codex

feat(tui): clarify Windows auto mode requirements (#5568 )

## Summary
- Coerce Windows `workspace-write` configs back to read-only, surface
the forced downgrade in the approvals popup,
  and funnel users toward WSL or Full Access.
- Add WSL installation instructions to the Auto preset on Windows while
keeping the preset available for other
  platforms.
- Skip the trust-on-first-run prompt on native Windows so new folders
remain read-only without additional
  confirmation.
- Expose a structured sandbox policy resolution from config to flag
Windows downgrades and adjust tests (core,
exec, TUI) to reflect the new behavior; provide a Windows-only approvals
snapshot.

  ## Testing
  - cargo fmt
- cargo test -p codex-core
config::tests::add_dir_override_extends_workspace_writable_roots
- cargo test -p codex-exec
suite::resume::exec_resume_preserves_cli_configuration_overrides
- cargo test -p codex-tui
chatwidget::tests::approvals_selection_popup_snapshot
- cargo test -p codex-tui
approvals_popup_includes_wsl_note_for_auto_mode
  - cargo test -p codex-tui windows_skips_trust_prompt
  - just fix -p codex-core
  - just fix -p codex-tui

Josh McKinney · 2025-10-28 01:19:32 +00:00

66a4b89822

Truncate the content-item for mcp tools (#5835 )

This PR truncates the text output of MCP tool

Ahmed Ibrahim · 2025-10-28 00:39:35 +00:00

d7b333be97

fix image drag drop (#5794 )

fixing drag/drop photos bug in codex

state of the world before:

sometimes, when you drag screenshots into codex, the image does not
properly render into context. instead, the file name is shown in
quotation marks.


https://github.com/user-attachments/assets/3c0e540a-505c-4ec0-b634-e9add6a73119

the screenshot is not actually included in agent context. the agent
needs to manually call the view_image tool to see the screenshot. this
can be unreliable especially if the image is part of a longer prompt and
is dependent on the agent going out of its way to view the image.

state of the world after:


https://github.com/user-attachments/assets/5f2b7bf7-8a3f-4708-85f3-d68a017bfd97

now, images will always be directly embedded into chat context

## Technical Details

- MacOS sends screenshot paths with a narrow no‑break space right before
the “AM/PM” suffix, which used to trigger our non‑ASCII fallback in the
paste burst detector.
- That fallback flushed the partially buffered paste immediately, so the
path arrived in two separate `handle_paste` calls (quoted prefix +
`PM.png'`). The split string could not be normalized to a real path, so
we showed the quoted filename instead of embedding the image.
- We now append non‑ASCII characters into the burst buffer when a burst
is already active. Finder’s payload stays intact, the path normalizes,
and the image attaches automatically.
- When no burst is active (e.g. during IME typing), non‑ASCII characters
still bypass the buffer so text entry remains responsive.

zhao-oai · 2025-10-27 17:11:30 -07:00

4d6a42a622

[MCP] Render MCP tool call result images to the model (#5600 )

It's pretty amazing we have gotten here without the ability for the
model to see image content from MCP tool calls.

This PR builds off of 4391 and fixes #4819. I would like @KKcorps to get
adequete credit here but I also want to get this fix in ASAP so I gave
him a week to update it and haven't gotten a response so I'm going to
take it across the finish line.


This test highlights how absured the current situation is. I asked the
model to read this image using the Chrome MCP
<img width="2378" height="674" alt="image"
src="https://github.com/user-attachments/assets/9ef52608-72a2-4423-9f5e-7ae36b2b56e0"
/>

After this change, it correctly outputs:
> Captured the page: image dhows a dark terminal-style UI labeled
`OpenAI Codex (v0.0.0)` with prompt `model: gpt-5-codex medium` and
working directory `/codex/codex-rs`
(and more)  

Before this change, it said:
> Took the full-page screenshot you asked for. It shows a long,
horizontally repeating pattern of stylized people in orange, light-blue,
and mustard clothing, holding hands in alternating poses against a white
background. No text or other graphics-just rows of flat illustration
stretching off to the right.

Without this change, the Figma, Playwright, Chrome, and other visual MCP
servers are pretty much entirely useless.

I tested this change with the openai respones api as well as a third
party completions api

Gabriel Peal · 2025-10-27 17:55:57 -04:00

b0bdc04c30

fix: move account struct to app-server-protocol and use camelCase (#5829 )

Makes sense to move this struct to `app-server-protocol/` since we want
to serialize as camelCase, but we don't for structs defined in
`protocol/`

It was:
```
export type Account = { "type": "ApiKey", api_key: string, } | { "type": "chatgpt", email: string | null, plan_type: PlanType, };
```

But we want:
```
export type Account = { "type": "apiKey", apiKey: string, } | { "type": "chatgpt", email: string | null, planType: PlanType, };
```

Owen Lin · 2025-10-27 14:06:13 -07:00

67a219ffc2

Centralize truncation in conversation history (#5652 )

move the truncation logic to conversation history to use on any tool
output. This will help us in avoiding edge cases while truncating the
tool calls and mcp calls.

Ahmed Ibrahim · 2025-10-27 14:05:35 -07:00

7226365397

[Auth] Add keyring support for Codex CLI (#5591 )

Follow-up PR to #5569. Add Keyring Support for Auth Storage in Codex CLI
as well as a hybrid mode (default to persisting in keychain but fall
back to file when unavailable.)

It also refactors out the keyringstore implementation from rmcp-client
[here](https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs)
to a new keyring-store crate.

There will be a follow-up that picks the right credential mode depending
on the config, instead of hardcoding `AuthCredentialsStoreMode::File`.

Celia Chen · 2025-10-27 12:10:11 -07:00

0fc295d958

feat: support verbosity in model_family (#5821 )

jif-oai · 2025-10-27 18:46:30 +00:00

3e50f94d76

[Auth] Introduce New Auth Storage Abstraction for Codex CLI (#5569 )

This PR introduces a new `Auth Storage` abstraction layer that takes
care of read, write, and load of auth tokens based on the
AuthCredentialsStoreMode. It is similar to how we handle MCP client
oauth
[here](https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs).
Instead of reading and writing directly from disk for auth tokens, Codex
CLI workflows now should instead use this auth storage using the public
helper functions.

This PR is just a refactor of the current code so the behavior stays the
same. We will add support for keyring and hybrid mode in follow-up PRs.

I have read the CLA Document and I hereby sign the CLA

Celia Chen · 2025-10-27 11:01:14 -07:00

eb5b1b627f

Made token refresh code resilient to missing id_token (#5782 )

This PR does the following:
1. Changes `try_refresh_token` to handle the case where the endpoint
returns a response without an `id_token`. The OpenID spec indicates that
this field is optional and clients should not assume it's present.
2. Changes the `attempt_stream_responses` to propagate token refresh
errors rather than silently ignoring them.
3. Fixes a typo in a couple of error messages (unrelated to the above,
but something I noticed in passing) - "reconnect" should be spelled
without a hyphen.

This PR does not implement the additional suggestion from @pakrym-oai
that we should sign out when receiving `refresh_token_expired` from the
refresh endpoint. Leaving this as a follow-on because I'm undecided on
whether this should be implemented in `try_refresh_token` or its
callers.

Eric Traut · 2025-10-27 10:09:53 -07:00

0c1ff1d3fd

feat: image resizing (#5446 )

Add image resizing on the client side to reduce load on the API

jif-oai · 2025-10-27 16:58:10 +00:00

aea7610c76

feat: return an error if unknown enabled/disabled feature (#5817 )

jif-oai · 2025-10-27 16:53:00 +00:00

775fbba6e0

feat: introduce GetConversationSummary RPC (#5803 )

This adds an RPC to the app server to the the `ConversationSummary` via
a rollout path. Now that the VS Code extension supports showing the
Codex UI in an editor panel where the URI of the panel maps to the
rollout file, we need to be able to get the `ConversationSummary` from
the rollout file directly.

Michael Bolin · 2025-10-27 09:11:45 -07:00

5ee8a17b4e

fix: test yield time (#5811 )

jif-oai · 2025-10-27 11:57:29 +00:00

81be54b229

chore: undo nits (#5631 )

jif-oai · 2025-10-27 11:48:01 +00:00

5e8659dcbc

nit: doc on session task (#5809 )

jif-oai · 2025-10-27 11:43:33 +00:00

2338294b39

feat: TUI undo op (#5629 )

jif-oai · 2025-10-27 10:55:29 +00:00

afc4eaab8b

feat: async ghost commit (#5618 )

jif-oai · 2025-10-27 10:09:10 +00:00

e92c4f6561

feat: update NewConversationParams to take an optional model_provider (#5793 )

An AppServer client should be able to use any (`model_provider`, `model`) in the user's config. `NewConversationParams` already supported specifying the `model`, but this PR expands it to support `model_provider`, as well.

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/5793).
* #5803
* __->__ #5793

Michael Bolin · 2025-10-27 09:33:30 +00:00

15fa2283e7

feat: annotate conversations with model_provider for filtering (#5658 )

Because conversations that use the Responses API can have encrypted
reasoning messages, trying to resume a conversation with a different
provider could lead to confusing "failed to decrypt" errors. (This is
reproducible by starting a conversation using ChatGPT login and resuming
it as a conversation that uses OpenAI models via Azure.)

This changes `ListConversationsParams` to take a `model_providers:
Option<Vec<String>>` and adds `model_provider` on each
`ConversationSummary` it returns so these cases can be disambiguated.

Note this ended up making changes to
`codex-rs/core/src/rollout/tests.rs` because it had a number of cases
where it expected `Some` for the value of `next_cursor`, but the list of
rollouts was complete, so according to this docstring:


https://github.com/openai/codex/blob/bcd64c7e7231d6316a2377d1525a0fa74f21b783/codex-rs/app-server-protocol/src/protocol.rs#L334-L337

If there are no more items to return, then `next_cursor` should be
`None`. This PR updates that logic.






---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/5658).
* #5803
* #5793
* __->__ #5658

Michael Bolin · 2025-10-27 02:03:30 -07:00

5907422d65

Add feedback upload request handling (#5682 )

Ahmed Ibrahim · 2025-10-27 05:53:39 +00:00

f178805252

fix: revert "[app-server] fix account/read response annotation (#5642 )" (#5796 )

Revert #5642 because this generates:

```
// GENERATED CODE! DO NOT MODIFY BY HAND!

// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

export type GetAccountResponse = Account | null;
```

But `Account` is unknown.

The unique use of `#[ts(export)]` on `GetAccountResponse` is also
suspicious as are the changes to
`codex-rs/app-server-protocol/src/export.rs` since the existing system
has worked fine for quite some time.

Though a pure backout of #5642 puts things in a state where, as the PR
noted, the following does not work:

```
cargo run -p codex-app-server-protocol --bin export -- --out DIR
```

So in addition to the backout, this PR adds:

```rust
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
#[serde(rename_all = "camelCase")]
pub struct GetAccountResponse {
    pub account: Account,
}
```

and changes `GetAccount.response` as follows:

```diff
-        response: Option<Account>,
+        response: GetAccountResponse,
```

making it consistent with other types.

With this change, I verified that both of the following work:

```
just codex generate-ts --out /tmp/somewhere
cargo run -p codex-app-server-protocol --bin export -- --out /tmp/somewhere-else
```

The generated TypeScript is as follows:

```typescript
// GetAccountResponse.ts
import type { Account } from "./Account";

export type GetAccountResponse = { account: Account, };
```

and

```typescript
// Account.ts
import type { PlanType } from "./PlanType";

export type Account = { "type": "ApiKey", api_key: string, } | { "type": "chatgpt", email: string | null, plan_type: PlanType, };
```

Though while the inconsistency between `"type": "ApiKey"` and `"type":
"chatgpt"` is quite concerning, I'm not sure if that format is ever
written to disk in any case, but @owenlin0, I would recommend looking
into that.

Also, it appears that the types in `codex-rs/protocol/src/account.rs`
are used exclusively by the `app-server-protocol` crate, so perhaps they
should just be moved there?

Michael Bolin · 2025-10-26 18:57:42 -07:00

a55b0c4bcc

fix: use codex-exp prefix for experimental models and consider codex- models to be production (#5797 )

Thibault Sottiaux · 2025-10-27 01:55:12 +00:00

224222f09f

[MCP] Minor docs clarifications around stdio tokens (#5676 )

Noticed
[here](https://github.com/openai/codex/issues/4707#issuecomment-3446547561)

Gabriel Peal · 2025-10-26 13:38:30 -04:00

7aab45e060

Reduced runtime of unit test that was taking multiple minutes (#5688 )

Modified `build_compacted_history_truncates_overlong_user_messages` test
to reduce runtime from minutes to tens of seconds

Eric Traut · 2025-10-25 23:46:08 -07:00

bcd64c7e72

Added support for sandbox_mode in profiles (#5686 )

Currently, `approval_policy` is supported in profiles, but
`sandbox_mode` is not. This PR adds support for `sandbox_mode`.

Note: a fix for this was submitted in [this
PR](https://github.com/openai/codex/pull/2397), but the underlying code
has changed significantly since then.

This addresses issue #3034

Eric Traut · 2025-10-25 16:52:26 -07:00

c124f24354

Skip flaky test (#5680 )

Did an investigation but couldn't find anything obvious. Let's skip for
now.

pakrym-oai · 2025-10-25 12:11:16 -07:00

c7e4e6d0ee

Followup feedback (#5663 )

- Added files to be uploaded
- Refactored
- Updated title

Ahmed Ibrahim · 2025-10-25 06:07:40 +00:00

88abbf58ce

Improve feedback (#5661 )

<img width="1099" height="153" alt="image"
src="https://github.com/user-attachments/assets/2c901884-8baf-4b1b-b2c4-bcb61ff42be8"
/>

<img width="1082" height="125" alt="image"
src="https://github.com/user-attachments/assets/6336e6c9-9ace-46df-a383-a807ceffa524"
/>

<img width="1102" height="103" alt="image"
src="https://github.com/user-attachments/assets/78883682-7e44-4fa3-9e04-57f7df4766fd"
/>

Ahmed Ibrahim · 2025-10-24 22:28:14 -07:00

71f838389b

Fixed flaky unit test (#5654 )

This PR fixes a test that is sporadically failing in CI.

The problem is that two unit tests (the older `login_and_cancel_chatgpt`
and a recently added
`login_chatgpt_includes_forced_workspace_query_param`) exercise code
paths that start the login server. The server binds to a hard-coded
localhost port number, so attempts to start more than one server at the
same time will fail. If these two tests happen to run concurrently, one
of them will fail.

To fix this, I've added a simple mutex. We can use this same mutex for
future tests that use the same pattern.

Eric Traut · 2025-10-24 16:31:24 -07:00

0533bd2e7c

[codex][app-server] introduce codex/event/raw_item events (#5578 )

Anton Panasenko · 2025-10-24 22:41:52 +00:00

6af83d86ff

[MCP] Properly gate login after mcp add with experimental_use_rmcp_client (#5653 )

There was supposed to be a check here like in other places.

Gabriel Peal · 2025-10-24 18:32:15 -04:00

e2e1b65da6

[MCP] Redact environment variable values in /mcp and mcp get (#5648 )

Fixes #5524

Gabriel Peal · 2025-10-24 18:30:20 -04:00

817d1508bc

Added model summary and risk assessment for commands that violate sandbox policy (#5536 )

This PR adds support for a model-based summary and risk assessment for
commands that violate the sandbox policy and require user approval. This
aids the user in evaluating whether the command should be approved.

The feature works by taking a failed command and passing it back to the
model and asking it to summarize the command, give it a risk level (low,
medium, high) and a risk category (e.g. "data deletion" or "data
exfiltration"). It uses a new conversation thread so the context in the
existing thread doesn't influence the answer. If the call to the model
fails or takes longer than 5 seconds, it falls back to the current
behavior.

For now, this is an experimental feature and is gated by a config key
`experimental_sandbox_command_assessment`.

Here is a screen shot of the approval prompt showing the risk assessment
and summary.

<img width="723" height="282" alt="image"
src="https://github.com/user-attachments/assets/4597dd7c-d5a0-4e9f-9d13-414bd082fd6b"
/>

Eric Traut · 2025-10-24 15:23:44 -07:00

f8af4f5c8d

Log more types of request IDs (#5645 )

Different services return different sets of IDs, log all of them to
simplify debugging.

pakrym-oai · 2025-10-24 19:12:03 +00:00

a4be4d78b9

Add instruction for upgrading codex with brew (#5640 )

Include instruction for upgrading codex with brew when there is switch
from formula to cask.

Shijie Rao · 2025-10-24 11:30:34 -07:00

00c1de0c56

[app-server] fix account/read response annotation (#5642 )

The API schema export is currently broken:
```
> cargo run -p codex-app-server-protocol --bin export -- --out DIR
Error: this type cannot be exported
```

This PR fixes the error message so we get more info:
```
> cargo run -p codex-app-server-protocol --bin export -- --out DIR
Error: failed to export client responses: dependency core::option::Option<codex_protocol::account::Account> cannot be exported
```

And fixes the root cause which is the `account/read` response.

Owen Lin · 2025-10-24 11:17:46 -07:00

190e7eb104

Add CodexHttpClient wrapper with request logging (#5564 )

## Summary
- wrap the default reqwest::Client inside a new
CodexHttpClient/CodexRequestBuilder pair and log the HTTP method, URL,
and status for each request
- update the auth/model/provider plumbing to use the new builder helpers
so headers and bearer auth continue to be applied consistently
- add the shared `http` dependency that backs the header conversion
helpers

## Testing
- `CODEX_SANDBOX=seatbelt CODEX_SANDBOX_NETWORK_DISABLED=1 cargo test -p
codex-core`
- `CODEX_SANDBOX=seatbelt CODEX_SANDBOX_NETWORK_DISABLED=1 cargo test -p
codex-chatgpt`
- `CODEX_SANDBOX=seatbelt CODEX_SANDBOX_NETWORK_DISABLED=1 cargo test -p
codex-tui`

------
https://chatgpt.com/codex/tasks/task_i_68fa5038c17483208b1148661c5873be

pakrym-oai · 2025-10-24 09:47:52 -07:00

061862a0e2

adding messaging for stale rate limits + when no rate limits are cached (#5570 )

zhao-oai · 2025-10-24 08:46:31 -07:00

c72b2ad766

fix: flaky tests (#5625 )

jif-oai · 2025-10-24 13:56:41 +01:00

80783a7bb9

[MCP] Improve startup errors for timeouts and github (#5595 )

1. I have seen too many reports of people hitting startup timeout errors
and thinking Codex is broken. Hopefully this will help people
self-serve. We may also want to consider raising the timeout to ~15s.
2. Make it more clear what PAT is (personal access token) in the GitHub
error

<img width="2378" height="674" alt="CleanShot 2025-10-23 at 22 05 06"
src="https://github.com/user-attachments/assets/d148ce1d-ade3-4511-84a4-c164aefdb5c5"
/>

Gabriel Peal · 2025-10-24 01:54:45 -04:00

ed77d2d977

[MCP] Update rmcp to 0.8.3 (#5542 )

Picks up modelcontextprotocol/rust-sdk#497 which fixes #5208 by allowing 204 response to MCP initialize notifications instead of just 202.

Gabriel Peal · 2025-10-23 20:45:29 -07:00

abccd3e367

Moving token_info to ConversationHistory (#5581 )

I want to centralize input processing and management to
`ConversationHistory`. This would need `ConversationHistory` to have
access to `token_info` (i.e. preventing adding a big input to the
history). Besides, it makes more sense to have it on
`ConversationHistory` than `state`.

Ahmed Ibrahim · 2025-10-23 20:30:58 -07:00

0f4fd33ddd

Use Option symbol for mac key hints (#5582 )

## Summary
- show the Option (⌥) symbol in key hints when the TUI is built for
macOS so the shortcut text matches the platform terminology

## Testing
- cargo test -p codex-tui

------
https://chatgpt.com/codex/tasks/task_i_68fab7505530832992780a9e13fb707b

Josh McKinney · 2025-10-23 20:04:15 -07:00

e258f0f044

feat: end events on unified exec (#5551 )

jif-oai · 2025-10-23 18:51:34 +01:00

a6b9471548

fix: resume lookup for gitignored CODEX_HOME (#5311 )

Walk the sessions tree instead of using file_search so gitignored
CODEX_HOME directories can resume sessions. Add a regression test that
covers a .gitignore'd sessions directory.

Fixes #5247
Fixes #5412

---------

Co-authored-by: Owen Lin <owen@openai.com>

Thibault Sottiaux · 2025-10-23 17:04:40 +00:00

3059373e06

feat: use actual tokenizer for unified_exec truncation (#5514 )

jif-oai · 2025-10-23 17:08:06 +01:00

0b4527146e

chore: testing on apply_path (#5557 )

jif-oai · 2025-10-23 17:00:48 +01:00

6745b12427

Handle cancelling/aborting while processing a turn (#5543 )

Currently we collect all all turn items in a vector, then we add it to
the history on success. This result in losing those items on errors
including aborting `ctrl+c`.

This PR:
- Adds the ability for the tool call to handle cancellation
- bubble the turn items up to where we are recording this info

Admittedly, this logic is an ad-hoc logic that doesn't handle a lot of
error edge cases. The right thing to do is recording to the history on
the spot as `items`/`tool calls output` come. However, this isn't
possible because of having different `task_kind` that has different
`conversation_histories`. The `try_run_turn` has no idea what thread are
we using. We cannot also pass an `arc` to the `conversation_histories`
because it's a private element of `state`.

That's said, `abort` is the most common case and we should cover it
until we remove `task kind`

Ahmed Ibrahim · 2025-10-23 08:47:10 -07:00

f59978ed3d

tui: show aggregated output in display (#5539 )

This shows the aggregated (stdout + stderr) buffer regardless of exit
code.

Many commands output useful / relevant info on stdout when returning a
non-zero exit code, or the same on stderr when returning an exit code of
0. Often, useful info is present on both stdout AND stderr. Also, the
model sees both. So it is confusing to see commands listed as "(no
output)" that in fact do have output, just on the stream that doesn't
match the exit status, or to see some sort of trivial output like "Tests
failed" but lacking any information about the actual failure.

As such, always display the aggregated output in the display. Transcript
mode remains unchanged as it was already displaying the text that the
model sees, which seems correct for transcript mode.

Jeremy Rose · 2025-10-23 08:05:08 -07:00

3ab6028e80

1724 Commits