171 Commits

• chore: remove codex-core public protocol/shell re-exports (#12432)

  ## Why
  
  `codex-rs/core/src/lib.rs` re-exported a broad set of types and modules
  from `codex-protocol` and `codex-shell-command`. That made it easy for
  workspace crates to import those APIs through `codex-core`, which in
  turn hides dependency edges and makes it harder to reduce compile-time
  coupling over time.
  
  This change removes those public re-exports so call sites must import
  from the source crates directly. Even when a crate still depends on
  `codex-core` today, this makes dependency boundaries explicit and
  unblocks future work to drop `codex-core` dependencies where possible.
  
  ## What Changed
  
  - Removed public re-exports from `codex-rs/core/src/lib.rs` for:
  - `codex_protocol::protocol` and related protocol/model types (including
  `InitialHistory`)
    - `codex_protocol::config_types` (`protocol_config_types`)
  - `codex_shell_command::{bash, is_dangerous_command, is_safe_command,
  parse_command, powershell}`
  - Migrated workspace Rust call sites to import directly from:
    - `codex_protocol::protocol`
    - `codex_protocol::config_types`
    - `codex_protocol::models`
    - `codex_shell_command`
  - Added explicit `Cargo.toml` dependencies (`codex-protocol` /
  `codex-shell-command`) in crates that now import those crates directly.
  - Kept `codex-core` internal modules compiling by using `pub(crate)`
  aliases in `core/src/lib.rs` (internal-only, not part of the public
  API).
  - Updated the two utility crates that can already drop a `codex-core`
  dependency edge entirely:
    - `codex-utils-approval-presets`
    - `codex-utils-cli`
  
  ## Verification
  
  - `cargo test -p codex-utils-approval-presets`
  - `cargo test -p codex-utils-cli`
  - `cargo check --workspace --all-targets`
  - `just clippy`

  Michael Bolin · 2026-02-20 23:45:35 -08:00
  1af2a37ada
• test(app-server): wait for turn/completed in turn_start tests (#12376)

  ## Summary
  - switch a few app-server `turn_start` tests from
  `codex/event/task_complete` waits to `turn/completed` waits
  - avoid matching unrelated/background `task_complete` events
  - keep this flaky test fix separate from the /title feature PR
  
  ## Why
  On Windows ARM CI, these tests can return early after observing a
  generic `codex/event/task_complete` notification from another task. That
  can leave the mock Responses server with fewer calls than expected and
  fail the test with a wiremock verification mismatch.
  
  Using `turn/completed` matches the app-server turn lifecycle
  notification the tests actually care about.
  
  ## Validation
  - `cargo test -p codex-app-server
  turn_start_updates_sandbox_and_cwd_between_turns_v2 -- --nocapture`
  - `cargo test -p codex-app-server turn_start_exec_approval_ --
  --nocapture`
  - `just fmt`

  Yaroslav Volovich · 2026-02-20 21:15:21 -08:00
  dca9c40dd5
• Add field to Thread object for the latest rename set for a given thread (#12301)

  Exposes through the app server updated names set for a thread. This
  enables other surfaces to use the core as the source of truth for thread
  naming. `threadName` is gathered using the helper functions used to
  interact with `session_index.jsonl`, and is hydrated in:
  - `thread/list`
  - `thread/read`
  - `thread/resume`
  - `thread/unarchive`
  - `thread/rollback`
  
  We don't do this for `thread/start` and `thread/fork`.

  natea-oai · 2026-02-20 18:26:57 -08:00
  936e744c93
• [apps] Enforce simple logo url format. (#12374)

  - [x] Enforce simple logo url format when loading apps directory to save
  bandwidth.

  Matthew Zeng · 2026-02-20 22:05:55 +00:00
  354e7fedd2
• [apps] Implement apps configs. (#12086)

  - [x] Implement apps configs.

  Matthew Zeng · 2026-02-20 12:05:21 -08:00
  aa121a115e
• feat: add nick name to sub-agents (#12320)

  Adding random nick name to sub-agents. Used for UX
  
  At the same time, also storing and wiring the role of the sub-agent

  jif-oai · 2026-02-20 14:39:49 +00:00
  0f9eed3a6f
• app-server: fix flaky list_apps_returns_connectors_with_accessible_flags test (#12286)

  ## Why
  
  `app/list` emits `app/list/updated` after whichever async load finishes
  first (directory connectors or accessible tools). This test assumed the
  directory-backed update always arrived first because it injected a tools
  delay, but that assumption is not stable when the process-global Codex
  Apps tools cache is already warm. In that case the accessible-tools path
  can return immediately and the first notification shape flips, which
  makes the assertion flaky.
  
  Relevant code paths:
  
  -
  [`codex-rs/app-server/src/codex_message_processor.rs`](https://github.com/openai/codex/blob/13ec97d72e3482f16c62e0a22025a0542133e623/codex-rs/app-server/src/codex_message_processor.rs#L4949-L5034)
  (concurrent loads + per-load `app/list/updated` notifications)
  -
  [`codex-rs/core/src/mcp_connection_manager.rs`](https://github.com/openai/codex/blob/13ec97d72e3482f16c62e0a22025a0542133e623/codex-rs/core/src/mcp_connection_manager.rs#L1182-L1197)
  (Codex Apps tools cache hit path)
  
  ## What Changed
  
  Updated
  `suite::v2::app_list::list_apps_returns_connectors_with_accessible_flags`
  in `codex-rs/app-server/tests/suite/v2/app_list.rs` to accept either
  valid first `app/list/updated` payload:
  
  - the directory-first snapshot
  - the accessible-tools-first snapshot
  
  The test still keeps the later assertions strict:
  
  - the second `app/list/updated` notification must be the fully merged
  result
  - the final `app/list` response must match the same merged result
  
  I also added an inline comment explaining why the first notification is
  intentionally order-insensitive.
  
  ## Verification
  
  - `cargo test -p codex-app-server`

  Michael Bolin · 2026-02-20 02:27:18 +00:00
  366ecaf17a
• tests: centralize in-flight turn cleanup helper (#12271)

  ## Why
  
  Several tests intentionally exercise behavior while a turn is still
  active. The cleanup sequence for those tests (`turn/interrupt` + waiting
  for `codex/event/turn_aborted`) was duplicated across files, which made
  the rationale easy to lose and the pattern easy to apply inconsistently.
  
  This change centralizes that cleanup in one place with a single
  explanatory doc comment.
  
  ## What Changed
  
  ### Added shared helper
  
  In `codex-rs/app-server/tests/common/mcp_process.rs`:
  
  - Added `McpProcess::interrupt_turn_and_wait_for_aborted(...)`.
  - Added a doc comment explaining why explicit interrupt + terminal wait
  is required for tests that intentionally leave a turn in-flight.
  
  ### Migrated call sites
  
  Replaced duplicated interrupt/aborted blocks with the helper in:
  
  - `codex-rs/app-server/tests/suite/v2/thread_resume.rs`
    - `thread_resume_rejects_history_when_thread_is_running`
    - `thread_resume_rejects_mismatched_path_when_thread_is_running`
  - `codex-rs/app-server/tests/suite/v2/turn_start_zsh_fork.rs`
    - `turn_start_shell_zsh_fork_executes_command_v2`
  -
  `turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2`
  - `codex-rs/app-server/tests/suite/v2/turn_steer.rs`
    - `turn_steer_returns_active_turn_id`
  
  ### Existing cleanup retained
  
  In `codex-rs/app-server/tests/suite/v2/turn_start.rs`:
  
  - `turn_start_accepts_local_image_input` continues to explicitly wait
  for `turn/completed` so the turn lifecycle is fully drained before test
  exit.
  
  ## Verification
  
  - `cargo test -p codex-app-server`

  Michael Bolin · 2026-02-20 01:47:34 +00:00
  4fa304306b
• tests(thread_resume): interrupt running turns in resume error-path tests (#12269)

  ## Why
  
  `thread_resume` tests can intentionally create an in-flight turn, assert
  a `thread/resume` error path, and return immediately. That leaves turn
  work active during teardown, which can surface as intermittent `LEAK`
  failures.
  
  Sample output that motivated this investigation (reported during test
  runs):
  
  ```text
  LEAK ... codex-app-server::all suite::v2::thread_resume::thread_resume_rejoins_running_thread_even_with_override_mismatch
  ```
  
  ## What Changed
  
  Updated only `codex-rs/app-server/tests/suite/v2/thread_resume.rs`:
  
  - `thread_resume_rejects_history_when_thread_is_running`
  - `thread_resume_rejects_mismatched_path_when_thread_is_running`
  
  Both tests now:
  
  1. capture the running turn id from `TurnStartResponse`
  2. assert the expected `thread/resume` error
  3. call `turn/interrupt` for that running turn
  4. wait for `codex/event/turn_aborted` before returning
  
  ## Why This Is The Correct Fix
  
  These tests are specifically validating resume behavior while a turn is
  active. They should also own cleanup of that active turn before exiting.
  Explicitly interrupting and waiting for the terminal abort notification
  removes teardown races and avoids relying on process-drop behavior to
  clean up in-flight work.
  
  ## Repro / Verification
  
  Repro command used for investigation:
  
  ```bash
  cargo nextest run -p codex-app-server -j 2 --no-fail-fast --stress-count 50 --status-level leak --final-status-level fail -E 'test(suite::v2::thread_resume::thread_resume_rejoins_running_thread_even_with_override_mismatch) | test(suite::v2::thread_resume::thread_resume_rejects_history_when_thread_is_running) | test(suite::v2::thread_resume::thread_resume_rejects_mismatched_path_when_thread_is_running) | test(suite::v2::thread_resume::thread_resume_keeps_in_flight_turn_streaming)'
  ```
  
  Observed before this change: intermittent `LEAK` in
  `thread_resume_rejects_history_when_thread_is_running`.
  
  Also verified with:
  
  - `cargo test -p codex-app-server`
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/12269).
  * #12271
  * __->__ #12269

  Michael Bolin · 2026-02-19 21:51:18 +00:00
  7ed3e3760d
• Stabilize app-server detached review and running-resume tests (#12203)

  ## Summary
  - stabilize
  `thread_resume_rejoins_running_thread_even_with_override_mismatch` by
  using a valid delayed second SSE response instead of an intentionally
  truncated stream
  - set `RUST_MIN_STACK=4194304` for spawned app-server test processes in
  `McpProcess` to avoid stack-sensitive CI overflows in detached review
  tests
  
  ## Why
  - the thread-resume assertion could race with a mocked stream-disconnect
  error and intermittently observe `systemError`
  - detached review startup is stack-sensitive in some CI environments;
  pinning a larger stack in the test harness removes that flake without
  changing product behavior
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-app-server --test all
  suite::v2::thread_resume::thread_resume_rejoins_running_thread_even_with_override_mismatch`
  - `cargo test -p codex-app-server --test all
  suite::v2::review::review_start_with_detached_delivery_returns_new_thread_id`

  Charley Cunningham · 2026-02-18 19:05:35 -08:00
  16c3c47535
• app-server: expose loaded thread status via read/list and notifications (#11786)

  Motivation
  - Today, a newly connected client has no direct way to determine the
  current runtime status of threads from read/list responses alone.
  - This forces clients to infer state from transient events, which can
  lead to stale or inconsistent UI when reconnecting or attaching late.
  
  Changes
  - Add `status` to `thread/read` responses.
  - Add `statuses` to `thread/list` responses.
  - Emit `thread/status/changed` notifications with `threadId` and the new
  status.
  - Track runtime status for all loaded threads and default unknown
  threads to `idle`.
  - Update protocol/docs/tests/schema fixtures for the revised API.
  
  Testing
  - Validated protocol API changes with automated protocol tests and
  regenerated schema/type fixtures.
  - Validated app-server behavior with unit and integration test suites,
  including status transitions and notifications.

  Ruslan Nigmatullin · 2026-02-18 15:20:03 -08:00
  1f54496c48
• app-server support for Windows sandbox setup. (#12025)

  app-server support for initiating Windows sandbox setup.
  server responds quickly to setup request and makes a future RPC call
  back to client when the setup finishes.
  
  The TUI implementation is unaffected but in a future PR I'll update the
  TUI to use the shared setup helper
  (`windows_sandbox.run_windows_sandbox_setup`)

  iceweasel-oai · 2026-02-18 13:03:16 -08:00
  292542616a
• feat(core): zsh exec bridge (#12052)

  zsh fork PR stack:
  - https://github.com/openai/codex/pull/12051 
  - https://github.com/openai/codex/pull/12052 👈 
  
  ### Summary
  This PR introduces a feature-gated native shell runtime path that routes
  shell execution through a patched zsh exec bridge, removing MCP-specific
  behavior from the shell hot path while preserving existing
  CommandExecution lifecycle semantics.
  
  When shell_zsh_fork is enabled, shell commands run via patched zsh with
  per-`execve` interception through EXEC_WRAPPER. Core receives wrapper
  IPC requests over a Unix socket, applies existing approval policy, and
  returns allow/deny before the subcommand executes.
  
  ### What’s included
  **1) New zsh exec bridge runtime in core**
  - Wrapper-mode entrypoint (maybe_run_zsh_exec_wrapper_mode) for
  EXEC_WRAPPER invocations.
  - Per-execution Unix-socket IPC handling for wrapper requests/responses.
  - Approval callback integration using existing core approval
  orchestration.
  - Streaming stdout/stderr deltas to existing command output event
  pipeline.
  - Error handling for malformed IPC, denial/abort, and execution
  failures.
  
  **2) Session lifecycle integration**
  SessionServices now owns a `ZshExecBridge`.
  Session startup initializes bridge state; shutdown tears it down
  cleanly.
  
  **3) Shell runtime routing (feature-gated)**
  When `shell_zsh_fork` is enabled:
  - Build execution env/spec as usual.
  - Add wrapper socket env wiring.
  - Execute via `zsh_exec_bridge.execute_shell_request(...)` instead of
  the regular shell path.
  - Non-zsh-fork behavior remains unchanged.
  
  **4) Config + feature wiring**
  - Added `Feature::ShellZshFork` (under development).
  - Added config support for `zsh_path` (optional absolute path to patched
  zsh):
  - `Config`, `ConfigToml`, `ConfigProfile`, overrides, and schema.
  - Session startup validates that `zsh_path` exists/usable when zsh-fork
  is enabled.
  - Added startup test for missing `zsh_path` failure mode.
  
  **5) Seatbelt/sandbox updates for wrapper IPC**
  - Extended seatbelt policy generation to optionally allow outbound
  connection to explicitly permitted Unix sockets.
  - Wired sandboxing path to pass wrapper socket path through to seatbelt
  policy generation.
  - Added/updated seatbelt tests for explicit socket allow rule and
  argument emission.
  
  **6) Runtime entrypoint hooks**
  - This allows the same binary to act as the zsh wrapper subprocess when
  invoked via `EXEC_WRAPPER`.
  
  **7) Tool selection behavior**
  - ToolsConfig now prefers ShellCommand type when shell_zsh_fork is
  enabled.
  - Added test coverage for precedence with unified-exec enabled.

  Owen Lin · 2026-02-17 20:19:53 -08:00
  edacbf7b6e
• Chore: remove response model check and rely on header model for downgrade (#12061)

  ### Summary
  Ensure that we use the model value from the response header only so that
  we are guaranteed with the correct slug name. We are no longer checking
  against the model value from response so that we are less likely to have
  false positive.
  
  There are two different treatments - for SSE we use the header from the
  response and for websocket we check top-level events.

  Shijie Rao · 2026-02-18 01:50:06 +00:00
  b3a8571219
• app-server: Emit thread archive/unarchive notifications (#12030)

  * Add v2 server notifications `thread/archived` and `thread/unarchived`
  with a `threadId` payload.
  * Wire new events into `thread/archive` and `thread/unarchive` success
  paths.
  * Update app-server protocol/schema/docs accordingly.
  
  Testing:
  - Updated archive/unarchive end-to-end tests to verify both
  notifications are emitted with the expected thread id payload.

  Ruslan Nigmatullin · 2026-02-17 14:53:58 -08:00
  31cbebd3c2
• [apps] Expose more fields from apps listing endpoints. (#11706)

  - [x] Expose app_metadata, branding, and labels in AppInfo.

  Matthew Zeng · 2026-02-17 11:45:04 -08:00
  16fa195fce
• chore: rm remote models fflag (#11699)

  rm `remote_models` feature flag.
  
  We see issues like #11527 when a user has `remote_models` disabled, as
  we always use the default fallback `ModelInfo`. This causes issues with
  model performance.
  
  Builds on #11690, which helps by warning the user when they are using
  the default fallback. This PR will make that happen much less frequently
  as an accidental consequence of disabling `remote_models`.

  sayan-oai · 2026-02-17 11:43:16 -08:00
  41800fc876
• Feat: add model reroute notification (#12001)

  ### Summary
  Builiding off
  https://github.com/openai/codex/pull/11964/files/5c75aa7b89a70bc2cc410a6fd238749306ec4c5e#diff-058ae8f109a8b84b4b79bbfa45f522c2233b9d9e139696044ae374d50b6196e0,
  we have created a `model/rerouted` notification that captures the event
  so that consumers can render as expected. Keep the `EventMsg::Warning`
  path in core so that this does not affect TUI rendering.
  
  `model/rerouted` is meant to be generic to account for future usage
  including capacity planning etc.

  Shijie Rao · 2026-02-17 11:02:23 -08:00
  48018e9eac
• add(core): safety check downgrade warning (#11964)

  Add per-turn notice when a request is downgraded to a fallback model due
  to cyber safety checks.
  
  **Changes**
  
  - codex-api: Emit a ServerModel event based on the openai-model response
  header and/or response payload (SSE + WebSocket), including when the
  model changes mid-stream.
  - core: When the server-reported model differs from the requested model,
  emit a single per-turn warning explaining the reroute to gpt-5.2 and
  directing users to Trusted
      Access verification and the cyber safety explainer.
  - app-server (v2): Surface these cyber model-routing warnings as
  synthetic userMessage items with text prefixed by Warning: (and document
  this behavior).

  Fouad Matin · 2026-02-16 22:13:36 -08:00
  02e9006547
• fix: send unfiltered models over model/list (#11793)

  ### What
  to unblock filtering models in VSCE, change `model/list` app-server
  endpoint to send all models + visibility field `showInPicker` so
  filtering can be done in VSCE if desired.
  
  ### Tests
  Updated tests.

  sayan-oai · 2026-02-13 16:26:32 -08:00
  6b466df146
• codex-rs: fix thread resume rejoin semantics (#11756)

  ## Summary
  - always rejoin an in-memory running thread on `thread/resume`, even
  when overrides are present
  - reject `thread/resume` when `history` is provided for a running thread
  - reject `thread/resume` when `path` mismatches the running thread
  rollout path
  - warn (but do not fail) on override mismatches for running threads
  - add more `thread_resume` integration tests and fixes; including
  restart-based resume-with-overrides coverage
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-app-server --test all thread_resume`
  - manual test with app-server-test-client
  https://github.com/openai/codex/pull/11755
  - manual test both stdio and websocket in app

  Max Johnson · 2026-02-13 23:09:58 +00:00
  fb0aaf94de
• [apps] Fix app loading logic. (#11518)

  When `app/list` is called with `force_refetch=True`, we should seed the
  results with what is already cached instead of starting from an empty
  list. Otherwise when we send app/list/updated events, the client will
  first see an empty list of accessible apps and then get the updated one.

  Matthew Zeng · 2026-02-13 03:55:10 +00:00
  f93037f55d
• Add cwd as an optional field to thread/list (#11651)

  Add's the ability to filter app-server thread/list by cwd

  acrognale-oai · 2026-02-13 02:05:04 +00:00
  ebe359b876
• [apps] Add is_enabled to app info. (#11417)

  - [x] Add is_enabled to app info and the response of `app/list`.
  - [x] Update TUI to have Enable/Disable button on the app detail page.

  Matthew Zeng · 2026-02-13 00:30:52 +00:00
  c37560069a
• app-server tests: disable shell_snapshot for review suite (#11657)

  ## Why
  
  
  `suite::v2::review::review_start_with_detached_delivery_returns_new_thread_id`
  was failing on Windows CI due to an unrelated process crash during shell
  snapshot initialization (`tokio-runtime-worker` stack overflow).
  
  This review test suite validates review API behavior and should not
  depend on shell snapshot behavior. Keeping shell snapshot enabled in
  this fixture made the test flaky for reasons outside the scenario under
  test.
  
  ## What Changed
  
  - Updated the review suite test config in
  `codex-rs/app-server/tests/suite/v2/review.rs` to set:
    - `shell_snapshot = false`
  
  This keeps the review tests focused on review behavior by disabling
  shell snapshot initialization in this fixture.
  
  ## Verification
  
  - `cargo test -p codex-app-server`
  - Confirmed the previously failing Windows CI job for this test now
  passes on this PR.

  Michael Bolin · 2026-02-12 23:56:43 +00:00
  aef4af1079
• fix: skip review_start_with_detached_delivery_returns_new_thread_id o… (#11645)

  …n windows

  Owen Lin · 2026-02-12 15:12:57 -08:00
  76256a8cec
• feat: make sandbox read access configurable with ReadOnlyAccess (#11387)

  `SandboxPolicy::ReadOnly` previously implied broad read access and could
  not express a narrower read surface.
  This change introduces an explicit read-access model so we can support
  user-configurable read restrictions in follow-up work, while preserving
  current behavior today.
  
  It also ensures unsupported backends fail closed for restricted-read
  policies instead of silently granting broader access than intended.
  
  ## What
  
  - Added `ReadOnlyAccess` in protocol with:
    - `Restricted { include_platform_defaults, readable_roots }`
    - `FullAccess`
  - Updated `SandboxPolicy` to carry read-access configuration:
    - `ReadOnly { access: ReadOnlyAccess }`
    - `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
  - Preserved existing behavior by defaulting current construction paths
  to `ReadOnlyAccess::FullAccess`.
  - Threaded the new fields through sandbox policy consumers and call
  sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
  related tests.
  - Updated Seatbelt policy generation to honor restricted read roots by
  emitting scoped read rules when full read access is not granted.
  - Added fail-closed behavior on Linux and Windows backends when
  restricted read access is requested but not yet implemented there
  (`UnsupportedOperation`).
  - Regenerated app-server protocol schema and TypeScript artifacts,
  including `ReadOnlyAccess`.
  
  ## Compatibility / rollout
  
  - Runtime behavior remains unchanged by default (`FullAccess`).
  - API/schema changes are in place so future config wiring can enable
  restricted read access without another policy-shape migration.

  Michael Bolin · 2026-02-11 18:31:14 -08:00
  abbd74e2be
• test(app-server): stabilize app/list thread feature-flag test by using file-backed MCP OAuth creds (#11521)

  ## Why
  
  `suite::v2::app_list::list_apps_uses_thread_feature_flag_when_thread_id_is_provided`
  has been flaky in CI. The test exercises `thread/start`, which
  initializes `codex_apps`. In CI/Linux, that path can reach OS
  keyring-backed MCP OAuth credential lookup (`Codex MCP Credentials`) and
  intermittently abort the MCP process (observed stack overflow in
  `zbus`), causing the test to fail before the assertion logic runs.
  
  ## What Changed
  
  - Updated the test config in
  `codex-rs/app-server/tests/suite/v2/app_list.rs` to set
  `mcp_oauth_credentials_store = "file"` in both relevant config-writing
  paths:
  - The in-test config override inside
  `list_apps_uses_thread_feature_flag_when_thread_id_is_provided`
  - `write_connectors_config(...)`, which is used by the v2 `app_list`
  test suite
  - This keeps test coverage focused on thread-scoped app feature flags
  while removing OS keyring/DBus dependency from this test path.
  
  ## How It Was Verified
  
  - `cargo test -p codex-app-server`
  - `cargo test -p codex-app-server
  list_apps_uses_thread_feature_flag_when_thread_id_is_provided --
  --nocapture`

  Michael Bolin · 2026-02-11 18:30:18 -08:00
  572ab66496
• Reapply "Add app-server transport layer with websocket support" (#11370)

  Reapply "Add app-server transport layer with websocket support" with
  additional fixes from https://github.com/openai/codex/pull/11313/changes
  to avoid deadlocking.
  
  This reverts commit 47356ff83c.
  
  ## Summary
  
  To avoid deadlocking when queues are full, we maintain separate tokio
  tasks dedicated to incoming vs outgoing event handling
  - split the app-server main loop into two tasks in
  `run_main_with_transport`
     - inbound handling (`transport_event_rx`)
     - outbound handling (`outgoing_rx` + `thread_created_rx`)
  - separate incoming and outgoing websocket tasks
  
  ## Validation
  
  Integration tests, testing thoroughly e2e in codex app w/ >10 concurrent
  requests
  
  <img width="1365" height="979" alt="Screenshot 2026-02-10 at 2 54 22 PM"
  src="https://github.com/user-attachments/assets/47ca2c13-f322-4e5c-bedd-25859cbdc45f"
  />
  
  ---------
  
  Co-authored-by: jif-oai <jif@openai.com>

  Max Johnson · 2026-02-11 18:13:39 +00:00
  7053aa5457
• Remove test-support feature from codex-core and replace it with explicit test toggles (#11405)

  ## Why
  
  `codex-core` was being built in multiple feature-resolved permutations
  because test-only behavior was modeled as crate features. For a large
  crate, those permutations increase compile cost and reduce cache reuse.
  
  ## Net Change
  
  - Removed the `test-support` crate feature and related feature wiring so
  `codex-core` no longer needs separate feature shapes for test consumers.
  - Standardized cross-crate test-only access behind
  `codex_core::test_support`.
  - External test code now imports helpers from
  `codex_core::test_support`.
  - Underlying implementation hooks are kept internal (`pub(crate)`)
  instead of broadly public.
  
  ## Outcome
  
  - Fewer `codex-core` build permutations.
  - Better incremental cache reuse across test targets.
  - No intended production behavior change.

  Michael Bolin · 2026-02-10 22:44:02 -08:00
  476c1a7160
• feat: support multiple rate limits (#11260)

  Added multi-limit support end-to-end by carrying limit_name in
  rate-limit snapshots and handling multiple buckets instead of only
  codex.
  Extended /usage client parsing to consume additional_rate_limits
  Updated TUI /status and in-memory state to store/render per-limit
  snapshots
  Extended app-server rate-limit read response: kept rate_limits and added
  rate_limits_by_name.
  Adjusted usage-limit error messaging for non-default codex limit buckets

  xl-openai · 2026-02-10 20:09:31 -08:00
  fdd0cd1de9
• Disable very flaky tests (#11394)

  Collected from last 20 builds of main in
  https://github.com/openai/codex/commits/main/.

  pakrym-oai · 2026-02-10 18:50:11 -08:00
  bfd4e2112c
• fix: reduce usage of open_if_present (#11344)
  jif-oai · 2026-02-10 19:25:07 +00:00
  847a6092e6
• feat: opt-out of events in the app-server (#11319)

  Add `optOutNotificationMethods` in the app-server to opt-out events
  based on exact method matching

  jif-oai · 2026-02-10 18:04:52 +00:00
  a364dd8b56
• Revert "Add app-server transport layer with websocket support (#10693)" (#11323)

  Suspected cause of deadlocking bug

  Max Johnson · 2026-02-10 17:37:49 +00:00
  47356ff83c
• [apps] Add thread_id param to optionally load thread config for apps feature check. (#11279)

  - [x] Add thread_id param to optionally load thread config for apps
  feature check

  Matthew Zeng · 2026-02-09 23:10:26 -08:00
  005e040f97
• fix(app-server): for external auth, replace id_token with chatgpt_acc… (#11240)

  …ount_id and chatgpt_plan_type
  
  ### Summary
  Following up on external auth mode which was introduced here:
  https://github.com/openai/codex/pull/10012
  
  Turns out some clients have a differently shaped ID token and don't have
  a chosen workspace (aka chatgpt_account_id) encoded in their ID token.
  So, let's replace `id_token` param with `chatgpt_account_id` and
  `chatgpt_plan_type` (optional) when initializing the external ChatGPT
  auth mode (`account/login/start` with `chatgptAuthTokens`).
  
  The client was able to test end-to-end with a Codex build from this
  branch and verified it worked!

  Owen Lin · 2026-02-09 20:48:58 -08:00
  53741013ab
• Adjust shell command timeouts for Windows (#11247)

  Summary
  - add platform-aware defaults for shell command timeouts so Windows
  tests get longer waits
  - keep medium timeout longer on Windows to ensure flakiness is reduced
  
  Testing
  - Not run (not requested)

  Dylan Hurd · 2026-02-09 20:03:32 -08:00
  168c359b71
• feat: extend skills/list to support additional roots. (#10835)

  Add an optional perCwdExtraUserRoots

  xl-openai · 2026-02-09 13:30:38 -08:00
  a33ee46e3b
• Load requirements on windows (#10770)

  We support requirements on Unix, loading from
  `/etc/codex/requirements.toml`. On MacOS, we also support MDM.
  
  Now, on Windows, we'll load requirements from
  `%ProgramData%\OpenAI\Codex\requirements.toml`

  gt-oai · 2026-02-09 16:05:38 +00:00
  9fe925b15a
• [apps] Improve app loading. (#10994)

  There are two concepts of apps that we load in the harness:
  
  - Directory apps, which is all the apps that the user can install.
  - Accessible apps, which is what the user actually installed and can be
  $ inserted and be used by the model. These are extracted from the tools
  that are loaded through the gateway MCP.
  
  Previously we wait for both sets of apps before returning the full apps
  list. Which causes many issues because accessible apps won't be
  available to the UI or the model if directory apps aren't loaded or
  failed to load.
  
  In this PR we are separating them so that accessible apps can be loaded
  separately and are instantly available to be shown in the UI and to be
  provided in model context. We also added an app-server event so that
  clients can subscribe to also get accessible apps without being blocked
  on the full app list.
  
  - [x] Separate accessible apps and directory apps loading.
  - [x] `app/list` request will also emit `app/list/updated` notifications
  that app-server clients can subscribe. Which allows clients to get
  accessible apps list to render in the $ menu without being blocked by
  directory apps.
  - [x] Cache both accessible and directory apps with 1 hour TTL to avoid
  reloading them when creating new threads.
  - [x] TUI improvements to redraw $ menu and /apps menu when app list is
  updated.

  Matthew Zeng · 2026-02-08 15:24:56 -08:00
  45b7763c3f
• Upgrade rmcp to 0.14 (#10718)

  - [x] Upgrade rmcp to 0.14

  Matthew Zeng · 2026-02-08 15:07:53 -08:00
  9f1009540b
• Defer persistence of rollout file (#11028)

  - Defer rollout persistence for fresh threads (`InitialHistory::New`):
  keep rollout events in memory and only materialize rollout file + state
  DB row on first `EventMsg::UserMessage`.
  - Keep precomputed rollout path available before materialization.
  - Change `thread/start` to build thread response from live config
  snapshot and optional precomputed path.
  - Improve pre-materialization behavior in app-server/TUI: clearer
  invalid-request errors for file-backed ops and a friendlier `/fork` “not
  ready yet” UX.
  - Update tests to match deferred semantics across
  start/read/archive/unarchive/fork/resume/review flows.
  - Improved resilience of user_shell test, which should be unrelated to
  this change but must be affected by timing changes
  
  For Reviewers:
  * The primary change is in recorder.rs
  * Most of the other changes were to fix up broken assumptions in
  existing tests
  
  Testing:
  * Manually tested CLI
  * Exercised app server paths by manually running IDE Extension with
  rebuilt CLI binary
  * Only user-visible change is that `/fork` in TUI generates visible
  error if used prior to first turn

  Eric Traut · 2026-02-07 23:05:03 -08:00
  b3de6c7f2b
• app-server: treat null mode developer instructions as built-in defaults (#10983)

  ## Summary
  - make `turn/start` normalize
  `collaborationMode.settings.developer_instructions: null` to the
  built-in instructions for the selected mode
  - prevent app-server clients from accidentally clearing mode-switch
  developer instructions by sending `null`
  - document this behavior in the v2 protocol and app-server docs
  
  ## What changed
  - `codex-rs/app-server/src/codex_message_processor.rs`
    - added a small `normalize_turn_start_collaboration_mode` helper
    - in `turn_start`, apply normalization before `OverrideTurnContext`
  - `codex-rs/app-server/tests/suite/v2/turn_start.rs`
  - extended `turn_start_accepts_collaboration_mode_override_v2` to assert
  the outgoing request includes default-mode instruction text when the
  client sends `developer_instructions: null`
  - `codex-rs/app-server-protocol/src/protocol/v2.rs`
  - clarified `TurnStartParams.collaboration_mode` docs:
  `settings.developer_instructions: null` means use built-in mode
  instructions
  - regenerated schema fixture:
  - `codex-rs/app-server-protocol/schema/typescript/v2/TurnStartParams.ts`
  - docs:
    - `codex-rs/app-server/README.md`
    - `codex-rs/docs/codex_mcp_interface.md`

  Charley Cunningham · 2026-02-07 12:59:41 -08:00
  e6662d6387
• Fixed a flaky test (#10970)

  ## Summary
  
  Stabilize v2 review integration tests by making them hermetic with
  respect to model discovery.
  
  `app-server` review tests were intermittently timing out in CI
  (especially on Windows runners) because their test config allowed remote
  model refresh. During `thread/start`, the test process could issue live
  `/v1/models` requests, introducing external network latency and
  nondeterministic timing before review flow assertions.
  
  This change disables remote model fetching in the review test config
  helper used by these tests.

  Eric Traut · 2026-02-06 21:26:26 -08:00
  4d52428fa2
• Treat compaction failure as failure state (#10927)

  - Return compaction errors from local and remote compaction flows.\n-
  Stop turns/tasks when auto-compaction fails instead of continuing
  execution.

  Ahmed Ibrahim · 2026-02-06 13:51:46 -08:00
  ba8b5d9018
• Add app configs to config.toml (#10822)

  Adds app configs to config.toml + tests

  canvrno-oai · 2026-02-06 10:29:08 -08:00
  36c16e0c58
• Handle required MCP startup failures across components (#10902)

  Summary
  - add a `required` flag for MCP servers everywhere config/CLI data is
  touched so mandatory helpers can be round-tripped
  - have `codex exec` and `codex app-server` thread start/resume fail fast
  when required MCPs fail to initialize

  jif-oai · 2026-02-06 17:14:37 +01:00
  aab61934af
• Removed the "remote_compaction" feature flag (#10840)

  This feature is always on now

  Eric Traut · 2026-02-05 23:54:57 -08:00
  dd80e332c4
• feat(app-server): turn/steer API (#10821)

  This PR adds a dedicated `turn/steer` API for appending user input to an
  in-flight turn.
  
  ## Motivation
  Currently, steering in the app is implemented by just calling
  `turn/start` while a turn is running. This has some really weird quirks:
  - Client gets back a new `turn.id`, even though streamed
  events/approvals remained tied to the original active turn ID.
  - All the various turn-level override params on `turn/start` do not
  apply to the "steer", and would only apply to the next real turn.
  - There can also be a race condition where the client thinks the turn is
  active but the server has already completed it, so there might be bugs
  if the client has baked in some client-specific behavior thinking it's a
  steer when in fact the server kicked off a new turn. This is
  particularly possible when running a client against a remote app-server.
  
  Having a dedicated `turn/steer` API eliminates all those quirks.
  
  `turn/steer` behavior:
  - Requires an active turn on threadId. Returns a JSON-RPC error if there
  is no active turn.
  - If expectedTurnId is provided, it must match the active turn (more
  useful when connecting to a remote app-server).
  - Does not emit `turn/started`.
  - Does not accept turn overrides (`cwd`, `model`, `sandbox`, etc.) or
  `outputSchema` to accurately reflect that these are not applied when
  steering.

  Owen Lin · 2026-02-06 00:35:04 +00:00
  0d8b2b74c4