1221 Commits

• add error messages for the go plan type (#10181)

  Adds support for the Go plan type
  Updates rate limit error messages to point to the usage page

  willwang-openai · 2026-01-30 01:17:25 +00:00
  a9cf449a80
• [feat] persist dynamic tools in session rollout file (#10130)

  Add dynamic tools to rollout file for persistence & read from rollout on
  resume. Ran a real example and spotted the following in the rollout
  file:
  ```
  {"timestamp":"2026-01-29T01:27:57.468Z","type":"session_meta","payload":{"id":"019c075d-3f0b-77e3-894e-c1c159b04b1e","timestamp":"2026-01-29T01:27:57.451Z","...."dynamic_tools":[{"name":"demo_tool","description":"Demo dynamic tool","inputSchema":{"additionalProperties":false,"properties":{"city":{"type":"string"}},"required":["city"],"type":"object"}}],"git":{"commit_hash":"ebc573f15c01b8af158e060cfedd401f043e9dfa","branch":"dev/cc/dynamic-tools","repository_url":"https://github.com/openai/codex.git"}}}
  ```

  Celia Chen · 2026-01-30 01:10:00 +00:00
  7151387474
• feat(app-server): support external auth mode (#10012)

  This enables a new use case where `codex app-server` is embedded into a
  parent application that will directly own the user's ChatGPT auth
  lifecycle, which means it owns the user’s auth tokens and refreshes it
  when necessary. The parent application would just want a way to pass in
  the auth tokens for codex to use directly.
  
  The idea is that we are introducing a new "auth mode" currently only
  exposed via app server: **`chatgptAuthTokens`** which consist of the
  `id_token` (stores account metadata) and `access_token` (the bearer
  token used directly for backend API calls). These auth tokens are only
  stored in-memory. This new mode is in addition to the existing `apiKey`
  and `chatgpt` auth modes.
  
  This PR reuses the shape of our existing app-server account APIs as much
  as possible:
  - Update `account/login/start` with a new `chatgptAuthTokens` variant,
  which will allow the client to pass in the tokens and have codex
  app-server use them directly. Upon success, the server emits
  `account/login/completed` and `account/updated` notifications.
  - A new server->client request called
  `account/chatgptAuthTokens/refresh` which the server can use whenever
  the access token previously passed in has expired and it needs a new one
  from the parent application.
  
  I leveraged the core 401 retry loop which typically triggers auth token
  refreshes automatically, but made it pluggable:
  - **chatgpt** mode refreshes internally, as usual.
  - **chatgptAuthTokens** mode calls the client via
  `account/chatgptAuthTokens/refresh`, the client responds with updated
  tokens, codex updates its in-memory auth, then retries. This RPC has a
  10s timeout and handles JSON-RPC errors from the client.
  
  Also some additional things:
  - chatgpt logins are blocked while external auth is active (have to log
  out first. typically clients will pick one OR the other, not support
  both)
  - `account/logout` clears external auth in memory
  - Ensures that if `forced_chatgpt_workspace_id` is set via the user's
  config, we respect it in both:
  - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC
  error back to the client)
  - `account/chatgptAuthTokens/refresh` (fails the turn, and on next
  request app-server will send another `account/chatgptAuthTokens/refresh`
  request to the client).

  Owen Lin · 2026-01-29 23:46:04 +00:00
  81a17bb2c1
• [Codex][CLI] Show model-capacity guidance on 429 (#10118)

  ###### Problem
  Users get generic 429s with no guidance when a model is at capacity.
  ###### Solution
  Detect model-cap headers, surface a clear “try a different model”
  message, and keep behavior non‑intrusive (no auto‑switch).
  ###### Scope
  CLI/TUI only; protocol + error mapping updated to carry model‑cap info.
  ###### Tests
        - just fmt
        - cargo test -p codex-tui
  - cargo test -p codex-core --lib
  shell_snapshot::tests::try_new_creates_and_deletes_snapshot_file --
  --nocapture (ran in isolated env)
        - validate local build with backend
       
  <img width="719" height="845" alt="image"
  src="https://github.com/user-attachments/assets/1470b33d-0974-4b1f-b8e6-d11f892f4b54"
  />

  Colin Young · 2026-01-29 14:59:07 -08:00
  b79bf69af6
• Remove WebSocket wire format (#10179)

  I'd like WireApi to go away (when chat is removed) and WebSockets is
  still responses API just over a different transport.

  pakrym-oai · 2026-01-29 13:50:53 -08:00
  fbb3a30953
• Better handling skill depdenencies on ENV VAR. (#9017)

  An experimental flow for env var skill dependencies. Skills can now
  declare required env vars in SKILL.md; if missing, the CLI prompts the
  user to get the value, and Core will store it in memory (eventually to a
  local persistent store)
  <img width="790" height="169" alt="image"
  src="https://github.com/user-attachments/assets/cd928918-9403-43cb-a7e7-b8d59bcccd9a"
  />

  xl-openai · 2026-01-29 14:13:30 -05:00
  bdd8a7d58b
• Fall back to http when websockets fail (#10139)

  I expect not all proxies work with websockets, fall back to http if
  websockets fail.

  pakrym-oai · 2026-01-29 10:36:21 -08:00
  3b1cddf001
• feat: reduce span exposition (#10171)

  This only avoids the creation of duplicates spans

  jif-oai · 2026-01-29 18:15:22 +00:00
  798c4b3260
• feat: adding thread ID to logs + filter in the client (#10150)
  jif-oai · 2026-01-29 16:53:30 +01:00
  89c5f3c4d4
• feat: async backfill (#10089)
  jif-oai · 2026-01-29 09:57:50 +00:00
  714dc8d8bd
• feat: add log db (#10086)

  Add a log DB. The goal is just to store our logs in a `.sqlite` DB to
  make it easier to crawl them and drop the oldest ones.

  jif-oai · 2026-01-29 10:23:03 +01:00
  780482da84
• emit a metric when we can't spawn powershell (#10125)

  This will help diagnose and measure the impact of a user-reported bug
  with the elevated sandbox and powershell

  iceweasel-oai · 2026-01-28 21:51:51 -08:00
  8cc338aecf
• chore(core) personality under development (#10133)

  ## Summary
  Have one or two more changes coming in for this.

  Dylan Hurd · 2026-01-28 22:00:48 -07:00
  335713f7e9
• [connectors] Support connectors part 2 - slash command and tui (#9728)

  - [x] Support `/apps` slash command to browse the apps in tui.
  - [x] Support inserting apps to prompt using `$`.
  - [x] Lots of simplification/renaming from connectors to apps.

  Matthew Zeng · 2026-01-28 19:51:58 -08:00
  b9cd089d1f
• chore(config) personality as a feature (#10116)

  ## Summary
  Sets up an explicit Feature flag for `/personality`, so users can now
  opt in to it via `/experimental`. #10114 also updates the config
  
  ## Testing
  - [x] Tested locally

  Dylan Hurd · 2026-01-28 17:58:28 -07:00
  ce3d764ae1
• Ensure auto-compaction starts after turn started (#10129)

  Start auto-compaction only after TurnStarted is emitted.\nAdd an
  integration test for deterministic ordering.

  Ahmed Ibrahim · 2026-01-28 16:51:20 -08:00
  26590d7927
• default enable compression, update test helpers (#10102)

  set `enable_request_compression` flag to default-enabled.
  
  update integration test helpers to decompress `zstd` if flag set.

  sayan-oai · 2026-01-28 12:25:40 -08:00
  ff9fa56368
• Added tui.notifications_method config option (#10043)

  This PR adds a new `tui.notifications_method` config option that accepts
  values of "auto", "osc9" and "bel". It defaults to "auto", which
  attempts to auto-detect whether the terminal supports OSC 9 escape
  sequences and falls back to BEL if not.
  
  The PR also removes the inconsistent handling of notifications on
  Windows when WSL was used.

  Eric Traut · 2026-01-28 12:00:32 -08:00
  147e7118e0
• allow elevated sandbox to be enabled without base experimental flag (#10028)

  elevated flag = elevated sandbox
  experimental flag = non-elevated sandbox
  both = elevated

  iceweasel-oai · 2026-01-28 11:38:29 -08:00
  66de985e4e
• compaction (#10034)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-28 11:36:11 -08:00
  b7edeee8ca
• chore: deprecate old web search feature flags (#10097)

  deprecate all old web search flags and aliases, including:
  - `[features].web_search_request` and `[features].web_search_cached`
  - `[tools].web_search`
  - `[features].web_search`
  
  slightly rework `legacy_usages` to enable pointing to non-features from
  deprecated features; we need to point to `web_search` (not under
  `[features]`) from things like `[features].web_search_cached` and
  `[features].web_search_request`.
  
  Added integration tests to confirm deprecation notice is shown on
  explicit enablement and disablement of deprecated flags.

  sayan-oai · 2026-01-28 10:55:57 -08:00
  851617ff5a
• file-search: improve file query perf (#9939)

  switch nucleo-matcher for nucleo and use a "file search session" w/ live
  updating query instead of a single hermetic run per query.

  Jeremy Rose · 2026-01-28 10:54:43 -08:00
  b8156706e6
• feat: sort metadata by date (#10083)
  jif-oai · 2026-01-28 16:19:08 +01:00
  231406bd04
• feat: sqlite 1 (#10004)

  Add a `.sqlite` database to be used to store rollout metatdata (and
  later logs)
  This PR is phase 1:
  * Add the database and the required infrastructure
  * Add a backfill of the database
  * Persist the newly created rollout both in files and in the DB
  * When we need to get metadata or a rollout, consider the `JSONL` as the
  source of truth but compare the results with the DB and show any errors

  jif-oai · 2026-01-28 15:29:14 +01:00
  3878c3dc7c
• Add exec policy TOML representation (#10026)

  We'd like to represent these in `requirements.toml`. This just adds the
  representation and the tests, doesn't wire it up anywhere yet.

  gt-oai · 2026-01-28 12:00:10 +00:00
  71b8d937ed
• feat(core) RequestRule (#9489)

  ## Summary
  Instead of trying to derive the prefix_rule for a command mechanically,
  let's let the model decide for us.
  
  ## Testing
  - [x] tested locally

  Dylan Hurd · 2026-01-28 08:43:17 +00:00
  996e09ca24
• error code/msg details for failed elevated setup (#9941)
  iceweasel-oai · 2026-01-27 23:06:10 -08:00
  9f79365691
• fix(core) info cleanup (#9986)

  ## Summary
  Simplify this logic a bit.

  Dylan Hurd · 2026-01-27 21:15:15 -07:00
  fef3e36f67
• [skills] Auto install MCP dependencies when running skils with dependency specs. (#9982)

  Auto install MCP dependencies when running skils with dependency specs.

  Matthew Zeng · 2026-01-27 19:02:45 -08:00
  3bb8e69dd3
• fix: allow unknown fields on Notice in schema (#10041)

  the `notice` field didn't allow unknown fields in the schema, leading to
  issues where they shouldn't be.
  
  Now we allow unknown fields.
  
  <img width="2260" height="720" alt="image"
  src="https://github.com/user-attachments/assets/1de43b60-0d50-4a96-9c9c-34419270d722"
  />

  sayan-oai · 2026-01-27 18:24:24 -08:00
  1609f6aa81
• fix: enable per-turn updates to web search mode (#10040)

  web_search can now be updated per-turn, for things like changes to
  sandbox policy.
  
  `SandboxPolicy::DangerFullAccess` now sets web_search to `live`, and the
  default is still `cached`.
  
  Added integration tests.

  sayan-oai · 2026-01-27 18:09:29 -08:00
  a90ab789c2
• enable live web search for DangerFullAccess sandbox policy (#10008)

  Auto-enable live `web_search` tool when sandbox policy is
  `DangerFullAccess`.
  
  Explicitly setting `web_search` (canonical setting), or enabling
  `web_search_cached` or `web_search_request` still takes precedence over
  this sandbox-policy-driven enablement.

  sayan-oai · 2026-01-27 20:09:05 +00:00
  28051d18c6
• Remove load from SKILL.toml fallback (#10007)
  alexsong-oai · 2026-01-27 12:06:40 -08:00
  2f8a44baea
• remove sandbox globals. (#9797)

  Threads sandbox updates through OverrideTurnContext for active turn
  Passes computed sandbox type into safety/exec

  iceweasel-oai · 2026-01-27 11:04:23 -08:00
  c40ad65bd8
• fix(app-server, core): defer initial context write to rollout file until first turn (#9950)

  ### Overview
  Currently calling `thread/resume` will always bump the thread's
  `updated_at` timestamp. This PR makes it the `updated_at` timestamp
  changes only if a turn is triggered.
  
  ### Additonal context
  What we typically do on resuming a thread is **always** writing “initial
  context” to the rollout file immediately. This initial context includes:
  - Developer instructions derived from sandbox/approval policy + cwd
  - Optional developer instructions (if provided)
  - Optional collaboration-mode instructions
  - Optional user instructions (if provided)
  - Environment context (cwd, shell, etc.)
  
  This PR defers writing the “initial context” to the rollout file until
  the first `turn/start`, so we don't inadvertently bump the thread's
  `updated_at` timestamp until a turn is actually triggered.
  
  This works even though both `thread/resume` and `turn/start` accept
  overrides (such as `model`, `cwd`, etc.) because the initial context is
  seeded from the effective `TurnContext` in memory, computed at
  `turn/start` time, after both sets of overrides have been applied.
  
  **NOTE**: This is a very short-lived solution until we introduce sqlite.
  Then we can remove this.

  Owen Lin · 2026-01-27 10:41:54 -08:00
  fc0fd85349
• description in role type (#9993)
  jif-oai · 2026-01-27 17:20:07 +00:00
  067922a734
• nit: better tool description (#9988)
  jif-oai · 2026-01-27 12:46:51 +00:00
  742f086ee6
• Fix: cap aggregated exec output consistently (#9759)

  ## WHAT?
  - Bias aggregated output toward stderr under contention (2/3 stderr, 1/3
  stdout) while keeping the 1 MiB cap.
  - Rebalance unused stderr share back to stdout when stderr is tiny to
  avoid underfilling.
  - Add tests for contention, small-stderr rebalance, and under-cap
  ordering (stdout then stderr).
  
  ## WHY?
  - Review feedback requested stderr priority under contention.
  - Avoid underfilled aggregated output when stderr is small while
  preserving a consistent cap across exec paths.
  
  ## HOW?
  - Update `aggregate_output` to compute stdout/stderr shares, then
  reassign unused capacity to the other stream.
  - Use the helper in both Windows and async exec paths.
  - Add regression tests for contention/rebalance and under-cap ordering.
  
  ## BEFORE
  ```rust
  // Best-effort aggregate: stdout then stderr (capped).
  let mut aggregated = Vec::with_capacity(
      stdout
          .text
          .len()
          .saturating_add(stderr.text.len())
          .min(EXEC_OUTPUT_MAX_BYTES),
  );
  append_capped(&mut aggregated, &stdout.text, EXEC_OUTPUT_MAX_BYTES);
  append_capped(&mut aggregated, &stderr.text, EXEC_OUTPUT_MAX_BYTES);
  let aggregated_output = StreamOutput {
      text: aggregated,
      truncated_after_lines: None,
  };
  ```
  
  ## AFTER
  ```rust
  fn aggregate_output(
      stdout: &StreamOutput<Vec<u8>>,
      stderr: &StreamOutput<Vec<u8>>,
  ) -> StreamOutput<Vec<u8>> {
      let total_len = stdout.text.len().saturating_add(stderr.text.len());
      let max_bytes = EXEC_OUTPUT_MAX_BYTES;
      let mut aggregated = Vec::with_capacity(total_len.min(max_bytes));
  
      if total_len <= max_bytes {
          aggregated.extend_from_slice(&stdout.text);
          aggregated.extend_from_slice(&stderr.text);
          return StreamOutput {
              text: aggregated,
              truncated_after_lines: None,
          };
      }
  
      // Under contention, reserve 1/3 for stdout and 2/3 for stderr; rebalance unused stderr to stdout.
      let want_stdout = stdout.text.len().min(max_bytes / 3);
      let want_stderr = stderr.text.len();
      let stderr_take = want_stderr.min(max_bytes.saturating_sub(want_stdout));
      let remaining = max_bytes.saturating_sub(want_stdout + stderr_take);
      let stdout_take = want_stdout + remaining.min(stdout.text.len().saturating_sub(want_stdout));
  
      aggregated.extend_from_slice(&stdout.text[..stdout_take]);
      aggregated.extend_from_slice(&stderr.text[..stderr_take]);
  
      StreamOutput {
          text: aggregated,
          truncated_after_lines: None,
      }
  }
  ```
  
  ## TESTS
  - [x] `just fmt`
  - [x] `just fix -p codex-core`
  - [x] `cargo test -p codex-core aggregate_output_`
  - [x] `cargo test -p codex-core`
  - [x] `cargo test --all-features`
  
  ## FIXES
  Fixes #9758

  K Bediako · 2026-01-27 09:29:12 +00:00
  ab99df0694
• Fixing main and make plan mode reasoning effort medium (#9980)

  It's overthinking so much on high and going over the context window.

  Ahmed Ibrahim · 2026-01-26 22:30:24 -08:00
  509ff1c643
• make cached web_search client-side default (#9974)

  [Experiment](https://console.statsig.com/50aWbk2p4R76rNX9lN5VUw/experiments/codex_web_search_rollout/summary)
  for default cached `web_search` completed; cached chosen as default.
  
  Update client to reflect that.

  sayan-oai · 2026-01-26 21:25:40 -08:00
  0adcd8aa86
• fix: handle all web_search actions and in progress invocations (#9960)

  ### Summary
  - Parse all `web_search` tool actions (`search`, `find_in_page`,
  `open_page`).
  - Previously we only parsed + displayed `search`, which made the TUI
  appear to pause when the other actions were being used.
  - Show in progress `web_search` calls as `Searching the web`
    - Previously we only showed completed tool calls
  
  <img width="308" height="149" alt="image"
  src="https://github.com/user-attachments/assets/90a4e8ff-b06a-48ff-a282-b57b31121845"
  />
  
  ### Tests
  Added + updated tests, tested locally
  
  ### Follow ups
  Update VSCode extension to display these as well

  sayan-oai · 2026-01-27 03:33:48 +00:00
  86adf53235
• Warn users on enabling underdevelopment features (#9954)

  <img width="938" height="73" alt="image"
  src="https://github.com/user-attachments/assets/a2d5ac46-92c5-4828-b35e-0965c30cdf36"
  />

  Ahmed Ibrahim · 2026-01-27 01:58:05 +00:00
  c900de271a
• feat: load interface metadata from SKILL.json (#9953)
  alexsong-oai · 2026-01-27 01:38:06 +00:00
  a641a6427c
• Reject request_user_input outside Plan/Pair (#9955)

  ## Context
  
  Previous work in https://github.com/openai/codex/pull/9560 only rejected
  `request_user_input` in Execute and Custom modes. Since then, additional
  modes
  (e.g., Code) were added, so the guard should be mode-agnostic.
  
  ## What changed
  
  - Switch the handler to an allowlist: only Plan and PairProgramming are
  allowed
  - Return the same error for any other mode (including Code)
  - Add a Code-mode rejection test alongside the existing Execute/Custom
  tests
  
  ## Why
  
  This prevents `request_user_input` from being used in modes where it is
  not
  intended, even as new modes are introduced.

  Charley Cunningham · 2026-01-26 17:12:17 -08:00
  47aa1f3b6a
• Add composer config and shared menu surface helpers (#9891)

  Centralize built-in slash-command gating and extract shared menu-surface
  helpers.
  
  - Add bottom_pane::slash_commands and reuse it from composer + command
  popup.
  - Introduce ChatComposerConfig + shared menu surface rendering without
  changing default behavior.

  Ahmed Ibrahim · 2026-01-26 23:16:29 +00:00
  a8f195828b
• Add MCP server scopes config and use it as fallback for OAuth login (#9647)

  ### Motivation
  - Allow MCP OAuth flows to request scopes defined in `config.toml`
  instead of requiring users to always pass `--scopes` on the CLI.
  CLI/remote parameters should still override config values.
  
  ### Description
  - Add optional `scopes: Option<Vec<String>>` to `McpServerConfig` and
  `RawMcpServerConfig`, and propagate it through deserialization and the
  built config types.
  - Serialize `scopes` into the MCP server TOML via
  `serialize_mcp_server_table` in `core/src/config/edit.rs` and include
  `scopes` in the generated config schema (`core/config.schema.json`).
  - CLI: update `codex-rs/cli/src/mcp_cmd.rs` `run_login` to fall back to
  `server.scopes` when the `--scopes` flag is empty, with explicit CLI
  scopes still taking precedence.
  - App server: update
  `codex-rs/app-server/src/codex_message_processor.rs`
  `mcp_server_oauth_login` to use `params.scopes.or_else(||
  server.scopes.clone())` so the RPC path also respects configured scopes.
  - Update many test fixtures to initialize the new `scopes` field (set to
  `None`) so test code builds with the new struct field.
  
  ### Testing
  - Ran config tooling and formatters: `just write-config-schema`
  (succeeded), `just fmt` (succeeded), and `just fix -p codex-core`, `just
  fix -p codex-cli`, `just fix -p codex-app-server` (succeeded where
  applicable).
  - Ran unit tests for the CLI: `cargo test -p codex-cli` (passed).
  - Ran unit tests for core: `cargo test -p codex-core` (ran; many tests
  passed but several failed, including model refresh/403-related tests,
  shell snapshot/timeouts, and several `unified_exec` expectations).
  - Ran app-server tests: `cargo test -p codex-app-server` (ran; many
  integration-suite tests failed due to mocked/remote HTTP 401/403
  responses and wiremock expectations).
  
  If you want, I can split the tests into smaller focused runs or help
  debug the failing integration tests (they appear to be unrelated to the
  config change and stem from external HTTP/mocking behaviors encountered
  during the test runs).
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69718f505914832ea1f334b3ba064553)

  blevy-oai · 2026-01-26 14:13:04 -08:00
  bdc4742bfc
• Aligned feature stage names with public feature maturity stages (#9929)

  We've recently standardized a [feature maturity
  model](https://developers.openai.com/codex/feature-maturity) that we're
  using in our docs and support forums to communicate expectations to
  users. This PR updates the internal stage names and descriptions to
  match.
  
  This change involves a simple internal rename and updates to a few
  user-visible strings. No functional change.

  Eric Traut · 2026-01-26 11:43:36 -08:00
  b77bf4d36d
• Add thread/unarchive to restore archived rollouts (#9843)

  ## Summary
  - Adds a new `thread/unarchive` RPC to move archived thread rollouts
  back into the active `sessions/` tree.
  
  ## What changed
  - **Protocol**
    - Adds `thread/unarchive` request/response types and wiring.
  - **Server**
    - Implements `thread_unarchive` in the app server.
    - Validates the archived rollout path and thread ID.
  - Restores the rollout to `sessions/YYYY/MM/DD/...` based on the rollout
  filename timestamp.
  - **Core**
  - Adds `find_archived_thread_path_by_id_str` helper for archived
  rollouts.
  - **Docs**
    - Documents the new RPC and usage example.
  - **Tests**
    - Adds an end-to-end server test that:
      1) starts a thread,
      2) archives it,
      3) unarchives it,
      4) asserts the file is restored to `sessions/`.
  
  ## How to use
  ```json
  { "method": "thread/unarchive", "id": 24, "params": { "threadId": "<thread-id>" } }
  ```
  
  ## Author Codex Session
  
  `codex resume 019bf158-54b6-7960-a696-9d85df7e1bc1` (soon I'll make this
  kind of session UUID forkable by anyone with the right
  `session_object_storage_url` line in their config, but for now just
  pasting it here for my reference)

  Charley Cunningham · 2026-01-26 11:24:36 -08:00
  62266b13f8
• chore: update interrupt message (#9925)
  jif-oai · 2026-01-26 19:07:54 +00:00
  09251387e0
• fix: attempt to reduce high cpu usage when using collab (#9776)

  Reproduce with a prompt like this with collab enabled:
  ```
  Examine the code at <some subdirectory with a deeply nested project>.  Find the most urgent issue to resolve and describe it to me.
  ```
  
  Existing behavior causes the top-level agent to busy wait on subagents.

  Gene Oden · 2026-01-26 10:07:25 -08:00
  375a5ef051