419 Commits

• Prepare managed network sandbox context (#29456)

  ## Why
  
  Managed network configures commands to use local HTTP and SOCKS proxies.
  For commands delegated to the exec server, the proxy environment and the
  sandbox policy were prepared separately. On macOS, that meant a command
  could receive `HTTPS_PROXY=http://127.0.0.1:43123` while Seatbelt still
  denied access to port `43123`.
  
  ## What changed
  
  `NetworkProxy` now prepares the command environment and sandbox context
  together from the same runtime snapshot:
  
  ```text
  Prepared managed network
  ├── command environment: HTTPS_PROXY=http://127.0.0.1:43123
  └── sandbox context: allow outbound to 127.0.0.1:43123
  ```
  
  That context travels with remote exec requests. The exec server
  preserves the managed proxy and CA environment, and macOS Seatbelt
  allows only the prepared loopback proxy ports without enabling broad
  network access or local binding.
  
  The protocol field is optional and the existing enforcement flag remains
  in place, preserving compatibility with callers that do not send the new
  context.

  jif · 2026-06-23 20:07:09 +01:00
  e476fc16ce
• Allow codex sandbox to consume MCP sandbox state (#29358)

  ## Summary
  
  - let `codex sandbox` accept the JSON value from
  `codex/sandbox-state-meta`
  - require the payload `permissionProfile` instead of falling back to
  ambient permissions
  - reuse the existing macOS, Linux, and Windows launch paths, treating
  external sandbox state conservatively as read-only
  - let opaque forwarders add runtime read roots and disable direct
  network access without decoding the payload
  
  Builds on #29113, which is now on `main`.
  
  ## Tests
  
  - `just test -p codex-cli debug_sandbox::tests`
  - `cargo build -p codex-rmcp-client --bin test_stdio_server`
  - `just test -p codex-core
  stdio_mcp_tool_call_includes_sandbox_state_meta`
  - `just test -p codex-mcp`
  - `just fmt`

  jif · 2026-06-23 10:17:52 +02:00
  d2484697b1
• mcp: accept foreign absolute cwd for remote stdio (#29493)

  ## Why
  
  Remote stdio MCP servers can run in an environment whose path convention
  differs from the Codex host. A Windows cwd such as
  `C:\Users\openai\share` is absolute for the executor but was rejected by
  a POSIX orchestrator.
  
  Built on #29501, now merged, which only clarifies the host-native
  `PathUri` constructor name.
  
  ## What changed
  
  - Deserialize MCP cwd values as `LegacyAppPathString` so config does not
  apply host path rules.
  - Interpret that spelling as host-native for local launches and convert
  it to `PathUri` at executor launch.
  - Skip host filesystem and command resolution checks for remote stdio in
  `codex doctor`.
  - Add host-independent config and executor-boundary coverage using the
  foreign path convention for each test platform.
  
  ## Validation
  
  - `just test -p codex-utils-path-uri -p codex-config -p codex-mcp -p
  codex-rmcp-client` (408 passed)
  - `just test -p codex-cli -p codex-rmcp-client` (372 passed)
  - `cargo check --workspace --tests`
  - `just test` (11,311 passed; 43 unrelated environment/timing failures)
  - `just fix -p codex-cli -p codex-config -p codex-core -p codex-mcp -p
  codex-mcp-extension -p codex-rmcp-client -p codex-tui`

  Adam Perry @ OpenAI · 2026-06-23 01:33:51 +00:00
  67009bc53f
• PAC 2 - Add shared auth system proxy contract (#26707)

  ## Summary
  
  Stacked on #26706.
  
  Adds the shared auth/system-proxy contract that later platform resolver
  PRs plug into. This PR moves Codex-owned auth and startup HTTP clients
  through a common route-aware boundary, but does not yet add Windows or
  macOS system proxy resolution.
  
  The default path remains unchanged when `respect_system_proxy` is absent
  or disabled.
  
  ## Implementation
  
  - Adds `codex-client/src/outbound_proxy.rs` with the shared
  route-selection model:
    - `OutboundProxyConfig`;
    - `ClientRouteClass`;
    - `RouteFailureClass`;
    - `build_reqwest_client_for_route`.
  - Preserves the existing reqwest/default-client behavior when no route
  config is supplied.
  - Uses the fixed MVP routing policy when route config is supplied:
  platform system/PAC/WPAD discovery, then explicit env proxy variables,
  then direct connection.
  - Keeps platform-specific system discovery behind the shared client
  boundary. This PR provides the contract and fallback behavior; later
  resolver PRs plug in Windows and macOS discovery.
  - Adds `login::AuthRouteConfig` so auth call sites depend on a small
  policy type instead of platform resolver details.
  - Maps the resolved `Config.respect_system_proxy` boolean into
  `AuthRouteConfig` for auth-owned clients.
  - Wires the route config through browser login, device-code login,
  access-token login, login status, logout/revoke, token refresh, API-key
  exchange, app-server account login, TUI/app startup, cloud-config
  bootstrap, cloud tasks, plugin auth, and exec startup config loading.
  
  ## End-user behavior
  
  - No behavior changes by default.
  - When `respect_system_proxy = true`, auth-owned clients opt into the
  shared route-aware client path.
  - On platforms without a resolver implementation in this PR, system
  discovery is unavailable and the route-aware path falls back to explicit
  env proxy handling, then direct connection.
  - Custom CA handling remains separate from proxy route selection and
  still runs through the shared client builder.
  - No proxy URLs, PAC contents, or resolved platform details are exposed
  through the public config surface introduced here.
  
  ## Tests
  
  Adds or updates coverage for:
  
  - preserving default auth-client fallback behavior when no route config
  is provided;
  - injected environment-proxy fallback without mutating process
  environment;
  - existing login-server E2E flows using explicit `auth_route_config:
  None` to guard unchanged default behavior;
  - updated auth manager, login, logout, cloud-config, startup, and
  plugin-auth call sites passing route config explicitly.

  canvrno-oai · 2026-06-22 13:03:11 -07:00
  1659c4a629
• Persist session IDs across thread resume (#29327)

  ## Summary
  
  A cold-resumed subagent kept its durable thread ID but could receive a
  new session ID, splitting one agent tree across multiple sessions after
  a restart.
  
  Persist the root session ID in every rollout `SessionMeta`, carry it
  through thread creation, and restore it before initializing the resumed
  `Session` and `AgentControl`.
  
  ## Behavior
  
  For a nested agent tree:
  
  ```text
  root session R
    parent thread P
      child thread C
  ```
  
  The child rollout stores:
  
  ```text
  session_id:       R
  parent_thread_id: P
  id:               C
  ```
  
  After a cold resume, the child still belongs to root session `R` while
  its immediate parent remains `P`. The integration coverage uses distinct
  values for all three IDs so it catches restoring the session from
  `parent_thread_id`.
  
  ## Legacy rollouts
  
  Previous rollouts have `id` but no `session_id`. `SessionMetaLine`
  deserialization treats a missing `session_id` as `id`, keeping those
  files readable, listable, and resumable. When a legacy subagent is
  resumed through its root, that synthesized child ID no longer overrides
  the inherited root-scoped `AgentControl`. New rollouts always persist
  the explicit root session ID.

  jif · 2026-06-22 09:36:08 +02:00
  6d15bb3d17
• Scope network approvals by environment (#28899)

  Stacked on #28766.
  
  ## Why
  
  Network approvals are environment-scoped: allowing a host in one
  execution environment should not allow the same host in another
  environment.
  
  #28766 adds the inert IDs and constructor plumbing. This PR applies the
  behavior on top.
  
  ## What changed
  
  - Route managed network traffic through per-environment HTTP and SOCKS
  proxy listeners.
  - Stamp HTTP, HTTPS CONNECT, SOCKS TCP, and SOCKS UDP policy requests
  with the source environment at the proxy boundary.
  - Carry the selected execution environment through shell, unified exec,
  zsh-fork, and sandbox transform paths.
  - Include the environment in pending, approved-for-session, and
  denied-for-session network approval cache keys.
  - Include the environment in approval IDs and approval prompts.
  - Preserve legacy fallback for unattributed requests, but deny when
  active-call attribution is ambiguous.
  - Fail closed if an environment-specific proxy endpoint cannot be
  prepared.
  
  ## Validation
  
  - just fmt
  - CI will run tests and clippy

  jif · 2026-06-19 13:49:45 +02:00
  bd5d31b250
• feat: opt ChatGPT auth into agent identity (#19049)

  ## Stack
  
  This is PR 2 of the simplified HAI single-run-task stack:
  
  - [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
  assertion and task-registration primitives, including the shared
  run-task helper used by existing Agent Identity JWT auth.
  - [#19049](https://github.com/openai/codex/pull/19049)
  Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
  Agent Identity runtime auth and its single run task.
  - [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
  provider auth that uses one backend-owned task id for first-party
  inference and compaction requests.
  
  [#19054](https://github.com/openai/codex/pull/19054) collapsed out of
  the active stack because the simplified design no longer needs a
  separate background/control-plane task helper.
  
  ## Summary
  
  This PR adds the disabled-by-default path for normal ChatGPT-login Codex
  sessions to obtain Agent Identity runtime auth through the Codex
  backend. Existing Agent Identity JWT startup mode remains a separate
  path and does not require the feature flag.
  
  What changed:
  
  - adds the experimental `use_agent_identity` feature flag and config
  schema entry
  - adds an explicit `AgentIdentityAuthPolicy` so call sites choose
  `JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
  - stores standalone Agent Identity JWT credentials separately from
  backend-registered Agent Identity records
  - persists the registered Agent Identity record, private key, and single
  run task id in `auth.json` so process restarts reuse the same identity
  - derives the agent/task registration base URL from ChatGPT/Codex auth
  config while keeping JWT JWKS lookup separate
  - provisions and caches ChatGPT-derived Agent Identity runtime auth when
  `use_agent_identity` is enabled
  - reuses the shared run-task registration helper from PR1 rather than
  adding a second task-registration path
  
  This PR intentionally does not switch model inference over to
  `AgentAssertion` auth. The provider-auth integration lands in the next
  PR.
  
  ## Testing
  
  - `just test -p codex-login`

  Adrian · 2026-06-18 14:05:27 -07:00
  ec848dde0e
• [codex] Initialize exec-server OpenTelemetry at startup (#25019)

  ## Summary
  
  - Initialize stderr tracing and the configured OpenTelemetry provider
  for local and remote `codex exec-server` startup.
  - Instrument the local and remote server entrypoints with a root runtime
  span.
  - Keep raw Noise environment, registration, and stream identifiers out
  of exported spans while preserving them in local debug events.
  - Keep telemetry setup in a focused CLI module instead of growing the
  top-level command entrypoint.
  
  ## Stack
  
  - Previous: none (`#27058` has merged)
  - Next: #27466
  
  ## Validation
  
  - `just test -p codex-exec-server --lib` (139 passed)
  - `just test -p codex-cli --test exec_server` (3 passed)
  - `just bazel-lock-check`
  - `just fix -p codex-exec-server -p codex-cli`
  - `just fmt`
  
  ---------
  
  Co-authored-by: Richard Lee <richardlee@openai.com>

  starr-openai · 2026-06-18 11:03:42 -07:00
  4c7228e423
• feat: add run task identity primitives (#19047)

  ## Stack
  
  This is PR 1 of the simplified HAI single-run-task stack:
  
  - [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
  assertion and task-registration primitives, including the shared
  run-task helper used by existing Agent Identity JWT auth.
  - [#19049](https://github.com/openai/codex/pull/19049)
  Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
  Agent Identity runtime auth and its single run task.
  - [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
  provider auth that uses one backend-owned task id for first-party
  inference and compaction requests.
  
  [#19054](https://github.com/openai/codex/pull/19054) collapsed out of
  the active stack because the simplified design no longer needs a
  separate background/control-plane task helper.
  
  ## Summary
  
  The simplified POC shape is one backend-owned task per Agent Identity
  run. This PR makes the first layer match that final shape directly
  instead of introducing task targets, caller-owned external task refs, or
  intermediate wrappers that later PRs would need to undo.
  
  What changed:
  
  - keeps the `AgentAssertion` wire payload as `agent_runtime_id`,
  `task_id`, `timestamp`, and `signature`
  - exposes `register_agent_task` as the single task-registration helper
  for both existing Agent Identity JWT auth and the ChatGPT-registration
  path added later in the stack
  - makes task registration send only the signed registration timestamp;
  the backend owns the returned opaque task id
  - removes the unused target/task-kind/external-task-ref surfaces from
  `codex-agent-identity`
  - keeps Agent Identity JWT JWKS lookup separate from agent/task
  registration URL derivation
  - updates Agent Identity JWT auth to register one run task during auth
  construction and share that task across cloned auth handles
  
  This PR intentionally does not enable ChatGPT-derived Agent Identity.
  That opt-in and config gate are added in the next PR.
  
  ## Testing
  
  - `just test -p codex-agent-identity`

  Adrian · 2026-06-17 11:23:39 -07:00
  d9e0551564
• [codex] Load API curated marketplace by auth (#28383)

  ## Summary
  - choose the local OpenAI curated marketplace manifest based on auth:
  Codex backend auth gets the existing marketplace, direct provider auth
  gets `api_marketplace.json`
  - include Bedrock API key auth in the direct-provider API marketplace
  path
  - safely skip the API marketplace when `api_marketplace.json` is absent
  
  ## Validation
  - `just fmt`
  - `git diff --check origin/main...HEAD`
  - CI should run the full validation
  
  ## Manual Testing
  
  ### - New api marketplace not available for API key sign
  1. Safely not display anything from api marketplace
  <img width="1161" height="289" alt="Screenshot 2026-06-15 at 21 37 43"
  src="https://github.com/user-attachments/assets/a5f16642-8a20-4ac1-a0de-1274a4c7b5b2"
  />
  
  ### - New api marketplace for API key sign in
  1. Setup api_marketplace.json
  ```
  {
    "name": "openai-curated",
    "interface": {
      "displayName": "Codex official"
    },
    "plugins": [
      {
        "name": "linear",
        "source": {
          "source": "local",
          "path": "./plugins/linear"
        },
        "policy": {
          "installation": "AVAILABLE",
          "authentication": "ON_INSTALL"
        },
        "category": "Productivity"
      }
    ]
  }
  ```
  
  2. Log in with API key, observe that only the defined plugin from
  api_marketplace.json is available from "Codex Official" (outside of
  local testing marketplaces)
  <img width="1167" height="446" alt="Screenshot 2026-06-15 at 21 16 53"
  src="https://github.com/user-attachments/assets/7cf61477-d826-4ef6-bc05-0a23ac1c0259"
  />
  
  also checked functionality on codex app
  
  ### - SiWC users 
  Still uses 'default' marketplace.json and renders all plugins
  <img width="1171" height="502" alt="Screenshot 2026-06-15 at 21 40 25"
  src="https://github.com/user-attachments/assets/d212ea9b-0aa5-470b-8ea4-450efe65bb2b"
  />
  
  also checked functionality on codex app
  
  
  ## Notes
  - `just test -p codex-core-plugins` was started locally before splitting
  branches, but I stopped relying on local tests per follow-up and left
  final validation to PR CI.

  felixxia-oai · 2026-06-16 01:16:11 +00:00
  02dce8eb8d
• exec-server: default remote transport to Noise (#26245)

  ## Why
  
  The transport in
  [openai/codex#26242](https://github.com/openai/codex/pull/26242) needs
  to be used by every remote orchestrator-to-executor connection before
  JSON-RPC traffic starts.
  
  ## Changes
  
  - Generates one executor Noise identity when remote exec-server starts
  and registers its public key.
  - Creates a harness identity for each physical remote environment
  connection.
  - Fetches a fresh registry bundle before connecting and validates the
  authenticated harness key before completing the executor handshake.
  - Multiplexes encrypted logical streams over the existing executor
  WebSocket.
  - Adds bounded stream, handshake-failure, and reassembly state.
  - Adds safe lifecycle diagnostics without logging keys, authorizations,
  plaintext, or ciphertext.
  - Covers reconnects, replay rejection, validation failure, framing
  limits, and encrypted JSON-RPC tool traffic.
  
  ## Stack
  
  1. [openai/codex#26242](https://github.com/openai/codex/pull/26242):
  Noise channel and relay transport
  2. **[openai/codex#26245](https://github.com/openai/codex/pull/26245)**:
  remote registration and runtime activation
  
  ## Verification
  
  - `just test -p codex-exec-server`
  - `just fix -p codex-exec-server`
  - `just bazel-lock-check`
  - `cargo shear`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-06-15 17:39:00 -07:00
  6e50b22e55
• Add hidden Windows sandbox wrapper entrypoint (#28358)

  ## Why
  
  This is the second PR in the Windows fs-helper sandbox stack. The
  fs-helper path needs a Windows sandbox launcher that has the same
  argv-shaped contract as macOS `sandbox-exec` and `codex-linux-sandbox`,
  but this PR only introduces that hidden launcher. It does not route
  fs-helper through it yet.
  
  The hidden launcher still needs to be policy-complete before later
  direct-spawn callers use it. In particular, it has to carry the same
  Windows sandbox policy details that the existing spawn paths already
  understand: proxy enforcement, read/write root overrides, and
  deny-read/deny-write overrides.
  
  ## What Changed
  
  - Added the hidden `codex.exe --run-as-windows-sandbox` arg1 dispatch
  path.
  - Added `windows-sandbox-rs/src/wrapper.rs`, which parses the wrapper
  argv, launches the requested command through the shared Windows sandbox
  session runner from PR1, and forwards stdio.
  - Added `create_windows_sandbox_command_args_for_permission_profile()`
  so later direct-spawn callers can build the wrapper argv consistently.
  - Made the wrapper argv round-trip the full Windows sandbox policy
  surface it needs later: workspace roots, environment, permission
  profile, sandbox level, private desktop, proxy enforcement, read/write
  root overrides, and deny-read/deny-write overrides.
  - Carried `proxy_enforced` through the shared Windows session request so
  proxy-managed executions continue to use the offline/elevated sandbox
  identity.
  - Added wrapper argument round-trip coverage for the full policy fields.
  
  ## Verification
  
  - `just test -p codex-windows-sandbox windows_wrapper_args_round_trip`
  - `just test -p codex-arg0`
  - `just test -p codex-core exec::tests::windows_`
  - `just fix -p codex-windows-sandbox -p codex-core -p codex-cli`
  
  Local note: the full `just fmt` command still fails on this workstation
  in non-Rust formatter setup (`uv` cache access denied and missing
  `dotslash`/buildifier), but the Rust formatter phase completed.

  iceweasel-oai · 2026-06-15 21:30:32 +00:00
  fbbe7706d6
• Extract shared Windows sandbox session runner (#28357)

  ## Why
  
  This is the first PR in a stack for the Windows fs-helper sandbox fix.
  Before changing fs-helper behavior, this pulls the reusable Windows
  sandbox session launch pieces out of the debug CLI path so later PRs can
  call the same backend selection and stdio forwarding logic.
  
  Keeping this as a pure refactor makes the later security fix easier to
  review: `codex sandbox windows` should continue to launch the same
  elevated or restricted-token backend, just through shared APIs in
  `windows-sandbox-rs` instead of code local to
  `cli/src/debug_sandbox.rs`.
  
  ## What Changed
  
  - Added `WindowsSandboxSessionRequest` and
  `spawn_windows_sandbox_session_for_level()` in `windows-sandbox-rs` to
  share the elevated-vs-legacy session launch decision.
  - Moved the Windows sandbox stdio forwarding helpers from
  `cli/src/debug_sandbox.rs` into
  `windows-sandbox-rs/src/stdio_bridge.rs`.
  - Updated `codex sandbox windows` to call the shared session launcher
  and stdio bridge.
  - Added unit coverage for the moved stdio forwarding helpers.
  
  ## Verification
  
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - `just test -p codex-windows-sandbox stdio_bridge::tests`
  - `just fix -p codex-windows-sandbox -p codex-sandboxing -p
  codex-exec-server -p codex-arg0 -p codex-core -p codex-file-system`
  - The new `stdio_bridge` tests also passed as part of `just test -p
  codex-windows-sandbox` on the stack tip. That full local run still fails
  in pre-existing legacy session integration tests with
  `CreateRestrictedToken failed: 87` on this workstation.

  iceweasel-oai · 2026-06-15 18:30:48 +00:00
  c3415f76c9
• feat: use encrypted local secrets for MCP OAuth (#27541)

  ## Summary
  
  - store MCP OAuth credentials in the configured auth credential backend
  - support encrypted-local OAuth storage, including legacy keyring
  migration
  - propagate the credential backend through MCP refresh, session, CLI,
  and app-server paths
  
  ## Stack
  
  1. #27504 — config and feature flag
  2. #27535 — auth-specific secret namespaces
  3. #27539 — encrypted CLI auth storage
  4. this PR — encrypted MCP OAuth storage
  
  This is a parallel review stack; the original #17931 remains unchanged.
  
  ## Tests
  
  - `just test -p codex-rmcp-client` (the transport round-trip test passed
  after building the required `codex` binary and retrying)
  - `just test -p codex-mcp`
  - `just test -p codex-app-server
  refresh_config_uses_latest_auth_keyring_backend`
  - `just test -p codex-core
  refresh_mcp_servers_is_deferred_until_next_turn`
  - `just test -p codex-cli mcp`
  - `just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli
  -p codex-app-server -p codex-protocol`
  - `just bazel-lock-check`

  Celia Chen · 2026-06-12 22:03:51 +00:00
  9915d34684
• feat: use encrypted local secrets for CLI auth (#27539)

  ## Why
  
  Windows Credential Manager limits generic credential blobs to 2,560
  bytes. Large serialized ChatGPT auth payloads can exceed that limit, so
  keyring-mode CLI auth needs a backend that keeps only the encryption key
  in the OS keyring and stores the payload in Codex's encrypted
  local-secrets file.
  
  This is the third PR in the encrypted-auth stack:
  
  1. #27504 — feature and config selection
  2. #27535 — auth-specific local-secrets namespaces
  3. This PR — CLI auth implementation and activation
  4. MCP OAuth implementation and activation
  
  ## What Changed
  
  - Added encrypted CLI-auth storage using the `CliAuth` secrets
  namespace.
  - Preserved direct keyring storage for platforms/configurations where it
  remains selected.
  - Selected the backend consistently for login, logout, refresh,
  device-code login, auth loading, and login restrictions.
  - Threaded resolved bootstrap/full config through CLI, exec, TUI,
  app-server account handling, cloud config, and cloud tasks.
  - Removed stale `auth.json` fallback data after successful encrypted
  saves and removed encrypted, direct-keyring, and fallback data during
  logout.
  - Added storage and integration coverage for both direct and encrypted
  keyring modes.
  
  MCP OAuth persistence is intentionally left to the next PR.
  
  ## Validation
  
  - `just test -p codex-login` — 131 passed
  - `just test -p codex-cli` — 280 passed
  - `just test -p codex-app-server v2::account` — 25 passed
  - `just test -p codex-cloud-config service` — 21 passed, 7 skipped
  - `just fix -p codex-login`
  - `just fix -p codex-cli`
  - `just fmt`

  Celia Chen · 2026-06-12 21:23:50 +00:00
  56c97e3b5c
• [login] revoke existing auth before starting login (#27674)

  ## Why
  
  `codex login` previously persisted newly issued OAuth credentials and
  only then attempted to revoke the superseded refresh token. The old
  credential must be revoked before a replacement browser or device-code
  flow starts, and successful login must not perform any post-login
  revocation attempt.
  
  ## What changed
  
  - Revoke and clear existing stored auth before browser or device-code
  CLI login begins.
  - Remove superseded-token detection and revocation from the shared token
  persistence path; successful login now only saves the new credentials.
  - Read the raw configured auth store during CLI cleanup so
  environment-provided auth cannot mask the stored refresh token.
  - Preserve `auto` storage fallback semantics when keyring deletion fails
  by clearing the fallback auth file.
  - Add a process-level CLI regression test that requires the revoke
  request to precede every device-login request and occur exactly once.
  
  If replacement login is canceled or fails, the previous local
  credentials have already been cleared. Remote revocation remains best
  effort, matching explicit logout behavior.
  
  ## Validation
  
  ### Process-level before/after reproduction
  
  I compiled the real `codex` CLI from the pre-fix parent (`14df0e8833`)
  and from the PR implementation (`25c002f23b`; the login behavior is
  unchanged at the current head), then ran the same device-code flow
  against a local HTTP mock OAuth authority.
  
  Each run:
  
  1. Used a fresh temporary `CODEX_HOME` configured with
  `cli_auth_credentials_store = "file"`.
  2. Seeded that temporary home with managed ChatGPT auth containing
  `old-access` and `old-refresh` tokens.
  3. Pointed `CODEX_REVOKE_TOKEN_URL_OVERRIDE` at the mock `/oauth/revoke`
  endpoint.
  4. Ran the compiled CLI as:
  
     ```shell
     CODEX_HOME=<temporary-home> \
       CODEX_REVOKE_TOKEN_URL_OVERRIDE=<mock-issuer>/oauth/revoke \
  <compiled-codex> login --device-auth --experimental_issuer <mock-issuer>
     ```
  
  5. Recorded every request received by the mock authority. The mock
  marked `new-access` valid when `/oauth/token` issued it and invalidated
  it if `/oauth/revoke` arrived afterward, reproducing the observed
  session-invalidating failure mode. After login exited, the harness also
  verified the persisted refresh token and probed a protected endpoint
  with `new-access`.
  
  | Build | Observed request order | CLI/persistence result | `new-access`
  probe |
  | --- | --- | --- | --- |
  | Pre-fix | `usercode → device token → OAuth token →
  revoke(old-refresh)` | Exit `0`; `new-refresh` persisted | `401` |
  | PR | `revoke(old-refresh) → usercode → device token → OAuth token` |
  Exit `0`; `new-refresh` persisted | `200` |
  
  The PR run therefore issued exactly one revocation request, before any
  request that initiated the replacement login, and issued no revocation
  after token exchange.
  
  ### Regression coverage
  
  
  `codex-rs/cli/tests/login.rs::device_login_revokes_existing_auth_before_requesting_new_tokens`
  runs the real first-party `codex` binary against a `wiremock` OAuth
  server with an isolated temporary `CODEX_HOME`. It asserts:
  
  - the exact request sequence is `/oauth/revoke`,
  `/api/accounts/deviceauth/usercode`, `/api/accounts/deviceauth/token`,
  then `/oauth/token`;
  - there is exactly one revoke request and its body contains
  `old-refresh` with the `refresh_token` hint;
  - the completed login persists `new-refresh`.
  
  Local validation:
  
  - `just test -p codex-login` — 130 passed
  - `just test -p codex-cli` — 280 passed, including the new process-level
  regression test
  - `just bazel-lock-check`

  cooper-oai · 2026-06-12 12:38:30 -07:00
  d1aaf789ad
• feat(app-server): persist remote-control desired state (#27445)

  ## Why
  
  Remote-control runtime enablement and persisted enrollment preference
  were represented by separate flags. That made startup rehydration, RPC
  persistence, and new-enrollment seeding race with one another, and it
  did not cleanly distinguish runtime-only CLI or daemon starts from
  durable app-server RPC changes.
  
  ## What Changed
  
  - Replace the parallel enablement, seed, and rehydration flags with one
  transport-owned `RemoteControlDesiredState`.
  - Add nullable enrollment-scoped persistence and preserve existing
  preferences during enrollment upserts.
  - Rehydrate plain startup only after auth and client scope resolve,
  without overwriting a concurrent RPC transition.
  - Make ordinary `remoteControl/enable` and `remoteControl/disable`
  durable while retaining `ephemeral: true` for runtime-only callers.
  - Have the daemon explicitly request ephemeral enablement and regenerate
  the app-server schemas.
  
  ## Verification
  
  - Covered migration and `NULL`/`0`/`1` persistence round trips.
  - Covered plain-start rehydration and runtime-only versus durable
  enrollment seeding.
  - Covered durable enable, durable disable, and ephemeral enable through
  app-server RPC.
  - Covered the daemon's exact `{ "ephemeral": true }` request payload.
  
  Related issue: N/A (internal remote-control persistence architecture
  change).

  Anton Panasenko · 2026-06-11 21:28:52 -07:00
  d61dfeb23a
• [codex-rs] enforce PAT workspace restrictions (#27450)

  ## Summary
  
  - validate a hydrated personal access token's workspace against
  `forced_chatgpt_workspace_id` before persisting `codex login
  --with-access-token`
  - apply the same PAT-only check when restricted auth managers load
  environment, ephemeral, or persisted credentials
  - enforce PAT workspace restrictions in the existing central
  login-restriction path
  - leave Agent Identity and cloud bootstrap behavior unchanged
  
  ## Scope
  
  This is intentionally the small PAT-only change. It does not attempt the
  broader auth-manager/bootstrap unification; that needs separate design
  work.
  
  ## Validation
  
  - `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/codex-pat-target just test
  -p codex-login -p codex-cli` (410 passed)
  - `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/codex-pat-target just fix
  -p codex-login -p codex-cli`
  - `just fmt`
  - `git diff --check`
  
  Context: https://openai.slack.com/archives/D0AUPLV03RQ/p1781138331548269

  cooper-oai · 2026-06-11 14:17:37 -07:00
  b5f1bb75d4
• [codex] Load user instructions through an injected provider (#27101)

  ## Why
  
  We want to remove implicit use of `$CODEX_HOME` from `codex-core` and
  make embedders responsible for supplying user-level instructions. This
  also ensures user instructions load when no primary environment is
  selected.
  
  ## What changed
  
  Stacked on #27415, which makes `codex exec` surface thread-scoped
  runtime warnings.
  
  - Added `UserInstructionsProvider` to `codex-extension-api`, with
  absolute source attribution and recoverable loading warnings.
  - Added `codex-home` with the filesystem-backed provider for
  `AGENTS.override.md` and `AGENTS.md`, preserving precedence, fallback,
  trimming, lossy UTF-8 handling, and the existing uncapped global
  instruction size.
  - Removed global instruction loading from `Config` and require
  `ThreadManager` callers to inject a provider.
  - Load provider instructions once for each fresh root runtime, including
  runtimes without a primary environment. Running sessions retain their
  snapshot, while child agents inherit the parent snapshot without
  invoking the provider.
  - Keep provider instructions separate while loading project `AGENTS.md`,
  then assemble the model-visible instructions with the existing ordering,
  source attribution, warning, and turn-context behavior.
  - Wired the Codex home provider through the CLI, app server, MCP server,
  core facade, and thread-manager sample.
  
  ## Validation
  
  - `just test -p codex-home -p codex-extension-api`
  - `just test -p codex-core agents_md`
  - `just test -p codex-core guardian`
  - `just test -p codex-app-server
  thread_start_without_selected_environment_includes_only_global_instruction_source`
  - `just test -p codex-exec warning`
  - `just bazel-lock-check`

  Adam Perry @ OpenAI · 2026-06-11 19:28:47 +00:00
  236b50125d
• Print TUI session info on fatal exits (#27417)

  ## Summary
  
  TUI exits printed the resume/session summary only after checking the
  exit reason. On fatal exits, both CLI wrappers wrote the error and
  called `process::exit(1)` immediately, so an active session that ended
  on a fatal error could skip the session information entirely.
  
  This change prints the normal exit summary before returning the fatal
  nonzero exit code. If a fatal exit has a known thread id but no
  resumable rollout hint, it prints `Session ID: <id>` instead of staying
  silent. It also flushes stdout before `process::exit(1)` so the summary
  line is not lost during process teardown.
  
  ## Implementation
  
  - Apply the fatal-exit ordering fix in both `codex` and standalone
  `codex-tui`.
  - Keep normal user-requested exit behavior unchanged.
  - Preserve the existing resume hint when a rollout is resumable, and use
  the raw thread id only as a fatal-exit fallback.

  Eric Traut · 2026-06-11 09:56:09 -07:00
  9d88e299a7
• feat: add Bedrock API key as a managed auth mode (#27443)

  ## Why
  
  Codex needs to manage Amazon Bedrock API key credentials through the
  existing auth lifecycle instead of introducing a separate auth manager
  or provider-specific credential file. Treating Bedrock API key login as
  a primary auth mode gives it the same persistence, keyring, reload, and
  logout behavior as the existing OpenAI API key and ChatGPT modes.
  
  The credential is valid only for the `amazon-bedrock` model provider.
  OpenAI-compatible providers must reject this auth mode rather than
  treating the Bedrock key as an OpenAI bearer token.
  
  ## What changed
  
  - Added `bedrockApiKey` as an app-server `AuthMode` and
  `CodexAuth::BedrockApiKey` as a primary `AuthManager` mode.
  - Added `BedrockApiKeyAuth`, containing the API key and AWS region, to
  the existing `AuthDotJson` payload stored in `$CODEX_HOME/auth.json` or
  the configured keyring backend.
  - Added `login_with_bedrock_api_key(...)`, parallel to
  `login_with_api_key(...)`, which replaces the current stored login with
  Bedrock credentials.
  - Reused generic auth reload and logout behavior instead of adding a
  Bedrock-specific auth manager or logout path.
  - Updated login restrictions, status reporting, diagnostics, telemetry
  classification, generated app-server schemas, and auth fixtures for the
  new mode.
  - Added explicit errors when Bedrock API key auth is selected with an
  OpenAI-compatible model provider.
  
  This PR establishes managed storage and auth-mode behavior. Routing the
  managed key and region into Amazon Bedrock requests will be in follow-up
  PRs.

  Celia Chen · 2026-06-10 20:42:38 -07:00
  06afd63f4a
• Add session delete commands in CLI and TUI (#27476)

  ## Summary
  
  The app server exposes `thread/delete`, but users cannot invoke it from
  the CLI or TUI. Because deletion is irreversible, the user-facing
  commands need deliberate confirmation and safer handling of name-based
  targets.
  
  - Add `codex delete <SESSION>` with interactive confirmation,
  restricting `--force` to UUID targets.
  - Resolve exact names across active and archived sessions, including
  renamed sessions, and validate prompted UUID targets before
  confirmation.
  - Add a `/delete` command with a confirmation popup that warns the
  current session and its subagent threads will be permanently deleted.
  
  ## Manual testing
  
  - Deleted by UUID with `--force` and verified the rollout, session-index
  entry, and database row were removed.
  - Exercised name-based confirmation for both cancellation and
  affirmative deletion; cancellation preserved the session and
  confirmation removed it.
  - Verified deletion refuses to proceed without `--force`, while
  `--force` rejects names, including duplicate names.
  - Verified duplicate-name confirmation displays the concrete UUID
  selected.
  - Deleted an archived session by name.
  - Verified an already-missing UUID fails before displaying a
  confirmation prompt.
  - Exercised `/delete` in the TUI: the popup defaults to No, cancellation
  preserves the session, and confirmation deletes the session and exits.
  - Verified that `codex delete` works for both archived and non-archived
  sessions.

  Eric Traut · 2026-06-10 18:04:02 -07:00
  9d87b771ce
• [codex] Skip local curated discovery for remote plugins (#27311)

  ## Summary
  
  - skip the local `openai-curated` marketplace before marketplace loading
  when tool-suggest discovery uses remote plugins
  - preserve existing marketplace listing behavior for all other callers
  and when remote plugins are disabled
  - add regression coverage proving the curated marketplace is excluded
  before its malformed manifest can be read
  
  ## Why
  
  Tool-suggest discovery previously loaded every local `openai-curated`
  plugin manifest and only discarded that marketplace afterward when
  remote plugins were enabled. The remote catalog is used in that mode, so
  the local scan consumed CPU without contributing discoverable plugins.
  
  ## Impact
  
  Remote-plugin tool suggestion discovery no longer reads the local
  curated marketplace and its plugin manifests. `openai-bundled`,
  configured marketplaces, normal `plugin/list` behavior, and local
  curated discovery when remote plugins are disabled are unchanged.
  
  ## Validation
  
  - `just test -p codex-core-plugins
  list_marketplaces_can_skip_openai_curated_before_loading`
  - `just test -p codex-core
  list_tool_suggest_discoverable_plugins_omits_openai_curated_when_remote_enabled`
  - `just fmt`
  - `git diff --check`

  xl-openai · 2026-06-10 13:11:09 -07:00
  7011044c1c
• [codex] add /import for external agents (#27071)

  ## Why
  
  External-agent import should be discoverable and deliberate without
  blocking startup or claiming the public `codex [PROMPT]` CLI namespace.
  The slash command keeps the flow local to the interactive TUI and reuses
  the existing app-server import API.
  
  ## What changed
  
  - add the user-facing `/import` slash command
  - detect external-agent importable items only when the command is
  invoked
  - run imports through the embedded local app-server
  - show start and completion messages, refresh configuration, and block
  duplicate imports while one is pending
  - reject the flow for unsupported remote and local-daemon sessions
  
  ## Validation
  
  - `just test -p codex-tui external_agent_config_migration` (10 passed)
  - manually exercised an isolated TUI fixture with existing
  external-agent setup and session data using a fresh `CODEX_HOME`
  - verified picker customization, plugin and session detection, import
  completion, repeated invocation, and imported-session resume context
  - the broader `just test -p codex-tui` run passed 2,805 tests, with 2
  unrelated guardian feature-flag failures and 4 skipped tests
  
  ## Draft follow-ups
  
  - review whether completion messaging should remain attached to the
  initiating chat if the user switches chats during an import
  - review shutdown semantics for an in-progress background import
  
  ## Stack
  
  1. [#27064](https://github.com/openai/codex/pull/27064): remove the
  startup migration flow
  2. [#27065](https://github.com/openai/codex/pull/27065): extract the
  picker renderer
  3. [#27070](https://github.com/openai/codex/pull/27070): add the
  external-agent import picker UX
  4. [#27071](https://github.com/openai/codex/pull/27071): expose the flow
  through `/import`
  
  **This PR is stack item 4.** Draft while the lower stack dependencies
  are reviewed.

  stefanstokic-oai · 2026-06-10 15:53:15 -04:00
  b4445f2758
• [codex] Move release platform rules into bazel package (#27321)

  ## Intent
  
  Keep release-specific Bazel helpers out of the shared Rust crate
  definitions and colocate them with Bazel platform configuration.
  
  ## Implementation
  
  Moves `multiplatform_binaries` and its platform list from `defs.bzl`
  into `bazel/platforms/release_binaries.bzl` and updates the CLI load
  site. Behavior is unchanged.
  
  ## Validation
  
  - `bazel query //codex-rs/cli:release_binaries`
  
  Stack: 1 of 6.

  Adam Perry @ OpenAI · 2026-06-10 19:45:29 +00:00
  1deae7bd4a
• fix: Auto-recover from corrupted sqlite databases (#26859)

  Further investigation of the sqlite incidents showed that the problems
  are due to corruption from the older version of SQLite that we recently
  upgraded, and that the data is truly corrupted in the root database --
  recovery of all data is not possible. Given that the data is
  reconstructable from the rollouts on disk, we should just auto-backup
  the database and let codex rebuild the rollout info from the disk
  rollouts.
  
  The new behavior is that appserver auto-backs-up and rebuilds (with logs
  reflecting that behavior). The CLI now pops a message letting you know
  this happened and the paths of the backed-up corrupt db and the new
  database. There is also context added so that the desktop app can read
  the rebuild info from it and inform the user with it.

  David de Regt · 2026-06-10 11:24:29 -07:00
  3691fe5b76
• feat(doctor): report editor and pager environment (#27081)

  ## Background
  
  This was prompted by
  [#26858](https://github.com/openai/codex/issues/26858), where the
  attached doctor report did not include the editor selection and I had to
  [ask which editor was in
  use](https://github.com/openai/codex/issues/26858#issuecomment-4653829891)
  before investigating the external-editor newline issue. Capturing these
  variables in doctor makes that context available up front in future
  reports.
  
  `codex doctor` is intended to capture enough local context to diagnose
  startup and terminal behavior, but it did not report the environment
  variables that select an external editor or configure command pagers.
  
  The TUI [prefers `VISUAL` over
  `EDITOR`](https://github.com/openai/codex/blob/56554904babcaacf4444a2cc90716880837dff7c/codex-rs/tui/src/external_editor.rs#L31-L38),
  so missing or unexpected values can explain why the external-editor
  shortcut fails or launches the wrong command. Pager values are also
  useful inherited-shell context even though [unified exec normalizes its
  effective pager variables to
  `cat`](https://github.com/openai/codex/blob/56554904babcaacf4444a2cc90716880837dff7c/codex-rs/core/src/unified_exec/process_manager.rs#L60-L70).
  
  These variables can contain arbitrary command arguments or inline
  environment assignments. The human report is local, but `codex doctor
  --json` may be attached to feedback, so the machine-readable report
  should not include their raw contents.
  
  ## What Changed
  
  - Report `VISUAL` and `EDITOR` in the system environment details, using
  `not set` when either variable is absent.
  - Report inherited `PAGER`, `GIT_PAGER`, `GH_PAGER`, and `LESS` values
  when present.
  - Preserve full values in local human output while reducing these fields
  to `set` or `not set` in redacted JSON output.
  - Add structured check, JSON-redaction, rendered-output, and snapshot
  coverage.
  
  ## How to Test
  
  1. From `codex-rs`, run Codex with explicit editor and pager variables:
  
     ```sh
  env VISUAL='code --wait' EDITOR=vim PAGER='less -R' GIT_PAGER=delta
  GH_PAGER=less LESS=-FRX \
       cargo run -p codex-cli --bin codex -- doctor --no-color
     ```
  
  2. Confirm the `system` details show the full values for all six
  variables.
  3. Unset the pager variables and rerun the command. Confirm pager rows
  are omitted while missing editor variables are shown as `not set`.
  4. Run the same configured environment with `doctor --json`. Confirm
  each configured editor or pager field is reported as `set` and none of
  the raw commands or arguments appear in the JSON.
  
  Targeted tests:
  
  - `just test -p codex-cli` (279 tests passed)

  Felipe Coury · 2026-06-08 15:43:08 -07:00
  0473a5cc52
• Enforce configured network proxy in codex sandbox (#27035)

  ## Why
  
  `codex sandbox` can start a network proxy from a configured permission
  profile. Previously, sandbox-level containment was tied to managed
  network requirements rather than whether a proxy was actually active.
  This meant config-driven proxy policies were not consistently enforced
  as the sandbox's only network path.
  
  ## What changed
  
  - Enable proxy-only network containment whenever `codex sandbox` starts
  a network proxy.
  - Apply the same active-proxy check to the macOS and Linux sandbox
  paths.
  - Add a Linux regression test that verifies a sandboxed command cannot
  establish a direct connection while the configured proxy is active.
  
  ## Test plan
  
  - `just test -p codex-cli debug_sandbox::tests`
  - `sandbox_with_network_proxy_blocks_direct_loopback_access` runs on
  Linux to cover the config-driven proxy path end to end.

  viyatb-oai · 2026-06-08 14:03:37 -07:00
  85fd52f7e4
• cli: add -P sandbox permissions profile alias (#27054)

  ## Why
  
  `codex sandbox --permissions-profile` is useful when running commands
  under a named permissions profile, but the long option is cumbersome for
  a debugging-oriented command. `-p` is already used for the config
  profile selector, so `-P` gives the permissions profile selector a
  compact, non-conflicting alias.
  
  ## What Changed
  
  - Added `short = 'P'` to the `permissions_profile` option for the macOS,
  Linux, and Windows sandbox command structs in
  [`codex-rs/cli/src/lib.rs`](https://github.com/openai/codex/blob/6d9f9c5cdcaa0a156aa2dabbde259ae5e9e8bc0b/codex-rs/cli/src/lib.rs#L29-L112).
  - Added parser coverage for `codex sandbox -P :workspace -- echo` in
  [`codex-rs/cli/src/main.rs`](https://github.com/openai/codex/blob/6d9f9c5cdcaa0a156aa2dabbde259ae5e9e8bc0b/codex-rs/cli/src/main.rs#L2883-L2896).
  
  ## Verification
  
  - `just test -p codex-cli` passed, including the new
  `sandbox_parses_permissions_profile_short_alias` parser test.

  Michael Bolin · 2026-06-08 20:59:23 +00:00
  e0ee491df3
• [plugins] Expose marketplace source in marketplace list JSON (#27009)

  ## Summary
  - Follow-up to #26417 and #26631
  - Add `marketplaceSource` to `codex plugin marketplace list --json`
  entries for configured marketplaces
  - Reuse the existing `marketplaceSource` shape from `codex plugin list
  --json`
  - Keep human-readable marketplace list output unchanged
  - Add CLI coverage for configured local and git marketplace sources
  
  Example:
  
  ```json
  {
    "marketplaces": [
      {
        "name": "debug",
        "root": "/path/to/.codex/.tmp/marketplaces/debug",
        "marketplaceSource": {
          "sourceType": "git",
          "source": "https://example.com/acme/agent-skills.git"
        }
      }
    ]
  }
  ```
  
  ## Validation
  - `just fmt`
  - `just fix -p codex-cli`
  - `just test -p codex-cli marketplace_list`
  - `just test -p codex-cli`

  mpc-oai · 2026-06-08 13:37:55 -05:00
  0aa9931aea
• fix(tui): accept prompts with resume and fork (#26818)

  ## Why
  
  Interactive `codex resume` and `codex fork` expose both a session ID
  positional and an initial prompt positional. With `--last`, Clap still
  assigns the first positional to the session ID, so a command such as
  `codex fork --last "/compact focus on auth"` either fails parsing or
  attempts to look up the prompt as a session ID instead of sending it to
  the latest session.
  
  This makes it impossible to select the latest session and immediately
  provide a follow-up prompt, even though `codex exec resume --last`
  already supports that workflow.
  
  <img width="1746" height="1024" alt="CleanShot 2026-06-06 at 17 00
  47@2x"
  src="https://github.com/user-attachments/assets/86885c07-a23c-48ee-b0ee-47f2484f6eb7"
  />
  
  ## What Changed
  
  - Reinterpret the first positional as the initial prompt when
  interactive `resume --last` or `fork --last` is used and no explicit
  second prompt was parsed.
  - Preserve the existing `resume SESSION_ID PROMPT` and `fork SESSION_ID
  PROMPT` behavior.
  - Add parser-level regression coverage for latest-session and
  explicit-session prompt forms.
  
  ## How to Test
  
  1. Start an interactive session, exit it, then run `codex resume --last
  "continue from the latest session"`.
  2. Confirm Codex resumes the latest session and submits the supplied
  prompt instead of treating it as a session ID.
  3. Run `codex fork --last "take a different approach"`.
  4. Confirm Codex forks the latest session and submits the supplied
  prompt.
  5. Also verify `codex resume SESSION_ID "continue here"` and `codex fork
  SESSION_ID "branch here"` still target the explicit session and submit
  the prompt.
  
  Targeted tests:
  - `just test -p codex-cli` (267 passed)

  Felipe Coury · 2026-06-07 17:34:35 -04:00
  e093d81982
• [codex-rs] support v2 personal access tokens (#25731)

  ## Summary
  
  - add v2 personal access token support for `codex login
  --with-access-token` and `CODEX_ACCESS_TOKEN`
  - classify opaque `at-` tokens separately from legacy Agent Identity
  JWTs
  - hydrate required ChatGPT account metadata through AuthAPI
  `/v1/user-auth-credential/whoami`
  - use PATs directly as bearer tokens while preserving existing ChatGPT
  account surfaces
  - expose PAT-backed auth as the explicit `personalAccessToken`
  app-server auth mode
  
  ## Implementation
  
  PAT auth is intentionally small and stateless. Loading a PAT performs
  one AuthAPI metadata request, stores the hydrated metadata in the
  in-memory auth object, and redacts the secret from debug output. Legacy
  Agent Identity JWT handling remains unchanged. The shared access-token
  classifier lives in a private neutral module because it dispatches
  between both credential types.
  
  PAT hydration fails closed when AuthAPI omits any required metadata,
  including email. Hydrated metadata is intentionally not persisted:
  startup performs a live `whoami` preflight so revoked tokens or changed
  account metadata are not accepted from a stale cache.
  
  ## Workspace restriction scope
  
  This change intentionally does **not** apply
  `forced_chatgpt_workspace_id` to PAT authentication. The setting is a
  client-side config guardrail, not an authorization boundary, and PAT
  does not currently require workspace-ID parity. The PAT login and
  `CODEX_ACCESS_TOKEN` paths therefore validate through AuthAPI without
  threading workspace-restriction state through access-token loading.
  Existing workspace checks for non-PAT auth remain on their established
  paths.
  
  ## App-server compatibility
  
  The public app-server `AuthMode` is shared across v1 and v2, and
  PAT-backed auth reports `personalAccessToken` through both APIs.
  Following human review, this intentionally removes the temporary v1
  compatibility mapping that reported PATs as `chatgpt`; the deprecated v1
  API is kept in parity with v2 rather than maintaining a separate closed
  enum. Clients with exhaustive auth-mode handling in either API version
  must add the new case and should generally treat it as ChatGPT-backed
  unless they need PAT-specific behavior.
  
  The v1 auth-status response still omits the raw PAT when `includeToken`
  is requested because that response cannot carry the account metadata
  needed to reuse the credential safely. Persisted PAT auth also omits the
  new enum value so older Codex builds can deserialize `auth.json` and
  infer PAT auth from the credential field after a rollback.
  
  ## Validation
  
  Latest review-fix validation:
  
  - `CARGO_INCREMENTAL=0 just test -p codex-login` (126 passed)
  - `CARGO_INCREMENTAL=0 just test -p codex-cli` (263 passed)
  - `CARGO_INCREMENTAL=0 just test -p codex-cli
  stored_auth_validation_handles_personal_access_token`
  - `CARGO_INCREMENTAL=0 just test -p codex-app-server-protocol` (226
  passed)
  - `CARGO_INCREMENTAL=0 just test -p codex-models-manager
  refresh_available_models_uses_remote_only_catalog_for_chatgpt_auth`
  - `CARGO_INCREMENTAL=0 just test -p codex-tui
  existing_non_oauth_chatgpt_login_counts_as_signed_in`
  - `CARGO_INCREMENTAL=0 just fix -p codex-login -p
  codex-app-server-protocol -p codex-models-manager -p codex-tui -p
  codex-cli`
  - `just fmt`
  - `git diff --check`
  
  The broader `codex-tui` suite previously compiled and ran 2,834 tests.
  Three unrelated environment-sensitive guardian/IDE-socket tests failed
  after retries; the PAT-relevant TUI coverage passed.

  cooper-oai · 2026-06-05 17:36:18 -07:00
  df7818c7d1
• Add JSON output for plugin subcommands (#26631)

  ## Summary
  - Follow-up to #25330 and #26417
  - Add `--json` output for `codex plugin add` and `codex plugin remove`
  - Add `--json` output for `codex plugin marketplace
  add/list/upgrade/remove`
  - Keep existing human-readable output unchanged
  - Keep existing error handling/stderr behavior unchanged; `--json`
  changes successful stdout output only
  - Align marketplace add/remove JSON field names with the existing
  app-server protocol shape
  - Add CLI coverage for plugin and marketplace JSON outputs
  
  ## Validation
  - `just fmt`
  - `just fix -p codex-cli`
  - `just test -p codex-cli`

  mpc-oai · 2026-06-05 14:40:31 -05:00
  bb7d19bc24
• Open Windows app workspaces via deep link (#26500)

  ## Summary
  
  Fixes #26423.
  
  On Windows, `codex app PATH` detected Codex Desktop and launched the app
  shell target, then only printed a manual instruction to open the
  workspace. The Desktop app already supports
  `codex://threads/new?path=...`, so the CLI can open the requested
  workspace directly.
  
  This updates the Windows launcher to normalize the workspace path,
  encode it into a `codex://threads/new` deep link, and open that URL when
  Codex Desktop is installed. The installer fallback still opens the
  Windows installer and prints the workspace path for after installation.

  Eric Traut · 2026-06-05 08:32:42 -07:00
  e781816ead
• Expose configured marketplace source in plugin list JSON (#26417)

  ## Summary
  - Follow-up to #25330
  - Add `marketplaceSource` to `codex plugin list --json` entries for
  configured marketplaces
  - Keep the existing per-plugin `source` field unchanged; this still
  reports the local plugin source path
  - Include only the configured marketplace `sourceType` and `source` from
  `config.toml`
  - Keep human-readable output unchanged
  - Add CLI coverage for configured local and git marketplace sources
  
  Example:
  
  ```json
  {
    "source": {
      "source": "local",
      "path": "/path/to/.codex/.tmp/marketplaces/debug/plugins/sample"
    },
    "marketplaceSource": {
      "sourceType": "git",
      "source": "https://example.com/acme/agent-skills.git"
    }
  }
  ```
  
  ## Validation
  - `just fmt`
  - `just fix -p codex-cli`
  - `just test -p codex-cli plugin_list`

  mpc-oai · 2026-06-04 12:20:32 -05:00
  cdc1d592df
• [codex] Add plugin list JSON output (#25330)

  ## Summary
  - add `--json` output to `codex plugin list` with `installed` and
  `available` arrays
  - add `--available` for JSON output only; using it without `--json` is
  rejected
  - keep the existing non-JSON table output unchanged
  - add CLI coverage for JSON installed/available output and the
  `--available`/`--json` requirement
  
  ## Validation
  - `just test -p codex-cli plugin_list`
  - `just fix -p codex-cli`
  - `git diff --check`
  
  Note: `just fmt` ran Rust formatting first, then failed in the Python
  ruff step because `openai-codex-cli-bin==0.132.0` has no wheel for this
  Linux platform.

  xl-openai · 2026-06-01 21:27:06 -07:00
  cb63ee7f5d
• Wire managed MITM CA trust into child env (#22668)

  ## Stack
  1. Parent PR: #18240 uses named MITM permissions config.
  2. This PR wires managed MITM CA trust into spawned child processes.
  
  ## Why
  When Codex terminates HTTPS for limited mode or MITM hooks, child HTTPS
  clients need to trust Codex's managed MITM CA. Exporting proxy URLs
  alone is not enough, but blindly replacing user CA settings would be
  wrong: it can break custom enterprise/test roots, leak unreadable CA
  files into generated bundles, or make the child env disagree with its
  sandbox policy.
  
  ## Summary
  1. Build immutable managed CA bundles under `$CODEX_HOME/proxy` that
  include native roots, the managed MITM CA, and only inherited or
  command-scoped CA bundles the child is allowed to read.
  2. Export curated CA env vars alongside managed proxy env vars while
  preserving user CA override semantics, including nested Codex
  `SSL_CERT_FILE` precedence.
  3. Thread generated CA bundle paths into child sandbox readable roots,
  including debug sandbox execution, so the exported env vars work inside
  sandboxed commands.
  4. Remove only Codex-generated MITM CA bundle env when a child
  intentionally drops managed proxying for escalation or no-proxy retry.
  5. Document the managed CA bundle behavior and cover env injection,
  per-child bundle generation, sandbox readable roots, and no-proxy
  cleanup in tests.
  
  ## Validation
  1. Ran `just test -p codex-network-proxy`.
  2. Ran `just test -p codex-protocol`.
  3. Ran `just fix -p codex-network-proxy -p codex-protocol`.
  4. Tried focused `codex-core` validation, but the crate currently fails
  to compile in `core/tests/suite/guardian_review.rs` because an existing
  `Op::UserInput` initializer is missing `additional_context`.
  
  ---------
  
  Co-authored-by: Eva Wong <evawong@openai.com>

  Winston Howes · 2026-06-01 23:23:59 +00:00
  bca18cba40
• Add reasoning-only status surface item (#25504)

  Closes #24886.
  
  ## Why
  Users can configure the TUI status line and terminal title with
  `model-with-reasoning`, but issue #24886 asks for a compact
  reasoning-only item. That lets a setup show just `default`, `low`,
  `medium`, `high`, or `xhigh` without repeating the model name.
  
  ## What changed
  - Added a `reasoning` item for `/statusline` and `/title` setup flows.
  - Rendered the item from the effective reasoning effort, including
  collaboration-mode overrides.
  - Registered `reasoning` with `codex doctor` so Codex-generated
  terminal-title config is not reported as invalid.
  - Updated TUI setup snapshots so the picker previews include the new
  item.

  Eric Traut · 2026-06-01 09:30:20 -07:00
  f1d029cf75
• Use deep links for macOS codex app paths (#25485)

  ## Why
  
  `codex app [PATH]` is the documented CLI entry point for opening Codex
  Desktop on a workspace. Recent desktop builds can focus the app while
  failing to honor paths passed as macOS document-open arguments via `open
  -a Codex.app <workspace>`, which broke `codex app .` for users. See
  #25333; related report: #25166.
  
  The desktop app still supports the explicit
  `codex://threads/new?path=...` route, so the CLI should use that
  app-owned launch surface instead of depending on folder-open event
  delivery.
  
  ## What Changed
  
  - Build a `codex://threads/new?path=<workspace>` URL in the macOS app
  launcher.
  - Pass that URL to `open -a <Codex.app>` instead of passing the
  workspace path as a document argument.
  - Add coverage that workspace paths needing escaping round-trip through
  URL query encoding.
  
  ## Verification
  
  - `just test -p codex-cli codex_new_thread_url_encodes_workspace_path`

  Eric Traut · 2026-06-01 09:17:08 -07:00
  f94c49cf46
• Add thread archive CLI commands (#25021)

  ## Problem
  
  Saved threads can already be archived through app-server RPCs, but the
  command line did not expose direct archive or unarchive commands.
  
  ## Solution
  
  Add `codex archive <thread>` and `codex unarchive <thread>`, resolving
  UUIDs or exact thread names before calling the existing `thread/archive`
  and `thread/unarchive` RPCs. The commands support scoped remote flags so
  callers can target remote app-server endpoints when archiving or
  unarchiving threads.
  
  This also fixes a long-standing bug in `codex resume <thread id>` and
  `codex fork <thread id>` that I found when testing the new commands.
  These operations shouldn't be allowed on archived sessions. They now
  fail with an error that tells the user to run `codex unarchive <thread
  id>` first.
  
  ## Verification
  
  Added app-server coverage for rejecting archived thread resume by id and
  checking that the error includes the matching `codex unarchive <thread
  id>` command.

  Eric Traut · 2026-05-29 23:37:26 -07:00
  3e7baa00e4
• Add Windows sandbox provisioning setup command (#24831)

  ## Why
  
  Some Windows users do not have local admin access, so they cannot
  complete the elevated portion of the Windows sandbox setup when Codex
  first needs it. This adds an alpha provisioning path that an admin or IT
  deployment script can run ahead of time for the Codex user.
  
  The intended managed-deployment shape is:
  
  ```powershell
  codex sandbox setup --elevated --user "$env:COMPUTERNAME\Alice" --codex-home "C:\Users\Alice\.codex"
  ```
  
  `--elevated` is treated as the requested sandbox setup level, not as
  proof that the process is elevated. The Windows sandbox setup
  orchestration still checks that the caller is actually elevated before
  launching the helper without a UAC prompt.
  
  ## What changed
  
  - Added `codex sandbox setup --elevated` with explicit user selection
  via either `--current-user` or `--user ... --codex-home ...`.
  - Moved the CLI implementation into `cli/src/sandbox_setup.rs` instead
  of growing `cli/src/main.rs`.
  - Added a Windows sandbox `ProvisionOnly` helper mode that runs the
  elevation-required provisioning work without requiring a workspace cwd
  or runtime sandbox policy.
  - Reused the existing elevated helper path for creating/updating sandbox
  users, configuring firewall/WFP rules, and applying sandbox directory
  ACLs.
  - Persisted `windows.sandbox = "elevated"` into the target `CODEX_HOME`
  so the desktop app does not show the initial sandbox setup banner after
  pre-provisioning succeeds.
  
  ## Validation
  
  - `cargo fmt -p codex-windows-sandbox -p codex-core -p codex-cli`
  - `cargo test -p codex-cli sandbox_setup --target-dir
  target\sandbox-setup-check`
  - `cargo test -p codex-windows-sandbox
  payload_accepts_provision_only_mode --target-dir
  target\sandbox-setup-check`
  - `git diff --check`
  - Manual Windows alpha flow with a standard local user (`Mandi Lavida`):
  ran the new setup command from an admin shell, verified the target
  `.codex` contents, sandbox marker/secrets, ACLs, firewall rules, and
  desktop startup without the sandbox setup banner once experimental
  network proxy requirements were disabled.
  
  ## Notes
  
  This intentionally does not solve later elevated update coordination for
  IT-managed deployments. The setup command can still apply provisioning
  updates when run again, but a broader coordination/process story is out
  of scope for this alpha.

  iceweasel-oai · 2026-05-29 11:01:44 -07:00
  cb9178e8b3
• windows-sandbox: pass workspace roots to runner (#24108)

  ## Why
  
  #23813 switches the Windows sandbox runner path to `PermissionProfile`,
  but it still left one runtime anchor for resolving symbolic
  `:workspace_roots` entries. That is not enough once a turn has multiple
  effective workspace roots: exact entries and deny globs under
  `:workspace_roots` need to be materialized for every runtime root before
  the command runner chooses token mode or builds ACL plans.
  
  ## What Changed
  
  - Replaces the Windows runner/setup `permission_profile_cwd` plumbing
  with `workspace_roots: Vec<AbsolutePathBuf>`.
  - Resolves Windows-local `PermissionProfile` data with
  `materialize_project_roots_with_workspace_roots(...)` instead of the
  single-cwd helper.
  - Threads `Config::effective_workspace_roots()` through core execution,
  unified exec, TUI setup/read-grant flows, app-server setup, app-server
  `command/exec`, and `debug sandbox` on Windows.
  - Preserves those workspace roots through the zsh-fork escalation
  executor instead of rebuilding them from `sandbox_policy_cwd`.
  - Makes `ExecRequest::new(...)` and the remaining
  `build_exec_request(...)` helper path take
  `windows_sandbox_workspace_roots` explicitly so new call sites cannot
  silently fall back to `vec![cwd]`.
  - Clarifies the `debug sandbox` non-Windows comment: remaining
  cwd-dependent resolution still uses `sandbox_policy_cwd`, while
  `:workspace_roots` entries are already materialized from config roots.
  - Updates elevated runner IPC `SpawnRequest` to send `workspace_roots`
  and bumps the framed IPC protocol version to `3` for the payload shape
  change.
  - Adds Windows-local resolver coverage for expanding exact and glob
  `:workspace_roots` entries across multiple roots, plus core helper
  coverage proving explicit roots are preserved.
  
  ## Verification
  
  - `cargo check -p codex-windows-sandbox -p codex-core -p codex-tui -p
  codex-cli -p codex-app-server`
  - `cargo test -p codex-windows-sandbox`
  - `cargo test -p codex-core windows_sandbox`
  - `cargo test -p codex-core unix_escalation`
  - `cargo test -p codex-app-server windows_sandbox`
  - `cargo test -p codex-tui windows_sandbox`
  - `cargo test -p codex-cli debug_sandbox`
  - `just test -p codex-core unified_exec`
  - `just test -p codex-core
  build_exec_request_preserves_windows_workspace_roots`
  - `env -u CODEX_NETWORK_PROXY_ACTIVE -u
  CODEX_NETWORK_ALLOW_LOCAL_BINDING just test -p codex-app-server --lib
  command_exec`
  - `just test -p codex-windows-sandbox`
  - `just test -p codex-exec sandbox`
  - `just fix -p codex-core -p codex-app-server -p codex-windows-sandbox`
  
  A local macOS cross-check with `cargo check --target
  x86_64-pc-windows-msvc ...` did not reach crate Rust code because native
  dependencies require Windows SDK headers (`windows.h` / `assert.h`) in
  this environment; Windows CI remains the real target validation.
  
  Two local targeted filters compile but do not run assertions on macOS:
  `env -u CODEX_NETWORK_PROXY_ACTIVE -u CODEX_NETWORK_ALLOW_LOCAL_BINDING
  just test -p codex-app-server --lib command_exec_processor` matched zero
  tests, and `just test -p codex-linux-sandbox landlock` matched zero
  tests because the landlock suite is Linux-only.

  Michael Bolin · 2026-05-28 15:26:55 -07:00
  986c60467b
• Add codex app-server --stdio alias (#24940)

  ## Summary
  - Add `--stdio` as a direct alias for `codex app-server --listen
  stdio://`.
  - Keep `--stdio` and `--listen` mutually exclusive.
  - Update the app-server README to document both forms.

  Adam Perry @ OpenAI · 2026-05-28 12:43:30 -07:00
  b90ec46387
• Allow API-key auth for remote exec-server registration (#24666)

  ## Overview
  Allow remote `codex exec-server` registration to use existing API-key
  auth while restricting where those credentials can be sent.
  
  - Accept `CodexAuth::ApiKey` for the normal `--remote` registration
  path.
  - Restrict API-key remote registration to HTTPS `openai.com` and
  `openai.org` hosts and subdomains, with explicit HTTP loopback support
  for local development.
  - Disable registry registration redirects so credentials cannot be
  forwarded to an unvalidated destination.
  - Retain `--use-agent-identity-auth` as the explicit Agent Identity
  path.
  - Document remote registration using `CODEX_API_KEY`.
  
  ## Big picture
  Callers can now provide an API key directly to `exec-server`
  registration without first establishing ChatGPT login state:
  
  ```sh
  CODEX_API_KEY="$OPENAI_API_KEY" \
  codex exec-server \
    --remote "https://<host>.openai.org/api" \
    --environment-id "$ENVIRONMENT_ID"
  ```
  
  ## Validation
  - `cargo fmt --all` (`just fmt` is not installed on this host)
  - `cargo test -p codex-cli -p codex-exec-server`

  Steve Coffey · 2026-05-27 21:17:38 +00:00
  c57dee98b7
• Uprev Rust toolchain pins to 1.95.0 (#24684)

  ## Summary
  - Bump the workspace Rust toolchain from `1.93.0` to `1.95.0` across
  Cargo, Bazel, CI, release workflows, devcontainers, and the Codex
  environment config.
  - Refresh `MODULE.bazel.lock` so the Bazel Rust toolchain artifacts
  match the new version.
  - Leave purpose-specific toolchains unchanged, including the
  `argument-comment-lint` nightly and the upstream `rusty_v8` `1.91.0`
  build pin.
  - Includes fixes for new lints from `just fix` and a few codex-authored
  fixes for lints without a suggestion.

  Adam Perry @ OpenAI · 2026-05-26 20:59:47 -07:00
  cca1e0ba1d
• windows-sandbox: remove SandboxPolicy runner plumbing (#23813)

  ## Why
  
  The Windows sandbox runner still carried the old `SandboxPolicy`
  compatibility path even though core now computes `PermissionProfile`.
  That meant Windows command-runner execution could only see the legacy
  projection, so profile-only filesystem rules such as deny globs were not
  part of the runner input.
  
  ## What Changed
  
  - Removed the Windows-local `SandboxPolicy` parser/export and deleted
  `windows-sandbox-rs/src/policy.rs`.
  - Changed restricted-token capture/session setup, elevated setup,
  world-writable audit, read-root grant, and command-runner session APIs
  to accept `PermissionProfile` plus the profile cwd.
  - Bumped the elevated command-runner IPC protocol to version 2 because
  `SpawnRequest` now carries `permission_profile` /
  `permission_profile_cwd` instead of the legacy `policy_json_or_preset` /
  `sandbox_policy_cwd` fields.
  - Updated core exec, unified exec, debug-sandbox, TUI setup/grant flows,
  and app-server setup to pass the actual effective `PermissionProfile`.
  - Left regression coverage asserting the old IPC policy fields are
  absent and the runner serializes tagged `PermissionProfile` JSON.
  
  ## Verification
  
  - `cargo test -p codex-windows-sandbox`
  - `cargo test -p codex-core windows_sandbox`
  - `cargo test -p codex-app-server
  request_processors::windows_sandbox_processor`
  - `just fix -p codex-windows-sandbox -p codex-core -p codex-app-server
  -p codex-cli -p codex-tui`
  - `just fix -p codex-cli -p codex-tui`
  - `just fix -p codex-windows-sandbox -p codex-tui`
  - `rg "\\bSandboxPolicy\\b" codex-rs/windows-sandbox-rs` returned no
  matches.
  
  Note: `cargo test -p codex-cli` was attempted but did not reach crate
  tests because local disk filled while compiling dependencies (`No space
  left on device`). The targeted clippy pass compiled the affected CLI/TUI
  surfaces afterward.
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/23813).
  * #24108
  * __->__ #23813

  Michael Bolin · 2026-05-26 14:56:27 -07:00
  0a6bc4e687
• Move memory state to a dedicated SQLite DB (#24591)

  ## Summary
  
  Generated memory rows and their stage-one/stage-two job state currently
  live in `state_5.sqlite` alongside thread metadata. That makes memory
  cleanup and regeneration share the main state schema even though those
  rows are memory-pipeline data and can be rebuilt independently from the
  durable thread records.
  
  This PR moves the memory-owned tables into a dedicated
  `memories_1.sqlite` runtime database while keeping thread metadata in
  `state_5.sqlite`.
  
  ## Changes
  
  - Adds a separate memories DB runtime, migrator, path helpers, telemetry
  kind, and Bazel compile data for `state/memory_migrations`.
  - Introduces `MemoryStore` behind `StateRuntime::memories()` and moves
  memory table/job operations onto that store.
  - Drops the old memory tables from the state DB and recreates their
  schema in `state/memory_migrations/0001_memories.sql`.
  - Updates memory startup, citation usage tracking, rollout pollution
  handling, `debug clear-memories`, and app-server `memory/reset` to
  operate through the memories DB.
  - Preserves cross-DB behavior by hydrating thread metadata from the
  state DB when selecting visible memory outputs and checking stage-one
  staleness.
  
  ## Verification
  
  - Added/updated `codex-state` tests for deleted-thread memory visibility
  and already-polluted phase-two enqueue behavior.
  - Updated `debug clear-memories`, app-server `memory/reset`, and
  memories startup tests to seed and assert memory rows through
  `memories_1.sqlite`.

  jif-oai · 2026-05-26 20:07:25 +02:00
  aad59a0916
• Add doctor thread inventory audit (#24305)

  ## Why
  
  Users have been reporting missing sessions in the app. The app server
  thread listing is backed by the SQLite state DB, but the durable source
  of truth for a thread still exists on disk as rollout JSONL. When the
  state DB is incomplete, doctor should be able to show the mismatch
  directly instead of leaving users with a generic state health result.
  
  ## What changed
  
  This adds a `threads` doctor check that compares active and archived
  rollout files under `CODEX_HOME` with rows in the SQLite `threads`
  table. The check reports missing rollout rows, stale DB rows, archive
  flag mismatches, duplicate rollout thread IDs, duplicate DB paths,
  source/provider summaries, and bounded samples of affected rollout
  paths.
  
  It also adds a read-only state audit helper in `codex-rs/state` so
  doctor can inspect thread rows without creating, migrating, or repairing
  the database.
  
  ## Sample output
  
  ```text
    ⚠ threads      rollout files are missing from the state DB
        default model provider   openai
        rollout DB active files  3910
        rollout DB archived files 2037
        rollout DB scan errors   0
        rollout DB malformed file names 0
        rollout DB scan cap reached false
        rollout DB rows          5499
        rollout DB active rows   3462
        rollout DB archived rows 2037
        rollout DB missing active rows 448
        rollout DB missing archived rows 0
        rollout DB stale rows    0
        rollout DB archive mismatches 0
        rollout DB duplicate rollout thread ids 0
        rollout DB duplicate DB paths 0
        rollout DB model providers openai=5359, lmstudio=35, mock_provider=33, lite_llm=26, proxy=26, ollama=15, lms=4, local-usage-limit=1
        rollout DB sources       vscode=2587, cli=1494, subagent:thread_spawn=577, subagent:other=502, exec=281, subagent:memory_consolidation=46, subagent:review=9, unknown=3
        rollout DB missing active sample ~/.codex/sessions/2026/0…857e-a923c712e066.jsonl
        rollout DB missing active sample ~/.codex/sessions/2025/0…877a-766dff25c68d.jsonl
        rollout DB missing active sample ~/.codex/sessions/2025/0…a8b1-7bbadc836f6e.jsonl
        rollout DB missing active sample ~/.codex/sessions/2025/0…a218-e6197f3f62f8.jsonl
        rollout DB missing active sample ~/.codex/sessions/2025/0…9011-7e30784f9932.jsonl
  ```

  Eric Traut · 2026-05-25 10:29:06 -07:00
  a7836744cc
• Report app-server version in codex doctor (#24311)

  ## Why
  
  We are seeing cases where users have an old background app-server still
  running. `codex doctor` already reports background server state, but
  without the running app-server version it is harder to diagnose
  behaviors that depend on the daemon build.
  
  ## What changed
  
  - Reused the app-server daemon's passive initialize probe through a
  narrow `probe_app_server_version` helper.
  - Updated the `codex doctor` Background Server section to report
  `app-server version: <version>` when the socket is reachable.
  - Preserved the not-running OK behavior and report `app-server version:
  unavailable (<short error>)` when a socket exists but the passive probe
  fails.

  Eric Traut · 2026-05-25 09:41:12 -07:00
  6491d1207f
• feat(doctor): add environment diagnostics (#24261)

  ## Why
  
  Issue #23031 was hard to diagnose from existing `codex doctor` output
  because support could not see the OS language, resolved Git install, Git
  repo metadata, Windows console mode/code page, or terminal-title inputs
  that affect the TUI startup path. This adds those read-only signals to
  `codex doctor` so Windows, Linux, and macOS reports carry the context
  needed to investigate similar terminal rendering regressions.
  
  Refs #23031
  
  ## What Changed
  
  - Add a `system.environment` check for OS type/version, OS language, and
  locale env vars.
  - Add a `git.environment` check for the selected Git executable, PATH
  Git candidates, version, exec path/build options, repository root,
  branch, `.git` entry, and `core.fsmonitor`.
  - Add Windows console code page and VT-processing mode details to
  terminal diagnostics.
  - Add a `terminal.title` check for configured/default title items and
  resolved project-title source/value.
  - Surface startup warning counts in config diagnostics and teach human
  output to render the new categories.
  
  ## How to Test
  
  1. On Windows, check out this branch and run `cargo run -p codex-cli --
  doctor --summary`.
  2. Confirm the Environment section includes `system`, `git`, `terminal`,
  and `title` rows.
  3. Run `cargo run -p codex-cli -- doctor --json`.
  4. Confirm the JSON contains `system.environment`, `git.environment`,
  and `terminal.title`; on Windows, confirm `terminal.env` details include
  console code pages and `VT processing` for stdout/stderr.
  5. From a non-git directory, run the same `doctor --json` command and
  confirm the Git check reports `repo detected: false` rather than
  warning.
  
  Targeted tests:
  
  - `cargo test -p codex-cli doctor`
  - `cargo test -p codex-cli`

  Felipe Coury · 2026-05-24 15:34:35 +00:00
  9f42c89c01