codex

shell_command returns freeform output (#6860 )

Instead of returning structured out and then re-formatting it into
freeform, return the freeform output from shell_command tool.

Keep `shell` as the default tool for GPT-5.

pakrym-oai · 2025-11-18 23:38:43 -08:00

ee0484a98c

chore(core) arcticfox (#6876 )

..

Dylan Hurd · 2025-11-18 23:38:08 -08:00

7e0e675db4

fix(tui) ghost snapshot notifications (#6881 )

## Summary
- avoid surfacing ghost snapshot warnings in the TUI when snapshot
creation fails, logging the conditions instead
- continue to capture successful ghost snapshots without changing
existing behavior

## Testing
- `cargo test -p codex-core` *(fails:
default_client::tests::test_create_client_sets_default_headers,
default_client::tests::test_get_codex_user_agent,
exec::tests::kill_child_process_group_kills_grandchildren_on_timeout)*

------
[Codex
Task](https://chatgpt.com/codex/tasks/task_i_691c02238db08322927c47b8c2d72c4c)

Dylan Hurd · 2025-11-18 23:23:00 -08:00

84458f12f6

fix: typos in model picker (#6859 )

# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.

Ahmed Ibrahim · 2025-11-19 06:29:02 +00:00

793063070b

chore: update windows docs url (#6877 )

- Testing: None

ae · 2025-11-19 06:24:17 +00:00

030d1d5b1c

feat: tweak windows sandbox strings (#6875 )

New strings:
1. Approval mode picker just says "Select Approval Mode"
1. Updated "Auto" to "Agent"
1. When you select "Agent", you get "Agent mode on Windows uses an
experimental sandbox to limit network and filesystem access. [Learn
more]"
1. Updated world-writable warning to "The Windows sandbox cannot protect
writes to folders that are writable by Everyone. Consider removing write
access for Everyone from the following folders: {folders}"

---------

Co-authored-by: iceweasel-oai <iceweasel@openai.com>

ae · 2025-11-19 06:00:06 +00:00

7e6316d4aa

fix: add more fields to ThreadStartResponse and ThreadResumeResponse (#6847 )

This adds the following fields to `ThreadStartResponse` and
`ThreadResumeResponse`:

```rust
    pub model: String,
    pub model_provider: String,
    pub cwd: PathBuf,
    pub approval_policy: AskForApproval,
    pub sandbox: SandboxPolicy,
    pub reasoning_effort: Option<ReasoningEffort>,
```

This is important because these fields are optional in
`ThreadStartParams` and `ThreadResumeParams`, so the caller needs to be
able to determine what values were ultimately used to start/resume the
conversation. (Though note that any of these could be changed later
between turns in the conversation.)

Though to get this information reliably, it must be read from the
internal `SessionConfiguredEvent` that is created in response to the
start of a conversation. Because `SessionConfiguredEvent` (as defined in
`codex-rs/protocol/src/protocol.rs`) did not have all of these fields, a
number of them had to be added as part of this PR.

Because `SessionConfiguredEvent` is referenced in many tests, test
instances of `SessionConfiguredEvent` had to be updated, as well, which
is why this PR touches so many files.

Michael Bolin · 2025-11-18 21:18:43 -08:00

a75321a64c

Remote compaction on by-default (#6866 )

pakrym-oai · 2025-11-19 02:21:57 +00:00

cac0a6a29d

[app-server] introduce turn/completed v2 event (#6800 )

similar to logic in
`codex/codex-rs/exec/src/event_processor_with_jsonl_output.rs`.
translation of v1 -> v2 events:
`codex/event/task_complete` -> `turn/completed`
`codex/event/turn_aborted` -> `turn/completed` with `interrupted` status
`codex/event/error` -> `turn/completed` with `error` status

this PR also makes `items` field in `Turn` optional. For now, we only
populate it when we resume a thread, and leave it as None for all other
places until we properly rewrite core to keep track of items.

tested using the codex app server client. example new event:
```
< {
<   "method": "turn/completed",
<   "params": {
<     "turn": {
<       "id": "0",
<       "items": [],
<       "status": "interrupted"
<     }
<   }
< }
```

Celia Chen · 2025-11-19 01:55:24 +00:00

b395dc1be6

update credit status details (#6862 )

zhao-oai · 2025-11-19 01:40:22 +00:00

4288091f63

tui: add branch to 'codex resume', filter by cwd (#6232 )

By default, show only sessions that shared a cwd with the current cwd.
`--all` shows all sessions in all cwds. Also, show the branch name from
the rollout metadata.

<img width="1091" height="638" alt="Screenshot 2025-11-04 at 3 30 47 PM"
src="https://github.com/user-attachments/assets/aae90308-6115-455f-aff7-22da5f1d9681"
/>

Jeremy Rose · 2025-11-19 00:47:37 +00:00

526eb3ff82

smoketest for browser vuln, rough draft of Windows security doc (#6822 )

iceweasel-oai · 2025-11-18 16:43:34 -08:00

b952bd2649

windows sandbox: support multiple workspace roots (#6854 )

The Windows sandbox did not previously support multiple workspace roots
via config. Now it does

iceweasel-oai · 2025-11-18 16:35:00 -08:00

cf57320b9f

updating codex backend models (#6855 )

zhao-oai · 2025-11-18 16:25:50 -08:00

4fb714fb46

exec-server (#6630 )

Jeremy Rose · 2025-11-19 00:20:19 +00:00

c1391b9f94

Fix tests so they don't emit an extraneous config.toml in the source tree (#6853 )

This PR fixes the `release_event_does_not_change_selection` test so it
doesn't cause an extra `config.toml` to be emitted in the sources when
running the tests locally. Prior to this fix, I needed to delete this
file every time I ran the tests to prevent it from showing up as an
uncommitted source file.

Eric Traut · 2025-11-18 15:27:45 -08:00

9275e93364

[app-server-test-client] feat: auto approve command (#6852 )

Owen Lin · 2025-11-18 15:25:02 -08:00

b3a824ae3c

Improved runtime of generated_ts_has_no_optional_nullable_fields test (#6851 )

The `generated_ts_has_no_optional_nullable_fields` test was occasionally
failing on slow CI nodes because of a timeout. This change reduces the
work done by the test. It adds some "options" for the `generate_ts`
function so it can skip work that's not needed for the test.

Eric Traut · 2025-11-18 15:24:32 -08:00

ab30453dee

fix: local compaction (#6844 )

jif-oai · 2025-11-18 22:18:10 +00:00

c56d0c159b

[codex][otel] support mtls configuration (#6228 )

fix for https://github.com/openai/codex/issues/6153

supports mTLS configuration and includes TLS features in the library
build to enable secure HTTPS connections with custom root certificates.

grpc:
https://docs.rs/tonic/0.13.1/src/tonic/transport/channel/endpoint.rs.html#63
https:
https://docs.rs/reqwest/0.12.23/src/reqwest/async_impl/client.rs.html#516

Anton Panasenko · 2025-11-18 14:01:01 -08:00

f7a921039c

feat: review in app server (#6613 )

jif-oai · 2025-11-18 21:58:54 +00:00

8ddae8cde3

chore(config) enable shell_command (#6843 )

## Summary
Enables shell_command as default for `gpt-5*` and `codex-*` models.

## Testing
- [x] Updated unit tests

Dylan Hurd · 2025-11-18 12:46:02 -08:00

29ca89c414

Prompt to turn on windows sandbox when auto mode selected. (#6618 )

- stop prompting users to install WSL 
- prompt users to turn on Windows sandbox when auto mode requested.

<img width="1660" height="195" alt="Screenshot 2025-11-17 110612"
src="https://github.com/user-attachments/assets/c67fc239-a227-417e-94bb-599a8ed8f11e"
/>
<img width="1684" height="168" alt="Screenshot 2025-11-17 110637"
src="https://github.com/user-attachments/assets/d18c3370-830d-4971-8746-04757ae2f709"
/>
<img width="1655" height="293" alt="Screenshot 2025-11-17 110719"
src="https://github.com/user-attachments/assets/d21f6ce9-c23e-4842-baf6-8938b77c16db"
/>

iceweasel-oai · 2025-11-18 11:38:18 -08:00

4bada5a84d

Add the utility to truncate by tokens (#6746 )

- This PR is to make it on path for truncating by tokens. This path will
be initially used by unified exec and context manager (responsible for
MCP calls mainly).
- We are exposing new config `calls_output_max_tokens`
- Use `tokens` as the main budget unit but truncate based on the model
family by Introducing `TruncationPolicy`.
- Introduce `truncate_text` as a router for truncation based on the
mode.

In next PRs:
- remove truncate_with_line_bytes_budget
- Add the ability to the model to override the token budget.

Ahmed Ibrahim · 2025-11-18 11:36:23 -08:00

3de8790714

fixing localshell tool calls (#6823 )

- Local-shell tool responses were always tagged as
`ExecCommandSource::UserShell` because handler would call
`run_exec_like` with `is_user_shell_cmd` set to true.
- Treat `ToolPayload::LocalShell` the same as other model generated
shell tool calls by deleting `is_user_shell_cmd` from `run_exec_like`
(since actual user shell commands follow a separate code path)

zhao-oai · 2025-11-18 17:28:26 +00:00

e9e644a119

feat: enable parallel tool calls (#6796 )

jif-oai · 2025-11-18 17:10:14 +00:00

f5d9939cda

feat: remote compaction (#6795 )

Co-authored-by: pakrym-oai <pakrym@openai.com>

jif-oai · 2025-11-18 16:51:16 +00:00

838531d3e4

nit: app server (#6830 )

jif-oai · 2025-11-18 16:34:13 +00:00

0eb2e6f9ee

nit: mark ghost commit as stable (#6833 )

jif-oai · 2025-11-18 16:05:49 +00:00

c20df79a38

feat: git branch tooling (#6831 )

jif-oai · 2025-11-18 15:26:09 +00:00

fc55fd7a81

🐛 fix(rmcp-client): refresh OAuth tokens using expires_at (#6574 )

## Summary
- persist OAuth credential expiry timestamps and rehydrate `expires_in`
- proactively refresh rmcp OAuth tokens when `expires_at` is near, then
persist

## Testing
- just fmt
- just fix -p codex-rmcp-client
- cargo test -p codex-rmcp-client

Fixes #6572

Lael · 2025-11-18 02:16:58 -05:00

f3d4e210d8

fix(windows) shell_command on windows, minor parsing (#6811 )

## Summary
Enables shell_command for windows users, and starts adding some basic
command parsing here, to at least remove powershell prefixes. We'll
follow this up with command parsing but I wanted to land this change
separately with some basic UX.

**NOTE**: This implementation parses bash and powershell on both
platforms. In theory this is possible, since you can use git bash on
windows or powershell on linux. In practice, this may not be worth the
complexity of supporting, so I don't feel strongly about the current
approach vs. platform-specific branching.

## Testing
- [x] Added a bunch of tests 
- [x] Ran on both windows and os x

Dylan Hurd · 2025-11-17 22:23:53 -08:00

28ebe1c97a

chore(core) Add shell_serialization coverage (#6810 )

## Summary
Similar to #6545, this PR updates the shell_serialization test suite to
cover the various `shell` tool invocations we have. Note that this does
not cover unified_exec, which has its own suite of tests. This should
provide some test coverage for when we eventually consolidate
serialization logic.

## Testing
- [x] These are tests

Dylan Hurd · 2025-11-17 19:10:56 -08:00

2b7378ac77

Update defaults to gpt-5.1 (#6652 )

## Summary
- update documentation, example configs, and automation defaults to
reference gpt-5.1 / gpt-5.1-codex
- bump the CLI and core configuration defaults, model presets, and error
messaging to the new models while keeping the model-family/tool coverage
for legacy slugs
- refresh tests, fixtures, and TUI snapshots so they expect the upgraded
defaults

## Testing
- `cargo test -p codex-core
config::tests::test_precedence_fixture_with_gpt5_profile`


------
[Codex
Task](https://chatgpt.com/codex/tasks/task_i_6916c5b3c2b08321ace04ee38604fc6b)

Ahmed Ibrahim · 2025-11-17 17:40:11 -08:00

ddcc60a085

Demote function call payload log to debug to avoid noisy error-level stderr (#6808 )

cassirer-openai · 2025-11-18 01:16:11 +00:00

8465f1f2f4

execpolicy2 extension (#6627 )

- enabling execpolicy2 parser to parse multiple policy files to build a
combined `Policy` (useful if codex detects many `.codexpolicy` files)
- adding functionality to `Policy` to allow evaluation of multiple cmds
at once (useful when we have chained commands)

zhao-oai · 2025-11-17 16:44:41 -08:00

7ab45487dd

[app-server] feat: add v2 command execution approval flow (#6758 )

This PR adds the API V2 version of the command‑execution approval flow
for the shell tool.

This PR wires the new RPC (`item/commandExecution/requestApproval`, V2
only) and related events (`item/started`, `item/completed`, and
`item/commandExecution/delta`, which are emitted in both V1 and V2)
through the app-server
protocol. The new approval RPC is only sent when the user initiates a
turn with the new `turn/start` API so we don't break backwards
compatibility with VSCE.

The approach I took was to make as few changes to the Codex core as
possible, leveraging existing `EventMsg` core events, and translating
those in app-server. I did have to add additional fields to
`EventMsg::ExecCommandEndEvent` to capture the command's input so that
app-server can statelessly transform these events to a
`ThreadItem::CommandExecution` item for the `item/completed` event.

Once we stabilize the API and it's complete enough for our partners, we
can work on migrating the core to be aware of command execution items as
a first-class concept.

**Note**: We'll need followup work to make sure these APIs work for the
unified exec tool, but will wait til that's stable and landed before
doing a pass on app-server.

Example payloads below:
```
{
  "method": "item/started",
  "params": {
    "item": {
      "aggregatedOutput": null,
      "command": "/bin/zsh -lc 'touch /tmp/should-trigger-approval'",
      "cwd": "/Users/owen/repos/codex/codex-rs",
      "durationMs": null,
      "exitCode": null,
      "id": "call_lNWWsbXl1e47qNaYjFRs0dyU",
      "parsedCmd": [
        {
          "cmd": "touch /tmp/should-trigger-approval",
          "type": "unknown"
        }
      ],
      "status": "inProgress",
      "type": "commandExecution"
    }
  }
}
```

```
{
  "id": 0,
  "method": "item/commandExecution/requestApproval",
  "params": {
    "itemId": "call_lNWWsbXl1e47qNaYjFRs0dyU",
    "parsedCmd": [
      {
        "cmd": "touch /tmp/should-trigger-approval",
        "type": "unknown"
      }
    ],
    "reason": "Need to create file in /tmp which is outside workspace sandbox",
    "risk": null,
    "threadId": "019a93e8-0a52-7fe3-9808-b6bc40c0989a",
    "turnId": "1"
  }
}
```

```
{
  "id": 0,
  "result": {
    "acceptSettings": {
      "forSession": false
    },
    "decision": "accept"
  }
}
```

```
{
  "params": {
    "item": {
      "aggregatedOutput": null,
      "command": "/bin/zsh -lc 'touch /tmp/should-trigger-approval'",
      "cwd": "/Users/owen/repos/codex/codex-rs",
      "durationMs": 224,
      "exitCode": 0,
      "id": "call_lNWWsbXl1e47qNaYjFRs0dyU",
      "parsedCmd": [
        {
          "cmd": "touch /tmp/should-trigger-approval",
          "type": "unknown"
        }
      ],
      "status": "completed",
      "type": "commandExecution"
    }
  }
}
```

Owen Lin · 2025-11-18 00:23:54 +00:00

cecbd5b021

background rate limits fetch (#6789 )

fetching rate limits every minute asynchronously

zhao-oai · 2025-11-17 16:06:26 -08:00

4000e26303

move cap_sid file into ~/.codex so the sandbox cannot overwrite it (#6798 )

The `cap_sid` file contains the IDs of the two custom SIDs that the
Windows sandbox creates/manages to implement read-only and
workspace-write sandbox policies.

It previously lived in `<cwd>/.codex` which means that the sandbox could
write to it, which could degrade the efficacy of the sandbox. This
change moves it to `~/.codex/` (or wherever `CODEX_HOME` points to) so
that it is outside the workspace.

iceweasel-oai · 2025-11-17 15:49:41 -08:00

e032d338f2

Fix TUI issues with Alt-Gr on Windows (#6799 )

This PR fixes keyboard handling for the Right Alt (aka "Alt-Gr") key on
Windows. This key appears on keyboards in Central and Eastern Europe.
Codex has effectively never worked for Windows users in these regions
because the code didn't properly handle this key, which is used for
typing common symbols like `\` and `@`.

A few days ago, I merged a [community-authored
PR](https://github.com/openai/codex/pull/6720) that supplied a partial
fix for this issue. Upon closer inspect, that PR was 1) too broad (not
scoped to Windows only) and 2) incomplete (didn't fix all relevant code
paths, so paste was still broken).

This improvement is based on another [community-provided
PR](https://github.com/openai/codex/pull/3241) by @marektomas-cz. He
submitted it back in September and later closed it because it didn't
receive any attention.

This fix addresses the following bugs: #5922, #3046, #3092, #3519,
#5684, #5843.

Eric Traut · 2025-11-17 15:18:16 -08:00

8bebe86a47

core: add a feature to disable the shell tool (#6481 )

`--disable shell_tool` disables the built-in shell tool. This is useful
for MCP-only operation.

---------

Co-authored-by: Michael Bolin <mbolin@openai.com>

Jeremy Rose · 2025-11-17 22:56:19 +00:00

ab2e7499f8

chore(core) Update shell instructions (#6679 )

## Summary
Consolidates `shell` and `shell_command` tool instructions.
## Testing 
- [x] Updated tests, tested locally

Dylan Hurd · 2025-11-17 13:05:15 -08:00

daf77b8452

fix: annotate all app server v2 types with camelCase (#6791 )

Owen Lin · 2025-11-17 12:02:52 -08:00

03a6e853c0

LM Studio OSS Support (#2312 )

## Overview

Adds LM Studio OSS support. Closes #1883


### Changes
This PR enhances the behavior of `--oss` flag to support LM Studio as a
provider. Additionally, it introduces a new flag`--local-provider` which
can take in `lmstudio` or `ollama` as values if the user wants to
explicitly choose which one to use.

If no provider is specified `codex --oss` will auto-select the provider
based on whichever is running.

#### Additional enhancements 
The default can be set using `oss-provider` in config like:

```
oss_provider = "lmstudio"
```

For non-interactive users, they will need to either provide the provider
as an arg or have it in their `config.toml`

### Notes
For best performance, [set the default context
length](https://lmstudio.ai/docs/app/advanced/per-model) for gpt-oss to
the maximum your machine can support

---------

Co-authored-by: Matt Clayton <matt@lmstudio.ai>
Co-authored-by: Eric Traut <etraut@openai.com>

rugvedS07 · 2025-11-17 11:49:09 -08:00

837bc98a1d

[app-server] add events to readme (#6690 )

add table of contents, lifecycle and events to readme.

Celia Chen · 2025-11-17 19:28:05 +00:00

842a1b7fe7

core/tui: non-blocking MCP startup (#6334 )

This makes MCP startup not block TUI startup. Messages sent while MCPs
are booting will be queued.


https://github.com/user-attachments/assets/96e1d234-5d8f-4932-a935-a675d35c05e0


Fixes #6317

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

Jeremy Rose · 2025-11-17 11:26:11 -08:00

03ffe4d595

chore: delete chatwidget::tests::binary_size_transcript_snapshot tui test (#6759 )

We're running into quite a bit of drag maintaining this test, since
every time we add fields to an EventMsg that happened to be dumped into
the `binary-size-log.jsonl` fixture, this test starts to fail. The fix
is usually to either manually update the `binary-size-log.jsonl` fixture
file, or update the `upgrade_event_payload_for_tests` function to map
the data in that file into something workable.

Eason says it's fine to delete this test, so let's just delete it

Owen Lin · 2025-11-17 11:11:41 -08:00

ae2a084fae

feat: execpolicy v2 (#6467 )

## Summary
- Introduces the `codex-execpolicy2` crate.
- This PR covers only the prefix-rule subset of the planned execpolicy
v2 language; a richer language will follow.

## Policy
- Policy language centers on `prefix_rule(pattern=[...], decision?,
match?, not_match?)`, where `pattern` is an ordered list of tokens; any
element may be a list to denote alternatives. `decision` defaults to
`allow`; valid values are `allow`, `prompt`, and `forbidden`. `match` /
`not_match` hold example commands that are tokenized and validated at
load time (think of these as unit tests).

## Policy shapes
- Prefix rules use Starlark syntax:
```starlark
prefix_rule(
    pattern = ["cmd", ["alt1", "alt2"]], # ordered tokens; list entries denote alternatives
    decision = "prompt",                # allow | prompt | forbidden; defaults to allow
    match = [["cmd", "alt1"]],          # examples that must match this rule (enforced at compile time)
    not_match = [["cmd", "oops"]],      # examples that must not match this rule (enforced at compile time)
)
```

## Response shapes
- Match:

```json
{
  "match": {
    "decision": "allow|prompt|forbidden",
    "matchedRules": [
      {
        "prefixRuleMatch": {
          "matchedPrefix": ["<token>", "..."],
          "decision": "allow|prompt|forbidden"
        }
      }
    ]
  }
}
```

- No match:

```json
"noMatch"
```

- `matchedRules` lists every rule whose prefix matched the command;
`matchedPrefix` is the exact prefix that matched.
- The effective `decision` is the strictest severity across all matches
(`forbidden` > `prompt` > `allow`).

---------

Co-authored-by: Michael Bolin <mbolin@openai.com>

zhao-oai · 2025-11-17 10:15:45 -08:00

a941ae7632

feat: placeholder for image that can't be decoded to prevent 400 (#6773 )

jif-oai · 2025-11-17 16:10:53 +00:00

7c8d333980

fix(core) serialize shell_command (#6744 )

## Summary
Ensures we're serializing calls to `shell_command`

## Testing
- [x] Added unit test

Dylan Hurd · 2025-11-16 23:16:51 -08:00

497fb4a19c

1539 Commits