codex

[MCP] Add an enabled config field (#4917 )

This lets users more easily toggle MCP servers.

Gabriel Peal · 2025-10-08 16:24:51 -04:00

d3820f4782

feat: truncate on compact (#4942 )

Truncate the message during compaction if it is just too large
Do it iteratively as tokenization is basically free on server-side

jif-oai · 2025-10-08 18:11:08 +01:00

687a13bbe5

fix: change log_sse_event() so it no longer takes a closure (#4953 )

Unlikely fix for https://github.com/openai/codex/issues/4381, but worth a shot given that https://github.com/openai/codex/pull/2103 changed around the same time.

Michael Bolin · 2025-10-08 16:53:35 +00:00

fe8122e514

feat: grep_files as a tool (#4820 )

Add `grep_files` to be able to perform more action in parallel

jif-oai · 2025-10-08 11:02:50 +01:00

f52320be86

[MCP] Add support for streamable http servers with codex mcp add and replace bearer token handling (#4904 )

1. You can now add streamable http servers via the CLI
2. As part of this, I'm also changing the existing bearer_token plain
text config field with ane env var

```
mcp add github --url https://api.githubcopilot.com/mcp/ --bearer-token-env-var=GITHUB_PAT
```

Gabriel Peal · 2025-10-07 23:21:37 -04:00

a43ae86b6c

[MCP] Add the ability to explicitly specify a credentials store (#4857 )

This lets users/companies explicitly choose whether to force/disallow
the keyring/fallback file storage for mcp credentials.

People who develop with Codex will want to use this until we sign
binaries or else each ad-hoc debug builds will require keychain access
on every build. I don't love this and am open to other ideas for how to
handle that.


```toml
mcp_oauth_credentials_store = "auto"
mcp_oauth_credentials_store = "file"
mcp_oauth_credentials_store = "keyrung"
```
Defaults to `auto`

Gabriel Peal · 2025-10-07 22:39:32 -04:00

496cb801e1

Set codex SDK TypeScript originator (#4894 )

## Summary
- ensure the TypeScript SDK sets CODEX_INTERNAL_ORIGINATOR_OVERRIDE to
codex_sdk_ts when spawning the Codex CLI
- extend the responses proxy test helper to capture request headers for
assertions
- add coverage that verifies Codex threads launched from the TypeScript
SDK send the codex_sdk_ts originator header

## Testing
- Not Run (not requested)


------
https://chatgpt.com/codex/tasks/task_i_68e561b125248320a487f129093d16e7

pakrym-oai · 2025-10-07 14:06:41 -07:00

60f9e85c16

Remove instruction hack for /review (#4896 )

We use to put the review prompt in the first user message as well to
bypass statsig overrides, but now that's been resolved and instructions
are being respected, so we're duplicating the review instructions.

dedrisian-oai · 2025-10-07 12:47:00 -07:00

b016a3e7d8

feat: list_dir tool (#4817 )

Add a tool to list_dir. It is useful because we can mark it as
non-mutating and so use it in parallel

jif-oai · 2025-10-07 19:33:19 +01:00

226215f36d

Simplify parallel (#4829 )

make tool processing return a future and then collect futures.
handle cleanup on Drop

pakrym-oai · 2025-10-07 10:12:38 -07:00

f2555422b9

Trim double Total output lines (#4787 )

pakrym-oai · 2025-10-05 16:41:55 -07:00

a90a58f7a1

Use assert_matches (#4756 )

assert_matches is soon to be in std but is experimental for now.

pakrym-oai · 2025-10-05 21:12:31 +00:00

5c42419b02

chore: drop read-file for gpt-5-codex (#4739 )

Drop `read_file` for gpt-5-codex (will do the same for parallel tool
call) and add `codex-` as internal model for this kind of feature

jif-oai · 2025-10-05 16:26:04 +00:00

f3b4a26f32

feat: parallel tool calls (#4663 )

Add parallel tool calls. This is configurable at model level and tool
level

jif-oai · 2025-10-05 16:10:49 +00:00

dc3c6bf62a

chore: update tool config (#4755 )

## Summary
Updates tool config for gpt-5-codex

## Test Plan
- [x] Ran locally
- [x]  Updated unit tests

Dylan · 2025-10-04 22:47:26 -07:00

3203862167

Add truncation hint on truncated exec output. (#4740 )

When truncating output, add a hint of the total number of lines

Ahmed Ibrahim · 2025-10-05 03:29:07 +00:00

cc2f4aafd7

feat: Freeform apply_patch with simple shell output (#4718 )

## Summary
This PR is an alternative approach to #4711, but instead of changing our
storage, parses out shell calls in the client and reserializes them on
the fly before we send them out as part of the request.

What this changes:
1. Adds additional serialization logic when the
ApplyPatchToolType::Freeform is in use.
2. Adds a --custom-apply-patch flag to enable this setting on a
session-by-session basis.

This change is delicate, but is not meant to be permanent. It is meant
to be the first step in a migration:
1. (This PR) Add in-flight serialization with config
2. Update model_family default
3. Update serialization logic to store turn outputs in a structured
format, with logic to serialize based on model_family setting.
4. Remove this rewrite in-flight logic.

## Test Plan
- [x] Additional unit tests added
- [x] Integration tests added
- [x] Tested locally

Dylan · 2025-10-04 19:16:36 -07:00

4764fc1ee7

Surface context window error to the client (#4675 )

In the past, we were treating `input exceeded context window` as a
streaming error and retrying on it. Retrying on it has no point because
it won't change the behavior. In this PR, we surface the error to the
client without retry and also send a token count event to indicate that
the context window is full.

<img width="650" height="125" alt="image"
src="https://github.com/user-attachments/assets/c26b1213-4c27-4bfc-90f4-51a270a3efd5"
/>

Ahmed Ibrahim · 2025-10-05 01:40:06 +00:00

90ef94d3b3

add an onboarding informing Windows of better support in WSL (#4697 )

iceweasel-oai · 2025-10-04 17:41:40 -07:00

6c2969d22d

fix: exec commands that blows up context window. (#4706 )

We truncate the output of exec commands to not blow the context window.
However, some cases we weren't doing that. This caused reports of people
with 76% context window left facing `input exceeded context window`
which is weird.

Ahmed Ibrahim · 2025-10-04 11:49:56 -07:00

d7acd146fb

[MCP] Don't require experimental_use_rmcp_client for no-auth http servers (#4689 )

The `experimental_use_rmcp_client` flag is still useful to:
1. Toggle between stdio clients
2. Enable oauth beacuse we want to land
https://github.com/modelcontextprotocol/rust-sdk/pull/469,
https://github.com/openai/codex/pull/4677, and binary signing before we
enable it by default

However, for no-auth http servers, there is only one option so we don't
need the flag and it seems to be working pretty well.

Gabriel Peal · 2025-10-03 17:15:23 -04:00

d13ee79c41

set gpt-5 as default model for Windows users (#4676 )

Codex isn’t great yet on Windows outside of WSL, and while we’ve merged
https://github.com/openai/codex/pull/4269 to reduce the repetitive
manual approvals on readonly commands, we’ve noticed that users seem to
have more issues with GPT-5-Codex than with GPT-5 on Windows.

This change makes GPT-5 the default for Windows users while we continue
to improve the CLI harness and model for GPT-5-Codex on Windows.

iceweasel-oai · 2025-10-03 14:00:03 -07:00

de8d77274a

add(core): managed config (#3868 )

## Summary

- Factor `load_config_as_toml` into `core::config_loader` so config
loading is reusable across callers.
- Layer `~/.codex/config.toml`, optional `~/.codex/managed_config.toml`,
and macOS managed preferences (base64) with recursive table merging and
scoped threads per source.

## Config Flow

```
Managed prefs (macOS profile: com.openai.codex/config_toml_base64)
                               ▲
                               │
~/.codex/managed_config.toml   │  (optional file-based override)
                               ▲
                               │
                ~/.codex/config.toml (user-defined settings)
```

- The loader searches under the resolved `CODEX_HOME` directory
(defaults to `~/.codex`).
- Managed configs let administrators ship fleet-wide overrides via
device profiles which is useful for enforcing certain settings like
sandbox or approval defaults.
- For nested hash tables: overlays merge recursively. Child tables are
merged key-by-key, while scalar or array values replace the prior layer
entirely. This lets admins add or tweak individual fields without
clobbering unrelated user settings.

Fouad Matin · 2025-10-03 13:02:26 -07:00

a5b7675e42

[MCP] Add support for MCP Oauth credentials (#4517 )

This PR adds oauth login support to streamable http servers when
`experimental_use_rmcp_client` is enabled.

This PR is large but represents the minimal amount of work required for
this to work. To keep this PR smaller, login can only be done with
`codex mcp login` and `codex mcp logout` but it doesn't appear in `/mcp`
or `codex mcp list` yet. Fingers crossed that this is the last large MCP
PR and that subsequent PRs can be smaller.

Under the hood, credentials are stored using platform credential
managers using the [keyring crate](https://crates.io/crates/keyring).
When the keyring isn't available, it falls back to storing credentials
in `CODEX_HOME/.credentials.json` which is consistent with how other
coding agents handle authentication.

I tested this on macOS, Windows, WSL (ubuntu), and Linux. I wasn't able
to test the dbus store on linux but did verify that the fallback works.

One quirk is that if you have credentials, during development, every
build will have its own ad-hoc binary so the keyring won't recognize the
reader as being the same as the write so it may ask for the user's
password. I may add an override to disable this or allow
users/enterprises to opt-out of the keyring storage if it causes issues.

<img width="5064" height="686" alt="CleanShot 2025-09-30 at 19 31 40"
src="https://github.com/user-attachments/assets/9573f9b4-07f1-4160-83b8-2920db287e2d"
/>
<img width="745" height="486" alt="image"
src="https://github.com/user-attachments/assets/9562649b-ea5f-4f22-ace2-d0cb438b143e"
/>

Gabriel Peal · 2025-10-03 13:43:12 -04:00

1d17ca1fa3

feat: add beta_supported_tools (#4669 )

Gate the new read_file tool behind a new `beta_supported_tools` flag and
only enable it for `gpt-5-codex`

jif-oai · 2025-10-03 16:58:03 +00:00

e0b38bd7a2

chore: refactor tool handling (#4510 )

# Tool System Refactor

- Centralizes tool definitions and execution in `core/src/tools/*`:
specs (`spec.rs`), handlers (`handlers/*`), router (`router.rs`),
registry/dispatch (`registry.rs`), and shared context (`context.rs`).
One registry now builds the model-visible tool list and binds handlers.
- Router converts model responses to tool calls; Registry dispatches
with consistent telemetry via `codex-rs/otel` and unified error
handling. Function, Local Shell, MCP, and experimental `unified_exec`
all flow through this path; legacy shell aliases still work.
- Rationale: reduce per‑tool boilerplate, keep spec/handler in sync, and
make adding tools predictable and testable.

Example: `read_file`
- Spec: `core/src/tools/spec.rs` (see `create_read_file_tool`,
registered by `build_specs`).
- Handler: `core/src/tools/handlers/read_file.rs` (absolute `file_path`,
1‑indexed `offset`, `limit`, `L#: ` prefixes, safe truncation).
- E2E test: `core/tests/suite/read_file.rs` validates the tool returns
the requested lines.

## Next steps:
- Decompose `handle_container_exec_with_params` 
- Add parallel tool calls

jif-oai · 2025-10-03 13:21:06 +01:00

33d3ecbccc

chore: sandbox refactor 2 (#4653 )

Revert the revert and fix the UI issue

jif-oai · 2025-10-03 11:17:39 +01:00

69cb72f842

Revert "chore: sanbox extraction" (#4626 )

Reverts openai/codex#4286

Ahmed Ibrahim · 2025-10-02 21:09:21 +00:00

ed5d656fa8

Separate interactive and non-interactive sessions (#4612 )

Do not show exec session in VSCode/TUI selector.

pakrym-oai · 2025-10-02 13:06:21 -07:00

4c566d484a

show "Viewed Image" when the model views an image (#4475 )

<img width="1022" height="339" alt="Screenshot 2025-09-29 at 4 22 00 PM"
src="https://github.com/user-attachments/assets/12da7358-19be-4010-a71b-496ede6dfbbf"
/>

Jeremy Rose · 2025-10-02 18:36:03 +00:00

45936f8fbd

fix: handle JSON Schema in additionalProperties for MCP tools (#4454 )

Fixes #4176

Some common tools provide a schema (even if just an empty object schema)
as the value for `additionalProperties`. The parsing as it currently
stands fails when it encounters this. This PR updates the schema to
accept a schema object in addition to a boolean value, per the JSON
Schema spec.

Marcus Griep · 2025-10-02 13:05:51 -04:00

b727d3f98a

Support CODEX_API_KEY for codex exec (#4615 )

Allows to set API key per invocation of `codex exec`

pakrym-oai · 2025-10-02 09:59:45 -07:00

2f6fb37d72

Include request ID in the error message (#4572 )

To help with issue debugging
<img width="1414" height="253" alt="image"
src="https://github.com/user-attachments/assets/254732df-44ac-4252-997a-6c5e0927355b"
/>

pakrym-oai · 2025-10-01 15:36:04 -07:00

e899ae7d8a

canonicalize display of Agents.md paths on Windows. (#4577 )

Canonicalize path on Windows to 
- remove unattractive path prefixes such as `\\?\`
- simplify it (`../AGENTS.md` vs
`C:\Users\iceweasel\code\coded\Agents.md`)
before: <img width="1110" height="45" alt="Screenshot 2025-10-01 123520"
src="https://github.com/user-attachments/assets/48920ae6-d89c-41b8-b4ea-df5c18fb5fad"
/>

after: 
<img width="585" height="46" alt="Screenshot 2025-10-01 123612"
src="https://github.com/user-attachments/assets/70a1761a-9d97-4836-b14c-670b6f13e608"
/>

iceweasel-oai · 2025-10-01 14:33:19 -07:00

6f97ec4990

Fall back to configured instruction files if AGENTS.md isn't available (#4544 )

Allow users to configure an agents.md alternative to consume, but warn
the user it may degrade model performance.

Fixes #4376

easong-openai · 2025-10-01 18:19:59 +00:00

400a5a90bf

Add Updated at time in resume picker (#4468 )

<img width="639" height="281" alt="image"
src="https://github.com/user-attachments/assets/92b2ad2b-9e18-4485-9b8d-d7056eb98651"
/>

Ahmed Ibrahim · 2025-10-01 10:40:43 -07:00

d78d0764aa

implement command safety for PowerShell commands (#4269 )

Implement command safety for PowerShell commands on Windows

This change adds a new Windows-specific command-safety module under
`codex-rs/core/src/command_safety/windows_safe_commands.rs` to strictly
sanitise PowerShell invocations. Key points:

- Introduce `is_safe_command_windows()` to only allow explicitly
read-only PowerShell calls.
- Parse and split PowerShell invocations (including inline `-Command`
scripts and pipelines).
- Block unsafe switches (`-File`, `-EncodedCommand`, `-ExecutionPolicy`,
unknown flags, call operators, redirections, separators).
- Whitelist only read-only cmdlets (`Get-ChildItem`, `Get-Content`,
`Select-Object`, etc.), safe Git subcommands (`status`, `log`, `show`,
`diff`, `cat-file`), and ripgrep without unsafe options.
- Add comprehensive unit tests covering allowed and rejected command
patterns (nested calls, side effects, chaining, redirections).

This ensures Codex on Windows can safely execute discover-only
PowerShell workflows without risking destructive operations.

iceweasel-oai · 2025-10-01 09:56:48 -07:00

dde615f482

chore: sanbox extraction (#4286 )

# Extract and Centralize Sandboxing
- Goal: Improve safety and clarity by centralizing sandbox planning and
execution.
  - Approach:
- Add planner (ExecPlan) and backend registry (Direct/Seatbelt/Linux)
with run_with_plan.
- Refactor codex.rs to plan-then-execute; handle failures/escalation via
the plan.
- Delegate apply_patch to the codex binary and run it with an empty env
for determinism.

jif-oai · 2025-10-01 12:05:12 +01:00

b8195a17e5

fix: remove mcp-types from app server protocol (#4537 )

We continue the separation between `codex app-server` and `codex
mcp-server`.

In particular, we introduce a new crate, `codex-app-server-protocol`,
and migrate `codex-rs/protocol/src/mcp_protocol.rs` into it, renaming it
`codex-rs/app-server-protocol/src/protocol.rs`.

Because `ConversationId` was defined in `mcp_protocol.rs`, we move it
into its own file, `codex-rs/protocol/src/conversation_id.rs`, and
because it is referenced in a ton of places, we have to touch a lot of
files as part of this PR.

We also decide to get away from proper JSON-RPC 2.0 semantics, so we
also introduce `codex-rs/app-server-protocol/src/jsonrpc_lite.rs`, which
is basically the same `JSONRPCMessage` type defined in `mcp-types`
except with all of the `"jsonrpc": "2.0"` removed.

Getting rid of `"jsonrpc": "2.0"` makes our serialization logic
considerably simpler, as we can lean heavier on serde to serialize
directly into the wire format that we use now.

Michael Bolin · 2025-10-01 02:16:26 +00:00

5881c0d6d4

Add cloud tasks (#3197 )

Adds a TUI for managing, applying, and creating cloud tasks

easong-openai · 2025-09-30 10:10:33 +00:00

5b038135de

Set originator for codex exec (#4485 )

Distinct from the main CLI.

pakrym-oai · 2025-09-29 20:59:19 -07:00

c09e131653

[Core]: add tail in the rollout data (#4461 )

This will help us show the conversation tail and last updated timestamp.

Ahmed Ibrahim · 2025-09-29 14:32:26 -07:00

16057e76b0

Parse out frontmatter for custom prompts (#4456 )

[Cherry picked from https://github.com/openai/codex/pull/3565]

Removes the frontmatter description/args from custom prompt files and
only includes body.

dedrisian-oai · 2025-09-29 13:06:08 -07:00

83a4d4d8ed

OpenTelemetry events (#2103 )

### Title

## otel

Codex can emit [OpenTelemetry](https://opentelemetry.io/) **log events**
that
describe each run: outbound API requests, streamed responses, user
input,
tool-approval decisions, and the result of every tool invocation. Export
is
**disabled by default** so local runs remain self-contained. Opt in by
adding an
`[otel]` table and choosing an exporter.

```toml
[otel]
environment = "staging"   # defaults to "dev"
exporter = "none"          # defaults to "none"; set to otlp-http or otlp-grpc to send events
log_user_prompt = false    # defaults to false; redact prompt text unless explicitly enabled
```

Codex tags every exported event with `service.name = "codex-cli"`, the
CLI
version, and an `env` attribute so downstream collectors can distinguish
dev/staging/prod traffic. Only telemetry produced inside the
`codex_otel`
crate—the events listed below—is forwarded to the exporter.

### Event catalog

Every event shares a common set of metadata fields: `event.timestamp`,
`conversation.id`, `app.version`, `auth_mode` (when available),
`user.account_id` (when available), `terminal.type`, `model`, and
`slug`.

With OTEL enabled Codex emits the following event types (in addition to
the
metadata above):

- `codex.api_request`
  - `cf_ray` (optional)
  - `attempt`
  - `duration_ms`
  - `http.response.status_code` (optional)
  - `error.message` (failures)
- `codex.sse_event`
  - `event.kind`
  - `duration_ms`
  - `error.message` (failures)
  - `input_token_count` (completion only)
  - `output_token_count` (completion only)
  - `cached_token_count` (completion only, optional)
  - `reasoning_token_count` (completion only, optional)
  - `tool_token_count` (completion only)
- `codex.user_prompt`
  - `prompt_length`
  - `prompt` (redacted unless `log_user_prompt = true`)
- `codex.tool_decision`
  - `tool_name`
  - `call_id`
- `decision` (`approved`, `approved_for_session`, `denied`, or `abort`)
  - `source` (`config` or `user`)
- `codex.tool_result`
  - `tool_name`
  - `call_id`
  - `arguments`
  - `duration_ms` (execution time for the tool)
  - `success` (`"true"` or `"false"`)
  - `output`

### Choosing an exporter

Set `otel.exporter` to control where events go:

- `none` – leaves instrumentation active but skips exporting. This is
the
  default.
- `otlp-http` – posts OTLP log records to an OTLP/HTTP collector.
Specify the
  endpoint, protocol, and headers your collector expects:

  ```toml
  [otel]
  exporter = { otlp-http = {
    endpoint = "https://otel.example.com/v1/logs",
    protocol = "binary",
    headers = { "x-otlp-api-key" = "${OTLP_TOKEN}" }
  }}
  ```

- `otlp-grpc` – streams OTLP log records over gRPC. Provide the endpoint
and any
  metadata headers:

  ```toml
  [otel]
  exporter = { otlp-grpc = {
    endpoint = "https://otel.example.com:4317",
    headers = { "x-otlp-meta" = "abc123" }
  }}
  ```

If the exporter is `none` nothing is written anywhere; otherwise you
must run or point to your
own collector. All exporters run on a background batch worker that is
flushed on
shutdown.

If you build Codex from source the OTEL crate is still behind an `otel`
feature
flag; the official prebuilt binaries ship with the feature enabled. When
the
feature is disabled the telemetry hooks become no-ops so the CLI
continues to
function without the extra dependencies.

---------

Co-authored-by: Anton Panasenko <apanasenko@openai.com>

vishnu-oai · 2025-09-29 11:30:55 -07:00

04c1782e52

chore: lower logging level from error to info for MCP startup (#4412 )

Michael Bolin · 2025-09-28 15:13:44 -07:00

7407469791

chore: remove model upgrade popup (#4332 )

Thibault Sottiaux · 2025-09-27 13:25:09 -07:00

d7286e9829

[MCP] Add experimental support for streamable HTTP MCP servers (#4317 )

This PR adds support for streamable HTTP MCP servers when the
`experimental_use_rmcp_client` is enabled.

To set one up, simply add a new mcp server config with the url:
```
[mcp_servers.figma]
url = "http://127.0.0.1:3845/mcp"
```

It also supports an optional `bearer_token` which will be provided in an
authorization header. The full oauth flow is not supported yet.

The config parsing will throw if it detects that the user mixed and
matched config fields (like command + bearer token or url + env).

The best way to review it is to review `core/src` and then
`rmcp-client/src/rmcp_client.rs` first. The rest is tests and
propagating the `Transport` struct around the codebase.

Example with the Figma MCP:
<img width="5084" height="1614" alt="CleanShot 2025-09-26 at 13 35 40"
src="https://github.com/user-attachments/assets/eaf2771e-df3e-4300-816b-184d7dec5a28"
/>

Gabriel Peal · 2025-09-26 21:24:01 -04:00

3a1be084f9

reject dangerous commands for AskForApproval::Never (#4307 )

If we detect a dangerous command but approval_policy is Never, simply
reject the command.

iceweasel-oai · 2025-09-26 14:08:28 -07:00

55801700de

/status followup (#4304 )

- Render `send a message to load usage data` in the beginning of the
session
- Render `data not available yet` if received no rate limits 
- nit case
- Deleted stall snapshots that were moved to
`codex-rs/tui/src/status/snapshots`

Ahmed Ibrahim · 2025-09-26 18:16:54 +00:00

1fba99ed85

[MCP] Introduce an experimental official rust sdk based mcp client (#4252 )

The [official Rust
SDK](https://github.com/modelcontextprotocol/rust-sdk/tree/57fc428c578a1a3fe851ee0838bf068bda120eb3)
has come a long way since we first started our mcp client implementation
5 months ago and, today, it is much more complete than our own
stdio-only implementation.

This PR introduces a new config flag `experimental_use_rmcp_client`
which will use a new mcp client powered by the sdk instead of our own.

To keep this PR simple, I've only implemented the same stdio MCP
functionality that we had but will expand on it with future PRs.

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

Gabriel Peal · 2025-09-26 13:13:37 -04:00

e555a36c6a

480 Commits