4756 Commits

This Branch

This Branch

All Branches

• Finish moving codex exec to app-server (#15424)

  This PR completes the conversion of non-interactive `codex exec` to use
  app server rather than directly using core events and methods.
  
  ### Summary
  - move `codex-exec` off exec-owned `AuthManager` and `ThreadManager`
  state
  - route exec bootstrap, resume, and auth refresh through existing
  app-server paths
  - replace legacy `codex/event/*` decoding in exec with typed app-server
  notification handling
  - update human and JSONL exec output adapters to translate existing
  app-server notifications only
  - clean up "app server client" layer by eliminating support for legacy
  notifications; this is no longer needed
  - remove exposure of `authManager` and `threadManager` from "app server
  client" layer
  
  ### Testing
  - `exec` has pretty extensive unit and integration tests already, and
  these all pass
  - In addition, I asked Codex to put together a comprehensive manual set
  of tests to cover all of the `codex exec` functionality (including
  command-line options), and it successfully generated and ran these tests

  Eric Traut · 2026-03-24 08:51:32 -06:00
  45f68843b8
• Allow global network allowlist wildcard (#15549)

  ## Problem
  
  Today `codex-network-proxy` rejects a global `*` in
  `network.allowed_domains`, so there is no static way to configure a
  denylist-only posture for public hosts. Users have to enumerate broad
  allowlist patterns instead.
  
  ## Approach
  
  - Make global wildcard acceptance field-specific: `allowed_domains` can
  use `*`, while `denied_domains` still rejects a global wildcard.
  - Keep the existing evaluation order, so explicit denies still win first
  and local/private protections still apply unless separately enabled.
  - Add coverage for the denylist-only behavior and update the README to
  document it.
  
  ## Validation
  
  - `just fmt`
  - `cargo test -p codex-network-proxy` (full run had one unrelated flaky
  telemetry test:
  `network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event`;
  reran in isolation and it passed)
  - `cargo test -p codex-network-proxy
  network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event
  -- --exact --nocapture`
  - `just fix -p codex-network-proxy`
  - `just argument-comment-lint`

  rreichel3-oai · 2026-03-24 10:43:46 -04:00
  1db6cb9789
• nit: optim on list agents (#15623)

  Lazy computation

  jif-oai · 2026-03-24 12:01:01 +00:00
  95e1d59939
• feat: list agents for sub-agent v2 (#15621)

  Add a `list_agents` for multi-agent v2, optionally path based
  
  This return the task and status of each agent in the matched path

  jif-oai · 2026-03-24 11:24:08 +00:00
  38c088ba8d
• fix: flaky test (#15614)
  jif-oai · 2026-03-24 11:01:54 +00:00
  567832c6fe
• nit: split v2 wait (#15613)
  jif-oai · 2026-03-24 09:57:19 +00:00
  f9545278e2
• Stabilize macOS CI test timeouts (#15581)

  ## Summary
  - raise the shell snapshot apply_patch helper timeout to avoid macOS CI
  startup races
  - increase the shared MCP app-server test read timeout so slow
  initialize handshakes do not fail command_exec tests spuriously
  
  ## Testing
  - cargo test -p codex-core
  shell_command_snapshot_still_intercepts_apply_patch
  - cargo test -p codex-app-server
  command_exec_tty_implies_streaming_and_reports_pty_output
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-03-24 09:33:20 +00:00
  79577355c1
• Remove filter from plugins/list result (#15580)

  Show all plugin marketplaces in the /plugins popup by removing the
  `openai-curated` marketplace filter, and update plugin popup
  copy/tests/snapshots to match the new behavior in both TUI codepaths.

  canvrno-oai · 2026-03-23 23:41:01 -07:00
  c850607129
• Move sandbox policy transforms into codex-sandboxing (#15599)

  ## Summary
  - move the pure sandbox policy transform helpers from `codex-core` into
  `codex-sandboxing`
  - move the corresponding unit tests with the extracted implementation
  - update `core` and `app-server` callers to import the moved APIs
  directly, without re-exports or proxy methods
  
  ## Testing
  - cargo test -p codex-sandboxing
  - cargo test -p codex-core sandboxing
  - cargo test -p codex-app-server --lib
  - just fix -p codex-sandboxing
  - just fix -p codex-core
  - just fix -p codex-app-server
  - just fmt
  - just argument-comment-lint

  pakrym-oai · 2026-03-23 22:22:44 -07:00
  9deb8ce3fc
• move imagegen skill into system skills (#15600)

  Add imagegen skill as built-in skill. Source: github.com/openai/skills

  Dominik Kundel · 2026-03-24 05:14:33 +00:00
  a10960e41c
• [codex-cli][app-server] Update self-serve business usage limit copy in error returned (#15478)

  ## Summary
  - update the self-serve business usage-based limit message to direct
  users to their admin for additional credits
  - add a focused unit test for the self_serve_business_usage_based plan
  branch
  
  Added also: 
  
  If you are at a rate limit but you still have credits, codex cli would
  tell you to switch the model. We shouldnt do this if you have credits so
  fixed this.
  
  ## Test
  - launched the source-built CLI and verified the updated message is
  shown for the self-serve business usage-based plan
  
  ![Test
  screenshot](https://raw.githubusercontent.com/openai/codex/5cc3c013ef17ac5c66dfd9395c0d3c4837602231/docs/images/self-serve-business-usage-limit.png)

  dhruvgupta-oai · 2026-03-24 04:41:38 +00:00
  c2410060ea
• Move macOS sandbox builders into codex-sandboxing (#15593)

  ## Summary
  - move macOS permission merging/intersection logic and tests from
  `codex-core` into `codex-sandboxing`
  - move seatbelt policy builders, permissions logic, SBPL assets, and
  their tests into `codex-sandboxing`
  - keep `codex-core` owning only the seatbelt spawn wrapper and switch
  call sites to import the moved APIs directly
  
  ## Notes
  - no re-exports added
  - moved the seatbelt tests with the implementation so internal helpers
  could stay private
  - local verification is still finishing while this PR is open

  pakrym-oai · 2026-03-23 21:26:35 -07:00
  431af0807c
• Extract landlock helpers into codex-sandboxing (#15592)

  ## Summary
  - add a new `codex-sandboxing` crate for sandboxing extraction work
  - move the pure Linux sandbox argv builders and their unit tests out of
  `codex-core`
  - keep `core::landlock` as the spawn wrapper and update direct callers
  to use `codex_sandboxing::landlock`
  
  ## Testing
  - `cargo test -p codex-sandboxing`
  - `cargo test -p codex-core landlock`
  - `cargo test -p codex-cli debug_sandbox`
  - `just argument-comment-lint`
  
  ## Notes
  - this is step 1 of the move plan aimed at minimizing per-PR diffs
  - no re-exports or no-op proxy methods were added

  pakrym-oai · 2026-03-23 20:56:15 -07:00
  2227248cd6
• Add plugin-creator as system skill (#15554)
  alexsong-oai · 2026-03-23 19:08:30 -07:00
  db8bb7236d
• Add fork snapshot modes (#15239)

  ## Summary
  - add `ForkSnapshotMode` to `ThreadManager::fork_thread` so callers can
  request either a committed snapshot or an interrupted snapshot
  - share the model-visible `<turn_aborted>` history marker between the
  live interrupt path and interrupted forks
  - update the small set of direct fork callsites to pass
  `ForkSnapshotMode::Committed`
  
  Note: this enables /btw to work similarly as Esc to interrupt (hopefully
  somewhat in distribution)
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-23 19:05:42 -07:00
  f547b79bd0
• fix: build PATH env var using OsString instead of String (#15360)
  Michael Bolin · 2026-03-23 18:59:04 -07:00
  84fb180eeb
• feat: custom watcher for multi-agent v2 (#15576)

  The new wait tool just returns `Wait timed out.` or `Wait completed.`.
  The actual content is done through the notification watcher

  jif-oai · 2026-03-23 23:27:55 +00:00
  527244910f
• feat: custom watcher for multi-agent v2 (#15575)
  jif-oai · 2026-03-23 22:57:54 +00:00
  0b5ba25b46
• feat: custom watcher for multi-agent v2 (#15570)

  Custom watcher that sends an InterAgentCommunication on end of turn

  jif-oai · 2026-03-23 22:56:17 +00:00
  4605c65308
• [codex] Add rollback context duplication snapshot (#15562)

  ## What changed
  - adds a targeted snapshot test for rollback with contextual diffs in
  `codex_tests.rs`
  - snapshots the exact model-visible request input before the rolled-back
  turn and on the follow-up request after rollback
  - shows the duplicate developer and environment context pair appearing
  again before the follow-up user message
  
  ## Why
  Rollback currently rewinds the reference context baseline without
  rewinding the live session overrides. On the next turn, the same
  contextual diff is emitted again and duplicated in the request sent to
  the model.
  
  ## Impact
  - makes the regression visible in a canonical snapshot test
  - keeps the snapshot on the shared `context_snapshot` path without
  adding new formatting helpers
  - gives a direct repro for future fixes to rollback/context
  reconstruction
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-23 15:36:23 -07:00
  0f34b14b41
• chore(core) Add approvals reviewer to UserTurn (#15426)

  ## Summary
  Adds support for approvals_reviewer to `Op::UserTurn` so we can migrate
  `[CodexMessageProcessor::turn_start]` to use Op::UserTurn
  
  ## Testing
  - [x] Adds quick test for the new field
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-03-23 15:19:01 -07:00
  67c1c7c054
• feat: use serde to differenciate inter agent communication (#15560)

  Use `serde` to encode the inter agent communication to an assistant
  message and use the decode to see if this is such a message
  
  Note: this assume serde on small pattern is fast enough

  jif-oai · 2026-03-23 22:09:55 +00:00
  191fd9fd16
• [hooks] add non-streaming (non-stdin style) shell-only PreToolUse support (#15211)

  - add `PreToolUse` hook for bash-like tool execution only at first
  - block shell execution before dispatch with deny-only hook behavior
  - introduces common.rs matcher framework for matching when hooks are run
  
  example run:
  
  ```
  › run three parallel echo commands, and the second one should echo "[block-pre-tool-use]" as a test
  
  
  • Running the three echo commands in parallel now and I’ll report the output directly.
  
  • Running PreToolUse hook: name for demo pre tool use hook
  
  • Running PreToolUse hook: name for demo pre tool use hook
  
  • Running PreToolUse hook: name for demo pre tool use hook
  
  PreToolUse hook (completed)
    warning: wizard-tower PreToolUse demo inspected Bash: echo "first parallel echo"
    
  PreToolUse hook (blocked)
    warning: wizard-tower PreToolUse demo blocked a Bash command on purpose.
    feedback: PreToolUse demo blocked the command. Remove [block-pre-tool-use] to continue.
  
  PreToolUse hook (completed)
    warning: wizard-tower PreToolUse demo inspected Bash: echo "third parallel echo"
  
  • Ran echo "first parallel echo"
    └ first parallel echo
  
  • Ran echo "third parallel echo"
    └ third parallel echo
  
  • Three little waves went out in parallel.
  
    1. printed first parallel echo
    2. was blocked before execution because it contained the exact test string [block-pre-tool-use]
    3. printed third parallel echo
  
    There was also an unrelated macOS defaults warning around the successful commands, but the echoes
    themselves worked fine. If you want, I can rerun the second one with a slightly modified string so
    it passes cleanly.
  ```

  Andrei Eternal · 2026-03-23 14:32:59 -07:00
  73bbb07ba8
• feat: new op type for sub-agents communication (#15556)

  Add `InterAgentCommunication` for v2 agent communication

  jif-oai · 2026-03-23 21:09:00 +00:00
  18f1a08bc9
• fix: main tui (#15557)
  jif-oai · 2026-03-23 20:51:07 +00:00
  7eb9e75b86
• Unify realtime stop handling in TUI (#15529)

  ## Summary
  - route /realtime, Ctrl+C, and deleted realtime meters through the same
  realtime stop path
  - keep generic transcription placeholder cleanup free of realtime
  shutdown side effects
  
  ## Testing
  - Ran 
  - Relied on CI for verification; did not run local tests
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-23 13:47:33 -07:00
  7b92a90612
• feat: support disable skills by name. (#15378)

  Support disabling skills by name, primarily for plugin skills. We can’t
  use the path, since plugin skill paths may change across versions.

  xl-openai · 2026-03-23 12:57:40 -07:00
  9a33e5c0a0
• Thread guardian Responses API errors into denial rationale (#15516)

  ## Summary
  - capture the last guardian `EventMsg::Error` while waiting for review
  completion
  - reuse that error as the denial rationale when the review turn
  completes without an assessment payload
  - add a regression test for the `/responses` HTTP 400 path
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-core
  guardian_review_surfaces_responses_api_errors_in_rejection_reason`
  - `just argument-comment-lint -p codex-core`
  
  ## Notes
  - `cargo test -p codex-core` still fails on the pre-existing unrelated
  test
  `tools::js_repl::tests::js_repl_imported_local_files_can_access_repl_globals`
  in this environment (`mktemp ... Operation not permitted` while
  downloading `dotslash`)
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-23 12:46:49 -07:00
  332edba78e
• chore: split sub-agent v2 implementation (#15540)

  Just to make things cleaner

  jif-oai · 2026-03-23 19:41:53 +00:00
  450dc289c3
• Plugins TUI install/uninstall (#15342)

  - Add install/uninstall actions to the TUI plugins menu
  - Wire plugin install/uninstall through both TUI and `tui_app_server`
  - Refresh config/plugin state after changes so the UI updates
  immediately
  - Add a post-install app setup flow for plugins that require additional
  app auth
  
  <img width="1567" height="300" alt="Screenshot 2026-03-20 at 4 08 44 PM"
  src="https://github.com/user-attachments/assets/366bd31b-2ffd-4e80-b4a3-3a9a9c674a5f"
  />
  <img width="445" height="240" alt="Screenshot 2026-03-20 at 4 08 54 PM"
  src="https://github.com/user-attachments/assets/613999ab-269a-4758-ab59-7c057a1742dc"
  />
  <img width="797" height="219" alt="Screenshot 2026-03-20 at 4 09 07 PM"
  src="https://github.com/user-attachments/assets/b9679e60-40f5-49bb-ade0-2e40449c3fbf"
  />
  <img width="499" height="235" alt="Screenshot 2026-03-20 at 4 09 24 PM"
  src="https://github.com/user-attachments/assets/261ce2fe-f356-4e99-8ac9-f29ed850bc75"
  />
  
  
  
  
  Note/known issue: The /plugin install flow fails in `tui_app_server`
  because after a successful install it tries to trigger a
  ReloadUserConfig operation, but `tui_app_server` has not yet implemented
  transport for that operation, so it falls through to the generic “Not
  available in app-server TUI yet” stub.

  canvrno-oai · 2026-03-23 12:38:39 -07:00
  b5d0a5518d
• Fix: proactive auth refresh to reload guarded disk state first (#15357)

  ## Summary
  
  Fix a managed ChatGPT auth bug where a stale Codex process could
  proactively refresh using an old in-memory refresh token even after
  another process had already rotated auth on disk.
  
  This changes the proactive `AuthManager::auth()` path to reuse the
  existing guarded `refresh_token()` flow instead of calling the refresh
  endpoint directly from cached auth state.
  
  ## Original Issue
  
  Users reported repeated `codexd` log lines like:
  
  ```text
  ERROR codex_core::auth: Failed to refresh token: error sending request for url (https://auth.openai.com/oauth/token)
  ```
  
  In practice this showed up most often when multiple `codexd` processes
  were left running. Killing the extra processes stopped the noise, which
  suggested the issue was caused by stale auth state across processes
  rather than invalid user credentials.
  
  ## Diagnosis
  
  The bug was in the proactive refresh path used by `AuthManager::auth()`:
  
  - Process A could refresh successfully, rotate refresh token `R0` to
  `R1`, and persist the updated auth state plus `last_refresh` to disk.
  - Process B could keep an older auth snapshot cached in memory, still
  holding `R0` and the old `last_refresh`.
  - Later, when Process B called `auth()`, it checked staleness from its
  cached in-memory auth instead of first reloading from disk.
  - Because that cached `last_refresh` was stale, Process B would
  proactively call `/oauth/token` with stale refresh token `R0`.
  - On failure, `auth()` logged the refresh error but kept returning the
  same stale cached auth, so repeated `auth()` calls could keep retrying
  with dead state.
  
  This differed from the existing unauthorized-recovery flow, which
  already did the safer thing: guarded reload from disk first, then
  refresh only if the on-disk auth was unchanged.
  
  ## What Changed
  
  - Switched proactive refresh in `AuthManager::auth()` to:
    - do a pure staleness check on cached auth
    - call `refresh_token()` when stale
  - return the original cached auth on genuine refresh failure, preserving
  existing outward behavior
  - Removed the direct proactive refresh-from-cached-state path
  - Added regression tests covering:
    - stale cached auth with newer same-account auth already on disk
  - the same scenario even when the refresh endpoint would fail if called
  
  ## Why This Fix
  
  `refresh_token()` already contains the right cross-process safety
  behavior:
  
  - guarded reload from disk
  - same-account verification
  - skip-refresh when another process already changed auth
  
  Reusing that path makes proactive refresh consistent with unauthorized
  recovery and prevents stale processes from trying to refresh
  already-rotated tokens.
  
  ## Testing
  
  Test shape:
  
  - create a fresh temp `CODEX_HOME` from `~/.codex/auth.json`
  - force `last_refresh` to an old timestamp so proactive refresh is
  required
  - start two long-lived helper processes against the same auth file
  - start `B` first so it caches stale auth and sleeps
  - start `A` second so it refreshes first
  - point both at a local mock `/oauth/token` server
  - inspect whether `B` makes a second refresh request with the stale
  in-memory token, or reloads the rotated token from disk
  
  ### Before the fix
  
  The repro showed the bug clearly: the mock server saw two refreshes with
  the same stale token, `A` rotated to a new token, and `B` still returned
  the stale token instead of reloading from disk.
  
  ```text
  POST /oauth/token refresh_token=rt_j6s0...
  POST /oauth/token refresh_token=rt_j6s0...
  
  B:cached_before=rt_j6s0...
  B:cached_after=rt_j6s0...
  B:returned=rt_j6s0...
  
  A:cached_before=rt_j6s0...
  A:cached_after=rotated-refresh-token-logged-run-v2
  A:returned=rotated-refresh-token-logged-run-v2
  ```
  
  ### After the fix
  
  After the fix, the mock server saw only one refresh request. `A`
  refreshed once, and `B` started with the stale token but reloaded and
  returned the rotated token.
  
  ```text
  POST /oauth/token refresh_token=rt_j6s0...
  
  B:cached_before=rt_j6s0...
  B:cached_after=rotated-refresh-token-fix-branch
  B:returned=rotated-refresh-token-fix-branch
  
  A:cached_before=rt_j6s0...
  A:cached_after=rotated-refresh-token-fix-branch
  A:returned=rotated-refresh-token-fix-branch
  ```
  
  This shows the new behavior: `A` refreshes once, then `B` reuses the
  updated auth from disk instead of making a second refresh request with
  the stale token.

  Celia Chen · 2026-03-23 12:07:59 -07:00
  f55f5c258f
• feat: structured multi-agent output (#15515)

  Send input now sends messages as assistant message and with this format:
  
  ```
  author: /root/worker_a
  recipient: /root/worker_a/tester
  other_recipients: []
  Content: bla bla bla. Actual content. Only text for now
  ```

  jif-oai · 2026-03-23 18:53:54 +00:00
  37ac0c093c
• tui: queue follow-ups during manual /compact (#15259)

  ## Summary
  - queue input after the user submits `/compact` until that manual
  compact turn ends
  - mirror the same behavior in the app-server TUI
  - add regressions for input queued before compact starts and while it is
  running
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-23 10:19:44 -07:00
  e838645fa2
• Label plugins as plugins, and hide skills/apps for given plugin (#15279)

  - Duplicate app mentions are now suppressed when they’re plugin-backed
  with the same display name.
  - Remaining connector mentions now label category as [Plugin] when
  plugin metadata is present, otherwise [App].
  - Mention result lists are now capped to 8 rows after filtering.
  - Updates both tui and tui_app_server with the same changes.

  canvrno-oai · 2026-03-23 10:10:17 -07:00
  54801634e1
• fix: cargo deny (#15520)
  jif-oai · 2026-03-23 16:48:54 +00:00
  2887f16cb9
• fix: fall back to vendored bubblewrap when system bwrap lacks --argv0 (#15338)

  ## Why
  
  Fixes [#15283](https://github.com/openai/codex/issues/15283), where
  sandboxed tool calls fail on older distro `bubblewrap` builds because
  `/usr/bin/bwrap` does not understand `--argv0`. The upstream [bubblewrap
  v0.9.0 release
  notes](https://github.com/containers/bubblewrap/releases/tag/v0.9.0)
  explicitly call out `Add --argv0`. Flipping `use_legacy_landlock`
  globally works around that compatibility bug, but it also weakens the
  default Linux sandbox and breaks proxy-routed and split-policy cases
  called out in review.
  
  The follow-up Linux CI failure was in the new launcher test rather than
  the launcher logic: the fake `bwrap` helper stayed open for writing, so
  Linux would not exec it. This update also closes the user-visibility gap
  from review by surfacing the same startup warning when `/usr/bin/bwrap`
  is present but too old for `--argv0`, not only when it is missing.
  
  ## What Changed
  
  - keep `use_legacy_landlock` default-disabled
  - teach `codex-rs/linux-sandbox/src/launcher.rs` to fall back to the
  vendored bubblewrap build when `/usr/bin/bwrap` does not advertise
  `--argv0` support
  - add launcher tests for supported, unsupported, and missing system
  `bwrap`
  - write the fake `bwrap` test helper to a closed temp path so the
  supported-path launcher test works on Linux too
  - extend the startup warning path so Codex warns when `/usr/bin/bwrap`
  is missing or too old to support `--argv0`
  - mirror the warning/fallback wording across
  `codex-rs/linux-sandbox/README.md` and `codex-rs/core/README.md`,
  including that the fallback is the vendored bubblewrap compiled into the
  binary
  - cite the upstream `bubblewrap` release that introduced `--argv0`
  
  ## Verification
  
  - `bazel test --config=remote --platforms=//:rbe
  //codex-rs/linux-sandbox:linux-sandbox-unit-tests
  --test_filter=launcher::tests::prefers_system_bwrap_when_help_lists_argv0
  --test_output=errors`
  - `cargo test -p codex-core system_bwrap_warning`
  - `cargo check -p codex-exec -p codex-tui -p codex-tui-app-server -p
  codex-app-server`
  - `just argument-comment-lint`

  Michael Bolin · 2026-03-23 09:46:51 -07:00
  d1088158b8
• nit: guard -> registry (#15317)
  jif-oai · 2026-03-23 10:02:11 +00:00
  d807d44ae7
• Use Shift+Left to edit queued messages in tmux (#15480)

  ## Summary
  - use Shift+Left to edit the most recent queued message when running
  under tmux
  - mirror the same binding change in the app-server TUI
  - add tmux-specific tests and snapshot coverage for the rendered
  queued-message hint
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui
  - cargo test -p codex-tui-app-server
  - just argument-comment-lint -p codex-tui -p codex-tui-app-server
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-22 21:19:31 -07:00
  5e3793def2
• core: snapshot fork startup context injection (#15443)

  ## Summary
  - add a snapshot-style core test for fork startup context injection
  followed by first-turn diff injection
  - capture the current duplicated startup-plus-turn context behavior
  without changing runtime logic
  
  ## Testing
  - not run locally; relying on CI
  - just fmt
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-22 18:24:14 -07:00
  85065ea1b8
• Remove smart_approvals alias migration (#15464)

  Remove the legacy `smart_approvals` config migration from core config
  loading.
  
  This change:
  - stops rewriting `smart_approvals` into `guardian_approval`
  - stops backfilling `approvals_reviewer = "guardian_subagent"`
  - replaces the migration tests with regression coverage that asserts the
  deprecated key is ignored in root and profile scopes
  
  Verification:
  - `just fmt`
  - `cargo test -p codex-core smart_approvals_alias_is_ignored`
  - `cargo test -p codex-core approvals_reviewer_`
  - `just argument-comment-lint`
  
  Notes:
  - `cargo test -p codex-core` still hits an unrelated existing failure in
  `tools::js_repl::tests::js_repl_imported_local_files_can_access_repl_globals`;
  the JS REPL kernel exits after `mktemp` fails under the current
  environment.
  
  Enhancement request: requested cleanup to delete the `smart_approvals`
  alias migration; no public issue link is available.
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-22 17:10:42 -07:00
  e830000e41
• chore(exec_policy) ExecPolicyRequirementScenario tests (#15415)

  ## Summary
  Consolidate exec_policy_tests on `ExecApprovalRequirementScenario` for
  consistency.
  
  ## Testing
  - [x] These are tests

  Dylan Hurd · 2026-03-22 08:07:43 -07:00
  31728dd460
• [apps] Improve app tools loading for TUI. (#15376)

  - [x] Remove the app tools copy in TUI and reference the core tools
  instead, this reduces tools/list calls from 4 to just 1.

  Matthew Zeng · 2026-03-22 00:17:48 -07:00
  19702e190e
• Remove legacy auth and notification handling from tui_app_server (#15414)

  ## Summary
  - remove `tui_app_server` handling for legacy app-server notifications
  - drop the local ChatGPT auth refresh request path from `tui_app_server`
  - remove the now-unused refresh response helper from local auth loading
  
  Split out of #15106 so the `tui_app_server` cleanup can land separately
  from the larger `codex-exec` app-server migration.

  Eric Traut · 2026-03-21 15:06:10 -06:00
  cf0223887f
• Add JIT entitlement for macosx (#15409)

  Without this entitlement, hardened mac os release binaries are unable to
  allocate the executable memory for the JIT compiled JS.
  
  Tested with local signing.  Without entitlement I reproduce the error:
  ```
  #
  # Fatal process out of memory: Failed to reserve virtual memory for CodeRange
  #
  ==== C stack trace ===============================
  
      0   codex                               0x00000001075d1acc codex + 85760716
      1   codex                               0x00000001075d6a64 codex + 85781092
      2   codex                               0x00000001075c7100 codex + 85717248
      3   codex                               0x0000000107637394 codex + 86176660
      4   codex                               0x0000000107823cfc codex + 88194300
      5   codex                               0x000000010777c438 codex + 87508024
      6   codex                               0x000000010777d130 codex + 87511344
      7   codex                               0x0000000107c87a54 codex + 92797524
      8   codex                               0x0000000107641188 codex + 86217096
      9   codex                               0x00000001076412d8 codex + 86217432
      10  codex                               0x0000000107553908 codex + 85244168
      11  codex                               0x000000010465f124 codex + 36008228
      12  codex                               0x000000010466a0d0 codex + 36053200
      13  codex                               0x000000010466ce78 codex + 36064888
      14  codex                               0x000000010734edb0 codex + 83127728
      15  libsystem_pthread.dylib             0x00000001810d3c08 _pthread_start + 136
      16  libsystem_pthread.dylib             0x00000001810ceba8 thread_start + 8
  zsh: trace trap  target/release/codex exec --enable code_mode_only --enable code_mode --
  ```
  
  With the entitlement the exec succeeds.

  Channing Conger · 2026-03-21 13:43:14 -07:00
  c23566b3af
• Remove legacy app-server notification handling from tui_app_server (#15390)

  As part of moving the TUI onto the app server, we added some temporary
  handling of some legacy events. We've confirmed that these do not need
  to be supported, so this PR removes this support from the
  tui_app_server, allowing for additional simplifications in follow-on
  PRs. These events are needed only for very old rollouts. None of the
  other app server clients (IDE extension or app) support these either.
  
  ## Summary
  - stop translating legacy `codex/event/*` notifications inside
  `tui_app_server`
  - remove the TUI-side legacy warning and rollback buffering/replay paths
  that were only fed by those notifications
  - keep the lower-level app-server and app-server-client legacy event
  plumbing intact so PR #15106 can rebase on top and handle the remaining
  exec/lower-layer migration separately

  Eric Traut · 2026-03-21 12:29:33 -06:00
  b0236501e2
• chore(context) Include guardian approval context (#15366)

  ## Summary
  Include the guardian context in the developer message for approvals
  
  ## Testing
  - [x] Updated unit tests

  Dylan Hurd · 2026-03-21 16:31:22 +00:00
  0d9bb8ea58
• [plugins] Fix plugin explicit mention context management. (#15372)

  - [x] Fix plugin explicit mention context management.

  Matthew Zeng · 2026-03-21 00:29:29 -07:00
  06e06ab173
• Code mode on v8 (#15276)

  Moves Code Mode to a new crate with no dependencies on codex. This
  create encodes the code mode semantics that we want for lifetime,
  mounting, tool calling.
  
  The model-facing surface is mostly unchanged. `exec` still runs raw
  JavaScript, `wait` still resumes or terminates a `cell_id`, nested tools
  are still available through `tools.*`, and helpers like `text`, `image`,
  `store`, `load`, `notify`, `yield_control`, and `exit` still exist.
  
  The major change is underneath that surface:
  
  - Old code mode was an external Node runtime.
  - New code mode is an in-process V8 runtime embedded directly in Rust.
  - Old code mode managed cells inside a long-lived Node runner process.
  - New code mode manages cells in Rust, with one V8 runtime thread per
  active `exec`.
  - Old code mode used JSON protocol messages over child stdin/stdout plus
  Node worker-thread messages.
  - New code mode uses Rust channels and direct V8 callbacks/events.
  
  This PR also fixes the two migration regressions that fell out of that
  substrate change:
  
  - `wait { terminate: true }` now waits for the V8 runtime to actually
  stop before reporting termination.
  - synchronous top-level `exit()` now succeeds again instead of surfacing
  as a script error.
  
  ---
  
  - `core/src/tools/code_mode/*` is now mostly an adapter layer for the
  public `exec` / `wait` tools.
  - `code-mode/src/service.rs` owns cell sessions and async control flow
  in Rust.
  - `code-mode/src/runtime/*.rs` owns the embedded V8 isolate and
  JavaScript execution.
  - each `exec` spawns a dedicated runtime thread plus a Rust
  session-control task.
  - helper globals are installed directly into the V8 context instead of
  being injected through a source prelude.
  - helper modules like `tools.js` and `@openai/code_mode` are synthesized
  through V8 module resolution callbacks in Rust.
  
  ---
  
  Also added a benchmark for showing the speed of init and use of a code
  mode env:
  ```
  $ cargo bench -p codex-code-mode --bench exec_overhead -- --samples 30 --warm-iterations 25 --tool-counts 0,32,128
  Finished [`bench` profile [optimized]](https://doc.rust-lang.org/cargo/reference/profiles.html#default-profiles) target(s) in 0.18s
       Running benches/exec_overhead.rs (target/release/deps/exec_overhead-008c440d800545ae)
  exec_overhead: samples=30, warm_iterations=25, tool_counts=[0, 32, 128]
  scenario       tools samples    warmups      iters      mean/exec       p95/exec       rssΔ p50       rssΔ max
  cold_exec          0      30          0          1         1.13ms         1.20ms        8.05MiB        8.06MiB
  warm_exec          0      30          1         25       473.43us       512.49us      912.00KiB        1.33MiB
  cold_exec         32      30          0          1         1.03ms         1.15ms        8.08MiB        8.11MiB
  warm_exec         32      30          1         25       509.73us       545.76us      960.00KiB        1.30MiB
  cold_exec        128      30          0          1         1.14ms         1.19ms        8.30MiB        8.34MiB
  warm_exec        128      30          1         25       575.08us       591.03us      736.00KiB      864.00KiB
  memory uses a fresh-process max RSS delta for each scenario
  ```
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Channing Conger · 2026-03-20 23:36:58 -07:00
  e4eedd6170
• Pass platform param to featured plugins (#15348)
  alexsong-oai · 2026-03-21 01:42:40 +00:00
  ec32866c37
• fix(core) disable command_might_be_dangerous when unsandboxed (#15036)

  ## Summary
  If we are in a mode that is already explicitly un-sandboxed, then
  `ApprovalPolicy::Never` should not block dangerous commands.
  
  ## Testing
  - [x] Existing unit test covers old behavior
  - [x] Added a unit test for this new case

  Dylan Hurd · 2026-03-21 01:28:25 +00:00
  60c59a7799