164 Commits

• register all mcp tools with namespace (#17404)

  stacked on #17402.
  
  MCP tools returned by `tool_search` (deferred tools) get registered in
  our `ToolRegistry` with a different format than directly available
  tools. this leads to two different ways of accessing MCP tools from our
  tool catalog, only one of which works for each. fix this by registering
  all MCP tools with the namespace format, since this info is already
  available.
  
  also, direct MCP tools are registered to responsesapi without a
  namespace, while deferred MCP tools have a namespace. this means we can
  receive MCP `FunctionCall`s in both formats from namespaces. fix this by
  always registering MCP tools with namespace, regardless of deferral
  status.
  
  make code mode track `ToolName` provenance of tools so it can map the
  literal JS function name string to the correct `ToolName` for
  invocation, rather than supporting both in core.
  
  this lets us unify to a single canonical `ToolName` representation for
  each MCP tool and force everywhere to use that one, without supporting
  fallbacks.

  sayan-oai · 2026-04-15 21:02:59 +08:00
  0df7e9a820
• Reuse remote exec-server in core tests (#17837)

  ## Summary
  - reuse a shared remote exec-server for remote-aware codex-core
  integration tests within a test binary process
  - keep per-test remote cwd creation and cleanup so tests retain
  workspace isolation
  - leave codex_self_exe, codex_linux_sandbox_exe, cwd_path(), and
  workspace_path() behavior unchanged
  
  ## Validation
  - rustfmt codex-rs/core/tests/common/test_codex.rs
  - git diff --check
  - CI is running on the updated branch

  starr-openai · 2026-04-14 20:42:03 -07:00
  e063596c67
• Stabilize exec-server filesystem tests in CI (#17671)

  ## Summary\n- add an exec-server package-local test helper binary that
  can run exec-server and fs-helper flows\n- route exec-server filesystem
  tests through that helper instead of cross-crate codex helper
  binaries\n- stop relying on Bazel-only extra binary wiring for these
  tests\n\n## Testing\n- not run (per repo guidance for codex changes)
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-04-13 16:53:42 -07:00
  280a4a6d42
• Use AbsolutePathBuf in skill loading and codex_home (#17407)

  Helps with FS migration later

  pakrym-oai · 2026-04-13 10:26:51 -07:00
  ac82443d07
• Run exec-server fs operations through sandbox helper (#17294)

  ## Summary
  - run exec-server filesystem RPCs requiring sandboxing through a
  `codex-fs` arg0 helper over stdin/stdout
  - keep direct local filesystem execution for `DangerFullAccess` and
  external sandbox policies
  - remove the standalone exec-server binary path in favor of top-level
  arg0 dispatch/runtime paths
  - add sandbox escape regression coverage for local and remote filesystem
  paths
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - remote devbox: `cd codex-rs && bazel test --bes_backend=
  --bes_results_url= //codex-rs/exec-server:all` (6/6 passed)
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-04-12 18:36:03 -07:00
  d626dc3895
• [codex-analytics] add compaction analytics event (#17155)

  - event for compaction analytics
  - introduces thread-connection and thread metadata caches for data
  denormalization, expected to be useful for denormalization onto core
  emitted events in general
  - threads analytics event client into core (mirrors approved
  implementation in #16640)
  - denormalizes key thread metadata: thread_source, subagent_source,
  parent_thread_id, as well as app-server client and runtime metadata)
  - compaction strategy defaults to memento, forward compatible with
  expected prefill_compaction strategy
  
  1. Manual standalone compact, local
  `INFO | 2026-04-09 17:35:50 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d0-5cfb-70c0-bef9-165c3bf9b2df', 'turn_id':
  '019d74d0-d7f6-7c81-acc6-aae2030243d6', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20170, 'active_context_tokens_after':
  4830, 'started_at': 1775781337, 'completed_at': 1775781350,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 13524} | `
  
  2. Auto pre-turn compact, local
  `INFO | 2026-04-09 17:37:30 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d2-45ef-71d1-9c93-23cc0c13d988', 'turn_id':
  '019d74d2-7b42-7372-9f0e-c0da3f352328', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'pre_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20063, 'active_context_tokens_after':
  4822, 'started_at': 1775781444, 'completed_at': 1775781449,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 5497} | `
  
  3. Auto mid-turn compact, local
  `INFO | 2026-04-09 17:38:28 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d3-212f-7a20-8c0a-4816a978675e', 'turn_id':
  '019d74d3-3ee1-7462-89f6-2ffbeefcd5e3', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'auto', 'reason':
  'context_limit', 'implementation': 'responses', 'phase': 'mid_turn',
  'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 20325, 'active_context_tokens_after':
  14641, 'started_at': 1775781500, 'completed_at': 1775781508,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 7507} | `
  
  4. Remote /responses/compact, manual standalone
  `INFO | 2026-04-09 17:40:20 | codex_backend.routers.analytics_events |
  analytics_events.track_analytics_events:526 | Tracked
  codex_compaction_event event params={'thread_id':
  '019d74d4-7a11-78a1-89f7-0535a1149416', 'turn_id':
  '019d74d4-e087-7183-9c20-b1e40b7578c0', 'product_surface': 'codex',
  'app_server_client': {'product_client_id': 'CODEX_CLI', 'client_name':
  'codex-tui', 'client_version': '0.0.0', 'rpc_transport': 'in_process',
  'experimental_api_enabled': True}, 'runtime': {'codex_rs_version':
  '0.0.0', 'runtime_os': 'macos', 'runtime_os_version': '26.4.0',
  'runtime_arch': 'aarch64'}, 'trigger': 'manual', 'reason':
  'user_requested', 'implementation': 'responses_compact', 'phase':
  'standalone_turn', 'strategy': 'memento', 'status': 'completed',
  'active_context_tokens_before': 23461, 'active_context_tokens_after':
  6171, 'started_at': 1775781601, 'completed_at': 1775781620,
  'thread_source': 'user', 'subagent_source': None, 'parent_thread_id':
  None, 'error': None, 'duration_ms': 18971} | `

  rhan-oai · 2026-04-10 13:03:54 -07:00
  5779be314a
• feat: add Codex Apps sediment file remapping (#15197)

  ## Summary
  - bridge Codex Apps tools that declare `_meta["openai/fileParams"]`
  through the OpenAI file upload flow
  - mask those file params in model-visible tool schemas so the model
  provides absolute local file paths instead of raw file payload objects
  - rewrite those local file path arguments client-side into
  `ProvidedFilePayload`-shaped objects before the normal MCP tool call
  
  ## Details
  - applies to scalar and array file params declared in
  `openai/fileParams`
  - Codex uploads local files directly to the backend and uses the
  uploaded file metadata to build the MCP tool arguments locally
  - this PR is input-only
  
  ## Verification
  - `just fmt`
  - `cargo test -p codex-core mcp_tool_call -- --nocapture`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Casey Chow · 2026-04-09 14:10:44 -04:00
  244b15c95d
• Default realtime startup to v2 model (#17183)

  - Default realtime sessions to v2 and gpt-realtime-1.5 when no override
  is configured.
  - Add Op::RealtimeConversationStart integration coverage and keep
  v1-specific tests explicit.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 22:11:30 -07:00
  1fdb695e42
• [codex] Apply patches through executor filesystem (#17048)

  ## Summary
  - run apply_patch through the executor filesystem when a remote
  environment is present instead of shelling out to the local process
  - thread the executor FileSystem into apply_patch interception and keep
  existing local behavior for non-remote turns
  - make the apply_patch integration harness use the executor filesystem
  for setup/assertions
  - add remote-aware skips for turn-diff coverage that still reads the
  test-runner filesystem
  
  ## Why
  Remote apply_patch needed to mutate the remote workspace instead of the
  local checkout. The tests also needed to seed and assert workspace state
  through the same filesystem abstraction so local and remote runs
  exercise the same behavior.
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - `cargo check -p core_test_support --tests`
  - `cargo test -p codex-core --test all
  suite::shell_serialization::apply_patch_custom_tool_call -- --nocapture`
  - `cargo test -p codex-core --test all
  suite::apply_patch_cli::apply_patch_cli_updates_file_appends_trailing_newline
  -- --nocapture`
  - remote `cargo test -p codex-core --test all apply_patch_cli --
  --nocapture` (229 passed)

  pakrym-oai · 2026-04-07 16:35:02 -07:00
  600c3e49e0
• [codex] Migrate apply_patch to executor filesystem (#17027)

  - Migrate apply-patch verification and application internals to use the
  async `ExecutorFileSystem` abstraction from `exec-server`.
  - Convert apply-patch `cwd` handling to `AbsolutePathBuf` through the
  verifier/parser/handler boundary.
  
  Doesn't change how the tool itself works.

  pakrym-oai · 2026-04-07 21:20:22 +00:00
  e9702411ab
• Make AGENTS.md discovery FS-aware (#15826)

  ## Summary
  - make AGENTS.md discovery and loading fully FS-aware and remove the
  non-FS discover helper
  - migrate remote-aware codex-core tests to use TestEnv workspace setup
  instead of syncing a local workspace copy
  - add AGENTS.md corner-case coverage, including directory fallbacks and
  remote-aware integration coverage
  
  ## Testing
  - cargo test -p codex-core project_doc -- --nocapture
  - cargo test -p codex-core hierarchical_agents -- --nocapture
  - cargo test -p codex-core agents_md -- --nocapture
  - cargo test -p codex-tui status -- --nocapture
  - cargo test -p codex-tui-app-server status -- --nocapture
  - just fix
  - just fmt
  - just bazel-lock-update
  - just bazel-lock-check
  - just argument-comment-lint
  - remote Linux executor tests in progress via scripts/test-remote-env.sh

  pakrym-oai · 2026-04-06 20:26:21 -07:00
  4bb507d2c4
• remove temporary ownership re-exports (#16626)

  Stacked on #16508.
  
  This removes the temporary `codex-core` / `codex-login` re-export shims
  from the ownership split and rewrites callsites to import directly from
  `codex-model-provider-info`, `codex-models-manager`, `codex-api`,
  `codex-protocol`, `codex-feedback`, and `codex-response-debug-context`.
  
  No behavior change intended; this is the mechanical import cleanup layer
  split out from the ownership move.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-03 00:33:34 -07:00
  af8a9d2d2b
• extract models manager and related ownership from core (#16508)

  ## Summary
  - split `models-manager` out of `core` and add `ModelsManagerConfig`
  plus `Config::to_models_manager_config()` so model metadata paths stop
  depending on `core::Config`
  - move login-owned/auth-owned code out of `core` into `codex-login`,
  move model provider config into `codex-model-provider-info`, move API
  bridge mapping into `codex-api`, move protocol-owned types/impls into
  `codex-protocol`, and move response debug helpers into a dedicated
  `response-debug-context` crate
  - move feedback tag emission into `codex-feedback`, relocate tests to
  the crates that now own the code, and keep broad temporary re-exports so
  this PR avoids a giant import-only rewrite
  
  ## Major moves and decisions
  - created `codex-models-manager` as the owner for model
  cache/catalog/config/model info logic, including the new
  `ModelsManagerConfig` struct
  - created `codex-model-provider-info` as the owner for provider config
  parsing/defaults and kept temporary `codex-login`/`codex-core`
  re-exports for old import paths
  - moved `api_bridge` error mapping + `CoreAuthProvider` into
  `codex-api`, while `codex-login::api_bridge` temporarily re-exports
  those symbols and keeps the `auth_provider_from_auth` wrapper
  - moved `auth_env_telemetry` and `provider_auth` ownership to
  `codex-login`
  - moved `CodexErr` ownership to `codex-protocol::error`, plus
  `StreamOutput`, `bytes_to_string_smart`, and network policy helpers to
  protocol-owned modules
  - created `codex-response-debug-context` for
  `extract_response_debug_context`, `telemetry_transport_error_message`,
  and related response-debug plumbing instead of leaving that behavior in
  `core`
  - moved `FeedbackRequestTags`, `emit_feedback_request_tags`, and
  `emit_feedback_request_tags_with_auth_env` to `codex-feedback`
  - deferred removal of temporary re-exports and the mechanical import
  rewrites to a stacked follow-up PR so this PR stays reviewable
  
  ## Test moves
  - moved auth refresh coverage from `core/tests/suite/auth_refresh.rs` to
  `login/tests/suite/auth_refresh.rs`
  - moved text encoding coverage from
  `core/tests/suite/text_encoding_fix.rs` to
  `protocol/src/exec_output_tests.rs`
  - moved model info override coverage from
  `core/tests/suite/model_info_overrides.rs` to
  `models-manager/src/model_info_overrides_tests.rs`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-02 23:00:02 -07:00
  6fff9955f1
• core: remove cross-crate re-exports from lib.rs (#16512)

  ## Why
  
  `codex-core` was re-exporting APIs owned by sibling `codex-*` crates,
  which made downstream crates depend on `codex-core` as a proxy module
  instead of the actual owner crate.
  
  Removing those forwards makes crate boundaries explicit and lets leaf
  crates drop unnecessary `codex-core` dependencies. In this PR, this
  reduces the dependency on `codex-core` to `codex-login` in the following
  files:
  
  ```
  codex-rs/backend-client/Cargo.toml
  codex-rs/mcp-server/tests/common/Cargo.toml
  ```
  
  ## What
  
  - Remove `codex-rs/core/src/lib.rs` re-exports for symbols owned by
  `codex-login`, `codex-mcp`, `codex-rollout`, `codex-analytics`,
  `codex-protocol`, `codex-shell-command`, `codex-sandboxing`,
  `codex-tools`, and `codex-utils-path`.
  - Delete the `default_client` forwarding shim in `codex-rs/core`.
  - Update in-crate and downstream callsites to import directly from the
  owning `codex-*` crate.
  - Add direct Cargo dependencies where callsites now target the owner
  crate, and remove `codex-core` from `codex-rs/backend-client`.

  Michael Bolin · 2026-04-01 23:06:24 -07:00
  aa2403e2eb
• ci: sync Bazel clippy lints and fix uncovered violations (#16351)

  ## Why
  
  Follow-up to #16345, the Bazel clippy rollout in #15955, and the cleanup
  pass in #16353.
  
  `cargo clippy` was enforcing the workspace deny-list from
  `codex-rs/Cargo.toml` because the member crates opt into `[lints]
  workspace = true`, but Bazel clippy was only using `rules_rust` plus
  `clippy.toml`. That left the Bazel lane vulnerable to drift:
  `clippy.toml` can tune lint behavior, but it cannot set
  allow/warn/deny/forbid levels.
  
  This PR now closes both sides of the follow-up. It keeps `.bazelrc` in
  sync with `[workspace.lints.clippy]`, and it fixes the real clippy
  violations that the newly-synced Windows Bazel lane surfaced once that
  deny-list started matching Cargo.
  
  ## What Changed
  
  - added `.github/scripts/verify_bazel_clippy_lints.py`, a Python check
  that parses `codex-rs/Cargo.toml` with `tomllib`, reads the Bazel
  `build:clippy` `clippy_flag` entries from `.bazelrc`, and reports
  missing, extra, or mismatched lint levels
  - ran that verifier from the lightweight `ci.yml` workflow so the sync
  check does not depend on a Rust toolchain being installed first
  - expanded the `.bazelrc` comment to explain the Cargo `workspace =
  true` linkage and why Bazel needs the deny-list duplicated explicitly
  - fixed the Windows-only `codex-windows-sandbox` violations that Bazel
  clippy reported after the sync, using the same style as #16353: inline
  `format!` args, method references instead of trivial closures, removed
  redundant clones, and replaced SID conversion `unwrap` and `expect`
  calls with proper errors
  - cleaned up the remaining cross-platform violations the Bazel lane
  exposed in `codex-backend-client` and `core_test_support`
  
  ## Testing
  
  Key new test introduced by this PR:
  
  `python3 .github/scripts/verify_bazel_clippy_lints.py`

  Michael Bolin · 2026-03-31 17:09:48 -07:00
  2e942ce830
• ci: verify codex-rs Cargo manifests inherit workspace settings (#16353)

  ## Why
  
  Bazel clippy now catches lints that `cargo clippy` can still miss when a
  crate under `codex-rs` forgets to opt into workspace lints. The concrete
  example here was `codex-rs/app-server/tests/common/Cargo.toml`: Bazel
  flagged a clippy violation in `models_cache.rs`, but Cargo did not
  because that crate inherited workspace package metadata without
  declaring `[lints] workspace = true`.
  
  We already mirror the workspace clippy deny list into Bazel after
  [#15955](https://github.com/openai/codex/pull/15955), so we also need a
  repo-side check that keeps every `codex-rs` manifest opted into the same
  workspace settings.
  
  ## What changed
  
  - add `.github/scripts/verify_cargo_workspace_manifests.py`, which
  parses every `codex-rs/**/Cargo.toml` with `tomllib` and verifies:
    - `version.workspace = true`
    - `edition.workspace = true`
    - `license.workspace = true`
    - `[lints] workspace = true`
  - top-level crate names follow the `codex-*` / `codex-utils-*`
  conventions, with explicit exceptions for `windows-sandbox-rs` and
  `utils/path-utils`
  - run that script in `.github/workflows/ci.yml`
  - update the current outlier manifests so the check is enforceable
  immediately
  - fix the newly exposed clippy violations in the affected crates
  (`app-server/tests/common`, `file-search`, `feedback`,
  `shell-escalation`, and `debug-client`)
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/16353).
  * #16351
  * __->__ #16353

  Michael Bolin · 2026-03-31 21:59:28 +00:00
  9a8730f31e
• fix: box apply_patch test harness futures (#15835)

  ## Why
  
  `#[large_stack_test]` made the `apply_patch_cli` tests pass by giving
  them more stack, but it did not address why those tests needed the extra
  stack in the first place.
  
  The real problem is the async state built by the `apply_patch_cli`
  harness path. Those tests await three helper boundaries directly:
  harness construction, turn submission, and apply-patch output
  collection. If those helpers inline their full child futures, the test
  future grows to include the whole harness startup and request/response
  path.
  
  This change replaces the workaround from #12768 with the same basic
  approach used in #13429, but keeps the fix narrower: only the helper
  boundaries awaited directly by `apply_patch_cli` stay boxed.
  
  ## What Changed
  
  - removed `#[large_stack_test]` from
  `core/tests/suite/apply_patch_cli.rs`
  - restored ordinary `#[tokio::test(flavor = "multi_thread",
  worker_threads = 2)]` annotations in that suite
  - deleted the now-unused `codex-test-macros` crate and removed its
  workspace wiring
  - boxed only the three helper boundaries that the suite awaits directly:
    - `apply_patch_harness_with(...)`
    - `TestCodexHarness::submit(...)`
    - `TestCodexHarness::apply_patch_output(...)`
  - added comments at those boxed boundaries explaining why they remain
  boxed
  
  ## Testing
  
  - `cargo test -p codex-core --test all suite::apply_patch_cli --
  --nocapture`
  
  ## References
  
  - #12768
  - #13429

  Michael Bolin · 2026-03-26 17:32:04 +00:00
  e36ebaa3da
• fix: fix old system bubblewrap compatibility without falling back to vendored bwrap (#15693)

  Fixes #15283.
  
  ## Summary
  Older system bubblewrap builds reject `--argv0`, which makes our Linux
  sandbox fail before the helper can re-exec. This PR keeps using system
  `/usr/bin/bwrap` whenever it exists and only falls back to vendored
  bwrap when the system binary is missing. That matters on stricter
  AppArmor hosts, where the distro bwrap package also provides the policy
  setup needed for user namespaces.
  
  For old system bwrap, we avoid `--argv0` instead of switching binaries:
  - pass the sandbox helper a full-path `argv0`,
  - keep the existing `current_exe() + --argv0` path when the selected
  launcher supports it,
  - otherwise omit `--argv0` and re-exec through the helper's own
  `argv[0]` path, whose basename still dispatches as
  `codex-linux-sandbox`.
  
  Also updates the launcher/warning tests and docs so they match the new
  behavior: present-but-old system bwrap uses the compatibility path, and
  only absent system bwrap falls back to vendored.
  
  ### Validation
  
  1. Install Ubuntu 20.04 in a VM
  2. Compile codex and run without bubblewrap installed - see a warning
  about falling back to the vendored bwrap
  3. Install bwrap and verify version is 0.4.0 without `argv0` support
  4. run codex and use apply_patch tool without errors
  
  <img width="802" height="631" alt="Screenshot 2026-03-25 at 11 48 36 PM"
  src="https://github.com/user-attachments/assets/77248a29-aa38-4d7c-9833-496ec6a458b8"
  />
  <img width="807" height="634" alt="Screenshot 2026-03-25 at 11 47 32 PM"
  src="https://github.com/user-attachments/assets/5af8b850-a466-489b-95a6-455b76b5050f"
  />
  <img width="812" height="635" alt="Screenshot 2026-03-25 at 11 45 45 PM"
  src="https://github.com/user-attachments/assets/438074f0-8435-4274-a667-332efdd5cb57"
  />
  <img width="801" height="623" alt="Screenshot 2026-03-25 at 11 43 56 PM"
  src="https://github.com/user-attachments/assets/0dc8d3f5-e8cf-4218-b4b4-a4f7d9bf02e3"
  />
  
  ---------
  
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  viyatb-oai · 2026-03-25 23:51:39 -07:00
  937cb5081d
• Add cached environment manager for exec server URL (#15785)

  Add environment manager that is a singleton and is created early in
  app-server (before skill manager, before config loading).
  
  Use an environment variable to point to a running exec server.

  pakrym-oai · 2026-03-25 16:14:36 -07:00
  8fa88fa8ca
• Use AbsolutePathBuf for cwd state (#15710)

  Migrate `cwd` and related session/config state to `AbsolutePathBuf` so
  downstream consumers consistently see absolute working directories.
  
  Add test-only `.abs()` helpers for `Path`, `PathBuf`, and `TempDir`, and
  update branch-local tests to use them instead of
  `AbsolutePathBuf::try_from(...)`.
  
  For the remaining TUI/app-server snapshot coverage that renders absolute
  cwd values, keep the snapshots unchanged and skip the Windows-only cases
  where the platform-specific absolute path layout differs.

  pakrym-oai · 2026-03-25 16:02:22 +00:00
  504aeb0e09
• chore: remove grep_files handler (#15775)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-03-25 16:01:45 +00:00
  178c3b15b4
• fix(core): default approval behavior for mcp missing annotations (#15519)

  - Changed `requires_mcp_tool_approval` to apply MCP spec defaults when
  annotations are missing.
  - Unannotated tools now default to:
    - `readOnlyHint = false`
    - `destructiveHint = true`
    - `openWorldHint = true`
  - This means unannotated MCP tools now go through approval/ARC
  monitoring instead of silently bypassing it.
  - Explicitly read-only tools still skip approval unless they are also
  explicitly marked destructive.
  
  **Previous behavior**
  Failed open for missing annotations, which was unsafe for custom MCP
  tools that omitted or forgot annotations.
  
  ---------
  
  Co-authored-by: colby-oai <228809017+colby-oai@users.noreply.github.com>

  Fouad Matin · 2026-03-25 07:55:41 -07:00
  32c4993c8a
• chore(core) Add approvals reviewer to UserTurn (#15426)

  ## Summary
  Adds support for approvals_reviewer to `Op::UserTurn` so we can migrate
  `[CodexMessageProcessor::turn_start]` to use Op::UserTurn
  
  ## Testing
  - [x] Adds quick test for the new field
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-03-23 15:19:01 -07:00
  67c1c7c054
• Add remote env CI matrix and integration test (#14869)

  `CODEX_TEST_REMOTE_ENV` will make `test_codex` start the executor
  "remotely" (inside a docker container) turning any integration test into
  remote test.

  pakrym-oai · 2026-03-20 08:02:50 -07:00
  ba85a58039
• Split features into codex-features crate (#15253)

  - Split the feature system into a new `codex-features` crate.
  - Cut `codex-core` and workspace consumers over to the new config and
  warning APIs.
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-19 20:12:07 -07:00
  2e22885e79
• feat(core, tracing): create turn spans over websockets (#14632)

  ## Description
  
  Dependent on:
  - [responsesapi] https://github.com/openai/openai/pull/760991 
  - [codex-backend] https://github.com/openai/openai/pull/760985
  
  `codex app-server -> codex-backend -> responsesapi` now reuses a
  persistent websocket connection across many turns. This PR updates
  tracing when using websockets so that each `response.create` websocket
  request propagates the current tracing context, so we can get a holistic
  end-to-end trace for each turn.
  
  Tracing is propagated via special keys (`ws_request_header_traceparent`,
  `ws_request_header_tracestate`) set in the `client_metadata` param in
  Responses API.
  
  Currently tracing on websockets is a bit broken because we only set
  tracing context on ws connection time, so it's detached from a
  `turn/start` request.

  Owen Lin · 2026-03-19 03:41:06 +00:00
  20f2a216df
• Prefer websockets when providers support them (#13592)

  Remove all flags and model settings.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  pakrym-oai · 2026-03-17 19:46:44 -07:00
  770616414a
• Stabilize Windows cmd-based shell test harnesses (#14958)

  ## What is flaky
  The Windows shell-driven integration tests in `codex-rs/core` were
  intermittently unstable, especially:
  
  - `apply_patch_cli_can_use_shell_command_output_as_patch_input`
  - `websocket_test_codex_shell_chain`
  - `websocket_v2_test_codex_shell_chain`
  
  ## Why it was flaky
  These tests were exercising real shell-tool flows through whichever
  shell Codex selected on Windows, and the `apply_patch` test also nested
  a PowerShell read inside `cmd /c`.
  
  There were multiple independent sources of nondeterminism in that setup:
  
  - The test harness depended on the model-selected Windows shell instead
  of pinning the shell it actually meant to exercise.
  - `cmd.exe /c powershell.exe -Command "..."` is quoting-sensitive; on CI
  that could leave the read command wrapped as a literal string instead of
  executing it.
  - Even after getting the quoting right, PowerShell could emit CLIXML
  progress records like module-initialization output onto stdout.
  - The `apply_patch` test was building a patch directly from shell
  stdout, so any quoting artifact or progress noise corrupted the patch
  input.
  
  So the failures were driven by shell startup and output-shape variance,
  not by the `apply_patch` or websocket logic themselves.
  
  ## How this PR fixes it
  - Add a test-only `user_shell_override` path so Windows integration
  tests can pin `cmd.exe` explicitly.
  - Use that override in the websocket shell-chain tests and in the
  `apply_patch` harness.
  - Change the nested Windows file read in
  `apply_patch_cli_can_use_shell_command_output_as_patch_input` to a UTF-8
  PowerShell `-EncodedCommand` script.
  - Run that nested PowerShell process with `-NonInteractive`, set
  `$ProgressPreference = 'SilentlyContinue'`, and read the file with
  `[System.IO.File]::ReadAllText(...)`.
  
  ## Why this fix fixes the flakiness
  The outer harness now runs under a deterministic shell, and the inner
  PowerShell read no longer depends on fragile `cmd` quoting or on
  progress output staying quiet by accident. The shell tool returns only
  the file contents, so patch construction and websocket assertions depend
  on stable test inputs instead of on runner-specific shell behavior.
  
  ---------
  
  Co-authored-by: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-17 20:21:46 +00:00
  b02388672f
• Apply argument comment lint across codex-rs (#14652)

  ## Why
  
  Once the repo-local lint exists, `codex-rs` needs to follow the
  checked-in convention and CI needs to keep it from drifting. This commit
  applies the fallback `/*param*/` style consistently across existing
  positional literal call sites without changing those APIs.
  
  The longer-term preference is still to avoid APIs that require comments
  by choosing clearer parameter types and call shapes. This PR is
  intentionally the mechanical follow-through for the places where the
  existing signatures stay in place.
  
  After rebasing onto newer `main`, the rollout also had to cover newly
  introduced `tui_app_server` call sites. That made it clear the first cut
  of the CI job was too expensive for the common path: it was spending
  almost as much time installing `cargo-dylint` and re-testing the lint
  crate as a representative test job spends running product tests. The CI
  update keeps the full workspace enforcement but trims that extra
  overhead from ordinary `codex-rs` PRs.
  
  ## What changed
  
  - keep a dedicated `argument_comment_lint` job in `rust-ci`
  - mechanically annotate remaining opaque positional literals across
  `codex-rs` with exact `/*param*/` comments, including the rebased
  `tui_app_server` call sites that now fall under the lint
  - keep the checked-in style aligned with the lint policy by using
  `/*param*/` and leaving string and char literals uncommented
  - cache `cargo-dylint`, `dylint-link`, and the relevant Cargo
  registry/git metadata in the lint job
  - split changed-path detection so the lint crate's own `cargo test` step
  runs only when `tools/argument-comment-lint/*` or `rust-ci.yml` changes
  - continue to run the repo wrapper over the `codex-rs` workspace, so
  product-code enforcement is unchanged
  
  Most of the code changes in this commit are intentionally mechanical
  comment rewrites or insertions driven by the lint itself.
  
  ## Verification
  
  - `./tools/argument-comment-lint/run.sh --workspace`
  - `cargo test -p codex-tui-app-server -p codex-tui`
  - parsed `.github/workflows/rust-ci.yml` locally with PyYAML
  
  ---
  
  * -> #14652
  * #14651

  Michael Bolin · 2026-03-16 16:48:15 -07:00
  b77fe8fefe
• Reuse guardian session across approvals (#14668)

  ## Summary
  - reuse a guardian subagent session across approvals so reviews keep a
  stable prompt cache key and avoid one-shot startup overhead
  - clear the guardian child history before each review so prior guardian
  decisions do not leak into later approvals
  - include the `smart_approvals` -> `guardian_approval` feature flag
  rename in the same PR to minimize release latency on a very tight
  timeline
  - add regression coverage for prompt-cache-key reuse without
  prior-review prompt bleed
  
  ## Request
  - Bug/enhancement request: internal guardian prompt-cache and latency
  improvement request
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-15 22:56:18 -07:00
  6fdeb1d602
• [apps] Improve search tool fallback. (#14732)

  - [x] Bypass tool search and stuff tool specs directly into model
  context when either a. Tool search is not available for the model or b.
  There are not that many tools to search for.

  Matthew Zeng · 2026-03-15 21:41:55 -07:00
  d4af6053e2
• [apps] Add tool call meta. (#14647)

  - [x] Add resource_uri and other things to _meta to shortcut resource
  lookup and speed things up.

  Matthew Zeng · 2026-03-14 22:24:13 -07:00
  49edf311ac
• move plugin/skill instructions into dev msg and reorder (#14609)

  Move the general `Apps`, `Skills` and `Plugins` instructions blocks out
  of `user_instructions` and into the developer message, with new `Apps ->
  Skills -> Plugins` order for better clarity.
  
  Also wrap those sections in stable XML-style instruction tags (like
  other sections) and update prompt-layout tests/snapshots. This makes the
  tests less brittle in snapshot output (we can parse the sections), and
  it consolidates the capability instructions in one place.
  
  #### Tests
  Updated snapshots, added tests.
  
  `<AGENTS_MD>` disappearing in snapshots is expected: before this change,
  the wrapped user-instructions message was kept alive by `Skills`
  content. Now that `Skills` and `Plugins` are in the developer message,
  that wrapper only appears when there is real
  project-doc/user-instructions content.
  
  ---------
  
  Co-authored-by: Charley Cunningham <ccunningham@openai.com>

  sayan-oai · 2026-03-13 20:51:01 -07:00
  d272f45058
• Add openai_base_url config override for built-in provider (#12031)

  We regularly get bug reports from users who mistakenly have the
  `OPENAI_BASE_URL` environment variable set. This PR deprecates this
  environment variable in favor of a top-level config key
  `openai_base_url` that is used for the same purpose. By making it a
  config key, it will be more visible to users. It will also participate
  in all of the infrastructure we've added for layered and managed
  configs.
  
  Summary
  - introduce the `openai_base_url` top-level config key, update
  schema/tests, and route the built-in openai provider through it while
  - fall back to deprecated `OPENAI_BASE_URL` env var but warn user of
  deprecation when no `openai_base_url` config key is present
  - update CLI, SDK, and TUI code to prefer the new config path (with a
  deprecated env-var fallback) and document the SDK behavior change

  Eric Traut · 2026-03-13 20:12:25 -06:00
  4b9d5c8c1b
• [apps] Add tool_suggest tool. (#14287)

  - [x] Add tool_suggest tool.
  - [x] Move chatgpt/src/connectors.rs and core/src/connectors.rs into a
  dedicated mod so that we have all the logic and global cache in one
  place.
  - [x] Update TUI app link view to support rendering the installation
  view for mcp elicitation.
  
  ---------
  
  Co-authored-by: Shaqayeq <shaqayeq@openai.com>
  Co-authored-by: Eric Traut <etraut@openai.com>
  Co-authored-by: pakrym-oai <pakrym@openai.com>
  Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>
  Co-authored-by: guinness-oai <guinness@openai.com>
  Co-authored-by: Eugene Brevdo <ebrevdo@users.noreply.github.com>
  Co-authored-by: Charlie Guo <cguo@openai.com>
  Co-authored-by: Fouad Matin <fouad@openai.com>
  Co-authored-by: Fouad Matin <169186268+fouad-openai@users.noreply.github.com>
  Co-authored-by: xl-openai <xl@openai.com>
  Co-authored-by: alexsong-oai <alexsong@openai.com>
  Co-authored-by: Owen Lin <owenlin0@gmail.com>
  Co-authored-by: sdcoffey <stevendcoffey@gmail.com>
  Co-authored-by: Codex <noreply@openai.com>
  Co-authored-by: Won Park <won@openai.com>
  Co-authored-by: Dylan Hurd <dylan.hurd@openai.com>
  Co-authored-by: celia-oai <celia@openai.com>
  Co-authored-by: gabec-openai <gabec@openai.com>
  Co-authored-by: joeytrasatti-openai <joey.trasatti@openai.com>
  Co-authored-by: Leo Shimonaka <leoshimo@openai.com>
  Co-authored-by: Rasmus Rygaard <rasmus@openai.com>
  Co-authored-by: maja-openai <163171781+maja-openai@users.noreply.github.com>
  Co-authored-by: pash-openai <pash@openai.com>
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Matthew Zeng · 2026-03-11 22:06:59 -07:00
  ba5b94287e
• feat(app-server): propagate traces across tasks and core ops (#14387)

  ## Summary
  
  This PR keeps app-server RPC request trace context alive for the full
  lifetime of the work that request kicks off (e.g. for `thread/start`,
  this is `app-server rpc handler -> tokio background task -> core op
  submissions`). Previously we lose trace lineage once the request handler
  returns or hands work off to background tasks.
  
  This approach is especially relevant for `thread/start` and other RPC
  handlers that run in a non-blocking way. In the near future we'll most
  likely want to make all app-server handlers run in a non-blocking way by
  default, and only queue operations that must operate in order (e.g.
  thread RPCs per thread?), so we want to make sure tracing in app-server
  just generally works.
  
  Depends on https://github.com/openai/codex/pull/14300
  
  **Before**
  <img width="155" height="207" alt="image"
  src="https://github.com/user-attachments/assets/c9487459-36f1-436c-beb7-fafeb40737af"
  />
  
  
  **After**
  <img width="299" height="337" alt="image"
  src="https://github.com/user-attachments/assets/727392b2-d072-4427-9dc4-0502d8652dea"
  />
  
  ## What changed
  
  - Keep request-scoped trace context around until we send the final
  response or error, or the connection closes.
  - Thread that trace context through detached `thread/start` work so
  background startup stays attached to the originating request.
  - Pass request trace context through to downstream core operations,
  including:
    - thread creation
    - resume/fork flows
    - turn submission
    - review
    - interrupt
    - realtime conversation operations
  - Add tracing tests that verify:
    - remote W3C trace context is preserved for `thread/start`
    - remote W3C trace context is preserved for `turn/start`
    - downstream core spans stay under the originating request span
    - request-scoped tracing state is cleaned up correctly
  - Clean up shutdown behavior so detached background tasks and spawned
  threads are drained before process exit.

  Owen Lin · 2026-03-11 20:18:31 -07:00
  5bc82c5b93
• feat: search_tool migrate to bring you own tool of Responses API (#14274)

  ## Why
  
  to support a new bring your own search tool in Responses
  API(https://developers.openai.com/api/docs/guides/tools-tool-search#client-executed-tool-search)
  we migrating our bm25 search tool to use official way to execute search
  on client and communicate additional tools to the model.
  
  ## What
  - replace the legacy `search_tool_bm25` flow with client-executed
  `tool_search`
  - add protocol, SSE, history, and normalization support for
  `tool_search_call` and `tool_search_output`
  - return namespaced Codex Apps search results and wire namespaced
  follow-up tool calls back into MCP dispatch

  Anton Panasenko · 2026-03-11 17:51:51 -07:00
  77b0c75267
• Stabilize websocket response.failed error delivery (#14017)

  ## What changed
  - Drop failed websocket connections immediately after a terminal stream
  error instead of awaiting a graceful close handshake before forwarding
  the error to the caller.
  - Keep the success path and the closed-connection guard behavior
  unchanged.
  
  ## Why this fixes the flake
  - The failing integration test waits for the second websocket stream to
  surface the model error before issuing a follow-up request.
  - On slower runners, the old error path awaited
  `ws_stream.close().await` before sending the error downstream. If that
  close handshake stalled, the test kept waiting for an error that had
  already happened server-side and nextest timed it out.
  - Dropping the failed websocket immediately makes the terminal error
  observable right away and marks the session closed so the next request
  reconnects cleanly instead of depending on a best-effort close
  handshake.
  
  ## Code or test?
  - This is a production logic fix in `codex-api`. The existing websocket
  integration test already exercises the regression path.

  Ahmed Ibrahim · 2026-03-11 12:33:09 -07:00
  c8446d7cf3
• feat: support disabling bundled system skills (#13792)

  Support disable bundled system skills with a config:
  
  [skills.bundled]
  enabled = false

  xl-openai · 2026-03-09 22:02:53 -07:00
  0c33af7746
• fix(ci) fix guardian ci (#13911)

  ## Summary
  #13910 was merged with some unused imports, let's fix this
  
  ## Testing
  - [x] Let's make sure CI is green
  
  ---------
  
  Co-authored-by: Charles Cunningham <ccunningham@openai.com>
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-03-07 23:34:56 +00:00
  92f7541624
• image-gen-core (#13290)

  Core tool-calling for image-gen, handles requesting and receiving logic
  for images using response API

  Won Park · 2026-03-03 23:11:28 -08:00
  fa2306b303
• core: box wrapper futures to reduce stack pressure (#13429)

  Follow-up to [#13388](https://github.com/openai/codex/pull/13388). This
  uses the same general fix pattern as
  [#12421](https://github.com/openai/codex/pull/12421), but in the
  `codex-core` compact/resume/fork path.
  
  ## Why
  
  `compact_resume_after_second_compaction_preserves_history` started
  overflowing the stack on Windows CI after `#13388`.
  
  The important part is that this was not a compaction-recursion bug. The
  test exercises a path with several thin `async fn` wrappers around much
  larger thread-spawn, resume, and fork futures. When one `async fn`
  awaits another inline, the outer future stores the callee future as part
  of its own state machine. In a long wrapper chain, that means a caller
  can accidentally inline a lot more state than the source code suggests.
  
  That is exactly what was happening here:
  
  - `ThreadManager` convenience methods such as `start_thread`,
  `resume_thread_from_rollout`, and `fork_thread` were inlining the larger
  spawn/resume futures beneath them.
  - `core_test_support::test_codex` added another wrapper layer on top of
  those same paths.
  - `compact_resume_fork` adds a few more helpers, and this particular
  test drives the resume/fork path multiple times.
  
  On Windows, that was enough to push both the libtest thread and Tokio
  worker threads over the edge. The previous 8 MiB test-thread workaround
  proved the failure was stack-related, but it did not address the
  underlying future size.
  
  ## How This Was Debugged
  
  The useful debugging pattern here was to turn the CI-only failure into a
  local low-stack repro.
  
  1. First, remove the explicit large-stack harness so the test runs on
  the normal `#[tokio::test]` path.
  2. Build the test binary normally.
  3. Re-run the already-built `tests/all` binary directly with
  progressively smaller `RUST_MIN_STACK` values.
  
  Running the built binary directly matters: it keeps the reduced stack
  size focused on the test process instead of also applying it to `cargo`
  and `rustc`.
  
  That made it possible to answer two questions quickly:
  
  - Does the failure still reproduce without the workaround? Yes.
  - Does boxing the wrapper futures actually buy back stack headroom? Also
  yes.
  
  After this change, the built test binary passes with
  `RUST_MIN_STACK=917504` and still overflows at `786432`, which is enough
  evidence to justify removing the explicit 8 MiB override while keeping a
  deterministic low-stack repro for future debugging.
  
  If we hit a similar issue again, the first places to inspect are thin
  `async fn` wrappers that mostly forward into a much larger async
  implementation.
  
  ## `Box::pin()` Primer
  
  `async fn` compiles into a state machine. If a wrapper does this:
  
  ```rust
  async fn wrapper() {
      inner().await;
  }
  ```
  
  then `wrapper()` stores the full `inner()` future inline as part of its
  own state.
  
  If the wrapper instead does this:
  
  ```rust
  async fn wrapper() {
      Box::pin(inner()).await;
  }
  ```
  
  then the child future lives on the heap, and the outer future only
  stores a pinned pointer to it. That usually trades one allocation for a
  substantially smaller outer future, which is exactly the tradeoff we
  want when the problem is stack pressure rather than raw CPU time.
  
  Useful references:
  
  -
  [`Box::pin`](https://doc.rust-lang.org/std/boxed/struct.Box.html#method.pin)
  - [Async book:
  Pinning](https://rust-lang.github.io/async-book/04_pinning/01_chapter.html)
  
  ## What Changed
  
  - Boxed the wrapper futures in `core/src/thread_manager.rs` around
  `start_thread`, `resume_thread_from_rollout`, `fork_thread`, and the
  corresponding `ThreadManagerState` spawn helpers so callers no longer
  inline the full spawn/resume state machine through multiple layers.
  - Boxed the matching test-only wrapper futures in
  `core/tests/common/test_codex.rs` and
  `core/tests/suite/compact_resume_fork.rs`, which sit directly on top of
  the same path.
  - Restored `compact_resume_after_second_compaction_preserves_history` in
  `core/tests/suite/compact_resume_fork.rs` to a normal `#[tokio::test]`
  and removed the explicit `TEST_STACK_SIZE_BYTES` thread/runtime sizing.
  - Simplified a tiny helper in `compact_resume_fork` by making
  `fetch_conversation_path()` synchronous, which removes one more
  unnecessary future layer from the test path.
  
  ## Verification
  
  - `cargo test -p codex-core --test all
  suite::compact_resume_fork::compact_resume_after_second_compaction_preserves_history
  -- --exact --nocapture`
  - `cargo test -p codex-core --test all suite::compact_resume_fork --
  --nocapture`
  - Re-ran the built `codex-core` `tests/all` binary directly with reduced
  stack sizes:
    - `RUST_MIN_STACK=917504` passes
    - `RUST_MIN_STACK=786432` still overflows
  - `cargo test -p codex-core`
  - Still fails locally in unrelated existing integration areas that
  expect the `codex` / `test_stdio_server` binaries or hit the existing
  `search_tool` wiremock mismatches.

  Michael Bolin · 2026-03-04 05:44:52 +00:00
  7134220f3c
• config: enforce enterprise feature requirements (#13388)

  ## Why
  
  Enterprises can already constrain approvals, sandboxing, and web search
  through `requirements.toml` and MDM, but feature flags were still only
  configurable as managed defaults. That meant an enterprise could suggest
  feature values, but it could not actually pin them.
  
  This change closes that gap and makes enterprise feature requirements
  behave like the other constrained settings. The effective feature set
  now stays consistent with enterprise requirements during config load,
  when config writes are validated, and when runtime code mutates feature
  flags later in the session.
  
  It also tightens the runtime API for managed features. `ManagedFeatures`
  now follows the same constraint-oriented shape as `Constrained<T>`
  instead of exposing panic-prone mutation helpers, and production code
  can no longer construct it through an unconstrained `From<Features>`
  path.
  
  The PR also hardens the `compact_resume_fork` integration coverage on
  Windows. After the feature-management changes,
  `compact_resume_after_second_compaction_preserves_history` was
  overflowing the libtest/Tokio thread stacks on Windows, so the test now
  uses an explicit larger-stack harness as a pragmatic mitigation. That
  may not be the ideal root-cause fix, and it merits a parallel
  investigation into whether part of the async future chain should be
  boxed to reduce stack pressure instead.
  
  ## What Changed
  
  Enterprises can now pin feature values in `requirements.toml` with the
  requirements-side `features` table:
  
  ```toml
  [features]
  personality = true
  unified_exec = false
  ```
  
  Only canonical feature keys are allowed in the requirements `features`
  table; omitted keys remain unconstrained.
  
  - Added a requirements-side pinned feature map to
  `ConfigRequirementsToml`, threaded it through source-preserving
  requirements merge and normalization in `codex-config`, and made the
  TOML surface use `[features]` (while still accepting legacy
  `[feature_requirements]` for compatibility).
  - Exposed `featureRequirements` from `configRequirements/read`,
  regenerated the JSON/TypeScript schema artifacts, and updated the
  app-server README.
  - Wrapped the effective feature set in `ManagedFeatures`, backed by
  `ConstrainedWithSource<Features>`, and changed its API to mirror
  `Constrained<T>`: `can_set(...)`, `set(...) -> ConstraintResult<()>`,
  and result-returning `enable` / `disable` / `set_enabled` helpers.
  - Removed the legacy-usage and bulk-map passthroughs from
  `ManagedFeatures`; callers that need those behaviors now mutate a plain
  `Features` value and reapply it through `set(...)`, so the constrained
  wrapper remains the enforcement boundary.
  - Removed the production loophole for constructing unconstrained
  `ManagedFeatures`. Non-test code now creates it through the configured
  feature-loading path, and `impl From<Features> for ManagedFeatures` is
  restricted to `#[cfg(test)]`.
  - Rejected legacy feature aliases in enterprise feature requirements,
  and return a load error when a pinned combination cannot survive
  dependency normalization.
  - Validated config writes against enterprise feature requirements before
  persisting changes, including explicit conflicting writes and
  profile-specific feature states that normalize into invalid
  combinations.
  - Updated runtime and TUI feature-toggle paths to use the constrained
  setter API and to persist or apply the effective post-constraint value
  rather than the requested value.
  - Updated the `core_test_support` Bazel target to include the bundled
  core model-catalog fixtures in its runtime data, so helper code that
  resolves `core/models.json` through runfiles works in remote Bazel test
  environments.
  - Renamed the core config test coverage to emphasize that effective
  feature values are normalized at runtime, while conflicting persisted
  config writes are rejected.
  - Ran `compact_resume_after_second_compaction_preserves_history` inside
  an explicit 8 MiB test thread and Tokio runtime worker stack, following
  the existing larger-stack integration-test pattern, to keep the Windows
  `compact_resume_fork` test slice from aborting while a parallel
  investigation continues into whether some of the underlying async
  futures should be boxed.
  
  ## Verification
  
  - `cargo test -p codex-config`
  - `cargo test -p codex-core feature_requirements_ -- --nocapture`
  - `cargo test -p codex-core
  load_requirements_toml_produces_expected_constraints -- --nocapture`
  - `cargo test -p codex-core
  compact_resume_after_second_compaction_preserves_history -- --nocapture`
  - `cargo test -p codex-core compact_resume_fork -- --nocapture`
  - Re-ran the built `codex-core` `tests/all` binary with
  `RUST_MIN_STACK=262144` for
  `compact_resume_after_second_compaction_preserves_history` to confirm
  the explicit-stack harness fixes the deterministic low-stack repro.
  - `cargo test -p codex-core`
  - This still fails locally in unrelated integration areas that expect
  the `codex` / `test_stdio_server` binaries or hit existing `search_tool`
  wiremock mismatches.
  
  ## Docs
  
  `developers.openai.com/codex` should document the requirements-side
  `[features]` table for enterprise and MDM-managed configuration,
  including that it only accepts canonical feature keys and that
  conflicting config writes are rejected.

  Michael Bolin · 2026-03-04 04:40:22 +00:00
  bfff0c729f
• feat: load plugin apps (#13401)

  load plugin-apps from `.app.json`.
  
  make apps runtime-mentionable iff `codex_apps` MCP actually exposes
  tools for that `connector_id`.
  
  if the app isn't available, it's filtered out of runtime connector set,
  so no tools are added and no app-mentions resolve.
  
  right now we don't have a clean cli-side error for an app not being
  installed. can look at this after.
  
  ### Tests
  Added tests, tested locally that using a plugin that bundles an app
  picks up the app.

  sayan-oai · 2026-03-03 16:29:15 -08:00
  082682a628
• Remove Responses V1 websocket implementation (#13364)

  V2 is the way to go!

  pakrym-oai · 2026-03-03 11:32:53 -07:00
  69df12efb3
• add fast mode toggle (#13212)

  - add a local Fast mode setting in codex-core (similar to how model id
  is currently stored on disk locally)
  - send `service_tier=priority` on requests when Fast is enabled
  - add `/fast` in the TUI and persist it locally
  - feature flag

  pash-openai · 2026-03-02 20:29:33 -08:00
  2f5b01abd6
• Update realtime websocket API (#13265)

  - migrate the realtime websocket transport to the new session and
  handoff flow
  - make the realtime model configurable in config.toml and use API-key
  auth for the websocket
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-02 16:05:40 -08:00
  b20b6aa46f
• Record realtime close marker on replacement (#13058)

  ## Summary
  - record a realtime close developer message when a new realtime session
  replaces an active one
  - assert the replacement marker through the mocked responses request
  path
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>
  Co-authored-by: Charles Cunningham <ccunningham@openai.com>

  Ahmed Ibrahim · 2026-03-01 13:54:12 -08:00
  0aeb55bf08
• core: adopt host_executable() rules in zsh-fork (#13046)

  ## Why
  
  [#12964](https://github.com/openai/codex/pull/12964) added
  `host_executable()` support to `codex-execpolicy`, but the zsh-fork
  interception path in `unix_escalation.rs` was still evaluating commands
  with the default exact-token matcher.
  
  That meant an intercepted absolute executable such as `/usr/bin/git
  status` could still miss basename rules like `prefix_rule(pattern =
  ["git", "status"])`, even when the policy also defined a matching
  `host_executable(name = "git", ...)` entry.
  
  This PR adopts the new matching behavior in the zsh-fork runtime only.
  That keeps the rollout intentionally narrow: zsh-fork already requires
  explicit user opt-in, so it is a safer first caller to exercise the new
  `host_executable()` scheme before expanding it to other execpolicy call
  sites.
  
  It also brings zsh-fork back in line with the current `prefix_rule()`
  execution model. Until prefix rules can carry their own permission
  profiles, a matched `prefix_rule()` is expected to rerun the intercepted
  command unsandboxed on `allow`, or after the user accepts `prompt`,
  instead of merely continuing inside the inherited shell sandbox.
  
  ## What Changed
  
  - added `evaluate_intercepted_exec_policy()` in
  `core/src/tools/runtimes/shell/unix_escalation.rs` to centralize
  execpolicy evaluation for intercepted commands
  - switched intercepted direct execs in the zsh-fork path to
  `check_multiple_with_options(...)` with `MatchOptions {
  resolve_host_executables: true }`
  - added `commands_for_intercepted_exec_policy()` so zsh-fork policy
  evaluation works from intercepted `(program, argv)` data instead of
  reconstructing a synthetic command before matching
  - left shell-wrapper parsing intentionally disabled by default behind
  `ENABLE_INTERCEPTED_EXEC_POLICY_SHELL_WRAPPER_PARSING`, so
  path-sensitive matching relies on later direct exec interception rather
  than shell-script parsing
  - made matched `prefix_rule()` decisions rerun intercepted commands with
  `EscalationExecution::Unsandboxed`, while unmatched-command fallback
  keeps the existing sandbox-preserving behavior
  - extracted the zsh-fork test harness into
  `core/tests/common/zsh_fork.rs` so both the skill-focused and
  approval-focused integration suites can exercise the same runtime setup
  - limited this change to the intercepted zsh-fork path rather than
  changing every execpolicy caller at once
  - added runtime coverage in
  `core/src/tools/runtimes/shell/unix_escalation_tests.rs` for allowed and
  disallowed `host_executable()` mappings and the wrapper-parsing modes
  - added integration coverage in `core/tests/suite/approvals.rs` to
  verify a saved `prefix_rule(pattern=["touch"], decision="allow")` reruns
  under zsh-fork outside a restrictive `WorkspaceWrite` sandbox
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13046).
  * #13065
  * __->__ #13046

  Michael Bolin · 2026-02-28 01:41:23 +00:00
  1a8d930267
• Support multimodal custom tool outputs (#12948)

  ## Summary
  
  This changes `custom_tool_call_output` to use the same output payload
  shape as `function_call_output`, so freeform tools can return either
  plain text or structured content items.
  
  The main goal is to let `js_repl` return image content from nested
  `view_image` calls in its own `custom_tool_call_output`, instead of
  relying on a separate injected message.
  
  ## What changed
  
  - Changed `custom_tool_call_output.output` from `string` to
  `FunctionCallOutputPayload`
  - Updated freeform tool plumbing to preserve structured output bodies
  - Updated `js_repl` to aggregate nested tool content items and attach
  them to the outer `js_repl` result
  - Removed the old `js_repl` special case that injected `view_image`
  results as a separate pending user image message
  - Updated normalization/history/truncation paths to handle multimodal
  `custom_tool_call_output`
  - Regenerated app-server protocol schema artifacts
  
  ## Behavior
  
  Direct `view_image` calls still return a `function_call_output` with
  image content.
  
  When `view_image` is called inside `js_repl`, the outer `js_repl`
  `custom_tool_call_output` now carries:
  - an `input_text` item if the JS produced text output
  - one or more `input_image` items from nested tool results
  
  So the nested image result now stays inside the `js_repl` tool output
  instead of being injected as a separate message.
  
  ## Compatibility
  
  This is intended to be backward-compatible for resumed conversations.
  
  Older histories that stored `custom_tool_call_output.output` as a plain
  string still deserialize correctly, and older histories that used the
  previous injected-image-message flow also continue to resume.
  
  Added regression coverage for resuming a pre-change rollout containing:
  - string-valued `custom_tool_call_output`
  - legacy injected image message history
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/12948

  Curtis 'Fjord' Hawthorne · 2026-02-26 18:17:46 -08:00
  7e980d7db6