7750 Commits

This Branch

This Branch

All Branches

• Add MCP tool call error metrics (#28976)

  [Codex Thread
  019edc37-5345-7272-92c9-bf5494cf3819](https://codex-thread-link.openai.chatgpt-team.site/thread/019edc37-5345-7272-92c9-bf5494cf3819)
  
  ## Summary
  
  - count MCP `CallToolResult.isError` responses as failed calls instead
  of successful transport-level calls
  - add `codex.mcp.call.error` with bounded `error_type` and trusted
  plugin-service `error_code` dimensions
  - record the same error classification on MCP tool-call spans while
  keeping untrusted server error text out of metric labels
  
  ## Scope
  
  - no changes to MCP routing, retries, tool behavior, configuration, or
  public APIs
  - request failures remain grouped as `mcp_request`; separating
  connection, timeout, protocol, and JSON-RPC failures requires preserving
  typed errors through the existing flattened error boundary
  
  ## Testing
  
  - `just test -p codex-core 'mcp_tool_call::tests::'` (75 passed)
  - `just fix -p codex-core`
  - `just fmt`
  - `just test -p codex-core` (2,676 passed; 80 unrelated environment
  failures from missing test binaries, sandbox signals, and read-only
  paths)

  stevenlee-oai · 2026-06-23 13:33:23 -07:00
  cbcf1f8ca3
• core: use current step environments for tools (#29547)

  ## Why
  
  With deferred executors, an environment can become ready between two
  sampling requests in the same turn. The model-visible environment
  update, advertised tools, and eventual tool execution must all describe
  the same request-time view.
  
  Otherwise, a request built while only environment B is ready can
  advertise a tool without an `environment_id`; if higher-priority
  environment A becomes ready before execution, that call could silently
  run in A instead.
  
  This PR is stacked on #29527.
  
  ## Design
  
  `run_turn` captures one `Arc<StepContext>` at each sampling-request
  boundary. That step owns the request's `TurnContext` and environment
  snapshot.
  
  - World-state environment updates and tool planning borrow that same
  step.
  - `ToolCallRuntime` retains the `Arc` while asynchronous tool calls
  execute.
  - `ToolInvocation` carries the step to handlers; its temporary `turn`
  compatibility field is derived from the same object.
  - `ToolRouter` does not retain `StepContext`; it only uses it while
  constructing the request's tool set.
  - With `DeferredExecutor` disabled, step capture keeps using the
  environments frozen at turn start.
  
  Simply: every sampling request gets one consistent picture of its
  environments, from what the model sees through where its tool calls run.
  
  ## What changed
  
  - Build environment-dependent tool specs from the current request's
  `StepContext`.
  - Use that same step for unified exec, legacy shell, `apply_patch`,
  `view_image`, and `request_permissions` execution.
  - Hide environment-backed tools, including `request_permissions`, while
  no environment is attached.
  - Resolve legacy shell paths and metadata from the selected step
  environment instead of the stale turn-start environment.
  - Capture explicit steps at non-turn-loop boundaries such as compaction,
  prompt debug, and startup prewarm.
  - Reconcile prompt-debug history from the same step used to build its
  tools.
  
  ## Follow-up
  
  - Bind yielded code-mode cells to the tool runtime that created them, so
  nested calls made after yielding continue to use the originating
  request's `StepContext`.
  
  ## Test plan
  
  - `just test -p codex-core
  deferred_executor_updates_context_and_tools_after_startup`
  - `just test -p codex-core
  environment_count_controls_environment_backed_tools`
  - `just test -p codex-core
  build_prompt_input_includes_context_and_user_message`

  sayan-oai · 2026-06-23 20:21:13 +00:00
  4cc6a4bab5
• [codex] Fix stale approval policy in MCP test (#29704)

  ## Summary
  
  - replace the removed `AskForApproval::OnFailure` variant in the MCP
  shutdown test with `OnRequest`
  
  ## Why
  
  `OnFailure` was removed from `AskForApproval`, but this test fixture
  still referenced it, causing Rust and Clippy compilation failures.
  
  ## Validation
  
  - `just test -p codex-mcp shutdown_continues_after_caller_is_aborted`
  - `just fmt`

  Boyang Niu · 2026-06-23 13:18:50 -07:00
  7aab4b04bf
• [codex] Fix stale approval policy in MCP test (#29696)

  ## Summary
  
  - replace the stale `AskForApproval::OnFailure` reference in the MCP
  connection manager test with `AskForApproval::OnRequest`
  - restore `codex-mcp` test compilation after `OnFailure` was removed in
  #28418
  
  ## Root cause
  
  The test was added on main after the approval-policy removal branch had
  already updated the other references, so the newly added call site was
  missed when #28418 merged.
  
  ## Validation
  
  - `just test -p codex-mcp` (90 passed)
  - `just fmt`

  sayan-oai · 2026-06-23 19:56:20 +00:00
  00dc5ea397
• core: resolve view_image paths in selected environment (#29526)

  ## Why
  
  view_image needs to support foreign OS remote executors.
  
  ## What
  
  - resolve image paths against the selected environment as `PathUri` and
  read them through that environment's filesystem
  - keep app-server's public path field wire-compatible as
  `LegacyAppPathString`, with purpose-specific UI rendering
  - cover relative and absolute target-native paths in the core
  integration test and run the full `view_image` suite under wine-exec
  without skips

  Adam Perry @ OpenAI · 2026-06-23 19:52:37 +00:00
  510bce9927
• [codex] allow image generation with provider auth (#29513)

  ## Summary
  
  - allow the native Responses API `image_generation` tool when the active
  provider carries CCA's non-empty `x-openai-actor-authorization` header
  - preserve the Codex-managed ChatGPT auth path, scoped to providers that
  actually require OpenAI auth
  - keep generic custom providers excluded, including when unrelated
  ChatGPT credentials are cached
  - retain the existing feature, provider-capability, and
  image-input-modality gates
  
  ## Why
  
  CCA authenticates its inference requests through the active provider's
  `x-openai-actor-authorization` and `ChatGPT-Account-ID` headers, so it
  does not have a Codex-managed login session. The previous gate therefore
  hid the native hosted image-generation tool despite an authenticated
  codex-backend path.
  
  This change is intentionally limited to the native hosted tool. It adds
  no extension, MCP, plugin-service, session-source, token plumbing, or
  new provider configuration surface.
  
  ## Tests
  
  - `cargo test -p codex-core
  hosted_tools_follow_provider_auth_model_and_config_gates`
  - `cargo fmt --all -- --check`
  - `git diff --check origin/main`

  richardopenai · 2026-06-23 12:40:54 -07:00
  c660e2b644
• [codex] Preserve proxy state for filesystem sandbox helpers (#29671)

  ## Why
  
  Filesystem helpers intentionally run with a minimal environment that
  excludes proxy variables. After filesystem operations started using the
  Windows sandbox wrapper, the wrapper derived an empty proxy
  configuration from that helper environment and compared it with the
  persistent sandbox setup marker. When the marker contained proxy ports,
  every filesystem operation appeared to require a firewall update, which
  could launch elevated setup, show a UAC or loader dialog, and fail
  operations such as `apply_patch` with error 1223.
  
  Filesystem helpers do not use network access, so they should preserve
  the proxy/firewall state established by normal sandboxed process
  launches.
  
  ## What changed
  
  - Add an explicit Windows sandbox proxy-settings mode for reconciling or
  preserving persistent proxy state.
  - Use preserve mode for filesystem helpers while normal process launches
  continue to reconcile proxy settings from their environment.
  - Carry the selected proxy state consistently through setup validation,
  elevated setup, and non-elevated ACL refreshes.
  - Cover wrapper argument propagation and marker-derived proxy
  preservation.
  
  ## Validation
  
  - `cargo build -p codex-cli --bin codex`
  - `just test -p codex-windows-sandbox
  preserving_proxy_settings_uses_the_existing_marker`
  - `just test -p codex-windows-sandbox windows_wrapper_args_round_trip`
  - `just test -p codex-windows-sandbox
  setup_request_prefers_explicit_proxy_settings`
  - `just test -p codex-sandboxing transform_for_direct_spawn_windows`
  - `just test -p codex-exec-server fs_sandbox::tests`
  - Ran the same sandboxed `fs/writeFile` reproduction against published
  `0.142.0-alpha.6` and the new CLI. The published CLI launched elevated
  setup and failed with `ShellExecuteExW ... 1223`; the new CLI completed
  without elevation.
  
  Related to #28359.

  iceweasel-oai · 2026-06-23 12:29:46 -07:00
  18fe1d9fe3
• Separate local and remote plugin analytics IDs (#29495)

  ## Why
  
  Plugin analytics overloaded `plugin_id`: most events used the Codex
  `<plugin>@<marketplace>` identity, while remote install events used the
  backend plugin ID. That makes the same field change meaning across event
  types and complicates downstream identity resolution.
  
  This change makes the contract unambiguous:
  
  - `plugin_id`: the local Codex `<plugin>@<marketplace>` identity, when
  resolved
  - `remote_plugin_id`: the backend plugin identity, when available
  
  For a remote install failure that happens before plugin details resolve,
  `plugin_id` is `null` and `remote_plugin_id` remains populated.
  
  ## What changed
  
  All six plugin analytics events use the same identity contract:
  
  - `codex_plugin_installed`
  - `codex_plugin_install_failed`
  - `codex_plugin_uninstalled`
  - `codex_plugin_enabled`
  - `codex_plugin_disabled`
  - `codex_plugin_used`
  
  Remote identity is resolved from the current installed-plugin snapshot
  first, with persisted install metadata as fallback. The telemetry
  metadata type keeps local identity optional for failures that occur
  before remote details are available.
  
  The app-server test client's manual analytics smokes now find remote
  mutation events through `remote_plugin_id` and validate that `plugin_id`
  remains local.
  
  ## Remote uninstall
  
  Resolve and capture telemetry metadata before removing the local plugin
  cache, then emit `codex_plugin_uninstalled` after the backend confirms
  success. The event is also emitted when backend uninstall succeeds but
  local cache cleanup reports `CacheRemove`.
  
  If a concurrent remote-cache refresh removes the local bundle before
  telemetry capture, the already-fetched remote plugin detail supplies
  fallback capability metadata.
  
  ## Validation
  
  - `just test -p codex-analytics` — 82 passed
  - `just test -p codex-core-plugins` — 271 passed
  - `just test -p codex-app-server-test-client` — 5 passed
  - `just test -p codex-plugin` — 3 passed
  - `just test -p codex-app-server plugin_install` — 37 passed
  - `just test -p codex-app-server plugin_uninstall` — 10 passed
  
  The production app-server install/uninstall flow was also exercised
  against `plugins~Plugin_f1b845ac33888191ac156169c58733c2`
  (`build-ios-apps@openai-curated-remote`), and the plugin's original
  uninstalled state was restored.

  jameswt-oai · 2026-06-23 12:27:14 -07:00
  ff50b47dce
• Keep managed MITM CA private keys in proxy memory (#29013)

  ## Why
  
  The managed MITM trust bundle must be readable by sandboxed commands.
  Persisting its sibling CA private key under `$CODEX_HOME/proxy`
  therefore requires a deny-read sandbox rule, but the Windows unelevated
  backend rejects deny-read paths and WSL1's legacy Landlock path cannot
  enforce that rule.
  
  A persistent OS credential store also does not provide the same
  cross-platform boundary from other processes running as the same user.
  Keeping the signer inside the network proxy process avoids both
  problems: ordinary sandbox setup stays independent of CA-key state, and
  no private signing key is exposed through the filesystem or a persistent
  credential record.
  
  ## What
  
  - generate one managed CA per proxy process and retain its private
  signer only in proxy memory
  - emit only content-addressed public CA certificates and trust bundles
  under `$CODEX_HOME/proxy`
  - hold a cross-process lease for each active public certificate and
  prune artifacts from inactive proxy processes
  - keep all CA ownership in `codex-network-proxy`; no `codex-core` or
  sandbox-policy changes
  - validate generated trust-bundle paths by their content hash
  - keep the public bundle readable by sandboxed commands on Windows,
  WSL1, macOS, and Linux
  
  The independent startup custom-CA follow-up is #29014.
  
  ## Validation
  
  - `CODEX_HOME=/private/tmp/codex-test-home-network-proxy just test -p
  codex-network-proxy` (179 tests)
  - `just bazel-lock-check`
  - `just fix -p codex-network-proxy`
  - `just fmt`
  
  ---------
  
  Co-authored-by: viyatb-oai <viyatb@openai.com>

  Winston Howes · 2026-06-23 12:20:51 -07:00
  c5a9a95ab6
• core: add extra metadata field to Thread struct (#29675)

  # Summary
  
  Adds a field Thread.extras that can be used to hold arbitrary metadata
  specific to a given thread.

  Boyang Niu · 2026-06-23 19:15:59 +00:00
  354807920e
• chore(core) rm AskForApproval::OnFailure (#28418)

  ## Summary
  Deletes the OnFailure variant of the `AskForApproval` enum. This option
  has been deprecated since #11631.
  
  ## Testing
  - [x] Tests pass

  Dylan Hurd · 2026-06-23 12:13:54 -07:00
  2cf2a6a844
• Prepare managed network sandbox context (#29456)

  ## Why
  
  Managed network configures commands to use local HTTP and SOCKS proxies.
  For commands delegated to the exec server, the proxy environment and the
  sandbox policy were prepared separately. On macOS, that meant a command
  could receive `HTTPS_PROXY=http://127.0.0.1:43123` while Seatbelt still
  denied access to port `43123`.
  
  ## What changed
  
  `NetworkProxy` now prepares the command environment and sandbox context
  together from the same runtime snapshot:
  
  ```text
  Prepared managed network
  ├── command environment: HTTPS_PROXY=http://127.0.0.1:43123
  └── sandbox context: allow outbound to 127.0.0.1:43123
  ```
  
  That context travels with remote exec requests. The exec server
  preserves the managed proxy and CA environment, and macOS Seatbelt
  allows only the prepared loopback proxy ports without enabling broad
  network access or local binding.
  
  The protocol field is optional and the existing enforcement flag remains
  in place, preserving compatibility with callers that do not send the new
  context.

  jif · 2026-06-23 20:07:09 +01:00
  e476fc16ce
• app-server: document thread and turn IDs are UUID7 (#27714)

  It's actually a very nice property that these are UUID7s, so documenting
  them so we think twice before changing it away from UUID7s in the
  future.

  Owen Lin · 2026-06-23 11:46:36 -07:00
  8d80b0176a
• Revert "Handle additional tools in rollout persistence metrics" (#29680)

  Reverts openai/codex#29669

  Rasmus Rygaard · 2026-06-23 18:35:54 +00:00
  d69828e18b
• Handle additional tools in rollout persistence metrics (#29669)

  ## Why
  
  The rollout persistence metrics added on current `main` exhaustively
  match `ResponseItem`, but omit `ResponseItem::AdditionalTools`. That
  prevents `codex-rollout` and downstream targets from compiling across
  Cargo and Bazel builds.
  
  ## What
  
  Map `ResponseItem::AdditionalTools` to the `response.additional_tools`
  metric label, consistent with the existing exact-variant labels.
  
  ## Validation
  
  - `just test -p codex-rollout` (76 passed)
  - `just fix -p codex-rollout`

  Winston Howes · 2026-06-23 11:06:07 -07:00
  b539e3e72b
• [codex] Handle additional tools in rollout persistence metrics (#29672)

  ## Summary
  
  Handle `ResponseItem::AdditionalTools` in rollout persistence metrics.
  
  The persistence metrics match was added after the `AdditionalTools`
  variant and omitted it, causing release builds to fail with a
  non-exhaustive pattern error. This assigns the item the
  `response.additional_tools` metrics label.
  
  Release failure:
  https://github.com/openai/codex/actions/runs/28043786727/job/83016608475
  
  ## Validation
  
  - `just fmt`
  - `just test -p codex-rollout` (76 passed)

  rka-oai · 2026-06-23 18:03:35 +00:00
  39ee1b96b0
• core: use turn-owned world state for inline compaction (#29527)

  ## Why
  
  Follow-up to #29249 and its [compaction review
  thread](https://github.com/openai/codex/pull/29249#discussion_r3455055101).
  
  During a turn, environment readiness can change between sampling
  requests. Inline compaction must render the same model-visible
  `WorldState` used by the request it follows. Rebuilding that state
  during compaction can observe a newer environment, make replacement
  history disagree with what the model saw, and suppress the next
  environment update.
  
  ## What changed
  
  - Make `run_turn` own the current `Arc<WorldState>` and replace it only
  between sampling requests.
  - Build each state from an explicitly chosen environment snapshot, diff
  deferred-executor steps against the turn-owned state, and retain the
  latest state in `ContextManager` only for cross-turn and resume
  tracking.
  - Pass the exact turn-owned state into inline compaction and explicit
  new-context-window replacement.
  - Carry that state with
  `InitialContextInjection::BeforeLastUserMessage`, so replacement context
  and its stored baseline cannot come from different snapshots.
  - Remove obsolete state-recapture helpers and ambiguous TurnContext-only
  WorldState builders.
  - Add an integration test that moves an environment from starting to
  ready during a paused turn, triggers compaction, and verifies the next
  request receives the readiness update exactly once.
  
  ## Test plan
  
  - `just test -p codex-core
  deferred_executor_compaction_preserves_then_updates_environment_once`
  - `just test -p codex-core process_compacted_history`
  - `just test -p codex-core mid_turn_continuation_compaction`
  - `just test -p codex-core build_initial_context`
  - `just test -p codex-core
  ignores_session_prefix_messages_when_truncating`

  sayan-oai · 2026-06-23 10:33:19 -07:00
  d1d11cac05
• Shut down superseded MCP managers on refresh (#29608)

  ## Summary
  
  MCP refresh replaced the published connection manager without shutting
  down the manager it superseded. If another task retained that old
  manager, its stdio MCP processes stayed alive and accumulated across
  refreshes.
  
  Atomically swap in the refreshed manager, then explicitly shut down the
  exact manager returned by the swap. Add a process-level regression test
  that retains the old manager during refresh and verifies its stdio
  process exits while the replacement remains available.
  
  ## Context
  
  Explicit cleanup was lost when manager publication moved to `ArcSwap`.
  Dropping the old manager is not a reliable shutdown boundary because
  active callers can retain its `Arc` and underlying client process
  handles.

  jif · 2026-06-23 18:29:27 +01:00
  8751fd3fcb
• [core] debounce current-time reminders by elapsed time (#29659)

  ## Summary
  - rename `reminder_interval_model_requests` to
  `reminder_interval_seconds`
  - read the configured time provider before every model request and
  inject a reminder only after the configured number of seconds has
  elapsed
  - preserve immediate first delivery and forced delivery after compaction
  changes the context window
  
  ## Tests
  - `just test -p codex-core current_time_reminder`

  rka-oai · 2026-06-23 10:13:27 -07:00
  9fe689783d
• [codex] Instrument rollout persistence bytes (#29498)

  - Add 1%-sampled rollout persistence metrics that report per-item and
  per-thread JSON byte totals before and after filtering when metrics
  export is enabled.
  - Tag each item with its exact response or event variant, including
  nested turn-item kinds for conditionally persisted completion events, so
  aggregate cloud-storage impact can be estimated by policy choice.

  Tom · 2026-06-23 09:26:30 -07:00
  02c326f646
• Update vulnerable Hono and fast-uri dependencies (#29650)

  ## Summary
  
  - Pin `hono` to 4.12.25, the first patched release for the recent Hono
  security advisories.
  - Pin `fast-uri` to 3.1.1 to fix the percent-encoded path traversal
  vulnerability.
  - Refresh `pnpm-lock.yaml` with only those dependency updates.
  
  `hono` 4.12.25 is used instead of the newer 4.12.27 because the
  repository requires dependencies to be at least seven days old.

  jif · 2026-06-23 16:19:19 +01:00
  c553cea9ea
• Update rmcp to 1.8.0 (#29634)

  ## Summary
  
  - Update `rmcp` and `rmcp-macros` from 1.7.0 to 1.8.0.
  - Adapt to the new shared `peer_info` return type.
  - Box OAuth status discovery at the MCP boundary to keep the expanded
  future type from overflowing Rust's trait recursion limit.
  
  This brings in custom OAuth HTTP client support from
  [modelcontextprotocol/rust-sdk#908](https://github.com/modelcontextprotocol/rust-sdk/pull/908).

  jif · 2026-06-23 15:25:28 +01:00
  bbe1006890
• Share resumed rollout history (#28426)

  ## Summary
  
  Resuming a persisted thread currently deep-clones its complete rollout
  history several times. `InitialHistory` is retained for the app-server
  response, copied into thread persistence, and copied again by read-only
  accessors. These copies scale with the complete rollout rather than the
  bounded model context and add measurable latency for large sessions.
  
  This change stores resumed rollout history in `Arc<Vec<RolloutItem>>`.
  Rollout loading wraps the parsed vector once, while app-server response
  construction, session initialization, and thread persistence share it
  through inexpensive `Arc` clones. Read-only history access now returns a
  borrowed slice, and fork paths use `Arc::unwrap_or_clone` where they
  genuinely need mutable ownership. Rollout reconstruction also consumes
  its temporary context instead of cloning the reconstructed model
  history.
  
  The serialized representation remains unchanged. In an artificial 123 MB
  rollout benchmark, sharing resumed history reduced cold resume latency
  by roughly 9–10%. The affected crates compile with their test targets,
  all 80 thread-store tests pass, and the Bazel dependency lock remains
  valid.

  Charlie Marsh · 2026-06-23 10:23:25 -04:00
  330ae6a516
• path-uri: add lexical containment (#29614)

  ## Why
  
  Executor-owned paths must stay portable while the orchestrator reasons
  about them. Converting a Windows or remote path to the orchestrator
  host's native path just to check containment breaks that boundary.
  
  ## What changed
  
  - Add lexical containment to `PathUri`.
  - Compare URI authorities and complete path segments, so `plugin-other`
  is not treated as a child of `plugin`.
  - Fail closed for encoded path separators and opaque fallback URIs.
  
  For example:
  
  ```text
  file:///C:/plugins/foo/assets/icon.svg
    is below file:///C:/plugins/foo
  
  file:///C:/plugins/foo2/icon.svg
    is not below file:///C:/plugins/foo
  ```
  
  This is the shared foundation for keeping executor-owned plugin
  resources URI-native without consulting the orchestrator filesystem.

  jif · 2026-06-23 14:59:39 +01:00
  4147824509
• Namespace multi-agent v2 tools under collaboration (#29067)

  ## Summary
  
  Multi-agent v2 tools now use the fixed `collaboration` namespace when
  namespace tools are available. This keeps the model-visible hint and the
  actual tool surface aligned around `functions.collaboration.*`, without
  exposing an unshipped namespace knob to users.
  
  The PR also removes the old `features.multi_agent_v2.tool_namespace`
  config/schema surface, updates the MAv2 test fixtures for namespaced
  calls, and fixes stale `TurnContext.features` references that were
  breaking `codex-core` builds.
  
  ## Changes
  
  - Expose MAv2 tools under `collaboration` instead of relying on a
  configurable namespace.
  - Remove `tool_namespace` from MAv2 TOML config, resolved config,
  validation, schema, and tests.
  - Update tool-planning and integration fixtures to assert or emit
  namespaced MAv2 tool calls.
  - Read feature state through `TurnContext.config.features` in the
  multi-agent mode context paths.
  
  ## Testing
  
  - `just write-config-schema`
  - `just test -p codex-features`

  jif · 2026-06-23 14:15:20 +02:00
  49614a0391
• Fix Codex Apps auth elicitation hang (#29615)

  ## Summary
  - Require the reserved Codex Apps MCP server name to be present in the
  connection manager before treating it as host-owned.
  - Update auth elicitation tests to model an installed host-owned Codex
  Apps server without sending startup events to the test session.
  
  ## Why
  PR #29518 replaced the old host-owned flag with a name-only check. That
  made non-host-owned tests with the reserved codex_apps name enter auth
  elicitation and wait forever for a response.

  jif · 2026-06-23 13:45:42 +02:00
  55bc38a22b
• Stop persisting bridged log events (#29599)

  ## Why
  
  The 0.142.0 persistent-log filter disables target=log, but bridged log
  records are filtered using their original dependency target before
  tracing-log emits them as target=log. This allowed high-volume
  dependency TRACE events to keep reaching SQLite.
  
  This is a follow-up to #28224.
  
  ## What changed
  
  - Reject bridged target=log events inside the SQLite sink before
  formatting or queueing them.

  jif · 2026-06-23 12:18:25 +02:00
  63f8f547c0
• Allow codex sandbox to consume MCP sandbox state (#29358)

  ## Summary
  
  - let `codex sandbox` accept the JSON value from
  `codex/sandbox-state-meta`
  - require the payload `permissionProfile` instead of falling back to
  ambient permissions
  - reuse the existing macOS, Linux, and Windows launch paths, treating
  external sandbox state conservatively as read-only
  - let opaque forwarders add runtime read roots and disable direct
  network access without decoding the payload
  
  Builds on #29113, which is now on `main`.
  
  ## Tests
  
  - `just test -p codex-cli debug_sandbox::tests`
  - `cargo build -p codex-rmcp-client --bin test_stdio_server`
  - `just test -p codex-core
  stdio_mcp_tool_call_includes_sandbox_state_meta`
  - `just test -p codex-mcp`
  - `just fmt`

  jif · 2026-06-23 10:17:52 +02:00
  d2484697b1
• Group Codex Apps client setup (#29583)

  ## Why
  
  `McpConnectionManager::new` classified the Codex Apps server twice: once
  to create its tools cache context and again to select its runtime
  authentication provider. Keeping those decisions separate makes it
  harder to see that they belong to the same server-specific setup path.
  
  ## What changed
  
  - Group Codex Apps cache and authentication setup under one explicit
  branch.
  - Keep regular MCP server setup in the corresponding `else` branch.
  - Limit environment bearer-token inspection to the Codex Apps path where
  it affects runtime authentication.

  Ahmed Ibrahim · 2026-06-23 00:53:17 -07:00
  266dcbfe5b
• Remove redundant Codex Apps cache guard (#29575)

  ## Why
  
  Codex Apps cache writes are already restricted to Codex Apps call paths:
  startup invokes the helper only from the Codex Apps branch, and hard
  refresh operates on the reserved Codex Apps server directly. Rechecking
  the server name inside the cache helper duplicates that classification
  and leaves the helper with an argument that cannot change valid
  behavior.
  
  ## What changed
  
  - Remove the redundant server-name check and parameter from the cache
  writer.
  - Rename the helper to `write_codex_apps_tools_cache` to reflect its
  narrower contract.
  - Update production and test callsites to use the simplified API.

  Ahmed Ibrahim · 2026-06-23 00:31:56 -07:00
  83c4934e45
• Handle additional tools in image URL validation (#29577)

  ## Why
  
  `ResponseItem::AdditionalTools` was added without updating app-server
  image URL validation. The exhaustive match therefore prevents app-server
  and downstream targets from compiling on `main`.
  
  ## What changed
  
  Treat `AdditionalTools` like the other response items that cannot
  contain input-image URLs.

  Ahmed Ibrahim · 2026-06-23 00:20:23 -07:00
  6e0c8b4517
• Centralize Codex Apps client handling (#29528)

  ## Why
  
  Codex Apps-specific behavior is currently distributed across cache
  helpers, startup, tool conversion, and model-visible annotation. Each
  layer independently checks the reserved server name, which obscures the
  boundary between trusted host-owned connector metadata and regular MCP
  server data.
  
  Classifying the server once when `AsyncManagedClient` is created gives
  the client a single source of truth and makes the two processing paths
  explicit.
  
  ## What changed
  
  - Record whether an `AsyncManagedClient` represents the Codex Apps
  server at construction time.
  - Route startup cache loading, cache persistence, and cache telemetry
  through the Codex Apps branch.
  - Split uncached tool conversion between Codex Apps normalization and
  regular MCP metadata sanitization.
  - Split model-visible schema and plugin provenance handling along the
  same boundary.
  - Remove redundant server-name guards from helpers that are now called
  only from the Codex Apps branch.
  
  ## Verification
  
  - Preserve behavioral coverage that verifies Codex Apps connector
  metadata and the complete converted `ToolInfo` shape.
  
  ## Stack
  
  Depends on #29518.

  Ahmed Ibrahim · 2026-06-23 00:00:25 -07:00
  f0ad028a74
• [codex] Use input items for Responses Lite tools (#27946)

  When using Responses Lite, we should all use `additional_tools` and a
  developer item instead of the top level tools array & instructions
  field. This keeps things 1-to-1.
  
  Forced namespacing for _all_ tools will land in a following PR after
  some coordination & fixes in Responses API (around collisions & return
  items).
  
  The goal is to eventually expand the scope of this to _all_ requests
  from codex, but that will require larger coordination across providers &
  slower rollout.

  rka-oai · 2026-06-22 23:56:16 -07:00
  33cc928d33
• Remove redundant Codex Apps manager flag (#29518)

  ## Why
  
  Codex Apps server admission is already decided before
  `McpConnectionManager` is constructed. `effective_mcp_servers` and
  `effective_mcp_servers_from_configured` remove the server when the apps
  feature or required authentication is unavailable, so storing the same
  decision on the manager duplicates state that can drift from the
  effective server map.
  
  ## What changed
  
  - Remove `host_owned_codex_apps_enabled` from `McpConnectionManager` and
  its constructor.
  - Identify the host-owned Codex Apps server by its reserved server name
  once it is present in the effective server map.
  - Remove the now-unused flag calculations and constructor arguments from
  production and test callsites.

  Ahmed Ibrahim · 2026-06-22 23:19:42 -07:00
  a22e3d0b82
• [codex] stylistic changes (#29068)

  ## Summary
  
  - express remote compaction result handling as an exhaustive match
  - preserve the special `TurnAborted` path without emitting a generic
  compaction error
  - rely on the standard `test_codex` provider setup in the compaction
  budget test
  
  Follow-up to review feedback on #28707.
  
  ## Testing
  
  - `just test -p codex-core
  compaction_budget_exhaustion_aborts_without_error_or_retry`
  - `just fmt`

  rka-oai · 2026-06-22 23:17:12 -07:00
  802c98cab4
• [codex] Expose service tier and reasoning effort in OTEL (#29155)

  ## Summary
  
  NVIDIA asked to measure Fast mode usage and reasoning effort from Codex
  CLI OTEL logs. Add the finalized `service_tier` and
  `model_reasoning_effort` to the existing `codex.sse_event`
  `response.completed` record.
  
  This intentionally reuses the existing completion event and leaves
  transport APIs and shared telemetry plumbing unchanged.
  
  ## Testing
  
  - `cargo build -p codex-cli --bin codex`
  - `just test -p codex-core responses_api_emits_api_request_event`
  - End-to-end with the built CLI and a local OTLP/HTTP collector:
  - Fast/high emitted `service_tier=priority` and
  `model_reasoning_effort=high` with token usage.
  - Standard/low omitted `service_tier` and emitted
  `model_reasoning_effort=low` with token usage.

  daniel-oai · 2026-06-22 20:44:48 -07:00
  e0ac5d3c15
• [codex] Reject unlowered PowerShell AST regions (#24092)

  ## Why
  
  On Windows, Codex uses a PowerShell safe-command classifier to decide
  whether a command is read-only enough to run without additional
  approval. The classifier lowers `EndBlock.Statements` into argv-like
  command words and checks those words against a safelist.
  
  PowerShell can execute code stored elsewhere in the AST. Parameter
  defaults, named blocks, `using` preambles, and top-level `trap` handlers
  are not represented in the lowered statement list. Ignoring those
  regions can make a side-effecting script look like a read-only command.
  
  ## What
  
  Fail closed whenever a PowerShell script contains executable AST content
  that the current lowering does not represent.
  
  ## How
  
  - Return `unsupported` for parameter, dynamic-parameter, begin, process,
  and clean blocks.
  - Return `unsupported` for `using module` and `using assembly`
  preambles.
  - Return `unsupported` for non-empty `EndBlock.Traps` collections.
  - Preserve compatibility with Windows PowerShell 5.1 by looking up
  `CleanBlock` dynamically.
  - Treat `unsupported` as a failure to prove that the command is safe,
  routing it through the normal approval path.
  - Add parser-level and end-to-end regressions for parameter blocks,
  named blocks, using statements, and trap handlers.
  
  This does not make these PowerShell forms invalid or prevent them from
  running. It prevents automatic safe-command approval when the classifier
  cannot account for all executable behavior.
  
  ## Testing
  
  - `just test -p codex-shell-command`
  - Windows CI exercises the parser and end-to-end safe-command
  regressions against a real PowerShell installation.
  
  ---------
  
  Co-authored-by: viyatb-oai <viyatb@openai.com>

  Chris Bookholt · 2026-06-23 03:09:20 +00:00
  27f22b54ae
• Propagate safety buffering treatment metadata (#29473)

  ## Summary
  
  - read the request-scoped safety-buffering treatment from HTTP response
  headers and per-turn WebSocket metadata through one shared header parser
  - combine that treatment with Responses API safety-buffering signals
  - propagate `showBufferingUi` and nullable `fasterModel` through the
  existing `model/safetyBuffering/updated` app-server notification
  - update the app-server documentation and generated JSON and TypeScript
  schemas
  
  The public implementation contains no model mapping or real model
  identifier. Tests and protocol examples use generic `current-model` and
  `faster-model` placeholders only.
  
  ## Dependencies
  
  - server-side treatment evaluation:
  https://github.com/openai/openai/pull/1060247
  - initial Responses API safety-buffering propagation:
  https://github.com/openai/codex/pull/29371
  - Codex App UI: https://github.com/openai/openai/pull/1057789
  
  ## Validation
  
  - Codex API tests: 129 passed
  - focused Codex core safety-buffering integration test passed
  - app-server protocol tests passed after regenerating schema fixtures
  - Clippy fix and repository formatting completed successfully
  
  The broader app-server run compiled all changed crates and completed
  with 1,269 passing tests. Its remaining failures were unrelated
  environment limitations: macOS sandbox application was denied, one
  expected test binary was unavailable, and several existing subprocess
  tests timed out as a result.

  Francis Chalissery · 2026-06-22 19:51:03 -07:00
  7c22d376e5
• mcp: accept foreign absolute cwd for remote stdio (#29493)

  ## Why
  
  Remote stdio MCP servers can run in an environment whose path convention
  differs from the Codex host. A Windows cwd such as
  `C:\Users\openai\share` is absolute for the executor but was rejected by
  a POSIX orchestrator.
  
  Built on #29501, now merged, which only clarifies the host-native
  `PathUri` constructor name.
  
  ## What changed
  
  - Deserialize MCP cwd values as `LegacyAppPathString` so config does not
  apply host path rules.
  - Interpret that spelling as host-native for local launches and convert
  it to `PathUri` at executor launch.
  - Skip host filesystem and command resolution checks for remote stdio in
  `codex doctor`.
  - Add host-independent config and executor-boundary coverage using the
  foreign path convention for each test platform.
  
  ## Validation
  
  - `just test -p codex-utils-path-uri -p codex-config -p codex-mcp -p
  codex-rmcp-client` (408 passed)
  - `just test -p codex-cli -p codex-rmcp-client` (372 passed)
  - `cargo check --workspace --tests`
  - `just test` (11,311 passed; 43 unrelated environment/timing failures)
  - `just fix -p codex-cli -p codex-config -p codex-core -p codex-mcp -p
  codex-mcp-extension -p codex-rmcp-client -p codex-tui`

  Adam Perry @ OpenAI · 2026-06-23 01:33:51 +00:00
  67009bc53f
• chore: warn when Code Mode lacks model metadata (#29490)
  Celia Chen · 2026-06-23 01:15:11 +00:00
  3310fc8ae5
• PAC 4 - Add macOS system proxy resolver (#26709)

  ## Summary
  
  Stacked on #26708.
  
  Adds the macOS implementation of the shared system-proxy contract. This
  allows Codex-owned auth clients to use the route macOS selects for each
  auth URL through SystemConfiguration and CFNetwork, including PAC and
  WPAD results.
  
  The `respect_system_proxy` feature is disabled by default, so existing
  client behavior remains unchanged unless explicitly enabled.
  
  ## Implementation
  
  - Adds the macOS-only `system-configuration` dependency to
  `codex-client`.
  - Dispatches system-proxy resolution to `outbound_proxy/macos.rs` on
  macOS.
  - Reads system proxy settings from `SCDynamicStore` and resolves the
  target URL with `CFNetworkCopyProxiesForURL`.
  - Executes PAC URLs and inline PAC JavaScript through a bounded run loop
  with a five-second timeout.
  - Handles `DIRECT`, HTTP proxies, and CFNetwork HTTPS entries using HTTP
  CONNECT; unsupported SOCKS entries map to `UnsupportedProxyScheme`.
  - Builds concrete proxy URLs from host and port entries, including IPv6
  host bracketing.
  - Maps results into the shared `SystemProxyDecision::{Direct, Proxy,
  Unavailable}` contract.
  - Hashes URL-specific cache keys so PAC decisions remain distinct
  without retaining raw request URLs or query strings.
  
  ## End-user behavior
  
  - Disabled/default: existing client behavior is unchanged.
  - Enabled with `[features.respect_system_proxy]`:
    - macOS auth clients honor system proxy configuration, PAC, and WPAD;
    - valid OS/PAC `DIRECT` decisions use a direct connection;
  - unavailable system resolution falls back to explicit environment proxy
  variables, then `DIRECT`, through the shared contract from #26707.
  - Unsupported proxy schemes are not silently translated into another
  route.
  - Custom CA handling remains separate from proxy selection.
  - Known limitation: only the first supported system/PAC candidate is
  used. Subsequent proxy or `DIRECT` candidates are not attempted after a
  connection failure. This matches the current Windows behavior and leaves
  room for future ordered-fallback support.
  
  ## Tests
  
  - `just test -p codex-client` — 34 tests passed.
  - `just clippy -p codex-client`
  - `just fmt`
  - `just bazel-lock-check`

  canvrno-oai · 2026-06-22 17:56:04 -07:00
  b16d2858f5
• Make formatter output quiet on success (#29467)

  ## Why
  
  `just fmt` is quite noisy even on successful runs.
  
  ## What
  
  Only print output when a formatter fails.
  
  - Buffer output from each formatter and print only a failed command and
  its diagnostics.
  - Prefix the `justfile` driver invocations with `@` so Just does not
  echo the command itself.
  - Retain rustfmt stderr on failure and cover silent-success and
  failure-reporting behavior.
  
  ## Validation
  
  - Confirmed `just fmt` and `just fmt-check` both exit successfully with
  empty stdout and stderr.

  Adam Perry @ OpenAI · 2026-06-23 00:55:49 +00:00
  ff31ba8d0a
• chore: improve expired Bedrock credential errors (#28992)

  ## Why
  
  Amazon Bedrock returns a `401 Unauthorized` response containing
  `Signature expired:` when an AWS credential, including a short-lived
  `AWS_BEARER_TOKEN_BEDROCK`, has expired. Codex currently surfaces that
  response as a generic `unexpected status` error, which does not explain
  how to recover.
  
  Environment-provided bearer tokens cannot be refreshed automatically, so
  the error should direct users to refresh their AWS credentials or
  replace or remove the environment token and restart Codex. This
  classification belongs to the Amazon Bedrock provider so similar
  responses from other providers retain their existing behavior.
  
  ## What changed
  
  - Add a synchronous `ModelProvider::map_api_error` hook that defaults to
  the existing provider-neutral API error mapping, and route model
  request, stream, WebSocket, and terminal unauthorized errors through the
  active provider.
  - Override the hook for Amazon Bedrock. After preserving the structured
  status, body, URL, and request metadata, recognize `401` responses
  containing `Signature expired:` and attach actionable credential
  guidance.
  - Keep `codex-protocol` provider-neutral by representing the guidance as
  an optional `user_message`. Error rendering prefers this message while
  continuing to append the URL, request ID, Cloudflare ray, and
  authorization diagnostics.
  - Add model-provider coverage for expired signatures and negative cases,
  core coverage for provider dispatch after unauthorized recovery, and a
  TUI snapshot for the rendered error.
  
  ## Testing
  Tested with a real request with expired bedrock key:
  <img width="962" height="126" alt="Screenshot 2026-06-22 at 3 56 51 PM"
  src="https://github.com/user-attachments/assets/7e21cc7c-798e-4662-8467-7f304a2f2b59"
  />

  Celia Chen · 2026-06-23 00:53:09 +00:00
  e65e480e0d
• [codex] reject remote images at app-server ingress (#29419)

  ## Stack
  
  Stacked on #29417. Review and land that PR first.
  
  ## Summary
  
  - reject HTTP(S) image URLs in the handlers for `turn/start` and
  `turn/steer`
  - validate `thread/inject_items` after its existing
  JSON-to-`ResponseItem` conversion, so each item is deserialized once
  - turn invalid dynamic-tool image responses into the existing
  unsuccessful text fallback; the model receives the validation message as
  the function output
  - leave `thread/resume.history` compatible with legacy history; #29417
  replaces remote images before model input
  - continue accepting inline data URLs and `localImage` inputs
  - keep this policy in app-server; this PR does not add a shared protocol
  API or change core image preparation
  
  ## Test plan
  
  - `just test -p codex-app-server -E
  'test(/request_handlers_reject_remote_image_urls|dynamic_tool_remote_image_response_becomes_model_visible_error|dynamic_tool_call_round_trip_sends_content_items_to_model|turn_start_tracks_turn_event_analytics|standalone_image_edit_uses_recent_pathless_image/)'`
  (5 passed)
  - `just fix -p codex-app-server`
  - `just fmt`

  rka-oai · 2026-06-23 00:43:56 +00:00
  b294638bb5
• TUI Plugin Sharing 4 - cover remote plugin catalog flows (#26704)

  Remote plugin catalogs now span workspace, shared, and local sources, so
  their TUI behavior needs focused regression coverage across loading,
  navigation, actions, and refreshes.
  
  This PR:
  
  - Covers product labels and rendered loading/error states for Workspace,
  Shared with me, Shared with me (link), and Local tabs, including tab
  persistence across refresh and detail navigation.
  - Covers remote/local deduplication, Installed-tab remote detail
  routing, marketplace load-error handling, and disabled install/uninstall
  navigation.
  - Adds a full detail snapshot for local shared-plugin metadata plus
  focused snapshots for marketplace labels and admin-disabled status.
  - Verifies shared plugins remain eligible for mentions and successful
  uninstalls trigger a catalog refresh.

  canvrno-oai · 2026-06-22 17:31:14 -07:00
  fbd575ab4a
• fix: world state response item test (#29504)

  seems to be a merge conflict on main:
  
  > pakrym-oai introduced the stale initializer in commit 3b32d861c5, PR
  #29249.
  > Context: Owen Lin renamed metadata to
  internal_chat_message_metadata_passthrough in PR #28968. PR #29249 then
  landed afterward with the old field name, causing the compile/Clippy
  failure.

  Celia Chen · 2026-06-23 00:19:03 +00:00
  97dc6abb11
• path-uri: clarify host-native path conversion (#29501)

  ## Why
  
  Downstream refactors are producing confusing code with this
  functionality having a very generic name. Encoding the specific
  conversion approach in the method name makes it clearer.
  
  ## What
  
  Rename `PathUri::from_path` to `PathUri::from_host_native_path` and
  update its Rust call sites.

  Adam Perry @ OpenAI · 2026-06-23 00:02:33 +00:00
  11fab432be
• [codex] Use tool search for MCP tools by default (#29486)

  ## Why
  
  MCP tools were only placed behind `tool_search` when a feature flag was
  enabled or when there were at least 100 tools. That made the model's
  tool flow depend on both rollout configuration and the number of
  installed tools.
  
  The searched-tool flow is now the intended behavior. Making it
  unconditional when the model and provider support it gives every
  supported setup the same behavior and lets us retire the feature flag
  safely.
  
  ## What changed
  
  - Defer all effective MCP tools when `tool_search` and namespaced tools
  are supported.
  - Keep exposing MCP tools directly when search cannot be used, so older
  or unsupported model/provider combinations still work.
  - Mark `tool_search_always_defer_mcp_tools` as removed and ignore old
  configured values.
  - Keep plugin filtering, app-only filtering, file handling, and MCP
  calls working through the searched-tool flow.
  
  ## Why many tests changed
  
  Many tests used to act as if the model could see MCP tools in its first
  request and call them immediately. That is no longer the real flow: the
  model first receives `tool_search`, searches for a tool, receives the
  matching MCP tool, and then calls it in the next request.
  
  The tests therefore needed an extra search step, and checks for tool
  names, descriptions, and input fields had to move from the first request
  to the search result. These are not separate product changes; they make
  the tests follow what the model will actually see after this change. The
  plugin tests still check which tools are allowed and where they came
  from, the file tests still check upload fields and behavior, and the MCP
  round-trip test still checks a successful call from start to finish.
  
  ## Tests
  
  - `just test -p codex-features`
  - Focused `codex-core` tests for MCP exposure and tool planning
  - `just test -p codex-core explicit_plugin_mentions`
  - `just test -p codex-core stdio_server_round_trip`
  - Focused `codex-core` tests for tool search, app-only tools, and MCP
  file uploads

  sayan-oai · 2026-06-22 16:45:23 -07:00
  c53b1dae09
• feat(core): store turn_id on ResponseItem metadata (#28360)

  ## Description
  
  This PR is a followup to https://github.com/openai/codex/pull/28355 and
  starts assigning `internal_chat_message_metadata_passthrough.turn_id` to
  durable Responses API items created during a turn.
  
  The goal is that those items keep the `turn_id` that introduced them
  when Codex resends stateless HTTP context, reconstructs history for
  resume/fork paths, or reuses websocket response state.
  
  ## What changed
  
  - Set `internal_chat_message_metadata_passthrough.turn_id` when missing
  as response items enter durable history, initial/replacement history,
  inter-agent communication history, and local compaction summaries.
  - Preserve existing item turn IDs instead of overwriting them during
  persistence, resume reconstruction, compaction, forked history, and
  websocket incremental reuse.
  - Keep `compaction_trigger` fieldless because it is a request control,
  not a durable response item.
  - Update focused history/request assertions and fixtures for stateless
  requests, websocket incrementals, compaction, thread injection, prompt
  debug, and related CI coverage.

  Owen Lin · 2026-06-22 16:45:14 -07:00
  4a82ecc3c9
• [codex] replace remote images with model-visible error text (#29417)

  ## What
  
  This PR will extend the existing centralized image-preparation path to
  replace HTTP(S) image inputs with a model visible error message. It
  won't "ruin" and break existing rollouts, but it will deprecate support
  for the pathway. App server clients should no longer use HTTP image urls
  if they'd like to upgrade.
  
  The HTTP image url pathway is currently resolved in the responsesapi. It
  is slow and not reccomended.
  
  ## Behavior
  
  - HTTP(S) image URL: replace with `input_text`
  - data URL: use the existing decode and resize path
  - other image URL schemes: leave unchanged
  
  This intentionally does not change app-server ingress. That validation
  remains a follow-up.
  
  ## Test plan
  
  - `just test -p codex-core -E
  'test(/image_preparation|prepares_image_failures_before_history_insertion|prepares_resumed_history_before_installing_it|responses_lite_prepares_images/)'`
  — 7 passed
  - `just fix -p codex-core`
  - `just fmt`

  rka-oai · 2026-06-22 16:41:00 -07:00
  7153affa0f