1515 Commits

• fixing localshell tool calls (#6823)

  - Local-shell tool responses were always tagged as
  `ExecCommandSource::UserShell` because handler would call
  `run_exec_like` with `is_user_shell_cmd` set to true.
  - Treat `ToolPayload::LocalShell` the same as other model generated
  shell tool calls by deleting `is_user_shell_cmd` from `run_exec_like`
  (since actual user shell commands follow a separate code path)

  zhao-oai · 2025-11-18 17:28:26 +00:00
  e9e644a119
• feat: enable parallel tool calls (#6796)
  jif-oai · 2025-11-18 17:10:14 +00:00
  f5d9939cda
• feat: remote compaction (#6795)

  Co-authored-by: pakrym-oai <pakrym@openai.com>

  jif-oai · 2025-11-18 16:51:16 +00:00
  838531d3e4
• nit: app server (#6830)
  jif-oai · 2025-11-18 16:34:13 +00:00
  0eb2e6f9ee
• nit: mark ghost commit as stable (#6833)
  jif-oai · 2025-11-18 16:05:49 +00:00
  c20df79a38
• feat: git branch tooling (#6831)
  jif-oai · 2025-11-18 15:26:09 +00:00
  fc55fd7a81
• 🐛 fix(rmcp-client): refresh OAuth tokens using expires_at (#6574)

  ## Summary
  - persist OAuth credential expiry timestamps and rehydrate `expires_in`
  - proactively refresh rmcp OAuth tokens when `expires_at` is near, then
  persist
  
  ## Testing
  - just fmt
  - just fix -p codex-rmcp-client
  - cargo test -p codex-rmcp-client
  
  Fixes #6572

  Lael · 2025-11-18 02:16:58 -05:00
  f3d4e210d8
• fix(windows) shell_command on windows, minor parsing (#6811)

  ## Summary
  Enables shell_command for windows users, and starts adding some basic
  command parsing here, to at least remove powershell prefixes. We'll
  follow this up with command parsing but I wanted to land this change
  separately with some basic UX.
  
  **NOTE**: This implementation parses bash and powershell on both
  platforms. In theory this is possible, since you can use git bash on
  windows or powershell on linux. In practice, this may not be worth the
  complexity of supporting, so I don't feel strongly about the current
  approach vs. platform-specific branching.
  
  ## Testing
  - [x] Added a bunch of tests 
  - [x] Ran on both windows and os x

  Dylan Hurd · 2025-11-17 22:23:53 -08:00
  28ebe1c97a
• chore(core) Add shell_serialization coverage (#6810)

  ## Summary
  Similar to #6545, this PR updates the shell_serialization test suite to
  cover the various `shell` tool invocations we have. Note that this does
  not cover unified_exec, which has its own suite of tests. This should
  provide some test coverage for when we eventually consolidate
  serialization logic.
  
  ## Testing
  - [x] These are tests

  Dylan Hurd · 2025-11-17 19:10:56 -08:00
  2b7378ac77
• Update defaults to gpt-5.1 (#6652)

  ## Summary
  - update documentation, example configs, and automation defaults to
  reference gpt-5.1 / gpt-5.1-codex
  - bump the CLI and core configuration defaults, model presets, and error
  messaging to the new models while keeping the model-family/tool coverage
  for legacy slugs
  - refresh tests, fixtures, and TUI snapshots so they expect the upgraded
  defaults
  
  ## Testing
  - `cargo test -p codex-core
  config::tests::test_precedence_fixture_with_gpt5_profile`
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6916c5b3c2b08321ace04ee38604fc6b)

  Ahmed Ibrahim · 2025-11-17 17:40:11 -08:00
  ddcc60a085
• Demote function call payload log to debug to avoid noisy error-level stderr (#6808)
  cassirer-openai · 2025-11-18 01:16:11 +00:00
  8465f1f2f4
• execpolicy2 extension (#6627)

  - enabling execpolicy2 parser to parse multiple policy files to build a
  combined `Policy` (useful if codex detects many `.codexpolicy` files)
  - adding functionality to `Policy` to allow evaluation of multiple cmds
  at once (useful when we have chained commands)

  zhao-oai · 2025-11-17 16:44:41 -08:00
  7ab45487dd
• [app-server] feat: add v2 command execution approval flow (#6758)

  This PR adds the API V2 version of the command‑execution approval flow
  for the shell tool.
  
  This PR wires the new RPC (`item/commandExecution/requestApproval`, V2
  only) and related events (`item/started`, `item/completed`, and
  `item/commandExecution/delta`, which are emitted in both V1 and V2)
  through the app-server
  protocol. The new approval RPC is only sent when the user initiates a
  turn with the new `turn/start` API so we don't break backwards
  compatibility with VSCE.
  
  The approach I took was to make as few changes to the Codex core as
  possible, leveraging existing `EventMsg` core events, and translating
  those in app-server. I did have to add additional fields to
  `EventMsg::ExecCommandEndEvent` to capture the command's input so that
  app-server can statelessly transform these events to a
  `ThreadItem::CommandExecution` item for the `item/completed` event.
  
  Once we stabilize the API and it's complete enough for our partners, we
  can work on migrating the core to be aware of command execution items as
  a first-class concept.
  
  **Note**: We'll need followup work to make sure these APIs work for the
  unified exec tool, but will wait til that's stable and landed before
  doing a pass on app-server.
  
  Example payloads below:
  ```
  {
    "method": "item/started",
    "params": {
      "item": {
        "aggregatedOutput": null,
        "command": "/bin/zsh -lc 'touch /tmp/should-trigger-approval'",
        "cwd": "/Users/owen/repos/codex/codex-rs",
        "durationMs": null,
        "exitCode": null,
        "id": "call_lNWWsbXl1e47qNaYjFRs0dyU",
        "parsedCmd": [
          {
            "cmd": "touch /tmp/should-trigger-approval",
            "type": "unknown"
          }
        ],
        "status": "inProgress",
        "type": "commandExecution"
      }
    }
  }
  ```
  
  ```
  {
    "id": 0,
    "method": "item/commandExecution/requestApproval",
    "params": {
      "itemId": "call_lNWWsbXl1e47qNaYjFRs0dyU",
      "parsedCmd": [
        {
          "cmd": "touch /tmp/should-trigger-approval",
          "type": "unknown"
        }
      ],
      "reason": "Need to create file in /tmp which is outside workspace sandbox",
      "risk": null,
      "threadId": "019a93e8-0a52-7fe3-9808-b6bc40c0989a",
      "turnId": "1"
    }
  }
  ```
  
  ```
  {
    "id": 0,
    "result": {
      "acceptSettings": {
        "forSession": false
      },
      "decision": "accept"
    }
  }
  ```
  
  ```
  {
    "params": {
      "item": {
        "aggregatedOutput": null,
        "command": "/bin/zsh -lc 'touch /tmp/should-trigger-approval'",
        "cwd": "/Users/owen/repos/codex/codex-rs",
        "durationMs": 224,
        "exitCode": 0,
        "id": "call_lNWWsbXl1e47qNaYjFRs0dyU",
        "parsedCmd": [
          {
            "cmd": "touch /tmp/should-trigger-approval",
            "type": "unknown"
          }
        ],
        "status": "completed",
        "type": "commandExecution"
      }
    }
  }
  ```

  Owen Lin · 2025-11-18 00:23:54 +00:00
  cecbd5b021
• background rate limits fetch (#6789)

  fetching rate limits every minute asynchronously

  zhao-oai · 2025-11-17 16:06:26 -08:00
  4000e26303
• move cap_sid file into ~/.codex so the sandbox cannot overwrite it (#6798)

  The `cap_sid` file contains the IDs of the two custom SIDs that the
  Windows sandbox creates/manages to implement read-only and
  workspace-write sandbox policies.
  
  It previously lived in `<cwd>/.codex` which means that the sandbox could
  write to it, which could degrade the efficacy of the sandbox. This
  change moves it to `~/.codex/` (or wherever `CODEX_HOME` points to) so
  that it is outside the workspace.

  iceweasel-oai · 2025-11-17 15:49:41 -08:00
  e032d338f2
• Fix TUI issues with Alt-Gr on Windows (#6799)

  This PR fixes keyboard handling for the Right Alt (aka "Alt-Gr") key on
  Windows. This key appears on keyboards in Central and Eastern Europe.
  Codex has effectively never worked for Windows users in these regions
  because the code didn't properly handle this key, which is used for
  typing common symbols like `\` and `@`.
  
  A few days ago, I merged a [community-authored
  PR](https://github.com/openai/codex/pull/6720) that supplied a partial
  fix for this issue. Upon closer inspect, that PR was 1) too broad (not
  scoped to Windows only) and 2) incomplete (didn't fix all relevant code
  paths, so paste was still broken).
  
  This improvement is based on another [community-provided
  PR](https://github.com/openai/codex/pull/3241) by @marektomas-cz. He
  submitted it back in September and later closed it because it didn't
  receive any attention.
  
  This fix addresses the following bugs: #5922, #3046, #3092, #3519,
  #5684, #5843.

  Eric Traut · 2025-11-17 15:18:16 -08:00
  8bebe86a47
• core: add a feature to disable the shell tool (#6481)

  `--disable shell_tool` disables the built-in shell tool. This is useful
  for MCP-only operation.
  
  ---------
  
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  Jeremy Rose · 2025-11-17 22:56:19 +00:00
  ab2e7499f8
• chore(core) Update shell instructions (#6679)

  ## Summary
  Consolidates `shell` and `shell_command` tool instructions.
  ## Testing 
  - [x] Updated tests, tested locally

  Dylan Hurd · 2025-11-17 13:05:15 -08:00
  daf77b8452
• fix: annotate all app server v2 types with camelCase (#6791)
  Owen Lin · 2025-11-17 12:02:52 -08:00
  03a6e853c0
• LM Studio OSS Support (#2312)

  ## Overview
  
  Adds LM Studio OSS support. Closes #1883
  
  
  ### Changes
  This PR enhances the behavior of `--oss` flag to support LM Studio as a
  provider. Additionally, it introduces a new flag`--local-provider` which
  can take in `lmstudio` or `ollama` as values if the user wants to
  explicitly choose which one to use.
  
  If no provider is specified `codex --oss` will auto-select the provider
  based on whichever is running.
  
  #### Additional enhancements 
  The default can be set using `oss-provider` in config like:
  
  ```
  oss_provider = "lmstudio"
  ```
  
  For non-interactive users, they will need to either provide the provider
  as an arg or have it in their `config.toml`
  
  ### Notes
  For best performance, [set the default context
  length](https://lmstudio.ai/docs/app/advanced/per-model) for gpt-oss to
  the maximum your machine can support
  
  ---------
  
  Co-authored-by: Matt Clayton <matt@lmstudio.ai>
  Co-authored-by: Eric Traut <etraut@openai.com>

  rugvedS07 · 2025-11-17 11:49:09 -08:00
  837bc98a1d
• [app-server] add events to readme (#6690)

  add table of contents, lifecycle and events to readme.

  Celia Chen · 2025-11-17 19:28:05 +00:00
  842a1b7fe7
• core/tui: non-blocking MCP startup (#6334)

  This makes MCP startup not block TUI startup. Messages sent while MCPs
  are booting will be queued.
  
  
  https://github.com/user-attachments/assets/96e1d234-5d8f-4932-a935-a675d35c05e0
  
  
  Fixes #6317
  
  ---------
  
  Co-authored-by: pakrym-oai <pakrym@openai.com>

  Jeremy Rose · 2025-11-17 11:26:11 -08:00
  03ffe4d595
• chore: delete chatwidget::tests::binary_size_transcript_snapshot tui test (#6759)

  We're running into quite a bit of drag maintaining this test, since
  every time we add fields to an EventMsg that happened to be dumped into
  the `binary-size-log.jsonl` fixture, this test starts to fail. The fix
  is usually to either manually update the `binary-size-log.jsonl` fixture
  file, or update the `upgrade_event_payload_for_tests` function to map
  the data in that file into something workable.
  
  Eason says it's fine to delete this test, so let's just delete it

  Owen Lin · 2025-11-17 11:11:41 -08:00
  ae2a084fae
• feat: execpolicy v2 (#6467)

  ## Summary
  - Introduces the `codex-execpolicy2` crate.
  - This PR covers only the prefix-rule subset of the planned execpolicy
  v2 language; a richer language will follow.
  
  ## Policy
  - Policy language centers on `prefix_rule(pattern=[...], decision?,
  match?, not_match?)`, where `pattern` is an ordered list of tokens; any
  element may be a list to denote alternatives. `decision` defaults to
  `allow`; valid values are `allow`, `prompt`, and `forbidden`. `match` /
  `not_match` hold example commands that are tokenized and validated at
  load time (think of these as unit tests).
  
  ## Policy shapes
  - Prefix rules use Starlark syntax:
  ```starlark
  prefix_rule(
      pattern = ["cmd", ["alt1", "alt2"]], # ordered tokens; list entries denote alternatives
      decision = "prompt",                # allow | prompt | forbidden; defaults to allow
      match = [["cmd", "alt1"]],          # examples that must match this rule (enforced at compile time)
      not_match = [["cmd", "oops"]],      # examples that must not match this rule (enforced at compile time)
  )
  ```
  
  ## Response shapes
  - Match:
  
  ```json
  {
    "match": {
      "decision": "allow|prompt|forbidden",
      "matchedRules": [
        {
          "prefixRuleMatch": {
            "matchedPrefix": ["<token>", "..."],
            "decision": "allow|prompt|forbidden"
          }
        }
      ]
    }
  }
  ```
  
  - No match:
  
  ```json
  "noMatch"
  ```
  
  - `matchedRules` lists every rule whose prefix matched the command;
  `matchedPrefix` is the exact prefix that matched.
  - The effective `decision` is the strictest severity across all matches
  (`forbidden` > `prompt` > `allow`).
  
  ---------
  
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  zhao-oai · 2025-11-17 10:15:45 -08:00
  a941ae7632
• feat: placeholder for image that can't be decoded to prevent 400 (#6773)
  jif-oai · 2025-11-17 16:10:53 +00:00
  7c8d333980
• fix(core) serialize shell_command (#6744)

  ## Summary
  Ensures we're serializing calls to `shell_command`
  
  ## Testing
  - [x] Added unit test

  Dylan Hurd · 2025-11-16 23:16:51 -08:00
  497fb4a19c
• Fix FreeBSD/OpenBSD builds: target-specific keyring features and BSD hardening (#6680)

  ## Summary
  Builds on FreeBSD and OpenBSD were failing due to globally enabled
  Linux-specific keyring features and hardening code paths not gated by
  OS. This PR scopes keyring native backends to the
  appropriate targets, disables default features at the workspace root,
  and adds a BSD-specific hardening function. Linux/macOS/Windows behavior
  remains unchanged, while FreeBSD/OpenBSD
    now build and run with a supported backend.
  
  ## Key Changes
  
    - Keyring features:
  - Disable keyring default features at the workspace root to avoid
  pulling Linux backends on non-Linux.
  - Move native backend features into target-specific sections in the
  affected crates:
            - Linux: linux-native-async-persistent
            - macOS: apple-native
            - Windows: windows-native
            - FreeBSD/OpenBSD: sync-secret-service
    - Process hardening:
        - Add pre_main_hardening_bsd() for FreeBSD/OpenBSD, applying:
            - Set RLIMIT_CORE to 0
            - Clear LD_* environment variables
  - Simplify process-hardening Cargo deps to unconditional libc (avoid
  conflicting OS fragments).
    - No changes to CODEX_SANDBOX_* behavior.
  
  ## Rationale
  
  - Previously, enabling keyring native backends globally pulled
  Linux-only features on BSD, causing build errors.
  - Hardening logic was tailored for Linux/macOS; BSD builds lacked a
  gated path with equivalent safeguards.
  - Target-scoped features and BSD hardening make the crates portable
  across these OSes without affecting existing behavior elsewhere.
  
  ## Impact by Platform
  
    - Linux: No functional change; backends now selected via target cfg.
    - macOS: No functional change; explicit apple-native mapping.
    - Windows: No functional change; explicit windows-native mapping.
  - FreeBSD/OpenBSD: Builds succeed using sync-secret-service; BSD
  hardening applied during startup.
  
  ## Testing
  
  - Verified compilation across affected crates with target-specific
  features.
  - Smoke-checked that Linux/macOS/Windows feature sets remain identical
  functionally after scoping.
  - On BSD, confirmed keyring resolves to sync-secret-service and
  hardening compiles.
  
  ## Risks / Compatibility
  
    - Minimal risk: only feature scoping and OS-gated additions.
  - No public API changes in the crates; runtime behavior on non-BSD
  platforms is preserved.
  - On BSD, the new hardening clears LD_*; this is consistent with
  security posture on other Unix platforms.
  
  ## Reviewer Notes
  
  - Pay attention to target-specific sections for keyring in the affected
  Cargo.toml files.
  - Confirm pre_main_hardening_bsd() mirrors the safe subset of
  Linux/macOS hardening without introducing Linux-only calls.
  - Confirm no references to CODEX_SANDBOX_ENV_VAR or
  CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR were added/modified.
  
  ## Checklist
  
    - Disable keyring default features at workspace root.
  - Target-specific keyring features mapped per OS
  (Linux/macOS/Windows/BSD).
    - Add BSD hardening (RLIMIT_CORE=0, clear LD_*).
    - Simplify process-hardening dependencies to unconditional libc.
    - No changes to sandbox env var code.
    - Formatting and linting: just fmt + just fix -p for changed crates.
    - Project tests pass for changed crates; broader suite unchanged.
  
  ---------
  
  Co-authored-by: celia-oai <celia@openai.com>

  Xiao-Yong Jin · 2025-11-17 05:07:34 +00:00
  5860481bc4
• Fix: Claude models return incomplete responses due to empty finish_reason handling (#6728)

  ## Summary
  Fixes streaming issue where Claude models return only 1-4 characters
  instead of full responses when used through certain API
  providers/proxies.
  
  ## Environment
  - **OS**: Windows
  - **Models affected**: Claude models (e.g., claude-haiku-4-5-20251001)
  - **API Provider**: AAAI API proxy (https://api.aaai.vip/v1)
  - **Working models**: GLM, Google models work correctly
  
  ## Problem
  When using Claude models in both TUI and exec modes, only 1-4 characters
  are displayed despite the backend receiving the full response. Debug
  logs revealed that some API providers send SSE chunks with an empty
  string finish_reason during active streaming, rather than null or
  omitting the field entirely.
  
  The current code treats any non-null finish_reason as a termination
  signal, causing the stream to exit prematurely after the first chunk.
  The problematic chunks contain finish_reason with an empty string
  instead of null.
  
  ## Solution
  Fix empty finish_reason handling in chat_completions.rs by adding a
  check to only process non-empty finish_reason values. This ensures empty
  strings are ignored and streaming continues normally.
  
  ## Testing
  - Tested on Windows with Claude Haiku model via AAAI API proxy
  - Full responses now received and displayed correctly in both TUI and
  exec modes
  - Other models (GLM, Google) continue to work as expected
  - No regression in existing functionality
  
  ## Impact
  - Improves compatibility with API providers that send empty
  finish_reason during streaming
  - Enables Claude models to work correctly in Windows environment
  - No breaking changes to existing functionality
  
  ## Related Issues
  This fix resolves the issue where Claude models appeared to return
  incomplete responses. The root cause was identified as a compatibility
  issue in parsing SSE responses from certain API providers/proxies,
  rather than a model-specific problem. This change improves overall
  robustness when working with various API endpoints.
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  dulikaifazr · 2025-11-16 19:50:36 -08:00
  de1768d3ba
• Fix AltGr/backslash input on Windows Codex terminal (#6720)

  ### Summary
  
  - Treat AltGr chords (Ctrl+Alt) as literal character input in the Codex
  TUI textarea so Windows terminals that report
      backslash and other characters via AltGr insert correctly.
  - Add regression test altgr_ctrl_alt_char_inserts_literal to ensure
  Ctrl+Alt char events append the character and
      advance the cursor.
  
   ### Motivation
  
  On US/UK keyboard layouts, backslash is produced by a plain key, so
  Ctrl+Alt handling is never exercised and the
  bug isn’t visible. On many non‑US layouts (e.g., German), backslash and
  other symbols require AltGr, which terminals
  report as Ctrl+Alt+<char>. Our textarea previously filtered these chords
  like navigation bindings, so AltGr input was
  dropped on affected layouts. This change treats AltGr chords as literal
  input so backslash and similar symbols work on
    Windows terminals.
  
  This fixes multiple reported Issues where the \ symbol got cut off.
  Like:
  C:\Users\Admin
  became
  C:UsersAdmin
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Akrelion45 · 2025-11-16 19:15:06 -08:00
  702238f004
• fix: resolve Windows MCP server execution for script-based tools (#3828)

  ## What?
  
  Fixes MCP server initialization failures on Windows when using
  script-based tools like `npx`, `pnpm`, and `yarn` that rely on
  `.cmd`/`.bat` files rather than `.exe` binaries.
  
  Fixes #2945
  
  ## Why?
  
  Windows users encounter "program not found" errors when configuring MCP
  servers with commands like `npx` in their `~/.codex/config.toml`. This
  happens because:
  
  - Tools like `npx` are batch scripts (`npx.cmd`) on Windows, not
  executable binaries
  - Rust's `std::process::Command` bypasses the shell and cannot execute
  these scripts directly
  - The Windows shell normally handles this by checking `PATHEXT` for
  executable extensions
  
  Without this fix, Windows users must specify full paths or add `.cmd`
  extensions manually, which breaks cross-platform compatibility.
  
  ## How?
  
  Added platform-specific program resolution using the `which` crate to
  find the correct executable path:
  
  - **Windows**: Resolves programs through PATH/PATHEXT to find
  `.cmd`/`.bat` scripts
  - **Unix**: Returns the program unchanged (no-op, as Unix handles
  scripts natively)
  
  ### Changes
  
  - Added `which = "6"` dependency to `mcp-client/Cargo.toml`
  - Implemented `program_resolver` module in `mcp_client.rs` with
  platform-specific resolution
  - Added comprehensive tests for both Windows and Unix behavior
  
  ### Testing
  
  Added platform-specific tests to verify:
  - Unix systems execute scripts without extensions
  - Windows fails without proper extensions
  - Windows succeeds with explicit extensions
  - Cross-platform resolution enables successful execution
  
  **Tested on:**
  - Windows 11 (NT 10.0.26100.0 x64)
  - PowerShell 5.1 & 7+, CMD, Git Bash
  - MCP servers: playwright, context7, supabase
  - WSL (verified no regression)
  
  **Local checks passed:**
  ```bash
  cargo test && cargo clippy --tests && cargo fmt -- --config imports_granularity=Item
  ```
  
  ### Results
  
  **Before:**
  ```
  🖐 MCP client for `playwright` failed to start: program not found
  ```
  
  **After:**
  ```
  🖐 MCP client for `playwright` failed to start: request timed out
  ```
  
  Windows users can now use simple commands like `npx` in their config
  without specifying full paths or extensions. The timeout issue is a
  separate concern that will be addressed in a follow-up PR.
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Joonsoo Lee · 2025-11-16 13:41:10 -08:00
  f828cd2897
• Tighten panic on double truncation (#6701)
  Ahmed Ibrahim · 2025-11-15 07:28:59 +00:00
  3f1c4b9add
• Improve compact (#6692)

  This PR does the following:
  - Add compact prefix to the summary
  - Change the compaction prompt
  - Allow multiple compaction for long running tasks
  - Filter out summary messages on the following compaction
  
  Considerations:
  - Filtering out the summary message isn't the most clean
  - Theoretically, we can end up in infinite compaction loop if the user
  messages > compaction limit . However, that's not possible in today's
  code because we have hard cap on user messages.
  - We need to address having multiple user messages because it confuses
  the model.
  
  Testing:
  - Making sure that after compact we always end up with one user message
  (task) and one summary, even on multiple compaction.

  Ahmed Ibrahim · 2025-11-15 07:17:51 +00:00
  0b28e72b66
• Refactor truncation helpers into its own file (#6683)

  That's to centralize the truncation in one place. Next step would be to
  make only two methods public: one with bytes/lines and one with tokens.

  Ahmed Ibrahim · 2025-11-15 06:44:23 +00:00
  94dfb211af
• Revert "templates and build step for validating/submitting winget package" (#6696)

  Reverts openai/codex#6485

  Ahmed Ibrahim · 2025-11-15 03:47:58 +00:00
  b560c5cef1
• Handle "Don't Trust" directory selection in onboarding (#4941)

  Fixes #4940
  Fixes #4892
  
  When selecting "No, ask me to approve edits and commands" during
  onboarding, the code wasn't applying the correct approval policy,
  causing Codex to block all write operations instead of requesting
  approval.
  
  This PR fixes the issue by persisting the "DontTrust" decision in
  config.toml as `trust_level = "untrusted"` and handling it in the
  sandbox and approval policy logic, so Codex correctly asks for approval
  before making changes.
  
  ## Before (bug)
  <img width="709" height="500" alt="bef"
  src="https://github.com/user-attachments/assets/5aced26d-d810-4754-879a-89d9e4e0073b"
  />
  
  ## After (fixed)
  <img width="713" height="359" alt="aft"
  src="https://github.com/user-attachments/assets/9887bbcb-a9a5-4e54-8e76-9125a782226b"
  />
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Vinicius da Motta · 2025-11-14 15:23:35 -08:00
  89ecc00b79
• Ignore unified_exec_respects_workdir_override (#6693)
  pakrym-oai · 2025-11-14 15:00:31 -08:00
  018a2d2e50
• Order outputs before inputs (#6691)

  For better caching performance all output items should be rendered in
  the order they were produced before all new input items (for example,
  all function_call before all function_call_output).

  pakrym-oai · 2025-11-14 14:54:11 -08:00
  cfcc87a953
• feat: add app-server-test-client crate for internal use (#5391)

  For app-server development it's been helpful to be able to trigger some
  test flows end-to-end and print the JSON-RPC messages sent between
  client and server.

  Owen Lin · 2025-11-14 12:39:58 -08:00
  c3951e505d
• fix codex detection, add new security-focused smoketests. (#6682)

  Fix 'codex' detection to look for debug build, then release build, then
  installed.
  
  Adds more smoketests around security from @viyatb-oai

  iceweasel-oai · 2025-11-14 12:08:59 -08:00
  abb7b79701
• templates and build step for validating/submitting winget package (#6485)
  iceweasel-oai · 2025-11-14 11:06:44 -08:00
  37fba28ac3
• Add test timeout (#6612)

  Add an overall test timeout of 30s.

  pakrym-oai · 2025-11-14 09:30:37 -08:00
  4ba562d2dd
• Enable TUI notifications by default (#6633)

  ## Summary
  - default the `tui.notifications` setting to enabled so desktop
  notifications work out of the box
  - update configuration tests and documentation to reflect the new
  default
  
  ## Testing
  - `cargo test -p codex-core` *(fails:
  `exec::tests::kill_child_process_group_kills_grandchildren_on_timeout`
  is flaky in this sandbox because the spawned grandchild process stays
  alive)*
  - `cargo test -p codex-core
  exec::tests::kill_child_process_group_kills_grandchildren_on_timeout`
  *(fails: same sandbox limitation as above)*
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69166f811144832c9e8aaf8ee2642373)

  Jeremy Rose · 2025-11-14 09:28:09 -08:00
  799364de87
• [App server] add mcp tool call item started/completed events (#6642)

  this PR does two things:
  1. refactor `apply_bespoke_event_handling` into a separate file as it's
  getting kind of long;
  2. add mcp tool call `item/started` and `item/completed` events. To roll
  out app server events asap we didn't properly migrate mcp core events to
  use TurnItem for mcp tool calls - this will be a follow-up PR.
  
  real events generated in log:
  ```
  {
    "method": "codex/event/mcp_tool_call_end",
    "params": {
      "conversationId": "019a8021-26af-7c20-83db-21ca81e44d68",
      "id": "0",
      "msg": {
        "call_id": "call_7EjRQkD9HnfyMWf7tGrT9FKA",
        "duration": {
          "nanos": 92708,
          "secs": 0
        },
        "invocation": {
          "arguments": {
            "server": ""
          },
          "server": "codex",
          "tool": "list_mcp_resources"
        },
        "result": {
          "Ok": {
            "content": [
              {
                "text": "{\"resources\":[]}",
                "type": "text"
              }
            ],
            "isError": false
          }
        },
        "type": "mcp_tool_call_end"
      }
    }
  }
  
  {
    "method": "item/completed",
    "params": {
      "item": {
        "arguments": {
          "server": ""
        },
        "error": null,
        "id": "call_7EjRQkD9HnfyMWf7tGrT9FKA",
        "result": {
          "content": [
            {
              "text": "{\"resources\":[]}",
              "type": "text"
            }
          ],
          "structuredContent": null
        },
        "server": "codex",
        "status": "completed",
        "tool": "list_mcp_resources",
        "type": "mcpToolCall"
      }
    }
  }
  ```

  Celia Chen · 2025-11-14 08:08:43 -08:00
  526777c9b4
• feat: cache tokenizer (#6609)
  jif-oai · 2025-11-14 17:05:00 +01:00
  f17b392470
• feat: better UI for unified_exec (#6515)

  <img width="376" height="132" alt="Screenshot 2025-11-12 at 17 36 22"
  src="https://github.com/user-attachments/assets/ce693f0d-5ca0-462e-b170-c20811dcc8d5"
  />

  jif-oai · 2025-11-14 16:31:12 +01:00
  63c8c01f40
• feat: add resume logs when doing /new (#6660)

  <img width="769" height="803" alt="Screenshot 2025-11-14 at 10 25 49"
  src="https://github.com/user-attachments/assets/12fbc21e-cab9-4d0a-a484-1aeb60219f96"
  />

  jif-oai · 2025-11-14 11:42:16 +01:00
  4788fb179a
• tests: replace mount_sse_once_match with mount_sse_once for SSE mocking (#6640)
  pakrym-oai · 2025-11-13 18:04:05 -08:00
  6c384eb9c6
• Promote shared helpers for suite tests (#6460)

  ## Summary
  - add `TestCodex::submit_turn_with_policies` and extend the response
  helpers with reusable tool-call utilities
  - update the grep_files, read_file, list_dir, shell_serialization, and
  tools suites to rely on the shared helpers instead of local copies
  - make the list_dir helper return `anyhow::Result` so clippy no longer
  warns about `expect`
  
  ## Testing
  - `just fix -p codex-core`
  - `cargo test -p codex-core --test all
  suite::grep_files::grep_files_tool_collects_matches`
  - `cargo test -p codex-core
  suite::grep_files::grep_files_tool_collects_matches -- --ignored`
  (filter requests ignored tests so nothing runs, but the build stays
  clean)
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69112d53abac83219813cab4d7cb6446)

  Ahmed Ibrahim · 2025-11-13 17:12:10 -08:00
  2a6e9b20df
• Use shared network gating helper in chat completion tests (#6461)

  ## Summary
  - replace the bespoke network check in the chat completion payload and
  SSE tests with the existing `skip_if_no_network!` helper so they follow
  the same gating convention as the rest of the suite
  
  ## Testing
  - `just fmt`
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69112d4cb9f08321ba773e8ccf39778e)

  Ahmed Ibrahim · 2025-11-13 17:11:43 -08:00
  f3c6b1334b
• Avoid double truncation (#6631)

  1. Avoid double truncation by giving 10% above the tool default constant
  2. Add tests that fails when const = 1

  Ahmed Ibrahim · 2025-11-13 16:59:31 -08:00
  9890ceb939