4712 Commits

This Branch

This Branch

All Branches

• Remove legacy app-server notification handling from tui_app_server (#15390)

  As part of moving the TUI onto the app server, we added some temporary
  handling of some legacy events. We've confirmed that these do not need
  to be supported, so this PR removes this support from the
  tui_app_server, allowing for additional simplifications in follow-on
  PRs. These events are needed only for very old rollouts. None of the
  other app server clients (IDE extension or app) support these either.
  
  ## Summary
  - stop translating legacy `codex/event/*` notifications inside
  `tui_app_server`
  - remove the TUI-side legacy warning and rollback buffering/replay paths
  that were only fed by those notifications
  - keep the lower-level app-server and app-server-client legacy event
  plumbing intact so PR #15106 can rebase on top and handle the remaining
  exec/lower-layer migration separately

  Eric Traut · 2026-03-21 12:29:33 -06:00
  b0236501e2
• chore(context) Include guardian approval context (#15366)

  ## Summary
  Include the guardian context in the developer message for approvals
  
  ## Testing
  - [x] Updated unit tests

  Dylan Hurd · 2026-03-21 16:31:22 +00:00
  0d9bb8ea58
• [plugins] Fix plugin explicit mention context management. (#15372)

  - [x] Fix plugin explicit mention context management.

  Matthew Zeng · 2026-03-21 00:29:29 -07:00
  06e06ab173
• Code mode on v8 (#15276)

  Moves Code Mode to a new crate with no dependencies on codex. This
  create encodes the code mode semantics that we want for lifetime,
  mounting, tool calling.
  
  The model-facing surface is mostly unchanged. `exec` still runs raw
  JavaScript, `wait` still resumes or terminates a `cell_id`, nested tools
  are still available through `tools.*`, and helpers like `text`, `image`,
  `store`, `load`, `notify`, `yield_control`, and `exit` still exist.
  
  The major change is underneath that surface:
  
  - Old code mode was an external Node runtime.
  - New code mode is an in-process V8 runtime embedded directly in Rust.
  - Old code mode managed cells inside a long-lived Node runner process.
  - New code mode manages cells in Rust, with one V8 runtime thread per
  active `exec`.
  - Old code mode used JSON protocol messages over child stdin/stdout plus
  Node worker-thread messages.
  - New code mode uses Rust channels and direct V8 callbacks/events.
  
  This PR also fixes the two migration regressions that fell out of that
  substrate change:
  
  - `wait { terminate: true }` now waits for the V8 runtime to actually
  stop before reporting termination.
  - synchronous top-level `exit()` now succeeds again instead of surfacing
  as a script error.
  
  ---
  
  - `core/src/tools/code_mode/*` is now mostly an adapter layer for the
  public `exec` / `wait` tools.
  - `code-mode/src/service.rs` owns cell sessions and async control flow
  in Rust.
  - `code-mode/src/runtime/*.rs` owns the embedded V8 isolate and
  JavaScript execution.
  - each `exec` spawns a dedicated runtime thread plus a Rust
  session-control task.
  - helper globals are installed directly into the V8 context instead of
  being injected through a source prelude.
  - helper modules like `tools.js` and `@openai/code_mode` are synthesized
  through V8 module resolution callbacks in Rust.
  
  ---
  
  Also added a benchmark for showing the speed of init and use of a code
  mode env:
  ```
  $ cargo bench -p codex-code-mode --bench exec_overhead -- --samples 30 --warm-iterations 25 --tool-counts 0,32,128
  Finished [`bench` profile [optimized]](https://doc.rust-lang.org/cargo/reference/profiles.html#default-profiles) target(s) in 0.18s
       Running benches/exec_overhead.rs (target/release/deps/exec_overhead-008c440d800545ae)
  exec_overhead: samples=30, warm_iterations=25, tool_counts=[0, 32, 128]
  scenario       tools samples    warmups      iters      mean/exec       p95/exec       rssΔ p50       rssΔ max
  cold_exec          0      30          0          1         1.13ms         1.20ms        8.05MiB        8.06MiB
  warm_exec          0      30          1         25       473.43us       512.49us      912.00KiB        1.33MiB
  cold_exec         32      30          0          1         1.03ms         1.15ms        8.08MiB        8.11MiB
  warm_exec         32      30          1         25       509.73us       545.76us      960.00KiB        1.30MiB
  cold_exec        128      30          0          1         1.14ms         1.19ms        8.30MiB        8.34MiB
  warm_exec        128      30          1         25       575.08us       591.03us      736.00KiB      864.00KiB
  memory uses a fresh-process max RSS delta for each scenario
  ```
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Channing Conger · 2026-03-20 23:36:58 -07:00
  e4eedd6170
• Pass platform param to featured plugins (#15348)
  alexsong-oai · 2026-03-21 01:42:40 +00:00
  ec32866c37
• fix(core) disable command_might_be_dangerous when unsandboxed (#15036)

  ## Summary
  If we are in a mode that is already explicitly un-sandboxed, then
  `ApprovalPolicy::Never` should not block dangerous commands.
  
  ## Testing
  - [x] Existing unit test covers old behavior
  - [x] Added a unit test for this new case

  Dylan Hurd · 2026-03-21 01:28:25 +00:00
  60c59a7799
• chore(core) update prefix_rule guidance (#15231)

  ## Summary
  Small tweaks to the prefix_rule guidance.
  
  ## Testing
  - [x] in progress

  Dylan Hurd · 2026-03-20 15:57:06 -07:00
  7754dd1b89
• fix: allow restricted filesystem profiles to read helper executables (#15114)

  ## Summary
  
  This PR fixes restricted filesystem permission profiles so Codex's
  runtime-managed helper executables remain readable without requiring
  explicit user configuration.
  
  - add implicit readable roots for the configured `zsh` helper path and
  the main execve wrapper
  - allowlist the shared `$CODEX_HOME/tmp/arg0` root when the execve
  wrapper lives there, so session-specific helper paths keep working
  - dedupe injected paths and avoid adding duplicate read entries to the
  sandbox policy
  - add regression coverage for restricted read mode with helper
  executable overrides
  
  ## Testing 
  before this change: got this error when executing a shell command via
  zsh fork:
  ```
  "sandbox error: sandbox denied exec error, exit code: 127, stdout: , stderr: /etc/zprofile:11: operation not permitted: /usr/libexec/path_helper\nzsh:1: operation not permitted: .codex/skills/proxy-a/scripts/fetch_example.sh\n"
  ```
  
  saw this change went away after this change, meaning the readable roots
  and injected correctly.

  Celia Chen · 2026-03-20 15:51:06 -07:00
  9eef2e91fc
• Gate tui /plugins menu behind flag (#15285)

  Gate /plugins menu behind `--enable plugins` flag

  canvrno-oai · 2026-03-20 15:49:04 -07:00
  10a936d127
• Add realtime transcript notification in v2 (#15344)

  - emit a typed `thread/realtime/transcriptUpdated` notification from
  live realtime transcript deltas
  - expose that notification as flat `threadId`, `role`, and `text` fields
  instead of a nested transcript array
  - continue forwarding raw `handoff_request` items on
  `thread/realtime/itemAdded`, including the accumulated
  `active_transcript`
  - update app-server docs, tests, and generated protocol schema artifacts
  to match the delta-based payloads
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-20 15:30:48 -07:00
  3431f01776
• chore(core) Remove Feature::PowershellUtf8 (#15128)

  ## Summary
  This feature has been enabled for powershell for a while now, let's get
  rid of the logic
  
  ## Testing
  - [x] Unit tests

  Dylan Hurd · 2026-03-20 22:03:31 +00:00
  ea8b07e680
• [apps] Use ARC for yolo mode. (#15273)

  - [x] Use ARC for yolo mode.

  Matthew Zeng · 2026-03-20 21:13:20 +00:00
  dd88ed767b
• Add v8-poc consumer of our new built v8 (#15203)

  This adds a dummy v8-poc project that in Cargo links against our
  prebuilt binaries and the ones provided by rusty_v8 for non musl
  platforms. This demonstrates that we can successfully link and use v8 on
  all platforms that we want to target.
  
  In bazel things are slightly more complicated. Since the libraries as
  published have libc++ linked in already we end up with a lot of double
  linked symbols if we try to use them in bazel land. Instead we fall back
  to building rusty_v8 and v8 from source (cached of course) on the
  platforms we ship to.
  
  There is likely some compatibility drift in the windows bazel builder
  that we'll need to reconcile before we can re-enable them. I'm happy to
  be on the hook to unwind that.

  Channing Conger · 2026-03-20 12:08:25 -07:00
  1350477150
• Bump aws-lc-rs (#15337)

  Bump our dep.
  
  RUSTSEC-2026-0048
  Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0048

  Channing Conger · 2026-03-20 18:59:13 +00:00
  a941d8439d
• Pin Python SDK app-server stdio to UTF-8 on Windows (#15244)

  ## TL;DR
  Pin the Python app-server SDK subprocess pipes to UTF-8 so Windows users
  on non-UTF-8 locales do not hit `UnicodeDecodeError` when the `codex`
  child emits UTF-8 text.
  
  - add `encoding="utf-8"` to the `subprocess.Popen(...)` call in
  `AppServerClient.start()`
  - add a focused regression test that asserts the client launches the
  subprocess with UTF-8 text I/O
  - validates with `python -m pytest
  sdk/python/tests/test_client_rpc_methods.py
  sdk/python/tests/test_client_process_launch.py
  sdk/python/tests/test_public_api_runtime_behavior.py`
  
  Fixes #14311.

  Shaqayeq · 2026-03-20 18:26:24 +00:00
  9e31aeadce
• feat: change multi-agent to use path-like system instead of uuids (#15313)

  This PR add an URI-based system to reference agents within a tree. This
  comes from a sync between research and engineering.
  
  The main agent (the one manually spawned by a user) is always called
  `/root`. Any sub-agent spawned by it will be `/root/agent_1` for example
  where `agent_1` is chosen by the model.
  
  Any agent can contact any agents using the path.
  
  Paths can be used either in absolute or relative to the calling agents
  
  Resume is not supported for now on this new path

  jif-oai · 2026-03-20 18:23:48 +00:00
  79ad7b247b
• Add remote test skill (#15324)

  Teach codex to run remote tests.

  pakrym-oai · 2026-03-20 10:37:57 -07:00
  4ddde54c19
• try to fix bazel (#15328)

  Fix Bazel macOS CI failures caused by the llvm module's pinned macOS SDK
  URL returning 403 Forbidden from Apple's CDN.
  
  Bump llvm to 0.6.8, switch to the new osx.from_archive(...) /
  osx.frameworks(...) API, and refresh MODULE.bazel.lock so Bazel uses the
  updated SDK archive configuration.

  jif-oai · 2026-03-20 10:18:19 -07:00
  b9fa08ec61
• Add temporary app-server originator fallback for codex-tui (#15218)

  ## Summary
  - make app-server treat `clientInfo.name == "codex-tui"` as a legacy
  compatibility case
  - fall back to `DEFAULT_ORIGINATOR` instead of sending `codex-tui` as
  the originator header
  - add a TODO noting this is a temporary workaround that should be
  removed later
  
  ## Testing
  - Not run (not requested)

  Eric Traut · 2026-03-20 10:51:21 -06:00
  4f28b64abc
• Add remote env CI matrix and integration test (#14869)

  `CODEX_TEST_REMOTE_ENV` will make `test_codex` start the executor
  "remotely" (inside a docker container) turning any integration test into
  remote test.

  pakrym-oai · 2026-03-20 08:02:50 -07:00
  ba85a58039
• feat: prefer git for curated plugin sync (#15275)

  start with git clone, fallback to http.

  xl-openai · 2026-03-20 00:06:24 -07:00
  e5f4d1fef5
• Feat/restore image generation history (#15223)

  Restore image generation items in resumed thread history

  Won Park · 2026-03-19 22:57:16 -07:00
  461ba012fc
• Add guardian follow-up reminder (#15262)

  ## Summary
  - add a short guardian follow-up developer reminder before reused
  reviews
  - cache prior-review state on the guardian session instead of rescanning
  full history on each request
  - update guardian follow-up coverage and snapshot expectations
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-19 22:35:52 -07:00
  b3a4da84da
• feat: Add One-Time Startup Remote Plugin Sync (#15264)

  For early users who have already enabled apps, we should enable plugins
  as part of the initial setup.

  xl-openai · 2026-03-20 05:01:39 +00:00
  b1570d6c23
• Disable hooks on windows for now (#15252)

  We'll verify a bit later that all of this works correctly and re-enable

  Andrei Eternal · 2026-03-19 21:31:56 -07:00
  cc192763e1
• Initial plugins TUI menu - list and read only. tui + tui_app_server (#15215)

  ### Preliminary /plugins TUI menu
  - Adds a preliminary /plugins menu flow in both tui and tui_app_server.
  - Fetches plugin list data asynchronously and shows loading/error/cached
  states.
    - Limits this first pass to the curated ChatGPT marketplace.
    - Shows available plugins with installed/status metadata.
  - Supports in-menu search over plugin display name, plugin id, plugin
  name, and marketplace label.
  - Opens a plugin detail view on selection, including summaries for
  Skills, Apps, and MCP Servers, with back navigation.
  
  ### Testing
    - Launch codex-cli with plugins enabled (`--enable plugins`).
    - Run /plugins and verify:
        - loading state appears first
        - plugin list is shown
        - search filters results
  - selecting a plugin opens detail view, with a list of
  skills/connectors/MCP servers for the plugin
        - back action returns to the list.
  - Verify disabled behavior by running /plugins without plugins enabled
  (shows “Plugins are disabled” message).
  - Launch with `--enable tui_app_server` (and plugins enabled) and repeat
  the same /plugins flow; behavior should match.

  canvrno-oai · 2026-03-19 21:28:33 -07:00
  f7201e5a9f
• Use released DotSlash package for argument-comment lint (#15199)

  ## Why
  The argument-comment lint now has a packaged DotSlash artifact from
  [#15198](https://github.com/openai/codex/pull/15198), so the normal repo
  lint path should use that released payload instead of rebuilding the
  lint from source every time.
  
  That keeps `just clippy` and CI aligned with the shipped artifact while
  preserving a separate source-build path for people actively hacking on
  the lint crate.
  
  The current alpha package also exposed two integration wrinkles that the
  repo-side prebuilt wrapper needs to smooth over:
  - the bundled Dylint library filename includes the host triple, for
  example `@nightly-2025-09-18-aarch64-apple-darwin`, and Dylint derives
  `RUSTUP_TOOLCHAIN` from that filename
  - on Windows, Dylint's driver path also expects `RUSTUP_HOME` to be
  present in the environment
  
  Without those adjustments, the prebuilt CI jobs fail during `cargo
  metadata` or driver setup. This change makes the checked-in prebuilt
  wrapper normalize the packaged library name to the plain
  `nightly-2025-09-18` channel before invoking `cargo-dylint`, and it
  teaches both the wrapper and the packaged runner source to infer
  `RUSTUP_HOME` from `rustup show home` when the environment does not
  already provide it.
  
  After the prebuilt Windows lint job started running successfully, it
  also surfaced a handful of existing anonymous literal callsites in
  `windows-sandbox-rs`. This PR now annotates those callsites so the new
  cross-platform lint job is green on the current tree.
  
  ## What Changed
  - checked in the current
  `tools/argument-comment-lint/argument-comment-lint` DotSlash manifest
  - kept `tools/argument-comment-lint/run.sh` as the source-build wrapper
  for lint development
  - added `tools/argument-comment-lint/run-prebuilt-linter.sh` as the
  normal enforcement path, using the checked-in DotSlash package and
  bundled `cargo-dylint`
  - updated `just clippy` and `just argument-comment-lint` to use the
  prebuilt wrapper
  - split `.github/workflows/rust-ci.yml` so source-package checks live in
  a dedicated `argument_comment_lint_package` job, while the released lint
  runs in an `argument_comment_lint_prebuilt` matrix on Linux, macOS, and
  Windows
  - kept the pinned `nightly-2025-09-18` toolchain install in the prebuilt
  CI matrix, since the prebuilt package still relies on rustup-provided
  toolchain components
  - updated `tools/argument-comment-lint/run-prebuilt-linter.sh` to
  normalize host-qualified nightly library filenames, keep the `rustup`
  shim directory ahead of direct toolchain `cargo` binaries, and export
  `RUSTUP_HOME` when needed for Windows Dylint driver setup
  - updated `tools/argument-comment-lint/src/bin/argument-comment-lint.rs`
  so future published DotSlash artifacts apply the same nightly-filename
  normalization and `RUSTUP_HOME` inference internally
  - fixed the remaining Windows lint violations in
  `codex-rs/windows-sandbox-rs` by adding the required `/*param*/`
  comments at the reported callsites
  - documented the checked-in DotSlash file, wrapper split, archive
  layout, nightly prerequisite, and Windows `RUSTUP_HOME` requirement in
  `tools/argument-comment-lint/README.md`

  Michael Bolin · 2026-03-20 03:19:22 +00:00
  fa2a2f0be9
• Split exec process into local and remote implementations (#15233)

  ## Summary
  - match the exec-process structure to filesystem PR #15232
  - expose `ExecProcess` on `Environment`
  - make `LocalProcess` the real implementation and `RemoteProcess` a thin
  network proxy over `ExecServerClient`
  - make `ProcessHandler` a thin RPC adapter delegating to `LocalProcess`
  - add a shared local/remote process test
  
  ## Validation
  - `just fmt`
  - `CARGO_TARGET_DIR=~/.cache/cargo-target/codex cargo test -p
  codex-exec-server`
  - `just fix -p codex-exec-server`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-03-20 03:13:08 +00:00
  96a86710c3
• Split features into codex-features crate (#15253)

  - Split the feature system into a new `codex-features` crate.
  - Cut `codex-core` and workspace consumers over to the new config and
  warning APIs.
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 20:12:07 -07:00
  2e22885e79
• fix: Distinguish missing and empty plugin products (#15263)

  Treat [] as no product allowed, empty as all products allowed.

  xl-openai · 2026-03-19 20:02:40 -07:00
  35f8b87a5b
• core: add a full-buffer exec capture policy (#15254)
  Michael Bolin · 2026-03-20 02:38:12 +00:00
  a3e59e9e85
• [plugins] Install MCPs when calling plugin/install (#15195)

  - [x] Auth MCPs when installing plugins.

  Matthew Zeng · 2026-03-19 19:36:58 -07:00
  0a344e4fab
• Move auth code into login crate (#15150)

  - Move the auth implementation and token data into codex-login.
  - Keep codex-core re-exporting that surface from codex-login for
  existing callers.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 18:58:17 -07:00
  2aa4873802
• V8 Bazel Build (#15021)

  Alternative approach, we use rusty_v8 for all platforms that its
  predefined, but lets build from source a musl v8 version with bazel for
  x86 and aarch64 only. We would need to release this on github and then
  use the release.

  Channing Conger · 2026-03-19 18:05:23 -07:00
  ded7854f09
• Refactor ExecServer filesystem split between local and remote (#15232)

  For each feature we have:
  1. Trait exposed on environment
  2. **Local Implementation** of the trait
  3. Remote implementation that uses the client to proxy via network
  4. Handler implementation that handles PRC requests and calls into
  **Local Implementation**

  pakrym-oai · 2026-03-19 17:08:04 -07:00
  403b397e4e
• changed save directory to codex_home (#15222)

  saving image gen default save directory to
  codex_home/imagegen/thread_id/

  Won Park · 2026-03-19 15:16:26 -07:00
  6b8175c734
• feat(app-server): add mcpServer/startupStatus/updated notification (#15220)

  Exposes the legacy `codex/event/mcp_startup_update` event as an API v2
  notification.
  
  The legacy event has this shape:
  ```
  #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
  pub struct McpStartupUpdateEvent {
      /// Server name being started.
      pub server: String,
      /// Current startup status.
      pub status: McpStartupStatus,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
  #[serde(rename_all = "snake_case", tag = "state")]
  #[ts(rename_all = "snake_case", tag = "state")]
  pub enum McpStartupStatus {
      Starting,
      Ready,
      Failed { error: String },
      Cancelled,
  }
  ```

  Owen Lin · 2026-03-19 15:09:59 -07:00
  9e695fe830
• Plumb MCP turn metadata through _meta (#15190)

  ## Summary
  
  Some background. We're looking to instrument GA turns end to end. Right
  now a big gap is grouping mcp tool calls with their codex sessions. We
  send session id and turn id headers to the responses call but not the
  mcp/wham calls.
  
  Ideally we could pass the args as headers like with responses, but given
  the setup of the rmcp client, we can't send as headers without either
  changing the rmcp package upstream to allow per request headers or
  introducing a mutex which break concurrency. An earlier attempt made the
  assumption that we had 1 client per thread, which allowed us to set
  headers at the start of a turn. @pakrym mentioned that this assumption
  might break in the near future.
  
  So the solution now is to package the turn metadata/session id into the
  _meta field in the post body and pull out in codex-backend.
  
  - send turn metadata to MCP servers via `tools/call` `_meta` instead of
  assuming per-thread request headers on shared clients
  - preserve the existing `_codex_apps` metadata while adding
  `x-codex-turn-metadata` for all MCP tool calls
  - extend tests to cover both custom MCP servers and the codex apps
  search flow
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  nicholasclark-openai · 2026-03-19 22:05:13 +00:00
  2bee37fe69
• feat: expose needs_auth for plugin/read. (#15217)

  So UI can render it properly.

  xl-openai · 2026-03-19 15:02:45 -07:00
  2254ec4f30
• adding full imagepath to tui (#15154)

  adding full path to TUI so image is open-able in the TUI after being
  generated. LImited to VSCode Terminal for now.

  Won Park · 2026-03-19 21:29:22 +00:00
  27977d6716
• add specific tool guidance for Windows destructive commands (#15207)

  updated Windows shell/unified_exec tool descriptions:
  
  `exec_command`
  ```text
  Runs a command in a PTY, returning output or a session ID for ongoing interaction.
  
  Windows safety rules:
  - Do not compose destructive filesystem commands across shells. Do not enumerate paths in PowerShell and then pass them to `cmd /c`, batch builtins, or another shell for deletion or moving. Use one shell end-to-end, prefer native PowerShell cmdlets such as `Remove-Item` / `Move-Item` with `-LiteralPath`, and avoid string-built shell commands for file operations.
  - Before any recursive delete or move on Windows, verify the resolved absolute target paths stay within the intended workspace or explicitly named target directory. Never issue a recursive delete or move against a computed path if the final target has not been checked.
  ```
  
  `shell`
  ```text
  Runs a Powershell command (Windows) and returns its output. Arguments to `shell` will be passed to CreateProcessW(). Most commands should be prefixed with ["powershell.exe", "-Command"].
  
  Examples of valid command strings:
  
  - ls -a (show hidden): ["powershell.exe", "-Command", "Get-ChildItem -Force"]
  - recursive find by name: ["powershell.exe", "-Command", "Get-ChildItem -Recurse -Filter *.py"]
  - recursive grep: ["powershell.exe", "-Command", "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"]
  - ps aux | grep python: ["powershell.exe", "-Command", "Get-Process | Where-Object { $_.ProcessName -like '*python*' }"]
  - setting an env var: ["powershell.exe", "-Command", "$env:FOO='bar'; echo $env:FOO"]
  - running an inline Python script: ["powershell.exe", "-Command", "@'\nprint('Hello, world!')\n'@ | python -"]
  
  Windows safety rules:
  - Do not compose destructive filesystem commands across shells. Do not enumerate paths in PowerShell and then pass them to `cmd /c`, batch builtins, or another shell for deletion or moving. Use one shell end-to-end, prefer native PowerShell cmdlets such as `Remove-Item` / `Move-Item` with `-LiteralPath`, and avoid string-built shell commands for file operations.
  - Before any recursive delete or move on Windows, verify the resolved absolute target paths stay within the intended workspace or explicitly named target directory. Never issue a recursive delete or move against a computed path if the final target has not been checked.
  ```
  
  `shell_command`
  ```text
  Runs a Powershell command (Windows) and returns its output.
  
  Examples of valid command strings:
  
  - ls -a (show hidden): "Get-ChildItem -Force"
  - recursive find by name: "Get-ChildItem -Recurse -Filter *.py"
  - recursive grep: "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"
  - ps aux | grep python: "Get-Process | Where-Object { $_.ProcessName -like '*python*' }"
  - setting an env var: "$env:FOO='bar'; echo $env:FOO"
  - running an inline Python script: "@'\nprint('Hello, world!')\n'@ | python -"
  
  Windows safety rules:
  - Do not compose destructive filesystem commands across shells. Do not enumerate paths in PowerShell and then pass them to `cmd /c`, batch builtins, or another shell for deletion or moving. Use one shell end-to-end, prefer native PowerShell cmdlets such as `Remove-Item` / `Move-Item` with `-LiteralPath`, and avoid string-built shell commands for file operations.
  - Before any recursive delete or move on Windows, verify the resolved absolute target paths stay within the intended workspace or explicitly named target directory. Never issue a recursive delete or move against a computed path if the final target has not been checked.
  ```

  iceweasel-oai · 2026-03-19 21:09:34 +00:00
  69750a0b5a
• Move terminal module to terminal-detection crate (#15216)

  - Move core/src/terminal.rs and its tests into a standalone
  terminal-detection workspace crate.
  - Update direct consumers to depend on codex-terminal-detection and
  import terminal APIs directly.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 14:08:04 -07:00
  7eb19e5319
• feat(tracing): tag app-server turn spans with turn_id (#15206)

  So we can find and filter spans by `turn.id`.
  
  We do this for the `turn/start`, `turn/steer`, and `turn/interrupt`
  APIs.

  Owen Lin · 2026-03-19 13:07:19 -07:00
  668330acc1
• feat(tui): add /title terminal title configuration (#12334)

  ## Problem
  
  When multiple Codex sessions are open at once, terminal tabs and windows
  are hard to distinguish from each other. The existing status line only
  helps once the TUI is already focused, so it does not solve the "which
  tab is this?" problem.
  
  This PR adds a first-class `/title` command so the terminal window or
  tab title can carry a short, configurable summary of the current
  session.
  
  ## Screenshot
  
  <img width="849" height="320" alt="image"
  src="https://github.com/user-attachments/assets/8b112927-7890-45ed-bb1e-adf2f584663d"
  />
  
  ## Mental model
  
  `/statusline` and `/title` are separate status surfaces with different
  constraints. The status line is an in-app footer that can be denser and
  more detailed. The terminal title is external terminal metadata, so it
  needs short, stable segments that still make multiple sessions easy to
  tell apart.
  
  The `/title` configuration is an ordered list of compact items. By
  default it renders `spinner,project`, so active sessions show
  lightweight progress first while idle sessions still stay easy to
  disambiguate. Each configured item is omitted when its value is not
  currently available rather than forcing a placeholder.
  
  ## Non-goals
  
  This does not merge `/title` into `/statusline`, and it does not add an
  arbitrary free-form title string. The feature is intentionally limited
  to a small set of structured items so the title stays short and
  reviewable.
  
  This also does not attempt to restore whatever title the terminal or
  shell had before Codex started. When Codex clears the title, it clears
  the title Codex last wrote.
  
  ## Tradeoffs
  
  A separate `/title` command adds some conceptual overlap with
  `/statusline`, but it keeps title-specific constraints explicit instead
  of forcing the status line model to cover two different surfaces.
  
  Title refresh can happen frequently, so the implementation now shares
  parsing and git-branch orchestration between the status line and title
  paths, and caches the derived project-root name by cwd. That keeps the
  hot path cheap without introducing background polling.
  
  ## Architecture
  
  The TUI gets a new `/title` slash command and a dedicated picker UI for
  selecting and ordering terminal-title items. The chosen ids are
  persisted in `tui.terminal_title`, with `spinner` and `project` as the
  default when the config is unset. `status` remains available as a
  separate text item, so configurations like `spinner,status` render
  compact progress like `⠋ Working`.
  
  `ChatWidget` now refreshes both status surfaces through a shared
  `refresh_status_surfaces()` path. That shared path parses configured
  items once, warns on invalid ids once, synchronizes shared cached state
  such as git-branch lookup, then renders the footer status line and
  terminal title from the same snapshot.
  
  Low-level OSC title writes live in `codex-rs/tui/src/terminal_title.rs`,
  which owns the terminal write path and last-mile sanitization before
  emitting OSC 0.
  
  ## Security
  
  Terminal-title text is treated as untrusted display content before Codex
  emits it. The write path strips control characters, removes invisible
  and bidi formatting characters that can make the title visually
  misleading, normalizes whitespace, and caps the emitted length.
  
  References used while implementing this:
  
  - [xterm control
  sequences](https://invisible-island.net/xterm/ctlseqs/ctlseqs.html)
  - [WezTerm escape sequences](https://wezterm.org/escape-sequences.html)
  - [CWE-150: Improper Neutralization of Escape, Meta, or Control
  Sequences](https://cwe.mitre.org/data/definitions/150.html)
  - [CERT VU#999008 (Trojan Source)](https://kb.cert.org/vuls/id/999008)
  - [Trojan Source disclosure site](https://trojansource.codes/)
  - [Unicode Bidirectional Algorithm (UAX
  #9)](https://www.unicode.org/reports/tr9/)
  - [Unicode Security Considerations (UTR
  #36)](https://www.unicode.org/reports/tr36/)
  
  ## Observability
  
  Unknown configured title item ids are warned about once instead of
  repeatedly spamming the transcript. Live preview applies immediately
  while the `/title` picker is open, and cancel rolls the in-memory title
  selection back to the pre-picker value.
  
  If terminal title writes fail, the TUI emits debug logs around set and
  clear attempts. The rendered status label intentionally collapses richer
  internal states into compact title text such as `Starting...`, `Ready`,
  `Thinking...`, `Working...`, `Waiting...`, and `Undoing...` when
  `status` is configured.
  
  ## Tests
  
  Ran:
  
  - `just fmt`
  - `cargo test -p codex-tui`
  
  At the moment, the red Windows `rust-ci` failures are due to existing
  `codex-core` `apply_patch_cli` stack-overflow tests that also reproduce
  on `main`. The `/title`-specific `codex-tui` suite is green.

  Yaroslav Volovich · 2026-03-19 19:26:36 +00:00
  60cd0cf75e
• Log automated reviewer approval sources distinctly (#15201)

  ## Summary
  
  - log guardian-reviewed tool approvals as `source=automated_reviewer` in
  `codex.tool_decision`
  - keep direct user approvals as `source=user` and config-driven
  approvals as `source=config`
  
  ## Testing
  
  -
  `/Users/gabec/.codex/skills/codex-oss-fastdev/scripts/codex-rs-fmt-quiet.sh`
  -
  `/Users/gabec/.codex/skills/codex-oss-fastdev/scripts/codex-rs-test-quiet.sh
  -p codex-otel` (fails in sandboxed loopback bind tests under
  `otel/tests/suite/otlp_http_loopback.rs`)
  - `cargo test -p codex-core guardian -- --nocapture` (original-tree run
  reached Guardian tests and only hit sandbox-related listener/proxy
  failures)
  
  Co-authored-by: Codex <noreply@openai.com>

  gabec-openai · 2026-03-19 12:10:41 -07:00
  fe287ac467
• Add exec-server exec RPC implementation (#15090)

  Stacked PR 2/3, based on the stub PR.
  
  Adds the exec RPC implementation and process/event flow in exec-server
  only.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-03-19 19:00:36 +00:00
  1d210f639e
• Publish runnable DotSlash package for argument-comment lint (#15198)

  ## Why
  
  To date, the argument-comment linter introduced in
  https://github.com/openai/codex/pull/14651 had to be built from source
  to run, which can be a bit slow (both for local dev and when it is run
  in CI). Because of the potential slowness, I did not wire it up to run
  as part of `just clippy` or anything like that. As a result, I have seen
  a number of occasions where folks put up PRs that violate the lint, see
  it fail in CI, and then have to put up their PR again.
  
  The goal of this PR is to pre-build a runnable version of the linter and
  then make it available via a DotSlash file. Once it is available, I will
  update `just clippy` and other touchpoints to make it a natural part of
  the dev cycle so lint violations should get flagged _before_ putting up
  a PR for review.
  
  To get things started, we will build the DotSlash file as part of an
  alpha release. Though I don't expect the linter to change often, so I'll
  probably change this to only build as part of mainline releases once we
  have a working DotSlash file. (Ultimately, we should probably move the
  linter into its own repo so it can have its own release cycle.)
  
  ## What Changed
  - add a reusable `rust-release-argument-comment-lint.yml` workflow that
  builds host-specific archives for macOS arm64, Linux arm64/x64, and
  Windows x64
  - wire `rust-release.yml` to publish the `argument-comment-lint`
  DotSlash manifest on all releases for now, including alpha tags
  - package a runnable layout instead of a bare library
  
  The Unix archive layout is:
  
  ```text
  argument-comment-lint/
    bin/
      argument-comment-lint
      cargo-dylint
    lib/
      libargument_comment_lint@nightly-2025-09-18-<target>.dylib|so
  ```
  
  On Windows the same layout is published as a `.zip`, with `.exe` and
  `.dll` filenames instead.
  
  DotSlash resolves the package entrypoint to
  `argument-comment-lint/bin/argument-comment-lint`. That runner finds the
  sibling bundled `cargo-dylint` binary plus the single packaged Dylint
  library under `lib/`, then invokes `cargo-dylint dylint --lib-path
  <that-library>` with the repo's default lint settings.

  Michael Bolin · 2026-03-19 18:59:02 +00:00
  b87ba0a3cc
• Add experimental exec server URL handling (#15196)

  Add a config and attempt to start the server.

  pakrym-oai · 2026-03-19 18:25:11 +00:00
  1837038f4e
• [hooks] use a user message > developer message for prompt continuation (#14867)

  ## Summary
  
  Persist Stop-hook continuation prompts as `user` messages instead of
  hidden `developer` messages + some requested integration tests
  
  This is a followup to @pakrym 's comment in
  https://github.com/openai/codex/pull/14532 to make sure stop-block
  continuation prompts match training for turn loops
  
  - Stop continuation now writes `<hook_prompt hook_run_id="...">stop
  hook's user prompt<hook_prompt>`
  - Introduces quick-xml dependency, though we already indirectly depended
  on it anyway via syntect
  - This PR only has about 500 lines of actual logic changes, the rest is
  tests/schema
  
  ## Testing
  
  Example run (with a sessionstart hook and 3 stop hooks) - this shows
  context added by session start, then two stop hooks sending their own
  additional prompts in a new turn. The model responds with a single
  message addressing both. Then when that turn ends, the hooks detect that
  they just ran using `stop_hook_active` and decide not to infinite loop
  
  test files for this (unzip, move codex -> .codex):
  [codex.zip](https://github.com/user-attachments/files/26075806/codex.zip)
  
  ```
  › cats
  
  
  • Running SessionStart hook: lighting the observatory
  
  SessionStart hook (completed)
    warning: Hi, I'm a session start hook for wizard-tower (startup).
    hook context: A wimboltine stonpet is an exotic cuisine from hyperspace
  
  • Cats are tiny zen wizards, my friend: equal parts nap, mystery, and chaos. If you want, we can talk
    cat facts, cat breeds, cat names, or build something cat-themed in this repo.
  
  • Running Stop hook: checking the tower wards
  
  • Running Stop hook: sacking the guards
  
  • Running Stop hook: hiring the guards
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook reviewed the completed reply (177 chars).
  
  Stop hook (blocked)
    warning: Wizard Tower Stop hook continuing conversation
    feedback: cook the stonpet
  
  Stop hook (blocked)
    warning: Wizard Tower Stop hook continuing conversation
    feedback: eat the cooked stonpet
  
  • Stonpet’s cooked, aloha style: flash-seared over a blue quasiflame, glazed with nebula salt, and
    rested until the hyperspace juices settle.
  
    Now we eat with gratitude, my friend. One mindful bite in, and the flavor is pure cosmic surf:
    smoky, bright, and totally out of this dimension.
  
  • Running Stop hook: checking the tower wards
  
  • Running Stop hook: sacking the guards
  
  • Running Stop hook: hiring the guards
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook reviewed the completed reply (285 chars).
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook saw a second pass and stayed calm to avoid a loop.
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook saw a second pass and stayed calm to avoid a loop.
  ```

  Andrei Eternal · 2026-03-19 10:53:08 -07:00
  267499bed8
• Revert "Forward session and turn headers to MCP HTTP requests" (#15185)

  Reverts openai/codex#15011
  
  Codex merged by mistake before feedback applied

  nicholasclark-openai · 2026-03-19 10:38:53 -07:00
  5ec121ba12