for unified_exec (#6515 )

<img width="376" height="132" alt="Screenshot 2025-11-12 at 17 36 22"
src="https://github.com/user-attachments/assets/ce693f0d-5ca0-462e-b170-c20811dcc8d5"
/>

jif-oai · 2025-11-14 16:31:12 +01:00

63c8c01f40

feat: shell_command tool (#6510 )

This adds support for a new variant of the shell tool behind a flag. To
test, run `codex` with `--enable shell_command_tool`, which will
register the tool with Codex under the name `shell_command` that accepts
the following shape:

```python
{
  command: str
  workdir: str | None,
  timeout_ms: int | None,
  with_escalated_permissions: bool | None,
  justification: str | None,
}
```

This is comparable to the existing tool registered under
`shell`/`container.exec`. The primary difference is that it accepts
`command` as a `str` instead of a `str[]`. The `shell_command` tool
executes by running `execvp(["bash", "-lc", command])`, though the exact
arguments to `execvp(3)` depend on the user's default shell.

The hypothesis is that this will simplify things for the model. For
example, on Windows, instead of generating:

```json
{"command": ["pwsh.exe", "-NoLogo", "-Command", "ls -Name"]}
```

The model could simply generate:

```json
{"command": "ls -Name"}
```

As part of this change, I extracted some logic out of `user_shell.rs` as
`Shell::derive_exec_args()` so that it can be reused in
`codex-rs/core/src/tools/handlers/shell.rs`. Note the original code
generated exec arg lists like:

```javascript
["bash", "-lc", command]
["zsh", "-lc", command]
["pwsh.exe", "-NoProfile", "-Command", command]
```

Using `-l` for Bash and Zsh, but then specifying `-NoProfile` for
PowerShell seemed inconsistent to me, so I changed this in the new
implementation while also adding a `use_login_shell: bool` option to
make this explicit. If we decide to add a `login: bool` to
`ShellCommandToolCallParams` like we have for unified exec:


https://github.com/openai/codex/blob/807e2c27f0a9f2e85c50e7e6df5533f0d9b853c7/codex-rs/core/src/tools/handlers/unified_exec.rs#L33-L34

Then this should make it straightforward to support.

Michael Bolin · 2025-11-12 08:18:57 -08:00

29364f3a9b

Add user command event types (#6246 )

adding new user command event, logic in TUI to render user command
events

zhao-oai · 2025-11-10 19:18:45 +00:00

980886498c

Move compact (#6454 )

jif-oai · 2025-11-10 11:59:48 +00:00

50a77dc138

Remove shell tool when unified exec is enabled (#6345 )

Also drop streameable shell that's just an alias for unified exec.

pakrym-oai · 2025-11-06 15:46:24 -08:00

c368c6aeea

ignore deltas in codex_delegate (#6208 )

ignore legacy deltas in codex-delegate to avoid this
[issue](https://github.com/openai/codex/pull/6202).

Ahmed Ibrahim · 2025-11-04 19:21:35 +00:00

fe54c216a3

fix: ignore reasoning deltas because we send it with turn item (#6202 )

should fix this:

<img width="2418" height="242" alt="image"
src="https://github.com/user-attachments/assets/f818d00b-ed3a-479b-94a7-e4bc5db6326e"
/>

Ahmed Ibrahim · 2025-11-04 08:27:16 -08:00

7e068e1094

Pass initial history as an optional to codex delegate (#5950 )

This will give us more freedom on controlling the delegation. i.e we can
fork our history and run `compact`.

Ahmed Ibrahim · 2025-10-30 07:22:42 -07:00

5fcc380bd9

ignore agent message deltas for the review mode (#5937 )

The deltas produce the whole json output. ignore them.

Ahmed Ibrahim · 2025-10-30 00:47:55 +00:00

7aa46ab5fc

Add item streaming events (#5546 )

Adds AgentMessageContentDelta, ReasoningContentDelta,
ReasoningRawContentDelta item streaming events while maintaining
compatibility for old events.

---------

Co-authored-by: Owen Lin <owen@openai.com>

pakrym-oai · 2025-10-29 22:33:57 +00:00

3429e82e45

Delegate review to codex instance (#5572 )

In this PR, I am exploring migrating task kind to an invocation of
Codex. The main reason would be getting rid off multiple
`ConversationHistory` state and streamlining our context/history
management.

This approach depends on opening a channel between the sub-codex and
codex. This channel is responsible for forwarding `interactive`
(`approvals`) and `non-interactive` events. The `task` is responsible
for handling those events.

This opens the door for implementing `codex as a tool`, replacing
`compact` and `review`, and potentially subagents.

One consideration is this code is very similar to `app-server` specially
in the approval part. If in the future we wanted an interactive
`sub-codex` we should consider using `codex-mcp`

Ahmed Ibrahim · 2025-10-29 21:04:25 +00:00

13e1d0362d

60 Commits