39 Commits

• [Auth] Choose which auth storage to use based on config (#5792)

  This PR is a follow-up to #5591. It allows users to choose which auth
  storage mode they want by using the new
  `cli_auth_credentials_store_mode` config.

  Celia Chen · 2025-10-27 19:41:49 -07:00
  4a42c4e142
• add(core): managed config (#3868)

  ## Summary
  
  - Factor `load_config_as_toml` into `core::config_loader` so config
  loading is reusable across callers.
  - Layer `~/.codex/config.toml`, optional `~/.codex/managed_config.toml`,
  and macOS managed preferences (base64) with recursive table merging and
  scoped threads per source.
  
  ## Config Flow
  
  ```
  Managed prefs (macOS profile: com.openai.codex/config_toml_base64)
                                 ▲
                                 │
  ~/.codex/managed_config.toml   │  (optional file-based override)
                                 ▲
                                 │
                  ~/.codex/config.toml (user-defined settings)
  ```
  
  - The loader searches under the resolved `CODEX_HOME` directory
  (defaults to `~/.codex`).
  - Managed configs let administrators ship fleet-wide overrides via
  device profiles which is useful for enforcing certain settings like
  sandbox or approval defaults.
  - For nested hash tables: overlays merge recursively. Child tables are
  merged key-by-key, while scalar or array values replace the prior layer
  entirely. This lets admins add or tweak individual fields without
  clobbering unrelated user settings.

  Fouad Matin · 2025-10-03 13:02:26 -07:00
  a5b7675e42
• Separate interactive and non-interactive sessions (#4612)

  Do not show exec session in VSCode/TUI selector.

  pakrym-oai · 2025-10-02 13:06:21 -07:00
  4c566d484a
• Support CODEX_API_KEY for codex exec (#4615)

  Allows to set API key per invocation of `codex exec`

  pakrym-oai · 2025-10-02 09:59:45 -07:00
  2f6fb37d72
• fix: remove mcp-types from app server protocol (#4537)

  We continue the separation between `codex app-server` and `codex
  mcp-server`.
  
  In particular, we introduce a new crate, `codex-app-server-protocol`,
  and migrate `codex-rs/protocol/src/mcp_protocol.rs` into it, renaming it
  `codex-rs/app-server-protocol/src/protocol.rs`.
  
  Because `ConversationId` was defined in `mcp_protocol.rs`, we move it
  into its own file, `codex-rs/protocol/src/conversation_id.rs`, and
  because it is referenced in a ton of places, we have to touch a lot of
  files as part of this PR.
  
  We also decide to get away from proper JSON-RPC 2.0 semantics, so we
  also introduce `codex-rs/app-server-protocol/src/jsonrpc_lite.rs`, which
  is basically the same `JSONRPCMessage` type defined in `mcp-types`
  except with all of the `"jsonrpc": "2.0"` removed.
  
  Getting rid of `"jsonrpc": "2.0"` makes our serialization logic
  considerably simpler, as we can lean heavier on serde to serialize
  directly into the wire format that we use now.

  Michael Bolin · 2025-10-01 02:16:26 +00:00
  5881c0d6d4
• fix: separate codex mcp into codex mcp-server and codex app-server (#4471)

  This is a very large PR with some non-backwards-compatible changes.
  
  Historically, `codex mcp` (or `codex mcp serve`) started a JSON-RPC-ish
  server that had two overlapping responsibilities:
  
  - Running an MCP server, providing some basic tool calls.
  - Running the app server used to power experiences such as the VS Code
  extension.
  
  This PR aims to separate these into distinct concepts:
  
  - `codex mcp-server` for the MCP server
  - `codex app-server` for the "application server"
  
  Note `codex mcp` still exists because it already has its own subcommands
  for MCP management (`list`, `add`, etc.)
  
  The MCP logic continues to live in `codex-rs/mcp-server` whereas the
  refactored app server logic is in the new `codex-rs/app-server` folder.
  Note that most of the existing integration tests in
  `codex-rs/mcp-server/tests/suite` were actually for the app server, so
  all the tests have been moved with the exception of
  `codex-rs/mcp-server/tests/suite/mod.rs`.
  
  Because this is already a large diff, I tried not to change more than I
  had to, so `codex-rs/app-server/tests/common/mcp_process.rs` still uses
  the name `McpProcess` for now, but I will do some mechanical renamings
  to things like `AppServer` in subsequent PRs.
  
  While `mcp-server` and `app-server` share some overlapping functionality
  (like reading streams of JSONL and dispatching based on message types)
  and some differences (completely different message types), I ended up
  doing a bit of copypasta between the two crates, as both have somewhat
  similar `message_processor.rs` and `outgoing_message.rs` files for now,
  though I expect them to diverge more in the near future.
  
  One material change is that of the initialize handshake for `codex
  app-server`, as we no longer use the MCP types for that handshake.
  Instead, we update `codex-rs/protocol/src/mcp_protocol.rs` to add an
  `Initialize` variant to `ClientRequest`, which takes the `ClientInfo`
  object we need to update the `USER_AGENT_SUFFIX` in
  `codex-rs/app-server/src/message_processor.rs`.
  
  One other material change is in
  `codex-rs/app-server/src/codex_message_processor.rs` where I eliminated
  a use of the `send_event_as_notification()` method I am generally trying
  to deprecate (because it blindly maps an `EventMsg` into a
  `JSONNotification`) in favor of `send_server_notification()`, which
  takes a `ServerNotification`, as that is intended to be a custom enum of
  all notification types supported by the app server. So to make this
  update, I had to introduce a new variant of `ServerNotification`,
  `SessionConfigured`, which is a non-backwards compatible change with the
  old `codex mcp`, and clients will have to be updated after the next
  release that contains this PR. Note that
  `codex-rs/app-server/tests/suite/list_resume.rs` also had to be update
  to reflect this change.
  
  I introduced `codex-rs/utils/json-to-toml/src/lib.rs` as a small utility
  crate to avoid some of the copying between `mcp-server` and
  `app-server`.

  Michael Bolin · 2025-09-30 07:06:18 +00:00
  d9dbf48828
• Switch to uuid_v7 and tighten ConversationId usage (#3819)

  Make sure conversations have a timestamp.

  pakrym-oai · 2025-09-18 14:37:03 +00:00
  d4aba772cb
• chore: enable clippy::redundant_clone (#3489)

  Created this PR by:
  
  - adding `redundant_clone` to `[workspace.lints.clippy]` in
  `cargo-rs/Cargol.toml`
  - running `cargo clippy --tests --fix`
  - running `just fmt`
  
  Though I had to clean up one instance of the following that resulted:
  
  ```rust
  let codex = codex;
  ```

  Michael Bolin · 2025-09-11 11:59:37 -07:00
  bec51f6c05
• Simplify auth flow and reconcile differences between ChatGPT and API Key auth (#3189)

  This PR does the following:
  * Adds the ability to paste or type an API key.
  * Removes the `preferred_auth_method` config option. The last login
  method is always persisted in auth.json, so this isn't needed.
  * If OPENAI_API_KEY env variable is defined, the value is used to
  prepopulate the new UI. The env variable is otherwise ignored by the
  CLI.
  * Adds a new MCP server entry point "login_api_key" so we can implement
  this same API key behavior for the VS Code extension.
  <img width="473" height="140" alt="Screenshot 2025-09-04 at 3 51 04 PM"
  src="https://github.com/user-attachments/assets/c11bbd5b-8a4d-4d71-90fd-34130460f9d9"
  />
  <img width="726" height="254" alt="Screenshot 2025-09-04 at 3 51 32 PM"
  src="https://github.com/user-attachments/assets/6cc76b34-309a-4387-acbc-15ee5c756db9"
  />

  Eric Traut · 2025-09-11 09:16:34 -07:00
  e13b35ecb0
• fix: ensure output of codex-rs/mcp-types/generate_mcp_types.py matches codex-rs/mcp-types/src/lib.rs (#3439)

  https://github.com/openai/codex/pull/3395 updated `mcp-types/src/lib.rs`
  by hand, but that file is generated code that is produced by
  `mcp-types/generate_mcp_types.py`. Unfortunately, we do not have
  anything in CI to verify this right now, but I will address that in a
  subsequent PR.
  
  #3395 ended up introducing a change that added a required field when
  deserializing `InitializeResult`, breaking Codex when used as an MCP
  client, so the quick fix in #3436 was to make the new field `Optional`
  with `skip_serializing_if = "Option::is_none"`, but that did not address
  the problem that `mcp-types/generate_mcp_types.py` and
  `mcp-types/src/lib.rs` are out of sync.
  
  This PR gets things back to where they are in sync. It removes the
  custom `mcp_types::McpClientInfo` type that was added to
  `mcp-types/src/lib.rs` and forces us to use the generated
  `mcp_types::Implementation` type. Though this PR also updates
  `generate_mcp_types.py` to generate the additional `user_agent:
  Optional<String>` field on `Implementation` so that we can continue to
  specify it when Codex operates as an MCP server.
  
  However, this also requires us to specify `user_agent: None` when Codex
  operates as an MCP client.
  
  We may want to introduce our own `InitializeResult` type that is
  specific to when we run as a server to avoid this in the future, but my
  immediate goal is just to get things back in sync.

  Michael Bolin · 2025-09-10 16:14:41 -07:00
  44262d8fd8
• Make user_agent optional (#3436)

  # External (non-OpenAI) Pull Request Requirements
  
  Currently, mcp server fail to start with:
  ```
  🖐  MCP client for `<CLIENT>` failed to start: missing field `user_agent`
  ````
  
  It isn't clear to me yet why this is happening. My understanding is that
  this struct is simply added as a new field to the response but this
  should fix it until I figure out the full story here.
  
  <img width="714" height="262" alt="CleanShot 2025-09-10 at 13 58 59"
  src="https://github.com/user-attachments/assets/946b1313-5c1c-43d3-8ae8-ecc3de3406fc"
  />

  Gabriel Peal · 2025-09-10 14:15:02 -07:00
  8d766088e6
• Set a user agent suffix when used as a mcp server (#3395)

  This automatically adds a user agent suffix whenever the CLI is used as
  a MCP server

  Gabriel Peal · 2025-09-10 02:32:57 +00:00
  8636bff46d
• Replace config.responses_originator_header_internal_override with CODEX_INTERNAL_ORIGINATOR_OVERRIDE_ENV_VAR (#3388)

  The previous config approach had a few issues:
  1. It is part of the config but not designed to be used externally
  2. It had to be wired through many places (look at the +/- on this PR
  3. It wasn't guaranteed to be set consistently everywhere because we
  don't have a super well defined way that configs stack. For example, the
  extension would configure during newConversation but anything that
  happened outside of that (like login) wouldn't get it.
  
  This env var approach is cleaner and also creates one less thing we have
  to deal with when coming up with a better holistic story around configs.
  
  One downside is that I removed the unit test testing for the override
  because I don't want to deal with setting the global env or spawning
  child processes and figuring out how to introspect their originator
  header. The new code is sufficiently simple and I tested it e2e that I
  feel as if this is still worth it.

  Gabriel Peal · 2025-09-09 17:23:23 -04:00
  5eab4c7ab4
• Use ConversationId instead of raw Uuids (#3282)

  We're trying to migrate from `session_id: Uuid` to `conversation_id:
  ConversationId`. Not only does this give us more type safety but it
  unifies our terminology across Codex and with the implementation of
  session resuming, a conversation (which can span multiple sessions) is
  more appropriate.
  
  I started this impl on https://github.com/openai/codex/pull/3219 as part
  of getting resume working in the extension but it's big enough that it
  should be broken out.

  Gabriel Peal · 2025-09-07 23:22:25 -04:00
  c8fab51372
• Add a common way to create HTTP client (#3110)

  Ensure User-Agent and originator are always sent.

  pakrym-oai · 2025-09-03 10:11:02 -07:00
  c636f821ae
• Move CodexAuth and AuthManager to the core crate (#3074)

  Fix a long standing layering issue.

  pakrym-oai · 2025-09-02 18:36:19 -07:00
  03e2796ca4
• Add AuthManager and enhance GetAuthStatus command (#2577)

  This PR adds a central `AuthManager` struct that manages the auth
  information used across conversations and the MCP server. Prior to this,
  each conversation and the MCP server got their own private snapshots of
  the auth information, and changes to one (such as a logout or token
  refresh) were not seen by others.
  
  This is especially problematic when multiple instances of the CLI are
  run. For example, consider the case where you start CLI 1 and log in to
  ChatGPT account X and then start CLI 2 and log out and then log in to
  ChatGPT account Y. The conversation in CLI 1 is still using account X,
  but if you create a new conversation, it will suddenly (and
  unexpectedly) switch to account Y.
  
  With the `AuthManager`, auth information is read from disk at the time
  the `ConversationManager` is constructed, and it is cached in memory.
  All new conversations use this same auth information, as do any token
  refreshes.
  
  The `AuthManager` is also used by the MCP server's GetAuthStatus
  command, which now returns the auth method currently used by the MCP
  server.
  
  This PR also includes an enhancement to the GetAuthStatus command. It
  now accepts two new (optional) input parameters: `include_token` and
  `refresh_token`. Callers can use this to request the in-use auth token
  and can optionally request to refresh the token.
  
  The PR also adds tests for the login and auth APIs that I recently added
  to the MCP server.

  Eric Traut · 2025-08-22 13:10:11 -07:00
  dc42ec0eb4
• Added new auth-related methods and events to mcp server (#2496)

  This PR adds the following:
  * A getAuthStatus method on the mcp server. This returns the auth method
  currently in use (chatgpt or apikey) or none if the user is not
  authenticated. It also returns the "preferred auth method" which
  reflects the `preferred_auth_method` value in the config.
  * A logout method on the mcp server. If called, it logs out the user and
  deletes the `auth.json` file — the same behavior in the cli's `/logout`
  command.
  * An `authStatusChange` event notification that is sent when the auth
  status changes due to successful login or logout operations.
  * Logic to pass command-line config overrides to the mcp server at
  startup time. This allows use cases like `codex mcp -c
  preferred_auth_method=apikey`.

  Eric Traut · 2025-08-20 20:36:34 -07:00
  dacff9675a
• chore: move mcp-server/src/wire_format.rs to protocol/src/mcp_protocol.rs (#2423)

  The existing `wire_format.rs` should share more types with the
  `codex-protocol` crate (like `AskForApproval` instead of maintaining a
  parallel `CodexToolCallApprovalPolicy` enum), so this PR moves
  `wire_format.rs` into `codex-protocol`, renaming it as
  `mcp-protocol.rs`. We also de-dupe types, where appropriate.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/2423).
  * #2424
  * __->__ #2423

  Michael Bolin · 2025-08-18 09:36:57 -07:00
  712bfa04ac
• remove mcp-server/src/mcp_protocol.rs and the code that depends on it (#2360)
  Michael Bolin · 2025-08-18 00:29:18 -07:00
  a269754668
• fix: add support for exec and apply_patch approvals in the new wire format (#2286)

  Now when `CodexMessageProcessor` receives either a
  `EventMsg::ApplyPatchApprovalRequest` or a
  `EventMsg::ExecApprovalRequest`, it sends the appropriate request from
  the server to the client. When it gets a response, it forwards it on to
  the `CodexConversation`.
  
  Note this takes a lot of code from:
  
  
  https://github.com/openai/codex/blob/main/codex-rs/mcp-server/src/conversation_loop.rs
  
  https://github.com/openai/codex/blob/main/codex-rs/mcp-server/src/exec_approval.rs
  
  https://github.com/openai/codex/blob/main/codex-rs/mcp-server/src/patch_approval.rs
  
  I am copy/pasting for now because I am trying to consolidate around the
  new `wire_format.rs`, so I plan to delete these other files soon.
  
  Now that we have requests going both from client-to-server and
  server-to-client, I renamed `CodexRequest` to `ClientRequest`.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/2286).
  * #2287
  * __->__ #2286
  * #2285

  Michael Bolin · 2025-08-13 23:00:50 -07:00
  539f4b290e
• feat: support traditional JSON-RPC request/response in MCP server (#2264)

  This introduces a new set of request types that our `codex mcp`
  supports. Note that these do not conform to MCP tool calls so that
  instead of having to send something like this:
  
  ```json
  {
    "jsonrpc": "2.0",
    "method": "tools/call",
    "id": 42,
    "params": {
      "name": "newConversation",
      "arguments": {
        "model": "gpt-5",
        "approvalPolicy": "on-request"
      }
    }
  }
  ```
  
  we can send something like this:
  
  
  ```json
  {
    "jsonrpc": "2.0",
    "method": "newConversation",
    "id": 42,
    "params": {
      "model": "gpt-5",
      "approvalPolicy": "on-request"
    }
  }
  ```
  
  Admittedly, this new format is not a valid MCP tool call, but we are OK
  with that right now. (That is, not everything we might want to request
  of `codex mcp` is something that is appropriate for an autonomous agent
  to do.)
  
  To start, this introduces four request types:
  
  - `newConversation`
  - `sendUserMessage`
  - `addConversationListener`
  - `removeConversationListener`
  
  The new `mcp-server/tests/codex_message_processor_flow.rs` shows how
  these can be used.
  
  The types are defined on the `CodexRequest` enum, so we introduce a new
  `CodexMessageProcessor` that is responsible for dealing with requests
  from this enum. The top-level `MessageProcessor` has been updated so
  that when `process_request()` is called, it first checks whether the
  request conforms to `CodexRequest` and dispatches it to
  `CodexMessageProcessor` if so.
  
  Note that I also decided to use `camelCase` for the on-the-wire format,
  as that seems to be the convention for MCP.
  
  For the moment, the new protocol is defined in `wire_format.rs` within
  the `mcp-server` crate, but in a subsequent PR, I will probably move it
  to its own crate to ensure the protocol has minimal dependencies and
  that we can codegen a schema from it.
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/2264).
  * #2278
  * __->__ #2264

  Michael Bolin · 2025-08-13 17:36:29 -07:00
  e7bad650ff
• fix: update OutgoingMessageSender::send_response() to take Serialize (#2263)

  This makes `send_response()` easier to work with.

  Michael Bolin · 2025-08-13 14:29:13 -07:00
  37fc4185ef
• chore: introduce ConversationManager as a clearinghouse for all conversations (#2240)

  This PR does two things because after I got deep into the first one I
  started pulling on the thread to the second:
  
  - Makes `ConversationManager` the place where all in-memory
  conversations are created and stored. Previously, `MessageProcessor` in
  the `codex-mcp-server` crate was doing this via its `session_map`, but
  this is something that should be done in `codex-core`.
  - It unwinds the `ctrl_c: tokio::sync::Notify` that was threaded
  throughout our code. I think this made sense at one time, but now that
  we handle Ctrl-C within the TUI and have a proper `Op::Interrupt` event,
  I don't think this was quite right, so I removed it. For `codex exec`
  and `codex proto`, we now use `tokio::signal::ctrl_c()` directly, but we
  no longer make `Notify` a field of `Codex` or `CodexConversation`.
  
  Changes of note:
  
  - Adds the files `conversation_manager.rs` and `codex_conversation.rs`
  to `codex-core`.
  - `Codex` and `CodexSpawnOk` are no longer exported from `codex-core`:
  other crates must use `CodexConversation` instead (which is created via
  `ConversationManager`).
  - `core/src/codex_wrapper.rs` has been deleted in favor of
  `ConversationManager`.
  - `ConversationManager::new_conversation()` returns `NewConversation`,
  which is in line with the `new_conversation` tool we want to add to the
  MCP server. Note `NewConversation` includes `SessionConfiguredEvent`, so
  we eliminate checks in cases like `codex-rs/core/tests/client.rs` to
  verify `SessionConfiguredEvent` is the first event because that is now
  internal to `ConversationManager`.
  - Quite a bit of code was deleted from
  `codex-rs/mcp-server/src/message_processor.rs` since it no longer has to
  manage multiple conversations itself: it goes through
  `ConversationManager` instead.
  - `core/tests/live_agent.rs` has been deleted because I had to update a
  bunch of tests and all the tests in here were ignored, and I don't think
  anyone ever ran them, so this was just technical debt, at this point.
  - Removed `notify_on_sigint()` from `util.rs` (and in a follow-up, I
  hope to refactor the blandly-named `util.rs` into more descriptive
  files).
  - In general, I started replacing local variables named `codex` as
  `conversation`, where appropriate, though admittedly I didn't do it
  through all the integration tests because that would have added a lot of
  noise to this PR.
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/2240).
  * #2264
  * #2263
  * __->__ #2240

  Michael Bolin · 2025-08-13 13:38:18 -07:00
  08ed618f72
• MCP: add conversation.create tool [Stack 2/2] (#1783)

  Introduce conversation.create handler (handle_create_conversation) and
  wire it in MessageProcessor.
  
  Stack:
  Top: #1783 
  Bottom: #1784
  
  ---------
  
  Co-authored-by: Gabriel Peal <gpeal@users.noreply.github.com>

  aibrahim-oai · 2025-08-01 22:18:36 +00:00
  97ab8fb610
• Introduce a new function to just send user message [Stack 3/3] (#1686)

  - MCP server: add send-user-message tool to send user input to a running
  Codex session
  - Added an integration tests for the happy and sad paths
  
  Changes:
  •	Add tool definition and schema.
  •	Expose tool in capabilities.
  •	Route and handle tool requests with validation.
  •	Tests for success, bad UUID, and missing session.
  
  
  follow‑ups
  • Listen path not implemented yet; the tool is present but marked “don’t
  use yet” in code comments.
  • Session run flag reset: clear running_session_id_set appropriately
  after turn completion/errors.
  
  This is the third PR in a stack.
  Stack:
  Final: #1686
  Intermediate: #1751
  First: #1750

  aibrahim-oai · 2025-08-01 17:04:12 +00:00
  f918198bbb
• MCP server: route structured tool-call requests and expose mcp_protocol [Stack 2/3] (#1751)

  - Expose mcp_protocol from mcp-server for reuse in tests and callers.
  - In MessageProcessor, detect structured ToolCallRequestParams in
  tools/call and forward to a new handler.
  - Add handle_new_tool_calls scaffold (returns error for now).
  - Test helper: add send_send_user_message_tool_call to McpProcess to
  send ConversationSendMessage requests;
  
  This is the second PR in a stack.
  Stack:
  Final: #1686
  Intermediate: #1751
  First: #1750

  aibrahim-oai · 2025-08-01 02:46:04 +00:00
  ad0295b893
• Adding interrupt Support to MCP (#1646)
  aibrahim-oai · 2025-07-22 20:33:49 +00:00
  01c0896f0f
• [mcp-server] Add reply tool call (#1643)

  ## Summary
  Adds a new mcp tool call, `codex-reply`, so we can continue existing
  sessions. This is a first draft and does not yet support sessions from
  previous processes.
  
  ## Testing
  - [x] tested with mcp client

  Dylan · 2025-07-21 21:01:56 -07:00
  18b2b30841
• test: add integration test for MCP server (#1633)

  This PR introduces a single integration test for `cargo mcp`, though it
  also introduces a number of reusable components so that it should be
  easier to introduce more integration tests going forward.
  
  The new test is introduced in `codex-rs/mcp-server/tests/elicitation.rs`
  and the reusable pieces are in `codex-rs/mcp-server/tests/common`.
  
  The test itself verifies new functionality around elicitations
  introduced in https://github.com/openai/codex/pull/1623 (and the fix
  introduced in https://github.com/openai/codex/pull/1629) by doing the
  following:
  
  - starts a mock model provider with canned responses for
  `/v1/chat/completions`
  - starts the MCP server with a `config.toml` to use that model provider
  (and `approval_policy = "untrusted"`)
  - sends the `codex` tool call which causes the mock model provider to
  request a shell call for `git init`
  - the MCP server sends an elicitation to the client to approve the
  request
  - the client replies to the elicitation with `"approved"`
  - the MCP server runs the command and re-samples the model, getting a
  `"finish_reason": "stop"`
  - in turn, the MCP server sends the final response to the original
  `codex` tool call
  - verifies that `git init` ran as expected
  
  To test:
  
  ```
  cargo test shell_command_approval_triggers_elicitation
  ```
  
  In writing this test, I discovered that `ExecApprovalResponse` does not
  conform to `ElicitResult`, so I added a TODO to fix that, since I think
  that should be updated in a separate PR. As it stands, this PR does not
  update any business logic, though it does make a number of members of
  the `mcp-server` crate `pub` so they can be used in the test.
  
  One additional learning from this PR is that
  `std::process::Command::cargo_bin()` from the `assert_cmd` trait is only
  available for `std::process::Command`, but we really want to use
  `tokio::process::Command` so that everything is async and we can
  leverage utilities like `tokio::time::timeout()`. The trick I came up
  with was to use `cargo_bin()` to locate the program, and then to use
  `std::process::Command::get_program()` when constructing the
  `tokio::process::Command`.

  Michael Bolin · 2025-07-21 10:27:07 -07:00
  d49d802b06
• fix: address review feedback on #1621 and #1623 (#1631)

  - formalizes `ExecApprovalElicitRequestParams`
  - adds some defensive logic when messages fail to parse
  - fixes a typo in a comment

  Michael Bolin · 2025-07-20 14:42:11 -07:00
  8a6c6cee88
• feat: leverage elicitations in the MCP server (#1623)

  This updates the MCP server so that if it receives an
  `ExecApprovalRequest` from the `Codex` session, it in turn sends an [MCP
  elicitation](https://modelcontextprotocol.io/specification/draft/client/elicitation)
  to the client to ask for the approval decision. Upon getting a response,
  it forwards the client's decision via `Op::ExecApproval`.
  
  Admittedly, we should be doing the same thing for
  `ApplyPatchApprovalRequest`, but this is our first time experimenting
  with elicitations, so I'm inclined to defer wiring that code path up
  until we feel good about how this one works.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/1623).
  * __->__ #1623
  * #1622
  * #1621
  * #1620

  Michael Bolin · 2025-07-19 01:32:03 -04:00
  018003e52f
• chore: introduce OutgoingMessageSender (#1622)

  Previous to this change, `MessageProcessor` had a
  `tokio::sync::mpsc::Sender<JSONRPCMessage>` as an abstraction for server
  code to send a message down to the MCP client. Because `Sender` is cheap
  to `clone()`, it was straightforward to make it available to tasks
  scheduled with `tokio::task::spawn()`.
  
  This worked well when we were only sending notifications or responses
  back down to the client, but we want to add support for sending
  elicitations in #1623, which means that we need to be able to send
  _requests_ to the client, and now we need a bit of centralization to
  ensure all request ids are unique.
  
  To that end, this PR introduces `OutgoingMessageSender`, which houses
  the existing `Sender<OutgoingMessage>` as well as an `AtomicI64` to mint
  out new, unique request ids. It has methods like `send_request()` and
  `send_response()` so that callers do not have to deal with
  `JSONRPCMessage` directly, as having to set the `jsonrpc` for each
  message was a bit tedious (this cleans up `codex_tool_runner.rs` quite a
  bit).
  
  We do not have `OutgoingMessageSender` implement `Clone` because it is
  important that the `AtomicI64` is shared across all users of
  `OutgoingMessageSender`. As such, `Arc<OutgoingMessageSender>` must be
  used instead, as it is frequently shared with new tokio tasks.
  
  As part of this change, we update `message_processor.rs` to embrace
  `await`, though we must be careful that no individual handler blocks the
  main loop and prevents other messages from being handled.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/1622).
  * #1623
  * __->__ #1622
  * #1621
  * #1620

  Michael Bolin · 2025-07-19 00:30:56 -04:00
  11fd3123be
• chore: support MCP schema 2025-06-18 (#1621)

  This updates the schema in `generate_mcp_types.py` from `2025-03-26` to
  `2025-06-18`, regenerates `mcp-types/src/lib.rs`, and then updates all
  the code that uses `mcp-types` to honor the changes.
  
  Ran
  
  ```
  npx @modelcontextprotocol/inspector just codex mcp
  ```
  
  and verified that I was able to invoke the `codex` tool, as expected.
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/1621).
  * #1623
  * #1622
  * __->__ #1621

  Michael Bolin · 2025-07-19 00:09:34 -04:00
  e78ec00e73
• feat: add codex_linux_sandbox_exe: Option<PathBuf> field to Config (#1089)

  https://github.com/openai/codex/pull/1086 is a work-in-progress to make
  Linux sandboxing work more like Seatbelt where, for the command we want
  to sandbox, we build up the command and then hand it, and some sandbox
  configuration flags, to another command to set up the sandbox and then
  run it.
  
  In the case of Seatbelt, macOS provides this helper binary and provides
  it at `/usr/bin/sandbox-exec`. For Linux, we have to build our own and
  pass it through (which is what #1086 does), so this makes the new
  `codex_linux_sandbox_exe` available on `Config` so that it will later be
  available in `exec.rs` when we need it in #1086.

  Michael Bolin · 2025-05-22 21:52:28 -07:00
  d1de7bb383
• Workspace lints and disallow unwrap (#855)

  Sets submodules to use workspace lints. Added denying unwrap as a
  workspace level lint, which found a couple of cases where we could have
  propagated errors. Also manually labeled ones that were fine by my eye.

  jcoens-openai · 2025-05-08 09:46:18 -07:00
  87cf120873
• Update cargo to 2024 edition (#842)

  Some effects of this change:
  - New formatting changes across many files. No functionality changes
  should occur from that.
  - Calls to `set_env` are considered unsafe, since this only happens in
  tests we wrap them in `unsafe` blocks

  jcoens-openai · 2025-05-07 08:37:48 -07:00
  8a89d3aeda
• feat: make Codex available as a tool when running it as an MCP server (#811)

  This PR replaces the placeholder `"echo"` tool call in the MCP server
  with a `"codex"` tool that calls Codex. Events such as
  `ExecApprovalRequest` and `ApplyPatchApprovalRequest` are not handled
  properly yet, but I have `approval_policy = "never"` set in my
  `~/.codex/config.toml` such that those codepaths are not exercised.
  
  The schema for this MPC tool is defined by a new `CodexToolCallParam`
  struct introduced in this PR. It is fairly similar to `ConfigOverrides`,
  as the param is used to help create the `Config` used to start the Codex
  session, though it also includes the `prompt` used to kick off the
  session.
  
  This PR also introduces the use of the third-party `schemars` crate to
  generate the JSON schema, which is verified in the
  `verify_codex_tool_json_schema()` unit test.
  
  Events that are dispatched during the Codex session are sent back to the
  MCP client as MCP notifications. This gives the client a way to monitor
  progress as the tool call itself may take minutes to complete depending
  on the complexity of the task requested by the user.
  
  In the video below, I launched the server via:
  
  ```shell
  mcp-server$ RUST_LOG=debug npx @modelcontextprotocol/inspector cargo run --
  ```
  
  In the video, you can see the flow of:
  
  * requesting the list of tools
  * choosing the **codex** tool
  * entering a value for **prompt** and then making the tool call
  
  Note that I left the other fields blank because when unspecified, the
  values in my `~/.codex/config.toml` were used:
  
  
  https://github.com/user-attachments/assets/1975058c-b004-43ef-8c8d-800a953b8192
  
  Note that while using the inspector, I did run into
  https://github.com/modelcontextprotocol/inspector/issues/293, though the
  tip about ensuring I had only one instance of the **MCP Inspector** tab
  open in my browser seemed to fix things.

  Michael Bolin · 2025-05-05 07:16:19 -07:00
  2b72d05c5e
• feat: introduce mcp-server crate (#792)

  This introduces the `mcp-server` crate, which contains a barebones MCP
  server that provides an `echo` tool that echoes the user's request back
  to them.
  
  To test it out, I launched
  [modelcontextprotocol/inspector](https://github.com/modelcontextprotocol/inspector)
  like so:
  
  ```
  mcp-server$ npx @modelcontextprotocol/inspector cargo run --
  ```
  
  and opened up `http://127.0.0.1:6274` in my browser:
  
  
  ![image](https://github.com/user-attachments/assets/83fc55d4-25c2-4497-80cd-e9702283ff93)
  
  I also had to make a small fix to `mcp-types`, adding
  `#[serde(untagged)]` to a number of `enum`s.

  Michael Bolin · 2025-05-02 17:25:58 -07:00
  21cd953dbd