57 Commits

• [2 of 2] Finish moving goal runtime to extension (#26548)

  ## Stack
  
  1. [#26547](https://github.com/openai/codex/pull/26547) - [1 of 2] Align
  goal extension with core behavior
  2. [#26548](https://github.com/openai/codex/pull/26548) - [2 of 2] Move
  goal runtime to extension
  
  ## Why
  
  This PR completes the switch of the goal behavior to the
  extension-backed runtime and removes the old core goal implementation.
  
  ## What Changed
  
  - Installs the goal extension for app-server `ThreadManager` sessions.
  - Routes app-server thread goal `get`, `set`, and `clear` through
  `GoalService`.
  - Uses thread-idle lifecycle emission after goal resume and snapshot
  ordering so the extension can decide whether to continue the goal.
  - Forwards extension goal updates through a FIFO async app-server
  notification path so backpressure does not drop them or reorder updates.
  - Keeps review turns from enabling goal runtime behavior.
  - Plans extension tools before dynamic tools so built-in goal tool names
  keep their old precedence when goals are enabled.
  - Removes the old core goal runtime, core goal tool handlers, and core
  goal tool specs.
  - Updates tests that were coupled to the core-owned goal runtime while
  leaving the legacy `<goal_context>` compatibility path in core for old
  threads.
  - Removes the stale cargo-shear ignore now that `codex-goal-extension`
  is used by the workspace.
  - Keeps realtime event matching exhaustive after removing the old
  goal-specific realtime text path.
  
  
  ## Validation
  
  - Ran manual `/goal` runs in TUI. Validated time accounting matched
  wall-clock time and goal lifecycle state transitions.

  Eric Traut · 2026-06-05 14:17:30 -07:00
  479a14cf59
• [codex] Forward turn moderation metadata through app-server (#25710)

  ## Why
  First-party backends can supply turn-scoped moderation metadata that
  app-server clients need for client-side presentation. Exposing this as
  an experimental typed notification lets opted-in clients consume it
  without interpreting raw Responses API events.
  
  ## What changed
  - forward `response.metadata.openai_chatgpt_moderation_metadata` from
  Responses API SSE and WebSocket streams as turn-scoped moderation
  metadata
  - emit the experimental app-server v2 `turn/moderationMetadata`
  notification with `{ threadId, turnId, metadata }`
  - add app-server integration coverage for the typed moderation metadata
  notification
  
  ## Testing
  - `just test -p codex-core
  build_ws_client_metadata_includes_window_lineage_and_turn_metadata`
  - `just test -p codex-core` (fails locally: 46 failures and 1 timeout,
  primarily missing `test_stdio_server` and shell snapshot timeouts)
  - `just test -p codex-app-server-protocol`
  - `just test -p codex-app-server
  turn_moderation_metadata_emits_typed_notification_v2`
  - `just test -p codex-app-server` (fails locally: 792 passed, 10 failed,
  and 5 timed out; failures are in existing environment-sensitive tests,
  primarily because nested macOS `sandbox-exec` is not permitted)
  - `just write-app-server-schema --experimental --schema-root
  /tmp/codex-app-server-schema-experimental`

  carlc-oai · 2026-06-05 02:41:06 -07:00
  55aa071b17
• feat: show enterprise monthly credit limits in status (#24812)

  ## Summary
  
  Enterprise users can have an effective monthly credit limit, but Codex
  `/status` currently drops that metadata from the account-usage response.
  
  This change adds the optional `spend_control.individual_limit`
  projection to the existing rate-limit snapshot flow. The backend client
  reads the monthly limit, app-server exposes it as `individualLimit`, and
  the TUI renders a `Monthly credit limit` row through the existing
  progress-bar renderer.
  
  When the backend does not return an effective monthly limit, existing
  rate-limit behavior is unchanged.
  
  ## Existing backend state
  
  The account-usage backend already returns the effective monthly limit
  and current usage together:
  
  ```json
  {
    "spend_control": {
      "reached": false,
      "individual_limit": {
        "limit": "25000",
        "used": "8000",
        "remaining": "17000",
        "used_percent": 32,
        "remaining_percent": 68,
        "reset_after_seconds": 86400,
        "reset_at": 1778137680
      }
    }
  }
  ```
  
  Before this change, Codex projected rolling `primary` and `secondary`
  windows plus `credits`. It ignored `spend_control.individual_limit`, so
  app-server clients and `/status` could not render the monthly cap.
  
  The updated flow is:
  
  ```text
  account usage backend
    -> backend-client reads spend_control.individual_limit
    -> existing rate-limit snapshot carries optional individual_limit
    -> app-server exposes optional individualLimit
    -> TUI renders Monthly credit limit
  ```
  
  ## App-server contract
  
  `account/rateLimits/read` and sparse `account/rateLimits/updated`
  notifications now include an additive nullable
  `rateLimits.individualLimit` field:
  
  ```json
  {
    "individualLimit": {
      "limit": "25000",
      "used": "8000",
      "remainingPercent": 68,
      "resetsAt": 1778137680
    }
  }
  ```
  
  In an `account/rateLimits/read` response, `null` means no monthly limit
  is available. `account/rateLimits/updated` remains a sparse rolling
  notification: clients merge available values into their most recent
  `account/rateLimits/read` snapshot or refetch. Nullable account metadata
  in a rolling notification does not clear a previously observed value.
  
  ## Design decisions
  
  - Extend the existing rate-limit snapshot instead of introducing a
  separate request or wire-level update protocol.
  - Keep the Codex projection narrow: `/status` needs the effective limit,
  current usage, remaining percentage, and reset timestamp.
  - Render the monthly row through the existing progress-bar renderer,
  with one optional detail line for `8,000 of 25,000 credits used`.
  - Keep the backend response optional so existing accounts and older
  usage states preserve their current behavior.
  - Preserve cached monthly metadata when sparse rolling notifications
  omit it. Live account-usage reads remain authoritative and can clear a
  removed limit.
  
  ## Visual evidence
  
  ```text
   Monthly credit limit:   [██████████████░░░░░░] 68% left (resets 07:08 on 7 May)
                           8,000 of 25,000 credits used
  ```
  
  Snapshot:
  `codex-rs/tui/src/status/snapshots/codex_tui__status__tests__status_snapshot_includes_enterprise_monthly_credit_limit.snap`
  
  ## Testing
  
  Tests: generated app-server schema verification, protocol tests,
  backend-client tests, app-server integration coverage, TUI snapshot
  coverage, formatting, and workspace lint cleanup.

  efrazer-oai · 2026-06-01 21:25:42 -07:00
  c8e5db16c9
• Uprev Rust toolchain pins to 1.95.0 (#24684)

  ## Summary
  - Bump the workspace Rust toolchain from `1.93.0` to `1.95.0` across
  Cargo, Bazel, CI, release workflows, devcontainers, and the Codex
  environment config.
  - Refresh `MODULE.bazel.lock` so the Bazel Rust toolchain artifacts
  match the new version.
  - Leave purpose-specific toolchains unchanged, including the
  `argument-comment-lint` nightly and the upstream `rusty_v8` `1.91.0`
  build pin.
  - Includes fixes for new lints from `just fix` and a few codex-authored
  fixes for lints without a suggestion.

  Adam Perry @ OpenAI · 2026-05-26 20:59:47 -07:00
  cca1e0ba1d
• Wire app-server extension event sink (#24586)

  ## Why
  
  The goal extension already emits `ThreadGoalUpdated` events, but
  production app-server thread extensions were built with the default
  no-op extension event sink. That meant extension-driven goal updates
  could be produced without ever reaching app-server clients.
  
  ## What changed
  
  - Build app-server thread extensions with a host-provided
  `ExtensionEventSink`.
  - Add an app-server sink that converts extension `ThreadGoalUpdated`
  events into `ServerNotification::ThreadGoalUpdated` broadcasts.
  - Use the existing bounded outgoing message channel via `try_send` so
  event forwarding cannot create an unbounded queue.
  - Pass `NoopExtensionEventSink` in app-server tests that construct a
  `ThreadManager` without an app-server host.
  - Refresh `Cargo.lock` for the existing `codex-memories-extension`
  `codex-otel` dependency.
  
  ## Verification
  
  - `just test -p codex-app-server
  extensions::tests::app_server_event_sink_forwards_thread_goal_updates`

  jif-oai · 2026-05-26 15:28:02 +02:00
  c4e53d103c
• [codex-analytics] emit terminal review events (#18748)

  ## Why
  
  Review telemetry should describe reviews as first-class events, not only
  as counters denormalized onto terminal tool-item events. That lets us
  analyze guardian and user reviews consistently across command execution,
  file changes, permissions, and network access, while still preserving
  the terminal item summaries that existing tool analytics need.
  
  To make those review events accurate, analytics also needs the observed
  completion time for each review and enough command metadata to
  distinguish `shell` from `unified_exec` reviews.
  
  ## What changed
  
  - emit generic `codex_review_event` rows for completed user and guardian
  reviews, with review subjects, reviewer, trigger, terminal status,
  resolution, and observed duration
  - reduce approval request / response / abort facts into review events
  for command execution, file change, and permissions flows
  - keep denormalized review counts, final approval outcome, and
  permission-request flags on terminal tool-item events for
  item-associated reviews
  - plumb review completion timing so user-review responses and aborts use
  app-server-observed completion times, while guardian analytics reuse the
  same terminal timestamps emitted on guardian assessment events
  - carry command approval `source` through the protocol and app-server
  layers so review analytics can distinguish `shell` from `unified_exec`
  - add analytics coverage for user-review emission, guardian-review
  emission, permission reviews that should not denormalize onto tool
  items, item-summary isolation across threads, and the serialized
  review-event shape
  
  ## Verification
  
  - `cargo test -p codex-analytics`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18748).
  * __->__ #18748
  * #21434
  * #18747
  * #17090
  * #17089
  * #20514

  rhan-oai · 2026-05-11 22:13:32 +00:00
  a175ddacc0
• [codex] request desktop attestation from app (#20619)

  ## Summary
  
  TL;DR: teaches `codex-rs` / app-server to request a desktop-provided
  attestation token and attach it as `x-oai-attestation` on the scoped
  ChatGPT Codex request paths.
  
  ![DeviceCheck attestation
  interface](https://raw.githubusercontent.com/openai/codex/dev/jm/devicecheck-diagram-assets/pr-assets/devicecheck-attestation-interface.png)
  
  ## Details
  
  This PR teaches the Codex app-server runtime how to request and attach
  an attestation token. It does not generate DeviceCheck tokens directly;
  instead, it relies on the connected desktop app to advertise that it can
  generate attestation and then asks that app for a fresh header value
  when needed.
  
  The flow is:
  
  1. The Codex desktop app connects to app-server.
  2. During `initialize`, the app can advertise that it supports
  `requestAttestation`.
  3. Before app-server calls selected ChatGPT Codex endpoints, it sends
  the internal server request `attestation/generate` to the app.
  4. app-server receives a pre-encoded header value back.
  5. app-server forwards that value as `x-oai-attestation` on the scoped
  outbound requests.
  
  The code in this repo is mostly protocol and runtime plumbing: it adds
  the app-server request/response shape, introduces an attestation
  provider in core, wires that provider into Responses / compaction /
  realtime setup paths, and covers the intended scoping with tests. The
  signed macOS DeviceCheck generation remains owned by the desktop app PR.
  
  ## Related PR
  
  - Codex desktop app implementation:
  https://github.com/openai/openai/pull/878649
  
  ## Validation
  
  <details>
  <summary>Tests run</summary>
  
  ```sh
  cargo test -p codex-app-server-protocol
  cargo test -p codex-core attestation --lib
  cargo test -p codex-app-server --lib attestation
  ```
  
  Also ran:
  
  ```sh
  just fix -p codex-core
  just fix -p codex-app-server
  just fix -p codex-app-server-protocol
  just fmt
  just write-app-server-schema
  ```
  
  </details>
  
  <details>
  <summary>E2E DeviceCheck validation</summary>
  
  First validated the signed desktop app boundary directly: launched a
  packaged signed `Codex.app`, sent `attestation/generate`, decoded the
  returned `v1.` attestation header, and validated the extracted
  DeviceCheck token with `personal/jm/verify_devicecheck_token.py` using
  bundle ID `com.openai.codex`. Apple returned `status_code: 200` and
  `is_ok: true`.
  
  Then ran the fuller app + app-server flow. The packaged `Codex.app`
  launched a current-branch app-server via `CODEX_CLI_PATH`, and a local
  MITM proxy intercepted outbound `chatgpt.com` traffic. The app-server
  requested `attestation/generate` from the real Electron app process, and
  the intercepted `/backend-api/codex/responses` traffic included
  `x-oai-attestation` on both routes:
  
  ```text
  GET  /backend-api/codex/responses  Upgrade: websocket  x-oai-attestation: present
  POST /backend-api/codex/responses  Upgrade: none       x-oai-attestation: present
  ```
  
  The captured header decoded to a DeviceCheck token that also validated
  with Apple for `com.openai.codex` (`status_code: 200`, `is_ok: true`,
  team `2DC432GLL2`).
  
  </details>
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Jiaming Zhang · 2026-05-08 12:36:02 -07:00
  5f4d0ec343
• [codex-analytics] plumb protocol-native review timing (#21434)

  ## Why
  
  We want terminal tool review analytics, but the reducer should not stamp
  review timing from its own wall clock.
  
  This PR plumbs review timing through the real protocol and app-server
  seams so downstream analytics can consume the emitter's timestamps
  directly. Guardian reviews keep their enriched `started_at` /
  `completed_at` analytics fields by deriving those legacy second-based
  values from the same protocol-native millisecond lifecycle timestamps,
  rather than sampling a separate analytics clock.
  
  ## What changed
  
  - add `started_at_ms` to user approval request payloads
  - add `started_at_ms` / `completed_at_ms` to guardian review
  notifications
  - preserve Guardian review `started_at` / `completed_at` enrichment from
  the protocol-native timing source
  - stamp typed `ServerResponse` analytics facts with app-server-observed
  `completed_at_ms`
  - thread the new timing fields through core, protocol, app-server, TUI,
  and analytics fixtures
  
  ## Verification
  
  - `cargo test -p codex-app-server outgoing_message --manifest-path
  codex-rs/Cargo.toml`
  - `cargo test -p codex-app-server-protocol guardian --manifest-path
  codex-rs/Cargo.toml`
  - `cargo test -p codex-tui guardian --manifest-path codex-rs/Cargo.toml`
  - `cargo test -p codex-analytics analytics_client_tests --manifest-path
  codex-rs/Cargo.toml`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/21434).
  * #18748
  * __->__ #21434
  * #18747
  * #17090
  * #17089
  * #20514

  rhan-oai · 2026-05-07 20:31:41 -07:00
  99016ec732
• [codex-analytics] emit tool item events from item lifecycle (#17090)

  ## Why
  
  After the tool-item schemas are in place, analytics needs to emit them
  from the app-server item lifecycle rather than requiring bespoke
  tracking at each callsite. The reducer should also reuse the shared
  thread analytics context introduced below it in the stack so later event
  families do not repeat the same reducer joins or missing-state ladder.
  
  ## What changed
  
  - Tracks tool-item completion notifications and emits the matching tool
  analytics event when a terminal item arrives.
  - Derives event-specific payload details for command execution, file
  changes, MCP calls, dynamic tools, collaboration tools, web search, and
  image generation.
  - Denormalizes thread, app-server client, runtime, and subagent
  provenance metadata through the shared thread analytics context.
  - Adds reducer coverage for item lifecycle emission and subagent
  metadata inheritance.
  
  ## Duration semantics
  
  `duration_ms` is computed from the app-server item lifecycle timestamps:
  `completed_at_ms - started_at_ms`. That makes it the duration of the
  lifecycle Codex observed locally, not necessarily the upstream
  provider's full execution time.
  
  - Web search usually has a meaningful observed lifecycle because
  Responses can send `response.output_item.added` before
  `response.output_item.done`; in that case `started_at_ms` comes from the
  added event and `completed_at_ms` comes from the done event.
  - Image generation can be much less precise. In the current observed
  stream, image generation often arrives only as a completed
  `response.output_item.done`; when there is no earlier added event, Codex
  synthesizes the started item immediately before completion, so
  `duration_ms` can be `0` even though upstream image generation took
  longer.
  - Standalone web search and standalone image generation work is expected
  to land after this stack. Those paths may introduce more direct
  lifecycle events or timing points, so the current
  web-search/image-generation duration semantics should be treated as the
  best available item-lifecycle approximation, not the final latency
  contract for those tool families.
  - `execution_duration_ms` is populated only where the completed item
  already carries a native execution duration; otherwise it remains `null`
  while `duration_ms` still reflects the local lifecycle interval.
  
  ## Currently placeholder / partial fields
  
  Some fields are included in the schema for the intended steady-state
  contract, but this PR does not yet populate them from real
  approval/review state:
  
  - `review_count`, `guardian_review_count`, and `user_review_count`
  currently default to `0`.
  - `final_approval_outcome` currently defaults to `unknown`.
  - `requested_additional_permissions` and `requested_network_access`
  currently default to `false`.
  
  ## Verification
  
  - `cargo test -p codex-analytics`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/17090).
  * #18748
  * #18747
  * __->__ #17090
  * #17089
  * #20514

  rhan-oai · 2026-05-06 20:27:41 +00:00
  fbdbc6b2fe
• [codex] Use shared app-server JSON-RPC error helpers (#21221)

  ## Why
  
  App-server had repeated hand-built JSON-RPC error objects for standard
  error shapes. Using the shared helpers keeps the common
  `invalid_request`, `invalid_params`, and `internal_error` construction
  in one place and reduces the chance of new call sites drifting from the
  common error payload shape.
  
  ## What changed
  
  - Replaced manual standard JSON-RPC error object creation with
  `internal_error(...)`, `invalid_request(...)`, and `invalid_params(...)`
  across app-server request processors and runtime paths.
  - Removed local duplicate helper definitions from search and review
  request handling.
  - Preserved existing structured `data` payloads by creating the shared
  helper error first and then attaching the existing metadata.
  - Left custom non-standard errors and raw error-code assertions intact.
  
  ## Validation
  
  - `cargo test -p codex-app-server`

  pakrym-oai · 2026-05-05 12:13:59 -07:00
  b6d4c4ea6b
• app-server: move transport into dedicated crate (#20545)

  ## Why
  
  `codex-app-server` currently owns both request-processing code and
  transport implementation details. Splitting the transport layer into its
  own crate makes that boundary explicit, reduces the amount of
  transport-specific dependency surface carried by `codex-app-server`, and
  gives future transport work a narrower place to evolve.
  
  ## What changed
  
  - Added `codex-app-server-transport` and moved the existing transport
  tree into it, including stdio, unix socket, websocket, remote-control
  transport, and websocket auth.
  - Moved shared transport-facing message types into the new crate so both
  the transport implementation and `codex-app-server` use the same
  definitions.
  - Kept processor-facing connection state and outbound routing in
  `codex-app-server`, with the routing tests moved next to that local
  wrapper.
  - Updated workspace metadata, Bazel crate metadata, and
  `codex-app-server` dependencies for the new crate boundary.
  
  ## Validation
  
  - `cargo metadata --locked --no-deps`
  - `git diff --check`
  - Attempted `cargo test -p codex-app-server-transport`, `cargo test -p
  codex-app-server`, `just fix -p codex-app-server-transport`, and `just
  fix -p codex-app-server`; all were blocked before compilation by the
  existing `packageproxy` resolution failure for locked `rustls-webpki =
  0.103.13`.
  - Attempted Bazel build / lockfile validation; those were blocked by
  external fetch failures against BuildBuddy / GitHub while resolving
  `v8`.

  Ruslan Nigmatullin · 2026-05-01 09:23:47 -07:00
  41e171fcf2
• [app-server] centralize client response analytics (#20059)

  ## Why
  
  The precursor PR keeps successful client responses typed until
  app-server's outgoing response seam. This follow-up uses that seam to
  move successful client-response analytics out of individual handlers and
  into the shared sender path, while keeping filtering decisions inside
  `codex-analytics`.
  
  ## What changed
  
  - Emit successful client-response analytics centrally from
  `OutgoingMessageSender::send_response`.
  - Remove duplicate handler-local response tracking for the current
  thread/turn lifecycle responses.
  - Keep analytics ingestion selective inside `AnalyticsEventsClient`, so
  unrelated client traffic is ignored before cloning or boxing.
  - Collapse client-response analytics facts onto one typed path and
  normalize payloads in the reducer.
  - Add direct client-filter coverage plus sender-level coverage for the
  centralized forwarding path.
  
  ## Verification
  
  - `cargo test -p codex-analytics`
  - `cargo test -p codex-app-server outgoing_message::tests --lib`

  rhan-oai · 2026-04-29 21:22:39 +00:00
  72a39e3a96
• [app-server] type client response payloads (#20050)

  ## Why
  
  `pr17088` adds typed server-originated request/response plumbing, but
  successful client responses are still erased into bare JSON-RPC `result`
  values before app-server can make any typed decision about them.
  
  This precursor PR keeps successful client responses typed until the
  outgoing response seam. It is intentionally limited to
  protocol/app-server plumbing so the analytics behavior change can review
  separately on top.
  
  ## What changed
  
  - Add `ClientResponsePayload` as the pre-serialization client response
  body type.
  - Route app-server successful response paths through the typed payload
  seam while preserving existing handler-local analytics behavior.
  - Keep `InterruptConversation` JSON-RPC-only because it has no
  `ClientResponse` variant.
  - Move the new payload conversion tests into a dedicated protocol test
  module.
  
  ## Verification
  
  - `cargo check -p codex-app-server`
  - `cargo test -p codex-app-server-protocol`

  rhan-oai · 2026-04-29 20:50:47 +00:00
  973c5c823e
• [codex-analytics] ingest server requests and responses (#17088)

  ## Why
  
  Codex analytics needs a typed seam for app-server-originated
  request/response traffic so future tool-approval analytics can consume
  those facts without adding bespoke callsite tracking each time. Server
  responses arrive as JSON-RPC `id + result` payloads, so analytics has to
  reconstruct the matching typed response from the original typed request
  while that request context still exists in app-server.
  
  This also puts analytics on the app-server outbound path, which needs to
  avoid keeping the runtime alive during shutdown. The final ownership fix
  keeps the normal strong auth-manager retention in analytics and makes
  the external-auth refresh bridge hold a weak back-reference to
  `OutgoingMessageSender`, breaking the runtime cycle at the bridge
  boundary instead of exposing retention policy through the analytics
  client API.
  
  ## What changed
  
  - Adds typed `ServerRequest` and `ServerResponse` analytics facts, plus
  `AnalyticsEventsClient::track_server_request` and
  `track_server_response`.
  - Renames the existing client-side facts to `ClientRequest` and
  `ClientResponse` so reducers can distinguish client-to-server traffic
  from server-to-client traffic.
  - Adds `ServerRequest::response_from_result`, allowing a stored typed
  request to decode the matching typed server response from a raw JSON-RPC
  result payload.
  - Threads `AnalyticsEventsClient` through `OutgoingMessageSender` and
  records targeted server requests, replayed targeted requests, and
  matching targeted responses with the responding connection id needed for
  correlation.
  - Intentionally leaves broadcast server requests/responses out of
  analytics for now because the current model is per connection, while
  broadcasts fan one logical request out across multiple connections.
  - Breaks the app-server shutdown cycle by storing
  `Weak<OutgoingMessageSender>` in `ExternalAuthRefreshBridge` and
  upgrading it only when an external-auth refresh is actually requested.
  - Keeps reducer ingestion of the new server-side facts as no-ops for
  now; this PR is plumbing for later tool-approval analytics work.
  
  ## Verification
  
  - `cargo test -p codex-analytics`
  - `cargo test -p codex-app-server outgoing_message::tests::`
  - Covers typed-response reconstruction plus the targeted, replayed,
  broadcast-exclusion, and response-attribution analytics paths.
  
  ## Follow-up
  
  This PR intentionally stops at ingestion plumbing, so `ServerRequest`
  and `ServerResponse` facts are still reducer no-ops. Once a follow-up PR
  adds real downstream analytics output for those facts:
  
  - replace the temporary pre-reducer observation seam with reducer tests
  for the emitted event shape;
  - add end-to-end coverage in `app-server/tests/suite/v2/analytics.rs`
  for the real app-server workflow and captured analytics payload;
  - remove the temporary sender-level observer tests added here in favor
  of the real-output coverage above.
  
  ---
  
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/17088).
  * #18748
  * #18747
  * #17090
  * #17089
  * #20241
  * #20239
  * __->__ #17088

  rhan-oai · 2026-04-29 19:56:41 +00:00
  0690ab0842
• Lift app-server JSON-RPC error handling to request boundary (#19484)

  ## Why
  
  App-server request handling had a lot of repeated JSON-RPC error
  construction and one-off `send_error`/`return` branches. This made small
  handlers noisy and pushed error response details into leaf code that
  otherwise only needed to validate input or call the underlying API.
  
  ## What Changed
  
  - Added shared JSON-RPC error constructors in
  `codex-rs/app-server/src/error_code.rs`.
  - Lifted straightforward request result emission into
  `codex-rs/app-server/src/message_processor.rs` so response/error
  dispatch happens at the request boundary.
  - Reused the result helpers across command exec, config, filesystem,
  device-key, external-agent config, fs-watch, and outgoing-message paths.
  - Removed leaf wrapper handlers where the method body was only
  forwarding to a response helper.
  - Returned request validation errors upward in the simple cases instead
  of sending an error locally and immediately returning.
  
  ## Verification
  
  - `cargo test -p codex-app-server --lib command_exec::tests`
  - `cargo test -p codex-app-server --lib outgoing_message::tests`
  - `cargo test -p codex-app-server --lib in_process::tests`
  - `cargo test -p codex-app-server --test all v2::fs`
  - `cargo test -p codex-app-server --test all v2::config_rpc`
  - `cargo test -p codex-app-server --test all v2::external_agent_config`
  - `cargo test -p codex-app-server --test all v2::initialize`
  - `just fix -p codex-app-server`
  - `git diff --check`
  
  Note: full `cargo test -p codex-app-server` was attempted and stopped in
  `message_processor::tracing_tests::turn_start_jsonrpc_span_parents_core_turn_spans`
  with a stack overflow after unrelated tests had already passed.

  pakrym-oai · 2026-04-26 15:10:35 -07:00
  2a020f1a0a
• Add safety check notification and error handling (#19055)

  Adds a new app-server notification that fires when a user account has
  been flagged for potential safety reasons.

  Eric Traut · 2026-04-22 22:24:12 -07:00
  bbff4ee61a
• feat(auto-review) short-circuit (#18890)

  ## Summary
  Short circuit the convo if auto-review hits too many denials
  
  ## Testing
  - [x] Added unit tests
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-04-22 20:34:15 +00:00
  ed4def8286
• [tool search] support namespaced deferred dynamic tools (#18413)

  Deferred dynamic tools need to round-trip a namespace so a tool returned
  by `tool_search` can be called through the same registry key that core
  uses for dispatch.
  
  This change adds namespace support for dynamic tool specs/calls,
  persists it through app-server thread state, and routes dynamic tool
  calls by full `ToolName` while still sending the app the leaf tool name.
  Deferred dynamic tools must provide a namespace; non-deferred dynamic
  tools may remain top-level.
  
  It also introduces `LoadableToolSpec` as the shared
  function-or-namespace Responses shape used by both `tool_search` output
  and dynamic tool registration, so dynamic tools use the same wrapping
  logic in both paths.
  
  Validation:
  - `cargo test -p codex-tools`
  - `cargo test -p codex-core tool_search`
  
  ---------
  
  Co-authored-by: Sayan Sisodiya <sayan@openai.com>

  pash-openai · 2026-04-21 14:13:08 +08:00
  dc1a8f2190
• [codex] Propagate rate limit reached type (#18227)

  ## Summary
  
  First PR in the split from #17956.
  
  - adds the core/app-server `RateLimitReachedType` shape
  - maps backend `rate_limit_reached_type` into Codex rate-limit snapshots
  - carries the field through app-server notifications/responses and
  generated schemas
  - updates existing constructors/tests for the new optional field
  
  ## Validation
  
  - `cargo test -p codex-backend-client`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-app-server rate_limits`
  - `cargo test -p codex-tui workspace_`
  - `cargo test -p codex-tui status_`
  - `just fmt`
  - `just fix -p codex-backend-client`
  - `just fix -p codex-app-server-protocol`
  - `just fix -p codex-app-server`
  - `just fix -p codex-tui`

  richardopenai · 2026-04-17 13:37:25 -07:00
  139fa8b8f2
• Revert "Option to Notify Workspace Owner When Usage Limit is Reached" (#17391)

  Reverts openai/codex#16969
  
  #sev3-2026-04-10-accountscheckversion-500s-for-openai-workspace-7300

  Shijie Rao · 2026-04-10 23:33:13 +00:00
  930e5adb7e
• Option to Notify Workspace Owner When Usage Limit is Reached (#16969)

  ## Summary
  - Replace the manual `/notify-owner` flow with an inline confirmation
  prompt when a usage-based workspace member hits a credits-depleted
  limit.
  - Fetch the current workspace role from the live ChatGPT
  `accounts/check/v4-2023-04-27` endpoint so owner/member behavior matches
  the desktop and web clients.
  - Keep owner, member, and spend-cap messaging distinct so we only offer
  the owner nudge when the workspace is actually out of credits.
  
  ## What Changed
  - `backend-client`
  - Added a typed fetch for the current account role from
  `accounts/check`.
    - Mapped backend role values into a Rust workspace-role enum.
  - `app-server` and protocol
    - Added `workspaceRole` to `account/read` and `account/updated`.
  - Derived `isWorkspaceOwner` from the live role, with a fallback to the
  cached token claim when the role fetch is unavailable.
  - `tui`
    - Removed the explicit `/notify-owner` slash command.
  - When a member is blocked because the workspace is out of credits, the
  error now prompts:
  - `Your workspace is out of credits. Request more from your workspace
  owner? [y/N]`
    - Choosing `y` sends the existing owner-notification request.
  - Choosing `n`, pressing `Esc`, or accepting the default selection
  dismisses the prompt without sending anything.
  - Selection popups now honor explicit item shortcuts, which is how the
  `y` / `n` interaction is wired.
  
  ## Reviewer Notes
  - The main behavior change is scoped to usage-based workspace members
  whose workspace credits are depleted.
  - Spend-cap reached should not show the owner-notification prompt.
  - Owners and admins should continue to see `/usage` guidance instead of
  the member prompt.
  - The live role fetch is best-effort; if it fails, we fall back to the
  existing token-derived ownership signal.
  
  ## Testing
  - Manual verification
    - Workspace owner does not see the member prompt.
  - Workspace member with depleted credits sees the confirmation prompt
  and can send the nudge with `y`.
  - Workspace member with spend cap reached does not see the
  owner-notification prompt.
  
  ### Workspace member out of usage
  
  https://github.com/user-attachments/assets/341ac396-eff4-4a7f-bf0c-60660becbea1
  
  ### Workspace owner
  <img width="1728" height="1086" alt="Screenshot 2026-04-09 at 11 48
  22 AM"
  src="https://github.com/user-attachments/assets/06262a45-e3fc-4cc4-8326-1cbedad46ed6"
  />

  richardopenai · 2026-04-09 21:15:17 -07:00
  9f2a585153
• chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

  ## Why
  
  `argument-comment-lint` was green in CI even though the repo still had
  many uncommented literal arguments. The main gap was target coverage:
  the repo wrapper did not force Cargo to inspect test-only call sites, so
  examples like the `latest_session_lookup_params(true, ...)` tests in
  `codex-rs/tui_app_server/src/lib.rs` never entered the blocking CI path.
  
  This change cleans up the existing backlog, makes the default repo lint
  path cover all Cargo targets, and starts rolling that stricter CI
  enforcement out on the platform where it is currently validated.
  
  ## What changed
  
  - mechanically fixed existing `argument-comment-lint` violations across
  the `codex-rs` workspace, including tests, examples, and benches
  - updated `tools/argument-comment-lint/run-prebuilt-linter.sh` and
  `tools/argument-comment-lint/run.sh` so non-`--fix` runs default to
  `--all-targets` unless the caller explicitly narrows the target set
  - fixed both wrappers so forwarded cargo arguments after `--` are
  preserved with a single separator
  - documented the new default behavior in
  `tools/argument-comment-lint/README.md`
  - updated `rust-ci` so the macOS lint lane keeps the plain wrapper
  invocation and therefore enforces `--all-targets`, while Linux and
  Windows temporarily pass `-- --lib --bins`
  
  That temporary CI split keeps the stricter all-targets check where it is
  already cleaned up, while leaving room to finish the remaining Linux-
  and Windows-specific target-gated cleanup before enabling
  `--all-targets` on those runners. The Linux and Windows failures on the
  intermediate revision were caused by the wrapper forwarding bug, not by
  additional lint findings in those lanes.
  
  ## Validation
  
  - `bash -n tools/argument-comment-lint/run.sh`
  - `bash -n tools/argument-comment-lint/run-prebuilt-linter.sh`
  - shell-level wrapper forwarding check for `-- --lib --bins`
  - shell-level wrapper forwarding check for `-- --tests`
  - `just argument-comment-lint`
  - `cargo test` in `tools/argument-comment-lint`
  - `cargo test -p codex-terminal-detection`
  
  ## Follow-up
  
  - Clean up remaining Linux-only target-gated callsites, then switch the
  Linux lint lane back to the plain wrapper invocation.
  - Clean up remaining Windows-only target-gated callsites, then switch
  the Windows lint lane back to the plain wrapper invocation.

  Michael Bolin · 2026-03-27 19:00:44 -07:00
  61dfe0b86c
• app-server: Add back pressure and batching to command/exec (#15547)

  * Add
  `OutgoingMessageSender::send_server_notification_to_connection_and_wait`
  which returns only once message is written to websocket (or failed to do
  so)
  * Use this mechanism to apply back pressure to stdout/stderr streams of
  processes spawned by `command/exec`, to limit them to at most one
  message in-memory at a time
  * Use back pressure signal to also batch smaller chunks into ≈64KiB ones
  
  This should make commands execution more robust over
  high-latency/low-throughput networks

  Ruslan Nigmatullin · 2026-03-24 11:35:51 -07:00
  d61c03ca08
• Finish moving codex exec to app-server (#15424)

  This PR completes the conversion of non-interactive `codex exec` to use
  app server rather than directly using core events and methods.
  
  ### Summary
  - move `codex-exec` off exec-owned `AuthManager` and `ThreadManager`
  state
  - route exec bootstrap, resume, and auth refresh through existing
  app-server paths
  - replace legacy `codex/event/*` decoding in exec with typed app-server
  notification handling
  - update human and JSONL exec output adapters to translate existing
  app-server notifications only
  - clean up "app server client" layer by eliminating support for legacy
  notifications; this is no longer needed
  - remove exposure of `authManager` and `threadManager` from "app server
  client" layer
  
  ### Testing
  - `exec` has pretty extensive unit and integration tests already, and
  these all pass
  - In addition, I asked Codex to put together a comprehensive manual set
  of tests to cover all of the `codex exec` functionality (including
  command-line options), and it successfully generated and ran these tests

  Eric Traut · 2026-03-24 08:51:32 -06:00
  45f68843b8
• feat(tracing): tag app-server turn spans with turn_id (#15206)

  So we can find and filter spans by `turn.id`.
  
  We do this for the `turn/start`, `turn/steer`, and `turn/interrupt`
  APIs.

  Owen Lin · 2026-03-19 13:07:19 -07:00
  668330acc1
• Apply argument comment lint across codex-rs (#14652)

  ## Why
  
  Once the repo-local lint exists, `codex-rs` needs to follow the
  checked-in convention and CI needs to keep it from drifting. This commit
  applies the fallback `/*param*/` style consistently across existing
  positional literal call sites without changing those APIs.
  
  The longer-term preference is still to avoid APIs that require comments
  by choosing clearer parameter types and call shapes. This PR is
  intentionally the mechanical follow-through for the places where the
  existing signatures stay in place.
  
  After rebasing onto newer `main`, the rollout also had to cover newly
  introduced `tui_app_server` call sites. That made it clear the first cut
  of the CI job was too expensive for the common path: it was spending
  almost as much time installing `cargo-dylint` and re-testing the lint
  crate as a representative test job spends running product tests. The CI
  update keeps the full workspace enforcement but trims that extra
  overhead from ordinary `codex-rs` PRs.
  
  ## What changed
  
  - keep a dedicated `argument_comment_lint` job in `rust-ci`
  - mechanically annotate remaining opaque positional literals across
  `codex-rs` with exact `/*param*/` comments, including the rebased
  `tui_app_server` call sites that now fall under the lint
  - keep the checked-in style aligned with the lint policy by using
  `/*param*/` and leaving string and char literals uncommented
  - cache `cargo-dylint`, `dylint-link`, and the relevant Cargo
  registry/git metadata in the lint job
  - split changed-path detection so the lint crate's own `cargo test` step
  runs only when `tools/argument-comment-lint/*` or `rust-ci.yml` changes
  - continue to run the repo wrapper over the `codex-rs` workspace, so
  product-code enforcement is unchanged
  
  Most of the code changes in this commit are intentionally mechanical
  comment rewrites or insertions driven by the lint itself.
  
  ## Verification
  
  - `./tools/argument-comment-lint/run.sh --workspace`
  - `cargo test -p codex-tui-app-server -p codex-tui`
  - parsed `.github/workflows/rust-ci.yml` locally with PyYAML
  
  ---
  
  * -> #14652
  * #14651

  Michael Bolin · 2026-03-16 16:48:15 -07:00
  b77fe8fefe
• feat(app-server, core): add more spans (#14479)

  ## Description
  
  This PR expands tracing coverage across app-server thread startup, core
  session initialization, and the Responses transport layer. It also gives
  core dispatch spans stable operation-specific names so traces are easier
  to follow than the old generic `submission_dispatch` spans.
  
  Also use `fmt::Display` for types that we serialize in traces so we send
  strings instead of rust types

  Owen Lin · 2026-03-13 13:16:33 -07:00
  014e19510d
• feat(app-server): propagate traces across tasks and core ops (#14387)

  ## Summary
  
  This PR keeps app-server RPC request trace context alive for the full
  lifetime of the work that request kicks off (e.g. for `thread/start`,
  this is `app-server rpc handler -> tokio background task -> core op
  submissions`). Previously we lose trace lineage once the request handler
  returns or hands work off to background tasks.
  
  This approach is especially relevant for `thread/start` and other RPC
  handlers that run in a non-blocking way. In the near future we'll most
  likely want to make all app-server handlers run in a non-blocking way by
  default, and only queue operations that must operate in order (e.g.
  thread RPCs per thread?), so we want to make sure tracing in app-server
  just generally works.
  
  Depends on https://github.com/openai/codex/pull/14300
  
  **Before**
  <img width="155" height="207" alt="image"
  src="https://github.com/user-attachments/assets/c9487459-36f1-436c-beb7-fafeb40737af"
  />
  
  
  **After**
  <img width="299" height="337" alt="image"
  src="https://github.com/user-attachments/assets/727392b2-d072-4427-9dc4-0502d8652dea"
  />
  
  ## What changed
  
  - Keep request-scoped trace context around until we send the final
  response or error, or the connection closes.
  - Thread that trace context through detached `thread/start` work so
  background startup stays attached to the originating request.
  - Pass request trace context through to downstream core operations,
  including:
    - thread creation
    - resume/fork flows
    - turn submission
    - review
    - interrupt
    - realtime conversation operations
  - Add tracing tests that verify:
    - remote W3C trace context is preserved for `thread/start`
    - remote W3C trace context is preserved for `turn/start`
    - downstream core spans stay under the originating request span
    - request-scoped tracing state is cleaned up correctly
  - Clean up shutdown behavior so detached background tasks and spawned
  threads are drained before process exit.

  Owen Lin · 2026-03-11 20:18:31 -07:00
  5bc82c5b93
• Add in-process app server and wire up exec to use it (#14005)

  This is a subset of PR #13636. See that PR for a full overview of the
  architectural change.
  
  This PR implements the in-process app server and modifies the
  non-interactive "exec" entry point to use the app server.
  
  ---------
  
  Co-authored-by: Felipe Coury <felipe.coury@gmail.com>

  Eric Traut · 2026-03-08 18:43:55 -06:00
  da3689f0ef
• app-server: Emit thread/name/updated event globally (#13674)
  Ruslan Nigmatullin · 2026-03-06 10:25:18 -08:00
  51fcdc760d
• chore(app-server): delete v1 RPC methods and notifications (#13375)

  ## Summary
  This removes the old app-server v1 methods and notifications we no
  longer need, while keeping the small set the main codex app client still
  depends on for now.
  
  The remaining legacy surface is:
  - `initialize`
  - `getConversationSummary`
  - `getAuthStatus`
  - `gitDiffToRemote`
  - `fuzzyFileSearch`
  - `fuzzyFileSearch/sessionStart`
  - `fuzzyFileSearch/sessionUpdate`
  - `fuzzyFileSearch/sessionStop`
  
  And the raw `codex/event/*` notifications emitted from core. These
  notifications will be removed in a followup PR.
  
  ## What changed
  - removed deprecated v1 request variants from the protocol and
  app-server dispatcher
  - removed deprecated typed notifications: `authStatusChange`,
  `loginChatGptComplete`, and `sessionConfigured`
  - updated the app-server test client to use v2 flows instead of deleted
  v1 flows
  - deleted legacy-only app-server test suites and added focused coverage
  for `getConversationSummary`
  - regenerated app-server schema fixtures and updated the MCP interface
  docs to match the remaining compatibility surface
  
  ## Testing
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-app-server`

  Owen Lin · 2026-03-03 13:18:25 -08:00
  167158f93c
• [codex] include plan type in account updates (#13181)

  This change fixes a Codex app account-state sync bug where clients could
  know the user was signed in but still miss the ChatGPT subscription
  tier, which could lead to incorrect upgrade messaging for paid users.
  
  The root cause was that `account/updated` only carried `authMode` while
  plan information was available separately via `account/read` and
  rate-limit snapshots, so this update adds `planType` to
  `account/updated`, populates it consistently across login and refresh
  paths.

  Thibault Sottiaux · 2026-03-01 13:43:37 -08:00
  c9cef6ba9e
• app-server: Replay pending item requests on thread/resume (#12560)

  Replay pending client requests after `thread/resume` and emit resolved
  notifications when those requests clear so approval/input UI state stays
  in sync after reconnects and across subscribed clients.
  
  Affected RPCs:
  - `item/commandExecution/requestApproval`
  - `item/fileChange/requestApproval`
  - `item/tool/requestUserInput`
  
  Motivation:
  - Resumed clients need to see pending approval/input requests that were
  already outstanding before the reconnect.
  - Clients also need an explicit signal when a pending request resolves
  or is cleared so stale UI can be removed on turn start, completion, or
  interruption.
  
  Implementation notes:
  - Use pending client requests from `OutgoingMessageSender` in order to
  replay them after `thread/resume` attaches the connection, using
  original request ids.
  - Emit `serverRequest/resolved` when pending requests are answered
  or cleared by lifecycle cleanup.
  - Update the app-server protocol schema, generated TypeScript bindings,
  and README docs for the replay/resolution flow.
  
  High-level test plan:
  - Added automated coverage for replaying pending command execution and
  file change approval requests on `thread/resume`.
  - Added automated coverage for resolved notifications in command
  approval, file change approval, request_user_input, turn start, and turn
  interrupt flows.
  - Verified schema/docs updates in the relevant protocol and app-server
  tests.
  
  Manual testing:
  - Tested reconnect/resume with multiple connections.
  - Confirmed state stayed in sync between connections.

  Ruslan Nigmatullin · 2026-02-27 12:45:59 -08:00
  69d7a456bb
• feat(app-server): thread/unsubscribe API (#10954)

  Adds a new v2 app-server API for a client to be able to unsubscribe to a
  thread:
  - New RPC method: `thread/unsubscribe`
  - New server notification: `thread/closed`
  
  Today clients can start/resume/archive threads, but there wasn’t a way
  to explicitly unload a live thread from memory without archiving it.
  With `thread/unsubscribe`, a client can indicate it is no longer
  actively working with a live Thread. If this is the only client
  subscribed to that given thread, the thread will be automatically closed
  by app-server, at which point the server will send `thread/closed` and
  `thread/status/changed` with `status: notLoaded` notifications.
  
  This gives clients a way to prevent long-running app-server processes
  from accumulating too many thread (and related) objects in memory.
  
  Closed threads will also be removed from `thread/loaded/list`.

  Owen Lin · 2026-02-25 13:14:30 -08:00
  21f7032dbb
• Add app-server event tracing (#12695)

  To help with debugging

  pakrym-oai · 2026-02-24 14:45:50 -08:00
  5571a022eb
• Feat: add model reroute notification (#12001)

  ### Summary
  Builiding off
  https://github.com/openai/codex/pull/11964/files/5c75aa7b89a70bc2cc410a6fd238749306ec4c5e#diff-058ae8f109a8b84b4b79bbfa45f522c2233b9d9e139696044ae374d50b6196e0,
  we have created a `model/rerouted` notification that captures the event
  so that consumers can render as expected. Keep the `EventMsg::Warning`
  path in core so that this does not affect TUI rendering.
  
  `model/rerouted` is meant to be generic to account for future usage
  including capacity planning etc.

  Shijie Rao · 2026-02-17 11:02:23 -08:00
  48018e9eac
• fix(app-server): surface more helpful errors for json-rpc (#11638)

  Propagate client JSON-RPC errors for app-server request callbacks.
  Previously a number of possible errors were collapsed to `channel
  closed`. Now we should be able to see the underlying client error.
  
  ### Summary
  This change stops masking client JSON-RPC error responses as generic
  callback cancellation in app-server server->client request flows.
  
  Previously, when the client responded with a JSON-RPC error, we removed
  the callback entry but did not send anything to the waiting oneshot
  receiver. Waiters then observed channel closure (for example, auth
  refresh request canceled: channel closed), which hid the actual client
  error.
  
  Now, client JSON-RPC errors are forwarded through the callback channel
  and handled explicitly by request consumers.
  
  ### User-visible behavior
  - External auth refresh now surfaces real client JSON-RPC errors when
  provided.
  - True transport/callback-drop cases still report
  canceled/channel-closed semantics.
  
  ### Example: client JSON-RPC error is now propagated (not masked as
  "canceled")
  
  When app-server asks the client to refresh ChatGPT auth tokens, it sends
  a server->client JSON-RPC request like:
  
  ```json
  {
    "id": 42,
    "method": "account/chatgptAuthTokens/refresh",
    "params": {
      "reason": "unauthorized",
      "previousAccountId": "org-abc"
    }
  }
  ```
  
  If the client cannot refresh and responds with a JSON-RPC error:
  ```
  {
    "id": 42,
    "error": {
      "code": -32000,
      "message": "refresh failed",
      "data": null
    }
  }
  ```
  
  app-server now forwards that error through the callback path and
  surfaces:
  `auth refresh request failed: code=-32000 message=refresh failed`
  
  Previously, this same case could be reported as:
  `auth refresh request canceled: channel closed`

  Owen Lin · 2026-02-13 00:14:55 +00:00
  8d97b5c246
• app-server: thread resume subscriptions (#11474)

  This stack layer makes app-server thread event delivery connection-aware
  so resumed/attached threads only emit notifications and approval prompts
  to subscribed connections.
  
  - Added per-thread subscription tracking in `ThreadState`
  (`subscribed_connections`) and mapped subscription ids to `(thread_id,
  connection_id)`.
  - Updated listener lifecycle so removing a subscription or closing a
  connection only removes that connection from the thread’s subscriber
  set; listener shutdown now happens when the last subscriber is gone.
  - Added `connection_closed(connection_id)` plumbing (`lib.rs` ->
  `message_processor.rs` -> `codex_message_processor.rs`) so disconnect
  cleanup happens immediately.
  - Scoped bespoke event handling outputs through `TargetedOutgoing` to
  send requests/notifications only to subscribed connections.
  - Kept existing threadresume behavior while aligning with the latest
  split-loop transport structure.

  Max Johnson · 2026-02-11 16:21:13 -08:00
  c0ecc2e1e1
• Reapply "Add app-server transport layer with websocket support" (#11370)

  Reapply "Add app-server transport layer with websocket support" with
  additional fixes from https://github.com/openai/codex/pull/11313/changes
  to avoid deadlocking.
  
  This reverts commit 47356ff83c.
  
  ## Summary
  
  To avoid deadlocking when queues are full, we maintain separate tokio
  tasks dedicated to incoming vs outgoing event handling
  - split the app-server main loop into two tasks in
  `run_main_with_transport`
     - inbound handling (`transport_event_rx`)
     - outbound handling (`outgoing_rx` + `thread_created_rx`)
  - separate incoming and outgoing websocket tasks
  
  ## Validation
  
  Integration tests, testing thoroughly e2e in codex app w/ >10 concurrent
  requests
  
  <img width="1365" height="979" alt="Screenshot 2026-02-10 at 2 54 22 PM"
  src="https://github.com/user-attachments/assets/47ca2c13-f322-4e5c-bedd-25859cbdc45f"
  />
  
  ---------
  
  Co-authored-by: jif-oai <jif@openai.com>

  Max Johnson · 2026-02-11 18:13:39 +00:00
  7053aa5457
• feat: support multiple rate limits (#11260)

  Added multi-limit support end-to-end by carrying limit_name in
  rate-limit snapshots and handling multiple buckets instead of only
  codex.
  Extended /usage client parsing to consume additional_rate_limits
  Updated TUI /status and in-memory state to store/render per-limit
  snapshots
  Extended app-server rate-limit read response: kept rate_limits and added
  rate_limits_by_name.
  Adjusted usage-limit error messaging for non-default codex limit buckets

  xl-openai · 2026-02-10 20:09:31 -08:00
  fdd0cd1de9
• feat: opt-out of events in the app-server (#11319)

  Add `optOutNotificationMethods` in the app-server to opt-out events
  based on exact method matching

  jif-oai · 2026-02-10 18:04:52 +00:00
  a364dd8b56
• Revert "Add app-server transport layer with websocket support (#10693)" (#11323)

  Suspected cause of deadlocking bug

  Max Johnson · 2026-02-10 17:37:49 +00:00
  47356ff83c
• Add app-server transport layer with websocket support (#10693)

  - Adds --listen <URL> to codex app-server with two listen modes:
        - stdio:// (default, existing behavior)
        - ws://IP:PORT (new websocket transport)
    - Refactors message routing to be connection-aware:
  - Tracks per-connection session state (initialize/experimental
  capability)
        - Routes responses/errors to the originating connection
  - Broadcasts server notifications/requests to initialized connections
  - Updates initialization semantics to be per connection (not
  process-global), and updates app-server docs accordingly.
  - Adds websocket accept/read/write handling (JSON-RPC per text frame,
  ping/pong handling, connection lifecycle events).
  
  Testing
  
  - Unit tests for transport URL parsing and targeted response/error
  routing.
    - New websocket integration test validating:
        - per-connection initialization requirements
        - no cross-connection response leakage
        - same request IDs on different connections route independently.

  Max Johnson · 2026-02-05 20:56:34 +00:00
  8473096efb
• feat(app-server): support external auth mode (#10012)

  This enables a new use case where `codex app-server` is embedded into a
  parent application that will directly own the user's ChatGPT auth
  lifecycle, which means it owns the user’s auth tokens and refreshes it
  when necessary. The parent application would just want a way to pass in
  the auth tokens for codex to use directly.
  
  The idea is that we are introducing a new "auth mode" currently only
  exposed via app server: **`chatgptAuthTokens`** which consist of the
  `id_token` (stores account metadata) and `access_token` (the bearer
  token used directly for backend API calls). These auth tokens are only
  stored in-memory. This new mode is in addition to the existing `apiKey`
  and `chatgpt` auth modes.
  
  This PR reuses the shape of our existing app-server account APIs as much
  as possible:
  - Update `account/login/start` with a new `chatgptAuthTokens` variant,
  which will allow the client to pass in the tokens and have codex
  app-server use them directly. Upon success, the server emits
  `account/login/completed` and `account/updated` notifications.
  - A new server->client request called
  `account/chatgptAuthTokens/refresh` which the server can use whenever
  the access token previously passed in has expired and it needs a new one
  from the parent application.
  
  I leveraged the core 401 retry loop which typically triggers auth token
  refreshes automatically, but made it pluggable:
  - **chatgpt** mode refreshes internally, as usual.
  - **chatgptAuthTokens** mode calls the client via
  `account/chatgptAuthTokens/refresh`, the client responds with updated
  tokens, codex updates its in-memory auth, then retries. This RPC has a
  10s timeout and handles JSON-RPC errors from the client.
  
  Also some additional things:
  - chatgpt logins are blocked while external auth is active (have to log
  out first. typically clients will pick one OR the other, not support
  both)
  - `account/logout` clears external auth in memory
  - Ensures that if `forced_chatgpt_workspace_id` is set via the user's
  config, we respect it in both:
  - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC
  error back to the client)
  - `account/chatgptAuthTokens/refresh` (fails the turn, and on next
  request app-server will send another `account/chatgptAuthTokens/refresh`
  request to the client).

  Owen Lin · 2026-01-29 23:46:04 +00:00
  81a17bb2c1
• Another round of improvements for config error messages (#9746)

  In a [recent PR](https://github.com/openai/codex/pull/9182), I made some
  improvements to config error messages so errors didn't leave app server
  clients in a dead state. This is a follow-on PR to make these error
  messages more readable and actionable for both TUI and GUI users. For
  example, see #9668 where the user was understandably confused about the
  source of the problem and how to fix it.
  
  The improved error message:
  1. Clearly identifies the config file where the error was found (which
  is more important now that we support layered configs)
  2. Provides a line and column number of the error
  3. Displays the line where the error occurred and underlines it
  
  For example, if my `config.toml` includes the following:
  ```toml
  [features]
  collaboration_modes = "true"
  ```
  
  Here's the current CLI error message:
  ```
  Error loading config.toml: invalid type: string "true", expected a boolean in `features`
  ```
  
  And here's the improved message:
  ```
  Error loading config.toml:
  /Users/etraut/.codex/config.toml:43:23: invalid type: string "true", expected a boolean
     |
  43 | collaboration_modes = "true"
     |                       ^^^^^^
  ```
  
  The bulk of the new logic is contained within a new module
  `config_loader/diagnostics.rs` that is responsible for calculating the
  text range for a given toml path (which is more involved than I would
  have expected).
  
  In addition, this PR adds the file name and text range to the
  `ConfigWarningNotification` app server struct. This allows GUI clients
  to present the user with a better error message and an optional link to
  open the errant config file. This was a suggestion from @.bolinfest when
  he reviewed my previous PR.

  Eric Traut · 2026-01-23 20:11:09 -08:00
  713ae22c04
• Improve handling of config and rules errors for app server clients (#9182)

  When an invalid config.toml key or value is detected, the CLI currently
  just quits. This leaves the VSCE in a dead state.
  
  This PR changes the behavior to not quit and bubble up the config error
  to users to make it actionable. It also surfaces errors related to
  "rules" parsing.
  
  This allows us to surface these errors to users in the VSCE, like this:
  
  <img width="342" height="129" alt="Screenshot 2026-01-13 at 4 29 22 PM"
  src="https://github.com/user-attachments/assets/a79ffbe7-7604-400c-a304-c5165b6eebc4"
  />
  
  <img width="346" height="244" alt="Screenshot 2026-01-13 at 4 45 06 PM"
  src="https://github.com/user-attachments/assets/de874f7c-16a2-4a95-8c6d-15f10482e67b"
  />

  Eric Traut · 2026-01-13 17:57:09 -08:00
  31d9b6f4d2
• fix: taking plan type from usage endpoint instead of thru auth token (#7610)

  pull plan type from the usage endpoint, persist it in session state /
  tui state, and propagate through rate limit snapshots

  zhao-oai · 2025-12-04 23:34:13 -08:00
  b8eab7ce90
• storing credits (#6858)

  Expand the rate-limit cache/TUI: store credit snapshots alongside
  primary and secondary windows, render “Credits” when the backend reports
  they exist (unlimited vs rounded integer balances)

  zhao-oai · 2025-11-19 10:49:35 -08:00
  72af589398
• nit: app server (#6830)
  jif-oai · 2025-11-18 16:34:13 +00:00
  0eb2e6f9ee
• [App-server] Implement v2 for account/login/start and account/login/completed (#6183)

  This PR implements `account/login/start` and `account/login/completed`.
  Instead of having separate endpoints for login with chatgpt and api, we
  have a single enum handling different login methods. For sync auth
  methods like sign in with api key, we still send a `completed`
  notification back to be compatible with the async login flow.

  Celia Chen · 2025-11-05 13:52:50 -08:00
  05f0b4f590