321 Commits

• Add server-level approval defaults for custom MCP servers (#17843)

  ## Summary
  - Add `default_tools_approval_mode` support for custom MCP server
  configs, matching the existing `codex_apps` behavior
  - Apply approval precedence as per-tool override, then server default,
  then `auto`
  - Update config serialization, CLI display, schema generation, docs, and
  tests
  
  ## Testing
  - `cargo check -p codex-config`
  - `cargo check -p codex-core`
  - `just write-config-schema`
  - `just fmt`
  - `cargo test -p codex-config`
  - Targeted `codex-core` tests for config parsing, config writes, and MCP
  approval precedence
  - `just fix -p codex-config -p codex-core`

  Matthew Zeng · 2026-04-16 18:18:07 +00:00
  71174574ad
• Refactor AGENTS.md discovery into AgentsMdManager (#18035)

  Encapsulate Agents MD processing a bit and drop user_instructions_path
  from config.

  pakrym-oai · 2026-04-16 10:51:33 -07:00
  ab97c9aaad
• feat(permissions): add glob deny-read policy support (#15979)

  ## Summary
  - adds first-class filesystem policy entries for deny-read glob patterns
  - parses config such as :project_roots { "**/*.env" = "none" } into
  pattern entries
  - enforces deny-read patterns in direct read/list helpers
  - fails closed for sandbox execution until platform backends enforce
  glob patterns in #18096
  - preserves split filesystem policy in turn context only when it cannot
  be reconstructed from legacy sandbox policy
  
  ## Stack
  1. This PR - glob deny-read policy/config/direct-tool support
  2. #18096 - macOS and Linux sandbox enforcement
  3. #17740 - managed deny-read requirements
  
  ## Verification
  - just fmt
  - cargo check -p codex-core -p codex-sandboxing --tests
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-16 10:31:51 -07:00
  6862b9c745
• [1/8] Add MCP server environment config (#18085)

  ## Summary
  - Add an MCP server environment setting with local as the default.
  - Thread the default through config serialization, schema generation,
  and existing config fixtures.
  
  ## Stack
  ```text
  o  #18027 [8/8] Fail exec client operations after disconnect
  │
  o  #18025 [7/8] Cover MCP stdio tests with executor placement
  │
  o  #18089 [6/8] Wire remote MCP stdio through executor
  │
  o  #18088 [5/8] Add executor process transport for MCP stdio
  │
  o  #18087 [4/8] Abstract MCP stdio server launching
  │
  o  #18020 [3/8] Add pushed exec process events
  │
  o  #18086 [2/8] Support piped stdin in exec process API
  │
  @  #18085 [1/8] Add MCP server environment config
  │
  o  main
  ```
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-16 08:50:03 -07:00
  b4be3617f9
• Async config loading (#18022)

  Parts of config will come from executor. Prepare for that by making
  config loading methods async.

  pakrym-oai · 2026-04-15 19:18:38 -07:00
  bd61737e8a
• removing network proxy for yolo (#17742)

  **Summary**
  - prevent managed requirements.toml network settings from leaking into
  DangerFullAccess / yolo turns by gating managed proxy attachment on
  sandbox mode
  - keep guardian/sandboxed modes on the managed proxy path, while making
  true yolo bypass the proxy entirely, including /shell full-access
  commands

  Won Park · 2026-04-16 00:02:42 +00:00
  e2dbe7dfc3
• Spread AbsolutePathBuf (#17792)

  Mechanical change to promote absolute paths through code.

  pakrym-oai · 2026-04-14 14:26:10 -07:00
  dd1321d11b
• fix: Revert danger-full-access denylist-only mode (#17732)

  ## Summary
  
  - Reverts openai/codex#16946 and removes the danger-full-access
  denylist-only network mode.
  - Removes the corresponding config requirements, app-server
  protocol/schema, config API, TUI debug output, and network proxy
  behavior.
  - Drops stale tests that depended on the reverted mode while preserving
  newer managed allowlist-only coverage.
  
  ## Verification
  
  - `just write-app-server-schema`
  - `just fmt`
  - `cargo test -p codex-config network_requirements`
  - `cargo test -p codex-core network_proxy_spec`
  - `cargo test -p codex-core
  managed_network_proxy_decider_survives_full_access_start`
  - `cargo test -p codex-app-server map_requirements_toml_to_api`
  - `cargo test -p codex-tui debug_config_output`
  - `cargo test -p codex-app-server-protocol`
  - `just fix -p codex-config -p codex-core -p codex-app-server-protocol
  -p codex-app-server -p codex-tui`
  - `git diff --cached --check`
  
  Not run: full workspace `cargo test` (repo instructions ask for
  confirmation before that broader run).

  viyatb-oai · 2026-04-14 09:50:14 -07:00
  81c0bcc921
• Refactor plugin loading to async (#17747)

  Simplifies skills migration.

  pakrym-oai · 2026-04-13 21:52:56 -07:00
  3b24a9a532
• Add supports_parallel_tool_calls flag to included mcps (#17667)

  ## Why
  
  For more advanced MCP usage, we want the model to be able to emit
  parallel MCP tool calls and have Codex execute eligible ones
  concurrently, instead of forcing all MCP calls through the serial block.
  
  The main design choice was where to thread the config. I made this
  server-level because parallel safety depends on the MCP server
  implementation. Codex reads the flag from `mcp_servers`, threads the
  opted-in server names into `ToolRouter`, and checks the parsed
  `ToolPayload::Mcp { server, .. }` at execution time. That avoids relying
  on model-visible tool names, which can be incomplete in
  deferred/search-tool paths or ambiguous for similarly named
  servers/tools.
  
  ## What was added
  
  Added `supports_parallel_tool_calls` for MCP servers.
  
  Before:
  
  ```toml
  [mcp_servers.docs]
  command = "docs-server"
  ```
  
  After:
  
  ```toml
  [mcp_servers.docs]
  command = "docs-server"
  supports_parallel_tool_calls = true
  ```
  
  MCP calls remain serial by default. Only tools from opted-in servers are
  eligible to run in parallel. Docs also now warn to enable this only when
  the server’s tools are safe to run concurrently, especially around
  shared state or read/write races.
  
  ## Testing
  
  Tested with a local stdio MCP server exposing real delay tools. The
  model/Responses side was mocked only to deterministically emit two MCP
  calls in the same turn.
  
  Each test called `query_with_delay` and `query_with_delay_2` with `{
  "seconds": 25 }`.
  
  | Build/config | Observed | Wall time |
  | --- | --- | --- |
  | main with flag enabled | serial | `58.79s` |
  | PR with flag enabled | parallel | `31.73s` |
  | PR without flag | serial | `56.70s` |
  
  PR with flag enabled showed both tools start before either completed;
  main and PR-without-flag completed the first delay before starting the
  second.
  
  Also added an integration test.
  
  Additional checks:
  
  - `cargo test -p codex-tools` passed
  - `cargo test -p codex-core
  mcp_parallel_support_uses_exact_payload_server` passed
  - `git diff --check` passed

  josiah-openai · 2026-04-13 15:16:34 -07:00
  937dd3812d
• Use AbsolutePathBuf in skill loading and codex_home (#17407)

  Helps with FS migration later

  pakrym-oai · 2026-04-13 10:26:51 -07:00
  ac82443d07
• feat: ignore keyring on 0.0.0 (#17221)

  To prevent the spammy: 
  <img width="424" height="172" alt="Screenshot 2026-04-09 at 13 36 16"
  src="https://github.com/user-attachments/assets/b5ece9e3-c561-422f-87ec-041e7bd6813d"
  />

  jif-oai · 2026-04-13 09:58:47 +01:00
  4ffe6c2ce6
• Remove context status-line meter (#17420)

  Addresses #17313
  
  Problem: The visual context meter in the status line was confusing and
  continued to draw negative feedback, and context reporting should remain
  an explicit opt-in rather than part of the default footer.
  
  Solution: Remove the visual meter, restore opt-in context remaining/used
  percentage items that explicitly say "Context", keep existing
  context-usage configs working as a hidden alias, and update the setup
  text and snapshots.

  Eric Traut · 2026-04-12 15:42:09 -07:00
  470510174b
• Fix thread/list cwd filtering for Windows verbatim paths (#17414)

  Addresses #17302
  
  Problem: `thread/list` compared cwd filters with raw path equality, so
  `resume --last` could miss Windows sessions when the saved cwd used a
  verbatim path form and the current cwd did not.
  
  Solution: Normalize cwd comparisons through the existing path comparison
  utilities before falling back to direct equality, and add Windows
  regression coverage for verbatim paths. I made this a general utility
  function and replaced all of the duplicated instance of it across the
  code base.

  Eric Traut · 2026-04-10 23:08:02 -07:00
  e9e7ef3d36
• make webrtc the default experience (#17188)

  ## Summary
  - make realtime default to the v2 WebRTC path
  - keep partial realtime config tables inheriting
  `RealtimeConfig::default()`
  
  ## Validation
  - CI found a stale config-test expectation; fixed in 974ba51bb3
  - just fmt
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 23:52:32 -07:00
  84a24fe333
• Default realtime startup to v2 model (#17183)

  - Default realtime sessions to v2 and gpt-realtime-1.5 when no override
  is configured.
  - Add Op::RealtimeConversationStart integration coverage and keep
  v1-specific tests explicit.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 22:11:30 -07:00
  1fdb695e42
• Add TUI notification condition config (#17175)

  Problem: TUI desktop notifications are hard-gated on terminal focus, so
  terminal/IDE hosts that want in-focus notifications cannot opt in.
  
  Solution: Add a flat `[tui] notification_condition` setting (`unfocused`
  by default, `always` opt-in), carry grouped TUI notification settings
  through runtime config, apply method + condition together in the TUI,
  and regenerate the config schema.

  Eric Traut · 2026-04-08 21:50:02 -07:00
  6dc5391c7c
• Add realtime voice selection (#17176)

  - Add realtime voice selection for realtime/start.
  - Expose the supported v1/v2 voice lists and cover explicit, configured,
  default, and invalid voice paths.

  Ahmed Ibrahim · 2026-04-08 20:19:15 -07:00
  2f9090be62
• Update guardian output schema (#17061)

  ## Summary
  - Update guardian output schema to separate risk, authorization,
  outcome, and rationale.
  - Feed guardian rationale into rejection messages.
  - Split the guardian policy into template and tenant-config sections.
  
  ## Validation
  - `cargo test -p codex-core mcp_tool_call`
  - `env -u CODEX_SANDBOX_NETWORK_DISABLED INSTA_UPDATE=always cargo test
  -p codex-core guardian::`
  
  ---------
  
  Co-authored-by: Owen Lin <owen@openai.com>

  maja-openai · 2026-04-08 15:47:29 -07:00
  dcbc91fd39
• [codex] Support remote exec cwd in TUI startup (#17142)

  When running with remote executor the cwd is the remote path. Today we
  check for existence of a local directory on startup and attempt to load
  config from it.
  
  For remote executors don't do that.

  pakrym-oai · 2026-04-08 13:09:28 -07:00
  e4d6702b87
• Add realtime transport config (#17097)

  Adds realtime.transport config with websocket as the default and webrtc
  wired through the effective config.
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 09:53:53 -07:00
  06d88b7e81
• Show global AGENTS.md in /status (#17091)

  Addresses #3793
  
  Problem: /status only reported project-level AGENTS files, so sessions
  with a loaded global $CODEX_HOME/AGENTS.md still showed Agents.md as
  <none>.
  
  Solution: Track the global instructions file loaded during config
  initialization and prepend that path to the /status Agents.md summary,
  with coverage for AGENTS.md, AGENTS.override.md, and global-plus-project
  ordering.

  Eric Traut · 2026-04-08 09:04:32 -07:00
  dc5feb916d
• Configure multi_agent_v2 spawn agent hints (#17071)

  Allow multi_agent_v2 features to have its own temporary configuration
  under `[features.multi_agent_v2]`
  
  ```
  [features.multi_agent_v2]
  enabled = true
  usage_hint_enabled = false
  usage_hint_text = "Custom delegation guidance."
  hide_spawn_agent_metadata = true
  ```
  
  Absent `usage_hint_text` means use the default hint.
  
  ```
  [features]
  multi_agent_v2 = true
  ```
  
  still works as the boolean shorthand.

  pakrym-oai · 2026-04-08 08:42:18 -07:00
  4c07dd4d25
• fix: refresh network proxy settings when sandbox mode changes (#17040)

  ## Summary
  
  Fix network proxy sessions so changing sandbox mode recomputes the
  effective managed network policy and applies it to the already-running
  per-session proxy.
  
  ## Root Cause
  
  `danger_full_access_denylist_only` injects `"*"` only while building the
  proxy spec for Full Access. Sessions built that spec once at startup, so
  a later permission switch to Full Access left the live proxy in its
  original restricted policy. Switching back needed the same recompute
  path to remove the synthetic wildcard again.
  
  ## What Changed
  
  - Preserve the original managed network proxy config/requirements so the
  effective spec can be recomputed for a new sandbox policy.
  - Refresh the current session proxy when sandbox settings change, then
  reapply exec-policy network overlays.
  - Add an in-place proxy state update path while rejecting
  listener/port/SOCKS changes that cannot be hot-reloaded.
  - Keep runtime proxy settings cheap to snapshot and update.
  - Add regression coverage for workspace-write -> Full Access ->
  workspace-write.

  viyatb-oai · 2026-04-08 03:07:55 +00:00
  3c1adbabcd
• fix(app-server) revert null instructions changes (#17047)
  Dylan Hurd · 2026-04-07 15:18:34 -07:00
  6c36e7d688
• [codex] Make AbsolutePathBuf joins infallible (#16981)

  Having to check for errors every time join is called is painful and
  unnecessary.

  pakrym-oai · 2026-04-07 10:52:08 -07:00
  f1a2b920f9
• Preserve null developer instructions (#16976)

  Preserve explicit null developer-instruction overrides across app-server
  resume and fork flows.

  Ahmed Ibrahim · 2026-04-07 09:32:14 -07:00
  cd591dc457
• [codex] reduce module visibility (#16978)

  ## Summary
  - reduce public module visibility across Rust crates, preferring private
  or crate-private modules with explicit crate-root public exports
  - update external call sites and tests to use the intended public crate
  APIs instead of reaching through module trees
  - add the module visibility guideline to AGENTS.md
  
  ## Validation
  - `cargo check --workspace --all-targets --message-format=short` passed
  before the final fix/format pass
  - `just fix` completed successfully
  - `just fmt` completed successfully
  - `git diff --check` passed

  pakrym-oai · 2026-04-07 08:03:35 -07:00
  413c1e1fdf
• Honor null thread instructions (#16964)

  - Treat explicit null thread instructions as a blank-slate override
  while preserving omitted-field fallback behavior.
  - Preserve null through rollout resume/fork and keep explicit empty
  strings distinct.
  - Add app-server v2 start/fork coverage for the tri-state instruction
  params.

  Ahmed Ibrahim · 2026-04-07 04:10:19 +00:00
  24c598e8a9
• [codex] Add danger-full-access denylist-only network mode (#16946)

  ## Summary
  
  This adds `experimental_network.danger_full_access_denylist_only` for
  orgs that want yolo / danger-full-access sessions to keep full network
  access while still enforcing centrally managed deny rules.
  
  When the flag is true and the session sandbox is `danger-full-access`,
  the network proxy starts with:
  
  - domain allowlist set to `*`
  - managed domain `deny` entries enforced
  - upstream proxy use allowed
  - all Unix sockets allowed
  - local/private binding allowed
  
  Caveat: the denylist is best effort only. In yolo / danger-full-access
  mode, Codex or the model can use an allowed socket or other
  local/private network path to bypass the proxy denylist, so this should
  not be treated as a hard security boundary.
  
  The flag is intentionally scoped to `SandboxPolicy::DangerFullAccess`.
  Read-only and workspace-write modes keep the existing managed/user
  allowlist, denylist, Unix socket, and local-binding behavior. This does
  not enable the non-loopback proxy listener setting; that still requires
  its own explicit config.
  
  This also threads the new field through config requirements parsing,
  app-server protocol/schema output, config API mapping, and the TUI debug
  config output.
  
  ## How to use
  
  Add the flag under `[experimental_network]` in the network policy config
  that is delivered to Codex. The setting is not under `[permissions]`.
  
  ```toml
  [experimental_network]
  enabled = true
  danger_full_access_denylist_only = true
  
  [experimental_network.domains]
  "blocked.example.com" = "deny"
  "*.blocked.example.com" = "deny"
  ```
  
  With that configuration, yolo / danger-full-access sessions get broad
  network access except for the managed denied domains above. The denylist
  remains a best-effort proxy policy because the session may still use
  allowed sockets to bypass it. Other sandbox modes do not get the
  wildcard domain allowlist or the socket/local-binding relaxations from
  this flag.
  
  ## Verification
  
  - `cargo test -p codex-config network_requirements`
  - `cargo test -p codex-core network_proxy_spec`
  - `cargo test -p codex-app-server map_requirements_toml_to_api`
  - `cargo test -p codex-tui debug_config_output`
  - `cargo test -p codex-app-server-protocol`
  - `just write-app-server-schema`
  - `just fmt`
  - `just fix -p codex-config -p codex-core -p codex-app-server-protocol
  -p codex-app-server -p codex-tui`
  - `just fix -p codex-core -p codex-config`
  - `git diff --check`
  - `cargo clean`

  viyatb-oai · 2026-04-06 19:38:51 -07:00
  9d13d29acd
• Refactor config types into a separate crate (#16962)

  Move config types into a separate crate because their macros expand into
  a lot of new code.

  pakrym-oai · 2026-04-07 00:32:41 +00:00
  1f2411629f
• app-server: centralize AuthManager initialization (#16764)

  Extract a shared helper that builds AuthManager from Config and applies
  the forced ChatGPT workspace override in one place.
  
  Create the shared AuthManager at MessageProcessor call sites so that
  upcoming new transport's initialization can reuse the same handle, and
  keep only external auth refresher wiring inside `MessageProcessor`.
  
  Remove the now-unused `AuthManager::shared_with_external_auth` helper.

  Ruslan Nigmatullin · 2026-04-06 12:46:55 -07:00
  1525bbdb9a
• feat(requirements): support allowed_approval_reviewers (#16701)

  ## Description
  
  Add requirements.toml support for `allowed_approvals_reviewers =
  ["user", "guardian_subagent"]`, so admins can now restrict the use of
  guardian mode.
  
  Note: If a user sets a reviewer that isn’t allowed by requirements.toml,
  config loading falls back to the first allowed reviewer and emits a
  startup warning.
  
  The table below describes the possible admin controls.
  | Admin intent | `requirements.toml` | User `config.toml` | End result |
  |---|---|---|---|
  | Leave Guardian optional | omit `allowed_approvals_reviewers` or set
  `["user", "guardian_subagent"]` | user chooses `approvals_reviewer =
  "user"` or `"guardian_subagent"` | Guardian off for `user`, on for
  `guardian_subagent` + `approval_policy = "on-request"` |
  | Force Guardian off | `allowed_approvals_reviewers = ["user"]` | any
  user value | Effective reviewer is `user`; Guardian off |
  | Force Guardian on | `allowed_approvals_reviewers =
  ["guardian_subagent"]` and usually `allowed_approval_policies =
  ["on-request"]` | any user reviewer value; user should also have
  `approval_policy = "on-request"` unless policy is forced | Effective
  reviewer is `guardian_subagent`; Guardian on when effective approval
  policy is `on-request` |
  | Allow both, but default to manual if user does nothing |
  `allowed_approvals_reviewers = ["user", "guardian_subagent"]` | omit
  `approvals_reviewer` | Effective reviewer is `user`; Guardian off |
  | Allow both, and user explicitly opts into Guardian |
  `allowed_approvals_reviewers = ["user", "guardian_subagent"]` |
  `approvals_reviewer = "guardian_subagent"` and `approval_policy =
  "on-request"` | Guardian on |
  | Invalid admin config | `allowed_approvals_reviewers = []` | anything |
  Config load error |

  Owen Lin · 2026-04-06 11:11:44 -07:00
  ded559680d
• [codex] allow disabling environment context injection (#16745)

  This adds an `include_environment_context` config/profile flag that
  defaults on, and guards both initial injection and later environment
  updates to allow skipping injection of `<environment_context>`.

  Thibault Sottiaux · 2026-04-03 18:06:52 -07:00
  91ca49e53c
• [codex] allow disabling prompt instruction blocks (#16735)

  This PR adds root and profile config switches to omit the generated
  `<permissions instructions>` and `<apps_instructions>` prompt blocks
  while keeping both enabled by default, and it gates both the initial
  developer-context injection and later permissions diff injection so
  turning the permissions block off stays effective across turn-context
  overrides.
  
  Also added a prompt debug tool that can be used as `codex debug
  prompt-input "hello"` and dumps the constructed items list.

  Thibault Sottiaux · 2026-04-03 23:47:56 +00:00
  8d19646861
• Remove OPENAI_BASE_URL config fallback (#16720)

  The `OPENAI_BASE_URL` environment variable has been a significant
  support issue, so we decided to deprecate it in favor of an
  `openai_base_url` config key. We've had the deprecation warning in place
  for about a month, so users have had time to migrate to the new
  mechanism. This PR removes support for `OPENAI_BASE_URL` entirely.

  Eric Traut · 2026-04-03 15:03:21 -07:00
  4b8bab6ad3
• Fix Windows Bazel app-server trust tests (#16711)

  ## Why
  
  Extracted from [#16528](https://github.com/openai/codex/pull/16528) so
  the Windows Bazel app-server test failures can be reviewed independently
  from the rest of that PR.
  
  This PR targets:
  
  -
  `suite::v2::thread_shell_command::thread_shell_command_runs_as_standalone_turn_and_persists_history`
  -
  `suite::v2::thread_start::thread_start_with_elevated_sandbox_trusts_project_and_followup_loads_project_config`
  -
  `suite::v2::thread_start::thread_start_with_nested_git_cwd_trusts_repo_root`
  
  There were two Windows-specific assumptions baked into those tests and
  the underlying trust lookup:
  
  - project trust keys were persisted and looked up using raw path
  strings, but Bazel's Windows test environment can surface canonicalized
  paths with `\\?\` / UNC prefixes or normalized symlink/junction targets,
  so follow-up `thread/start` requests no longer matched the project entry
  that had just been written
  - `item/commandExecution/outputDelta` assertions compared exact trailing
  line endings even though shell output chunk boundaries and CRLF handling
  can differ on Windows, and Bazel made that timing-sensitive mismatch
  visible
  
  There was also one behavior bug separate from the assertion cleanup:
  `thread/start` decided whether to persist trust from the final resolved
  sandbox policy, but on Windows an explicit `workspace-write` request may
  be downgraded to `read-only`. That incorrectly skipped writing trust
  even though the request had asked to elevate the project, so the new
  logic also keys off the requested sandbox mode.
  
  ## What
  
  - Canonicalize project trust keys when persisting/loading `[projects]`
  entries, while still accepting legacy raw keys for existing configs.
  - Persist project trust when `thread/start` explicitly requests
  `workspace-write` or `danger-full-access`, even if the resolved policy
  is later downgraded on Windows.
  - Make the Windows app-server tests compare persisted trust paths and
  command output deltas in a path/newline-normalized way.
  
  ## Verification
  
  - Existing app-server v2 tests cover the three failing Windows Bazel
  cases above.

  Michael Bolin · 2026-04-03 21:41:25 +00:00
  a70aee1a1e
• remove temporary ownership re-exports (#16626)

  Stacked on #16508.
  
  This removes the temporary `codex-core` / `codex-login` re-export shims
  from the ownership split and rewrites callsites to import directly from
  `codex-model-provider-info`, `codex-models-manager`, `codex-api`,
  `codex-protocol`, `codex-feedback`, and `codex-response-debug-context`.
  
  No behavior change intended; this is the mechanical import cleanup layer
  split out from the ownership move.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-03 00:33:34 -07:00
  af8a9d2d2b
• extract models manager and related ownership from core (#16508)

  ## Summary
  - split `models-manager` out of `core` and add `ModelsManagerConfig`
  plus `Config::to_models_manager_config()` so model metadata paths stop
  depending on `core::Config`
  - move login-owned/auth-owned code out of `core` into `codex-login`,
  move model provider config into `codex-model-provider-info`, move API
  bridge mapping into `codex-api`, move protocol-owned types/impls into
  `codex-protocol`, and move response debug helpers into a dedicated
  `response-debug-context` crate
  - move feedback tag emission into `codex-feedback`, relocate tests to
  the crates that now own the code, and keep broad temporary re-exports so
  this PR avoids a giant import-only rewrite
  
  ## Major moves and decisions
  - created `codex-models-manager` as the owner for model
  cache/catalog/config/model info logic, including the new
  `ModelsManagerConfig` struct
  - created `codex-model-provider-info` as the owner for provider config
  parsing/defaults and kept temporary `codex-login`/`codex-core`
  re-exports for old import paths
  - moved `api_bridge` error mapping + `CoreAuthProvider` into
  `codex-api`, while `codex-login::api_bridge` temporarily re-exports
  those symbols and keeps the `auth_provider_from_auth` wrapper
  - moved `auth_env_telemetry` and `provider_auth` ownership to
  `codex-login`
  - moved `CodexErr` ownership to `codex-protocol::error`, plus
  `StreamOutput`, `bytes_to_string_smart`, and network policy helpers to
  protocol-owned modules
  - created `codex-response-debug-context` for
  `extract_response_debug_context`, `telemetry_transport_error_message`,
  and related response-debug plumbing instead of leaving that behavior in
  `core`
  - moved `FeedbackRequestTags`, `emit_feedback_request_tags`, and
  `emit_feedback_request_tags_with_auth_env` to `codex-feedback`
  - deferred removal of temporary re-exports and the mechanical import
  rewrites to a stacked follow-up PR so this PR stays reviewable
  
  ## Test moves
  - moved auth refresh coverage from `core/tests/suite/auth_refresh.rs` to
  `login/tests/suite/auth_refresh.rs`
  - moved text encoding coverage from
  `core/tests/suite/text_encoding_fix.rs` to
  `protocol/src/exec_output_tests.rs`
  - moved model info override coverage from
  `core/tests/suite/model_info_overrides.rs` to
  `models-manager/src/model_info_overrides_tests.rs`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-02 23:00:02 -07:00
  6fff9955f1
• [codex] Remove codex-core config type shim (#16529)

  ## Why
  
  This finishes the config-type move out of `codex-core` by removing the
  temporary compatibility shim in `codex_core::config::types`. Callers now
  depend on `codex-config` directly, which keeps these config model types
  owned by the config crate instead of re-expanding `codex-core` as a
  transitive API surface.
  
  ## What Changed
  
  - Removed the `codex-rs/core/src/config/types.rs` re-export shim and the
  `core::config::ApprovalsReviewer` re-export.
  - Updated `codex-core`, `codex-cli`, `codex-tui`, `codex-app-server`,
  `codex-mcp-server`, and `codex-linux-sandbox` call sites to import
  `codex_config::types` directly.
  - Added explicit `codex-config` dependencies to downstream crates that
  previously relied on the `codex-core` re-export.
  - Regenerated `codex-rs/core/config.schema.json` after updating the
  config docs path reference.

  Michael Bolin · 2026-04-02 01:19:44 -07:00
  c1d18ceb6f
• [codex] Move config types into codex-config (#16523)

  ## Why
  
  `codex-rs/core/src/config/types.rs` is a plain config-type module with
  no dependency on `codex-core`. Moving it into `codex-config` shrinks the
  core crate and gives config-only consumers a more natural dependency
  boundary.
  
  ## What Changed
  
  - Added `codex_config::types` with the moved structs, enums, constants,
  and unit tests.
  - Kept `codex_core::config::types` as a compatibility re-export to avoid
  a broad call-site migration in this PR.
  - Switched notice-table writes in `core/src/config/edit.rs` to a local
  `NOTICE_TABLE_KEY` constant.
  - Added the `wildmatch` runtime dependency and `tempfile` test
  dependency to `codex-config`.

  Michael Bolin · 2026-04-02 00:39:20 -07:00
  f32a5e84bf
• core: remove cross-crate re-exports from lib.rs (#16512)

  ## Why
  
  `codex-core` was re-exporting APIs owned by sibling `codex-*` crates,
  which made downstream crates depend on `codex-core` as a proxy module
  instead of the actual owner crate.
  
  Removing those forwards makes crate boundaries explicit and lets leaf
  crates drop unnecessary `codex-core` dependencies. In this PR, this
  reduces the dependency on `codex-core` to `codex-login` in the following
  files:
  
  ```
  codex-rs/backend-client/Cargo.toml
  codex-rs/mcp-server/tests/common/Cargo.toml
  ```
  
  ## What
  
  - Remove `codex-rs/core/src/lib.rs` re-exports for symbols owned by
  `codex-login`, `codex-mcp`, `codex-rollout`, `codex-analytics`,
  `codex-protocol`, `codex-shell-command`, `codex-sandboxing`,
  `codex-tools`, and `codex-utils-path`.
  - Delete the `default_client` forwarding shim in `codex-rs/core`.
  - Update in-crate and downstream callsites to import directly from the
  owning `codex-*` crate.
  - Add direct Cargo dependencies where callsites now target the owner
  crate, and remove `codex-core` from `codex-rs/backend-client`.

  Michael Bolin · 2026-04-01 23:06:24 -07:00
  aa2403e2eb
• Extract MCP into codex-mcp crate (#15919)

  - Split MCP runtime/server code out of `codex-core` into the new
  `codex-mcp` crate. New/moved public structs/types include `McpConfig`,
  `McpConnectionManager`, `ToolInfo`, `ToolPluginProvenance`,
  `CodexAppsToolsCacheKey`, and the `McpManager` API
  (`codex_mcp::mcp::McpManager` plus the `codex_core::mcp::McpManager`
  wrapper/shim). New/moved functions include `with_codex_apps_mcp`,
  `configured_mcp_servers`, `effective_mcp_servers`,
  `collect_mcp_snapshot`, `collect_mcp_snapshot_from_manager`,
  `qualified_mcp_tool_name_prefix`, and the MCP auth/skill-dependency
  helpers. Why: this creates a focused MCP crate boundary and shrinks
  `codex-core` without forcing every consumer to migrate in the same PR.
  
  - Move MCP server config schema and persistence into `codex-config`.
  New/moved structs/enums include `AppToolApproval`,
  `McpServerToolConfig`, `McpServerConfig`, `RawMcpServerConfig`,
  `McpServerTransportConfig`, `McpServerDisabledReason`, and
  `codex_config::ConfigEditsBuilder`. New/moved functions include
  `load_global_mcp_servers` and
  `ConfigEditsBuilder::replace_mcp_servers`/`apply`. Why: MCP TOML
  parsing/editing is config ownership, and this keeps config
  validation/round-tripping (including per-tool approval overrides and
  inline bearer-token rejection) in the config crate instead of
  `codex-core`.
  
  - Rewire `codex-core`, app-server, and plugin call sites onto the new
  crates. Updated `Config::to_mcp_config(&self, plugins_manager)`,
  `codex-rs/core/src/mcp.rs`, `codex-rs/core/src/connectors.rs`,
  `codex-rs/core/src/codex.rs`,
  `CodexMessageProcessor::list_mcp_server_status_task`, and
  `utils/plugins/src/mcp_connector.rs` to build/pass the new MCP
  config/runtime types. Why: plugin-provided MCP servers still merge with
  user-configured servers, and runtime auth (`CodexAuth`) is threaded into
  `with_codex_apps_mcp` / `collect_mcp_snapshot` explicitly so `McpConfig`
  stays config-only.

  Ahmed Ibrahim · 2026-04-01 19:03:26 -07:00
  59b68f5519
• Refactor chatwidget tests into topical modules (#16361)

  Problem: `chatwidget/tests.rs` had grown into a single oversized test
  blob that was hard to maintain and exceeded the repo's blob size limit.
  
  Solution: split the chatwidget tests into topical modules with a thin
  root `tests.rs`, shared helper utilities, preserved snapshot naming, and
  hermetic test config so the refactor stays stable and passes the
  `codex-tui` test suite.

  Eric Traut · 2026-03-31 16:45:58 -06:00
  424e532a6b
• core: support dynamic auth tokens for model providers (#16288)

  ## Summary
  
  Fixes #15189.
  
  Custom model providers that set `requires_openai_auth = false` could
  only use static credentials via `env_key` or
  `experimental_bearer_token`. That is not enough for providers that mint
  short-lived bearer tokens, because Codex had no way to run a command to
  obtain a bearer token, cache it briefly in memory, and retry with a
  refreshed token after a `401`.
  
  This PR adds that provider config and wires it through the existing auth
  design: request paths still go through `AuthManager.auth()` and
  `UnauthorizedRecovery`, with `core` only choosing when to use a
  provider-backed bearer-only `AuthManager`.
  
  ## Scope
  
  To keep this PR reviewable, `/models` only uses provider auth for the
  initial request in this change. It does **not** add a dedicated `401`
  retry path for `/models`; that can be follow-up work if we still need it
  after landing the main provider-token support.
  
  ## Example Usage
  
  ```toml
  model_provider = "corp-openai"
  
  [model_providers.corp-openai]
  name = "Corp OpenAI"
  base_url = "https://gateway.example.com/openai"
  requires_openai_auth = false
  
  [model_providers.corp-openai.auth]
  command = "gcloud"
  args = ["auth", "print-access-token"]
  timeout_ms = 5000
  refresh_interval_ms = 300000
  ```
  
  The command contract is intentionally small:
  
  - write the bearer token to `stdout`
  - exit `0`
  - any leading or trailing whitespace is trimmed before the token is used
  
  ## What Changed
  
  - add `model_providers.<id>.auth` to the config model and generated
  schema
  - validate that command-backed provider auth is mutually exclusive with
  `env_key`, `experimental_bearer_token`, and `requires_openai_auth`
  - build a bearer-only `AuthManager` for `ModelClient` and
  `ModelsManager` when a provider configures `auth`
  - let normal Responses requests and realtime websocket connects use the
  provider-backed bearer source through the same `AuthManager.auth()` path
  - allow `/models` online refresh for command-auth providers and attach
  the provider token to the initial `/models` request
  - keep `auth.cwd` available as an advanced escape hatch and include it
  in the generated config schema
  
  ## Testing
  
  - `cargo test -p codex-core provider_auth_command`
  - `cargo test -p codex-core
  refresh_available_models_uses_provider_auth_token`
  - `cargo test -p codex-core
  test_deserialize_provider_auth_config_defaults`
  
  ## Docs
  
  - `developers.openai.com/codex` should document the new
  `[model_providers.<id>.auth]` block and the token-command contract

  Michael Bolin · 2026-03-31 01:37:27 -07:00
  20f43c1e05
• chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

  ## Why
  
  `argument-comment-lint` was green in CI even though the repo still had
  many uncommented literal arguments. The main gap was target coverage:
  the repo wrapper did not force Cargo to inspect test-only call sites, so
  examples like the `latest_session_lookup_params(true, ...)` tests in
  `codex-rs/tui_app_server/src/lib.rs` never entered the blocking CI path.
  
  This change cleans up the existing backlog, makes the default repo lint
  path cover all Cargo targets, and starts rolling that stricter CI
  enforcement out on the platform where it is currently validated.
  
  ## What changed
  
  - mechanically fixed existing `argument-comment-lint` violations across
  the `codex-rs` workspace, including tests, examples, and benches
  - updated `tools/argument-comment-lint/run-prebuilt-linter.sh` and
  `tools/argument-comment-lint/run.sh` so non-`--fix` runs default to
  `--all-targets` unless the caller explicitly narrows the target set
  - fixed both wrappers so forwarded cargo arguments after `--` are
  preserved with a single separator
  - documented the new default behavior in
  `tools/argument-comment-lint/README.md`
  - updated `rust-ci` so the macOS lint lane keeps the plain wrapper
  invocation and therefore enforces `--all-targets`, while Linux and
  Windows temporarily pass `-- --lib --bins`
  
  That temporary CI split keeps the stricter all-targets check where it is
  already cleaned up, while leaving room to finish the remaining Linux-
  and Windows-specific target-gated cleanup before enabling
  `--all-targets` on those runners. The Linux and Windows failures on the
  intermediate revision were caused by the wrapper forwarding bug, not by
  additional lint findings in those lanes.
  
  ## Validation
  
  - `bash -n tools/argument-comment-lint/run.sh`
  - `bash -n tools/argument-comment-lint/run-prebuilt-linter.sh`
  - shell-level wrapper forwarding check for `-- --lib --bins`
  - shell-level wrapper forwarding check for `-- --tests`
  - `just argument-comment-lint`
  - `cargo test` in `tools/argument-comment-lint`
  - `cargo test -p codex-terminal-detection`
  
  ## Follow-up
  
  - Clean up remaining Linux-only target-gated callsites, then switch the
  Linux lint lane back to the plain wrapper invocation.
  - Clean up remaining Windows-only target-gated callsites, then switch
  the Windows lint lane back to the plain wrapper invocation.

  Michael Bolin · 2026-03-27 19:00:44 -07:00
  61dfe0b86c
• chore: refactor network permissions to use explicit domain and unix socket rule maps (#15120)

  ## Summary
  
  This PR replaces the legacy network allow/deny list model with explicit
  rule maps for domains and unix sockets across managed requirements,
  permissions profiles, the network proxy config, and the app server
  protocol.
  
  Concretely, it:
  
  - introduces typed domain (`allow` / `deny`) and unix socket permission
  (`allow` / `none`) entries instead of separate `allowed_domains`,
  `denied_domains`, and `allow_unix_sockets` lists
  - updates config loading, managed requirements merging, and exec-policy
  overlays to read and upsert rule entries consistently
  - exposes the new shape through protocol/schema outputs, debug surfaces,
  and app-server config APIs
  - rejects the legacy list-based keys and updates docs/tests to reflect
  the new config format
  
  ## Why
  
  The previous representation split related network policy across multiple
  parallel lists, which made merging and overriding rules harder to reason
  about. Moving to explicit keyed permission maps gives us a single source
  of truth per host/socket entry, makes allow/deny precedence clearer, and
  gives protocol consumers access to the full rule state instead of
  derived projections only.
  
  ## Backward Compatibility
  
  ### Backward compatible
  
  - Managed requirements still accept the legacy
  `experimental_network.allowed_domains`,
  `experimental_network.denied_domains`, and
  `experimental_network.allow_unix_sockets` fields. They are normalized
  into the new canonical `domains` and `unix_sockets` maps internally.
  - App-server v2 still deserializes legacy `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` payloads, so older clients can
  continue reading managed network requirements.
  - App-server v2 responses still populate `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` as legacy compatibility views
  derived from the canonical maps.
  - `managed_allowed_domains_only` keeps the same behavior after
  normalization. Legacy managed allowlists still participate in the same
  enforcement path as canonical `domains` entries.
  
  ### Not backward compatible
  
  - Permissions profiles under `[permissions.<profile>.network]` no longer
  accept the legacy list-based keys. Those configs must use the canonical
  `[domains]` and `[unix_sockets]` tables instead of `allowed_domains`,
  `denied_domains`, or `allow_unix_sockets`.
  - Managed `experimental_network` config cannot mix canonical and legacy
  forms in the same block. For example, `domains` cannot be combined with
  `allowed_domains` or `denied_domains`, and `unix_sockets` cannot be
  combined with `allow_unix_sockets`.
  - The canonical format can express explicit `"none"` entries for unix
  sockets, but those entries do not round-trip through the legacy
  compatibility fields because the legacy fields only represent allow/deny
  lists.
  ## Testing
  `/target/debug/codex sandbox macos --log-denials /bin/zsh -c 'curl
  https://www.example.com' ` gives 200 with config
  ```
  [permissions.workspace.network.domains]
  "www.example.com" = "allow"
  ```
  and fails when set to deny: `curl: (56) CONNECT tunnel failed, response
  403`.
  
  Also tested backward compatibility path by verifying that adding the
  following to `/etc/codex/requirements.toml` works:
  ```
  [experimental_network]
  allowed_domains = ["www.example.com"]
  ```

  Celia Chen · 2026-03-27 06:17:59 +00:00
  dd30c8eedd
• permissions: remove macOS seatbelt extension profiles (#15918)

  ## Why
  
  `PermissionProfile` should only describe the per-command permissions we
  still want to grant dynamically. Keeping
  `MacOsSeatbeltProfileExtensions` in that surface forced extra macOS-only
  approval, protocol, schema, and TUI branches for a capability we no
  longer want to expose.
  
  ## What changed
  
  - Removed the macOS-specific permission-profile types from
  `codex-protocol`, the app-server v2 API, and the generated
  schema/TypeScript artifacts.
  - Deleted the core and sandboxing plumbing that threaded
  `MacOsSeatbeltProfileExtensions` through execution requests and seatbelt
  construction.
  - Simplified macOS seatbelt generation so it always includes the fixed
  read-only preferences allowlist instead of carrying a configurable
  profile extension.
  - Removed the macOS additional-permissions UI/docs/test coverage and
  deleted the obsolete macOS permission modules.
  - Tightened `request_permissions` intersection handling so explicitly
  empty requested read lists are preserved only when that field was
  actually granted, avoiding zero-grant responses being stored as active
  permissions.

  Michael Bolin · 2026-03-26 17:12:45 -07:00
  e6e2999209
• chore: move bwrap config helpers into dedicated module (#15898)

  ## Summary
  - move the bwrap PATH lookup and warning helpers out of config/mod.rs
  - move the related tests into a dedicated bwrap_tests.rs file
  
  ## Validation
  - git diff --check
  - skipped heavier local tests per request
  
  Follow-up to #15791.

  viyatb-oai · 2026-03-26 15:15:59 -07:00
  b52abff279
• fix: resolve bwrap from trusted PATH entry (#15791)

  ## Summary
  - resolve system bwrap from PATH instead of hardcoding /usr/bin/bwrap
  - skip PATH entries that resolve inside the current workspace before
  launching the sandbox helper
  - keep the vendored bubblewrap fallback when no trusted system bwrap is
  found
  
  ## Validation
  - cargo test -p codex-core bwrap --lib
  - cargo test -p codex-linux-sandbox
  - just fix -p codex-core
  - just fix -p codex-linux-sandbox
  - just fmt
  - just argument-comment-lint
  - cargo clean

  viyatb-oai · 2026-03-26 12:13:51 -07:00
  b6050b42ae