codex

Add read-only when backfilling requirements from managed_config (#8913 )

When a user has a managed_config which doesn't specify read-only, Codex
fails to launch.

gt-oai · 2026-01-08 11:27:46 -08:00

4156060416

fix: preserve core env vars on Windows (#8897 )

This updates core shell environment policy handling to match Windows
case-insensitive variable names and adds a Windows-only regression test,
so Path/TEMP are no longer dropped when inherit=core.

Thibault Sottiaux · 2026-01-08 10:36:36 -08:00

98122cbad0

clean: all history cloning (#8916 )

jif-oai · 2026-01-08 18:17:18 +00:00

69898e3dba

fix: reduce duplicate include_str!() calls (#8914 )

Michael Bolin · 2026-01-08 17:20:41 +00:00

59d6937550

config requirements: improve requirement error messages (#8843 )

**Before:**
```
Error loading configuration: value `Never` is not in the allowed set [OnRequest]
```

**After:**
```
Error loading configuration: invalid value for `approval_policy`: `Never` is not in the
allowed set [OnRequest] (set by MDM com.openai.codex:requirements_toml_base64)
```

Done by introducing a new struct `ConfigRequirementsWithSources` onto
which we `merge_unset_fields` now. Also introduces a pair of requirement
value and its `RequirementSource` (inspired by `ConfigLayerSource`):

```rust
pub struct Sourced<T> {
    pub value: T,
    pub source: RequirementSource,
}
```

gt-oai · 2026-01-08 16:11:14 +00:00

932a5a446f

feat: add a few metrics (#8910 )

jif-oai · 2026-01-08 15:39:57 +00:00

5522663f92

nit: drop unused function call error (#8903 )

jif-oai · 2026-01-08 15:07:30 +00:00

98e171258c

chore: drop useless interaction_input (#8907 )

jif-oai · 2026-01-08 15:01:07 +00:00

da667b1f56

Avoid setpgid for inherited stdio on macOS (#8691 )

## Summary
- avoid setting a new process group when stdio is inherited (keeps child
in foreground PG)
- keep process-group isolation when stdio is redirected so killpg
cleanup still works
- prevents macOS job-control SIGTTIN stops that look like hangs after
output

## Testing
- `cargo build -p codex-cli`
- `GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
CARGO_BIN_EXE_codex=/Users/denis/Code/codex/codex-rs/target/debug/codex
/opt/homebrew/bin/timeout 30m cargo test -p codex-core -p codex-exec`

## Context
This fixes macOS sandbox hangs for commands like `elixir -v` / `erl
-noshell`, where the child was moved into a new process group while
still attached to the controlling TTY. See issue #8690.

## Authorship & collaboration
- This change and analysis were authored by **Codex** (AI coding agent).
- Human collaborator: @seeekr provided repro environment, context, and
review guidance.
- CLI used: `codex-cli 0.77.0`.
- Model: `gpt-5.2-codex (xhigh)`.

Co-authored-by: Eric Traut <etraut@openai.com>

Denis Andrejew · 2026-01-08 07:50:40 -07:00

9ce6bbc43e

fix: include project instructions in /review subagent (#8899 )

Include project-level AGENTS.md and skills in /review sessions so the
review sub-agent uses the same instruction pipeline as standard runs,
keeping reviewer context aligned with normal sessions.

Thibault Sottiaux · 2026-01-08 13:31:01 +00:00

be212db0c8

chore: align error limit comment (#8896 )

Thibault Sottiaux · 2026-01-08 13:30:33 +00:00

5b022c2904

chore: drop metrics exporter config (#8892 )

Dropped for now as enterprises should not be able to use it

jif-oai · 2026-01-08 13:20:18 +00:00

e21ce6c5de

fix: stabilize list_dir pagination order (#8826 )

Sort list_dir entries before applying offset/limit so pagination matches
the displayed order, update pagination/truncation expectations, and add
coverage for sorted pagination. This ensures stable, predictable
directory pages when list_dir is enabled.

Thibault Sottiaux · 2026-01-08 03:51:47 -08:00

267c05fb30

feat: metrics capabilities (#8318 )

Add metrics capabilities to Codex. The `README.md` is up to date.

This will not be merged with the metrics before this PR of course:
https://github.com/openai/codex/pull/8350

jif-oai · 2026-01-08 11:47:36 +00:00

634650dd25

chore: add list thread ids on manager (#8855 )

jif-oai · 2026-01-08 10:53:58 +00:00

8a0c2e5841

Feat: appServer.requirementList for requirement.toml (#8800 )

### Summary
We are exposing requirements via `requirement/list` method from
app-server so that we can conditionally disable the agent mode dropdown
selection in VSCE and correctly setting the default value.

### Sample output
#### `etc/codex/requirements.toml`
<img width="497" height="49" alt="Screenshot 2026-01-06 at 11 32 06 PM"
src="https://github.com/user-attachments/assets/fbd9402e-515f-4b9e-a158-2abb23e866a0"
/>

#### App server response
<img width="1107" height="79" alt="Screenshot 2026-01-06 at 11 30 18 PM"
src="https://github.com/user-attachments/assets/c0d669cd-54ef-4789-a26c-adb2c41950af"
/>

Shijie Rao · 2026-01-07 13:57:44 -08:00

efd0c21b9b

Support symlink for skills discovery. (#8801 )

Skills discovery now follows symlink entries for SkillScope::User
($CODEX_HOME/skills) and SkillScope::Admin (e.g. /etc/codex/skills).

Added cycle protection: directories are canonicalized and tracked in a
visited set to prevent infinite traversal from circular links.

Added per-root traversal limits to avoid accidentally scanning huge
trees:
- max depth: 6
- max directories: 2000 (logs a warning if truncated)

For now, symlink stat failures and traversal truncation are logged
rather than surfaced as UI “invalid SKILL.md” warnings.

xl-openai · 2026-01-07 13:34:48 -08:00

61e81af887

Clarify YAML frontmatter formatting in skill-creator (#8610 )

Fixes #8609

# Summary

Emphasize single-line name/description values and quoting when values
could be interpreted as YAML syntax.

# Testing

Not run (skill-only change.)

darlingm · 2026-01-07 14:24:02 -07:00

5f3f70203c

Add feature for optional request compression (#8767 )

Adds a new feature
`enable_request_compression` that will compress using zstd requests to
the codex-backend. Currently only enabled for codex-backend so only enabled for openai providers when using chatgpt::auth even when the feature is enabled

Added a new info log line too for evaluating the compression ratio and
overhead off compressing before requesting. You can enable with
`RUST_LOG=$RUST_LOG,codex_client::transport=info`

```
2026-01-06T00:09:48.272113Z  INFO codex_client::transport: Compressed request body with zstd pre_compression_bytes=28914 post_compression_bytes=11485 compression_duration_ms=0
```

Channing Conger · 2026-01-07 13:21:40 -08:00

21c6d40a44

Simplify error managment in run_turn (#8849 )

Ahmed Ibrahim · 2026-01-07 13:15:46 -08:00

a9b5e8a136

Override truncation policy at model info level (#8856 )

We used to override truncation policy by comparing model info vs config
value in context manager. A better way to do it is to construct model
info using the config value

Ahmed Ibrahim · 2026-01-07 13:06:20 -08:00

187924d761

fix: implement 'Allow this session' for apply_patch approvals (#8451 )

**Summary**
This PR makes “ApprovalDecision::AcceptForSession / don’t ask again this
session” actually work for `apply_patch` approvals by caching approvals
based on absolute file paths in codex-core, properly wiring it through
app-server v2, and exposing the choice in both TUI and TUI2.
- This brings `apply_patch` calls to be at feature-parity with general
shell commands, which also have a "Yes, and don't ask again" option.
- This also fixes VSCE's "Allow this session" button to actually work.

While we're at it, also split the app-server v2 protocol's
`ApprovalDecision` enum so execpolicy amendments are only available for
command execution approvals.

**Key changes**
- Core: per-session patch approval allowlist keyed by absolute file
paths
- Handles multi-file patches and renames/moves by recording both source
and destination paths for `Update { move_path: Some(...) }`.
- Extend the `Approvable` trait and `ApplyPatchRuntime` to work with
multiple keys, because an `apply_patch` tool call can modify multiple
files. For a request to be auto-approved, we will need to check that all
file paths have been approved previously.
- App-server v2: honor AcceptForSession for file changes
- File-change approval responses now map AcceptForSession to
ReviewDecision::ApprovedForSession (no longer downgraded to plain
Approved).
- Replace `ApprovalDecision` with two enums:
`CommandExecutionApprovalDecision` and `FileChangeApprovalDecision`
- TUI / TUI2: expose “don’t ask again for these files this session”
- Patch approval overlays now include a third option (“Yes, and don’t
ask again for these files this session (s)”).
    - Snapshot updates for the approval modal.

**Tests added/updated**
- Core:
- Integration test that proves ApprovedForSession on a patch skips the
next patch prompt for the same file
- App-server:
- v2 integration test verifying
FileChangeApprovalDecision::AcceptForSession works properly

**User-visible behavior**
- When the user approves a patch “for session”, future patches touching
only those previously approved file(s) will no longer prompt gain during
that session (both via app-server v2 and TUI/TUI2).

**Manual testing**
Tested both TUI and TUI2 - see screenshots below.

TUI:
<img width="1082" height="355" alt="image"
src="https://github.com/user-attachments/assets/adcf45ad-d428-498d-92fc-1a0a420878d9"
/>


TUI2:
<img width="1089" height="438" alt="image"
src="https://github.com/user-attachments/assets/dd768b1a-2f5f-4bd6-98fd-e52c1d3abd9e"
/>

Owen Lin · 2026-01-07 20:11:12 +00:00

66450f0445

chore: drop some deprecated (#8848 )

jif-oai · 2026-01-07 19:54:45 +00:00

fe460e0f9a

chore: drop useless feature flags (#8850 )

jif-oai · 2026-01-07 19:54:32 +00:00

1253d19641

Stop using AuthManager as the source of codex_home (#8846 )

pakrym-oai · 2026-01-07 18:56:20 +00:00

018de994b0

remove unnecessary todos (#8842 )

> // todo(aibrahim): why are we passing model here while it can change?

we update it on each turn with `.with_model`

> //TODO(aibrahim): run CI in release mode.

although it's good to have, release builds take double the time tests
take.

> // todo(aibrahim): make this async function

we figured out another way of doing this sync

Ahmed Ibrahim · 2026-01-07 10:43:10 -08:00

c31960b13a

Merge Modelfamily into modelinfo (#8763 )

- Merge ModelFamily into ModelInfo
- Remove logic for adding instructions to apply patch
- Add compaction limit and visible context window to `ModelInfo`

Ahmed Ibrahim · 2026-01-07 10:35:09 -08:00

9179c9deac

Move tests below auth manager (#8840 )

To simplify future diffs

pakrym-oai · 2026-01-07 17:36:44 +00:00

fedcb8f63c

chore: unify conversation with thread name (#8830 )

Done and verified by Codex + refactor feature of RustRover

jif-oai · 2026-01-07 17:04:53 +00:00

116059c3a0

chore: rename unified exec sessions (#8822 )

Renaming done by Codex

jif-oai · 2026-01-07 16:12:47 +00:00

4cef89a122

Enable model upgrade popup even when selected model is no longer in picker (#8802 )

With `config.toml`:
```
model = "gpt-5.1-codex"
```
(where `gpt-5.1-codex` has `show_in_picker: false` in
[`model_presets.rs`](https://github.com/openai/codex/blob/main/codex-rs/core/src/models_manager/model_presets.rs);
this happens if the user hasn't used codex in a while so they didn't see
the popup before their model was changed to `show_in_picker: false`)

The upgrade picker used to not show (because `gpt-5.1-codex` was
filtered out of the model list in code). Now, the filtering is done
downstream in tui and app-server, so the model upgrade popup shows:

<img width="1503" height="227" alt="Screenshot 2026-01-06 at 5 04 37 PM"
src="https://github.com/user-attachments/assets/26144cc2-0b3f-4674-ac17-e476781ec548"
/>

charley-oai · 2026-01-06 19:32:27 -08:00

3389465c8d

add web_search_cached flag (#8795 )

Add `web_search_cached` feature to config. Enables `web_search` tool
with access only to cached/indexed results (see
[docs](https://platform.openai.com/docs/guides/tools-web-search#live-internet-access)).

This takes precedence over the existing `web_search_request`, which
continues to enable `web_search` over live results as it did before.

`web_search_cached` is disabled for review mode, as `web_search_request`
is.

sayan-oai · 2026-01-06 14:53:59 -08:00

54ded1a3c0

feat(app-server): thread/rollback API (#8454 )

Add `thread/rollback` to app-server to support IDEs undo-ing the last N
turns of a thread.

For context, an IDE partner will be supporting an "undo" capability
where the IDE (the app-server client) will be responsible for reverting
the local changes made during the last turn. To support this well, we
also need a way to drop the last turn (or more generally, the last N
turns) from the agent's context. This is what `thread/rollback` does.

**Core idea**: A Thread rollback is represented as a persisted event
message (EventMsg::ThreadRollback) in the rollout JSONL file, not by
rewriting history. On resume, both the model's context (core replay) and
the UI turn list (app-server v2's thread history builder) apply these
markers so the pruned history is consistent across live conversations
and `thread/resume`.

Implementation notes:
- Rollback only affects agent context and appends to the rollout file;
clients are responsible for reverting files on disk.
- If a thread rollback is currently in progress, subsequent
`thread/rollback` calls are rejected.
- Because we use `CodexConversation::submit` and codex core tracks
active turns, returning an error on concurrent rollbacks is communicated
via an `EventMsg::Error` with a new variant
`CodexErrorInfo::ThreadRollbackFailed`. app-server watches for that and
sends the BAD_REQUEST RPC response.

Tests cover thread rollbacks in both core and app-server, including when
`num_turns` > existing turns (which clears all turns).

**Note**: this explicitly does **not** behave like `/undo` which we just
removed from the CLI, which does the opposite of what `thread/rollback`
does. `/undo` reverts local changes via ghost commits/snapshots and does
not modify the agent's context / conversation history.

Owen Lin · 2026-01-06 21:23:48 +00:00

8b7ec31ba7

feat: drop agent bus and store the agent status in codex directly (#8788 )

jif-oai · 2026-01-06 19:44:39 +00:00

188f79afee

feat: agent controller (#8783 )

Added an agent control plane that lets sessions spawn or message other
conversations via `AgentControl`.

`AgentBus` (core/src/agent/bus.rs) keeps track of the last known status
of a conversation.

ConversationManager now holds shared state behind an Arc so AgentControl
keeps only a weak back-reference, the goal is just to avoid explicit
cycle reference.

Follow-ups:
* Build a small tool in the TUI to be able to see every agent and send
manual message to each of them
* Handle approval requests in this TUI
* Add tools to spawn/communicate between agents (see related design)
* Define agent types

jif-oai · 2026-01-06 19:08:02 +00:00

1dd1355df3

feat: add analytics config setting (#8350 )

Javi · 2026-01-06 19:04:13 +00:00

915352b10c

feat: add head-tail buffer for unified_exec (#8735 )

jif-oai · 2026-01-06 15:48:44 +00:00

32db8ea5ca

fix: stop honoring CODEX_MANAGED_CONFIG_PATH environment variable in production (#8762 )

Michael Bolin · 2026-01-06 07:10:27 -08:00

7ecd0dc9b3

chore: emit unified exec begin only when PTY exist (#8780 )

jif-oai · 2026-01-06 13:12:54 +00:00

8858012fd1

Use ConfigLayerStack for skills discovery. (#8497 )

Use ConfigLayerStack to get all folders while loading skills.

xl-openai · 2026-01-05 13:47:39 -08:00

58a91a0b50

feat: add justification arg to prefix_rule() in *.rules (#8751 )

Adds an optional `justification` parameter to the `prefix_rule()`
execpolicy DSL so policy authors can attach human-readable rationale to
a rule. That justification is propagated through parsing/matching and
can be surfaced to the model (or approval UI) when a command is blocked
or requires approval.

When a command is rejected (or gated behind approval) due to policy, a
generic message makes it hard for the model/user to understand what went
wrong and what to do instead. Allowing policy authors to supply a short
justification improves debuggability and helps guide the model toward
compliant alternatives.

Example:

```python
prefix_rule(
    pattern = ["git", "push"],
    decision = "forbidden",
    justification = "pushing is blocked in this repo",
)
```

If Codex tried to run `git push origin main`, now the failure would
include:

```
`git push origin main` rejected: pushing is blocked in this repo
```

whereas previously, all it was told was:

```
execpolicy forbids this command
```

Michael Bolin · 2026-01-05 21:24:48 +00:00

cafb07fe6e

chore: improve skills render section (#8459 )

This change improves the skills render section
- Separate the skills list from usage rules with clear subheadings
- Define skill more clearly upfront
- Remove confusing trigger/discovery wording and make reference-following guidance more actionable

Gav Verma · 2026-01-05 11:55:26 -08:00

57f8158608

chore: GH pager (#8747 )

jif-oai · 2026-01-05 18:40:34 +00:00

fabb797097

feat: expose outputSchema to user_turn/turn_start app_server API (#8377 )

What changed
- Added `outputSchema` support to the app-server APIs, mirroring `codex
exec --output-schema` behavior.
- V1 `sendUserTurn` now accepts `outputSchema` and constrains the final
assistant message for that turn.
- V2 `turn/start` now accepts `outputSchema` and constrains the final
assistant message for that turn (explicitly per-turn only).

Core behavior
- `Op::UserTurn` already supported `final_output_json_schema`; now V1
`sendUserTurn` forwards `outputSchema` into that field.
- `Op::UserInput` now carries `final_output_json_schema` for per-turn
settings updates; core maps it into
`SessionSettingsUpdate.final_output_json_schema` so it applies to the
created turn context.
- V2 `turn/start` does NOT persist the schema via `OverrideTurnContext`
(it’s applied only for the current turn). Other overrides
(cwd/model/etc) keep their existing persistent behavior.

API / docs
- `codex-rs/app-server-protocol/src/protocol/v1.rs`: add `output_schema:
Option<serde_json::Value>` to `SendUserTurnParams` (serialized as
`outputSchema`).
- `codex-rs/app-server-protocol/src/protocol/v2.rs`: add `output_schema:
Option<JsonValue>` to `TurnStartParams` (serialized as `outputSchema`).
- `codex-rs/app-server/README.md`: document `outputSchema` for
`turn/start` and clarify it applies only to the current turn.
- `codex-rs/docs/codex_mcp_interface.md`: document `outputSchema` for v1
`sendUserTurn` and v2 `turn/start`.

Tests added/updated
- New app-server integration tests asserting `outputSchema` is forwarded
into outbound `/responses` requests as `text.format`:
  - `codex-rs/app-server/tests/suite/output_schema.rs`
  - `codex-rs/app-server/tests/suite/v2/output_schema.rs`
- Added per-turn semantics tests (schema does not leak to the next
turn):
  - `send_user_turn_output_schema_is_per_turn_v1`
  - `turn_start_output_schema_is_per_turn_v2`
- Added protocol wire-compat tests for the merged op:
  - serialize omits `final_output_json_schema` when `None`
  - deserialize works when field is missing
  - serialize includes `final_output_json_schema` when `Some(schema)`

Call site updates (high level)
- Updated all `Op::UserInput { .. }` constructions to include
`final_output_json_schema`:
  - `codex-rs/app-server/src/codex_message_processor.rs`
  - `codex-rs/core/src/codex_delegate.rs`
  - `codex-rs/mcp-server/src/codex_tool_runner.rs`
  - `codex-rs/tui/src/chatwidget.rs`
  - `codex-rs/tui2/src/chatwidget.rs`
  - plus impacted core tests.

Validation
- `just fmt`
- `cargo test -p codex-core`
- `cargo test -p codex-app-server`
- `cargo test -p codex-mcp-server`
- `cargo test -p codex-tui`
- `cargo test -p codex-tui2`
- `cargo test -p codex-protocol`
- `cargo clippy --all-features --tests --profile dev --fix -- -D
warnings`

Anton Panasenko · 2026-01-05 10:27:00 -08:00

807f8a43c2

(MacOS) Load config requirements from MDM (#8743 )

Load managed requirements from MDM key `requirements_toml_base64`.

Tested on my Mac (using `defaults` to set the preference, though this
would be set by MDM in production):

```
➜  codex git:(gt/mdm-requirements) defaults read com.openai.codex requirements_toml_base64 | base64 -d
allowed_approval_policies = ["on-request"]

➜  codex git:(gt/mdm-requirements) just c --yolo
cargo run --bin codex -- "$@"
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.26s
     Running `target/debug/codex --yolo`
Error loading configuration: value `Never` is not in the allowed set [OnRequest]
error: Recipe `codex` failed on line 11 with exit code 1

➜  codex git:(gt/mdm-requirements) defaults delete com.openai.codex requirements_toml_base64

➜  codex git:(gt/mdm-requirements) just c --yolo
cargo run --bin codex -- "$@"
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.24s
     Running `target/debug/codex --yolo`
╭──────────────────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.0.0)                                 │
│                                                          │
│ model:     codex-auto-balanced medium   /model to change │
│ directory: ~/code/codex/codex-rs                         │
╰──────────────────────────────────────────────────────────╯

  Tip: Start a fresh idea with /new; the previous session stays in history.
```

gt-oai · 2026-01-05 17:41:27 +00:00

1d8e2b4da8

[MCP] Sanitize MCP tool names to ensure they are compatible with the Responses APO (#8694 )

The Responses API requires that all tool names conform to
'^[a-zA-Z0-9_-]+$'. This PR replaces all non-conforming characters with
`_` to ensure that they can be used.

Fixes #8174

Gabriel Peal · 2026-01-05 09:00:45 -08:00

468ee8a75c

fix: /review to respect session cwd (#8738 )

Fixes /review base-branch prompt resolution to use the session/turn cwd
(respecting runtime cwd overrides) so merge-base/diff guidance is
computed from the intended repo; adds a regression test for cwd
overrides; tested with cargo test -p codex-core --test all
review_uses_overridden_cwd_for_base_branch_merge_base.

Thibault Sottiaux · 2026-01-05 12:11:20 +00:00

0b53aed2d0

Attach more tags to feedback submissions (#8688 )

Attach more tags to sentry feedback so it's easier to classify and debug
without having to scan through logs.

Formatting isn't amazing but it's a start.
<img width="1234" height="276" alt="image"
src="https://github.com/user-attachments/assets/521a349d-f627-4051-b511-9811cd5cd933"
/>

pakrym-oai · 2026-01-02 16:51:03 -08:00

1b5095b5d1

hard disable remote models refresh when feature is disabled (#8687 )

We were refreshing on tag mismatch even with feature is disabled

Ahmed Ibrahim · 2026-01-02 15:22:51 -08:00

6846bc1115

Account for last token count on resume (#8677 )

last token count in context manager is initialized to 0. Gets populated
only on events from server.

This PR populates it on resume so we can decide if we need to compact or
not.

Ahmed Ibrahim · 2026-01-02 23:20:20 +00:00

efd2d76484

997 Commits