1810 Commits

• skill-creator: lazy-load PyYAML in frontmatter parsing (#12080)

  init-skill should work even without PyYAML

  xl-openai · 2026-02-19 15:09:12 -08:00
  e4456840f5
• feat(config): add permissions.network proxy config wiring (#12054)

  ## Summary
  
  Implements the `ConfigToml.permissions.network` and uses it to populate
  `NetworkProxyConfig`. We now parse a new nested permissions/network
  config shape which is converted into the proxy’s runtime config.
  
  When managed requirements exist, we still apply those constraints on top
  of user settings (so managed policy still wins).
  
  * Cleaned up the old constructor path so it now accepts both user config
  + managed constraints directly.
  * Updated the reload path so live proxy config reloads respect
  [permissions.network] too, while still supporting the existing top-level
  [network] format.
  
  ### Behavior
  - User-defined `[permissions.network]` values are now honored.
  - Managed constraints still take effect and are validated against the
  resulting policy.

  viyatb-oai · 2026-02-19 13:44:55 -08:00
  4edb1441a7
• Add configurable MCP OAuth callback URL for MCP login (#11382)

  ## Summary
  
  Implements a configurable MCP OAuth callback URL override for `codex mcp
  login` and app-server OAuth login flows, including support for non-local
  callback endpoints (for example, devbox ingress URLs).
  
  ## What changed
  
  - Added new config key: `mcp_oauth_callback_url` in
  `~/.codex/config.toml`.
  - OAuth authorization now uses `mcp_oauth_callback_url` as
  `redirect_uri` when set.
  - Callback handling validates the callback path against the configured
  redirect URI path.
  - Listener bind behavior is now host-aware:
  - local callback URL hosts (`localhost`, `127.0.0.1`, `::1`) bind to
  `127.0.0.1`
    - non-local callback URL hosts bind to `0.0.0.0`
  - `mcp_oauth_callback_port` remains supported and is used for the
  listener port.
  - Wired through:
    - CLI MCP login flow
    - App-server MCP OAuth login flow
    - Skill dependency OAuth login flow
  - Updated config schema and config tests.
  
  ## Why
  
  Some environments need OAuth callbacks to land on a specific reachable
  URL (for example ingress in remote devboxes), not loopback. This change
  allows that while preserving local defaults for existing users.
  
  ## Backward compatibility
  
  - No behavior change when `mcp_oauth_callback_url` is unset.
  - Existing `mcp_oauth_callback_port` behavior remains intact.
  - Local callback flows continue binding to loopback by default.
  
  ## Testing
  
  - `cargo test -p codex-rmcp-client callback -- --nocapture`
  - `cargo test -p codex-core --lib mcp_oauth_callback -- --nocapture`
  - `cargo check -p codex-cli -p codex-app-server -p codex-rmcp-client`
  
  ## Example config
  
  ```toml
  mcp_oauth_callback_port = 5555
  mcp_oauth_callback_url = "https://<devbox>-<namespace>.gateway.<cluster>.internal.api.openai.org/callback"

  dkumar-oai · 2026-02-19 13:32:10 -08:00
  1070a0a712
• fix(bazel): replace askama templates with include_str! in memories (#11778)

  ## Summary
  
  - The experimental Bazel CI builds fail on all platforms because askama
  resolves template paths relative to `CARGO_MANIFEST_DIR`, which points
  outside the Bazel sandbox. This produces errors like:
    ```
  error: couldn't read
  `codex-rs/core/src/memories/../../../../../../../../../../../work/codex/codex/codex-rs/core/templates/memories/consolidation.md`:
  No such file or directory
    ```
  - Replaced `#[derive(Template)]` + `#[template(path = "...")]` with
  `include_str!` + `str::replace()` for the three affected templates
  (`consolidation.md`, `stage_one_input.md`, `read_path.md`).
  `include_str!` resolves paths relative to the source file, which works
  correctly in both Cargo and Bazel builds.
  - The templates only use simple `{{ variable }}` substitution with no
  control flow or filters, so no askama functionality is lost.
  - Removes the `askama` dependency from `codex-core` since it was the
  only crate using it. The workspace-level dependency definition is left
  in place.
  - This matches the existing pattern used throughout the codebase — e.g.
  `codex-rs/core/src/memories/mod.rs` already uses
  `include_str!("../../templates/memories/stage_one_system.md")` for the
  fourth template file.
  
  ## Test plan
  
  - [ ] Verify Bazel (experimental) CI passes on all platforms
  - [ ] Verify rust-ci (Cargo) builds and tests continue to pass
  - [ ] Verify `cargo test -p codex-core` passes locally

  Alex Kwiatkowski · 2026-02-19 16:29:26 -05:00
  fe7054a346
• ws turn metadata via client_metadata (#11953)
  pash-openai · 2026-02-19 12:28:15 -08:00
  429cc4860e
• Clarify cumulative proposed_plan behavior in Plan mode (#12265)

  ## Summary
  - Require revised `<proposed_plan>` blocks in the same planning session
  to be complete replacements, not partial/delta plans.
  - Scope that cumulative replacement rule to the current planning session
  only.
  - Clarify that after leaving Plan mode (for example switching to Default
  mode to implement) or when explicitly asked for a new plan, the model
  should produce a new self-contained plan without inheriting prior plan
  blocks unless requested.
  
  ## Testing
  - Not run (prompt/template text-only change).

  Charley Cunningham · 2026-02-19 12:18:23 -08:00
  c3cb38eafb
• Skip removed features during metrics emission (#12253)

  Summary
  - avoid emitting metrics for features marked as `Stage::Removed`
  - keep feature metrics aligned with active and planned states only
  
  Testing
  - Not run (not requested)

  jif-oai · 2026-02-19 19:58:46 +00:00
  0362e12da6
• feat: add Reject approval policy with granular prompt rejection controls (#12087)

  ## Why
  
  We need a way to auto-reject specific approval prompt categories without
  switching all approvals off.
  
  The goal is to let users independently control:
  - sandbox escalation approvals,
  - execpolicy `prompt` rule approvals,
  - MCP elicitation prompts.
  
  ## What changed
  
  - Added a new primary approval mode in `protocol/src/protocol.rs`:
  
  ```rust
  pub enum AskForApproval {
      // ...
      Reject(RejectConfig),
      // ...
  }
  
  pub struct RejectConfig {
      pub sandbox_approval: bool,
      pub rules: bool,
      pub mcp_elicitations: bool,
  }
  ```
  
  - Wired `RejectConfig` semantics through approval paths in `core`:
    - `core/src/exec_policy.rs`
      - rejects rule-driven prompts when `rules = true`
      - rejects sandbox/escalation prompts when `sandbox_approval = true`
  - preserves rule priority when both rule and sandbox prompt conditions
  are present
    - `core/src/tools/sandboxing.rs`
  - applies `sandbox_approval` to default exec approval decisions and
  sandbox-failure retry gating
    - `core/src/safety.rs`
  - keeps `Reject { all false }` behavior aligned with `OnRequest` for
  patch safety
      - rejects out-of-root patch approvals when `sandbox_approval = true`
    - `core/src/mcp_connection_manager.rs`
      - auto-declines MCP elicitations when `mcp_elicitations = true`
  
  - Ensured approval policy used by MCP elicitation flow stays in sync
  with constrained session policy updates.
  
  - Updated app-server v2 conversions and generated schema/TypeScript
  artifacts for the new `Reject` shape.
  
  ## Verification
  
  Added focused unit coverage for the new behavior in:
  - `core/src/exec_policy.rs`
  - `core/src/tools/sandboxing.rs`
  - `core/src/mcp_connection_manager.rs`
  - `core/src/safety.rs`
  - `core/src/tools/runtimes/apply_patch.rs`
  
  Key cases covered include rule-vs-sandbox prompt precedence, MCP
  auto-decline behavior, and patch/sandbox retry behavior under
  `RejectConfig`.

  Michael Bolin · 2026-02-19 11:41:49 -08:00
  425fff7ad6
• try fix 2 (#12264)
  jif-oai · 2026-02-19 19:36:42 +00:00
  f6c06108b1
• Revert "feat: no timeout mode on ue" (#12256)

  Reverts openai/codex#12250

  jif-oai · 2026-02-19 19:02:29 +00:00
  928be5f515
• chore: consolidate new() and initialize() for McpConnectionManager (#12255)

  ## Why
  `McpConnectionManager` used a two-phase setup (`new()` followed by
  `initialize()`), which forced call sites to construct placeholder state
  and then mutate it asynchronously. That made MCP startup/refresh flows
  harder to follow and easier to misuse, especially around cancellation
  token ownership.
  
  ## What changed
  - Replaced the two-phase initialization flow with a single async
  constructor: `McpConnectionManager::new(...) -> (Self,
  CancellationToken)`.
  - Added `McpConnectionManager::new_uninitialized()` for places that need
  an empty manager before async startup begins.
  - Added `McpConnectionManager::new_mcp_connection_manager_for_tests()`
  for test-only construction.
  - Updated MCP startup and refresh call sites in
  `codex-rs/core/src/codex.rs` to build a fresh manager via `new(...)`,
  swap it in, and update the startup cancellation token consistently.
  - Updated MCP snapshot/connector call sites in
  `codex-rs/core/src/mcp/mod.rs` and `codex-rs/core/src/connectors.rs` to
  use the consolidated constructor.
  - Removed the now-obsolete `reset_mcp_startup_cancellation_token()`
  helper in favor of explicit token replacement at the call sites.
  
  ## Testing
  - Not run (refactor-only change; no new behavior was intended).

  Michael Bolin · 2026-02-19 10:59:51 -08:00
  7cd2e84026
• feat: no timeout mode on ue (#12250)
  jif-oai · 2026-02-19 18:58:13 +00:00
  9719dc502c
• Add configurable agent spawn depth (#12251)

  Summary
  - expose `agents.max_depth` in config schema and toml parsing, with
  defaults and validation
  - thread-spawn depth guards and multi-agent handler now respect the
  configured limit instead of a hardcoded value
  - ensure documentation and helpers account for agent depth limits

  jif-oai · 2026-02-19 18:40:41 +00:00
  d87cf7794c
• client side modelinfo overrides (#12101)

  TL;DR
  Add top-level `model_catalog_json` config support so users can supply a
  local model catalog override from a JSON file path (including adding new
  models) without backend changes.
  
  ### Problem
  Codex previously had no clean client-side way to replace/overlay model
  catalog data for local testing of model metadata and new model entries.
  
  ### Fix
  - Add top-level `model_catalog_json` config field (JSON file path).
  - Apply catalog entries when resolving `ModelInfo`:
    1. Base resolved model metadata (remote/fallback)
    2. Catalog overlay from `model_catalog_json`
  3. Existing global top-level overrides (`model_context_window`,
  `model_supports_reasoning_summaries`, etc.)
  
  ### Note
  Will revisit per-field overrides in a follow-up
  
  ### Tests
  Added tests

  sayan-oai · 2026-02-19 10:38:57 -08:00
  d54999d006
• Restore phase when loading from history (#12244)
  Jack Mousseau · 2026-02-19 09:56:56 -08:00
  3a951f8096
• Move previous turn context tracking into ContextManager history (#12179)

  ## Summary
  - add `previous_context_item: Option<TurnContextItem>` to
  `ContextManager`
  - expose session/state accessors for reading and updating the stored
  previous context item
  - switch settings diffing to use `TurnContextItem` instead of
  `TurnContext`
  - remove submission-loop local `previous_context` and persist the
  previous context item in history
  
  ## Testing
  - `just fmt`
  - `just fix -p codex-core`
  - `cargo test -p codex-core --test all model_switching::`
  - `cargo test -p codex-core --test all collaboration_instructions::`
  - `cargo test -p codex-core --test all personality::`
  - `cargo test -p codex-core --test all
  permissions_messages::permissions_message_not_added_when_no_change`

  Charley Cunningham · 2026-02-19 09:56:20 -08:00
  f2d5842ed1
• Adjust MCP tool approval handling for custom servers (#11787)

  Summary
  This PR expands MCP client-side approval behavior beyond codex_apps and
  tightens elicitation capability signaling.
  
  - Removed the codex_apps-only gate in MCP tool approval checks, so
  local/custom MCP servers are now eligible for the same client-side
  approval prompt flow when tool annotations indicate side effects.
  - Updated approval memory keying to support tools without a connector ID
  (connector_id: Option<String>), allowing “Approve this Session” to be
  remembered even when connector metadata is missing.
  - Updated prompt text for non-codex_apps tools to identify origin as The
  <server> MCP server instead of This app.
  - Added MCP initialization capability policy so only codex_apps
  advertises MCP elicitation capability; other servers advertise no
  elicitation support.
  - Added regression tests for:
  server-specific prompt copy behavior
  codex-apps-only elicitation capability advertisement
  
  Testing
  - Not run (not requested)

  colby-oai · 2026-02-19 12:52:42 -05:00
  f6fd4cb3f5
• feat: add configurable write_stdin timeout (#12228)

  Add max timeout as config for `write_stdin`. This is only used for empty
  `write_stdin`.
  
  Also increased the default value from 30s to 5mins.

  jif-oai · 2026-02-19 17:22:13 +00:00
  547f462385
• feat: add shell snapshot failure reason (#12233)
  jif-oai · 2026-02-19 13:49:12 +00:00
  743caea3a6
• feat: sub-agent injection (#12152)

  This PR adds parent-thread sub-agent completion notifications and change
  the prompt of the model to prevent if from being confused

  jif-oai · 2026-02-19 11:32:10 +00:00
  2daa3fd44f
• Adjust memories rollout defaults (#12231)

  - Summary
  - raise `DEFAULT_MEMORIES_MAX_ROLLOUTS_PER_STARTUP` to 16 so more
  rollouts are allowed per startup
  - lower `DEFAULT_MEMORIES_MIN_ROLLOUT_IDLE_HOURS` to 6 to make rollouts
  eligible sooner
  - Testing
    - Not run (not requested)

  jif-oai · 2026-02-19 10:52:43 +00:00
  f298c48cc6
• Update docs links for feature flag notice (#12164)

  Summary
  - replace the stale `docs/config.md#feature-flags` reference in the
  legacy feature notice with the canonical published URL
  - align the deprecation notice test to expect the new link
  
  This addresses #12123

  Eric Traut · 2026-02-19 00:00:44 -08:00
  227352257c
• [apps] Update apps allowlist. (#12211)

  - [x] Update apps allowlist.

  Matthew Zeng · 2026-02-18 23:21:32 -08:00
  18eb640a47
• fix: Remove citation (#12187)

  Remove citation requirement until we figure out a better visualization

  zuxin-oai · 2026-02-18 21:13:33 +00:00
  f8ee18c8cf
• app-server support for Windows sandbox setup. (#12025)

  app-server support for initiating Windows sandbox setup.
  server responds quickly to setup request and makes a future RPC call
  back to client when the setup finishes.
  
  The TUI implementation is unaffected but in a future PR I'll update the
  TUI to use the shared setup helper
  (`windows_sandbox.run_windows_sandbox_setup`)

  iceweasel-oai · 2026-02-18 13:03:16 -08:00
  292542616a
• js_repl: canonicalize paths for node_modules boundary checks (#12177)

  ## Summary
  
  Fix `js_repl` package-resolution boundary checks for macOS temp
  directory path aliasing (`/var` vs `/private/var`).
  
  ## Problem
  
  `js_repl` verifies that resolved bare-package imports stay inside a
  configured `node_modules` root.
  On macOS, temp directories are commonly exposed as `/var/...` but
  canonicalize to `/private/var/...`.
  Because the boundary check compared raw paths with `path.relative(...)`,
  valid resolutions under temp dirs could be misclassified as escaping the
  allowed base, causing false `Module not found` errors.
  
  ## Changes
  
  - Add `fs` import in the JS kernel.
  - Add `canonicalizePath()` using `fs.realpathSync.native(...)` (with
  safe fallback).
  - Canonicalize both `base` and `resolvedPath` before running the
  `node_modules` containment check.
  
  ## Impact
  
  - Fixes false-negative boundary checks for valid package resolutions in
  macOS temp-dir scenarios.
  - Keeps the existing security boundary behavior intact.
  - Scope is limited to `js_repl` kernel module path validation logic.
  
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/12177
  - ⏳ `2` https://github.com/openai/codex/pull/10673

  Curtis 'Fjord' Hawthorne · 2026-02-18 11:56:45 -08:00
  cc248e4681
• memories: bump rollout summary slug cap to 60 (#12167)

  ## Summary
  Increase the rollout summary filename slug cap from 20 to 60 characters
  in memory storage.
  
  ## What changed
  - Updated `ROLLOUT_SLUG_MAX_LEN` from `20` to `60` in:
    - `codex-rs/core/src/memories/storage.rs`
  - Updated slug truncation test to verify 60-char behavior.
  
  ## Why
  This preserves more semantic context in rollout summary filenames while
  keeping existing normalization behavior unchanged.
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-core
  memories::storage::tests::rollout_summary_file_stem_sanitizes_and_truncates_slug
  -- --exact`

  zuxin-oai · 2026-02-18 19:15:07 +00:00
  82d82d9ca5
• fix: file watcher (#12105)

  The issue was that the file_watcher never unsubscribe a file watch. All
  of them leave in the owning of the ThreadManager. As a result, for each
  newly created thread we create a new file watcher but this one never get
  deleted even if we close the thread. On Unix system, a file watcher uses
  an `inotify` and after some time we end up having consumed all of them.
  
  This PR adds a mechanism to unsubscribe a file watcher when a thread is
  dropped

  jif-oai · 2026-02-18 18:28:34 +00:00
  f675bf9334
• Fixed a hole in token refresh logic for app server (#11802)

  We've continued to receive reports from users that they're seeing the
  error message "Your access token could not be refreshed because your
  refresh token was already used. Please log out and sign in again." This
  PR fixes two holes in the token refresh logic that lead to this
  condition.
  
  Background: A previous change in token refresh introduced the
  `UnauthorizedRecovery` object. It implements a state machine in the core
  agent loop that first performs a load of the on-disk auth information
  guarded by a check for matching account ID. If it finds that the on-disk
  version has been updated by another instance of codex, it uses the
  reloaded auth tokens. If the on-disk version hasn't been updated, it
  issues a refresh request from the token authority.
  
  There are two problems that this PR addresses:
  
  Problem 1: We weren't doing the same thing for the code path used by the
  app server interface. This PR effectively replicates the
  `UnauthorizedRecovery` logic for that code path.
  
  Problem 2: The `UnauthorizedRecovery` logic contained a hole in the
  `ReloadOutcome::Skipped` case. Here's the scenario. A user starts two
  instances of the CLI. Instance 1 is active (working on a task), instance
  2 is idle. Both instances have the same in-memory cached tokens. The
  user then runs `codex logout` or `codex login` to log in to a separate
  account, which overwrites the `auth.json` file. Instance 1 receives a
  401 and refreshes its token, but it doesn't write the new token to the
  `auth.json` file because the account ID doesn't match. Instance 2 is
  later activated and presented with a new task. It immediately hits a 401
  and attempts to refresh its token but fails because its cached refresh
  token is now invalid. To avoid this situation, I've changed the logic to
  immediately fail a token refresh if the user has since logged out or
  logged in to another account. This will still be seen as an error by the
  user, but the cause will be clearer.
  
  I also took this opportunity to clean up the names of existing functions
  to make their roles clearer.
  * `try_refresh_token` is renamed `request_chatgpt_token_refresh`
  * the existing `refresh_token` is renamed `refresh_token_from_authority`
  (there's a new higher-level function named `refresh_token` now)
  * `refresh_tokens` is renamed `refresh_and_persist_chatgpt_token`, and
  it now implicitly reloads
  * `update_tokens` is renamed `persist_tokens`

  Eric Traut · 2026-02-18 09:27:04 -08:00
  999576f7b8
• Disable collab tools during review delegation (#12157)

  Summary
  - prevent delegated review agents from re-enabling blocked tools by
  explicitly disabling the Collab feature alongside web search and view
  image controls
  
  Testing
  - Not run (not requested)

  jif-oai · 2026-02-18 17:02:49 +00:00
  9f5b17de0d
• feat: better slug for rollout summaries (#12135)
  jif-oai · 2026-02-18 16:39:38 +00:00
  18206a9c1e
• Stop filtering model tools in js_repl_tools_only mode (#12069)

  ## Summary
  This change removes tool-list filtering in `js_repl_tools_only` mode and
  relies on the normal model tool descriptions, while still enforcing that
  tool execution must go through `js_repl` + `codex.tool(...)`.
  
  ## Motivation
  The previous `js_repl_tools_only` filtering hid most tools from the
  model request, which diverged from standard tool-list behavior and made
  signatures less discoverable. I tested that this filtering is not
  needed, and the model can follow the prompt to only call tools via
  `js_repl`.
  
  ## What Changed
  - `filter_tools_for_model(...)` in `core/src/tools/spec.rs` is now a
  pass-through (no filtering when `js_repl_tools_only` is enabled).
  - Updated tests to assert that model tools are not filtered in
  `js_repl_tools_only` mode.
  - Updated dynamic-tool test to assert dynamic tools remain visible in
  model tool specs.
  - Removed obsolete test helper used only by the old filtering
  assertions.
  
  ## Safety / Behavior
  - This commit does **not** relax execution policy.
  - Direct model tool calls remain blocked in `js_repl_tools_only` mode
  (except internal `js_repl` tools), and callers are instructed to use
  `js_repl` + `codex.tool(...)`.
  
  ## Testing
  - `cargo test -p codex-core js_repl_tools_only`
  - Manual rollout validation showed the model can follow the `js_repl`
  routing instructions without needing filtered tool lists.
  
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/12069
  - ⏳ `2` https://github.com/openai/codex/pull/10673
  - ⏳ `3` https://github.com/openai/codex/pull/10670

  Curtis 'Fjord' Hawthorne · 2026-02-18 07:31:15 -08:00
  491b4946ae
• nit: change model for phase 1 (#12137)
  jif-oai · 2026-02-18 13:55:30 +00:00
  cc3bbd7852
• feat: validate agent config file paths (#12133)
  jif-oai · 2026-02-18 13:48:52 +00:00
  7b65b05e87
• feat: memory usage metrics (#12120)
  jif-oai · 2026-02-18 12:45:19 +00:00
  a9f5f633b2
• feat: phase 2 usage (#12121)
  jif-oai · 2026-02-18 11:33:55 +00:00
  2293ab0e21
• feat: phase 1 and phase 2 e2e latencies (#12124)
  jif-oai · 2026-02-18 11:30:20 +00:00
  f0ee2d9f67
• Enable default status line indicators in TUI config (#12015)

  Default statusline to something
  <img width="307" height="83" alt="Screenshot 2026-02-17 at 18 16 12"
  src="https://github.com/user-attachments/assets/44e16153-0aa2-4c1a-9b4a-02e2feb8b7f6"
  />

  jif-oai · 2026-02-18 09:51:15 +00:00
  0dcf8d9c8f
• fix: Restricted Read: /System is too permissive for macOS platform de… (#11798)

  …fault
  
  Update the list of platform defaults included for `ReadOnlyAccess`.
  
  When `ReadOnlyAccess::Restricted::include_platform_defaults` is `true`,
  the policy defined in
  `codex-rs/core/src/seatbelt_platform_defaults.sbpl` is appended to
  enable macOS programs to function properly.

  Leo Shimonaka · 2026-02-17 23:56:35 -08:00
  1946a4c48b
• [js_repl] paths for node module resolution can be specified for js_repl (#11944)

  # External (non-OpenAI) Pull Request Requirements
  
  In `js_repl` mode, module resolution currently starts from
  `js_repl_kernel.js`, which is written to a per-kernel temp dir. This
  effectively means that bare imports will not resolve.
  
  This PR adds a new config option, `js_repl_node_module_dirs`, which is a
  list of dirs that are used (in order) to resolve a bare import. If none
  of those work, the current working directory of the thread is used.
  
  For example:
  ```toml
  js_repl_node_module_dirs = [
      "/path/to/node_modules/",
      "/other/path/to/node_modules/",
  ]
  ```

  aaronl-openai · 2026-02-17 23:29:49 -08:00
  f600453699
• Add model-visible context layout snapshot tests (#12073)

  ## Summary
  - add a dedicated `core/tests/suite/model_visible_layout.rs` snapshot
  suite to materialize model-visible request layout in high-value
  scenarios
  - add three reviewer-focused snapshot scenarios:
    - turn-level context updates (cwd / permissions / personality)
    - first post-resume turn with model hydration + personality change
  - first post-resume turn where pre-turn model override matches rollout
  model
  - wire the new suite into `core/tests/suite/mod.rs`
  - commit generated `insta` snapshots under `core/tests/suite/snapshots/`
  
  ## Why
  This creates a stable, reviewable baseline of model-visible context
  layout against `main` before follow-on context-management refactors. It
  lets subsequent PRs show focused snapshot diffs for behavior changes
  instead of introducing the test surface and behavior changes at once.
  
  ## Testing
  - `just fmt`
  - `INSTA_UPDATE=always cargo test -p codex-core model_visible_layout`

  Charley Cunningham · 2026-02-17 22:30:29 -08:00
  c16f9daaaf
• got rid of experimental_mode for configtoml (#12077)
  won-openai · 2026-02-17 21:10:30 -08:00
  189f592014
• feat(core): zsh exec bridge (#12052)

  zsh fork PR stack:
  - https://github.com/openai/codex/pull/12051 
  - https://github.com/openai/codex/pull/12052 👈 
  
  ### Summary
  This PR introduces a feature-gated native shell runtime path that routes
  shell execution through a patched zsh exec bridge, removing MCP-specific
  behavior from the shell hot path while preserving existing
  CommandExecution lifecycle semantics.
  
  When shell_zsh_fork is enabled, shell commands run via patched zsh with
  per-`execve` interception through EXEC_WRAPPER. Core receives wrapper
  IPC requests over a Unix socket, applies existing approval policy, and
  returns allow/deny before the subcommand executes.
  
  ### What’s included
  **1) New zsh exec bridge runtime in core**
  - Wrapper-mode entrypoint (maybe_run_zsh_exec_wrapper_mode) for
  EXEC_WRAPPER invocations.
  - Per-execution Unix-socket IPC handling for wrapper requests/responses.
  - Approval callback integration using existing core approval
  orchestration.
  - Streaming stdout/stderr deltas to existing command output event
  pipeline.
  - Error handling for malformed IPC, denial/abort, and execution
  failures.
  
  **2) Session lifecycle integration**
  SessionServices now owns a `ZshExecBridge`.
  Session startup initializes bridge state; shutdown tears it down
  cleanly.
  
  **3) Shell runtime routing (feature-gated)**
  When `shell_zsh_fork` is enabled:
  - Build execution env/spec as usual.
  - Add wrapper socket env wiring.
  - Execute via `zsh_exec_bridge.execute_shell_request(...)` instead of
  the regular shell path.
  - Non-zsh-fork behavior remains unchanged.
  
  **4) Config + feature wiring**
  - Added `Feature::ShellZshFork` (under development).
  - Added config support for `zsh_path` (optional absolute path to patched
  zsh):
  - `Config`, `ConfigToml`, `ConfigProfile`, overrides, and schema.
  - Session startup validates that `zsh_path` exists/usable when zsh-fork
  is enabled.
  - Added startup test for missing `zsh_path` failure mode.
  
  **5) Seatbelt/sandbox updates for wrapper IPC**
  - Extended seatbelt policy generation to optionally allow outbound
  connection to explicitly permitted Unix sockets.
  - Wired sandboxing path to pass wrapper socket path through to seatbelt
  policy generation.
  - Added/updated seatbelt tests for explicit socket allow rule and
  argument emission.
  
  **6) Runtime entrypoint hooks**
  - This allows the same binary to act as the zsh wrapper subprocess when
  invoked via `EXEC_WRAPPER`.
  
  **7) Tool selection behavior**
  - ToolsConfig now prefers ShellCommand type when shell_zsh_fork is
  enabled.
  - Added test coverage for precedence with unified-exec enabled.

  Owen Lin · 2026-02-17 20:19:53 -08:00
  edacbf7b6e
• Use V2 websockets if feature enabled (#12071)
  pakrym-oai · 2026-02-17 18:32:16 -08:00
  fc810ba045
• Unify remote compaction snapshot mocks around default endpoint behavior (#12050)

  ## Summary
  - standardize remote compaction test mocking around one default behavior
  in shared helpers
  - make default remote compact mocks mirror production shape: keep
  `message/user` + `message/developer`, drop assistant/tool artifacts,
  then append a summary user message
  - switch non-special `compact_remote` tests to the shared default mock
  instead of ad-hoc JSON payloads
  
  ## Special-case tests that still use explicit mocks
  - remote compaction error payload / HTTP failure behavior
  - summary-only compact output behavior
  - manual `/compact` with no prior user messages
  - stale developer-instruction injection coverage
  
  ## Why
  This removes inconsistent manual remote compaction fixtures and gives us
  one source of truth for normal remote compact behavior, while preserving
  explicit mocks only where tests intentionally cover non-default
  behavior.

  Charley Cunningham · 2026-02-17 18:18:47 -08:00
  eb68767f2f
• feat(core): plumb distinct approval ids for command approvals (#12051)

  zsh fork PR stack:
  - https://github.com/openai/codex/pull/12051 👈 
  - https://github.com/openai/codex/pull/12052
  
  With upcoming support for a fork of zsh that allows us to intercept
  `execve` and run execpolicy checks for each subcommand as part of a
  `CommandExecution`, it will be possible for there to be multiple
  approval requests for a shell command like `/path/to/zsh -lc 'git status
  && rg \"TODO\" src && make test'`.
  
  To support that, this PR introduces a new `approval_id` field across
  core, protocol, and app-server so that we can associate approvals
  properly for subcommands.

  Owen Lin · 2026-02-18 01:55:57 +00:00
  db4d2599b5
• Chore: remove response model check and rely on header model for downgrade (#12061)

  ### Summary
  Ensure that we use the model value from the response header only so that
  we are guaranteed with the correct slug name. We are no longer checking
  against the model value from response so that we are less likely to have
  false positive.
  
  There are two different treatments - for SSE we use the header from the
  response and for websocket we check top-level events.

  Shijie Rao · 2026-02-18 01:50:06 +00:00
  b3a8571219
• Use prompt-based co-author attribution with config override (#11617)
  gabec-openai · 2026-02-17 20:15:54 +00:00
  5341ad08f8
• chore(deps): bump arc-swap from 1.8.0 to 1.8.2 in /codex-rs (#11890)

  Bumps [arc-swap](https://github.com/vorner/arc-swap) from 1.8.0 to
  1.8.2.
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/vorner/arc-swap/blob/master/CHANGELOG.md">arc-swap's
  changelog</a>.</em></p>
  <blockquote>
  <h1>1.8.2</h1>
  <ul>
  <li>Proper gate of <code>Pin</code> (since 1.39 - we are not using only
  <code>Pin</code>, but also
  <code>Pin::into_inner</code>, <a
  href="https://redirect.github.com/vorner/arc-swap/issues/197">#197</a>).</li>
  </ul>
  <h1>1.8.1</h1>
  <ul>
  <li>Some more careful orderings (<a
  href="https://redirect.github.com/vorner/arc-swap/issues/195">#195</a>).</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/19f0d661a27bb6312c6ba9e19e1453db19c30ab5"><code>19f0d66</code></a>
  Version 1.8.2</li>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/c222a22864dce497f1924eb788f6b05b760a9c10"><code>c222a22</code></a>
  Release 1.8.1</li>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/cccf3548a8c1c83028f3a9cff83d89d1b89b17b8"><code>cccf354</code></a>
  Upgrade the other ordering too, for transitivity</li>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/e94df5511ab2eb0b04959af2505ea1be51e67242"><code>e94df55</code></a>
  Merge pull request <a
  href="https://redirect.github.com/vorner/arc-swap/issues/195">#195</a>
  from 0xfMel/master</li>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/bd5d3276e4cfc37b90676260c93d8545d9b9b911"><code>bd5d327</code></a>
  Fix Debt::pay failure ordering</li>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/22431daf6411cedfa3ebdf7fd8777dc579858b9a"><code>22431da</code></a>
  Merge pull request <a
  href="https://redirect.github.com/vorner/arc-swap/issues/189">#189</a>
  from atouchet/rdm</li>
  <li><a
  href="https://github.com/vorner/arc-swap/commit/b142bd81dae89d5f7a934bb399103f7f029faeed"><code>b142bd8</code></a>
  Update Readme</li>
  <li>See full diff in <a
  href="https://github.com/vorner/arc-swap/compare/v1.8.0...v1.8.2">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=arc-swap&package-manager=cargo&previous-version=1.8.0&new-version=1.8.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-02-17 11:45:45 -08:00
  15cd796749
• [apps] Expose more fields from apps listing endpoints. (#11706)

  - [x] Expose app_metadata, branding, and labels in AppInfo.

  Matthew Zeng · 2026-02-17 11:45:04 -08:00
  16fa195fce