629 Commits

• tui_app_server: cancel active login before Ctrl+C exit (#15673)

  ## Summary
  
  Fixes slow `Ctrl+C` exit from the ChatGPT browser-login screen in
  `tui_app_server`.
  
  ## Root cause
  
  Onboarding-level `Ctrl+C` quit bypassed the auth widget's cancel path.
  That let the active ChatGPT login keep running, and in-process
  app-server shutdown then waited on the stale login attempt before
  finishing.
  
  ## Changes
  
  - Extract a shared `cancel_active_attempt()` path in the auth widget
  - Use that path from onboarding-level `Ctrl+C` before exiting the TUI
  - Add focused tests for canceling browser-login and device-code attempts
  - Add app-server shutdown cleanup that explicitly drops any active login
  before draining background work

  Eric Traut · 2026-03-24 15:11:43 -06:00
  c023e9d959
• Move git utilities into a dedicated crate (#15564)

  - create `codex-git-utils` and move the shared git helpers into it with
  file moves preserved for diff readability
  - move the `GitInfo` helpers out of `core` so stacked rollout work can
  depend on the shared crate without carrying its own git info module
  
  ---------
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-24 13:26:23 -07:00
  0f957a93cd
• fix: keep zsh-fork release assets after removing shell-tool-mcp (#15644)

  ## Why
  
  `shell-tool-mcp` and the Bash fork are no longer needed, but the patched
  zsh fork is still relevant for shell escalation and for the
  DotSlash-backed zsh-fork integration tests.
  
  Deleting the old `shell-tool-mcp` workflow also deleted the only
  pipeline that rebuilt those patched zsh binaries. This keeps the package
  removal, while preserving a small release path that can be reused
  whenever `codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch`
  changes.
  
  ## What changed
  
  - removed the `shell-tool-mcp` workspace package, its npm
  packaging/release jobs, the Bash test fixture, and the remaining
  Bash-specific compatibility wiring
  - deleted the old `.github/workflows/shell-tool-mcp.yml` and
  `.github/workflows/shell-tool-mcp-ci.yml` workflows now that their
  responsibilities have been replaced or removed
  - kept the zsh patch under
  `codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch` and updated
  the `codex-rs/shell-escalation` docs/code to describe the zsh-based flow
  directly
  - added `.github/workflows/rust-release-zsh.yml` to build only the three
  zsh binaries that `codex-rs/app-server/tests/suite/zsh` needs today:
    - `aarch64-apple-darwin` on `macos-15`
    - `x86_64-unknown-linux-musl` on `ubuntu-24.04`
    - `aarch64-unknown-linux-musl` on `ubuntu-24.04`
  - extracted the shared zsh build/smoke-test/stage logic into
  `.github/scripts/build-zsh-release-artifact.sh`, made that helper
  directly executable, and now invoke it directly from the workflow so the
  Linux and macOS jobs only keep the OS-specific setup in YAML
  - wired those standalone `codex-zsh-*.tar.gz` assets into
  `rust-release.yml` and added `.github/dotslash-zsh-config.json` so
  releases also publish a `codex-zsh` DotSlash file
  - updated the checked-in `codex-rs/app-server/tests/suite/zsh` fixture
  comments to explain that new releases come from the standalone zsh
  assets, while the checked-in fixture remains pinned to the latest
  historical release until a newer zsh artifact is published
  - tightened a couple of follow-on cleanups in
  `codex-rs/shell-escalation`: the `ExecParams::command` comment now
  describes the shell `-c`/`-lc` string more clearly, and the README now
  points at the same `git.code.sf.net` zsh source URL that the workflow
  uses
  
  ## Testing
  
  - `cargo test -p codex-shell-escalation`
  - `just argument-comment-lint`
  - `bash -n .github/scripts/build-zsh-release-artifact.sh`
  - attempted `cargo test -p codex-core`; unrelated existing failures
  remain, but the touched `tools::runtimes::shell::unix_escalation::*`
  coverage passed during that run

  Michael Bolin · 2026-03-24 12:56:26 -07:00
  e89e5136bd
• chore: stop app-server auth refresh storms after permanent token failure (#15530)

  built from #14256. PR description from @etraut-openai:
  
  This PR addresses a hole in [PR
  11802](https://github.com/openai/codex/pull/11802). The previous PR
  assumed that app server clients would respond to token refresh failures
  by presenting the user with an error ("you must log in again") and then
  not making further attempts to call network endpoints using the expired
  token. While they do present the user with this error, they don't
  prevent further attempts to call network endpoints and can repeatedly
  call `getAuthStatus(refreshToken=true)` resulting in many failed calls
  to the token refresh endpoint.
  
  There are three solutions I considered here:
  1. Change the getAuthStatus app server call to return a null auth if the
  caller specified "refreshToken" on input and the refresh attempt fails.
  This will cause clients to immediately log out the user and return them
  to the log in screen. This is a really bad user experience. It's also a
  breaking change in the app server contract that could break third-party
  clients.
  2. Augment the getAuthStatus app server call to return an additional
  field that indicates the state of "token could not be refreshed". This
  is a non-breaking change to the app server API, but it requires
  non-trivial changes for all clients to properly handle this new field
  properly.
  3. Change the getAuthStatus implementation to handle the case where a
  token refresh fails by marking the AuthManager's in-memory access and
  refresh tokens as "poisoned" so it they are no longer used. This is the
  simplest fix that requires no client changes.
  
  I chose option 3.
  
  Here's Codex's explanation of this change:
  
  When an app-server client asks `getAuthStatus(refreshToken=true)`, we
  may try to refresh a stale ChatGPT access token. If that refresh fails
  permanently (for example `refresh_token_reused`, expired, or revoked),
  the old behavior was bad in two ways:
  
  1. We kept the in-memory auth snapshot alive as if it were still usable.
  2. Later auth checks could retry refresh again and again, creating a
  storm of doomed `/oauth/token` requests and repeatedly surfacing the
  same failure.
  
  This is especially painful for app-server clients because they poll auth
  status and can keep driving the refresh path without any real chance of
  recovery.
  
  This change makes permanent refresh failures terminal for the current
  managed auth snapshot without changing the app-server API contract.
  
  What changed:
  - `AuthManager` now poisons the current managed auth snapshot in memory
  after a permanent refresh failure, keyed to the unchanged `AuthDotJson`.
  - Once poisoned, later refresh attempts for that same snapshot fail fast
  locally without calling the auth service again.
  - The poison is cleared automatically when auth materially changes, such
  as a new login, logout, or reload of different auth state from storage.
  - `getAuthStatus(includeToken=true)` now omits `authToken` after a
  permanent refresh failure instead of handing out the stale cached bearer
  token.
  
  This keeps the current auth method visible to clients, avoids forcing an
  immediate logout flow, and stops repeated refresh attempts for
  credentials that cannot recover.
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Celia Chen · 2026-03-24 12:39:58 -07:00
  88694e8417
• feat: include marketplace loading error in plugin/list (#15438)

  Include error.

  xl-openai · 2026-03-24 11:47:23 -07:00
  621862a7d1
• app-server: Add back pressure and batching to command/exec (#15547)

  * Add
  `OutgoingMessageSender::send_server_notification_to_connection_and_wait`
  which returns only once message is written to websocket (or failed to do
  so)
  * Use this mechanism to apply back pressure to stdout/stderr streams of
  processes spawned by `command/exec`, to limit them to at most one
  message in-memory at a time
  * Use back pressure signal to also batch smaller chunks into ≈64KiB ones
  
  This should make commands execution more robust over
  high-latency/low-throughput networks

  Ruslan Nigmatullin · 2026-03-24 11:35:51 -07:00
  d61c03ca08
• Extract sandbox manager and transforms into codex-sandboxing (#15603)

  Extract sandbox manager

  pakrym-oai · 2026-03-24 08:20:57 -07:00
  f49eb8e9d7
• Finish moving codex exec to app-server (#15424)

  This PR completes the conversion of non-interactive `codex exec` to use
  app server rather than directly using core events and methods.
  
  ### Summary
  - move `codex-exec` off exec-owned `AuthManager` and `ThreadManager`
  state
  - route exec bootstrap, resume, and auth refresh through existing
  app-server paths
  - replace legacy `codex/event/*` decoding in exec with typed app-server
  notification handling
  - update human and JSONL exec output adapters to translate existing
  app-server notifications only
  - clean up "app server client" layer by eliminating support for legacy
  notifications; this is no longer needed
  - remove exposure of `authManager` and `threadManager` from "app server
  client" layer
  
  ### Testing
  - `exec` has pretty extensive unit and integration tests already, and
  these all pass
  - In addition, I asked Codex to put together a comprehensive manual set
  of tests to cover all of the `codex exec` functionality (including
  command-line options), and it successfully generated and ran these tests

  Eric Traut · 2026-03-24 08:51:32 -06:00
  45f68843b8
• Stabilize macOS CI test timeouts (#15581)

  ## Summary
  - raise the shell snapshot apply_patch helper timeout to avoid macOS CI
  startup races
  - increase the shared MCP app-server test read timeout so slow
  initialize handshakes do not fail command_exec tests spuriously
  
  ## Testing
  - cargo test -p codex-core
  shell_command_snapshot_still_intercepts_apply_patch
  - cargo test -p codex-app-server
  command_exec_tty_implies_streaming_and_reports_pty_output
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-03-24 09:33:20 +00:00
  79577355c1
• Move sandbox policy transforms into codex-sandboxing (#15599)

  ## Summary
  - move the pure sandbox policy transform helpers from `codex-core` into
  `codex-sandboxing`
  - move the corresponding unit tests with the extracted implementation
  - update `core` and `app-server` callers to import the moved APIs
  directly, without re-exports or proxy methods
  
  ## Testing
  - cargo test -p codex-sandboxing
  - cargo test -p codex-core sandboxing
  - cargo test -p codex-app-server --lib
  - just fix -p codex-sandboxing
  - just fix -p codex-core
  - just fix -p codex-app-server
  - just fmt
  - just argument-comment-lint

  pakrym-oai · 2026-03-23 22:22:44 -07:00
  9deb8ce3fc
• [codex-cli][app-server] Update self-serve business usage limit copy in error returned (#15478)

  ## Summary
  - update the self-serve business usage-based limit message to direct
  users to their admin for additional credits
  - add a focused unit test for the self_serve_business_usage_based plan
  branch
  
  Added also: 
  
  If you are at a rate limit but you still have credits, codex cli would
  tell you to switch the model. We shouldnt do this if you have credits so
  fixed this.
  
  ## Test
  - launched the source-built CLI and verified the updated message is
  shown for the self-serve business usage-based plan
  
  ![Test
  screenshot](https://raw.githubusercontent.com/openai/codex/5cc3c013ef17ac5c66dfd9395c0d3c4837602231/docs/images/self-serve-business-usage-limit.png)

  dhruvgupta-oai · 2026-03-24 04:41:38 +00:00
  c2410060ea
• Add fork snapshot modes (#15239)

  ## Summary
  - add `ForkSnapshotMode` to `ThreadManager::fork_thread` so callers can
  request either a committed snapshot or an interrupted snapshot
  - share the model-visible `<turn_aborted>` history marker between the
  live interrupt path and interrupted forks
  - update the small set of direct fork callsites to pass
  `ForkSnapshotMode::Committed`
  
  Note: this enables /btw to work similarly as Esc to interrupt (hopefully
  somewhat in distribution)
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-23 19:05:42 -07:00
  f547b79bd0
• feat: support disable skills by name. (#15378)

  Support disabling skills by name, primarily for plugin skills. We can’t
  use the path, since plugin skill paths may change across versions.

  xl-openai · 2026-03-23 12:57:40 -07:00
  9a33e5c0a0
• tui: queue follow-ups during manual /compact (#15259)

  ## Summary
  - queue input after the user submits `/compact` until that manual
  compact turn ends
  - mirror the same behavior in the app-server TUI
  - add regressions for input queued before compact starts and while it is
  running
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-23 10:19:44 -07:00
  e838645fa2
• fix: fall back to vendored bubblewrap when system bwrap lacks --argv0 (#15338)

  ## Why
  
  Fixes [#15283](https://github.com/openai/codex/issues/15283), where
  sandboxed tool calls fail on older distro `bubblewrap` builds because
  `/usr/bin/bwrap` does not understand `--argv0`. The upstream [bubblewrap
  v0.9.0 release
  notes](https://github.com/containers/bubblewrap/releases/tag/v0.9.0)
  explicitly call out `Add --argv0`. Flipping `use_legacy_landlock`
  globally works around that compatibility bug, but it also weakens the
  default Linux sandbox and breaks proxy-routed and split-policy cases
  called out in review.
  
  The follow-up Linux CI failure was in the new launcher test rather than
  the launcher logic: the fake `bwrap` helper stayed open for writing, so
  Linux would not exec it. This update also closes the user-visibility gap
  from review by surfacing the same startup warning when `/usr/bin/bwrap`
  is present but too old for `--argv0`, not only when it is missing.
  
  ## What Changed
  
  - keep `use_legacy_landlock` default-disabled
  - teach `codex-rs/linux-sandbox/src/launcher.rs` to fall back to the
  vendored bubblewrap build when `/usr/bin/bwrap` does not advertise
  `--argv0` support
  - add launcher tests for supported, unsupported, and missing system
  `bwrap`
  - write the fake `bwrap` test helper to a closed temp path so the
  supported-path launcher test works on Linux too
  - extend the startup warning path so Codex warns when `/usr/bin/bwrap`
  is missing or too old to support `--argv0`
  - mirror the warning/fallback wording across
  `codex-rs/linux-sandbox/README.md` and `codex-rs/core/README.md`,
  including that the fallback is the vendored bubblewrap compiled into the
  binary
  - cite the upstream `bubblewrap` release that introduced `--argv0`
  
  ## Verification
  
  - `bazel test --config=remote --platforms=//:rbe
  //codex-rs/linux-sandbox:linux-sandbox-unit-tests
  --test_filter=launcher::tests::prefers_system_bwrap_when_help_lists_argv0
  --test_output=errors`
  - `cargo test -p codex-core system_bwrap_warning`
  - `cargo check -p codex-exec -p codex-tui -p codex-tui-app-server -p
  codex-app-server`
  - `just argument-comment-lint`

  Michael Bolin · 2026-03-23 09:46:51 -07:00
  d1088158b8
• Pass platform param to featured plugins (#15348)
  alexsong-oai · 2026-03-21 01:42:40 +00:00
  ec32866c37
• Add realtime transcript notification in v2 (#15344)

  - emit a typed `thread/realtime/transcriptUpdated` notification from
  live realtime transcript deltas
  - expose that notification as flat `threadId`, `role`, and `text` fields
  instead of a nested transcript array
  - continue forwarding raw `handoff_request` items on
  `thread/realtime/itemAdded`, including the accumulated
  `active_transcript`
  - update app-server docs, tests, and generated protocol schema artifacts
  to match the delta-based payloads
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-20 15:30:48 -07:00
  3431f01776
• feat: change multi-agent to use path-like system instead of uuids (#15313)

  This PR add an URI-based system to reference agents within a tree. This
  comes from a sync between research and engineering.
  
  The main agent (the one manually spawned by a user) is always called
  `/root`. Any sub-agent spawned by it will be `/root/agent_1` for example
  where `agent_1` is chosen by the model.
  
  Any agent can contact any agents using the path.
  
  Paths can be used either in absolute or relative to the calling agents
  
  Resume is not supported for now on this new path

  jif-oai · 2026-03-20 18:23:48 +00:00
  79ad7b247b
• Add temporary app-server originator fallback for codex-tui (#15218)

  ## Summary
  - make app-server treat `clientInfo.name == "codex-tui"` as a legacy
  compatibility case
  - fall back to `DEFAULT_ORIGINATOR` instead of sending `codex-tui` as
  the originator header
  - add a TODO noting this is a temporary workaround that should be
  removed later
  
  ## Testing
  - Not run (not requested)

  Eric Traut · 2026-03-20 10:51:21 -06:00
  4f28b64abc
• feat: Add One-Time Startup Remote Plugin Sync (#15264)

  For early users who have already enabled apps, we should enable plugins
  as part of the initial setup.

  xl-openai · 2026-03-20 05:01:39 +00:00
  b1570d6c23
• Split features into codex-features crate (#15253)

  - Split the feature system into a new `codex-features` crate.
  - Cut `codex-core` and workspace consumers over to the new config and
  warning APIs.
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 20:12:07 -07:00
  2e22885e79
• core: add a full-buffer exec capture policy (#15254)
  Michael Bolin · 2026-03-20 02:38:12 +00:00
  a3e59e9e85
• [plugins] Install MCPs when calling plugin/install (#15195)

  - [x] Auth MCPs when installing plugins.

  Matthew Zeng · 2026-03-19 19:36:58 -07:00
  0a344e4fab
• Move auth code into login crate (#15150)

  - Move the auth implementation and token data into codex-login.
  - Keep codex-core re-exporting that surface from codex-login for
  existing callers.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 18:58:17 -07:00
  2aa4873802
• Refactor ExecServer filesystem split between local and remote (#15232)

  For each feature we have:
  1. Trait exposed on environment
  2. **Local Implementation** of the trait
  3. Remote implementation that uses the client to proxy via network
  4. Handler implementation that handles PRC requests and calls into
  **Local Implementation**

  pakrym-oai · 2026-03-19 17:08:04 -07:00
  403b397e4e
• feat(app-server): add mcpServer/startupStatus/updated notification (#15220)

  Exposes the legacy `codex/event/mcp_startup_update` event as an API v2
  notification.
  
  The legacy event has this shape:
  ```
  #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
  pub struct McpStartupUpdateEvent {
      /// Server name being started.
      pub server: String,
      /// Current startup status.
      pub status: McpStartupStatus,
  }
  
  #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
  #[serde(rename_all = "snake_case", tag = "state")]
  #[ts(rename_all = "snake_case", tag = "state")]
  pub enum McpStartupStatus {
      Starting,
      Ready,
      Failed { error: String },
      Cancelled,
  }
  ```

  Owen Lin · 2026-03-19 15:09:59 -07:00
  9e695fe830
• feat: expose needs_auth for plugin/read. (#15217)

  So UI can render it properly.

  xl-openai · 2026-03-19 15:02:45 -07:00
  2254ec4f30
• feat(tracing): tag app-server turn spans with turn_id (#15206)

  So we can find and filter spans by `turn.id`.
  
  We do this for the `turn/start`, `turn/steer`, and `turn/interrupt`
  APIs.

  Owen Lin · 2026-03-19 13:07:19 -07:00
  668330acc1
• Add experimental exec server URL handling (#15196)

  Add a config and attempt to start the server.

  pakrym-oai · 2026-03-19 18:25:11 +00:00
  1837038f4e
• [hooks] use a user message > developer message for prompt continuation (#14867)

  ## Summary
  
  Persist Stop-hook continuation prompts as `user` messages instead of
  hidden `developer` messages + some requested integration tests
  
  This is a followup to @pakrym 's comment in
  https://github.com/openai/codex/pull/14532 to make sure stop-block
  continuation prompts match training for turn loops
  
  - Stop continuation now writes `<hook_prompt hook_run_id="...">stop
  hook's user prompt<hook_prompt>`
  - Introduces quick-xml dependency, though we already indirectly depended
  on it anyway via syntect
  - This PR only has about 500 lines of actual logic changes, the rest is
  tests/schema
  
  ## Testing
  
  Example run (with a sessionstart hook and 3 stop hooks) - this shows
  context added by session start, then two stop hooks sending their own
  additional prompts in a new turn. The model responds with a single
  message addressing both. Then when that turn ends, the hooks detect that
  they just ran using `stop_hook_active` and decide not to infinite loop
  
  test files for this (unzip, move codex -> .codex):
  [codex.zip](https://github.com/user-attachments/files/26075806/codex.zip)
  
  ```
  › cats
  
  
  • Running SessionStart hook: lighting the observatory
  
  SessionStart hook (completed)
    warning: Hi, I'm a session start hook for wizard-tower (startup).
    hook context: A wimboltine stonpet is an exotic cuisine from hyperspace
  
  • Cats are tiny zen wizards, my friend: equal parts nap, mystery, and chaos. If you want, we can talk
    cat facts, cat breeds, cat names, or build something cat-themed in this repo.
  
  • Running Stop hook: checking the tower wards
  
  • Running Stop hook: sacking the guards
  
  • Running Stop hook: hiring the guards
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook reviewed the completed reply (177 chars).
  
  Stop hook (blocked)
    warning: Wizard Tower Stop hook continuing conversation
    feedback: cook the stonpet
  
  Stop hook (blocked)
    warning: Wizard Tower Stop hook continuing conversation
    feedback: eat the cooked stonpet
  
  • Stonpet’s cooked, aloha style: flash-seared over a blue quasiflame, glazed with nebula salt, and
    rested until the hyperspace juices settle.
  
    Now we eat with gratitude, my friend. One mindful bite in, and the flavor is pure cosmic surf:
    smoky, bright, and totally out of this dimension.
  
  • Running Stop hook: checking the tower wards
  
  • Running Stop hook: sacking the guards
  
  • Running Stop hook: hiring the guards
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook reviewed the completed reply (285 chars).
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook saw a second pass and stayed calm to avoid a loop.
  
  Stop hook (completed)
    warning: Wizard Tower Stop hook saw a second pass and stayed calm to avoid a loop.
  ```

  Andrei Eternal · 2026-03-19 10:53:08 -07:00
  267499bed8
• Move environment abstraction into exec server (#15125)

  The idea is that codex-exec exposes an Environment struct with services
  on it. Each of those is a trait.
  
  Depending on construction parameters passed to Environment they are
  either backed by local or remote server but core doesn't see these
  differences.

  pakrym-oai · 2026-03-19 08:31:14 -07:00
  dee03da508
• feat: support product-scoped plugins. (#15041)

  1. Added SessionSource::Custom(String) and --session-source.
    2. Enforced plugin and skill products by session_source.
    3. Applied the same filtering to curated background refresh.

  xl-openai · 2026-03-19 00:46:15 -07:00
  db5781a088
• Add thread/shellCommand to app server API surface (#14988)

  This PR adds a new `thread/shellCommand` app server API so clients can
  implement `!` shell commands. These commands are executed within the
  sandbox, and the command text and output are visible to the model.
  
  The internal implementation mirrors the current TUI `!` behavior.
  - persist shell command execution as `CommandExecution` thread items,
  including source and formatted output metadata
  - bridge live and replayed app-server command execution events back into
  the existing `tui_app_server` exec rendering path
  
  This PR also wires `tui_app_server` to submit `!` commands through the
  new API.

  Eric Traut · 2026-03-18 23:42:40 -06:00
  01df50cf42
• Simple directory mentions (#14970)

  - Adds simple support for directory mentions in the TUI.
  - Codex App/VS Code will require minor change to recognize a directory
  mention as such and change the link behavior.
  - Directory mentions have a trailing slash to differentiate from
  extensionless files
  
  
  <img width="972" height="382" alt="image"
  src="https://github.com/user-attachments/assets/8035b1eb-0978-465b-8d7a-4db2e5feca39"
  />
  <img width="978" height="228" alt="image"
  src="https://github.com/user-attachments/assets/af22cf0b-dd10-4440-9bee-a09915f6ba52"
  />

  canvrno-oai · 2026-03-19 05:24:09 +00:00
  10eb3ec7fc
• Support featured plugins (#15042)
  alexsong-oai · 2026-03-18 17:45:30 -07:00
  825d09373d
• fix: harden plugin feature gating (#15104)

  Resubmit https://github.com/openai/codex/pull/15020 with correct
  content.
  
  1. Use requirement-resolved config.features as the plugin gate.
  2. Guard plugin/list, plugin/read, and related flows behind that gate.
  3. Skip bad marketplace.json files instead of failing the whole list.
  4. Simplify plugin state and caching.

  xl-openai · 2026-03-19 00:03:37 +00:00
  dcd5e08269
• Feat: reuse persisted model and reasoning effort on thread resume (#14888)

  ## Summary
  
  This PR makes `thread/resume` reuse persisted thread model metadata when
  the caller does not explicitly override it.
  
  Changes:
  - read persisted thread metadata from SQLite during `thread/resume`
  - reuse persisted `model` and `model_reasoning_effort` as resume-time
  defaults
  - fetch persisted metadata once and reuse it later in the resume
  response path
  - keep thread summary loading on the existing rollout path, while
  reusing persisted metadata when available
  - document the resume fallback behavior in the app-server README
  
  ## Why
  
  Before this change, resuming a thread without explicit overrides derived
  `model` and `model_reasoning_effort` from current config, which could
  drift from the thread’s last persisted values. That meant a resumed
  thread could report and run with different model settings than the ones
  it previously used.
  
  ## Behavior
  
  Precedence on `thread/resume` is now:
  1. explicit resume overrides
  2. persisted SQLite metadata for the thread
  3. normal config resolution for the resumed cwd

  Shijie Rao · 2026-03-18 15:45:17 -07:00
  bb30432421
• Revert "fix: harden plugin feature gating" (#15102)

  Reverts openai/codex#15020
  
  I messed up the commit in my PR and accidentally merged changes that
  were still under review.

  xl-openai · 2026-03-18 15:19:29 -07:00
  86982ca1f9
• fix: harden plugin feature gating (#15020)

  1. Use requirement-resolved config.features as the plugin gate.
  2. Guard plugin/list, plugin/read, and related flows behind that gate.
  3. Skip bad marketplace.json files instead of failing the whole list.
  4. Simplify plugin state and caching.

  xl-openai · 2026-03-18 10:11:43 -07:00
  580f32ad2a
• feat: add memory citation to agent message (#14821)

  Client side to come

  jif-oai · 2026-03-18 10:03:38 +00:00
  a265d6043e
• Use workspace requirements for guardian prompt override (#14727)

  ## Summary
  - move `guardian_developer_instructions` from managed config into
  workspace-managed `requirements.toml`
  - have guardian continue using the override when present and otherwise
  fall back to the bundled local guardian prompt
  - keep the generalized prompt-quality improvements in the shared
  guardian default prompt
  - update requirements parsing, layering, schema, and tests for the new
  source of truth
  
  ## Context
  This replaces the earlier managed-config / MDM rollout plan.
  
  The intended rollout path is workspace-managed requirements, including
  cloud enterprise policies, rather than backend model metadata, Statsig,
  or Jamf-managed config. That keeps the default/fallback behavior local
  to `codex-rs` while allowing faster policy updates through the
  enterprise requirements plane.
  
  This is intentionally an admin-managed policy input, not a user
  preference: the guardian prompt should come either from the bundled
  `codex-rs` default or from enterprise-managed `requirements.toml`, and
  normal user/project/session config should not override it.
  
  ## Updating The OpenAI Prompt
  After this lands, the OpenAI-specific guardian prompt should be updated
  through the workspace Policies UI at `/codex/settings/policies` rather
  than through Jamf or codex-backend model metadata.
  
  Operationally:
  - open the workspace Policies editor as a Codex admin
  - edit the default `requirements.toml` policy, or a higher-precedence
  group-scoped override if we ever want different behavior for a subset of
  users
  - set `guardian_developer_instructions = """..."""` to the full
  OpenAI-specific guardian prompt text
  - save the policy; codex-backend stores the raw TOML and `codex-rs`
  fetches the effective requirements file from `/wham/config/requirements`
  
  When updating the OpenAI-specific prompt, keep it aligned with the
  shared default guardian policy in `codex-rs` except for intentional
  OpenAI-only additions.
  
  ## Testing
  - `cargo check --tests -p codex-core -p codex-config -p
  codex-cloud-requirements --message-format short`
  - `cargo run -p codex-core --bin codex-write-config-schema`
  - `cargo fmt`
  - `git diff --check`
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-17 22:05:41 -07:00
  226241f035
• Prefer websockets when providers support them (#13592)

  Remove all flags and model settings.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  pakrym-oai · 2026-03-17 19:46:44 -07:00
  770616414a
• Add FS abstraction and use in view_image (#14960)

  Adds an environment crate and environment + file system abstraction.
  
  Environment is a combination of attributes and services specific to
  environment the agent is connected to:
  File system, process management, OS, default shell.
  
  The goal is to move most of agent logic that assumes environment to work
  through the environment abstraction.

  pakrym-oai · 2026-03-17 17:36:23 -07:00
  83a60fdb94
• app-server: reject websocket requests with Origin headers (#14995)

  Reject websocket requests that carry an `Origin` header

  Max Johnson · 2026-03-18 00:24:53 +00:00
  19b887128e
• feat: Add product-aware plugin policies and clean up manifest naming (#14993)

  - Add shared Product support to marketplace plugin policy and skill
  policy (no enforced yet).
  - Move marketplace installation/authentication under policy and model it
  as MarketplacePluginPolicy.
  - Rename plugin/marketplace local manifest types to separate raw serde
  shapes from resolved in-memory models.

  xl-openai · 2026-03-17 17:01:34 -07:00
  a5d3114e97
• fix(linux-sandbox): prefer system /usr/bin/bwrap when available (#14963)

  ## Problem
  Ubuntu/AppArmor hosts started failing in the default Linux sandbox path
  after the switch to vendored/default bubblewrap in `0.115.0`.
  
  The clearest report is in
  [#14919](https://github.com/openai/codex/issues/14919), especially [this
  investigation
  comment](https://github.com/openai/codex/issues/14919#issuecomment-4076504751):
  on affected Ubuntu systems, `/usr/bin/bwrap` works, but a copied or
  vendored `bwrap` binary fails with errors like `bwrap: setting up uid
  map: Permission denied` or `bwrap: loopback: Failed RTM_NEWADDR:
  Operation not permitted`.
  
  The root cause is Ubuntu's `/etc/apparmor.d/bwrap-userns-restrict`
  profile, which grants `userns` access specifically to `/usr/bin/bwrap`.
  Once Codex started using a vendored/internal bubblewrap path, that path
  was no longer covered by the distro AppArmor exception, so sandbox
  namespace setup could fail even when user namespaces were otherwise
  enabled and `uidmap` was installed.
  
  ## What this PR changes
  - prefer system `/usr/bin/bwrap` whenever it is available
  - keep vendored bubblewrap as the fallback when `/usr/bin/bwrap` is
  missing
  - when `/usr/bin/bwrap` is missing, surface a Codex startup warning
  through the app-server/TUI warning path instead of printing directly
  from the sandbox helper with `eprintln!`
  - use the same launcher decision for both the main sandbox execution
  path and the `/proc` preflight path
  - document the updated Linux bubblewrap behavior in the Linux sandbox
  and core READMEs
  
  ## Why this fix
  This still fixes the Ubuntu/AppArmor regression from
  [#14919](https://github.com/openai/codex/issues/14919), but it keeps the
  runtime rule simple and platform-agnostic: if the standard system
  bubblewrap is installed, use it; otherwise fall back to the vendored
  helper.
  
  The warning now follows that same simple rule. If Codex cannot find
  `/usr/bin/bwrap`, it tells the user that it is falling back to the
  vendored helper, and it does so through the existing startup warning
  plumbing that reaches the TUI and app-server instead of low-level
  sandbox stderr.
  
  ## Testing
  - `cargo test -p codex-linux-sandbox`
  - `cargo test -p codex-app-server --lib`
  - `cargo test -p codex-tui-app-server
  tests::embedded_app_server_start_failure_is_returned`
  - `cargo clippy -p codex-linux-sandbox --all-targets`
  - `cargo clippy -p codex-app-server --all-targets`
  - `cargo clippy -p codex-tui-app-server --all-targets`

  viyatb-oai · 2026-03-17 23:05:34 +00:00
  0d1539e74c
• Unify realtime shutdown in core (#14902)

  - route realtime startup, input, and transport failures through a single
  shutdown path
  - emit one realtime error/closed lifecycle while clearing session state
  once
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>

  Ahmed Ibrahim · 2026-03-17 15:58:52 -07:00
  98be562fd3
• Gate realtime audio interruption logic to v2 (#14984)

  - thread the realtime version into conversation start and app-server
  notifications
  - keep playback-aware mic gating and playback interruption behavior on
  v2 only, leaving v1 on the legacy path

  Ahmed Ibrahim · 2026-03-17 15:24:37 -07:00
  c6ab4ee537
• Cleanup skills/remote/xxx endpoints. (#14977)

  Remote skills/remote/xxx as they are not in used for now.

  xl-openai · 2026-03-17 15:22:36 -07:00
  1a9555eda9
• Fix fuzzy search notification buffering in app-server tests (#14955)

  ## What is flaky
  `codex-rs/app-server/tests/suite/fuzzy_file_search.rs` intermittently
  loses the expected `fuzzyFileSearch/sessionUpdated` and
  `fuzzyFileSearch/sessionCompleted` notifications when multiple
  fuzzy-search sessions are active and CI delivers notifications out of
  order.
  
  ## Why it was flaky
  The wait helpers were keyed only by JSON-RPC method name.
  
  - `wait_for_session_updated` consumed the next
  `fuzzyFileSearch/sessionUpdated` notification even when it belonged to a
  different search session.
  - `wait_for_session_completed` did the same for
  `fuzzyFileSearch/sessionCompleted`.
  - Once an unmatched notification was read, it was dropped permanently
  instead of buffered.
  - That meant a valid completion for the target search could arrive
  slightly early, be consumed by the wrong waiter, and disappear before
  the test started waiting for it.
  
  The result depended on notification ordering and runner scheduling
  instead of on the actual product behavior.
  
  ## How this PR fixes it
  - Add a buffered notification reader in
  `codex-rs/app-server/tests/common/mcp_process.rs`.
  - Match fuzzy-search notifications on the identifying payload fields
  instead of matching only on method name.
  - Preserve unmatched notifications in the in-process queue so later
  waiters can still consume them.
  - Include pending notification methods in timeout failures to make
  future diagnosis concrete.
  
  ## Why this fix fixes the flakiness
  The test now behaves like a real consumer of an out-of-order event
  stream: notifications for other sessions stay buffered until the correct
  waiter asks for them. Reordering no longer loses the target event, so
  the test result is determined by whether the server emitted the right
  notifications, not by which one happened to be read first.
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-17 10:52:16 -07:00
  f26ad3c92c