184 Commits

• Fallback to HTTP on UPGRADE_REQUIRED (#10824)

  Allow the server to trigger a connection downgrade in case the protocol
  changes in incompatible ways.

  pakrym-oai · 2026-02-08 05:06:33 +00:00
  6d08298f4e
• Simplify pre-connect (#11040)
  pakrym-oai · 2026-02-07 15:52:03 -08:00
  8fe5066bcc
• Support alternative websocket API (#10861)

  **Test plan**
  
  ```
  cargo build -p codex-cli && RUST_LOG='codex_api::endpoint::responses_websocket=trace,codex_core::client=debug,codex_core::codex=debug' \
    ./target/debug/codex \
      --enable responses_websockets_v2 \
      --profile byok \
      --full-auto
  ```

  Brian Yu · 2026-02-06 14:40:50 -08:00
  1fbf5ed06f
• core: preconnect Responses websocket for first turn (#10698)

  ## Problem
  The first user turn can pay websocket handshake latency even when a
  session has already started. We want to reduce that initial delay while
  preserving turn semantics and avoiding any prompt send during startup.
  
  Reviewer feedback also called out duplicated connect/setup paths and
  unnecessary preconnect state complexity.
  
  ## Mental model
  `ModelClient` owns session-scoped transport state. During session
  startup, it can opportunistically warm one websocket handshake slot. A
  turn-scoped `ModelClientSession` adopts that slot once if available,
  restores captured sticky turn-state, and otherwise opens a websocket
  through the same shared connect path.
  
  If startup preconnect is still in flight, first turn setup awaits that
  task and treats it as the first connection attempt for the turn.
  
  Preconnect is handshake-only. The first `response.create` is still sent
  only when a turn starts.
  
  ## Non-goals
  This change does not make preconnect required for correctness and does
  not change prompt/turn payload semantics. It also does not expand
  fallback behavior beyond clearing preconnect state when fallback
  activates.
  
  ## Tradeoffs
  The implementation prioritizes simpler ownership and shared connection
  code over header-match gating for reuse. The single-slot cache keeps
  lifecycle straightforward but only benefits the immediate next turn.
  
  Awaiting in-flight preconnect has the same app-level connect-timeout
  semantics as existing websocket connect behavior (no new timeout class
  introduced by this PR).
  
  ## Architecture
  `core/src/client.rs`:
  - Added session-level preconnect lifecycle state (`Idle` / `InFlight` /
  `Ready`) carrying one warmed websocket plus optional captured
  turn-state.
  - Added `pre_establish_connection()` startup warmup and `preconnect()`
  handshake-only setup.
  - Deduped auth/provider resolution into `current_client_setup()` and
  websocket handshake wiring into `connect_websocket()` /
  `build_websocket_headers()`.
  - Updated turn websocket path to adopt preconnect first, await in-flight
  preconnect when present, then create a new websocket only when needed.
  - Ensured fallback activation clears warmed preconnect state.
  - Added documentation for lifecycle, ownership, sticky-routing
  invariants, and timeout semantics.
  
  `core/src/codex.rs`:
  - Session startup invokes `model_client.pre_establish_connection(...)`.
  - Turn metadata resolution uses the shared timeout helper.
  
  `core/src/turn_metadata.rs`:
  - Centralized shared timeout helper used by both turn-time metadata
  resolution and startup preconnect metadata building.
  
  `core/tests/common/responses.rs` + websocket test suites:
  - Added deterministic handshake waiting helper (`wait_for_handshakes`)
  with bounded polling.
  - Added startup preconnect and in-flight preconnect reuse coverage.
  - Fallback expectations now assert exactly two websocket attempts in
  covered scenarios (startup preconnect + turn attempt before fallback
  sticks).
  
  ## Observability
  Preconnect remains best-effort and non-fatal. Existing
  websocket/fallback telemetry remains in place, and debug logs now make
  preconnect-await behavior and preconnect failures easier to reason
  about.
  
  ## Tests
  Validated with:
  1. `just fmt`
  2. `cargo test -p codex-core websocket_preconnect -- --nocapture`
  3. `cargo test -p codex-core websocket_fallback -- --nocapture`
  4. `cargo test -p codex-core
  websocket_first_turn_waits_for_inflight_preconnect -- --nocapture`

  Josh McKinney · 2026-02-06 19:08:24 +00:00
  e416e578bb
• Send beta header with websocket connects (#10727)
  pakrym-oai · 2026-02-05 15:05:02 -08:00
  dbe47ea01a
• chore: rm web-search-eligible header (#10660)

  default-enablement of web_search is now client-side, no need to send
  eligibility headers to backend.
  
  Tested locally, headers no longer sent.
  
  will wait for corresponding backend change to deploy before merging

  sayan-oai · 2026-02-05 11:48:34 -08:00
  5fdf6f5efa
• fix(auth): isolate chatgptAuthTokens concept to auth manager and app-server (#10423)

  So that the rest of the codebase (like TUI) don't need to be concerned
  whether ChatGPT auth was handled by Codex itself or passed in via
  app-server's external auth mode.

  Owen Lin · 2026-02-05 10:46:06 -08:00
  3582b74d01
• Session-level model client (#10664)

  Make ModelClient a session-scoped object.
  Move state that is session level onto the client, and make state that is
  per-turn explicit on corresponding methods.
  Stop taking a huge Config object, instead only pass in values that are
  actually needed.
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  pakrym-oai · 2026-02-04 16:58:48 -08:00
  0e8d359da9
• feat: add phase 1 mem client (#10629)

  Adding a client on top of https://github.com/openai/openai/pull/672176

  jif-oai · 2026-02-04 17:59:36 +00:00
  e9335374b9
• Stop client from being state carrier (#10595)

  I'd like to make client session wide. This requires shedding all random
  state it has to carry.

  pakrym-oai · 2026-02-04 09:05:37 -08:00
  7f20357611
• Move metadata calculation out of client (#10589)

  Model client shouldn't be responsible for this.

  pakrym-oai · 2026-02-03 21:59:13 -08:00
  56ebfff1a8
• feat: log webscocket timing into runtime metrics (#10577)
  Anton Panasenko · 2026-02-03 18:04:07 -08:00
  fcaed4cb88
• Add more detail to 401 error (#10508)

  Add the error.message if it exists, the body otherwise. Truncate body to
  1k characters. Print the cf-ray and the requestId.
  
  **Before:**
  <img width="860" height="305" alt="Screenshot 2026-02-03 at 13 15 28"
  src="https://github.com/user-attachments/assets/949d5a4d-2b51-488c-a723-c6deffde0353"
  />
  
  **After:**
  <img width="1523" height="373" alt="Screenshot 2026-02-03 at 13 15 38"
  src="https://github.com/user-attachments/assets/f96a747e-e596-4a7a-aae9-64210d805b26"
  />

  gt-oai · 2026-02-03 14:58:33 +00:00
  944541e936
• chore: nuke chat/completions API (#10157)
  jif-oai · 2026-02-03 11:31:57 +00:00
  d2394a2494
• make codex better at git (#10145)

  adds basic git context to the session prefix so the model can anchor git
  actions and be a bit more version-aware. structured it in a
  multiroot-friendly shape even though we only have one root today

  pash-openai · 2026-02-02 16:57:29 -08:00
  019d89ff86
• Add websocket telemetry metrics and labels (#10316)

  Summary
  - expose websocket telemetry hooks through the responses client so
  request durations and event processing can be reported
  - record websocket request/event metrics and emit runtime telemetry
  events that the history UI now surfaces
  - improve tests to cover websocket telemetry reporting and guard runtime
  summary updates
  
  
  <img width="824" height="79" alt="Screenshot 2026-01-31 at 5 28 12 PM"
  src="https://github.com/user-attachments/assets/ea9a7965-d8b4-4e3c-a984-ef4fdc44c81d"
  />

  Anton Panasenko · 2026-01-31 19:16:44 -08:00
  101d359cd7
• feat: refactor CodexAuth so invalid state cannot be represented (#10208)

  Previously, `CodexAuth` was defined as follows:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L39-L46
  
  But if you looked at its constructors, we had creation for
  `AuthMode::ApiKey` where `storage` was built using a nonsensical path
  (`PathBuf::new()`) and `auth_dot_json` was `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L212-L220
  
  By comparison, when `AuthMode::ChatGPT` was used, `api_key` was always
  `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L665-L671
  
  https://github.com/openai/codex/pull/10012 took things further because
  it introduced a new `ChatgptAuthTokens` variant to `AuthMode`, which is
  important in when invoking `account/login/start` via the app server, but
  most logic _internal_ to the app server should just reason about two
  `AuthMode` variants: `ApiKey` and `ChatGPT`.
  
  This PR tries to clean things up as follows:
  
  - `LoginAccountParams` and `AuthMode` in `codex-rs/app-server-protocol/`
  both continue to have the `ChatgptAuthTokens` variant, though it is used
  exclusively for the on-the-wire messaging.
  - `codex-rs/core/src/auth.rs` now has its own `AuthMode` enum, which
  only has two variants: `ApiKey` and `ChatGPT`.
  - `CodexAuth` has been changed from a struct to an enum. It is a
  disjoint union where each variant (`ApiKey`, `ChatGpt`, and
  `ChatGptAuthTokens`) have only the associated fields that make sense for
  that variant.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10208).
  * #10224
  * __->__ #10208

  Michael Bolin · 2026-01-30 09:33:23 -08:00
  377ab0c77c
• feat(app-server): support external auth mode (#10012)

  This enables a new use case where `codex app-server` is embedded into a
  parent application that will directly own the user's ChatGPT auth
  lifecycle, which means it owns the user’s auth tokens and refreshes it
  when necessary. The parent application would just want a way to pass in
  the auth tokens for codex to use directly.
  
  The idea is that we are introducing a new "auth mode" currently only
  exposed via app server: **`chatgptAuthTokens`** which consist of the
  `id_token` (stores account metadata) and `access_token` (the bearer
  token used directly for backend API calls). These auth tokens are only
  stored in-memory. This new mode is in addition to the existing `apiKey`
  and `chatgpt` auth modes.
  
  This PR reuses the shape of our existing app-server account APIs as much
  as possible:
  - Update `account/login/start` with a new `chatgptAuthTokens` variant,
  which will allow the client to pass in the tokens and have codex
  app-server use them directly. Upon success, the server emits
  `account/login/completed` and `account/updated` notifications.
  - A new server->client request called
  `account/chatgptAuthTokens/refresh` which the server can use whenever
  the access token previously passed in has expired and it needs a new one
  from the parent application.
  
  I leveraged the core 401 retry loop which typically triggers auth token
  refreshes automatically, but made it pluggable:
  - **chatgpt** mode refreshes internally, as usual.
  - **chatgptAuthTokens** mode calls the client via
  `account/chatgptAuthTokens/refresh`, the client responds with updated
  tokens, codex updates its in-memory auth, then retries. This RPC has a
  10s timeout and handles JSON-RPC errors from the client.
  
  Also some additional things:
  - chatgpt logins are blocked while external auth is active (have to log
  out first. typically clients will pick one OR the other, not support
  both)
  - `account/logout` clears external auth in memory
  - Ensures that if `forced_chatgpt_workspace_id` is set via the user's
  config, we respect it in both:
  - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC
  error back to the client)
  - `account/chatgptAuthTokens/refresh` (fails the turn, and on next
  request app-server will send another `account/chatgptAuthTokens/refresh`
  request to the client).

  Owen Lin · 2026-01-29 23:46:04 +00:00
  81a17bb2c1
• Remove WebSocket wire format (#10179)

  I'd like WireApi to go away (when chat is removed) and WebSockets is
  still responses API just over a different transport.

  pakrym-oai · 2026-01-29 13:50:53 -08:00
  fbb3a30953
• Fall back to http when websockets fail (#10139)

  I expect not all proxies work with websockets, fall back to http if
  websockets fail.

  pakrym-oai · 2026-01-29 10:36:21 -08:00
  3b1cddf001
• fix: enable per-turn updates to web search mode (#10040)

  web_search can now be updated per-turn, for things like changes to
  sandbox policy.
  
  `SandboxPolicy::DangerFullAccess` now sets web_search to `live`, and the
  default is still `cached`.
  
  Added integration tests.

  sayan-oai · 2026-01-27 18:09:29 -08:00
  a90ab789c2
• make cached web_search client-side default (#9974)

  [Experiment](https://console.statsig.com/50aWbk2p4R76rNX9lN5VUw/experiments/codex_web_search_rollout/summary)
  for default cached `web_search` completed; cached chosen as default.
  
  Update client to reflect that.

  sayan-oai · 2026-01-26 21:25:40 -08:00
  0adcd8aa86
• Aligned feature stage names with public feature maturity stages (#9929)

  We've recently standardized a [feature maturity
  model](https://developers.openai.com/codex/feature-maturity) that we're
  using in our docs and support forums to communicate expectations to
  users. This PR updates the internal stage names and descriptions to
  match.
  
  This change involves a simple internal rename and updates to a few
  user-visible strings. No functional change.

  Eric Traut · 2026-01-26 11:43:36 -08:00
  b77bf4d36d
• feat: add thread spawn source for collab tools (#9769)
  jif-oai · 2026-01-24 14:21:34 +00:00
  515ac2cd19
• fix(core) Preserve base_instructions in SessionMeta (#9427)

  ## Summary
  This PR consolidates base_instructions onto SessionMeta /
  SessionConfiguration, so we ensure `base_instructions` is set once per
  session and should be (mostly) immutable, unless:
  - overridden by config on resume / fork
  - sub-agent tasks, like review or collab
  
  
  In a future PR, we should convert all references to `base_instructions`
  to consistently used the typed struct, so it's less likely that we put
  other strings there. See #9423. However, this PR is already quite
  complex, so I'm deferring that to a follow-up.
  
  ## Testing
  - [x] Added a resume test to assert that instructions are preserved. In
  particular, `resume_switches_models_preserves_base_instructions` fails
  against main.
  
  Existing test coverage thats assert base instructions are preserved
  across multiple requests in a session:
  - Manual compact keeps baseline instructions:
  core/tests/suite/compact.rs:199
  - Auto-compact keeps baseline instructions:
  core/tests/suite/compact.rs:1142
  - Prompt caching reuses the same instructions across two requests:
  core/tests/suite/prompt_caching.rs:150 and
  core/tests/suite/prompt_caching.rs:157
  - Prompt caching with explicit expected string across two requests:
  core/tests/suite/prompt_caching.rs:213 and
  core/tests/suite/prompt_caching.rs:222
  - Resume with model switch keeps original instructions:
  core/tests/suite/resume.rs:136
  - Compact/resume/fork uses request 0 instructions for later expected
  payloads: core/tests/suite/compact_resume_fork.rs:215

  Dylan Hurd · 2026-01-19 21:59:36 -08:00
  675f165c56
• Turn-state sticky routing per turn (#9332)

  - capture the header from SSE/WS handshakes, store it per
  ModelClientSession using `Oncelock`, echo it on turn-scoped requests,
  and add SSE+WS integration tests for within-turn persistence +
  cross-turn reset.
  
  - keep `x-codex-turn-state` sticky within a user turn to maintain
  routing continuity for retries/tool follow-ups.

  Ahmed Ibrahim · 2026-01-16 09:30:11 -08:00
  ebdd8795e9
• [search] allow explicitly disabling web search (#9249)

  moving `web_search` rollout serverside, so need a way to explicitly
  disable search + signal eligibility from the client.
  
  - Add `x‑oai‑web‑search‑eligible` header that signifies whether the
  request can have web search.
  - Only attach the `web_search` tool when the resolved `WebSearchMode` is
  `Live` or `Cached`.

  sayan-oai · 2026-01-15 11:28:57 -08:00
  169201b1b5
• Websocket append support (#9128)

  Support an incremental append request in websocket transport.

  pakrym-oai · 2026-01-13 06:07:13 +00:00
  e726a82c8a
• Reuse websocket connection (#9127)

  Reuses the connection but still sends full requests.

  pakrym-oai · 2026-01-13 03:30:09 +00:00
  d75626ad99
• Add model client sessions (#9102)

  Maintain a long-running session.

  pakrym-oai · 2026-01-13 01:15:56 +00:00
  490c1c1fdd
• Add URL to responses error messages (#8984)

  Put the URL in error messages, to aid debugging Codex pointing at wrong
  endpoints.
  
  <img width="759" height="164" alt="Screenshot 2026-01-09 at 16 32 49"
  src="https://github.com/user-attachments/assets/77a0622c-955d-426d-86bb-c035210a4ecc"
  />

  gt-oai · 2026-01-10 00:53:47 +00:00
  cc0b5e8504
• Attempt to reload auth as a step in 401 recovery (#8880)

  When authentication fails, first attempt to reload the auth from file
  and then attempt to refresh it.

  pakrym-oai · 2026-01-08 15:06:44 -08:00
  62a73b6d58
• Immutable CodexAuth (#8857)

  Historically we started with a CodexAuth that knew how to refresh it's
  own tokens and then added AuthManager that did a different kind of
  refresh (re-reading from disk).
  
  I don't think it makes sense for both `CodexAuth` and `AuthManager` to
  be mutable and contain behaviors.
  
  Move all refresh logic into `AuthManager` and keep `CodexAuth` as a data
  object.

  pakrym-oai · 2026-01-08 11:43:56 -08:00
  634764ece9
• feat: metrics capabilities (#8318)

  Add metrics capabilities to Codex. The `README.md` is up to date.
  
  This will not be merged with the metrics before this PR of course:
  https://github.com/openai/codex/pull/8350

  jif-oai · 2026-01-08 11:47:36 +00:00
  634650dd25
• Add feature for optional request compression (#8767)

  Adds a new feature
  `enable_request_compression` that will compress using zstd requests to
  the codex-backend. Currently only enabled for codex-backend so only enabled for openai providers when using chatgpt::auth even when the feature is enabled
  
  Added a new info log line too for evaluating the compression ratio and
  overhead off compressing before requesting. You can enable with
  `RUST_LOG=$RUST_LOG,codex_client::transport=info`
  
  ```
  2026-01-06T00:09:48.272113Z  INFO codex_client::transport: Compressed request body with zstd pre_compression_bytes=28914 post_compression_bytes=11485 compression_duration_ms=0
  ```

  Channing Conger · 2026-01-07 13:21:40 -08:00
  21c6d40a44
• Merge Modelfamily into modelinfo (#8763)

  - Merge ModelFamily into ModelInfo
  - Remove logic for adding instructions to apply patch
  - Add compaction limit and visible context window to `ModelInfo`

  Ahmed Ibrahim · 2026-01-07 10:35:09 -08:00
  9179c9deac
• chore: unify conversation with thread name (#8830)

  Done and verified by Codex + refactor feature of RustRover

  jif-oai · 2026-01-07 17:04:53 +00:00
  116059c3a0
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• feat: experimental menu (#8071)

  This will automatically render any `Stage::Beta` features.
  
  The change only gets applied to the *next session*. This started as a
  bug but actually this is a good thing to prevent out of distribution
  push
  
  <img width="986" height="288" alt="Screenshot 2025-12-15 at 15 38 35"
  src="https://github.com/user-attachments/assets/78b7a71d-0e43-4828-a118-91c5237909c7"
  />
  
  
  <img width="509" height="109" alt="Screenshot 2025-12-15 at 17 35 44"
  src="https://github.com/user-attachments/assets/6933de52-9b66-4abf-b58b-a5f26d5747e2"
  />

  jif-oai · 2025-12-17 17:08:03 +00:00
  ac6ba286aa
• [codex] add otel tracing (#7844)
  Anton Panasenko · 2025-12-12 17:07:17 -08:00
  ad7b9d63c3
• fix: omit reasoning summary when ReasoningSummary::None (#7845)

  ```
  {
    "error": {
      "message": "Invalid value: 'none'. Supported values are: 'concise', 'detailed', and 'auto'.",
      "type": "invalid_request_error",
      "param": "reasoning.summary",
      "code": "invalid_value"
    }
  }
  ```

  Anton Panasenko · 2025-12-11 11:59:40 -08:00
  0af7e4a195
• make model optional in config (#7769)

  - Make Config.model optional and centralize default-selection logic in
  ModelsManager, including a default_model helper (with
  codex-auto-balanced when available) so sessions now carry an explicit
  chosen model separate from the base config.
  - Resolve `model` once in `core` and `tui` from config. Then store the
  state of it on other structs.
  - Move refreshing models to be before resolving the default model

  Ahmed Ibrahim · 2025-12-10 11:19:00 -08:00
  cb9a189857
• Remove legacy ModelInfo and merge it with ModelFamily (#7748)

  This is a step towards removing the need to know `model` when
  constructing config. We firstly don't need to know `model_info` and just
  respect if the user has already set it. Next step, we don't need to know
  `model` unless the user explicitly set it in `config.toml`

  Ahmed Ibrahim · 2025-12-08 15:29:37 -08:00
  382f047a10
• remove model_family from `config (#7571)

  - Remove `model_family` from `config`
  - Make sure to still override config elements related to `model_family`
  like supporting reasoning

  Ahmed Ibrahim · 2025-12-04 11:57:58 -08:00
  9b2055586d
• Migrate model family to models manager (#7565)

  This PR moves `ModelsFamily` to `openai_models`. It also propagates
  `ModelsManager` to session services and use it to drive model family. We
  also make `derive_default_model_family` private because it's a step
  towards what we want: one place that gives model configuration.
  
  This is a second step at having one source of truth for models
  information and config: `ModelsManager`.
  
  Next steps would be to remove `ModelsFamily` from config. That's massive
  because it's being used in 41 occasions mostly pre launching `codex`.
  Also, we need to make `find_family_for_model` private. It's also big
  because it's being used in 21 occasions ~ all tests.

  Ahmed Ibrahim · 2025-12-03 18:49:47 -08:00
  cee37a32b2
• Migrate model preset (#7542)

  - Introduce `openai_models` in `/core`
  - Move `PRESETS` under it
  - Move `ModelPreset`, `ModelUpgrade`, `ReasoningEffortPreset`,
  `ReasoningEffortPreset`, and `ReasoningEffortPreset` to `protocol`
  - Introduce `Op::ListModels` and `EventMsg::AvailableModels`
  
  Next steps:
  - migrate `app-server` and `tui` to use the introduced Operation

  Ahmed Ibrahim · 2025-12-03 20:30:43 +00:00
  71504325d3
• chore: proper client extraction (#6996)
  jif-oai · 2025-11-25 18:06:12 +00:00
  4502b1b263
• Revert "fix: read max_output_tokens param from config" (#7088)

  Reverts openai/codex#4139

  jif-oai · 2025-11-21 11:40:02 +01:00
  bce030ddb5
• fix: read max_output_tokens param from config (#4139)

  Request param `max_output_tokens` is documented in
  `https://github.com/openai/codex/blob/main/docs/config.md`,
  but nowhere uses the item in config, this commit read it from config for
  GPT responses API.
  
  see https://github.com/openai/codex/issues/4138 for issue report.
  
  Signed-off-by: Yorling <shallowcloud@yeah.net>

  Yorling · 2025-11-20 22:46:34 -08:00
  c9e149fd5c
• storing credits (#6858)

  Expand the rate-limit cache/TUI: store credit snapshots alongside
  primary and secondary windows, render “Credits” when the backend reports
  they exist (unlimited vs rounded integer balances)

  zhao-oai · 2025-11-19 10:49:35 -08:00
  72af589398