186 Commits

• [5/6] Wire executor-backed MCP stdio (#18212)

  ## Summary
  - Add the executor-backed RMCP stdio transport.
  - Wire MCP stdio placement through the executor environment config.
  - Cover local and executor-backed stdio paths with the existing MCP test
  helpers.
  
  ## Stack
  ```text
  o  #18027 [6/6] Fail exec client operations after disconnect
  │
  @  #18212 [5/6] Wire executor-backed MCP stdio
  │
  o  #18087 [4/6] Abstract MCP stdio server launching
  │
  o  #18020 [3/6] Add pushed exec process events
  │
  o  #18086 [2/6] Support piped stdin in exec process API
  │
  o  #18085 [1/6] Add MCP server environment config
  │
  o  main
  ```
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-18 21:47:43 -07:00
  996aa23e4c
• [TUI] add external config migration prompt when start TUI (#17891)

  - add a TUI startup migration prompt for external agent config
  - support migrating external configs including config, skills, AGENTS.md
  and plugins
  - gate the prompt behind features.external_migrate (default false)
  
  <img width="1037" height="480" alt="Screenshot 2026-04-14 at 9 29 14 PM"
  src="https://github.com/user-attachments/assets/6060849b-03cb-429a-9c13-c7bb46ad2e65"
  />
  <img width="713" height="183" alt="Screenshot 2026-04-14 at 9 29 26 PM"
  src="https://github.com/user-attachments/assets/d13f177e-d4c4-479c-8736-ef29636081e1"
  />
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  alexsong-oai · 2026-04-17 17:58:32 -07:00
  93ff798e5b
• feat: config aliases (#18140)

  Rename `no_memories_if_mcp_or_web_search` →
  `disable_on_external_context` with backward compatibility
  
  While doing so, we add a key alias system on our layer merging system.
  What we try to avoid is a case where a company managed config use an old
  name while the user has a new name in it's local config (which would
  make the deserialization fail)

  jif-oai · 2026-04-17 18:26:09 +01:00
  cfc23eee3d
• add token-based tool deferral behind feature flag (#18097)

  add new `tool_search_always_defer_mcp_tools` feature flag that always
  defers all mcp tools rather than deferring once > 100 deferrable tools.
  
  add new tests, also move `mcp_exposure` tests into dedicated file rather
  than polluting `codex_tests`.

  sayan-oai · 2026-04-17 18:34:06 +08:00
  d0047de7cb
• Stream apply_patch changes (#17862)

  Adds new events for streaming apply_patch changes from responses api.
  This is to enable clients to show progress during file writes.
  
  Caveat: This does not work with apply_patch in function call mode, since
  that required adding streaming json parsing.

  Akshay Nathan · 2026-04-16 18:12:19 -07:00
  7995c66032
• feat(sandbox): add glob deny-read platform enforcement (#18096)

  ## Summary
  - adds macOS Seatbelt deny rules for unreadable glob patterns
  - expands unreadable glob matches on Linux and masks them in bwrap,
  including canonical symlink targets
  - keeps Linux glob expansion robust when `rg` is unavailable in minimal
  or Bazel test environments
  - adds sandbox integration coverage that runs `shell` and `exec_command`
  with a `**/*.env = none` policy and verifies the secret contents do not
  reach the model
  
  ## Linux glob expansion
  
  ```text
  Prefer:   rg --files --hidden --no-ignore --glob <pattern> -- <search-root>
  Fallback: internal globset walker when rg is not installed
  Failure:  any other rg failure aborts sandbox construction
  ```
  
  ```
  [permissions.workspace.filesystem]
  glob_scan_max_depth = 2
  
  [permissions.workspace.filesystem.":project_roots"]
  "**/*.env" = "none"
  ```
  
  
  This keeps the common path fast without making sandbox construction
  depend on an ambient `rg` binary. If `rg` is present but fails for
  another reason, the sandbox setup fails closed instead of silently
  omitting deny-read masks.
  
  ## Platform support
  - macOS: subprocess sandbox enforcement is handled by Seatbelt regex
  deny rules
  - Linux: subprocess sandbox enforcement is handled by expanding existing
  glob matches and masking them in bwrap
  - Windows: policy/config/direct-tool glob support is already on `main`
  from #15979; Windows subprocess sandbox paths continue to fail closed
  when unreadable split filesystem carveouts require runtime enforcement,
  rather than silently running unsandboxed
  
  ## Stack
  1. #15979 - merged: cross-platform glob deny-read
  policy/config/direct-tool support for macOS, Linux, and Windows
  2. This PR - macOS/Linux subprocess sandbox enforcement plus Windows
  fail-closed clarification
  3. #17740 - managed deny-read requirements
  
  ## Verification
  - Added integration coverage for `shell` and `exec_command` glob
  deny-read enforcement
  - `cargo check -p codex-sandboxing -p codex-linux-sandbox --tests`
  - `cargo check -p codex-core --test all`
  - `cargo clippy -p codex-linux-sandbox -p codex-sandboxing --tests`
  - `just bazel-lock-check`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-16 17:35:16 -07:00
  0d0abe839a
• Add server-level approval defaults for custom MCP servers (#17843)

  ## Summary
  - Add `default_tools_approval_mode` support for custom MCP server
  configs, matching the existing `codex_apps` behavior
  - Apply approval precedence as per-tool override, then server default,
  then `auto`
  - Update config serialization, CLI display, schema generation, docs, and
  tests
  
  ## Testing
  - `cargo check -p codex-config`
  - `cargo check -p codex-core`
  - `just write-config-schema`
  - `just fmt`
  - `cargo test -p codex-config`
  - Targeted `codex-core` tests for config parsing, config writes, and MCP
  approval precedence
  - `just fix -p codex-config -p codex-core`

  Matthew Zeng · 2026-04-16 18:18:07 +00:00
  71174574ad
• Auto-upgrade configured marketplaces (#17425)

  ## Summary
  - Add best-effort auto-upgrade for user-configured Git marketplaces
  recorded in `config.toml`.
  - Track the last activated Git revision with `last_revision` so
  unchanged marketplace sources skip clone work.
  - Trigger the upgrade from plugin startup and `plugin/list`, while
  preserving existing fail-open plugin behavior with warning logs rather
  than new user-visible errors.
  
  ## Details
  - Remote configured marketplaces use `git ls-remote` to compare the
  source/ref against the recorded revision.
  - Upgrades clone into a staging directory, validate that
  `.agents/plugins/marketplace.json` exists and that the manifest name
  matches the configured marketplace key, then atomically activate the new
  root.
  - Local `.agents/plugins/marketplace.json` marketplaces remain live
  filesystem state and are not auto-pulled.
  - Existing non-curated plugin cache refresh is kicked after successful
  marketplace root upgrades.
  
  ## Validation
  - `just write-config-schema`
  - `cargo test -p codex-core marketplace_upgrade`
  - `cargo check -p codex-cli -p codex-app-server`
  - `just fix -p codex-core`
  
  Did not run the complete `cargo test` suite because the repo
  instructions require asking before a full core workspace run.

  xli-oai · 2026-04-16 10:36:34 -07:00
  faf48489f3
• [1/8] Add MCP server environment config (#18085)

  ## Summary
  - Add an MCP server environment setting with local as the default.
  - Thread the default through config serialization, schema generation,
  and existing config fixtures.
  
  ## Stack
  ```text
  o  #18027 [8/8] Fail exec client operations after disconnect
  │
  o  #18025 [7/8] Cover MCP stdio tests with executor placement
  │
  o  #18089 [6/8] Wire remote MCP stdio through executor
  │
  o  #18088 [5/8] Add executor process transport for MCP stdio
  │
  o  #18087 [4/8] Abstract MCP stdio server launching
  │
  o  #18020 [3/8] Add pushed exec process events
  │
  o  #18086 [2/8] Support piped stdin in exec process API
  │
  @  #18085 [1/8] Add MCP server environment config
  │
  o  main
  ```
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-16 08:50:03 -07:00
  b4be3617f9
• nit: add min values for memories (#18137)

  Just add min values to some memories config fields

  jif-oai · 2026-04-16 14:37:43 +01:00
  9c326c4cb4
• [mcp] Add dummy tools for previously called but currently missing tools. (#17853)

  - [x] Add dummy tools for previously called but currently missing tools.
  Currently supporting MCP tools only.

  Matthew Zeng · 2026-04-15 21:48:05 +00:00
  28b76d13fe
• chore(features) codex dependencies feat (#17960)

  ## Summary
  Setting this up
  
  ## Testing
  - [x] Unit tests pass

  Dylan Hurd · 2026-04-15 10:59:59 -07:00
  652380d362
• [codex] Support local marketplace sources (#17756)

  ## Summary
  
  - Port marketplace source support into the shared core marketplace-add
  flow
  - Support local marketplace directory sources
  - Support direct `marketplace.json` URL sources
  - Persist the new source types in config/schema and cover them in CLI
  and app-server tests
  
  ## Validation
  
  - `cargo test -p codex-core marketplace_add`
  - `cargo test -p codex-cli marketplace_add`
  - `cargo test -p codex-app-server marketplace_add`
  - `just write-config-schema`
  - `just fmt`
  - `just fix -p codex-core`
  - `just fix -p codex-cli`
  
  ## Context
  
  Current `main` moved marketplace-add behavior into shared core code and
  still assumed only git-backed sources. This change keeps that structure
  but restores support for local directories and direct manifest URLs in
  the shared path.

  xli-oai · 2026-04-14 15:58:14 -07:00
  3cc689fb23
• Keep image_detail_original as a removed feature flag (#17803)
  Curtis 'Fjord' Hawthorne · 2026-04-14 18:06:50 +00:00
  769b1c3d7e
• Always enable original image detail on supported models (#17665)

  ## Summary
  
  This PR removes `image_detail_original` as a runtime experiment and
  makes original image detail available whenever the selected model
  supports it.
  
  Concretely, this change:
  - drops the `image_detail_original` feature flag from the feature
  registry and generated config schema
  - makes tool-emitted image detail depend only on
  `ModelInfo.supports_image_detail_original`
  - updates `view_image` and `code_mode`/`js_repl` image emission to use
  that capability check directly
  - removes now-redundant experiment-specific tests and instruction
  coverage
  - keeps backward compatibility for existing configs by silently ignoring
  a stale `features.image_detail_original` entry
  
  The net effect is that `detail: "original"` is always available on
  supported models, without requiring an experiment toggle.

  Curtis 'Fjord' Hawthorne · 2026-04-14 08:15:56 -07:00
  f030ab62eb
• nit: feature flag (#17777)
  jif-oai · 2026-04-14 13:44:01 +01:00
  34a9ca083e
• Add supports_parallel_tool_calls flag to included mcps (#17667)

  ## Why
  
  For more advanced MCP usage, we want the model to be able to emit
  parallel MCP tool calls and have Codex execute eligible ones
  concurrently, instead of forcing all MCP calls through the serial block.
  
  The main design choice was where to thread the config. I made this
  server-level because parallel safety depends on the MCP server
  implementation. Codex reads the flag from `mcp_servers`, threads the
  opted-in server names into `ToolRouter`, and checks the parsed
  `ToolPayload::Mcp { server, .. }` at execution time. That avoids relying
  on model-visible tool names, which can be incomplete in
  deferred/search-tool paths or ambiguous for similarly named
  servers/tools.
  
  ## What was added
  
  Added `supports_parallel_tool_calls` for MCP servers.
  
  Before:
  
  ```toml
  [mcp_servers.docs]
  command = "docs-server"
  ```
  
  After:
  
  ```toml
  [mcp_servers.docs]
  command = "docs-server"
  supports_parallel_tool_calls = true
  ```
  
  MCP calls remain serial by default. Only tools from opted-in servers are
  eligible to run in parallel. Docs also now warn to enable this only when
  the server’s tools are safe to run concurrently, especially around
  shared state or read/write races.
  
  ## Testing
  
  Tested with a local stdio MCP server exposing real delay tools. The
  model/Responses side was mocked only to deterministically emit two MCP
  calls in the same turn.
  
  Each test called `query_with_delay` and `query_with_delay_2` with `{
  "seconds": 25 }`.
  
  | Build/config | Observed | Wall time |
  | --- | --- | --- |
  | main with flag enabled | serial | `58.79s` |
  | PR with flag enabled | parallel | `31.73s` |
  | PR without flag | serial | `56.70s` |
  
  PR with flag enabled showed both tools start before either completed;
  main and PR-without-flag completed the first delay before starting the
  second.
  
  Also added an integration test.
  
  Additional checks:
  
  - `cargo test -p codex-tools` passed
  - `cargo test -p codex-core
  mcp_parallel_support_uses_exact_payload_server` passed
  - `git diff --check` passed

  josiah-openai · 2026-04-13 15:16:34 -07:00
  937dd3812d
• Add use_agent_identity feature flag (#17385)
  Adrian · 2026-04-11 09:52:06 -07:00
  39cc85310f
• Add marketplace command (#17087)

  Added a new top-level `codex marketplace add` command for installing
  plugin marketplaces into Codex’s local marketplace cache.
  
  This change adds source parsing for local directories, GitHub shorthand,
  and git URLs, supports optional `--ref` and git-only `--sparse` checkout
  paths, stages the source in a temp directory, validates the marketplace
  manifest, and installs it under
  `$CODEX_HOME/marketplaces/<marketplace-name>`
  
  Included tests cover local install behavior in the CLI and marketplace
  discovery from installed roots in core. Scoped formatting and fix passes
  were run, and targeted CLI/core tests passed.

  xli-oai · 2026-04-10 19:18:37 -07:00
  f9a8d1870f
• Render statusline context as a meter (#17170)

  Problem: The statusline reported context as an “X% left” value, which
  could be mistaken for quota, and context usage was included in the
  default footer.
  
  Solution: Render configured context status items as a filling context
  meter, preserve `context-used` as a legacy alias while hiding it from
  the setup menu, and remove context from the default statusline. It will
  still be available as an opt-in option for users who want to see it.
  
  <img width="317" height="39" alt="image"
  src="https://github.com/user-attachments/assets/3aeb39bb-f80d-471f-88fe-d55e25b31491"
  />

  Eric Traut · 2026-04-09 07:52:07 -07:00
  598d6ff056
• Add TUI notification condition config (#17175)

  Problem: TUI desktop notifications are hard-gated on terminal focus, so
  terminal/IDE hosts that want in-focus notifications cannot opt in.
  
  Solution: Add a flat `[tui] notification_condition` setting (`unfocused`
  by default, `always` opt-in), carry grouped TUI notification settings
  through runtime config, apply method + condition together in the TUI,
  and regenerate the config schema.

  Eric Traut · 2026-04-08 21:50:02 -07:00
  6dc5391c7c
• Add realtime voice selection (#17176)

  - Add realtime voice selection for realtime/start.
  - Expose the supported v1/v2 voice lists and cover explicit, configured,
  default, and invalid voice paths.

  Ahmed Ibrahim · 2026-04-08 20:19:15 -07:00
  2f9090be62
• Add realtime transport config (#17097)

  Adds realtime.transport config with websocket as the default and webrtc
  wired through the effective config.
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 09:53:53 -07:00
  06d88b7e81
• Configure multi_agent_v2 spawn agent hints (#17071)

  Allow multi_agent_v2 features to have its own temporary configuration
  under `[features.multi_agent_v2]`
  
  ```
  [features.multi_agent_v2]
  enabled = true
  usage_hint_enabled = false
  usage_hint_text = "Custom delegation guidance."
  hide_spawn_agent_metadata = true
  ```
  
  Absent `usage_hint_text` means use the default hint.
  
  ```
  [features]
  multi_agent_v2 = true
  ```
  
  still works as the boolean shorthand.

  pakrym-oai · 2026-04-08 08:42:18 -07:00
  4c07dd4d25
• chore: debug flag to hide some parameters (#17002)
  jif-oai · 2026-04-07 10:42:19 +01:00
  e2bb45bb24
• Refactor config types into a separate crate (#16962)

  Move config types into a separate crate because their macros expand into
  a lot of new code.

  pakrym-oai · 2026-04-07 00:32:41 +00:00
  1f2411629f
• app-server: Add transport for remote control (#15951)
  Ruslan Nigmatullin · 2026-04-06 14:55:59 -07:00
  73dab2046f
• [codex] allow disabling environment context injection (#16745)

  This adds an `include_environment_context` config/profile flag that
  defaults on, and guards both initial injection and later environment
  updates to allow skipping injection of `<environment_context>`.

  Thibault Sottiaux · 2026-04-03 18:06:52 -07:00
  91ca49e53c
• [codex] allow disabling prompt instruction blocks (#16735)

  This PR adds root and profile config switches to omit the generated
  `<permissions instructions>` and `<apps_instructions>` prompt blocks
  while keeping both enabled by default, and it gates both the initial
  developer-context injection and later permissions diff injection so
  turning the permissions block off stays effective across turn-context
  overrides.
  
  Also added a prompt debug tool that can be used as `codex debug
  prompt-input "hello"` and dumps the constructed items list.

  Thibault Sottiaux · 2026-04-03 23:47:56 +00:00
  8d19646861
• [codex] Remove codex-core config type shim (#16529)

  ## Why
  
  This finishes the config-type move out of `codex-core` by removing the
  temporary compatibility shim in `codex_core::config::types`. Callers now
  depend on `codex-config` directly, which keeps these config model types
  owned by the config crate instead of re-expanding `codex-core` as a
  transitive API surface.
  
  ## What Changed
  
  - Removed the `codex-rs/core/src/config/types.rs` re-export shim and the
  `core::config::ApprovalsReviewer` re-export.
  - Updated `codex-core`, `codex-cli`, `codex-tui`, `codex-app-server`,
  `codex-mcp-server`, and `codex-linux-sandbox` call sites to import
  `codex_config::types` directly.
  - Added explicit `codex-config` dependencies to downstream crates that
  previously relied on the `codex-core` re-export.
  - Regenerated `codex-rs/core/config.schema.json` after updating the
  config docs path reference.

  Michael Bolin · 2026-04-02 01:19:44 -07:00
  c1d18ceb6f
• Extract MCP into codex-mcp crate (#15919)

  - Split MCP runtime/server code out of `codex-core` into the new
  `codex-mcp` crate. New/moved public structs/types include `McpConfig`,
  `McpConnectionManager`, `ToolInfo`, `ToolPluginProvenance`,
  `CodexAppsToolsCacheKey`, and the `McpManager` API
  (`codex_mcp::mcp::McpManager` plus the `codex_core::mcp::McpManager`
  wrapper/shim). New/moved functions include `with_codex_apps_mcp`,
  `configured_mcp_servers`, `effective_mcp_servers`,
  `collect_mcp_snapshot`, `collect_mcp_snapshot_from_manager`,
  `qualified_mcp_tool_name_prefix`, and the MCP auth/skill-dependency
  helpers. Why: this creates a focused MCP crate boundary and shrinks
  `codex-core` without forcing every consumer to migrate in the same PR.
  
  - Move MCP server config schema and persistence into `codex-config`.
  New/moved structs/enums include `AppToolApproval`,
  `McpServerToolConfig`, `McpServerConfig`, `RawMcpServerConfig`,
  `McpServerTransportConfig`, `McpServerDisabledReason`, and
  `codex_config::ConfigEditsBuilder`. New/moved functions include
  `load_global_mcp_servers` and
  `ConfigEditsBuilder::replace_mcp_servers`/`apply`. Why: MCP TOML
  parsing/editing is config ownership, and this keeps config
  validation/round-tripping (including per-tool approval overrides and
  inline bearer-token rejection) in the config crate instead of
  `codex-core`.
  
  - Rewire `codex-core`, app-server, and plugin call sites onto the new
  crates. Updated `Config::to_mcp_config(&self, plugins_manager)`,
  `codex-rs/core/src/mcp.rs`, `codex-rs/core/src/connectors.rs`,
  `codex-rs/core/src/codex.rs`,
  `CodexMessageProcessor::list_mcp_server_status_task`, and
  `utils/plugins/src/mcp_connector.rs` to build/pass the new MCP
  config/runtime types. Why: plugin-provided MCP servers still merge with
  user-configured servers, and runtime auth (`CodexAuth`) is threaded into
  `with_codex_apps_mcp` / `collect_mcp_snapshot` explicitly so `McpConfig`
  stays config-only.

  Ahmed Ibrahim · 2026-04-01 19:03:26 -07:00
  59b68f5519
• login: treat provider auth refresh_interval_ms=0 as no auto-refresh (#16480)

  ## Why
  
  Follow-up to #16288: the new dynamic provider auth token flow currently
  defaults `refresh_interval_ms` to a non-zero value and rejects `0`
  entirely.
  
  For command-backed bearer auth, `0` should mean "never auto-refresh".
  That lets callers keep using the cached token until the backend actually
  returns `401 Unauthorized`, at which point Codex can rerun the auth
  command as part of the existing retry path.
  
  ## What changed
  
  - changed `ModelProviderAuthInfo.refresh_interval_ms` to accept `0` and
  documented that value as disabling proactive refresh
  - updated the external bearer token refresher to treat
  `refresh_interval_ms = 0` as an indefinitely reusable cached token,
  while still rerunning the auth command during unauthorized recovery
  - regenerated `core/config.schema.json` so the schema minimum is `0` and
  the new behavior is described in the field docs
  - added coverage for both config deserialization and the no-auto-refresh
  plus `401` recovery behavior
  
  ## How tested
  
  - `cargo test -p codex-protocol`
  - `cargo test -p codex-login`
  - `cargo test -p codex-core test_deserialize_provider_auth_config_`

  Michael Bolin · 2026-04-01 15:30:10 -07:00
  f83f3fa2a6
• [codex-analytics] thread events (#15690)

  - add event for thread initialization
  - thread/start, thread/fork, thread/resume
  - feature flagged behind `FeatureFlag::GeneralAnalytics`
  - does not yet support threads started by subagents
  
  PR stack:
  - --> [[telemetry] thread events
  #15690](https://github.com/openai/codex/pull/15690)
  - [[telemetry] subagent events
  #15915](https://github.com/openai/codex/pull/15915)
  - [[telemetry] turn events
  #15591](https://github.com/openai/codex/pull/15591)
  - [[telemetry] steer events
  #15697](https://github.com/openai/codex/pull/15697)
  - [[telemetry] queued prompt data
  #15804](https://github.com/openai/codex/pull/15804)
  
  
  Sample extracted logs in Codex-backend
  ```
  INFO     | 2026-03-29 16:39:37 | codex_backend.routers.analytics_events | analytics_events.track_analytics_events:398 | Tracked analytics event codex_thread_initialized thread_id=019d3bf7-9f5f-7f82-9877-6d48d1052531 product_surface=codex product_client_id=CODEX_CLI client_name=codex-tui client_version=0.0.0 rpc_transport=in_process experimental_api_enabled=True codex_rs_version=0.0.0 runtime_os=macos runtime_os_version=26.4.0 runtime_arch=aarch64 model=gpt-5.3-codex ephemeral=False thread_source=user initialization_mode=new subagent_source=None parent_thread_id=None created_at=1774827577 | 
  INFO     | 2026-03-29 16:45:46 | codex_backend.routers.analytics_events | analytics_events.track_analytics_events:398 | Tracked analytics event codex_thread_initialized thread_id=019d3b84-5731-79d0-9b3b-9c6efe5f5066 product_surface=codex product_client_id=CODEX_CLI client_name=codex-tui client_version=0.0.0 rpc_transport=in_process experimental_api_enabled=True codex_rs_version=0.0.0 runtime_os=macos runtime_os_version=26.4.0 runtime_arch=aarch64 model=gpt-5.3-codex ephemeral=False thread_source=user initialization_mode=resumed subagent_source=None parent_thread_id=None created_at=1774820022 | 
  INFO     | 2026-03-29 16:45:49 | codex_backend.routers.analytics_events | analytics_events.track_analytics_events:398 | Tracked analytics event codex_thread_initialized thread_id=019d3bfd-4cd6-7c12-a13e-48cef02e8c4d product_surface=codex product_client_id=CODEX_CLI client_name=codex-tui client_version=0.0.0 rpc_transport=in_process experimental_api_enabled=True codex_rs_version=0.0.0 runtime_os=macos runtime_os_version=26.4.0 runtime_arch=aarch64 model=gpt-5.3-codex ephemeral=False thread_source=user initialization_mode=forked subagent_source=None parent_thread_id=None created_at=1774827949 | 
  INFO     | 2026-03-29 17:20:29 | codex_backend.routers.analytics_events | analytics_events.track_analytics_events:398 | Tracked analytics event codex_thread_initialized thread_id=019d3c1d-0412-7ed2-ad24-c9c0881a36b0 product_surface=codex product_client_id=CODEX_SERVICE_EXEC client_name=codex_exec client_version=0.0.0 rpc_transport=in_process experimental_api_enabled=True codex_rs_version=0.0.0 runtime_os=macos runtime_os_version=26.4.0 runtime_arch=aarch64 model=gpt-5.3-codex ephemeral=False thread_source=user initialization_mode=new subagent_source=None parent_thread_id=None created_at=1774830027 | 
  ```
  
  Notes
  - `product_client_id` gets canonicalized in codex-backend
  - subagent threads are addressed in a following pr

  rhan-oai · 2026-03-31 12:16:44 -07:00
  e8de4ea953
• core: support dynamic auth tokens for model providers (#16288)

  ## Summary
  
  Fixes #15189.
  
  Custom model providers that set `requires_openai_auth = false` could
  only use static credentials via `env_key` or
  `experimental_bearer_token`. That is not enough for providers that mint
  short-lived bearer tokens, because Codex had no way to run a command to
  obtain a bearer token, cache it briefly in memory, and retry with a
  refreshed token after a `401`.
  
  This PR adds that provider config and wires it through the existing auth
  design: request paths still go through `AuthManager.auth()` and
  `UnauthorizedRecovery`, with `core` only choosing when to use a
  provider-backed bearer-only `AuthManager`.
  
  ## Scope
  
  To keep this PR reviewable, `/models` only uses provider auth for the
  initial request in this change. It does **not** add a dedicated `401`
  retry path for `/models`; that can be follow-up work if we still need it
  after landing the main provider-token support.
  
  ## Example Usage
  
  ```toml
  model_provider = "corp-openai"
  
  [model_providers.corp-openai]
  name = "Corp OpenAI"
  base_url = "https://gateway.example.com/openai"
  requires_openai_auth = false
  
  [model_providers.corp-openai.auth]
  command = "gcloud"
  args = ["auth", "print-access-token"]
  timeout_ms = 5000
  refresh_interval_ms = 300000
  ```
  
  The command contract is intentionally small:
  
  - write the bearer token to `stdout`
  - exit `0`
  - any leading or trailing whitespace is trimmed before the token is used
  
  ## What Changed
  
  - add `model_providers.<id>.auth` to the config model and generated
  schema
  - validate that command-backed provider auth is mutually exclusive with
  `env_key`, `experimental_bearer_token`, and `requires_openai_auth`
  - build a bearer-only `AuthManager` for `ModelClient` and
  `ModelsManager` when a provider configures `auth`
  - let normal Responses requests and realtime websocket connects use the
  provider-backed bearer source through the same `AuthManager.auth()` path
  - allow `/models` online refresh for command-auth providers and attach
  the provider token to the initial `/models` request
  - keep `auth.cwd` available as an advanced escape hatch and include it
  in the generated config schema
  
  ## Testing
  
  - `cargo test -p codex-core provider_auth_command`
  - `cargo test -p codex-core
  refresh_available_models_uses_provider_auth_token`
  - `cargo test -p codex-core
  test_deserialize_provider_auth_config_defaults`
  
  ## Docs
  
  - `developers.openai.com/codex` should document the new
  `[model_providers.<id>.auth]` block and the token-command contract

  Michael Bolin · 2026-03-31 01:37:27 -07:00
  20f43c1e05
• Remove TUI voice transcription feature (#16114)

  Removes the partially-completed TUI composer voice transcription flow,
  including its feature flag, app events, and hold-to-talk state machine.

  Eric Traut · 2026-03-29 00:20:25 +00:00
  3bbc1ce003
• chore: refactor network permissions to use explicit domain and unix socket rule maps (#15120)

  ## Summary
  
  This PR replaces the legacy network allow/deny list model with explicit
  rule maps for domains and unix sockets across managed requirements,
  permissions profiles, the network proxy config, and the app server
  protocol.
  
  Concretely, it:
  
  - introduces typed domain (`allow` / `deny`) and unix socket permission
  (`allow` / `none`) entries instead of separate `allowed_domains`,
  `denied_domains`, and `allow_unix_sockets` lists
  - updates config loading, managed requirements merging, and exec-policy
  overlays to read and upsert rule entries consistently
  - exposes the new shape through protocol/schema outputs, debug surfaces,
  and app-server config APIs
  - rejects the legacy list-based keys and updates docs/tests to reflect
  the new config format
  
  ## Why
  
  The previous representation split related network policy across multiple
  parallel lists, which made merging and overriding rules harder to reason
  about. Moving to explicit keyed permission maps gives us a single source
  of truth per host/socket entry, makes allow/deny precedence clearer, and
  gives protocol consumers access to the full rule state instead of
  derived projections only.
  
  ## Backward Compatibility
  
  ### Backward compatible
  
  - Managed requirements still accept the legacy
  `experimental_network.allowed_domains`,
  `experimental_network.denied_domains`, and
  `experimental_network.allow_unix_sockets` fields. They are normalized
  into the new canonical `domains` and `unix_sockets` maps internally.
  - App-server v2 still deserializes legacy `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` payloads, so older clients can
  continue reading managed network requirements.
  - App-server v2 responses still populate `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` as legacy compatibility views
  derived from the canonical maps.
  - `managed_allowed_domains_only` keeps the same behavior after
  normalization. Legacy managed allowlists still participate in the same
  enforcement path as canonical `domains` entries.
  
  ### Not backward compatible
  
  - Permissions profiles under `[permissions.<profile>.network]` no longer
  accept the legacy list-based keys. Those configs must use the canonical
  `[domains]` and `[unix_sockets]` tables instead of `allowed_domains`,
  `denied_domains`, or `allow_unix_sockets`.
  - Managed `experimental_network` config cannot mix canonical and legacy
  forms in the same block. For example, `domains` cannot be combined with
  `allowed_domains` or `denied_domains`, and `unix_sockets` cannot be
  combined with `allow_unix_sockets`.
  - The canonical format can express explicit `"none"` entries for unix
  sockets, but those entries do not round-trip through the legacy
  compatibility fields because the legacy fields only represent allow/deny
  lists.
  ## Testing
  `/target/debug/codex sandbox macos --log-denials /bin/zsh -c 'curl
  https://www.example.com' ` gives 200 with config
  ```
  [permissions.workspace.network.domains]
  "www.example.com" = "allow"
  ```
  and fails when set to deny: `curl: (56) CONNECT tunnel failed, response
  403`.
  
  Also tested backward compatibility path by verifying that adding the
  following to `/etc/codex/requirements.toml` works:
  ```
  [experimental_network]
  allowed_domains = ["www.example.com"]
  ```

  Celia Chen · 2026-03-27 06:17:59 +00:00
  dd30c8eedd
• [mcp] Fix legacy_tools (#15885)

  - [x] Fix legacy_tools

  Matthew Zeng · 2026-03-26 11:08:49 -07:00
  25134b592c
• feat: drop artifact tool and feature (#15851)
  jif-oai · 2026-03-26 13:21:24 +01:00
  b00a05c785
• [mcp] Improve custom MCP elicitation (#15800)

  - [x] Support don't ask again for custom MCP tool calls.
  - [x] Don't run arc in yolo mode.
  - [x] Run arc for custom MCP tools in always allow mode.

  Matthew Zeng · 2026-03-26 01:02:37 +00:00
  78799c1bcf
• Add cached environment manager for exec server URL (#15785)

  Add environment manager that is a singleton and is created early in
  app-server (before skill manager, before config loading).
  
  Use an environment variable to point to a running exec server.

  pakrym-oai · 2026-03-25 16:14:36 -07:00
  8fa88fa8ca
• [plugins] Add a flag for tool search. (#15722)

  - [x] Add a flag for tool search.

  Matthew Zeng · 2026-03-25 07:00:25 +00:00
  e590fad50b
• feat: support disable skills by name. (#15378)

  Support disabling skills by name, primarily for plugin skills. We can’t
  use the path, since plugin skill paths may change across versions.

  xl-openai · 2026-03-23 12:57:40 -07:00
  9a33e5c0a0
• chore(core) Remove Feature::PowershellUtf8 (#15128)

  ## Summary
  This feature has been enabled for powershell for a while now, let's get
  rid of the logic
  
  ## Testing
  - [x] Unit tests

  Dylan Hurd · 2026-03-20 22:03:31 +00:00
  ea8b07e680
• feat: change multi-agent to use path-like system instead of uuids (#15313)

  This PR add an URI-based system to reference agents within a tree. This
  comes from a sync between research and engineering.
  
  The main agent (the one manually spawned by a user) is always called
  `/root`. Any sub-agent spawned by it will be `/root/agent_1` for example
  where `agent_1` is chosen by the model.
  
  Any agent can contact any agents using the path.
  
  Paths can be used either in absolute or relative to the calling agents
  
  Resume is not supported for now on this new path

  jif-oai · 2026-03-20 18:23:48 +00:00
  79ad7b247b
• feat(tui): add /title terminal title configuration (#12334)

  ## Problem
  
  When multiple Codex sessions are open at once, terminal tabs and windows
  are hard to distinguish from each other. The existing status line only
  helps once the TUI is already focused, so it does not solve the "which
  tab is this?" problem.
  
  This PR adds a first-class `/title` command so the terminal window or
  tab title can carry a short, configurable summary of the current
  session.
  
  ## Screenshot
  
  <img width="849" height="320" alt="image"
  src="https://github.com/user-attachments/assets/8b112927-7890-45ed-bb1e-adf2f584663d"
  />
  
  ## Mental model
  
  `/statusline` and `/title` are separate status surfaces with different
  constraints. The status line is an in-app footer that can be denser and
  more detailed. The terminal title is external terminal metadata, so it
  needs short, stable segments that still make multiple sessions easy to
  tell apart.
  
  The `/title` configuration is an ordered list of compact items. By
  default it renders `spinner,project`, so active sessions show
  lightweight progress first while idle sessions still stay easy to
  disambiguate. Each configured item is omitted when its value is not
  currently available rather than forcing a placeholder.
  
  ## Non-goals
  
  This does not merge `/title` into `/statusline`, and it does not add an
  arbitrary free-form title string. The feature is intentionally limited
  to a small set of structured items so the title stays short and
  reviewable.
  
  This also does not attempt to restore whatever title the terminal or
  shell had before Codex started. When Codex clears the title, it clears
  the title Codex last wrote.
  
  ## Tradeoffs
  
  A separate `/title` command adds some conceptual overlap with
  `/statusline`, but it keeps title-specific constraints explicit instead
  of forcing the status line model to cover two different surfaces.
  
  Title refresh can happen frequently, so the implementation now shares
  parsing and git-branch orchestration between the status line and title
  paths, and caches the derived project-root name by cwd. That keeps the
  hot path cheap without introducing background polling.
  
  ## Architecture
  
  The TUI gets a new `/title` slash command and a dedicated picker UI for
  selecting and ordering terminal-title items. The chosen ids are
  persisted in `tui.terminal_title`, with `spinner` and `project` as the
  default when the config is unset. `status` remains available as a
  separate text item, so configurations like `spinner,status` render
  compact progress like `⠋ Working`.
  
  `ChatWidget` now refreshes both status surfaces through a shared
  `refresh_status_surfaces()` path. That shared path parses configured
  items once, warns on invalid ids once, synchronizes shared cached state
  such as git-branch lookup, then renders the footer status line and
  terminal title from the same snapshot.
  
  Low-level OSC title writes live in `codex-rs/tui/src/terminal_title.rs`,
  which owns the terminal write path and last-mile sanitization before
  emitting OSC 0.
  
  ## Security
  
  Terminal-title text is treated as untrusted display content before Codex
  emits it. The write path strips control characters, removes invisible
  and bidi formatting characters that can make the title visually
  misleading, normalizes whitespace, and caps the emitted length.
  
  References used while implementing this:
  
  - [xterm control
  sequences](https://invisible-island.net/xterm/ctlseqs/ctlseqs.html)
  - [WezTerm escape sequences](https://wezterm.org/escape-sequences.html)
  - [CWE-150: Improper Neutralization of Escape, Meta, or Control
  Sequences](https://cwe.mitre.org/data/definitions/150.html)
  - [CERT VU#999008 (Trojan Source)](https://kb.cert.org/vuls/id/999008)
  - [Trojan Source disclosure site](https://trojansource.codes/)
  - [Unicode Bidirectional Algorithm (UAX
  #9)](https://www.unicode.org/reports/tr9/)
  - [Unicode Security Considerations (UTR
  #36)](https://www.unicode.org/reports/tr36/)
  
  ## Observability
  
  Unknown configured title item ids are warned about once instead of
  repeatedly spamming the transcript. Live preview applies immediately
  while the `/title` picker is open, and cancel rolls the in-memory title
  selection back to the pre-picker value.
  
  If terminal title writes fail, the TUI emits debug logs around set and
  clear attempts. The rendered status label intentionally collapses richer
  internal states into compact title text such as `Starting...`, `Ready`,
  `Thinking...`, `Working...`, `Waiting...`, and `Undoing...` when
  `status` is configured.
  
  ## Tests
  
  Ran:
  
  - `just fmt`
  - `cargo test -p codex-tui`
  
  At the moment, the red Windows `rust-ci` failures are due to existing
  `codex-core` `apply_patch_cli` stack-overflow tests that also reproduce
  on `main`. The `/title`-specific `codex-tui` suite is green.

  Yaroslav Volovich · 2026-03-19 19:26:36 +00:00
  60cd0cf75e
• Add experimental exec server URL handling (#15196)

  Add a config and attempt to start the server.

  pakrym-oai · 2026-03-19 18:25:11 +00:00
  1837038f4e
• [plugins] Support configuration tool suggest allowlist. (#15022)

  - [x] Support configuration tool suggest allowlist.
  
  Supports both plugins and connectors.

  Matthew Zeng · 2026-03-17 23:58:27 -07:00
  40a7d1d15b
• Gate realtime audio interruption logic to v2 (#14984)

  - thread the realtime version into conversation start and app-server
  notifications
  - keep playback-aware mic gating and playback interruption behavior on
  v2 only, leaving v1 on the legacy path

  Ahmed Ibrahim · 2026-03-17 15:24:37 -07:00
  c6ab4ee537
• fix(core): prevent hanging turn/start due to websocket warming issues (#14838)

  ## Description
  
  This PR fixes a bad first-turn failure mode in app-server when the
  startup websocket prewarm hangs. Before this change, `initialize ->
  thread/start -> turn/start` could sit behind the prewarm for up to five
  minutes, so the client would not see `turn/started`, and even
  `turn/interrupt` would block because the turn had not actually started
  yet.
  
  Now, we:
  - set a (configurable) timeout of 15s for websocket startup time,
  exposed as `websocket_startup_timeout_ms` in config.toml
  - `turn/started` is sent immediately on `turn/start` even if the
  websocket is still connecting
  - `turn/interrupt` can be used to cancel a turn that is still waiting on
  the websocket warmup
  - the turn task will wait for the full 15s websocket warming timeout
  before falling back
  
  ## Why
  
  The old behavior made app-server feel stuck at exactly the moment the
  client expects turn lifecycle events to start flowing. That was
  especially painful for external clients, because from their point of
  view the server had accepted the request but then went silent for
  minutes.
  
  ## Configuring the websocket startup timeout
  Can set it in config.toml like this:
  ```
  [model_providers.openai]
  supports_websockets = true
  websocket_connect_timeout_ms = 15000
  ```

  Owen Lin · 2026-03-17 10:07:46 -07:00
  6ea041032b
• Move TUI on top of app server (parallel code) (#14717)

  This PR replicates the `tui` code directory and creates a temporary
  parallel `tui_app_server` directory. It also implements a new feature
  flag `tui_app_server` to select between the two tui implementations.
  
  Once the new app-server-based TUI is stabilized, we'll delete the old
  `tui` directory and feature flag.

  Eric Traut · 2026-03-16 10:49:19 -06:00
  db89b73a9c