748 Commits

• core: adopt host_executable() rules in zsh-fork (#13046)

  ## Why
  
  [#12964](https://github.com/openai/codex/pull/12964) added
  `host_executable()` support to `codex-execpolicy`, but the zsh-fork
  interception path in `unix_escalation.rs` was still evaluating commands
  with the default exact-token matcher.
  
  That meant an intercepted absolute executable such as `/usr/bin/git
  status` could still miss basename rules like `prefix_rule(pattern =
  ["git", "status"])`, even when the policy also defined a matching
  `host_executable(name = "git", ...)` entry.
  
  This PR adopts the new matching behavior in the zsh-fork runtime only.
  That keeps the rollout intentionally narrow: zsh-fork already requires
  explicit user opt-in, so it is a safer first caller to exercise the new
  `host_executable()` scheme before expanding it to other execpolicy call
  sites.
  
  It also brings zsh-fork back in line with the current `prefix_rule()`
  execution model. Until prefix rules can carry their own permission
  profiles, a matched `prefix_rule()` is expected to rerun the intercepted
  command unsandboxed on `allow`, or after the user accepts `prompt`,
  instead of merely continuing inside the inherited shell sandbox.
  
  ## What Changed
  
  - added `evaluate_intercepted_exec_policy()` in
  `core/src/tools/runtimes/shell/unix_escalation.rs` to centralize
  execpolicy evaluation for intercepted commands
  - switched intercepted direct execs in the zsh-fork path to
  `check_multiple_with_options(...)` with `MatchOptions {
  resolve_host_executables: true }`
  - added `commands_for_intercepted_exec_policy()` so zsh-fork policy
  evaluation works from intercepted `(program, argv)` data instead of
  reconstructing a synthetic command before matching
  - left shell-wrapper parsing intentionally disabled by default behind
  `ENABLE_INTERCEPTED_EXEC_POLICY_SHELL_WRAPPER_PARSING`, so
  path-sensitive matching relies on later direct exec interception rather
  than shell-script parsing
  - made matched `prefix_rule()` decisions rerun intercepted commands with
  `EscalationExecution::Unsandboxed`, while unmatched-command fallback
  keeps the existing sandbox-preserving behavior
  - extracted the zsh-fork test harness into
  `core/tests/common/zsh_fork.rs` so both the skill-focused and
  approval-focused integration suites can exercise the same runtime setup
  - limited this change to the intercepted zsh-fork path rather than
  changing every execpolicy caller at once
  - added runtime coverage in
  `core/src/tools/runtimes/shell/unix_escalation_tests.rs` for allowed and
  disallowed `host_executable()` mappings and the wrapper-parsing modes
  - added integration coverage in `core/tests/suite/approvals.rs` to
  verify a saved `prefix_rule(pattern=["touch"], decision="allow")` reruns
  under zsh-fork outside a restrictive `WorkspaceWrite` sandbox
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13046).
  * #13065
  * __->__ #13046

  Michael Bolin · 2026-02-28 01:41:23 +00:00
  1a8d930267
• Unify rollout reconstruction with resume/fork TurnContext hydration (#12612)

  ## Summary
  
  This PR unifies rollout history reconstruction and resume/fork metadata
  hydration under a single `Session::reconstruct_history_from_rollout`
  implementation.
  
  The key change from main is that replay metadata now comes from the same
  reconstruction pass that rebuilds model-visible history, instead of
  doing a second bespoke rollout scan to recover `previous_model` /
  `reference_context_item`.
  
  ## What Changed
  
  ### Unified reconstruction output
  
  `reconstruct_history_from_rollout` now returns a single
  `RolloutReconstruction` bundle containing:
  
  - rebuilt `history`
  - `previous_model`
  - `reference_context_item`
  
  Resume and fork both consume that shared output directly.
  
  ### Reverse replay core
  
  The reconstruction logic moved into
  `codex-rs/core/src/codex/rollout_reconstruction.rs` and now scans
  rollout items newest-to-oldest.
  
  That reverse pass:
  
  - derives `previous_model`
  - derives whether `reference_context_item` is preserved or cleared
  - stops early once it has both resume metadata and a surviving
  `replacement_history` checkpoint
  
  History materialization is still bridged eagerly for now by replaying
  only the surviving suffix forward, which keeps the history result stable
  while moving the control flow toward the future lazy reverse loader
  design.
  
  ### Removed bespoke context lookup
  
  This deletes `last_rollout_regular_turn_context_lookup` and its separate
  compaction-aware scan.
  
  The previous model / baseline metadata is now computed from the same
  replay state that rebuilds history, so resume/fork cannot drift from the
  reconstructed transcript view.
  
  ### `TurnContextItem` persistence contract
  
  `TurnContextItem` is now treated as the replay source of truth for
  durable model-visible baselines.
  
  This PR keeps the following contract explicit:
  
  - persist `TurnContextItem` for the first real user turn so resume can
  recover `previous_model`
  - persist it for later turns that emit model-visible context updates
  - if mid-turn compaction reinjects full initial context into replacement
  history, persist a fresh `TurnContextItem` after `Compacted` so
  resume/fork can re-establish the baseline from the rewritten history
  - do not treat manual compaction or pre-sampling compaction as creating
  a new durable baseline on their own
  
  ## Behavior Preserved
  
  - rollback replay stays aligned with `drop_last_n_user_turns`
  - rollback skips only user turns
  - incomplete active user turns are dropped before older finalized turns
  when rollback applies
  - unmatched aborts do not consume the current active turn
  - missing abort IDs still conservatively clear stale compaction state
  - compaction clears `reference_context_item` until a later
  `TurnContextItem` re-establishes it
  - `previous_model` still comes from the newest surviving user turn that
  established one
  
  ## Tests
  
  Targeted validation run for the current branch shape:
  
  - `cd codex-rs && cargo test -p codex-core --lib
  codex::rollout_reconstruction_tests -- --nocapture`
  - `cd codex-rs && just fmt`
  
  The branch also extracts the rollout reconstruction tests into
  `codex-rs/core/src/codex/rollout_reconstruction_tests.rs` so this logic
  has a dedicated home instead of living inline in `codex.rs`.

  Charley Cunningham · 2026-02-27 13:50:45 -08:00
  695957a348
• fix: use AbsolutePathBuf for permission profile file roots (#12970)

  ## Why
  `PermissionProfile` should describe filesystem roots as absolute paths
  at the type level. Using `PathBuf` in `FileSystemPermissions` made the
  shared type too permissive and blurred together three different
  deserialization cases:
  
  - skill metadata in `agents/openai.yaml`, where relative paths should
  resolve against the skill directory
  - app-server API payloads, where callers should have to send absolute
  paths
  - local tool-call payloads for commands like `shell_command` and
  `exec_command`, where `additional_permissions.file_system` may
  legitimately be relative to the command `workdir`
  
  This change tightens the shared model without regressing the existing
  local command flow.
  
  ## What Changed
  - changed `protocol::models::FileSystemPermissions` and the app-server
  `AdditionalFileSystemPermissions` mirror to use `AbsolutePathBuf`
  - wrapped skill metadata deserialization in `AbsolutePathBufGuard`, so
  relative permission roots in `agents/openai.yaml` resolve against the
  containing skill directory
  - kept app-server/API deserialization strict, so relative
  `additionalPermissions.fileSystem.*` paths are rejected at the boundary
  - restored cwd/workdir-relative deserialization for local tool-call
  payloads by parsing `shell`, `shell_command`, and `exec_command`
  arguments under an `AbsolutePathBufGuard` rooted at the resolved command
  working directory
  - simplified runtime additional-permission normalization so it only
  canonicalizes and deduplicates absolute roots instead of trying to
  recover relative ones later
  - updated the app-server schema fixtures, `app-server/README.md`, and
  the affected transport/TUI tests to match the final behavior

  Michael Bolin · 2026-02-27 17:42:52 +00:00
  d09a7535ed
• fix: more stable notify script (#13011)
  jif-oai · 2026-02-27 16:05:44 +01:00
  8cf5b00aef
• Add model availability NUX metadata (#12972)

  - replace show_nux with structured availability_nux model metadata
  - expose availability NUX data through the app-server model API
  - update shared fixtures and tests for the new field

  Ahmed Ibrahim · 2026-02-26 22:02:57 -08:00
  4d180ae428
• Add oauth_resource handling for MCP login flows (#12866)

  Addresses bug https://github.com/openai/codex/issues/12589
  
  Builds on community PR #12763.
  
  This adds `oauth_resource` support for MCP `streamable_http` servers and
  wires it through the relevant config and login paths. It fixes the bug
  where the configured OAuth resource was not reliably included in the
  authorization request, causing MCP login to omit the expected
  `resource` parameter.

  Eric Traut · 2026-02-26 20:10:12 -08:00
  cee009d117
• Support multimodal custom tool outputs (#12948)

  ## Summary
  
  This changes `custom_tool_call_output` to use the same output payload
  shape as `function_call_output`, so freeform tools can return either
  plain text or structured content items.
  
  The main goal is to let `js_repl` return image content from nested
  `view_image` calls in its own `custom_tool_call_output`, instead of
  relying on a separate injected message.
  
  ## What changed
  
  - Changed `custom_tool_call_output.output` from `string` to
  `FunctionCallOutputPayload`
  - Updated freeform tool plumbing to preserve structured output bodies
  - Updated `js_repl` to aggregate nested tool content items and attach
  them to the outer `js_repl` result
  - Removed the old `js_repl` special case that injected `view_image`
  results as a separate pending user image message
  - Updated normalization/history/truncation paths to handle multimodal
  `custom_tool_call_output`
  - Regenerated app-server protocol schema artifacts
  
  ## Behavior
  
  Direct `view_image` calls still return a `function_call_output` with
  image content.
  
  When `view_image` is called inside `js_repl`, the outer `js_repl`
  `custom_tool_call_output` now carries:
  - an `input_text` item if the JS produced text output
  - one or more `input_image` items from nested tool results
  
  So the nested image result now stays inside the `js_repl` tool output
  instead of being injected as a separate message.
  
  ## Compatibility
  
  This is intended to be backward-compatible for resumed conversations.
  
  Older histories that stored `custom_tool_call_output.output` as a plain
  string still deserialize correctly, and older histories that used the
  previous injected-image-message flow also continue to resume.
  
  Added regression coverage for resuming a pre-change rollout containing:
  - string-valued `custom_tool_call_output`
  - legacy injected image message history
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/12948

  Curtis 'Fjord' Hawthorne · 2026-02-26 18:17:46 -08:00
  7e980d7db6
• Make realtime audio test deterministic (#12959)

  ## Summary\n- add a websocket test-server request waiter so tests can
  synchronize on recorded client messages\n- use that waiter in the
  realtime delegation test instead of a fixed audio timeout\n- add
  temporary timing logs in the test and websocket mock to inspect where
  the flake stalls

  Ahmed Ibrahim · 2026-02-26 16:09:00 -08:00
  a11da86b37
• feat: add local date/timezone to turn environment context (#12947)

  ## Summary
  
  This PR includes the session's local date and timezone in the
  model-visible environment context and persists that data in
  `TurnContextItem`.
  
    ## What changed
  - captures the current local date and IANA timezone when building a turn
  context, with a UTC fallback if the timezone lookup fails
  - includes current_date and timezone in the serialized
  <environment_context> payload
  - stores those fields on TurnContextItem so they survive rollout/history
  handling, subagent review threads, and resume flows
  - treats date/timezone changes as environment updates, so prompt caching
  and context refresh logic do not silently reuse stale time context
  - updates tests to validate the new environment fields without depending
  on a single hardcoded environment-context string
  
  ## test
  
  built a local build and saw it in the rollout file:
  ```
  {"timestamp":"2026-02-26T21:39:50.737Z","type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"<environment_context>\n  <shell>zsh</shell>\n  <current_date>2026-02-26</current_date>\n  <timezone>America/Los_Angeles</timezone>\n</environment_context>"}]}}
  ```

  Celia Chen · 2026-02-26 23:17:35 +00:00
  90cc4e79a2
• Allow clients not to send summary as an option (#12950)

  Summary is a required parameter on UserTurn. Ideally we'd like the core
  to decide the appropriate summary level.
  
  Make the summary optional and don't send it when not needed.

  pakrym-oai · 2026-02-26 14:37:38 -08:00
  951a389654
• feat: add git info to memories (#12940)
  jif-oai · 2026-02-26 20:14:13 +00:00
  a6065d30f4
• feat: include sandbox config with escalation request (#12839)

  ## Why
  
  Before this change, an escalation approval could say that a command
  should be rerun, but it could not carry the sandbox configuration that
  should still apply when the escalated command is actually spawned.
  
  That left an unsafe gap in the `zsh-fork` skill path: skill scripts
  under `scripts/` that did not declare permissions could be escalated
  without a sandbox, and scripts that did declare permissions could lose
  their bounded sandbox on rerun or cached session approval.
  
  This PR extends the escalation protocol so approvals can optionally
  carry sandbox configuration all the way through execution. That lets the
  shell runtime preserve the intended sandbox instead of silently widening
  access.
  
  We likely want a single permissions type for this codepath eventually,
  probably centered on `Permissions`. For now, the protocol needs to
  represent both the existing `PermissionProfile` form and the fuller
  `Permissions` form, so this introduces a temporary disjoint union,
  `EscalationPermissions`, to carry either one.
  
  Further, this means that today, a skill either:
  
  - does not declare any permissions, in which case it is run using the
  default sandbox for the turn
  - specifies permissions, in which case the skill is run using that exact
  sandbox, which might be more restrictive than the default sandbox for
  the turn
  
  We will likely change the skill's permissions to be additive to the
  existing permissions for the turn.
  
  ## What Changed
  
  - Added `EscalationPermissions` to `codex-protocol` so escalation
  requests can carry either a `PermissionProfile` or a full `Permissions`
  payload.
  - Added an explicit `EscalationExecution` mode to the shell escalation
  protocol so reruns distinguish between `Unsandboxed`, `TurnDefault`, and
  `Permissions(...)` instead of overloading `None`.
  - Updated `zsh-fork` shell reruns to resolve `TurnDefault` at execution
  time, which keeps ordinary `UseDefault` commands on the turn sandbox and
  preserves turn-level macOS seatbelt profile extensions.
  - Updated the `zsh-fork` skill path so a skill with no declared
  permissions inherits the conversation's effective sandbox instead of
  escalating unsandboxed.
  - Updated the `zsh-fork` skill path so a skill with declared permissions
  reruns with exactly those permissions, including when a cached session
  approval is reused.
  
  ## Testing
  
  - Added unit coverage in
  `core/src/tools/runtimes/shell/unix_escalation.rs` for the explicit
  `UseDefault` / `RequireEscalated` / `WithAdditionalPermissions`
  execution mapping.
  - Added unit coverage in
  `core/src/tools/runtimes/shell/unix_escalation.rs` for macOS seatbelt
  extension preservation in both the `TurnDefault` and
  explicit-permissions rerun paths.
  - Added integration coverage in `core/tests/suite/skill_approval.rs` for
  permissionless skills inheriting the turn sandbox and explicit skill
  permissions remaining bounded across cached approval reuse.

  Michael Bolin · 2026-02-26 12:00:18 -08:00
  7fa9d9ae35
• feat: add post-compaction sub-agent infos (#12774)

  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-02-26 18:55:34 +00:00
  3404ecff15
• feat: fork thread multi agent (#12499)
  jif-oai · 2026-02-26 18:01:53 +00:00
  d3603ae5d3
• Use model catalog default for reasoning summary fallback (#12873)

  ## Summary
  - make `Config.model_reasoning_summary` optional so unset means use
  model default
  - resolve the optional config value to a concrete summary when building
  `TurnContext`
  - add protocol support for `default_reasoning_summary` in model metadata
  
  ## Validation
  - `cargo test -p codex-core --lib client::tests -- --nocapture`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  pakrym-oai · 2026-02-26 09:31:13 -08:00
  ba41e84a50
• feat: use memory usage for selection (#12909)
  jif-oai · 2026-02-26 16:44:02 +00:00
  c528f32acb
• feat: memories forgetting (#12900)

  Add diff based memory forgetting

  jif-oai · 2026-02-26 13:19:57 +00:00
  382fa338b3
• core: bundle settings diff updates into one dev/user envelope (#12417)

  ## Summary
  - bundle contextual prompt injection into at most one developer message
  plus one contextual user message in both:
    - per-turn settings updates
    - initial context insertion
  - preserve `<model_switch>` across compaction by rebuilding it through
  canonical initial-context injection, instead of relying on
  strip/reattach hacks
  - centralize contextual user fragment detection in one shared definition
  table and reuse it for parsing/compaction logic
  - keep `AGENTS.md` in its natural serialized format:
    - `# AGENTS.md instructions for {dirname}`
    - `<INSTRUCTIONS>...</INSTRUCTIONS>`
  - simplify related tests/helpers and accept the expected snapshot/layout
  updates from bundled multi-part messages
  
  ## Why
  The goal is to converge toward a simpler, more intentional prompt shape
  where contextual updates are consistently represented as one developer
  envelope plus one contextual user envelope, while keeping parsing and
  compaction behavior aligned with that representation.
  
  ## Notable details
  - the temporary `SettingsUpdateEnvelope` wrapper was removed; these
  paths now return `Vec<ResponseItem>` directly
  - local/remote compaction no longer rely on model-switch strip/restore
  helpers
  - contextual user detection is now driven by shared fragment definitions
  instead of ad hoc matcher assembly
  - AGENTS/user instructions are still the same logical context; only the
  synthetic `<user_instructions>` wrapper was replaced by the natural
  AGENTS text format
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-app-server
  codex_message_processor::tests::extract_conversation_summary_prefers_plain_user_messages
  -- --exact`
  - `cargo test -p codex-core
  compact::tests::collect_user_messages_filters_session_prefix_entries
  --lib -- --exact`
  - `cargo test -p codex-core --test all
  'suite::compact::snapshot_request_shape_pre_turn_compaction_strips_incoming_model_switch'
  -- --exact`
  - `cargo test -p codex-core --test all
  'suite::compact_remote::snapshot_request_shape_remote_pre_turn_compaction_strips_incoming_model_switch'
  -- --exact`
  - `cargo test -p codex-core --test all
  'suite::client::includes_apps_guidance_as_developer_message_when_enabled'
  -- --exact`
  - `cargo test -p codex-core --test all
  'suite::client::includes_developer_instructions_message_in_request' --
  --exact`
  - `cargo test -p codex-core --test all
  'suite::client::includes_user_instructions_message_in_request' --
  --exact`
  - `cargo test -p codex-core --test all
  'suite::client::resume_includes_initial_messages_and_sends_prior_items'
  -- --exact`
  - `cargo test -p codex-core --test all
  'suite::review::review_input_isolated_from_parent_history' -- --exact`
  - `cargo test -p codex-exec --test all
  'suite::resume::exec_resume_last_respects_cwd_filter_and_all_flag' --
  --exact`
  - `cargo test -p core_test_support
  context_snapshot::tests::full_text_mode_preserves_unredacted_text --
  --exact`
  
  ## Notes
  - I also ran several targeted `compact`, `compact_remote`,
  `prompt_caching`, `model_visible_layout`, and `event_mapping` tests
  while iterating on prompt-shape changes.
  - I have not claimed a clean full-workspace `cargo test` from this
  environment because local sandbox/resource conditions have previously
  produced unrelated failures in large workspace runs.

  Charley Cunningham · 2026-02-26 00:12:08 -08:00
  07aefffb1f
• Disable js_repl when Node is incompatible at startup (#12824)

  ## Summary
  - validate `js_repl` Node compatibility during session startup when the
  experiment is enabled
  - if Node is missing or too old, disable `js_repl` and
  `js_repl_tools_only` for the session before tools and instructions are
  built
  - surface that startup disablement to users through the existing startup
  warning flow instead of only logging it
  - reuse the same compatibility check in js_repl kernel startup so
  startup gating and runtime behavior stay aligned
  - add a regression test that verifies the warning is emitted and that
  the first advertised tool list omits `js_repl` and `js_repl_reset` when
  Node is incompatible
  
  ## Why
  Today `js_repl` can be advertised based only on the feature flag, then
  fail later when the kernel starts. That makes the available tool list
  inaccurate at the start of a conversation, and users do not get a clear
  explanation for why the tool is unavailable.
  
  This change makes tool availability reflect real startup checks, keeps
  the advertised tool set stable for the lifetime of the session, and
  gives users a visible warning when `js_repl` is disabled.
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-core --test all
  js_repl_is_not_advertised_when_startup_node_is_incompatible`

  Curtis 'Fjord' Hawthorne · 2026-02-26 01:14:51 +00:00
  40ab71a985
• feat: include available decisions in command approval requests (#12758)

  Command-approval clients currently infer which choices to show from
  side-channel fields like `networkApprovalContext`,
  `proposedExecpolicyAmendment`, and `additionalPermissions`. That makes
  the request shape harder to evolve, and it forces each client to
  replicate the server's heuristics instead of receiving the exact
  decision list for the prompt.
  
  This PR introduces a mapping between `CommandExecutionApprovalDecision`
  and `codex_protocol::protocol::ReviewDecision`:
  
  ```rust
  impl From<CoreReviewDecision> for CommandExecutionApprovalDecision {
      fn from(value: CoreReviewDecision) -> Self {
          match value {
              CoreReviewDecision::Approved => Self::Accept,
              CoreReviewDecision::ApprovedExecpolicyAmendment {
                  proposed_execpolicy_amendment,
              } => Self::AcceptWithExecpolicyAmendment {
                  execpolicy_amendment: proposed_execpolicy_amendment.into(),
              },
              CoreReviewDecision::ApprovedForSession => Self::AcceptForSession,
              CoreReviewDecision::NetworkPolicyAmendment {
                  network_policy_amendment,
              } => Self::ApplyNetworkPolicyAmendment {
                  network_policy_amendment: network_policy_amendment.into(),
              },
              CoreReviewDecision::Abort => Self::Cancel,
              CoreReviewDecision::Denied => Self::Decline,
          }
      }
  }
  ```
  
  And updates `CommandExecutionRequestApprovalParams` to have a new field:
  
  ```rust
  available_decisions: Option<Vec<CommandExecutionApprovalDecision>>
  ```
  
  when, if specified, should make it easier for clients to display an
  appropriate list of options in the UI.
  
  This makes it possible for `CoreShellActionProvider::prompt()` in
  `unix_escalation.rs` to specify the `Vec<ReviewDecision>` directly,
  adding support for `ApprovedForSession` when approving a skill script,
  which was previously missing in the TUI.
  
  Note this results in a significant change to `exec_options()` in
  `approval_overlay.rs`, as the displayed options are now derived from
  `available_decisions: &[ReviewDecision]`.
  
  ## What Changed
  
  - Add `available_decisions` to
  [`ExecApprovalRequestEvent`](https://github.com/openai/codex/blob/de00e932dd9801de0a4faac0519162099753f331/codex-rs/protocol/src/approvals.rs#L111-L175),
  including helpers to derive the legacy default choices when older
  senders omit the field.
  - Map `codex_protocol::protocol::ReviewDecision` to app-server
  `CommandExecutionApprovalDecision` and expose the ordered list as
  experimental `availableDecisions` in
  [`CommandExecutionRequestApprovalParams`](https://github.com/openai/codex/blob/de00e932dd9801de0a4faac0519162099753f331/codex-rs/app-server-protocol/src/protocol/v2.rs#L3798-L3807).
  - Thread optional `available_decisions` through the core approval path
  so Unix shell escalation can explicitly request `ApprovedForSession` for
  session-scoped approvals instead of relying on client heuristics.
  [`unix_escalation.rs`](https://github.com/openai/codex/blob/de00e932dd9801de0a4faac0519162099753f331/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs#L194-L214)
  - Update the TUI approval overlay to build its buttons from the ordered
  decision list, while preserving the legacy fallback when
  `available_decisions` is missing.
  - Update the app-server README, test client output, and generated schema
  artifacts to document and surface the new field.
  
  ## Testing
  
  - Add `approval_overlay.rs` coverage for explicit decision lists,
  including the generic `ApprovedForSession` path and network approval
  options.
  - Update `chatwidget/tests.rs` and app-server protocol tests to populate
  the new optional field and keep older event shapes working.
  
  ## Developers Docs
  
  - If we document `item/commandExecution/requestApproval` on
  [developers.openai.com/codex](https://developers.openai.com/codex), add
  experimental `availableDecisions` as the preferred source of approval
  choices and note that older servers may omit it.

  Michael Bolin · 2026-02-26 01:10:46 +00:00
  14116ade8d
• Revert "Add skill approval event/response (#12633)" (#12811)

  This reverts commit https://github.com/openai/codex/pull/12633. We no
  longer need this PR, because we favor sending normal exec command
  approval server request with `additional_permissions` of skill
  permissions instead

  Celia Chen · 2026-02-26 01:02:42 +00:00
  4f45668106
• Use websocket v2 as model-preferred websocket protocol (#12838)
  pakrym-oai · 2026-02-25 16:35:53 -08:00
  4fedef88e0
• Enable request_user_input in Default mode (#12735)

  ## Summary
  - allow `request_user_input` in Default collaboration mode as well as
  Plan
  - update the Default-mode instructions to prefer assumptions first and
  use `request_user_input` only when a question is unavoidable
  - update request_user_input and app-server tests to match the new
  Default-mode behavior
  - refactor collaboration-mode availability plumbing into
  `CollaborationModesConfig` for future mode-related flags
  
  ## Codex author
  `codex resume 019c9124-ed28-7c13-96c6-b916b1c97d49`

  Charley Cunningham · 2026-02-25 15:20:46 -08:00
  2f4d6ded1d
• Revert "Ensure shell command skills trigger approval (#12697)" (#12721)

  This reverts commit daf0f03ac8.
  
  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Celia Chen · 2026-02-25 22:49:53 +00:00
  b6d20748e0
• make 5.3-codex visible in cli for api users (#12808)

  5.3-codex released in api, mark it visible for API users via bundled
  `models.json`.

  sayan-oai · 2026-02-25 13:01:40 -08:00
  d45ffd5830
• Propagate session ID when compacting (#12802)

  We propagate the session ID when sending requests for inference but we
  don't do the same for compaction requests. This makes it hard to link
  compaction requests to their session for debugging purposes

  Rasmus Rygaard · 2026-02-25 19:17:38 +00:00
  73eaebbd1c
• fix: enforce sandbox envelope for zsh fork execution (#12800)

  ## Why
  Zsh fork execution was still able to bypass the `WorkspaceWrite` model
  in edge cases because the fork path reconstructed command execution
  without preserving sandbox wrappers, and command extraction only
  accepted shell invocations in a narrow positional shape. This can allow
  commands to run with broader filesystem access than expected, which
  breaks the sandbox safety model.
  
  ## What changed
  - Preserved the sandboxed `ExecRequest` produced by
  `attempt.env_for(...)` when entering the zsh fork path in
  [`unix_escalation.rs`](https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs).
  - Updated `CoreShellCommandExecutor` to execute the sandboxed command
  and working directory captured from `attempt.env_for(...)`, instead of
  re-running a freshly reconstructed shell command.
  - Made zsh-fork script extraction robust to wrapped invocations by
  scanning command arguments for `-c`/`-lc` rather than only matching the
  first positional form.
  - Added unit tests in `unix_escalation.rs` to lock in wrapper-tolerant
  parsing behavior and keep unsupported shell forms rejected.
  - Tightened the regression in
  [`skill_approval.rs`](https://github.com/openai/codex/blob/main/codex-rs/core/tests/suite/skill_approval.rs):
  - `shell_zsh_fork_still_enforces_workspace_write_sandbox` now uses an
  explicit `WorkspaceWrite` policy with `exclude_tmpdir_env_var: true` and
  `exclude_slash_tmp: true`.
  - The test attempts to write to `/tmp/...`, which is only reliably
  outside writable roots with those explicit exclusions set.
  
  ## Verification
  - Added and passed the new unit tests around `extract_shell_script`
  parsing behavior with wrapped command shapes.
    - `extract_shell_script_supports_wrapped_command_prefixes`
    - `extract_shell_script_rejects_unsupported_shell_invocation`
  - Verified the regression with the focused integration test:
  `shell_zsh_fork_still_enforces_workspace_write_sandbox`.
  
  ## Manual Testing
  
  Prior to this change, if I ran Codex via:
  
  ```
  just codex --config zsh_path=/Users/mbolin/code/codex2/codex-rs/app-server/tests/suite/zsh --enable shell_zsh_fork
  ```
  
  and asked:
  
  ```
  what is the output of /bin/ps
  ```
  
  it would run it, even though the default sandbox should prevent the
  agent from running `/bin/ps` because it is setuid on MacOS.
  
  But with this change, I now see the expected failure because it is
  blocked by the sandbox:
  
  ```
  /bin/ps exited with status 1 and produced no output in this environment.
  ```

  Michael Bolin · 2026-02-25 11:05:27 -08:00
  648a420cbf
• Handle websocket timeout (#12791)

  Sometimes websockets will timeout with 400 error, ensure we retry it.

  pakrym-oai · 2026-02-25 10:31:37 -08:00
  9d7013eab0
• feat: adding stream parser (#12666)

  Add a stream parser to extract citations (and others) from a stream.
  This support cases where markers are split in differen tokens.
  
  Codex never manage to make this code work so everything was done
  manually. Please review correctly and do not touch this part of the code
  without a very clear understanding of it

  jif-oai · 2026-02-25 13:27:58 +00:00
  5441130e0a
• feat: add large stack test macro (#12768)

  This PR adds the macro `#[large_stack_test]`
  
  This spawns the tests in a dedicated tokio runtime with a larger stack.
  It is useful for tests that needs the full recursion on the harness
  (which is now too deep for windows for example)

  jif-oai · 2026-02-25 13:19:21 +00:00
  5a9a5b51b2
• feat: add service name to app-server (#12319)

  Add service name to the app-server so that the app can use it's own
  service name
  
  This is on thread level because later we might plan the app-server to
  become a singleton on the computer

  jif-oai · 2026-02-25 09:51:42 +00:00
  10c04e11b8
• Surface skill permission profiles in zsh-fork exec approvals (#12753)

  ## Summary
  
  - Preserve each skill’s raw permissions block as a permission_profile on
  SkillMetadata during skill loading.
  - Keep compiling that same metadata into the existing runtime
  Permissions object, so current enforcement
      behavior stays intact.
  - When zsh-fork intercepts execution of a script that belongs to a
  skill, include the skill’s
      permission_profile in the exec approval request.
  - This lets approval UIs show the extra filesystem access the skill
  declared when prompting for approval.

  Celia Chen · 2026-02-25 01:23:10 -08:00
  6a3233da64
• feat: zsh-fork forces scripts/**/* for skills to trigger a prompt (#12730)

  Direct skill-script matches force `Decision::Prompt`, so skill-backed
  scripts require explicit approval before they run. (Note "allow for
  session" is not supported in this PR, but will be done in a follow-up.)
  
  In the process of implementing this, I fixed an important bug:
  `ShellZshFork` is supposed to keep ordinary allowed execs on the
  client-side `Run` path so later `execve()` calls are still intercepted
  and reviewed. After the shell-escalation port, `Decision::Allow` still
  mapped to `Escalate`, which moved `zsh` to server-side execution too
  early. That broke the intended flow for skill-backed scripts and made
  the approval prompt depend on the wrong execution path.
  
  ## What changed
  - In `codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs`,
  `Decision::Allow` now returns `Run` unless escalation is actually
  required.
  - Removed the zsh-specific `argv[0]` fallback. With the `Allow -> Run`
  fix in place, zsh's later `execve()` of the script is intercepted
  normally, so the skill match happens on the script path itself.
  - Kept the skill-path handling in `determine_action()` focused on the
  direct `program` match path.
  
  ## Verification
  - Updated `shell_zsh_fork_prompts_for_skill_script_execution` in
  `codex-rs/core/tests/suite/skill_approval.rs` (gated behind `cfg(unix)`)
  to:
  - run under `SandboxPolicy::new_workspace_write_policy()` instead of
  `DangerFullAccess`
    - assert the approval command contains only the script path
  - assert the approved run returns both stdout and stderr markers in the
  shell output
  - Ran `cargo test -p codex-core
  shell_zsh_fork_prompts_for_skill_script_execution -- --nocapture`
  
  ## Manual Testing
  
  Run the dev build:
  
  ```
  just codex --config zsh_path=/Users/mbolin/code/codex2/codex-rs/app-server/tests/suite/zsh --enable shell_zsh_fork
  ```
  
  I have created `/Users/mbolin/.agents/skills/mbolin-test-skill` with:
  
  ```
  ├── scripts
  │   └── hello-mbolin.sh
  └── SKILL.md
  ```
  
  The skill:
  
  ```
  ---
  name: mbolin-test-skill
  description: Used to exercise various features of skills.
  ---
  
  When this skill is invoked, run the `hello-mbolin.sh` script and report the output.
  ```
  
  The script:
  
  ```
  set -e
  
  # Note this script will fail if run with network disabled.
  curl --location openai.com
  ```
  
  Use `$mbolin-test-skill` to invoke the skill manually and verify that I
  get prompted to run `hello-mbolin.sh`.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/12730).
  * #12750
  * __->__ #12730

  Michael Bolin · 2026-02-24 23:51:26 -08:00
  59398125f6
• feat(ui): add network approval persistence plumbing (#12358)

  ## Summary
  - add TUI approval options for persistent network host rules
  - add app-server v2 approval payload plumbing for network approval
  context + proposed network policy amendments
  - add app-server handling to translate `applyNetworkPolicyAmendment`
  decisions back into core review decisions
  - update docs/test client output and generated app-server schemas/types

  viyatb-oai · 2026-02-25 07:06:19 +00:00
  c086b36b58
• tests(js_repl): remove node-related skip paths from js_repl tests (#12185)

  ## Summary
  Remove js_repl/node test-skip paths and make Node setup explicit in CI
  so js_repl tests always run instead of silently skipping.
  
  ## Why
  We had multiple “expediency” skip paths that let js_repl tests pass
  without actually exercising Node-backed behavior. This reduced CI signal
  and hid runtime/environment regressions.
  
  ## What changed
  
  ### CI
  - Added Node setup using `codex-rs/node-version.txt` in:
    - `.github/workflows/rust-ci.yml`
    - `.github/workflows/bazel.yml`
  - Added a Unix PATH copy step in Bazel workflow to expose the setup-node
  binary in common paths.
  
  ### js_repl test harness
  - Added explicit js_repl sandbox test configuration helpers in:
    - `codex-rs/core/src/tools/js_repl/mod.rs`
    - `codex-rs/core/src/tools/handlers/js_repl.rs`
  - Added Linux arg0 dispatch glue for js_repl tests so sandbox subprocess
  entrypoint behavior is correct under Linux test execution.
  
  ### Removed skip behavior
  - Deleted runtime guard function and early-return skips in js_repl tests
  (`can_run_js_repl_runtime_tests` and related per-test short-circuits).
  - Removed view_image integration test skip behavior:
    - dropped `skip_if_no_network!(Ok(()))`
  - removed “skip on Node missing/too old” branch after js_repl output
  inspection.
  
  ## Impact
  - js_repl/node tests now consistently execute and fail loudly when the
  environment is not correctly provisioned.
  - CI has stronger signal for js_repl regressions instead of false green
  from conditional skips.
  
  ## Testing
  - `cargo test -p codex-core` (locally) to validate js_repl
  unit/integration behavior with skips removed.
  - CI expected to surface any remaining environment/runtime gaps directly
  (rather than masking them).
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/12300
  - ✅ `2` https://github.com/openai/codex/pull/12275
  - ✅ `3` https://github.com/openai/codex/pull/12205
  - ✅ `4` https://github.com/openai/codex/pull/12407
  - ✅ `5` https://github.com/openai/codex/pull/12372
  - 👉 `6` https://github.com/openai/codex/pull/12185
  - ⏳ `7` https://github.com/openai/codex/pull/10673

  Curtis 'Fjord' Hawthorne · 2026-02-24 22:52:14 -08:00
  9501669a24
• tests(js_repl): stabilize CI runtime test execution (#12407)

  ## Summary
  
  Stabilize `js_repl` runtime test setup in CI and move tool-facing
  `js_repl` behavior coverage into integration tests.
  
  This is a test/CI change only. No production `js_repl` behavior change
  is intended.
  
  ## Why
  
  - Bazel test sandboxes (especially on macOS) could resolve a different
  `node` than the one installed by `actions/setup-node`, which caused
  `js_repl` runtime/version failures.
  - `js_repl` runtime tests depend on platform-specific
  sandbox/test-harness behavior, so they need explicit gating in a
  base-stability commit.
  - Several tests in the `js_repl` unit test module were actually
  black-box/tool-level behavior tests and fit better in the integration
  suite.
  
  ## Changes
  
  - Add `actions/setup-node` to the Bazel and Rust `Tests` workflows,
  using the exact version pinned in the repo’s Node version file.
  - In Bazel (non-Windows), pass `CODEX_JS_REPL_NODE_PATH=$(which node)`
  into test env so `js_repl` uses the `actions/setup-node` runtime inside
  Bazel tests.
  - Add a new integration test suite for `js_repl` tool behavior and
  register it in the core integration test suite module.
  - Move black-box `js_repl` behavior tests into the integration suite
  (persistence/TLA, builtin tool invocation, recursive self-call
  rejection, `process` isolation, blocked builtin imports).
  - Keep white-box manager/kernel tests in the `js_repl` unit test module.
  - Gate `js_repl` runtime tests to run only on macOS and only when a
  usable Node runtime is available (skip on other platforms / missing Node
  in this commit).
  
  ## Impact
  
  - Reduces `js_repl` CI failures caused by Node resolution drift in
  Bazel.
  - Improves test organization by separating tool-facing behavior tests
  from white-box manager/kernel tests.
  - Keeps the base commit stable while expanding `js_repl` runtime
  coverage.
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/12372
  - 👉 `2` https://github.com/openai/codex/pull/12407
  - ⏳ `3` https://github.com/openai/codex/pull/12185
  - ⏳ `4` https://github.com/openai/codex/pull/10673

  Curtis 'Fjord' Hawthorne · 2026-02-24 21:04:34 -08:00
  8f3f2c3c02
• chore: migrate additional permissions to PermissionProfile (#12731)

  This PR replaces the old `additional_permissions.fs_read/fs_write` shape
  with a shared `PermissionProfile`
  model and wires it through the command approval, sandboxing, protocol,
  and TUI layers. The schema is adopted from the
  `SkillManifestPermissions`, which is also refactored to use this unified
  struct. This helps us easily expose permission profiles in app
  server/core as a follow-up.

  Celia Chen · 2026-02-25 03:35:28 +00:00
  16ca527c80
• Fix js_repl view_image attachments in nested tool calls (#12725)

  ## Summary
  
  - Fix `js_repl` so `await codex.tool("view_image", { path })` actually
  attaches the image to the active turn when called from inside the JS
  REPL.
  - Restore the behavior expected by the existing `js_repl`
  image-attachment test.
  - This is a follow-up to
  [#12553](https://github.com/openai/codex/pull/12553), which changed
  `view_image` to return structured image content.
  
  ## Root Cause
  
  - [#12553](https://github.com/openai/codex/pull/12553) changed
  `view_image` from directly injecting a pending user image message to
  returning structured `function_call_output` content items.
  - The nested tool-call bridge inside `js_repl` serialized that tool
  response back to the JS runtime, but it did not mirror returned image
  content into the active turn.
  - As a result, `view_image` appeared to succeed inside `js_repl`, but no
  `input_image` was actually attached for the outer turn.
  
  ## What Changed
  
  - Updated the nested tool-call path in `js_repl` to inspect function
  tool responses for structured content items.
  - When a nested tool response includes `input_image` content, `js_repl`
  now injects a corresponding user `Message` into the active turn before
  returning the raw tool result back to the JS runtime.
  - Kept the normal JSON result flow intact, so `codex.tool(...)` still
  returns the original tool output object to JavaScript.
  
  ## Why
  
  - `js_repl` documentation and tests already assume that `view_image` can
  be used from inside the REPL to attach generated images to the model.
  - Without this fix, the nested call path silently dropped that
  attachment behavior.

  Curtis 'Fjord' Hawthorne · 2026-02-24 18:23:53 -08:00
  125fbec317
• Agent jobs (spawn_agents_on_csv) + progress UI (#10935)

  ## Summary
  - Add agent job support: spawn a batch of sub-agents from CSV, auto-run,
  auto-export, and store results in SQLite.
  - Simplify workflow: remove run/resume/get-status/export tools; spawn is
  deterministic and completes in one call.
  - Improve exec UX: stable, single-line progress bar with ETA; suppress
  sub-agent chatter in exec.
  
  ## Why
  Enables map-reduce style workflows over arbitrarily large repos using
  the existing Codex orchestrator. This addresses review feedback about
  overly complex job controls and non-deterministic monitoring.
  
  ## Demo (progress bar)
  ```
  ./codex-rs/target/debug/codex exec \
    --enable collab \
    --enable sqlite \
    --full-auto \
    --progress-cursor \
    -c agents.max_threads=16 \
    -C /Users/daveaitel/code/codex \
    - <<'PROMPT'
  Create /tmp/agent_job_progress_demo.csv with columns: path,area and 30 rows:
  path = item-01..item-30, area = test.
  
  Then call spawn_agents_on_csv with:
  - csv_path: /tmp/agent_job_progress_demo.csv
  - instruction: "Run `python - <<'PY'` to sleep a random 0.3–1.2s, then output JSON with keys: path, score (int). Set score = 1."
  - output_csv_path: /tmp/agent_job_progress_demo_out.csv
  PROMPT
  ```
  
  ## Review feedback addressed
  - Auto-start jobs on spawn; removed run/resume/status/export tools.
  - Auto-export on success.
  - More descriptive tool spec + clearer prompts.
  - Avoid deadlocks on spawn failure; pending/running handled safely.
  - Progress bar no longer scrolls; stable single-line redraw.
  
  ## Tests
  - `cd codex-rs && cargo test -p codex-exec`
  - `cd codex-rs && cargo build -p codex-cli`

  daveaitel-openai · 2026-02-24 21:00:19 +00:00
  dcab40123f
• Ensure shell command skills trigger approval (#12697)

  Summary
  - detect skill-invoking shell commands based on the original command
  string, request approvals when needed, and cache positive decisions per
  session
  - keep implicit skill invocation emitted after approval and keep skill
  approval decline messaging centralized to the shell handler
  - expand and adjust skill approval tests to cover shell-based skill
  scripts while matching the new detection expectations
  
  Testing
  - Not run (not requested)

  pakrym-oai · 2026-02-24 12:13:20 -08:00
  daf0f03ac8
• fix: also try matching namespaced prefix for modelinfo candidate (#12658)

  #### What
  Try matching `\w+`-namespaced model after `longest prefix` as heuristic
  to match `ModelInfo` from list of candidates.
  
  This shouldn't regress existing behavior:
  - `gpt-5.2-codex` -> `gpt-5.2` if `gpt-5.2-codex` not present
  - `gpt-5.3` -> `gpt-5` if `gpt-5.3` not present
  - `gpt-9` still doesn't match anything
  
  while being more forgiving for custom prefixes:
  - `oai/gpt-5.3-codex` -> `gpt-5.3-codex`
  
  #### Tests
  Added unit test.

  sayan-oai · 2026-02-24 10:57:26 -08:00
  0b6c2e5652
• feat(core) Introduce Feature::RequestPermissions (#11871)

  ## Summary
  Introduces the initial implementation of Feature::RequestPermissions.
  RequestPermissions allows the model to request that a command be run
  inside the sandbox, with additional permissions, like writing to a
  specific folder. Eventually this will include other rules as well, and
  the ability to persist these permissions, but this PR is already quite
  large - let's get the core flow working and go from there!
  
  <img width="1279" height="541" alt="Screenshot 2026-02-15 at 2 26 22 PM"
  src="https://github.com/user-attachments/assets/0ee3ec0f-02ec-4509-91a2-809ac80be368"
  />
  
  ## Testing
  - [x] Added tests
  - [x] Tested locally
  - [x] Feature

  Dylan Hurd · 2026-02-24 09:48:57 -08:00
  f6053fdfb3
• Send warmup request (#11258)

  Send a request with `generate: falls` but a full set of tools and
  instructions to pre-warm inference.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  pakrym-oai · 2026-02-24 08:15:47 -08:00
  97d0068658
• chore: rm hardcoded PRESETS list (#12650)

  rm `PRESETS` list harcoded in `model_presets` as we now have bundled
  `models.json` with equivalent info.
  
  update logic to rely on bundled models instead, update tests.

  sayan-oai · 2026-02-23 22:35:51 -08:00
  7e46e5b9c2
• Add skill approval event/response (#12633)

  Set the stage for skill-level permission approval in addition to
  command-level.
  
  Behind a feature flag.

  pakrym-oai · 2026-02-23 22:28:58 -08:00
  58763afa0f
• feat(core): persist network approvals in execpolicy (#12357)

  ## Summary
  Persist network approval allow/deny decisions as `network_rule(...)`
  entries in execpolicy (not proxy config)
  
  It adds `network_rule` parsing + append support in `codex-execpolicy`,
  including `decision="prompt"` (parse-only; not compiled into proxy
  allow/deny lists)
  - compile execpolicy network rules into proxy allow/deny lists and
  update the live proxy state on approval
  - preserve requirements execpolicy `network_rule(...)` entries when
  merging with file-based execpolicy
  - reject broad wildcard hosts (for example `*`) for persisted
  `network_rule(...)`

  viyatb-oai · 2026-02-23 21:37:46 -08:00
  c3048ff90a
• Handle realtime spawn_transcript delegation (#12619)
  Ahmed Ibrahim · 2026-02-23 14:39:07 -08:00
  10a3adad8e
• Return image content from view_image (#12553)

  Responses API supports image content

  pakrym-oai · 2026-02-22 23:00:08 -08:00
  335a4e1cbc
• test: vendor zsh fork via DotSlash and stabilize zsh-fork tests (#12518)

  ## Why
  
  The zsh integration tests were still brittle in two ways:
  
  - they relied on `CODEX_TEST_ZSH_PATH` / environment-specific setup, so
  they often did not exercise the patched zsh fork that `shell-tool-mcp`
  ships
  - once the tests consistently used the vendored zsh fork, they exposed
  real Linux-specific zsh-fork issues in CI
  
  In particular, the Linux failures were not just test noise:
  
  - the zsh-fork launch path was dropping `ExecRequest.arg0`, so Linux
  `codex-linux-sandbox` arg0 dispatch did not run and zsh wrapper-mode
  could receive malformed arguments
  - the
  `turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2`
  test uses the zsh exec bridge (which talks to the parent over a Unix
  socket), but Linux restricted sandbox seccomp denies `connect(2)`,
  causing timeouts on `ubuntu-24.04` x86/arm
  
  This PR makes the zsh tests consistently run against the intended
  vendored zsh fork and fixes/hardens the zsh-fork path so the Linux CI
  signal is meaningful.
  
  ## What Changed
  
  - Added a single shared test-only DotSlash file for the patched zsh fork
  at `codex-rs/exec-server/tests/suite/zsh` (analogous to the existing
  `bash` test resource).
  - Updated both app-server and exec-server zsh tests to use that shared
  DotSlash zsh (no duplicate zsh DotSlash file, no `CODEX_TEST_ZSH_PATH`
  dependency).
  - Updated the app-server zsh-fork test helper to resolve the shared
  DotSlash zsh and avoid silently falling back to host zsh.
  - Kept the app-server zsh-fork tests configured via `config.toml`, using
  a test wrapper path where needed to force `zsh -df` (and rewrite `-lc`
  to `-c`) for the subcommand-decline test.
  - Hardened the app-server subcommand-decline zsh-fork test for CI
  variability:
    - tolerate an extra `/responses` POST with a no-op mock response
  - tolerate non-target approval ordering while remaining strict on the
  two `/usr/bin/true` approvals and decline behavior
  - use `DangerFullAccess` on Linux for this one test because it validates
  zsh approval flow, not Linux sandbox socket restrictions
  - Fixed zsh-fork process launching on Linux by preserving `req.arg0` in
  `ZshExecBridge::execute_shell_request(...)` so `codex-linux-sandbox`
  arg0 dispatch continues to work.
  - Moved `maybe_run_zsh_exec_wrapper_mode()` under
  `arg0_dispatch_or_else(...)` in `app-server` and `cli` so wrapper-mode
  handling coexists correctly with arg0-dispatched helper modes.
  - Consolidated duplicated `dotslash -- fetch` resolution logic into
  shared test support (`core/tests/common/lib.rs`).
  - Updated `codex-rs/exec-server/tests/suite/accept_elicitation.rs` to
  use DotSlash zsh and hardened the zsh elicitation test for Bazel/zsh
  differences by:
    - resolving an absolute `git` path
    - running `git init --quiet .`
  - asserting success / `.git` creation instead of relying on banner text
  
  ## Verification
  
  - `cargo test -p codex-app-server turn_start_zsh_fork -- --nocapture`
  - `cargo test -p codex-exec-server accept_elicitation -- --nocapture`
  - `bazel test //codex-rs/exec-server:exec-server-all-test
  --test_output=streamed --test_arg=--nocapture
  --test_arg=accept_elicitation_for_prompt_rule_with_zsh`
  - CI (`rust-ci`) on the final cleaned commit: `Tests — ubuntu-24.04 -
  x86_64-unknown-linux-gnu` and `Tests — ubuntu-24.04-arm -
  aarch64-unknown-linux-gnu` passed in [run
  22291424358](https://github.com/openai/codex/actions/runs/22291424358)

  Michael Bolin · 2026-02-22 19:39:56 -08:00
  e8949f4507
• Revert "Revert "Route inbound realtime text into turn start or steer"" (#12480)

  With working tests this time
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-02-22 11:54:16 -08:00
  e00fa19328