5290 Commits

This Branch

This Branch

All Branches

• fix(sandboxing): reject WSL1 bubblewrap sandboxing (#17559)

  ## Summary
  
  - detect WSL1 before Codex probes or invokes the Linux bubblewrap
  sandbox
  - fail early with a clear unsupported-operation message when a command
  would require bubblewrap on WSL1
  - document that WSL2 follows the normal Linux bubblewrap path while WSL1
  is unsupported
  
  ## Why
  
  Codex 0.115.0 made bubblewrap the default Linux sandbox. WSL1 cannot
  create the user namespaces that bubblewrap needs, so shell commands
  currently fail later with a raw bwrap namespace error. This makes the
  unsupported environment explicit and keeps non-bubblewrap paths
  unchanged.
  
  The WSL detection reads /proc/version, lets an explicit WSL<version>
  marker decide WSL1 vs WSL2+, and only treats a bare Microsoft marker as
  WSL1 when no explicit WSL version is present.
  
  addresses https://github.com/openai/codex/issues/16076
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-12 14:08:14 -07:00
  cb870a169a
• build(pnpm): require reviewed dependency build scripts (#17558)

  ## Description
  
  Enable pnpm's reviewed build-script gate for this repo.
  
  ## What changed
  
  - added `strictDepBuilds: true` to `pnpm-workspace.yaml`
  
  ## Why
  
  The repo already uses pinned pnpm and frozen installs in CI. This adds
  the remaining guard so dependency build scripts do not run unless they
  are explicitly reviewed.
  
  ## Validation
  
  - ran `pnpm install --frozen-lockfile`
  
  Co-authored-by: Codex <noreply@openai.com>

  mcgrew-oai · 2026-04-12 16:27:44 -04:00
  a4d5112b37
• [codex] Support flattened deferred MCP tool calls (#17556)

  ## Summary
  - register flattened handler aliases for deferred MCP tools
  - cover the node_repl-shaped deferred MCP call path in tool registry
  tests
  
  ## Root Cause
  Deferred MCP tools were registered only under their namespaced handler
  key, e.g. `mcp__node_repl__:js`. If the model/bridge emitted the
  flattened qualified name `mcp__node_repl__js`, core parsed it as an MCP
  payload but dispatch looked up the flattened handler key and returned
  `unsupported call` before reaching the MCP handler.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-tools
  search_tool_registers_deferred_mcp_flattened_handlers`
  - `cargo test -p codex-core
  search_tool_registers_namespaced_mcp_tool_aliases`
  - `git diff --check`

  Francis Chalissery · 2026-04-12 13:19:36 -07:00
  720932ca3d
• Budget realtime current thread context (#17519)

  Select Current Thread startup context by budget from newest turns, cap
  each rendered turn at 300 approximate tokens, and add formatter plus
  integration snapshot coverage.

  Ahmed Ibrahim · 2026-04-12 11:59:09 -07:00
  4db60d5d8b
• [codex] Support bubblewrap in secure Docker devcontainer (#17547)

  ## Summary
  
  - leave the default contributor devcontainer on its lightweight
  platform-only Docker runtime
  - install bubblewrap in setuid mode only in the secure devcontainer
  image for running Codex inside Docker
  - add Docker run args to the secure profile for bubblewrap's required
  capabilities
  - use explicit `seccomp=unconfined` and `apparmor=unconfined` in the
  secure profile instead of shipping a custom seccomp profile
  - document that the relaxed Docker security options are scoped to the
  secure profile
  
  ## Why
  
  Docker's default seccomp profile blocks bubblewrap with `pivot_root:
  Operation not permitted`, even when the container has `CAP_SYS_ADMIN`.
  Docker's default AppArmor profile also blocks bubblewrap with `Failed to
  make / slave: Permission denied`.
  
  A custom seccomp profile works, but it is hard for customers to audit
  and understand. Using Docker's standard `seccomp=unconfined` option is
  clearer: the secure profile intentionally relaxes Docker's outer sandbox
  just enough for Codex to construct its own bubblewrap/seccomp sandbox
  inside the container. The default contributor profile does not get these
  expanded runtime settings.
  
  ## Validation
  
  - `sed '/\\/\\*/,/\\*\\//d' .devcontainer/devcontainer.json | jq empty`
  - `jq empty .devcontainer/devcontainer.secure.json`
  - `git diff --check`
  - `docker build --platform=linux/arm64 -t
  codex-devcontainer-bwrap-test-arm64 ./.devcontainer`
  - `docker build --platform=linux/arm64 -f
  .devcontainer/Dockerfile.secure -t
  codex-devcontainer-secure-bwrap-test-arm64 .`
  - interactive `docker run -it` smoke tests:
    - verified non-root users `ubuntu` and `vscode`
    - verified secure image `/usr/bin/bwrap` is setuid
  - verified user/pid namespace, user/network namespace, and preserved-fd
  `--ro-bind-data` bwrap commands
  - reran secure-image smoke test with simplified `seccomp=unconfined`
  setup:
    - `bwrap-basic-ok`
    - `bwrap-netns-ok`
    - `codex-ok`
  - ran Codex inside the secure image:
    - `codex --version` -> `codex-cli 0.120.0`
  - `codex sandbox linux --full-auto -- /bin/sh -lc '...'` -> exited 0 and
  printed `codex-inner-ok`
  
  Note: direct `bwrap --proc /proc` is still denied by this Docker
  runtime, and Codex's existing proc-mount preflight fallback handles that
  by retrying without `--proc`.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-12 10:49:50 -07:00
  1288bb60a1
• Clarify guardian timeout guidance (#17521)

  ## Summary
  - update the guardian timeout guidance to say permission approval review
  timed out
  - simplify the retry guidance to say retry once or ask the user for
  guidance or explicit approval
  
  ## Testing
  - cargo test -p codex-core
  guardian_timeout_message_distinguishes_timeout_from_policy_denial
  - cargo test -p codex-core
  guardian_review_decision_maps_to_mcp_tool_decision

  Won Park · 2026-04-12 02:03:53 -07:00
  3895ddd6b1
• changing decision semantics after guardian timeout (#17486)

  **Summary**
  
  This PR treats Guardian timeouts as distinct from explicit denials in
  the core approval paths.
  Timeouts now return timeout-specific guidance instead of Guardian
  policy-rejection messaging.
  It updates the command, shell, network, and MCP approval flows and adds
  focused test coverage.

  Won Park · 2026-04-12 00:00:50 -07:00
  ba839c23f3
• chore: refactor name and namespace to single type (#17402)

  avoid passing them both around, unify on a type. this now also keys
  `ToolRegistry`.
  
  tests pass

  sayan-oai · 2026-04-11 23:06:22 +00:00
  1325bcd3f6
• Restore codex-tui resume hint on exit (#17415)

  Addresses #17303
  
  Problem: The standalone codex-tui entrypoint only printed token usage on
  exit, so resumable sessions could omit the codex resume footer even when
  thread metadata was available.
  
  Solution: Format codex-tui exit output from AppExitInfo so it includes
  the same resume hint as the main CLI and reports fatal exits
  consistently.

  Eric Traut · 2026-04-11 15:46:54 -07:00
  7a6266323c
• Clear /ps after /stop (#17416)

  Addresses #17311
  
  Problem: `/stop` stops background terminals, but `/ps` can still show
  stale entries because the TUI process cache is cleared only after later
  exec end events arrive.
  
  Solution: Clear the TUI's tracked unified exec process list and footer
  immediately when `/stop` submits background terminal cleanup.

  Eric Traut · 2026-04-11 15:45:58 -07:00
  1e27028360
• Support prolite plan type (#17419)

  Addresses #17353
  
  Problem: Codex rate-limit fetching failed when the backend returned the
  new `prolite` subscription plan type.
  
  Solution: Add `prolite` to the backend/account/auth plan mappings, keep
  unknown WHAM plan values decodable, and regenerate app-server plan
  schemas.

  Eric Traut · 2026-04-11 13:58:16 -07:00
  3b948d9dd8
• fix (#17493)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-04-11 13:52:17 -07:00
  163ae7d3e6
• Update issue labeler agent labels (#17483)

  Problem: The automatic issue labeler still treated agent-related issues
  as one broad category, even though more specific agent-area labels now
  exist.
  
  Solution: Update the issue labeler prompt to prefer the new agent-area
  labels and keep "agent" as the fallback for uncategorized core agent
  issues.

  Eric Traut · 2026-04-11 11:55:14 -07:00
  640d3a036f
• Add use_agent_identity feature flag (#17385)
  Adrian · 2026-04-11 09:52:06 -07:00
  39cc85310f
• Handle closed TUI input stream as shutdown (#17430)

  Addresses #17276
  
  Problem: Closing the terminal while the TUI input stream is pending
  could leave the app outside the normal shutdown path, which is risky
  when an approval prompt is active.
  
  Solution: Treat a closed TUI input stream as ShutdownFirst so existing
  thread shutdown behavior cancels pending work and approvals before exit.

  Eric Traut · 2026-04-11 09:02:05 -07:00
  51d58c56d5
• fix(tui): recall accepted slash commands locally (#17336)

  # TL;DR
  
  - Adds recognized slash commands to the TUI's local in-session recall
  history.
  - This is the MVP of the whole feature: it keeps slash-command recall
  local only: nothing is written to persistent history, app-server
  history, or core history storage.
  - Treats slash commands like submitted text once they parse as a known
  built-in command, regardless of whether command dispatch later succeeds.
  
  # Problem
  
  Slash commands are handled outside the normal message submission path,
  so they could clear the composer without becoming part of the local
  Up-arrow recall list. That made command-heavy workflows awkward: after
  running `/diff`, `/rename Better title`, `/plan investigate this`, or
  even a valid command that reports a usage error, users had to retype the
  command instead of recalling and editing it like a normal prompt.
  
  The goal of this PR is to make slash commands feel like submitted input
  inside the current TUI session while keeping the change deliberately
  local. This is not persistent history yet; it only affects the
  composer's in-memory recall behavior.
  
  # Mental model
  
  The composer owns draft state and local recall. When slash input parses
  as a recognized built-in command, the composer stages the submitted
  command text before returning `InputResult::Command` or
  `InputResult::CommandWithArgs`. `ChatWidget` then dispatches the command
  and records the staged entry once dispatch returns to the input-result
  path.
  
  Command-name recognition is the only validation before local recall. A
  valid slash command is recallable whether it succeeds, fails with a
  usage error, no-ops, is unavailable while a task is running, or is
  skipped by command-specific logic. An unrecognized slash command is
  different: it is restored as a draft, surfaces the existing
  unrecognized-command message, and is not added to recall.
  
  Bare commands recalled from typed text use the trimmed submitted draft.
  Commands selected from the popup record the canonical command text, such
  as `/diff`, rather than the partial filter text the user typed. Inline
  commands with arguments keep the original command invocation available
  locally even when their arguments are later prepared through the normal
  submission pipeline.
  
  # Non-goals
  
  Persisting slash commands across sessions is intentionally out of scope.
  This change does not modify app-server history, core history storage,
  protocol events, or message submission semantics.
  
  This does not change command availability, command side effects, popup
  filtering, command parsing, or the semantics of unsupported commands. It
  only changes whether recognized slash-command invocations are available
  through local Up-arrow recall after the user submits them.
  
  # Tradeoffs
  
  The main tradeoff is that recall is based on command recognition, not
  command outcome. This intentionally favors a simpler user model: if the
  TUI accepted the input as a slash command, the user can recall and edit
  that input just like plain text. That means valid-but-unsuccessful
  invocations such as usage errors are recallable, which is useful when
  the next action is usually to edit and retry.
  
  The previous accept/reject design required command dispatch to report a
  boolean outcome, which made the dispatcher API noisier and forced every
  branch to decide history behavior. This version keeps the dispatch APIs
  as side-effect-only methods and localizes history recording to the
  slash-command input path.
  
  Inline command handling still avoids double-recording by preparing
  inline arguments without using the normal message-submission history
  path. The staged slash-command entry remains the single local recall
  record for the command invocation.
  
  # Architecture
  
  `ChatComposer` stages a pending `HistoryEntry` when recognized
  slash-command input is promoted into an input result. The pending entry
  mirrors the existing local history payload shape so recall can restore
  text elements, local images, remote images, mention bindings, and
  pending paste state when those are present.
  
  `BottomPane` exposes a narrow method for recording that staged command
  entry because it owns the composer. `ChatWidget` records the staged
  entry after dispatching a recognized command from the input-result
  match. Valid commands rejected before they reach `ChatWidget`, such as
  commands unavailable while a task is running, are staged and recorded in
  the composer path that detects the rejection.
  
  Slash-command dispatch itself now lives in
  `chatwidget/slash_dispatch.rs` so the behavior is reviewable without
  adding more weight to `chatwidget.rs`. The extraction is
  behavior-preserving: the dispatch match arms stay intact, while the
  input flow in `chatwidget.rs` remains the single place that connects
  submitted slash-command input to dispatch.
  
  # Observability
  
  There is no new logging because this is a local UI recall behavior and
  the result is directly visible through Up-arrow recall. The practical
  debug path is to trace Enter through
  `ChatComposer::try_dispatch_bare_slash_command`,
  `ChatComposer::try_dispatch_slash_command_with_args`, or popup Enter/Tab
  handling, then confirm the recognized command is staged before dispatch
  and recorded exactly once afterward.
  
  If a valid command unexpectedly does not appear in recall, check whether
  the input path staged slash history before clearing the composer and
  whether it used the `ChatWidget` slash-dispatch wrapper. If an
  unrecognized command unexpectedly appears in recall, check the parser
  branch that should restore the draft instead of staging history.
  
  # Tests
  
  Composer-level tests cover staging and recording for a bare typed slash
  command, a popup-selected command, and an inline command with arguments.
  
  Chat-widget tests cover valid commands being recallable after normal
  dispatch, inline dispatch, usage errors, task-running unavailability,
  no-op stub dispatch, and command-specific skip behavior such as `/init`
  when an instructions file already exists. They also cover the negative
  case: unrecognized slash commands are not added to local recall.

  Felipe Coury · 2026-04-11 12:40:08 -03:00
  0bdeab330b
• Pass turn id with feedback uploads (#17314)

  ## Summary
  - Add an optional `tags` dictionary to feedback upload params.
  - Capture the active app-server turn id in the TUI and submit it as
  `tags.turn_id` with `/feedback` uploads.
  - Merge client-provided feedback tags into Sentry feedback tags while
  preserving reserved system fields like `thread_id`, `classification`,
  `cli_version`, `session_source`, and `reason`.
  
  ## Behavior / impact
  Existing feedback upload callers remain compatible because `tags` is
  optional and nullable. The wire shape is still a normal JSON object /
  TypeScript dictionary, so adding future feedback metadata will not
  require a new top-level protocol field each time. This change only adds
  feedback metadata for Codex CLI/TUI uploads; it does not affect existing
  pipelines, DAGs, exports, or downstream consumers unless they choose to
  read the new `turn_id` feedback tag.
  
  ## Tests
  - `cargo fmt -- --config imports_granularity=Item` passed; stable
  rustfmt warned that `imports_granularity` is nightly-only.
  - `cargo run -p codex-app-server-protocol --bin write_schema_fixtures`
  - `cargo test -p codex-feedback
  upload_tags_include_client_tags_and_preserve_reserved_fields`
  - `cargo test -p codex-app-server-protocol
  schema_fixtures_match_generated`
  - `cargo test -p codex-tui build_feedback_upload_params`
  - `cargo test -p codex-tui
  live_app_server_turn_started_sets_feedback_turn_id`
  - `cargo check -p codex-app-server --tests`
  - `git diff --check`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  ningyi-oai · 2026-04-11 00:23:50 -07:00
  be13f03c39
• feat(devcontainer): add separate secure customer profile (#10431)

  ## Description
  
  Keeps the existing Codex contributor devcontainer in place and adds a
  separate secure profile for customer use.
  
  ## What changed
  
  - leaves `.devcontainer/devcontainer.json` and the contributor
  `Dockerfile` aligned with `main`
  - adds `.devcontainer/devcontainer.secure.json` and
  `.devcontainer/Dockerfile.secure`
  - adds secure-profile bootstrap scripts:
    - `post_install.py`
    - `post-start.sh`
    - `init-firewall.sh`
  - updates `.devcontainer/README.md` to explain when to use each path
  
  ## Secure profile behavior
  
  The new secure profile is opt-in and is meant for running Codex in a
  stricter project container:
  
  - preinstalls the Codex CLI plus common build tools
  - uses persistent volumes for Codex state, Cargo, Rustup, and GitHub
  auth
  - applies an allowlist-driven outbound firewall at startup
  - blocks IPv6 by default so the allowlist cannot be bypassed via AAAA
  routes
  - keeps the stricter networking isolated from the default contributor
  workflow
  
  ## Resulting behavior
  
  - `devcontainer.json` remains the low-friction Codex contributor setup
  - `devcontainer.secure.json` is the customer-facing secure option
  - the repo supports both workflows without forcing the secure profile on
  Codex contributors

  viyatb-oai · 2026-04-10 23:32:06 -07:00
  dbfe855f4f
• Fix thread/list cwd filtering for Windows verbatim paths (#17414)

  Addresses #17302
  
  Problem: `thread/list` compared cwd filters with raw path equality, so
  `resume --last` could miss Windows sessions when the saved cwd used a
  verbatim path form and the current cwd did not.
  
  Solution: Normalize cwd comparisons through the existing path comparison
  utilities before falling back to direct equality, and add Windows
  regression coverage for verbatim paths. I made this a general utility
  function and replaced all of the duplicated instance of it across the
  code base.

  Eric Traut · 2026-04-10 23:08:02 -07:00
  e9e7ef3d36
• Stabilize marketplace add local source test (#17424)

  ## Summary
  - Update the marketplace add local-source integration test to pass an
  explicit relative local path.
  - Keep the change test-only; no CLI source parsing behavior changes.
  
  ## Tests
  - cargo fmt -p codex-cli
  - cargo test -p codex-cli --test marketplace_add
  
  ## Impact
  - Production behavior is unchanged.
  - No impact to feedback upload logic, DAGs, exports, or downstream
  pipelines.
  
  Co-authored-by: Codex <noreply@openai.com>

  ningyi-oai · 2026-04-11 05:06:59 +00:00
  a9796e39c4
• [mcp] Support MCP Apps part 3 - Add mcp tool call support. (#17364)

  - [x] Add a new app-server method so that MCP Apps can call their own
  MCP server directly.

  Matthew Zeng · 2026-04-11 04:39:19 +00:00
  b7139a7e8f
• update cloud requirements parse failure msg (#17396)

  <img width="805" height="189" alt="Screenshot 2026-04-10 at 6 17 19 PM"
  src="https://github.com/user-attachments/assets/3ce22f45-56fb-4011-8005-98a2c1407f30"
  />

  alexsong-oai · 2026-04-10 20:56:55 -07:00
  f8bb088617
• fix: unblock private DNS in macOS sandbox (#17370)

  ## Summary
  - keep hostname targets proxied by default by removing hostname suffixes
  from the managed `NO_PROXY` value while preserving private/link-local
  CIDRs
  - make the macOS `allow_local_binding` sandbox rules match the local
  socket shape used by DNS tools by allowing wildcard local binds
  - allow raw DNS egress to remote port 53 only when `allow_local_binding`
  is enabled, without opening blanket outbound network access
  
  ## Root cause
  Raw DNS tools do not honor `HTTP_PROXY` or `ALL_PROXY`, so the
  proxy-only Seatbelt policy blocked their resolver traffic before it
  could reach host DNS. In the affected managed config,
  `allow_local_binding = true`, but the existing rule only allowed
  `localhost:*` binds; `dig`/BIND can bind sockets in a way that needs
  wildcard local binding. Separately, hostname suffixes in `NO_PROXY`
  could force internal hostnames to resolve locally instead of through the
  proxy path.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-10 20:34:04 -07:00
  8a474a6561
• TUI: enforce core boundary (#17399)

  Problem: The TUI still depended on `codex-core` directly in a number of
  places, and we had no enforcement from keeping this problem from getting
  worse.
  
  Solution: Route TUI core access through
  `codex-app-server-client::legacy_core`, add CI enforcement for that
  boundary, and re-export this legacy bridge inside the TUI as
  `crate::legacy_core` so the remaining call sites stay readable. There is
  no functional change in this PR — just changes to import targets.
  
  Over time, we can whittle away at the remaining symbols in this legacy
  namespace with the eventual goal of removing them all. In the meantime,
  this linter rule will prevent us from inadvertently importing new
  symbols from core.

  Eric Traut · 2026-04-10 20:25:31 -07:00
  66e13efd9c
• representing guardian review timeouts in protocol types (#17381)

  ## Summary
  
  - Add `TimedOut` to Guardian/review carrier types:
    - `ReviewDecision::TimedOut`
    - `GuardianAssessmentStatus::TimedOut`
    - app-server v2 `GuardianApprovalReviewStatus::TimedOut`
  - Regenerate app-server JSON/TypeScript schemas for the new wire shape.
  - Wire the new status through core/app-server/TUI mappings with
  conservative fail-closed handling.
  - Keep `TimedOut` non-user-selectable in the approval UI.
  
  **Does not change runtime behavior yet; emitting `TimeOut` and
  parent-model timeout messaging will come in followup PRs**

  Won Park · 2026-04-10 20:02:33 -07:00
  37aac89a6d
• Fix Windows exec-server output test flake (#17409)

  Problem: The Windows exec-server test command could let separator
  whitespace become part of `echo` output, making the exact
  retained-output assertion flaky.
  
  Solution: Tighten the Windows `cmd.exe` command by placing command
  separators directly after the echoed tokens so stdout remains
  deterministic while preserving the exact assertion.

  Eric Traut · 2026-04-10 19:24:40 -07:00
  824ec94eab
• Add marketplace command (#17087)

  Added a new top-level `codex marketplace add` command for installing
  plugin marketplaces into Codex’s local marketplace cache.
  
  This change adds source parsing for local directories, GitHub shorthand,
  and git URLs, supports optional `--ref` and git-only `--sparse` checkout
  paths, stages the source in a temp directory, validates the marketplace
  manifest, and installs it under
  `$CODEX_HOME/marketplaces/<marketplace-name>`
  
  Included tests cover local install behavior in the CLI and marketplace
  discovery from installed roots in core. Scoped formatting and fix passes
  were run, and targeted CLI/core tests passed.

  xli-oai · 2026-04-10 19:18:37 -07:00
  f9a8d1870f
• feat(analytics): add guardian review event schema (#17055)

  Just the analytics schema definition for guardian evaluations. No wiring
  done yet.

  Owen Lin · 2026-04-10 17:33:58 -07:00
  58933237cd
• fix(permissions): fix symlinked writable roots in sandbox permissions (#15981)

  ## Summary
  - preserve logical symlink paths during permission normalization and
  config cwd handling
  - bind real targets for symlinked readable/writable roots in bwrap and
  remap carveouts and unreadable roots there
  - add regressions for symlinked carveouts and nested symlink escape
  masking
  
  ## Root cause
  Permission normalization canonicalized symlinked writable roots and cwd
  to their real targets too early. That drifted policy checks away from
  the logical paths the sandboxed process can actually address, while
  bwrap still needed the real targets for mounts. The mismatch caused
  shell and apply_patch failures on symlinked writable roots.
  
  ## Impact
  Fixes #15781.
  
  Also fixes #17079:
  - #17079 is the protected symlinked carveout side: bwrap now binds the
  real symlinked writable-root target and remaps carveouts before masking.
  
  Related to #15157:
  - #15157 is the broader permission-check side of this path-identity
  problem. This PR addresses the shared logical-vs-canonical normalization
  issue, but the reported Darwin prompt behavior should be validated
  separately before auto-closing it.
  
  This should also fix #14672, #14694, #14715, and #15725:
  - #14672, #14694, and #14715 are the same Linux
  symlinked-writable-root/bwrap family as #15781.
  - #15725 is the protected symlinked workspace path variant; the PR
  preserves the protected logical path in policy space while bwrap applies
  read-only or unreadable treatment to the resolved target so
  file-vs-directory bind mismatches do not abort sandbox setup.
  
  ## Notes
  - Added Linux-only regressions for symlinked writable ancestors and
  protected symlinked directory targets, including nested symlink escape
  masking without rebinding the escape target writable.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-10 17:00:58 -07:00
  b114781495
• app-server: add pipelined config rpc regression test (#17371)

  ### Summary
  Adds regression coverage for pipelined config RPC reads after writes
  ### Testing
  These are new tests

  Ruslan Nigmatullin · 2026-04-10 16:46:02 -07:00
  0a99943a94
• Revert "Option to Notify Workspace Owner When Usage Limit is Reached" (#17391)

  Reverts openai/codex#16969
  
  #sev3-2026-04-10-accountscheckversion-500s-for-openai-workspace-7300

  Shijie Rao · 2026-04-10 23:33:13 +00:00
  930e5adb7e
• fix(guardian, app-server): introduce guardian review ids (#17298)

  ## Description
  
  This PR introduces `review_id` as the stable identifier for guardian
  reviews and exposes it in app-server `item/autoApprovalReview/started`
  and `item/autoApprovalReview/completed` events.
  
  Internally, guardian rejection state is now keyed by `review_id` instead
  of the reviewed tool item ID. `target_item_id` is still included when a
  review maps to a concrete thread item, but it is no longer overloaded as
  the review lifecycle identifier.
  
  ## Motivation
  
  We'd like to give users the ability to preempt a guardian review while
  it's running (approve or decline).
  
  However, we can't implement the API that allows the user to override a
  running guardian review because we didn't have a unique `review_id` per
  guardian review. Using `target_item_id` is not correct since:
  - with execve reviews, there can be multiple execve calls (and therefore
  guardian reviews) per shell command
  - with network policy reviews, there is no target item ID
  
  The PR that actually implements user overrides will use `review_id` as
  the stable identifier.

  Owen Lin · 2026-04-10 16:21:02 -07:00
  a3be74143a
• Support clear SessionStart source (#17073)

  ## Motivation
  
  The `SessionStart` hook already receives `startup` and `resume` sources,
  but sessions created from `/clear` previously looked like normal startup
  sessions. This makes it impossible for hook authors to distinguish
  between these with the matcher.
  
  ## Summary
  
  - Add `InitialHistory::Cleared` so `/clear`-created sessions can be
  distinguished from ordinary startup sessions.
  - Add `SessionStartSource::Clear` and wire it through core, app-server
  thread start params, and TUI clear-session flow.
  - Update app-server protocol schemas, generated TypeScript, docs, and
  related tests.
  
  
  https://github.com/user-attachments/assets/9cae3cb4-41c7-4d06-b34f-966252442e5c

  Abhinav · 2026-04-10 16:05:21 -07:00
  7999b0f60f
• [codex] Improve hook status rendering (#17266)

  # Motivation
  
  Make hook display less noisy and more useful by keeping transient hook
  activity out of permanent history unless there is useful output,
  preserving visibility for meaningful hook work, and making completed
  hook severity easier to scan.
  
  Also addresses some of the concerns in
  https://github.com/openai/codex/issues/15497
  
  # Changes
  
  ## Demo
  
  
  https://github.com/user-attachments/assets/9d8cebd4-a502-4c95-819c-c806c0731288
  
  Reverse spec for the behavior changes in this branch:
  
  ## Hook Lifecycle Rendering
  - Hook start events no longer write permanent history rows like `Running
  PreToolUse hook`.
  - Running hooks now render in a dedicated live hook area above the
  composer. It's similar to the active cell we use for tool calls but its
  a separate lane.
  - Running hook rows use the existing animation setting.
  
  ## Hook Reveal Timing
  - We wait 300ms before showing running hook rows and linger for up to
  600ms once visible.
  - This is so fast hooks don't flash a transient `Running hook` row
  before user can read it every time.
  - If a fast hook completes with meaningful output, only the completed
  hook result is written to history.
  - If a fast hook completes successfully with no output, it leaves no
  visible trace.
  
  ## Completed Hook Output
  - Completed hooks with output are sticky, for example `• SessionStart
  hook (completed)`.
  - Hook output entries are rendered under that row with stable prefixes:
  `warning:`, `stop:`, `feedback:`, `hook context:`, and `error:`.
  - Blocked hooks show feedback entries, for example `• PreToolUse hook
  (blocked)` followed by `feedback: ...`.
  - Failed hooks show error entries, for example `• PostToolUse hook
  (failed)` followed by `error: ...`.
  - Stopped hooks show stop entries and remain visually treated as
  non-success.
  
  ## Parallel Hook Behavior
  - Multiple simultaneously running hooks can be tracked in one live hook
  cell.
  - Adjacent running hooks with the same hook event name and same status
  message collapse into a count, for example `• Running 3 PreToolUse
  hooks: checking command policy`.
  - Running hooks with different event names or different status messages
  remain separate rows.
  
  ## Hook Run Identity
  - `PreToolUse` and `PostToolUse` hook run IDs now include the tool call
  ID which prevents concurrent tool-use hooks from sharing a run ID and
  clobbering each other in the UI.
  - This ID scoping applies to tool-use hooks only; other hook event types
  keep their existing run identity behavior.
  
  ## App-Server Hook Notifications
  - App-server `HookStarted` and `HookCompleted` notifications use the
  same live hook rendering path as core hook events.
  - `UserPromptSubmit` hook notifications now render through the same
  completed hook output format, including warning and stop entries.

  Abhinav · 2026-04-10 14:05:47 -07:00
  87b9275fff
• add parent-id to guardian context (#17194)

  adding parent codex session id to guardian prompt

  Won Park · 2026-04-10 13:57:56 -07:00
  147cb84112
• Add thread title to configurable TUI status line (#17187)

  - Add thread-title as an optional TUI status line item, omitted unless
  the user has set a custom name (`ChatWidget.thread_name`).
  - Refresh the status line when threads are renamded
  - Add snapshot coverage for renamed-thread footer behavior.

  canvrno-oai · 2026-04-10 13:24:07 -07:00
  aac1e74cd5
• [codex-analytics] add compaction analytics event (#17155)

  - event for compaction analytics
  - introduces thread-connection and thread metadata caches for data
  denormalization, expected to be useful for denormalization onto core
  emitted events in general
  - threads analytics event client into core (mirrors approved
  implementation in #16640)
  - denormalizes key thread metadata: thread_source, subagent_source,
  parent_thread_id, as well as app-server client and runtime metadata)
  - compaction strategy defaults to memento, forward compatible with
  expected prefill_compaction strategy
  
  1. Manual standalone compact, local
  `INFO | 2026-04-09 17:35:50 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d0-5cfb-70c0-bef9-165c3bf9b2df', 'turn_id':
  '019d74d0-d7f6-7c81-acc6-aae2030243d6', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20170, 'active_context_tokens_after':
  4830, 'started_at': 1775781337, 'completed_at': 1775781350,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 13524} | `
  
  2. Auto pre-turn compact, local
  `INFO | 2026-04-09 17:37:30 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d2-45ef-71d1-9c93-23cc0c13d988', 'turn_id':
  '019d74d2-7b42-7372-9f0e-c0da3f352328', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'pre_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20063, 'active_context_tokens_after':
  4822, 'started_at': 1775781444, 'completed_at': 1775781449,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 5497} | `
  
  3. Auto mid-turn compact, local
  `INFO | 2026-04-09 17:38:28 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d3-212f-7a20-8c0a-4816a978675e', 'turn_id':
  '019d74d3-3ee1-7462-89f6-2ffbeefcd5e3', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'mid_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20325, 'active_context_tokens_after':
  14641, 'started_at': 1775781500, 'completed_at': 1775781508,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 7507} | `
  
  4. Remote /responses/compact, manual standalone
  `INFO | 2026-04-09 17:40:20 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d4-7a11-78a1-89f7-0535a1149416', 'turn_id':
  '019d74d4-e087-7183-9c20-b1e40b7578c0', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses_compact', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 23461, 'active_context_tokens_after':
  6171, 'started_at': 1775781601, 'completed_at': 1775781620,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 18971} | `

  rhan-oai · 2026-04-10 13:03:54 -07:00
  5779be314a
• Strengthen realtime backend delegation prompt (#17363)

  Encourages realtime prompt handling to delegate user requests to the
  backend agent by default when repo inspection, commands, implementation,
  or validation may help.
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-10 12:14:33 -07:00
  029fc63d13
• fix: main (#17352)
  jif-oai · 2026-04-10 18:14:42 +01:00
  87328976f6
• Queue Realtime V2 response.create while active (#17306)

  Builds on #17264.
  
  - queues Realtime V2 `response.create` while an active response is open,
  then flushes it after `response.done` or `response.cancelled`
  - requests `response.create` after background agent final output and
  steering acknowledgements
  - adds app-server integration coverage for all `response.create` paths
  
  Validation:
  - `just fmt`
  - `cargo check -p codex-app-server --tests`
  - `git diff --check`
  - CI green
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-10 09:09:13 -07:00
  2e81eac004
• feat(guardian): send only transcript deltas on guardian followups (#17269)

  ## Description
  
  We reuse a guardian thread for a given user thread when we can. However,
  we had always sent the full transcript history every time we made a
  followup review request to an existing guardian thread.
  
  This is especially bad for long guardian threads since we keep
  re-appending old transcript entries instead of just what has changed.
  The fix is to just send what's new.
  
  **Caveat**: Whenever a thread is compacted or rolled back, we fall back
  to sending the full transcript to guardian again since the thread's
  history has been modified. However in the happy path we get a nice
  optimization.
  
  ## Before
  Initial guardian review sends the full parent transcript:
  
  ```
  The following is the Codex agent history whose request action you are assessing...
  >>> TRANSCRIPT START
  [1] user: Please check the repo visibility and push the docs fix if needed.
  [2] tool gh_repo_view call: {"repo":"openai/codex"}
  [3] tool gh_repo_view result: repo visibility: public
  [4] assistant: The repo is public; I now need approval to push the docs fix.
  >>> TRANSCRIPT END
  The Codex agent has requested the following action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```
  
  And a followup to the same guardian thread would send the full
  transcript again (including items 1-4 we already sent):
  ```
  The following is the Codex agent history whose request action you are assessing...
  >>> TRANSCRIPT START
  [1] user: Please check the repo visibility and push the docs fix if needed.
  [2] tool gh_repo_view call: {"repo":"openai/codex"}
  [3] tool gh_repo_view result: repo visibility: public
  [4] assistant: The repo is public; I now need approval to push the docs fix.
  [5] user: Please push the second docs fix too.
  [6] assistant: I need approval for the second docs fix.
  >>> TRANSCRIPT END
  The Codex agent has requested the following action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```
  
  ## After
  Initial guardian review sends the full parent transcript (this is
  unchanged):
  
  ```
  The following is the Codex agent history whose request action you are assessing...
  >>> TRANSCRIPT START
  [1] user: Please check the repo visibility and push the docs fix if needed.
  [2] tool gh_repo_view call: {"repo":"openai/codex"}
  [3] tool gh_repo_view result: repo visibility: public
  [4] assistant: The repo is public; I now need approval to push the docs fix.
  >>> TRANSCRIPT END
  The Codex agent has requested the following action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```
  
  But a followup now sends:
  ```
  The following is the Codex agent history added since your last approval assessment. Continue the same review conversation...
  >>> TRANSCRIPT DELTA START
  [5] user: Please push the second docs fix too.
  [6] assistant: I need approval for the second docs fix.
  >>> TRANSCRIPT DELTA END
  The Codex agent has requested the following next action:
  >>> APPROVAL REQUEST START
  ...
  >>> APPROVAL REQUEST END
  ```

  Owen Lin · 2026-04-10 07:48:44 -07:00
  88165e179a
• feat: description multi-agent v2 (#17338)
  jif-oai · 2026-04-10 15:31:32 +01:00
  d39a722865
• fix: MCP leaks in app-server (#17223)

  The disconnect path now reuses the same teardown flow as explicit
  unsubscribe, and the thread-state bookkeeping consistently reports only
  threads that lost their last subscriber
  
  https://github.com/openai/codex/issues/16895

  jif-oai · 2026-04-10 15:31:26 +01:00
  8d58899297
• feat: make rollout recorder reliable against errors (#17214)

  The rollout writer now keeps an owned/monitored task handle, returns
  real Result acks for flush/persist/shutdown, retries failed flushes by
  reopening the rollout file, and keeps buffered items until they are
  successfully written. Session flushes are now real durability barriers
  for fork/rollback/read-after-write paths, while turn completion surfaces
  a warning if the rollout still cannot be saved after recovery.

  jif-oai · 2026-04-10 14:12:33 +01:00
  8035cb03f1
• feat: move exec-server ownership (#16344)

  This introduces session-scoped ownership for exec-server so ws
  disconnects no longer immediately kill running remote exec processes,
  and it prepares the protocol for reconnect-based resume.
  - add session_id / resume_session_id to the exec-server initialize
  handshake
    - move process ownership under a shared session registry
  - detach sessions on websocket disconnect and expire them after a TTL
  instead of killing processes immediately (we will resume based on this)
  - allow a new connection to resume an existing session and take over
  notifications/ownership
  - I use UUID to make them not predictable as we don't have auth for now
  - make detached-session expiry authoritative at resume time so teardown
  wins at the TTL boundary
  - reject long-poll process/read calls that get resumed out from under an
  older attachment
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-10 14:11:47 +01:00
  085ffb4456
• Add output_schema to code mode render (#17210)

  This updates code-mode tool rendering so MCP tools can surface
  structured output types from their `outputSchema`.
  
  What changed:
  - Detect MCP tool-call result wrappers from the output schema shape
  instead of relying on tool-name parsing or provenance flags.
  - Render shared TypeScript aliases once for MCP tool results
  (`CallToolResult`, `ContentBlock`, etc.) so multiple MCP tool
  declarations stay compact.
  - Type `structuredContent` from the tool definition's `outputSchema`
  instead of rendering it as `unknown`.
  - Update the shared MCP aliases to match the MCP draft `CallToolResult`
  schema more closely.
  
  Example:
  - Before: `declare const tools: { mcp__rmcp__echo(args: { env_var?:
  string; message: string; }): Promise<{ _meta?: unknown; content:
  Array<unknown>; isError?: boolean; structuredContent?: unknown; }>; };`
  - After: `declare const tools: { mcp__rmcp__echo(args: { env_var?:
  string; message: string; }): Promise<CallToolResult<{ echo: string; env:
  string | null; }>>; };`

  Vivian Fang · 2026-04-10 11:41:44 +00:00
  7bbe3b6011
• Stream Realtime V2 background agent progress (#17264)

  Stream Realtime V2 background agent updates while the background agent
  task is still running, then send the final tool output when it
  completes. User input during an active V2 handoff is acknowledged back
  to realtime as a steering update.
  
  Stack:
  - Depends on #17278 for the background_agent rename.
  - Depends on #17280 for the input task handler refactor.
  
  Coverage:
  - Adds an app-server integration regression test that verifies V2
  progress is sent before the final function-call output.
  
  Validation:
  - just fmt
  - cargo check -p codex-core
  - cargo check -p codex-app-server --tests
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-10 00:06:00 -07:00
  1de0085418
• adding parent_thread_id in guardian (#17249)

  ## Summary
  
  This PR adds the parent conversation/session id to the subagent-start
  analytics event for Guardian subagents.
  
  Previously, Guardian sessions were emitted as subagent
  thread-initialized events, but their `parent_thread_id` was serialized
  as `null`. After this change, the `codex_thread_initialized` analytics
  event for a Guardian child session includes the parent user conversation
  id.

  Won Park · 2026-04-10 06:25:05 +00:00
  4e910bf151
• Extract realtime input task handlers (#17280)

  Refactor the realtime input task select loop into named handlers for
  user text, background agent output, realtime server events, and user
  audio without changing the V2 behavior.
  
  Stack:
  - Depends on #17278 for the background_agent rename.
  
  Validation:
  - just fmt
  - cargo check -p codex-core
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-09 22:35:18 -07:00
  26a28afc6d
• Rename Realtime V2 tool to background_agent (#17278)

  Rename the Realtime V2 delegation tool and parser constant to
  background_agent, and update the tool description and fixtures to match.
  
  Validation: just fmt; cargo check -p codex-api; git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-09 22:17:55 -07:00
  60236e8c92