2675 Commits

• Add use_agent_identity feature flag (#17385)
  Adrian · 2026-04-11 09:52:06 -07:00
  39cc85310f
• Fix thread/list cwd filtering for Windows verbatim paths (#17414)

  Addresses #17302
  
  Problem: `thread/list` compared cwd filters with raw path equality, so
  `resume --last` could miss Windows sessions when the saved cwd used a
  verbatim path form and the current cwd did not.
  
  Solution: Normalize cwd comparisons through the existing path comparison
  utilities before falling back to direct equality, and add Windows
  regression coverage for verbatim paths. I made this a general utility
  function and replaced all of the duplicated instance of it across the
  code base.

  Eric Traut · 2026-04-10 23:08:02 -07:00
  e9e7ef3d36
• [mcp] Support MCP Apps part 3 - Add mcp tool call support. (#17364)

  - [x] Add a new app-server method so that MCP Apps can call their own
  MCP server directly.

  Matthew Zeng · 2026-04-11 04:39:19 +00:00
  b7139a7e8f
• representing guardian review timeouts in protocol types (#17381)

  ## Summary
  
  - Add `TimedOut` to Guardian/review carrier types:
    - `ReviewDecision::TimedOut`
    - `GuardianAssessmentStatus::TimedOut`
    - app-server v2 `GuardianApprovalReviewStatus::TimedOut`
  - Regenerate app-server JSON/TypeScript schemas for the new wire shape.
  - Wire the new status through core/app-server/TUI mappings with
  conservative fail-closed handling.
  - Keep `TimedOut` non-user-selectable in the approval UI.
  
  **Does not change runtime behavior yet; emitting `TimeOut` and
  parent-model timeout messaging will come in followup PRs**

  Won Park · 2026-04-10 20:02:33 -07:00
  37aac89a6d
• Add marketplace command (#17087)

  Added a new top-level `codex marketplace add` command for installing
  plugin marketplaces into Codex’s local marketplace cache.
  
  This change adds source parsing for local directories, GitHub shorthand,
  and git URLs, supports optional `--ref` and git-only `--sparse` checkout
  paths, stages the source in a temp directory, validates the marketplace
  manifest, and installs it under
  `$CODEX_HOME/marketplaces/<marketplace-name>`
  
  Included tests cover local install behavior in the CLI and marketplace
  discovery from installed roots in core. Scoped formatting and fix passes
  were run, and targeted CLI/core tests passed.

  xli-oai · 2026-04-10 19:18:37 -07:00
  f9a8d1870f
• feat(analytics): add guardian review event schema (#17055)

  Just the analytics schema definition for guardian evaluations. No wiring
  done yet.

  Owen Lin · 2026-04-10 17:33:58 -07:00
  58933237cd
• fix(permissions): fix symlinked writable roots in sandbox permissions (#15981)

  ## Summary
  - preserve logical symlink paths during permission normalization and
  config cwd handling
  - bind real targets for symlinked readable/writable roots in bwrap and
  remap carveouts and unreadable roots there
  - add regressions for symlinked carveouts and nested symlink escape
  masking
  
  ## Root cause
  Permission normalization canonicalized symlinked writable roots and cwd
  to their real targets too early. That drifted policy checks away from
  the logical paths the sandboxed process can actually address, while
  bwrap still needed the real targets for mounts. The mismatch caused
  shell and apply_patch failures on symlinked writable roots.
  
  ## Impact
  Fixes #15781.
  
  Also fixes #17079:
  - #17079 is the protected symlinked carveout side: bwrap now binds the
  real symlinked writable-root target and remaps carveouts before masking.
  
  Related to #15157:
  - #15157 is the broader permission-check side of this path-identity
  problem. This PR addresses the shared logical-vs-canonical normalization
  issue, but the reported Darwin prompt behavior should be validated
  separately before auto-closing it.
  
  This should also fix #14672, #14694, #14715, and #15725:
  - #14672, #14694, and #14715 are the same Linux
  symlinked-writable-root/bwrap family as #15781.
  - #15725 is the protected symlinked workspace path variant; the PR
  preserves the protected logical path in policy space while bwrap applies
  read-only or unreadable treatment to the resolved target so
  file-vs-directory bind mismatches do not abort sandbox setup.
  
  ## Notes
  - Added Linux-only regressions for symlinked writable ancestors and
  protected symlinked directory targets, including nested symlink escape
  masking without rebinding the escape target writable.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-10 17:00:58 -07:00
  b114781495
• Revert "Option to Notify Workspace Owner When Usage Limit is Reached" (#17391)

  Reverts openai/codex#16969
  
  #sev3-2026-04-10-accountscheckversion-500s-for-openai-workspace-7300

  Shijie Rao · 2026-04-10 23:33:13 +00:00
  930e5adb7e
• fix(guardian, app-server): introduce guardian review ids (#17298)

  ## Description
  
  This PR introduces `review_id` as the stable identifier for guardian
  reviews and exposes it in app-server `item/autoApprovalReview/started`
  and `item/autoApprovalReview/completed` events.
  
  Internally, guardian rejection state is now keyed by `review_id` instead
  of the reviewed tool item ID. `target_item_id` is still included when a
  review maps to a concrete thread item, but it is no longer overloaded as
  the review lifecycle identifier.
  
  ## Motivation
  
  We'd like to give users the ability to preempt a guardian review while
  it's running (approve or decline).
  
  However, we can't implement the API that allows the user to override a
  running guardian review because we didn't have a unique `review_id` per
  guardian review. Using `target_item_id` is not correct since:
  - with execve reviews, there can be multiple execve calls (and therefore
  guardian reviews) per shell command
  - with network policy reviews, there is no target item ID
  
  The PR that actually implements user overrides will use `review_id` as
  the stable identifier.

  Owen Lin · 2026-04-10 16:21:02 -07:00
  a3be74143a
• Support clear SessionStart source (#17073)

  ## Motivation
  
  The `SessionStart` hook already receives `startup` and `resume` sources,
  but sessions created from `/clear` previously looked like normal startup
  sessions. This makes it impossible for hook authors to distinguish
  between these with the matcher.
  
  ## Summary
  
  - Add `InitialHistory::Cleared` so `/clear`-created sessions can be
  distinguished from ordinary startup sessions.
  - Add `SessionStartSource::Clear` and wire it through core, app-server
  thread start params, and TUI clear-session flow.
  - Update app-server protocol schemas, generated TypeScript, docs, and
  related tests.
  
  
  https://github.com/user-attachments/assets/9cae3cb4-41c7-4d06-b34f-966252442e5c

  Abhinav · 2026-04-10 16:05:21 -07:00
  7999b0f60f
• add parent-id to guardian context (#17194)

  adding parent codex session id to guardian prompt

  Won Park · 2026-04-10 13:57:56 -07:00
  147cb84112
• [codex-analytics] add compaction analytics event (#17155)

  - event for compaction analytics
  - introduces thread-connection and thread metadata caches for data
  denormalization, expected to be useful for denormalization onto core
  emitted events in general
  - threads analytics event client into core (mirrors approved
  implementation in #16640)
  - denormalizes key thread metadata: thread_source, subagent_source,
  parent_thread_id, as well as app-server client and runtime metadata)
  - compaction strategy defaults to memento, forward compatible with
  expected prefill_compaction strategy
  
  1. Manual standalone compact, local
  `INFO | 2026-04-09 17:35:50 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d0-5cfb-70c0-bef9-165c3bf9b2df', 'turn_id':
  '019d74d0-d7f6-7c81-acc6-aae2030243d6', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20170, 'active_context_tokens_after':
  4830, 'started_at': 1775781337, 'completed_at': 1775781350,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 13524} | `
  
  2. Auto pre-turn compact, local
  `INFO | 2026-04-09 17:37:30 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d2-45ef-71d1-9c93-23cc0c13d988', 'turn_id':
  '019d74d2-7b42-7372-9f0e-c0da3f352328', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'pre_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20063, 'active_context_tokens_after':
  4822, 'started_at': 1775781444, 'completed_at': 1775781449,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 5497} | `
  
  3. Auto mid-turn compact, local
  `INFO | 2026-04-09 17:38:28 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d3-212f-7a20-8c0a-4816a978675e', 'turn_id':
  '019d74d3-3ee1-7462-89f6-2ffbeefcd5e3', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'mid_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20325, 'active_context_tokens_after':
  14641, 'started_at': 1775781500, 'completed_at': 1775781508,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 7507} | `
  
  4. Remote /responses/compact, manual standalone
  `INFO | 2026-04-09 17:40:20 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d4-7a11-78a1-89f7-0535a1149416', 'turn_id':
  '019d74d4-e087-7183-9c20-b1e40b7578c0', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses_compact', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 23461, 'active_context_tokens_after':
  6171, 'started_at': 1775781601, 'completed_at': 1775781620,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 18971} | `

  rhan-oai · 2026-04-10 13:03:54 -07:00
  5779be314a
• Strengthen realtime backend delegation prompt (#17363)

  Encourages realtime prompt handling to delegate user requests to the
  backend agent by default when repo inspection, commands, implementation,
  or validation may help.
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-10 12:14:33 -07:00
  029fc63d13
• Queue Realtime V2 response.create while active (#17306)

  Builds on #17264.
  
  - queues Realtime V2 `response.create` while an active response is open,
  then flushes it after `response.done` or `response.cancelled`
  - requests `response.create` after background agent final output and
  steering acknowledgements
  - adds app-server integration coverage for all `response.create` paths
  
  Validation:
  - `just fmt`
  - `cargo check -p codex-app-server --tests`
  - `git diff --check`
  - CI green
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-10 09:09:13 -07:00
  2e81eac004
• feat(guardian): send only transcript deltas on guardian followups (#17269)

  ## Description
  
  We reuse a guardian thread for a given user thread when we can. However,
  we had always sent the full transcript history every time we made a
  followup review request to an existing guardian thread.
  
  This is especially bad for long guardian threads since we keep
  re-appending old transcript entries instead of just what has changed.
  The fix is to just send what's new.
  
  **Caveat**: Whenever a thread is compacted or rolled back, we fall back
  to sending the full transcript to guardian again since the thread's
  history has been modified. However in the happy path we get a nice
  optimization.
  
  ## Before
  Initial guardian review sends the full parent transcript:
  
  ```
  The following is the Codex agent history whose request action you are assessing...
  >>> TRANSCRIPT START
  [1] user: Please check the repo visibility and push the docs fix if needed.
  [2] tool gh_repo_view call: {"repo":"openai/codex"}
  [3] tool gh_repo_view result: repo visibility: public
  [4] assistant: The repo is public; I now need approval to push the docs fix.
  >>> TRANSCRIPT END
  The Codex agent has requested the following action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```
  
  And a followup to the same guardian thread would send the full
  transcript again (including items 1-4 we already sent):
  ```
  The following is the Codex agent history whose request action you are assessing...
  >>> TRANSCRIPT START
  [1] user: Please check the repo visibility and push the docs fix if needed.
  [2] tool gh_repo_view call: {"repo":"openai/codex"}
  [3] tool gh_repo_view result: repo visibility: public
  [4] assistant: The repo is public; I now need approval to push the docs fix.
  [5] user: Please push the second docs fix too.
  [6] assistant: I need approval for the second docs fix.
  >>> TRANSCRIPT END
  The Codex agent has requested the following action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```
  
  ## After
  Initial guardian review sends the full parent transcript (this is
  unchanged):
  
  ```
  The following is the Codex agent history whose request action you are assessing...
  >>> TRANSCRIPT START
  [1] user: Please check the repo visibility and push the docs fix if needed.
  [2] tool gh_repo_view call: {"repo":"openai/codex"}
  [3] tool gh_repo_view result: repo visibility: public
  [4] assistant: The repo is public; I now need approval to push the docs fix.
  >>> TRANSCRIPT END
  The Codex agent has requested the following action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```
  
  But a followup now sends:
  ```
  The following is the Codex agent history added since your last approval assessment. Continue the same review conversation...
  >>> TRANSCRIPT DELTA START
  [5] user: Please push the second docs fix too.
  [6] assistant: I need approval for the second docs fix.
  >>> TRANSCRIPT DELTA END
  The Codex agent has requested the following next action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```

  Owen Lin · 2026-04-10 07:48:44 -07:00
  88165e179a
• feat: description multi-agent v2 (#17338)
  jif-oai · 2026-04-10 15:31:32 +01:00
  d39a722865
• feat: make rollout recorder reliable against errors (#17214)

  The rollout writer now keeps an owned/monitored task handle, returns
  real Result acks for flush/persist/shutdown, retries failed flushes by
  reopening the rollout file, and keeps buffered items until they are
  successfully written. Session flushes are now real durability barriers
  for fork/rollback/read-after-write paths, while turn completion surfaces
  a warning if the rollout still cannot be saved after recovery.

  jif-oai · 2026-04-10 14:12:33 +01:00
  8035cb03f1
• Add output_schema to code mode render (#17210)

  This updates code-mode tool rendering so MCP tools can surface
  structured output types from their `outputSchema`.
  
  What changed:
  - Detect MCP tool-call result wrappers from the output schema shape
  instead of relying on tool-name parsing or provenance flags.
  - Render shared TypeScript aliases once for MCP tool results
  (`CallToolResult`, `ContentBlock`, etc.) so multiple MCP tool
  declarations stay compact.
  - Type `structuredContent` from the tool definition's `outputSchema`
  instead of rendering it as `unknown`.
  - Update the shared MCP aliases to match the MCP draft `CallToolResult`
  schema more closely.
  
  Example:
  - Before: `declare const tools: { mcp__rmcp__echo(args: { env_var?:
  string; message: string; }): Promise<{ _meta?: unknown; content:
  Array<unknown>; isError?: boolean; structuredContent?: unknown; }>; };`
  - After: `declare const tools: { mcp__rmcp__echo(args: { env_var?:
  string; message: string; }): Promise<CallToolResult<{ echo: string; env:
  string | null; }>>; };`

  Vivian Fang · 2026-04-10 11:41:44 +00:00
  7bbe3b6011
• Stream Realtime V2 background agent progress (#17264)

  Stream Realtime V2 background agent updates while the background agent
  task is still running, then send the final tool output when it
  completes. User input during an active V2 handoff is acknowledged back
  to realtime as a steering update.
  
  Stack:
  - Depends on #17278 for the background_agent rename.
  - Depends on #17280 for the input task handler refactor.
  
  Coverage:
  - Adds an app-server integration regression test that verifies V2
  progress is sent before the final function-call output.
  
  Validation:
  - just fmt
  - cargo check -p codex-core
  - cargo check -p codex-app-server --tests
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-10 00:06:00 -07:00
  1de0085418
• adding parent_thread_id in guardian (#17249)

  ## Summary
  
  This PR adds the parent conversation/session id to the subagent-start
  analytics event for Guardian subagents.
  
  Previously, Guardian sessions were emitted as subagent
  thread-initialized events, but their `parent_thread_id` was serialized
  as `null`. After this change, the `codex_thread_initialized` analytics
  event for a Guardian child session includes the parent user conversation
  id.

  Won Park · 2026-04-10 06:25:05 +00:00
  4e910bf151
• Extract realtime input task handlers (#17280)

  Refactor the realtime input task select loop into named handlers for
  user text, background agent output, realtime server events, and user
  audio without changing the V2 behavior.
  
  Stack:
  - Depends on #17278 for the background_agent rename.
  
  Validation:
  - just fmt
  - cargo check -p codex-core
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-09 22:35:18 -07:00
  26a28afc6d
• Option to Notify Workspace Owner When Usage Limit is Reached (#16969)

  ## Summary
  - Replace the manual `/notify-owner` flow with an inline confirmation
  prompt when a usage-based workspace member hits a credits-depleted
  limit.
  - Fetch the current workspace role from the live ChatGPT
  `accounts/check/v4-2023-04-27` endpoint so owner/member behavior matches
  the desktop and web clients.
  - Keep owner, member, and spend-cap messaging distinct so we only offer
  the owner nudge when the workspace is actually out of credits.
  
  ## What Changed
  - `backend-client`
  - Added a typed fetch for the current account role from
  `accounts/check`.
    - Mapped backend role values into a Rust workspace-role enum.
  - `app-server` and protocol
    - Added `workspaceRole` to `account/read` and `account/updated`.
  - Derived `isWorkspaceOwner` from the live role, with a fallback to the
  cached token claim when the role fetch is unavailable.
  - `tui`
    - Removed the explicit `/notify-owner` slash command.
  - When a member is blocked because the workspace is out of credits, the
  error now prompts:
  - `Your workspace is out of credits. Request more from your workspace
  owner? [y/N]`
    - Choosing `y` sends the existing owner-notification request.
  - Choosing `n`, pressing `Esc`, or accepting the default selection
  dismisses the prompt without sending anything.
  - Selection popups now honor explicit item shortcuts, which is how the
  `y` / `n` interaction is wired.
  
  ## Reviewer Notes
  - The main behavior change is scoped to usage-based workspace members
  whose workspace credits are depleted.
  - Spend-cap reached should not show the owner-notification prompt.
  - Owners and admins should continue to see `/usage` guidance instead of
  the member prompt.
  - The live role fetch is best-effort; if it fails, we fall back to the
  existing token-derived ownership signal.
  
  ## Testing
  - Manual verification
    - Workspace owner does not see the member prompt.
  - Workspace member with depleted credits sees the confirmation prompt
  and can send the nudge with `y`.
  - Workspace member with spend cap reached does not see the
  owner-notification prompt.
  
  ### Workspace member out of usage
  
  https://github.com/user-attachments/assets/341ac396-eff4-4a7f-bf0c-60660becbea1
  
  ### Workspace owner
  <img width="1728" height="1086" alt="Screenshot 2026-04-09 at 11 48
  22 AM"
  src="https://github.com/user-attachments/assets/06262a45-e3fc-4cc4-8326-1cbedad46ed6"
  />

  richardopenai · 2026-04-09 21:15:17 -07:00
  9f2a585153
• fix: support split carveouts in windows elevated sandbox (#14568)

  ## Summary
  - preserve legacy Windows elevated sandbox behavior for existing
  policies
  - add elevated-only support for split filesystem policies that can be
  represented as readable-root overrides, writable-root overrides, and
  extra deny-write carveouts
  - resolve those elevated filesystem overrides during sandbox transform
  and thread them through setup and policy refresh
  - keep failing closed for explicit unreadable (`none`) carveouts and
  reopened writable descendants under read-only carveouts
  - for explicit read-only-under-writable-root carveouts, materialize
  missing carveout directories during elevated setup before applying the
  deny-write ACL
  - document the elevated vs restricted-token support split in the core
  README
  
  ## Example
  Given a split filesystem policy like:
  
  ```toml
  ":root" = "read"
  ":cwd" = "write"
  "./docs" = "read"
  "C:/scratch" = "write"
  ```
  
  the elevated backend now provisions the readable-root overrides,
  writable-root overrides, and extra deny-write carveouts during setup and
  refresh instead of collapsing back to the legacy workspace-only shape.
  
  If a read-only carveout under a writable root is missing at setup time,
  elevated setup creates that carveout as an empty directory before
  applying its deny-write ACE; otherwise the sandboxed command could
  create it later and bypass the carveout. This is only for explicit
  policy carveouts. Best-effort workspace protections like `.codex/` and
  `.agents/` still skip missing directories.
  
  A policy like:
  
  ```toml
  "/workspace" = "write"
  "/workspace/docs" = "read"
  "/workspace/docs/tmp" = "write"
  ```
  
  still fails closed, because the elevated backend does not reopen
  writable descendants under read-only carveouts yet.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-09 17:34:52 -07:00
  b976e701a8
• Stop Realtime V2 response.done delegation (#17267)

  Stop parsing Realtime V2 response completion as a Codex handoff;
  delegation stays tied to item completion.\n\nValidation: just fmt; git
  diff --check
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-09 17:17:49 -07:00
  32224878b3
• Omit empty app-server instruction overrides (#17258)

  ## Summary
  - omit serialized Responses instructions when an app-server base
  instruction override is empty
  - skip empty developer instruction messages and add v2 coverage for the
  empty-override request shape
  
  ## Validation
  - just fmt
  - git diff --check

  Ahmed Ibrahim · 2026-04-09 15:29:35 -07:00
  ecca34209d
• [mcp] Expand tool search to custom MCPs. (#16944)

  - [x] Expand tool search to custom MCPs.
  - [x] Rename several variables/fields to be more generic.
  
  Updated tool & server name lifecycles:
  
  **Raw Identity**
  
  ToolInfo.server_name is raw MCP server name.
  ToolInfo.tool.name is raw MCP tool name.
  MCP calls route back to raw via parse_tool_name() returning
  (tool.server_name, tool.tool.name).
  mcpServerStatus/list now groups by raw server and keys tools by
  Tool.name: mod.rs:599
  App-server just forwards that grouped raw snapshot:
  codex_message_processor.rs:5245
  
  **Callable Names**
  
  On list-tools, we create provisional callable_namespace / callable_name:
  mcp_connection_manager.rs:1556
  For non-app MCP, provisional callable name starts as raw tool name.
  For codex-apps, provisional callable name is sanitized and strips
  connector name/id prefix; namespace includes connector name.
  Then qualify_tools() sanitizes callable namespace + name to ASCII alnum
  / _ only: mcp_tool_names.rs:128
  Note: this is stricter than Responses API. Hyphen is currently replaced
  with _ for code-mode compatibility.
  
  **Collision Handling**
  
  We do initially collapse example-server and example_server to the same
  base.
  Then qualify_tools() detects distinct raw namespace identities behind
  the same sanitized namespace and appends a hash to the callable
  namespace: mcp_tool_names.rs:137
  Same idea for tool-name collisions: hash suffix goes on callable tool
  name.
  Final list_all_tools() map key is callable_namespace + callable_name:
  mcp_connection_manager.rs:769
  
  **Direct Model Tools**
  
  Direct MCP tool declarations use the full qualified sanitized key as the
  Responses function name.
  The raw rmcp Tool is converted but renamed for model exposure.
  
  **Tool Search / Deferred**
  
  Tool search result namespace = final ToolInfo.callable_namespace:
  tool_search.rs:85
  Tool search result nested name = final ToolInfo.callable_name:
  tool_search.rs:86
  Deferred tool handler is registered as "{namespace}:{name}":
  tool_registry_plan.rs:248
  When a function call comes back, core recombines namespace + name, looks
  up the full qualified key, and gets the raw server/tool for MCP
  execution: codex.rs:4353
  
  **Separate Legacy Snapshot**
  
  collect_mcp_snapshot_from_manager_with_detail() still returns a map
  keyed by qualified callable name.
  mcpServerStatus/list no longer uses that; it uses
  McpServerStatusSnapshot, which is raw-inventory shaped.

  Matthew Zeng · 2026-04-09 13:34:52 -07:00
  d7f99b0fa6
• Forward app-server turn clientMetadata to Responses (#16009)

  ## Summary
  App-server v2 already receives turn-scoped `clientMetadata`, but the
  Rust app-server was dropping it before the outbound Responses request.
  This change keeps the fix lightweight by threading that metadata through
  the existing turn-metadata path rather than inventing a new transport.
  
  ## What we're trying to do and why
  We want turn-scoped metadata from the app-server protocol layer,
  especially fields like Hermes/GAAS run IDs, to survive all the way to
  the actual Responses API request so it is visible in downstream
  websocket request logging and analytics.
  
  The specific bug was:
  - app-server protocol uses camelCase `clientMetadata`
  - Responses transport already has an existing turn metadata carrier:
  `x-codex-turn-metadata`
  - websocket transport already rewrites that header into
  `request.request_body.client_metadata["x-codex-turn-metadata"]`
  - but the Rust app-server never parsed or stored `clientMetadata`, so
  nothing from the app-server request was making it into that existing
  path
  
  This PR fixes that without adding a new header or a second metadata
  channel.
  
  ## How we did it
  ### Protocol surface
  - Add optional `clientMetadata` to v2 `TurnStartParams` and
  `TurnSteerParams`
  - Regenerate the JSON schema / TypeScript fixtures
  - Update app-server docs to describe the field and its behavior
  
  ### Runtime plumbing
  - Add a dedicated core op for app-server user input carrying turn-scoped
  metadata: `Op::UserInputWithClientMetadata`
  - Wire `turn/start` and `turn/steer` through that op / signature path
  instead of dropping the metadata at the message-processor boundary
  - Store the metadata in `TurnMetadataState`
  
  ### Transport behavior
  - Reuse the existing serialized `x-codex-turn-metadata` payload
  - Merge the new app-server `clientMetadata` into that JSON additively
  - Do **not** replace built-in reserved fields already present in the
  turn metadata payload
  - Keep websocket behavior unchanged at the outer shape level: it still
  sends only `client_metadata["x-codex-turn-metadata"]`, but that JSON
  string now contains the merged fields
  - Keep HTTP fallback behavior unchanged except that the existing
  `x-codex-turn-metadata` header now includes the merged fields too
  
  ### Request shape before / after
  Before, a websocket `response.create` looked like:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\"}"
    }
  }
  ```
  Even if the app-server caller supplied `clientMetadata`, it was not
  represented there.
  
  After, the same request shape is preserved, but the serialized payload
  now includes the new turn-scoped fields:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\",\"fiber_run_id\":\"fiber-start-123\",\"origin\":\"gaas\"}"
    }
  }
  ```
  
  ## Validation
  ### Targeted tests added / updated
  - protocol round-trip coverage for `clientMetadata` on `turn/start` and
  `turn/steer`
  - protocol round-trip coverage for `Op::UserInputWithClientMetadata`
  - `TurnMetadataState` merge test proving client metadata is added
  without overwriting reserved built-in fields
  - websocket request-shape test proving outbound `response.create`
  contains merged metadata inside
  `client_metadata["x-codex-turn-metadata"]`
  - app-server integration tests proving:
  - `turn/start` forwards `clientMetadata` into the outbound Responses
  request path
    - websocket warmup + real turn request both behave correctly
    - `turn/steer` updates the follow-up request metadata
  
  ### Commands run
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-protocol`
  - `cargo test -p codex-core
  turn_metadata_state_merges_client_metadata_without_replacing_reserved_fields
  --lib`
  - `cargo test -p codex-core --test all
  responses_websocket_preserves_custom_turn_metadata_fields`
  - `cargo test -p codex-app-server --test all client_metadata`
  - `cargo test -p codex-app-server --test all
  turn_start_forwards_client_metadata_to_responses_websocket_request_body_v2
  -- --nocapture`
  - `just fmt`
  - `just fix -p codex-core -p codex-protocol -p codex-app-server-protocol
  -p codex-app-server`
  - `just fix -p codex-exec -p codex-tui-app-server`
  - `just argument-comment-lint`
  
  ### Full suite note
  `cargo test` in `codex-rs` still fails in:
  -
  `suite::v2::turn_interrupt::turn_interrupt_resolves_pending_command_approval_request`
  
  I verified that same failure on a clean detached `HEAD` worktree with an
  isolated `CARGO_TARGET_DIR`, so it is not caused by this patch.

  neil-oai · 2026-04-09 11:52:37 -07:00
  a92a5085bd
• feat: add Codex Apps sediment file remapping (#15197)

  ## Summary
  - bridge Codex Apps tools that declare `_meta["openai/fileParams"]`
  through the OpenAI file upload flow
  - mask those file params in model-visible tool schemas so the model
  provides absolute local file paths instead of raw file payload objects
  - rewrite those local file path arguments client-side into
  `ProvidedFilePayload`-shaped objects before the normal MCP tool call
  
  ## Details
  - applies to scalar and array file params declared in
  `openai/fileParams`
  - Codex uploads local files directly to the backend and uses the
  uploaded file metadata to build the MCP tool arguments locally
  - this PR is input-only
  
  ## Verification
  - `just fmt`
  - `cargo test -p codex-core mcp_tool_call -- --nocapture`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Casey Chow · 2026-04-09 14:10:44 -04:00
  244b15c95d
• refactor(proxy): clarify sandbox block messages (#17168)

  ## Summary
  - Replace Codex-branded network-proxy block responses with concise
  reason text
  - Mention sandbox policy for local/private network and deny-policy
  wording
  - Remove “managed” from the proxy-disabled denial detail

  viyatb-oai · 2026-04-09 10:53:06 -07:00
  7ab825e047
• [codex] add memory extensions (#16276)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Kevin Liu · 2026-04-09 10:45:02 -07:00
  76de99ff25
• chore: merge name and title (#17116)

  Merge title and name concept to leverage the sqlite title column and
  have more efficient queries
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-09 18:44:26 +01:00
  12f0e0b0eb
• Skip local shell snapshots for remote unified exec (#17217)

  ## Summary
  - detect remote exec-server sessions in the unified-exec runtime
  - bypass the local shell-snapshot bootstrap only for those remote
  sessions
  - preserve existing local snapshot wrapping, PowerShell UTF-8 prefixing,
  sandbox orchestration, and zsh-fork handling
  
  ## Why
  The shell snapshot file is currently captured and stored next to Core.
  If Core wraps a remote command with `. /path/to/local/snapshot`, the
  process starts on the executor and tries to source a path from the
  orchestrator filesystem. This keeps remote commands from receiving that
  known-local path until shell snapshots are captured/restored on the
  executor side.
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - `cargo test -p codex-core --lib tools::runtimes::tests`
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-09 17:30:18 +01:00
  c0b5d8d24a
• Render statusline context as a meter (#17170)

  Problem: The statusline reported context as an “X% left” value, which
  could be mistaken for quota, and context usage was included in the
  default footer.
  
  Solution: Render configured context status items as a filling context
  meter, preserve `context-used` as a legacy alias while hiding it from
  the setup menu, and remove context from the default statusline. It will
  still be available as an opt-in option for users who want to see it.
  
  <img width="317" height="39" alt="image"
  src="https://github.com/user-attachments/assets/3aeb39bb-f80d-471f-88fe-d55e25b31491"
  />

  Eric Traut · 2026-04-09 07:52:07 -07:00
  598d6ff056
• [codex] Defer steering until after sampling the model post-compaction (#17163)

  ## Summary
  - keep pending steered input buffered until the active user prompt has
  received a model response
  - keep steering pending across auto-compact when there is real
  model/tool continuation to resume
  - allow queued steering to follow compaction immediately when the prior
  model response was already final
  - keep pending-input follow-up owned by `run_turn` instead of folding it
  into `SamplingRequestResult`
  - add regression coverage for mid-turn compaction, final-response
  compaction, and compaction triggered before the next request after tool
  output
  
  ## Root Cause
  Steered input was drained at the top of every `run_turn` loop. After
  auto-compaction, the loop continued and immediately appended any pending
  steer after the compact summary, making a queued prompt look like the
  newest task instead of letting the model first resume interrupted
  model/tool work.
  
  ## Implementation Notes
  This patch keeps the follow-up signals separated:
  
  - `SamplingRequestResult.needs_follow_up` means model/tool continuation
  is needed
  - `sess.has_pending_input().await` means queued user steering exists
  - `run_turn` computes the combined loop condition from those two signals
  
  In `run_turn`:
  
  ```rust
  let has_pending_input = sess.has_pending_input().await;
  let needs_follow_up = model_needs_follow_up || has_pending_input;
  ```
  
  After auto-compact we choose whether the next request may drain
  steering:
  
  ```rust
  can_drain_pending_input = !model_needs_follow_up;
  ```
  
  That means:
  
  - model/tool continuation + pending steer: compact -> resume once
  without draining steer
  - completed model answer + pending steer: compact -> drain/send the
  steer immediately
  - fresh user prompt: do not drain steering before the model has answered
  the prompt once
  
  The drain is still only `sess.get_pending_input().await`; when
  `can_drain_pending_input` is false, core uses an empty local vec and
  leaves the steer pending in session state.
  
  ## Validation
  - PASS `cargo test -p codex-core --test all steered_user_input --
  --nocapture`
  - PASS `just fmt`
  - PASS `git diff --check`
  - NOT PASSING HERE `just fix -p codex-core` currently stops before
  linting this change on an unrelated mainline test-build error:
  `core/src/tools/spec_tests.rs` initializes `ToolsConfigParams` without
  `image_generation_tool_auth_allowed`; this PR does not touch that file.

  jgershen-oai · 2026-04-09 02:08:41 -07:00
  8f705b0702
• make webrtc the default experience (#17188)

  ## Summary
  - make realtime default to the v2 WebRTC path
  - keep partial realtime config tables inheriting
  `RealtimeConfig::default()`
  
  ## Validation
  - CI found a stale config-test expectation; fixed in 974ba51bb3
  - just fmt
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 23:52:32 -07:00
  84a24fe333
• Default realtime startup to v2 model (#17183)

  - Default realtime sessions to v2 and gpt-realtime-1.5 when no override
  is configured.
  - Add Op::RealtimeConversationStart integration coverage and keep
  v1-specific tests explicit.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 22:11:30 -07:00
  1fdb695e42
• Add TUI notification condition config (#17175)

  Problem: TUI desktop notifications are hard-gated on terminal focus, so
  terminal/IDE hosts that want in-focus notifications cannot opt in.
  
  Solution: Add a flat `[tui] notification_condition` setting (`unfocused`
  by default, `always` opt-in), carry grouped TUI notification settings
  through runtime config, apply method + condition together in the TUI,
  and regenerate the config schema.

  Eric Traut · 2026-04-08 21:50:02 -07:00
  6dc5391c7c
• Add realtime voice selection (#17176)

  - Add realtime voice selection for realtime/start.
  - Expose the supported v1/v2 voice lists and cover explicit, configured,
  default, and invalid voice paths.

  Ahmed Ibrahim · 2026-04-08 20:19:15 -07:00
  2f9090be62
• Move default realtime prompt into core (#17165)

  - Adds a core-owned realtime backend prompt template and preparation
  path.
  - Makes omitted realtime start prompts use the core default, while null
  or empty prompts intentionally send empty instructions.
  - Covers the core realtime path and app-server v2 path with integration
  coverage.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 19:34:40 -07:00
  4c2a1ae31b
• Fix stale thread-name resume lookups (#16646)

  Addresses #15943
  
  Problem: Name-based resume could stop on a newer session_index entry
  whose rollout was never persisted, shadowing an older saved thread with
  the same name.
  
  Solution: Materialize rollouts before indexing thread names and make
  name lookup skip unresolved entries until it finds a persisted rollout.

  Eric Traut · 2026-04-08 18:51:29 -07:00
  36586eafed
• Auto-approve MCP server elicitations in Full Access mode (#17164)

  Currently, when a MCP server sends an elicitation to Codex running in
  Full Access (`sandbox_policy: DangerFullAccess` + `approval_policy:
  Never`), the elicitations are auto-cancelled.
  
  This PR updates the automatic handling of MCP elicitations to be
  consistent with other approvals in full-access, where they are
  auto-approved. Because MCP elicitations may actually require user input,
  this mechanism is limited to empty form elicitations.
  
  ## Changeset
  - Add policy helper shared with existing MCP tool call approval
  auto-approve
  - Update `ElicitationRequestManager` to auto-approve elicitations in
  full access when `can_auto_accept_elicitation` is true.
  - Add tests
  
  Co-authored-by: Codex <noreply@openai.com>

  Leo Shimonaka · 2026-04-08 16:41:02 -07:00
  01537f0bd2
• Update guardian output schema (#17061)

  ## Summary
  - Update guardian output schema to separate risk, authorization,
  outcome, and rationale.
  - Feed guardian rationale into rejection messages.
  - Split the guardian policy into template and tenant-config sections.
  
  ## Validation
  - `cargo test -p codex-core mcp_tool_call`
  - `env -u CODEX_SANDBOX_NETWORK_DISABLED INSTA_UPDATE=always cargo test
  -p codex-core guardian::`
  
  ---------
  
  Co-authored-by: Owen Lin <owen@openai.com>

  maja-openai · 2026-04-08 15:47:29 -07:00
  dcbc91fd39
• Attach WebRTC realtime starts to sideband websocket (#17057)

  Summary:
  - parse the realtime call Location header and join that call over the
  direct realtime WebSocket
  - keep WebRTC starts alive on the existing realtime conversation path
  
  Validation:
  - just fmt
  - git diff --check
  - cargo check -p codex-api
  - cargo check -p codex-core --tests
  - local cargo tests not run; relying on PR CI

  Ahmed Ibrahim · 2026-04-08 15:25:42 -07:00
  794a0240f9
• Fix missing fields (#17149)

  Fix missing `image_generation_tool_auth_allowed` in two locations.

  canvrno-oai · 2026-04-08 13:53:53 -07:00
  58ad79b60e
• [codex] Support remote exec cwd in TUI startup (#17142)

  When running with remote executor the cwd is the remote path. Today we
  check for existence of a local directory on startup and attempt to load
  config from it.
  
  For remote executors don't do that.

  pakrym-oai · 2026-04-08 13:09:28 -07:00
  e4d6702b87
• release ready, enabling only for siwc users (#17046)

  **Disabling Image-Gen for Non-SIWC Codex Users**
  
  We are only enabling image-gen feature for SIWC Codex users until there
  comes a fix in ResponsesAPI to omit output from responses.completed, to
  prevent the following issues:
  
  1. websocket blows up due to heavier load (images) than before (text) 
  2. http parser streams through n^2 of n-base64 bytes (sum of base64s of
  all images generated in turn) that causes long delays in
  turn_completion.

  Won Park · 2026-04-08 11:22:39 -07:00
  e003f84e1e
• fix(debug-config, guardian): fix /debug-config rendering and guardian… (#17138)

  ## Description
  
  This PR fixes `/debug-config` so it shows more of the active
  requirements state, including reviewer requirements and managed feature
  pins. This made it clear that legacy MDM config was setting
  `approvals_reviewer = "guardian_subagent"` and that we were translating
  that into a requirements constraint.
  
  Also, translate `approvals_reviewer = "guardian_subagent"` (from legacy
  managed_config.toml) to `allowed_approvals_reviewers: guardian_subagent,
  user` instead of `allowed_approvals_reviewers: guardian_subagent`.
  
  Example `/debug-config`:
  ```
  Config layer stack (lowest precedence first):
    1. system (/etc/codex/config.toml) (enabled)
    2. user (/Users/owen/.codex/config.toml) (enabled)
    3. project (/Users/owen/repos/codex/.codex/config.toml) (enabled)
    4. legacy managed_config.toml (MDM) (enabled)
       MDM value:
         ...
  
         # Enable Guardian Mode
         features.guardian_approval = true
         approvals_reviewer = "guardian_subagent"
  
  Requirements:
    - allowed_approvals_reviewers: guardian_subagent, user (source: MDM managed_config.toml (legacy))
    - features: apps=true, plugins=true (source: cloud requirements)
  ```
  
  Before this PR, the `Requirements` section showed None.

  Owen Lin · 2026-04-08 11:08:09 -07:00
  e794457a59
• Use AbsolutePathBuf for exec cwd plumbing (#17063)

  ## Summary
  - Carry `AbsolutePathBuf` through tool cwd parsing/resolution instead of
  resolving workdirs to raw `PathBuf`s.
  - Type exec/sandbox request cwd fields as `AbsolutePathBuf` through
  `ExecParams`, `ExecRequest`, `SandboxCommand`, and unified exec runtime
  requests.
  - Keep `PathBuf` conversions at external/event boundaries and update
  existing tests/fixtures for the typed cwd.
  
  ## Validation
  - `cargo check -p codex-core --tests`
  - `cargo check -p codex-sandboxing --tests`
  - `cargo test -p codex-sandboxing`
  - `cargo test -p codex-core --lib tools::handlers::`
  - `just fix -p codex-sandboxing`
  - `just fix -p codex-core`
  - `just fmt`
  
  Full `codex-core` test suite was not run locally; per repo guidance I
  kept local validation targeted.

  pakrym-oai · 2026-04-08 10:54:12 -07:00
  35b5720e8d
• Add realtime transport config (#17097)

  Adds realtime.transport config with websocket as the default and webrtc
  wired through the effective config.
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 09:53:53 -07:00
  06d88b7e81
• Show global AGENTS.md in /status (#17091)

  Addresses #3793
  
  Problem: /status only reported project-level AGENTS files, so sessions
  with a loaded global $CODEX_HOME/AGENTS.md still showed Agents.md as
  <none>.
  
  Solution: Track the global instructions file loaded during config
  initialization and prepend that path to the /status Agents.md summary,
  with coverage for AGENTS.md, AGENTS.override.md, and global-plus-project
  ordering.

  Eric Traut · 2026-04-08 09:04:32 -07:00
  dc5feb916d