1017 Commits

• register all mcp tools with namespace (#17404)

  stacked on #17402.
  
  MCP tools returned by `tool_search` (deferred tools) get registered in
  our `ToolRegistry` with a different format than directly available
  tools. this leads to two different ways of accessing MCP tools from our
  tool catalog, only one of which works for each. fix this by registering
  all MCP tools with the namespace format, since this info is already
  available.
  
  also, direct MCP tools are registered to responsesapi without a
  namespace, while deferred MCP tools have a namespace. this means we can
  receive MCP `FunctionCall`s in both formats from namespaces. fix this by
  always registering MCP tools with namespace, regardless of deferral
  status.
  
  make code mode track `ToolName` provenance of tools so it can map the
  literal JS function name string to the correct `ToolName` for
  invocation, rather than supporting both in core.
  
  this lets us unify to a single canonical `ToolName` representation for
  each MCP tool and force everywhere to use that one, without supporting
  fallbacks.

  sayan-oai · 2026-04-15 21:02:59 +08:00
  0df7e9a820
• feat: cleaning of memories extension (#17844)
  jif-oai · 2026-04-15 10:38:11 +01:00
  b6244f776d
• Send sandbox state through MCP tool metadata (#17763)

  ## Changes
  
  Allows MCPs to opt in to receiving sandbox config info through `_meta`
  on model-initiated tool calls. This lets MCPs adhere to the thread's
  sandbox if they choose to.
  
  ## Details
  
  - Adds the `codex/sandbox-state-meta` experimental MCP capability.
  - Tracks whether each MCP server advertises that capability.
  - When a server opts in, `codex-core` injects the current `SandboxState`
  into model-initiated MCP tool-call request `_meta`.
  
  ## Verification
  
  - added an integration test for the capability

  aaronl-openai · 2026-04-15 00:49:15 -07:00
  42528a905d
• sandbox: remove dead seatbelt helper and update tests (#17859)

  ## Why
  
  `spawn_command_under_seatbelt()` in `codex-rs/core/src/seatbelt.rs` had
  fallen out of production use and was only referenced by test-only
  wrappers. That left us with sandbox tests that could stay green even if
  the actual seatbelt exec path regressed, because production shell
  execution now flows through `SandboxManager::transform()` and
  `ExecRequest::from_sandbox_exec_request()` instead of that helper.
  
  Removing the dead helper also exposed one downstream `codex-exec`
  integration test that still imported it, which broke `just clippy`.
  
  ## What Changed
  
  - Removed `codex-rs/core/src/seatbelt.rs` and stopped exporting
  `codex_core::seatbelt`.
  - Removed the redundant `codex-rs/core/tests/suite/seatbelt.rs` coverage
  that only exercised the dead helper.
  - Kept the `openpty` regression check, but moved it into
  `codex-rs/core/tests/suite/exec.rs` so it now runs through
  `process_exec_tool_call()`.
  - Fixed the seatbelt denial test in `codex-rs/core/tests/suite/exec.rs`
  to use `/usr/bin/touch`, so it actually exercises the sandbox instead of
  a nonexistent path.
  - Updated `codex-rs/exec/tests/suite/sandbox.rs` on macOS to build the
  sandboxed command through `build_exec_request()` and spawn the
  transformed command, instead of importing the removed helper.
  - Left the lower-level seatbelt policy coverage in
  `codex-rs/sandboxing/src/seatbelt_tests.rs`, where the policy generator
  is still covered directly.
  
  ## Verification
  
  - `cargo test -p codex-core suite::exec::`
  - `cargo test -p codex-exec`
  - `cargo clippy -p codex-exec --tests -- -D warnings`

  Michael Bolin · 2026-04-14 20:48:01 -07:00
  d34bc66466
• Reuse remote exec-server in core tests (#17837)

  ## Summary
  - reuse a shared remote exec-server for remote-aware codex-core
  integration tests within a test binary process
  - keep per-test remote cwd creation and cleanup so tests retain
  workspace isolation
  - leave codex_self_exe, codex_linux_sandbox_exe, cwd_path(), and
  workspace_path() behavior unchanged
  
  ## Validation
  - rustfmt codex-rs/core/tests/common/test_codex.rs
  - git diff --check
  - CI is running on the updated branch

  starr-openai · 2026-04-14 20:42:03 -07:00
  e063596c67
• Wrap delegated input text (#17868)

  ## Summary
  - wrap routed delegation text in a small XML envelope before submitting
  it as a user turn
  - escape XML text content so the envelope stays well formed
  - update focused coverage for the wrapper and the affected routed-turn
  expectations

  guinness-oai · 2026-04-14 19:58:58 -07:00
  6f5ddd408b
• Make skill loading filesystem-aware (#17720)

  Migrates skill loading to support reading repo skills from the remote
  environment.

  pakrym-oai · 2026-04-14 15:40:40 -07:00
  96254a763a
• fix: apply patch bin refresh (#17808)

  Make sure the link to apply patch binary (i.e. codex) does not die in
  case of an update
  
  Fix this:
  https://openai.slack.com/archives/C08MGJXUCUQ/p1776183247771849
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-14 22:27:47 +01:00
  42166ba260
• Spread AbsolutePathBuf (#17792)

  Mechanical change to promote absolute paths through code.

  pakrym-oai · 2026-04-14 14:26:10 -07:00
  dd1321d11b
• Route apply_patch through the environment filesystem (#17674)

  ## Summary
  - route apply_patch runtime execution through the selected Environment
  filesystem instead of the local self-exec path
  - keep the standalone apply_patch command surface intact while restoring
  its launcher/test/docs contract
  - add focused apply_patch filesystem sandbox regression coverage
  
  ## Validation
  - remote devbox Bazel run in progress
  - passed: //codex-rs/apply-patch:apply-patch-unit-tests
  --test_filter=test_read_file_utf8_with_context_reports_invalid_utf8
  - in progress / follow-up: focused core and exec Bazel test slices on
  dev
  
  ## Follow-up under review
  - remote pre-verification and approval/retry behavior still need
  explicit scrutiny for delete/update flows
  - runtime sandbox-denial classification may need a tighter assertion
  path than rendered stderr matching
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-04-14 12:49:02 -07:00
  c24124b37d
• fix: Revert danger-full-access denylist-only mode (#17732)

  ## Summary
  
  - Reverts openai/codex#16946 and removes the danger-full-access
  denylist-only network mode.
  - Removes the corresponding config requirements, app-server
  protocol/schema, config API, TUI debug output, and network proxy
  behavior.
  - Drops stale tests that depended on the reverted mode while preserving
  newer managed allowlist-only coverage.
  
  ## Verification
  
  - `just write-app-server-schema`
  - `just fmt`
  - `cargo test -p codex-config network_requirements`
  - `cargo test -p codex-core network_proxy_spec`
  - `cargo test -p codex-core
  managed_network_proxy_decider_survives_full_access_start`
  - `cargo test -p codex-app-server map_requirements_toml_to_api`
  - `cargo test -p codex-tui debug_config_output`
  - `cargo test -p codex-app-server-protocol`
  - `just fix -p codex-config -p codex-core -p codex-app-server-protocol
  -p codex-app-server -p codex-tui`
  - `git diff --cached --check`
  
  Not run: full workspace `cargo test` (repo instructions ask for
  confirmation before that broader run).

  viyatb-oai · 2026-04-14 09:50:14 -07:00
  81c0bcc921
• [codex-analytics] add session source to client metadata (#17374)

  ## Summary
  
  Adds `thread_source` field to the existing Codex turn metadata sent to
  Responses API
  - Sends `thread_source: "user"` for user-initiated sessions: CLI, VS
  Code, and Exec
  - Sends `thread_source: "subagent"` for subagent sessions
  - Omits `thread_source` for MCP, custom, and unknown session sources
  - Uses the existing turn metadata transport:
    - HTTP requests send through the `x-codex-turn-metadata` header
  - WebSocket `response.create` requests send through
  `client_metadata["x-codex-turn-metadata"]`
  
  ## Testing
  - `cargo test -p codex-protocol
  session_source_thread_source_name_classifies_user_and_subagent_sources`
  - `cargo test -p codex-core turn_metadata_state`
  - `cargo test -p codex-core --test responses_headers
  responses_stream_includes_turn_metadata_header_for_git_workspace_e2e --
  --nocapture`

  marksteinbrick-oai · 2026-04-14 08:55:12 -07:00
  61fe23159e
• Always enable original image detail on supported models (#17665)

  ## Summary
  
  This PR removes `image_detail_original` as a runtime experiment and
  makes original image detail available whenever the selected model
  supports it.
  
  Concretely, this change:
  - drops the `image_detail_original` feature flag from the feature
  registry and generated config schema
  - makes tool-emitted image detail depend only on
  `ModelInfo.supports_image_detail_original`
  - updates `view_image` and `code_mode`/`js_repl` image emission to use
  that capability check directly
  - removes now-redundant experiment-specific tests and instruction
  coverage
  - keeps backward compatibility for existing configs by silently ignoring
  a stale `features.image_detail_original` entry
  
  The net effect is that `detail: "original"` is always available on
  supported models, without requiring an experiment toggle.

  Curtis 'Fjord' Hawthorne · 2026-04-14 08:15:56 -07:00
  f030ab62eb
• Add realtime output modality and transcript events (#17701)

  - Add outputModality to thread/realtime/start and wire text/audio output
  selection through app-server, core, API, and TUI.\n- Rename the realtime
  transcript delta notification and add a separate transcript done
  notification that forwards final text from item done without correlating
  it with deltas.

  Ahmed Ibrahim · 2026-04-14 00:13:13 -07:00
  2f6fc7c137
• [codex] drain mailbox only at request boundaries (#17749)

  This changes multi-agent v2 mailbox handling so incoming inter-agent
  messages no longer preempt an in-flight sampling stream at reasoning or
  commentary output-item boundaries.

  Thibault Sottiaux · 2026-04-13 22:09:51 -07:00
  05c5829923
• Stabilize exec-server filesystem tests in CI (#17671)

  ## Summary\n- add an exec-server package-local test helper binary that
  can run exec-server and fs-helper flows\n- route exec-server filesystem
  tests through that helper instead of cross-crate codex helper
  binaries\n- stop relying on Bazel-only extra binary wiring for these
  tests\n\n## Testing\n- not run (per repo guidance for codex changes)
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-04-13 16:53:42 -07:00
  280a4a6d42
• Add supports_parallel_tool_calls flag to included mcps (#17667)

  ## Why
  
  For more advanced MCP usage, we want the model to be able to emit
  parallel MCP tool calls and have Codex execute eligible ones
  concurrently, instead of forcing all MCP calls through the serial block.
  
  The main design choice was where to thread the config. I made this
  server-level because parallel safety depends on the MCP server
  implementation. Codex reads the flag from `mcp_servers`, threads the
  opted-in server names into `ToolRouter`, and checks the parsed
  `ToolPayload::Mcp { server, .. }` at execution time. That avoids relying
  on model-visible tool names, which can be incomplete in
  deferred/search-tool paths or ambiguous for similarly named
  servers/tools.
  
  ## What was added
  
  Added `supports_parallel_tool_calls` for MCP servers.
  
  Before:
  
  ```toml
  [mcp_servers.docs]
  command = "docs-server"
  ```
  
  After:
  
  ```toml
  [mcp_servers.docs]
  command = "docs-server"
  supports_parallel_tool_calls = true
  ```
  
  MCP calls remain serial by default. Only tools from opted-in servers are
  eligible to run in parallel. Docs also now warn to enable this only when
  the server’s tools are safe to run concurrently, especially around
  shared state or read/write races.
  
  ## Testing
  
  Tested with a local stdio MCP server exposing real delay tools. The
  model/Responses side was mocked only to deterministically emit two MCP
  calls in the same turn.
  
  Each test called `query_with_delay` and `query_with_delay_2` with `{
  "seconds": 25 }`.
  
  | Build/config | Observed | Wall time |
  | --- | --- | --- |
  | main with flag enabled | serial | `58.79s` |
  | PR with flag enabled | parallel | `31.73s` |
  | PR without flag | serial | `56.70s` |
  
  PR with flag enabled showed both tools start before either completed;
  main and PR-without-flag completed the first delay before starting the
  second.
  
  Also added an integration test.
  
  Additional checks:
  
  - `cargo test -p codex-tools` passed
  - `cargo test -p codex-core
  mcp_parallel_support_uses_exact_payload_server` passed
  - `git diff --check` passed

  josiah-openai · 2026-04-13 15:16:34 -07:00
  937dd3812d
• Cap realtime mirrored user turns (#17685)

  Cap mirrored user text sent to realtime with the existing 300-token turn
  budget while preserving the full model turn.
  
  Adds integration coverage for capped realtime mirror payloads.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-13 14:31:18 -07:00
  ec0133f5f8
• Use AbsolutePathBuf in skill loading and codex_home (#17407)

  Helps with FS migration later

  pakrym-oai · 2026-04-13 10:26:51 -07:00
  ac82443d07
• Run exec-server fs operations through sandbox helper (#17294)

  ## Summary
  - run exec-server filesystem RPCs requiring sandboxing through a
  `codex-fs` arg0 helper over stdin/stdout
  - keep direct local filesystem execution for `DangerFullAccess` and
  external sandbox policies
  - remove the standalone exec-server binary path in favor of top-level
  arg0 dispatch/runtime paths
  - add sandbox escape regression coverage for local and remote filesystem
  paths
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - remote devbox: `cd codex-rs && bazel test --bes_backend=
  --bes_results_url= //codex-rs/exec-server:all` (6/6 passed)
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-04-12 18:36:03 -07:00
  d626dc3895
• Add MCP tool wall time to model output (#17406)

  Include MCP wall time in the output so the model is aware of how long
  it's calls are taking.

  pakrym-oai · 2026-04-12 18:26:15 -07:00
  7c1e41c8b6
• Mirror user text into realtime (#17520)

  - Let typed user messages submit while realtime is active and mirror
  accepted text into the realtime text stream.
  - Add integration coverage and snapshot for outbound realtime text.

  Ahmed Ibrahim · 2026-04-12 15:03:14 -07:00
  d840b247d7
• Budget realtime current thread context (#17519)

  Select Current Thread startup context by budget from newest turns, cap
  each rendered turn at 300 approximate tokens, and add formatter plus
  integration snapshot coverage.

  Ahmed Ibrahim · 2026-04-12 11:59:09 -07:00
  4db60d5d8b
• Revert "Option to Notify Workspace Owner When Usage Limit is Reached" (#17391)

  Reverts openai/codex#16969
  
  #sev3-2026-04-10-accountscheckversion-500s-for-openai-workspace-7300

  Shijie Rao · 2026-04-10 23:33:13 +00:00
  930e5adb7e
• [codex-analytics] add compaction analytics event (#17155)

  - event for compaction analytics
  - introduces thread-connection and thread metadata caches for data
  denormalization, expected to be useful for denormalization onto core
  emitted events in general
  - threads analytics event client into core (mirrors approved
  implementation in #16640)
  - denormalizes key thread metadata: thread_source, subagent_source,
  parent_thread_id, as well as app-server client and runtime metadata)
  - compaction strategy defaults to memento, forward compatible with
  expected prefill_compaction strategy
  
  1. Manual standalone compact, local
  `INFO | 2026-04-09 17:35:50 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d0-5cfb-70c0-bef9-165c3bf9b2df', 'turn_id':
  '019d74d0-d7f6-7c81-acc6-aae2030243d6', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20170, 'active_context_tokens_after':
  4830, 'started_at': 1775781337, 'completed_at': 1775781350,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 13524} | `
  
  2. Auto pre-turn compact, local
  `INFO | 2026-04-09 17:37:30 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d2-45ef-71d1-9c93-23cc0c13d988', 'turn_id':
  '019d74d2-7b42-7372-9f0e-c0da3f352328', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'pre_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20063, 'active_context_tokens_after':
  4822, 'started_at': 1775781444, 'completed_at': 1775781449,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 5497} | `
  
  3. Auto mid-turn compact, local
  `INFO | 2026-04-09 17:38:28 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d3-212f-7a20-8c0a-4816a978675e', 'turn_id':
  '019d74d3-3ee1-7462-89f6-2ffbeefcd5e3', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'mid_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20325, 'active_context_tokens_after':
  14641, 'started_at': 1775781500, 'completed_at': 1775781508,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 7507} | `
  
  4. Remote /responses/compact, manual standalone
  `INFO | 2026-04-09 17:40:20 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d4-7a11-78a1-89f7-0535a1149416', 'turn_id':
  '019d74d4-e087-7183-9c20-b1e40b7578c0', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses_compact', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 23461, 'active_context_tokens_after':
  6171, 'started_at': 1775781601, 'completed_at': 1775781620,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 18971} | `

  rhan-oai · 2026-04-10 13:03:54 -07:00
  5779be314a
• Add output_schema to code mode render (#17210)

  This updates code-mode tool rendering so MCP tools can surface
  structured output types from their `outputSchema`.
  
  What changed:
  - Detect MCP tool-call result wrappers from the output schema shape
  instead of relying on tool-name parsing or provenance flags.
  - Render shared TypeScript aliases once for MCP tool results
  (`CallToolResult`, `ContentBlock`, etc.) so multiple MCP tool
  declarations stay compact.
  - Type `structuredContent` from the tool definition's `outputSchema`
  instead of rendering it as `unknown`.
  - Update the shared MCP aliases to match the MCP draft `CallToolResult`
  schema more closely.
  
  Example:
  - Before: `declare const tools: { mcp__rmcp__echo(args: { env_var?:
  string; message: string; }): Promise<{ _meta?: unknown; content:
  Array<unknown>; isError?: boolean; structuredContent?: unknown; }>; };`
  - After: `declare const tools: { mcp__rmcp__echo(args: { env_var?:
  string; message: string; }): Promise<CallToolResult<{ echo: string; env:
  string | null; }>>; };`

  Vivian Fang · 2026-04-10 11:41:44 +00:00
  7bbe3b6011
• Option to Notify Workspace Owner When Usage Limit is Reached (#16969)

  ## Summary
  - Replace the manual `/notify-owner` flow with an inline confirmation
  prompt when a usage-based workspace member hits a credits-depleted
  limit.
  - Fetch the current workspace role from the live ChatGPT
  `accounts/check/v4-2023-04-27` endpoint so owner/member behavior matches
  the desktop and web clients.
  - Keep owner, member, and spend-cap messaging distinct so we only offer
  the owner nudge when the workspace is actually out of credits.
  
  ## What Changed
  - `backend-client`
  - Added a typed fetch for the current account role from
  `accounts/check`.
    - Mapped backend role values into a Rust workspace-role enum.
  - `app-server` and protocol
    - Added `workspaceRole` to `account/read` and `account/updated`.
  - Derived `isWorkspaceOwner` from the live role, with a fallback to the
  cached token claim when the role fetch is unavailable.
  - `tui`
    - Removed the explicit `/notify-owner` slash command.
  - When a member is blocked because the workspace is out of credits, the
  error now prompts:
  - `Your workspace is out of credits. Request more from your workspace
  owner? [y/N]`
    - Choosing `y` sends the existing owner-notification request.
  - Choosing `n`, pressing `Esc`, or accepting the default selection
  dismisses the prompt without sending anything.
  - Selection popups now honor explicit item shortcuts, which is how the
  `y` / `n` interaction is wired.
  
  ## Reviewer Notes
  - The main behavior change is scoped to usage-based workspace members
  whose workspace credits are depleted.
  - Spend-cap reached should not show the owner-notification prompt.
  - Owners and admins should continue to see `/usage` guidance instead of
  the member prompt.
  - The live role fetch is best-effort; if it fails, we fall back to the
  existing token-derived ownership signal.
  
  ## Testing
  - Manual verification
    - Workspace owner does not see the member prompt.
  - Workspace member with depleted credits sees the confirmation prompt
  and can send the nudge with `y`.
  - Workspace member with spend cap reached does not see the
  owner-notification prompt.
  
  ### Workspace member out of usage
  
  https://github.com/user-attachments/assets/341ac396-eff4-4a7f-bf0c-60660becbea1
  
  ### Workspace owner
  <img width="1728" height="1086" alt="Screenshot 2026-04-09 at 11 48
  22 AM"
  src="https://github.com/user-attachments/assets/06262a45-e3fc-4cc4-8326-1cbedad46ed6"
  />

  richardopenai · 2026-04-09 21:15:17 -07:00
  9f2a585153
• [mcp] Expand tool search to custom MCPs. (#16944)

  - [x] Expand tool search to custom MCPs.
  - [x] Rename several variables/fields to be more generic.
  
  Updated tool & server name lifecycles:
  
  **Raw Identity**
  
  ToolInfo.server_name is raw MCP server name.
  ToolInfo.tool.name is raw MCP tool name.
  MCP calls route back to raw via parse_tool_name() returning
  (tool.server_name, tool.tool.name).
  mcpServerStatus/list now groups by raw server and keys tools by
  Tool.name: mod.rs:599
  App-server just forwards that grouped raw snapshot:
  codex_message_processor.rs:5245
  
  **Callable Names**
  
  On list-tools, we create provisional callable_namespace / callable_name:
  mcp_connection_manager.rs:1556
  For non-app MCP, provisional callable name starts as raw tool name.
  For codex-apps, provisional callable name is sanitized and strips
  connector name/id prefix; namespace includes connector name.
  Then qualify_tools() sanitizes callable namespace + name to ASCII alnum
  / _ only: mcp_tool_names.rs:128
  Note: this is stricter than Responses API. Hyphen is currently replaced
  with _ for code-mode compatibility.
  
  **Collision Handling**
  
  We do initially collapse example-server and example_server to the same
  base.
  Then qualify_tools() detects distinct raw namespace identities behind
  the same sanitized namespace and appends a hash to the callable
  namespace: mcp_tool_names.rs:137
  Same idea for tool-name collisions: hash suffix goes on callable tool
  name.
  Final list_all_tools() map key is callable_namespace + callable_name:
  mcp_connection_manager.rs:769
  
  **Direct Model Tools**
  
  Direct MCP tool declarations use the full qualified sanitized key as the
  Responses function name.
  The raw rmcp Tool is converted but renamed for model exposure.
  
  **Tool Search / Deferred**
  
  Tool search result namespace = final ToolInfo.callable_namespace:
  tool_search.rs:85
  Tool search result nested name = final ToolInfo.callable_name:
  tool_search.rs:86
  Deferred tool handler is registered as "{namespace}:{name}":
  tool_registry_plan.rs:248
  When a function call comes back, core recombines namespace + name, looks
  up the full qualified key, and gets the raw server/tool for MCP
  execution: codex.rs:4353
  
  **Separate Legacy Snapshot**
  
  collect_mcp_snapshot_from_manager_with_detail() still returns a map
  keyed by qualified callable name.
  mcpServerStatus/list no longer uses that; it uses
  McpServerStatusSnapshot, which is raw-inventory shaped.

  Matthew Zeng · 2026-04-09 13:34:52 -07:00
  d7f99b0fa6
• Forward app-server turn clientMetadata to Responses (#16009)

  ## Summary
  App-server v2 already receives turn-scoped `clientMetadata`, but the
  Rust app-server was dropping it before the outbound Responses request.
  This change keeps the fix lightweight by threading that metadata through
  the existing turn-metadata path rather than inventing a new transport.
  
  ## What we're trying to do and why
  We want turn-scoped metadata from the app-server protocol layer,
  especially fields like Hermes/GAAS run IDs, to survive all the way to
  the actual Responses API request so it is visible in downstream
  websocket request logging and analytics.
  
  The specific bug was:
  - app-server protocol uses camelCase `clientMetadata`
  - Responses transport already has an existing turn metadata carrier:
  `x-codex-turn-metadata`
  - websocket transport already rewrites that header into
  `request.request_body.client_metadata["x-codex-turn-metadata"]`
  - but the Rust app-server never parsed or stored `clientMetadata`, so
  nothing from the app-server request was making it into that existing
  path
  
  This PR fixes that without adding a new header or a second metadata
  channel.
  
  ## How we did it
  ### Protocol surface
  - Add optional `clientMetadata` to v2 `TurnStartParams` and
  `TurnSteerParams`
  - Regenerate the JSON schema / TypeScript fixtures
  - Update app-server docs to describe the field and its behavior
  
  ### Runtime plumbing
  - Add a dedicated core op for app-server user input carrying turn-scoped
  metadata: `Op::UserInputWithClientMetadata`
  - Wire `turn/start` and `turn/steer` through that op / signature path
  instead of dropping the metadata at the message-processor boundary
  - Store the metadata in `TurnMetadataState`
  
  ### Transport behavior
  - Reuse the existing serialized `x-codex-turn-metadata` payload
  - Merge the new app-server `clientMetadata` into that JSON additively
  - Do **not** replace built-in reserved fields already present in the
  turn metadata payload
  - Keep websocket behavior unchanged at the outer shape level: it still
  sends only `client_metadata["x-codex-turn-metadata"]`, but that JSON
  string now contains the merged fields
  - Keep HTTP fallback behavior unchanged except that the existing
  `x-codex-turn-metadata` header now includes the merged fields too
  
  ### Request shape before / after
  Before, a websocket `response.create` looked like:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\"}"
    }
  }
  ```
  Even if the app-server caller supplied `clientMetadata`, it was not
  represented there.
  
  After, the same request shape is preserved, but the serialized payload
  now includes the new turn-scoped fields:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\",\"fiber_run_id\":\"fiber-start-123\",\"origin\":\"gaas\"}"
    }
  }
  ```
  
  ## Validation
  ### Targeted tests added / updated
  - protocol round-trip coverage for `clientMetadata` on `turn/start` and
  `turn/steer`
  - protocol round-trip coverage for `Op::UserInputWithClientMetadata`
  - `TurnMetadataState` merge test proving client metadata is added
  without overwriting reserved built-in fields
  - websocket request-shape test proving outbound `response.create`
  contains merged metadata inside
  `client_metadata["x-codex-turn-metadata"]`
  - app-server integration tests proving:
  - `turn/start` forwards `clientMetadata` into the outbound Responses
  request path
    - websocket warmup + real turn request both behave correctly
    - `turn/steer` updates the follow-up request metadata
  
  ### Commands run
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-protocol`
  - `cargo test -p codex-core
  turn_metadata_state_merges_client_metadata_without_replacing_reserved_fields
  --lib`
  - `cargo test -p codex-core --test all
  responses_websocket_preserves_custom_turn_metadata_fields`
  - `cargo test -p codex-app-server --test all client_metadata`
  - `cargo test -p codex-app-server --test all
  turn_start_forwards_client_metadata_to_responses_websocket_request_body_v2
  -- --nocapture`
  - `just fmt`
  - `just fix -p codex-core -p codex-protocol -p codex-app-server-protocol
  -p codex-app-server`
  - `just fix -p codex-exec -p codex-tui-app-server`
  - `just argument-comment-lint`
  
  ### Full suite note
  `cargo test` in `codex-rs` still fails in:
  -
  `suite::v2::turn_interrupt::turn_interrupt_resolves_pending_command_approval_request`
  
  I verified that same failure on a clean detached `HEAD` worktree with an
  isolated `CARGO_TARGET_DIR`, so it is not caused by this patch.

  neil-oai · 2026-04-09 11:52:37 -07:00
  a92a5085bd
• feat: add Codex Apps sediment file remapping (#15197)

  ## Summary
  - bridge Codex Apps tools that declare `_meta["openai/fileParams"]`
  through the OpenAI file upload flow
  - mask those file params in model-visible tool schemas so the model
  provides absolute local file paths instead of raw file payload objects
  - rewrite those local file path arguments client-side into
  `ProvidedFilePayload`-shaped objects before the normal MCP tool call
  
  ## Details
  - applies to scalar and array file params declared in
  `openai/fileParams`
  - Codex uploads local files directly to the backend and uses the
  uploaded file metadata to build the MCP tool arguments locally
  - this PR is input-only
  
  ## Verification
  - `just fmt`
  - `cargo test -p codex-core mcp_tool_call -- --nocapture`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Casey Chow · 2026-04-09 14:10:44 -04:00
  244b15c95d
• chore: merge name and title (#17116)

  Merge title and name concept to leverage the sqlite title column and
  have more efficient queries
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-09 18:44:26 +01:00
  12f0e0b0eb
• [codex] Defer steering until after sampling the model post-compaction (#17163)

  ## Summary
  - keep pending steered input buffered until the active user prompt has
  received a model response
  - keep steering pending across auto-compact when there is real
  model/tool continuation to resume
  - allow queued steering to follow compaction immediately when the prior
  model response was already final
  - keep pending-input follow-up owned by `run_turn` instead of folding it
  into `SamplingRequestResult`
  - add regression coverage for mid-turn compaction, final-response
  compaction, and compaction triggered before the next request after tool
  output
  
  ## Root Cause
  Steered input was drained at the top of every `run_turn` loop. After
  auto-compaction, the loop continued and immediately appended any pending
  steer after the compact summary, making a queued prompt look like the
  newest task instead of letting the model first resume interrupted
  model/tool work.
  
  ## Implementation Notes
  This patch keeps the follow-up signals separated:
  
  - `SamplingRequestResult.needs_follow_up` means model/tool continuation
  is needed
  - `sess.has_pending_input().await` means queued user steering exists
  - `run_turn` computes the combined loop condition from those two signals
  
  In `run_turn`:
  
  ```rust
  let has_pending_input = sess.has_pending_input().await;
  let needs_follow_up = model_needs_follow_up || has_pending_input;
  ```
  
  After auto-compact we choose whether the next request may drain
  steering:
  
  ```rust
  can_drain_pending_input = !model_needs_follow_up;
  ```
  
  That means:
  
  - model/tool continuation + pending steer: compact -> resume once
  without draining steer
  - completed model answer + pending steer: compact -> drain/send the
  steer immediately
  - fresh user prompt: do not drain steering before the model has answered
  the prompt once
  
  The drain is still only `sess.get_pending_input().await`; when
  `can_drain_pending_input` is false, core uses an empty local vec and
  leaves the steer pending in session state.
  
  ## Validation
  - PASS `cargo test -p codex-core --test all steered_user_input --
  --nocapture`
  - PASS `just fmt`
  - PASS `git diff --check`
  - NOT PASSING HERE `just fix -p codex-core` currently stops before
  linting this change on an unrelated mainline test-build error:
  `core/src/tools/spec_tests.rs` initializes `ToolsConfigParams` without
  `image_generation_tool_auth_allowed`; this PR does not touch that file.

  jgershen-oai · 2026-04-09 02:08:41 -07:00
  8f705b0702
• Default realtime startup to v2 model (#17183)

  - Default realtime sessions to v2 and gpt-realtime-1.5 when no override
  is configured.
  - Add Op::RealtimeConversationStart integration coverage and keep
  v1-specific tests explicit.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 22:11:30 -07:00
  1fdb695e42
• Add realtime voice selection (#17176)

  - Add realtime voice selection for realtime/start.
  - Expose the supported v1/v2 voice lists and cover explicit, configured,
  default, and invalid voice paths.

  Ahmed Ibrahim · 2026-04-08 20:19:15 -07:00
  2f9090be62
• Move default realtime prompt into core (#17165)

  - Adds a core-owned realtime backend prompt template and preparation
  path.
  - Makes omitted realtime start prompts use the core default, while null
  or empty prompts intentionally send empty instructions.
  - Covers the core realtime path and app-server v2 path with integration
  coverage.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 19:34:40 -07:00
  4c2a1ae31b
• Attach WebRTC realtime starts to sideband websocket (#17057)

  Summary:
  - parse the realtime call Location header and join that call over the
  direct realtime WebSocket
  - keep WebRTC starts alive on the existing realtime conversation path
  
  Validation:
  - just fmt
  - git diff --check
  - cargo check -p codex-api
  - cargo check -p codex-core --tests
  - local cargo tests not run; relying on PR CI

  Ahmed Ibrahim · 2026-04-08 15:25:42 -07:00
  794a0240f9
• Use AbsolutePathBuf for exec cwd plumbing (#17063)

  ## Summary
  - Carry `AbsolutePathBuf` through tool cwd parsing/resolution instead of
  resolving workdirs to raw `PathBuf`s.
  - Type exec/sandbox request cwd fields as `AbsolutePathBuf` through
  `ExecParams`, `ExecRequest`, `SandboxCommand`, and unified exec runtime
  requests.
  - Keep `PathBuf` conversions at external/event boundaries and update
  existing tests/fixtures for the typed cwd.
  
  ## Validation
  - `cargo check -p codex-core --tests`
  - `cargo check -p codex-sandboxing --tests`
  - `cargo test -p codex-sandboxing`
  - `cargo test -p codex-core --lib tools::handlers::`
  - `just fix -p codex-sandboxing`
  - `just fix -p codex-core`
  - `just fmt`
  
  Full `codex-core` test suite was not run locally; per repo guidance I
  kept local validation targeted.

  pakrym-oai · 2026-04-08 10:54:12 -07:00
  35b5720e8d
• Render function attribute descriptions (#16880)
  Vivian Fang · 2026-04-08 02:10:45 -07:00
  9091999c83
• Use model metadata for Fast Mode status (#16949)

  Fast Mode status was still tied to one model name in the TUI and
  model-list plumbing. This changes the model metadata shape so a model
  can advertise additional speed tiers, carries that field through the
  app-server model list, and uses it to decide when to show Fast Mode
  status.
  
  For people using Codex, the behavior is intended to stay the same for
  existing models. Fast Mode still requires the existing signed-in /
  feature-gated path; the difference is that the UI can now recognize any
  model the model list marks as Fast-capable, instead of requiring a new
  client-side slug check.

  pash-openai · 2026-04-07 17:55:40 -07:00
  80ebc80be5
• [codex] Apply patches through executor filesystem (#17048)

  ## Summary
  - run apply_patch through the executor filesystem when a remote
  environment is present instead of shelling out to the local process
  - thread the executor FileSystem into apply_patch interception and keep
  existing local behavior for non-remote turns
  - make the apply_patch integration harness use the executor filesystem
  for setup/assertions
  - add remote-aware skips for turn-diff coverage that still reads the
  test-runner filesystem
  
  ## Why
  Remote apply_patch needed to mutate the remote workspace instead of the
  local checkout. The tests also needed to seed and assert workspace state
  through the same filesystem abstraction so local and remote runs
  exercise the same behavior.
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - `cargo check -p core_test_support --tests`
  - `cargo test -p codex-core --test all
  suite::shell_serialization::apply_patch_custom_tool_call -- --nocapture`
  - `cargo test -p codex-core --test all
  suite::apply_patch_cli::apply_patch_cli_updates_file_appends_trailing_newline
  -- --nocapture`
  - remote `cargo test -p codex-core --test all apply_patch_cli --
  --nocapture` (229 passed)

  pakrym-oai · 2026-04-07 16:35:02 -07:00
  600c3e49e0
• Add WebRTC transport to realtime start (#16960)

  Adds WebRTC startup to the experimental app-server
  `thread/realtime/start` method with an optional transport enum. The
  websocket path remains the default; WebRTC offers create the realtime
  session through the shared start flow and emit the answer SDP via
  `thread/realtime/sdp`.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-07 15:43:38 -07:00
  fb3dcfde1d
• fix(app-server) revert null instructions changes (#17047)
  Dylan Hurd · 2026-04-07 15:18:34 -07:00
  6c36e7d688
• [codex] Migrate apply_patch to executor filesystem (#17027)

  - Migrate apply-patch verification and application internals to use the
  async `ExecutorFileSystem` abstraction from `exec-server`.
  - Convert apply-patch `cwd` handling to `AbsolutePathBuf` through the
  verifier/parser/handler boundary.
  
  Doesn't change how the tool itself works.

  pakrym-oai · 2026-04-07 21:20:22 +00:00
  e9702411ab
• fix(core) revert Command line in unified exec output (#17031)

  ## Summary
  https://github.com/openai/codex/pull/13860 changed the serialized output
  format of Unified Exec. This PR reverts those changes and some related
  test changes
  
  ## Testing
  - [x] Update tests
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-04-07 13:35:40 -07:00
  d45513ce5a
• [codex] Fix unified exec test build (#17032)

  ## Summary
  - Remove the stale `?` after `AbsolutePathBuf::join` in the unified exec
  integration test helper.
  
  ## Root Cause
  - `AbsolutePathBuf::join` was made infallible, but
  `core/tests/suite/unified_exec.rs` still treated it as a `Result`, which
  broke the Windows test build for the `all` integration test target.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-core --test all
  unified_exec_resolves_relative_workdir`

  pakrym-oai · 2026-04-07 12:01:06 -07:00
  8614f92fc4
• [codex] Make unified exec tests remote aware (#16977)

  ## Summary
  - Convert unified exec integration tests that can run against the remote
  executor to use the remote-aware test harness.
  - Create workspace directories through the executor filesystem for
  remote runs.
  - Install `python3` and `zsh` in the remote test container so restored
  Python/zsh-based test commands work in fresh Ubuntu containers.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-core --test all unified_exec_defaults_to_pipe`
  - `cargo test -p codex-core --test all unified_exec_can_enable_tty`
  - `cargo test -p codex-core --test all unified_exec`
  - Remote on `codex-remote`: `source scripts/test-remote-env.sh && cd
  codex-rs && cargo test -p codex-core --test all unified_exec`
  - `just fix -p codex-core`

  pakrym-oai · 2026-04-07 10:56:08 -07:00
  365154d5da
• [codex] Make AbsolutePathBuf joins infallible (#16981)

  Having to check for errors every time join is called is painful and
  unnecessary.

  pakrym-oai · 2026-04-07 10:52:08 -07:00
  f1a2b920f9
• feat(analytics): generate an installation_id and pass it in responsesapi client_metadata (#16912)

  ## Summary
  
  This adds a stable Codex installation ID and includes it on Responses
  API requests via `x-codex-installation-id` passed in via the
  `client_metadata` field for analytics/debugging.
  
  The main pieces are:
  - persist a UUID in `$CODEX_HOME/installation_id`
  - thread the installation ID into `ModelClient`
  - send it in `client_metadata` on Responses requests so it works
  consistently across HTTP and WebSocket transports

  Owen Lin · 2026-04-07 09:52:17 -07:00
  5d1671ca70
• Preserve null developer instructions (#16976)

  Preserve explicit null developer-instruction overrides across app-server
  resume and fork flows.

  Ahmed Ibrahim · 2026-04-07 09:32:14 -07:00
  cd591dc457
• [codex] reduce module visibility (#16978)

  ## Summary
  - reduce public module visibility across Rust crates, preferring private
  or crate-private modules with explicit crate-root public exports
  - update external call sites and tests to use the intended public crate
  APIs instead of reaching through module trees
  - add the module visibility guideline to AGENTS.md
  
  ## Validation
  - `cargo check --workspace --all-targets --message-format=short` passed
  before the final fix/format pass
  - `just fix` completed successfully
  - `just fmt` completed successfully
  - `git diff --check` passed

  pakrym-oai · 2026-04-07 08:03:35 -07:00
  413c1e1fdf