codex

core/protocol: add structured macOS additional permissions and merge them into sandbox execution (#13499 )

## Summary
- Introduce strongly-typed macOS additional permissions across
protocol/core/app-server boundaries.
- Merge additional permissions into effective sandbox execution,
including macOS seatbelt profile extensions.
- Expand docs, schema/tool definitions, UI rendering, and tests for
`network`, `file_system`, and `macos` additional permissions.

Celia Chen · 2026-03-05 16:21:45 -08:00

aaefee04cd

Revert "Revert "realtime prompt changes"" (#13398 )

Reverts openai/codex#13385

Ahmed Ibrahim · 2026-03-03 14:41:26 -08:00

041c896509

Revert "realtime prompt changes" (#13385 )

Reverts openai/codex#13376

Ahmed Ibrahim · 2026-03-03 12:30:37 -08:00

8afe2127dc

realtime prompt changes (#13376 )

# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.

Ahmed Ibrahim · 2026-03-03 10:13:14 -08:00

f6288248f4

Record realtime close marker on replacement (#13058 )

## Summary
- record a realtime close developer message when a new realtime session
replaces an active one
- assert the replacement marker through the mocked responses request
path

---------

Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Charles Cunningham <ccunningham@openai.com>

Ahmed Ibrahim · 2026-03-01 13:54:12 -08:00

0aeb55bf08

Clarify escalation guidance for sandbox-related network failures (#13051 )

This updates the on-request permissions instructions so likely
sandbox-related network failures during dependency installation are
treated as escalation candidates.

Repro:
- Run `codex -a on-request -s workspace-write` in a fresh temp dir.
- Prompt: `Build a new rust app with one dependency, anyhow, and try
installing the dependency`.
- Before this change, DNS/registry failures like `Could not resolve
host: index.crates.io` could be treated like ordinary transient failures
and not escalate.

Fix:
- Clarify that likely sandbox-related network errors such as DNS/host
resolution, registry/index access, and dependency download failures
should trigger escalation.

Validation:
- Rebuild the CLI and rerun the same repro. The same instructions should
now be more likely to trigger escalation instead of silently stopping.

Related Slack canvas:
- https://openai.enterprise.slack.com/docs/T0BQTNSUF/F0ACVNJAV09

daniel-oai · 2026-02-27 13:48:52 -08:00

6046ca19ba

chore: migrate additional permissions to PermissionProfile (#12731 )

This PR replaces the old `additional_permissions.fs_read/fs_write` shape
with a shared `PermissionProfile`
model and wires it through the command approval, sandboxing, protocol,
and TUI layers. The schema is adopted from the
`SkillManifestPermissions`, which is also refactored to use this unified
struct. This helps us easily expose permission profiles in app
server/core as a follow-up.

Celia Chen · 2026-02-25 03:35:28 +00:00

16ca527c80

feat(core) Introduce Feature::RequestPermissions (#11871 )

## Summary
Introduces the initial implementation of Feature::RequestPermissions.
RequestPermissions allows the model to request that a command be run
inside the sandbox, with additional permissions, like writing to a
specific folder. Eventually this will include other rules as well, and
the ability to persist these permissions, but this PR is already quite
large - let's get the core flow working and go from there!

<img width="1279" height="541" alt="Screenshot 2026-02-15 at 2 26 22 PM"
src="https://github.com/user-attachments/assets/0ee3ec0f-02ec-4509-91a2-809ac80be368"
/>

## Testing
- [x] Added tests
- [x] Tested locally
- [x] Feature

Dylan Hurd · 2026-02-24 09:48:57 -08:00

f6053fdfb3

chore(core) rm Feature::RequestRule (#11866 )

## Summary
This feature is now reasonably stable, let's remove it so we can
simplify our upcoming iterations here.

## Testing 
- [x] Existing tests pass

Dylan Hurd · 2026-02-16 22:30:23 +00:00

19afbc35c1

fix(protocol): approval policy never prompt (#11288 )

This removes overly directed language about how the model should behave
when it's in `approval_policy=never` mode.

---------

Co-authored-by: Dylan Hurd <dylan.hurd@openai.com>

Fouad Matin · 2026-02-10 09:27:46 -08:00

693bac1851

fix(core) Request Rule guidance tweak (#10598 )

## Summary
Forgot to include this tweak.

## Testing
- [x] Unit tests pass

Dylan Hurd · 2026-02-04 08:44:32 +00:00

8f17b37d06

fix(core) updated request_rule guidance (#10379 )

## Summary
Update guidance for request_rule

## Testing
- [x] Unit tests pass

Dylan Hurd · 2026-02-03 22:29:52 -08:00

968c029471

feat(core) RequestRule (#9489 )

## Summary
Instead of trying to derive the prefix_rule for a command mechanically,
let's let the model decide for us.

## Testing
- [x] tested locally

Dylan Hurd · 2026-01-28 08:43:17 +00:00

996e09ca24

fix(core) Preserve base_instructions in SessionMeta (#9427 )

## Summary
This PR consolidates base_instructions onto SessionMeta /
SessionConfiguration, so we ensure `base_instructions` is set once per
session and should be (mostly) immutable, unless:
- overridden by config on resume / fork
- sub-agent tasks, like review or collab


In a future PR, we should convert all references to `base_instructions`
to consistently used the typed struct, so it's less likely that we put
other strings there. See #9423. However, this PR is already quite
complex, so I'm deferring that to a follow-up.

## Testing
- [x] Added a resume test to assert that instructions are preserved. In
particular, `resume_switches_models_preserves_base_instructions` fails
against main.

Existing test coverage thats assert base instructions are preserved
across multiple requests in a session:
- Manual compact keeps baseline instructions:
core/tests/suite/compact.rs:199
- Auto-compact keeps baseline instructions:
core/tests/suite/compact.rs:1142
- Prompt caching reuses the same instructions across two requests:
core/tests/suite/prompt_caching.rs:150 and
core/tests/suite/prompt_caching.rs:157
- Prompt caching with explicit expected string across two requests:
core/tests/suite/prompt_caching.rs:213 and
core/tests/suite/prompt_caching.rs:222
- Resume with model switch keeps original instructions:
core/tests/suite/resume.rs:136
- Compact/resume/fork uses request 0 instructions for later expected
payloads: core/tests/suite/compact_resume_fork.rs:215

Dylan Hurd · 2026-01-19 21:59:36 -08:00

675f165c56

Remove unused protocol collaboration mode prompts (#9463 )

Delete duplicate collaboration mode markdown under protocol prompts;
core templates remain the single source of truth.

Ahmed Ibrahim · 2026-01-19 08:54:19 -08:00

31415ebfcf

Add collaboration modes test prompts (#9443 )

# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.

Ahmed Ibrahim · 2026-01-18 11:39:08 -08:00

f72f87fbee

Assemble sandbox/approval/network prompts dynamically (#8961 )

- Add a single builder for developer permissions messaging that accepts
SandboxPolicy and approval policy. This builder now drives the developer
“permissions” message that’s injected at session start and any time
sandbox/approval settings change.
- Trim EnvironmentContext to only include cwd, writable roots, and
shell; removed sandbox/approval/network duplication and adjusted XML
serialization and tests accordingly.

Follow-up: adding a config value to replace the developer permissions
message for custom sandboxes.

Ahmed Ibrahim · 2026-01-12 23:12:59 +00:00

87f7226cca

17 Commits