1846 Commits

• fix: make skills loader tests hermetic with ~/.agents skills (#12474)
  Michael Bolin · 2026-02-21 14:40:13 -08:00
  f33ac830aa
• Improve token usage estimate for images (#12419)

  Fixes #11845.
  
  Adjust context/token estimation for inline image `data:*;base64,...`
  URLs so we
  do not count the raw base64 payload as model-visible text.
  
  What changed:
  - keep the existing JSON-length estimator as the baseline
  - detect only inline base64 `data:` image URLs in message and
  function-call
    output content items
  - subtract only the base64 payload bytes (preserving data URL prefix +
  JSON
    overhead)
  - add a fixed per-image estimate of 340 bytes (~85 tokens at the repo’s
    4-bytes/token heuristic)
  
  This avoids large overestimates from MCP image tool outputs while
  leaving normal
  image URLs (`https://`, `file://`, non-base64 `data:` URLs) unchanged.
  
  Tests:
  - message image data URL estimate regression
  - function-call output image data URL estimate regression
  - non-base64 image URLs unchanged
  - non-base64 `data:` URLs unchanged
  - `data:application/octet-stream;base64,...` adjusted
  - multiple inline images apply multiple fixed costs
  - text-only items unchanged

  Eric Traut · 2026-02-21 14:25:36 -08:00
  3586fcb802
• Prefer v2 websockets if available (#12428)

  And also cleanup settings flow to avoid reading many separate flags.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  pakrym-oai · 2026-02-21 20:08:04 +00:00
  b17148f13a
• profile-level model_catalog_json overrie (#12410)

  enable `model-catalog_json` config value on `ConfigProfile` as well

  sayan-oai · 2026-02-21 19:39:02 +00:00
  5a635f3427
• refactor(core): move embedded system skills into codex-skills crate (#12435)

  ## Why
  
  `codex-core` was carrying the embedded system-skill sample assets (and a
  `build.rs` that walks those files to register rerun triggers). Those
  assets change infrequently, but any change under `codex-core` still ties
  them to `codex-core`'s build/cache lifecycle.
  
  This change moves the embedded system-skills packaging into a dedicated
  `codex-skills` crate so it can be cached independently. That reduces
  unnecessary invalidation/rebuild pressure on `codex-core` when the
  skills bundle is the only thing that changes.
  
  ## What Changed
  
  - Added a new `codex-rs/skills` crate (`codex-skills`) with:
    - `Cargo.toml`
    - `BUILD.bazel`
    - `build.rs` to track skill asset file changes for Cargo rebuilds
  - `src/lib.rs` containing the embedded system-skills install/cache logic
  previously in `codex-core`
  - Moved the embedded sample skill assets from
  `codex-rs/core/src/skills/assets/samples` to
  `codex-rs/skills/src/assets/samples`.
  - Updated `codex-rs/core/Cargo.toml` to depend on `codex-skills` and
  removed `codex-core`'s direct `include_dir` dependency.
  - Removed `codex-core`'s `build.rs`.
  - Replaced `codex-rs/core/src/skills/system.rs` implementation with a
  thin re-export wrapper to keep existing `codex-core` call sites
  unchanged.
  - Updated workspace manifests/lockfile (`codex-rs/Cargo.toml`,
  `codex-rs/Cargo.lock`) for the new crate.

  Michael Bolin · 2026-02-21 08:34:08 +00:00
  85ce91a5b3
• fix: codex-arg0 no longer depends on codex-core (#12434)

  ## Why
  
  `codex-rs/arg0` only needed two things from `codex-core`:
  
  - the `find_codex_home()` wrapper
  - the special argv flag used for the internal `apply_patch`
  self-invocation path
  
  That made `codex-arg0` depend on `codex-core` for a very small surface
  area. This change removes that dependency edge and moves the shared
  `apply_patch` invocation flag to a more natural boundary
  (`codex-apply-patch`) while keeping the contract explicitly documented.
  
  ## What Changed
  
  - Moved the internal `apply_patch` argv[1] flag constant out of
  `codex-core` and into `codex-apply-patch`.
  - Renamed the constant to `CODEX_CORE_APPLY_PATCH_ARG1` and documented
  that it is part of the Codex core process-invocation contract (even
  though it now lives in `codex-apply-patch`).
  - Updated `arg0`, the core apply-patch runtime, and the `codex-exec`
  apply-patch test to import the constant from `codex-apply-patch`.
  - Updated `codex-rs/arg0` to call
  `codex_utils_home_dir::find_codex_home()` directly instead of
  `codex_core::config::find_codex_home()`.
  - Removed the `codex-core` dependency from `codex-rs/arg0` and added the
  needed direct dependency on `codex-utils-home-dir`.
  - Added `codex-apply-patch` as a dev-dependency for `codex-rs/exec`
  tests (the apply-patch test now imports the moved constant directly).
  
  ## Verification
  
  - `cargo test -p codex-apply-patch`
  - `cargo test -p codex-arg0`
  - `cargo test -p codex-core --lib apply_patch`
  - `cargo test -p codex-exec
  test_standalone_exec_cli_can_use_apply_patch`
  - `cargo shear`

  Michael Bolin · 2026-02-21 00:20:42 -08:00
  2fe4be1aa9
• chore: remove codex-core public protocol/shell re-exports (#12432)

  ## Why
  
  `codex-rs/core/src/lib.rs` re-exported a broad set of types and modules
  from `codex-protocol` and `codex-shell-command`. That made it easy for
  workspace crates to import those APIs through `codex-core`, which in
  turn hides dependency edges and makes it harder to reduce compile-time
  coupling over time.
  
  This change removes those public re-exports so call sites must import
  from the source crates directly. Even when a crate still depends on
  `codex-core` today, this makes dependency boundaries explicit and
  unblocks future work to drop `codex-core` dependencies where possible.
  
  ## What Changed
  
  - Removed public re-exports from `codex-rs/core/src/lib.rs` for:
  - `codex_protocol::protocol` and related protocol/model types (including
  `InitialHistory`)
    - `codex_protocol::config_types` (`protocol_config_types`)
  - `codex_shell_command::{bash, is_dangerous_command, is_safe_command,
  parse_command, powershell}`
  - Migrated workspace Rust call sites to import directly from:
    - `codex_protocol::protocol`
    - `codex_protocol::config_types`
    - `codex_protocol::models`
    - `codex_shell_command`
  - Added explicit `Cargo.toml` dependencies (`codex-protocol` /
  `codex-shell-command`) in crates that now import those crates directly.
  - Kept `codex-core` internal modules compiling by using `pub(crate)`
  aliases in `core/src/lib.rs` (internal-only, not part of the public
  API).
  - Updated the two utility crates that can already drop a `codex-core`
  dependency edge entirely:
    - `codex-utils-approval-presets`
    - `codex-utils-cli`
  
  ## Verification
  
  - `cargo test -p codex-utils-approval-presets`
  - `cargo test -p codex-utils-cli`
  - `cargo check --workspace --all-targets`
  - `just clippy`

  Michael Bolin · 2026-02-20 23:45:35 -08:00
  1af2a37ada
• chore: move config diagnostics out of codex-core (#12427)

  ## Why
  
  Compiling `codex-rs/core` is a bottleneck for local iteration, so this
  change continues the ongoing extraction of config-related functionality
  out of `codex-core` and into `codex-config`.
  
  The goal is not just to move code, but to reduce `codex-core` ownership
  and indirection so more code depends on `codex-config` directly.
  
  ## What Changed
  
  - Moved config diagnostics logic from
  `core/src/config_loader/diagnostics.rs` into
  `config/src/diagnostics.rs`.
  - Updated `codex-core` to use `codex-config` diagnostics types/functions
  directly where possible.
  - Removed the `core/src/config_loader/diagnostics.rs` shim module
  entirely; the remaining `ConfigToml`-specific calls are in
  `core/src/config_loader/mod.rs`.
  - Moved `CONFIG_TOML_FILE` into `codex-config` and updated existing
  references to use `codex_config::CONFIG_TOML_FILE` directly.
  - Added a direct `codex-config` dependency to `codex-cli` for its
  `CONFIG_TOML_FILE` use.

  Michael Bolin · 2026-02-20 23:19:29 -08:00
  1a220ad77d
• Fix compaction context reinjection and model baselines (#12252)

  ## Summary
  - move regular-turn context diff/full-context persistence into
  `run_turn` so pre-turn compaction runs before incoming context updates
  are recorded
  - after successful pre-turn compaction, rely on a cleared
  `reference_context_item` to trigger full context reinjection on the
  follow-up regular turn (manual `/compact` keeps replacement history
  summary-only and also clears the baseline)
  - preserve `<model_switch>` when full context is reinjected, and inject
  it *before* the rest of the full-context items
  - scope `reference_context_item` and `previous_model` to regular user
  turns only so standalone tasks (`/compact`, shell, review, undo) cannot
  suppress future reinjection or `<model_switch>` behavior
  - make context-diff persistence + `reference_context_item` updates
  explicit in the regular-turn path, with clearer docs/comments around the
  invariant
  - stop persisting local `/compact` `RolloutItem::TurnContext` snapshots
  (only regular turns persist `TurnContextItem` now)
  - simplify resume/fork previous-model/reference-baseline hydration by
  looking up the last surviving turn context from rollout lifecycle
  events, including rollback and compaction-crossing handling
  - remove the legacy fallback that guessed from bare `TurnContext`
  rollouts without lifecycle events
  - update compaction/remote-compaction/model-visible snapshots and
  compact test assertions (including remote compaction mock response
  shape)
  
  ## Why
  We were persisting incoming context items before spawning the regular
  turn task, which let pre-turn compaction requests accidentally include
  incoming context diffs without the new user message. Fixing that exposed
  follow-on baseline issues around `/compact`, resume/fork, and standalone
  tasks that could cause duplicate context injection or suppress
  `<model_switch>` instructions.
  
  This PR re-centers the invariants around regular turns:
  - regular turns persist model-visible context diffs/full reinjection and
  update the `reference_context_item`
  - standalone tasks do not advance those regular-turn baselines
  - compaction clears the baseline when replacement history may have
  stripped the referenced context diffs
  
  ## Follow-ups (TODOs left in code)
  - `TODO(ccunningham)`: fix rollback/backtracking baseline handling more
  comprehensively
  - `TODO(ccunningham)`: include pending incoming context items in
  pre-turn compaction threshold estimation
  - `TODO(ccunningham)`: inject updated personality spec alongside
  `<model_switch>` so some model-switch paths can avoid forced full
  reinjection
  - `TODO(ccunningham)`: review task turn lifecycle
  (`TurnStarted`/`TurnComplete`) behavior and emit task-start context
  diffs for task types that should have them (excluding `/compact`)
  
  ## Validation
  - `just fmt`
  - CI should cover the updated compaction/resume/model-visible snapshot
  expectations and rollout-hydration behavior
  - I did **not** rerun the full local test suite after the latest
  resume-lookup / rollout-persistence simplifications

  Charley Cunningham · 2026-02-20 23:13:08 -08:00
  bb0ac5be70
• fix(core) Filter non-matching prefix rules (#12314)

  ## Summary
  `gpt-5.3-codex` really likes to write complicated shell scripts, and
  suggest a partial prefix_rule that wouldn't actually approve the
  command. We should only show the `prefix_rule` suggestion from the model
  if it would actually fully approve the command the user is seeing.
  
  This will technically cause more instances of overly-specific
  suggestions when we fallback, but I think the UX is clearer,
  particularly when the model doesn't necessarily understand the current
  limitations of execpolicy parsing.
  
  ## Testing
   - [x] Add unit tests
   - [x] Add integration tests

  Dylan Hurd · 2026-02-20 22:02:35 -08:00
  a8b4b569fb
• Add experimental realtime websocket backend prompt override (#12418)

  - add top-level `experimental_realtime_ws_backend_prompt` config key
  (experimental / do not use) and include it in config schema
  - apply the override only to `Op::RealtimeConversation` websocket
  `backend_prompt`, with config + realtime tests

  Ahmed Ibrahim · 2026-02-20 20:10:51 -08:00
  b237f7cbb1
• Improve Plan mode reasoning selection flow (#12303)

  Addresses https://github.com/openai/codex/issues/11013
  
  ## Summary
  - add a Plan implementation path in the TUI that lets users choose
  reasoning before switching to Default mode and implementing
  - add Plan-mode reasoning scope handling (Plan-only override vs
  all-modes default), including config/schema/docs plumbing for
  `plan_mode_reasoning_effort`
  - remove the hardcoded Plan preset medium default and make the reasoning
  popup reflect the active Plan override as `(current)`
  - split the collaboration-mode switch notification UI hint into #12307
  to keep this diff focused
  
  If I have `plan_mode_reasoning_effort = "medium"` set in my
  `config.toml`:
  <img width="699" height="127" alt="Screenshot 2026-02-20 at 6 59 37 PM"
  src="https://github.com/user-attachments/assets/b33abf04-6b7a-49ed-b2e9-d24b99795369"
  />
  
  If I don't have `plan_mode_reasoning_effort` set in my `config.toml`:
  <img width="704" height="129" alt="Screenshot 2026-02-20 at 7 01 51 PM"
  src="https://github.com/user-attachments/assets/88a086d4-d2f1-49c7-8be4-f6f0c0fa1b8d"
  />
  
  ## Codex author
  `codex resume 019c78a2-726b-7fe3-adac-3fa4523dcc2a`

  Charley Cunningham · 2026-02-20 20:08:56 -08:00
  4c1744afb2
• Add experimental realtime websocket URL override (#12416)

  - add top-level `experimental_realtime_ws_base_url` config key
  (experimental / do not use) and include it in config schema
  - apply the override only to `Op::RealtimeConversation` websocket
  transport, with config + realtime tests

  Ahmed Ibrahim · 2026-02-20 19:51:20 -08:00
  7ae5d88016
• Wire realtime api to core (#12268)

  - Introduce `RealtimeConversationManager` for realtime API management 
  - Add `op::conversation` to start conversation, insert audio, insert
  text, and close conversation.
  - emit conversation lifecycle and realtime events.
  - Move shared realtime payload types into codex-protocol and add core
  e2e websocket tests for start/replace/transport-close paths.
  
  Things to consider:
  - Should we use the same `op::` and `Events` channel to carry audio? I
  think we should try this simple approach and later we can create
  separate one if the channels got congested.
  - Sending text updates to the client: we can start simple and later
  restrict that.
  - Provider auth isn't wired for now intentionally

  Ahmed Ibrahim · 2026-02-20 19:06:35 -08:00
  6817f0be8a
• [apps] Bump MCP tool call timeout. (#12405)

  - [x] Bump MCP tool call timeout.

  Matthew Zeng · 2026-02-20 17:35:07 -08:00
  36a2a9fdbb
• [apps] Fix gateway url. (#12403)

  - [x] Fix connectors gateway url.

  Matthew Zeng · 2026-02-21 00:47:15 +00:00
  4ebdddaa34
• clarify model_catalog_json only applied on startup (#12379)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  sayan-oai · 2026-02-20 15:04:36 -08:00
  65b9fe8f30
• Move sanitizer into codex-secrets (#12306)

  ## Summary
  - move the sanitizer implementation into `codex-secrets`
  (`secrets/src/sanitizer.rs`) and re-export `redact_secrets`
  - switch `codex-core` to depend on/import `codex-secrets` for sanitizer
  usage
  - remove the old `utils/sanitizer` crate wiring and refresh lockfiles
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-secrets`
  - `cargo test -p codex-core --no-run`
  - `cargo clippy -p codex-secrets -p codex-core --all-targets
  --all-features -- -D warnings`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  
  ## Notes
  - not run: `cargo test --all-features` (full workspace suite)

  viyatb-oai · 2026-02-20 22:47:54 +00:00
  64f3827d10
• core tests: use hermetic mock server in review suite (#12291)

  ## Summary
  - switch the review test SSE mock helper to use the shared hermetic mock
  server setup
  - ensure review tests always have a default `/v1/models` stub during
  Codex session bootstrap
  - remove the race that caused intermittent `/v1/models` connection
  failures and flaky ETag refresh assertions
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-core --test all
  refresh_models_on_models_etag_mismatch_and_avoid_duplicate_models_fetch`
  - `cargo test -p codex-core --test all
  review_uses_custom_review_model_from_config`
  - repeated both targeted tests 5x in a loop
  - `cargo clippy -p codex-core --tests -- -D warnings`

  viyatb-oai · 2026-02-20 12:50:12 -08:00
  60c2b7beca
• fix(core): require approval for destructive MCP tool calls (#12353)

  Summary
  - ensure destructive tool annotations short-circuit to require approval
  - simplify approval logic to only require read/write + open-world when
  destructive is false
  - update the unit test to cover the new destructive behavior
  
  Testing
  - Not run (not requested)

  colby-oai · 2026-02-20 12:12:16 -08:00
  d3cf8bd0fa
• [apps] Implement apps configs. (#12086)

  - [x] Implement apps configs.

  Matthew Zeng · 2026-02-20 12:05:21 -08:00
  aa121a115e
• feat: add config allow_login_shell (#12312)
  jif-oai · 2026-02-20 20:02:24 +00:00
  5034d4bd89
• js_repl: remove codex.state helper references (#12275)

  ## Summary
  
  This PR removes `codex.state` from the `js_repl` helper surface and
  removes all corresponding documentation/instruction references.
  
  ## Motivation
  
  Top-level bindings in `js_repl` now persist across cells, so the extra
  `codex.state` helper is redundant and adds unnecessary API/docs surface.
  
  ## Changes
  
  - Removed the long-lived `state` object from the Node kernel helper
  wiring.
  - Stopped exposing `codex.state` (and `context.state`) during `js_repl`
  execution.
  - Updated user-facing `js_repl` docs to remove `codex.state`.
  - Updated generated instruction text and related test expectations to
  list only:
    - `codex.tmpDir`
    - `codex.tool(name, args?)`
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/12300
  - 👉 `2` https://github.com/openai/codex/pull/12275
  - ⏳ `3` https://github.com/openai/codex/pull/12205
  - ⏳ `4` https://github.com/openai/codex/pull/12185
  - ⏳ `5` https://github.com/openai/codex/pull/10673

  Curtis 'Fjord' Hawthorne · 2026-02-20 11:20:45 -08:00
  097620218d
• fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368)

  ## Summary
  Adds support for a Unix socket escape hatch so we can bypass socket
  allowlisting when explicitly enabled.
  
  ## Description
  * added a new flag, `network.dangerously_allow_all_unix_sockets` as an
  explicit escape hatch
  * In codex-network-proxy, enabling that flag now allows any absolute
  Unix socket path from x-unix-socket instead of requiring each path to be
  explicitly allowlisted. Relative paths are still rejected.
  * updated the macOS seatbelt path in core so it enforces the same Unix
  socket behavior:
    * allowlisted sockets generate explicit network* subpath rules
    * allow-all generates a broad network* (subpath "/") rule
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-20 10:56:57 -08:00
  28c0089060
• js_repl: block wrapped payload prefixes in grammar (#12300)

  ## Summary
  
  Tighten the `js_repl` freeform Lark grammar to block the most common
  malformed payload wrappers before they reach runtime validation.
  
  ## What Changed
  
  - Replaced the overly permissive `js_repl` freeform grammar (`start:
  /[\s\S]*/`) with a structured grammar that still supports:
    - plain JS source
    - optional first-line `// codex-js-repl:` pragma followed by JS source
  - Added grammar-level filtering for common bad payload shapes by
  rejecting inputs whose first significant token starts with:
    - `{` (JSON object wrapper like `{"code":"..."}`)
    - `"` (quoted code string)
    - `` ``` `` (markdown code fences)
  - Implemented the grammar without regex lookahead/lookbehind because the
  API-side Lark regex engine does not support look-around.
  - Added a unit test to validate the grammar shape and guard against
  reintroducing unsupported lookaround.
  
  ## Why
  
  `js_repl` is a freeform tool, but the model sometimes emits wrapped
  payloads (JSON, quoted strings, markdown fences) instead of raw
  JavaScript. We already reject those at runtime, but this change moves
  the constraint into the tool grammar so the model is less likely to
  generate invalid tool-call payloads in the first place.
  
  ## Testing
  
  - `cargo test -p codex-core
  js_repl_freeform_grammar_blocks_common_non_js_prefixes`
  - `cargo test -p codex-core parse_freeform_args_rejects_`
  
  ## Notes
  
  - This intentionally over-blocks a few uncommon valid JS starts (for
  example top-level `{ ... }` blocks or top-level quoted directives like
  `"use strict";`) in exchange for preventing the common wrapped-payload
  mistakes.
  
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/12300
  - ⏳ `2` https://github.com/openai/codex/pull/12275
  - ⏳ `3` https://github.com/openai/codex/pull/12205
  - ⏳ `4` https://github.com/openai/codex/pull/12185
  - ⏳ `5` https://github.com/openai/codex/pull/10673

  Curtis 'Fjord' Hawthorne · 2026-02-20 10:47:07 -08:00
  73fd939296
• Refactor network approvals to host/protocol/port scope (#12140)

  ## Summary
  Simplify network approvals by removing per-attempt proxy correlation and
  moving to session-level approval dedupe keyed by (host, protocol, port).
  Instead of encoding attempt IDs into proxy credentials/URLs, we now
  treat approvals as a destination policy decision.
  
  - Concurrent calls to the same destination share one approval prompt.
  - Different destinations (or same host on different ports) get separate
  prompts.
  - Allow once approves the current queued request group only.
  - Allow for session caches that (host, protocol, port) and auto-allows
  future matching requests.
  - Never policy continues to deny without prompting.
  
  Example:
  - 3 calls: 
    - a.com (line 443)
    - b.com (line 443)
    - a.com (line 443)
  => 2 prompts total (a, b), second a waits on the first decision.
  - a.com:80 is treated separately from a.com line 443
  
  ## Testing
  - `just fmt` (in `codex-rs`)
  - `cargo test -p codex-core tools::network_approval::tests`
  - `cargo test -p codex-core` (unit tests pass; existing
  integration-suite failures remain in this environment)

  viyatb-oai · 2026-02-20 10:39:55 -08:00
  e8afaed502
• Reuse connection between turns (#12294)

  Add a pool of one to the model client to reuse connections across turns.

  pakrym-oai · 2026-02-20 10:09:46 -08:00
  86803ca9bf
• feat: cleaner TUI for sub-agents (#12327)

  <img width="760" height="496" alt="Screenshot 2026-02-20 at 14 31 25"
  src="https://github.com/user-attachments/assets/1983b825-bb47-417e-9925-6f727af56765"
  />

  jif-oai · 2026-02-20 15:26:33 +00:00
  4d60c803ba
• Add MCP server context to otel tool_result logs (#12267)

  Summary
  - capture the origin for each configured MCP server and expose it via
  the connection manager
  - plumb MCP server name/origin into tool logging and emit
  codex.tool_result events with those fields
  - add unit coverage for origin parsing and extend OTEL tests to assert
  empty MCP fields for non-MCP tools
  - currently not logging full urls or url paths to prevent logging
  potentially sensitive data
  
  Testing
  - Not run (not requested)

  colby-oai · 2026-02-20 10:26:19 -05:00
  2036a5f5e0
• disable collab for phase 2 (#12326)
  jif-oai · 2026-02-20 14:51:17 +00:00
  ede561b5d1
• chore: better agent names (#12328)
  jif-oai · 2026-02-20 14:51:09 +00:00
  595665de35
• feat: add nick name to sub-agents (#12320)

  Adding random nick name to sub-agents. Used for UX
  
  At the same time, also storing and wiring the role of the sub-agent

  jif-oai · 2026-02-20 14:39:49 +00:00
  0f9eed3a6f
• chore: nit explorer (#12315)
  jif-oai · 2026-02-20 11:24:28 +00:00
  03ff04cd65
• Set memories phase reasoning effort constants (#12309)

  ## Summary
  - add reasoning effort constants for the memories phase one and phase
  two agents
  - wire the constants into phase1 request creation and phase2 agent
  configuration so the default efforts are always applied
  
  ## Testing
  - Not run (not requested)

  jif-oai · 2026-02-20 09:25:35 +00:00
  a7632f68a6
• memories: add rollout_summary_file header to raw memories and tune prompts (#12221)

  ## Summary
  - Add `rollout_summary_file: <generated>.md` to each thread header in
  `raw_memories.md` so Phase 2 can reliably reference the canonical
  rollout summary filename.
  - Update the memory prompts/templates (`stage_one_system`,
  `consolidation`, `read_path`) for the new task-oriented raw-memory /
  MEMORY.md schema and stronger consolidation guidance.
  
  ## Details
  - `codex-rs/core/src/memories/storage.rs`
  - Writes the generated `rollout_summary_file` path into the per-thread
  metadata header when rebuilding `raw_memories.md`.
  - `codex-rs/core/src/memories/tests.rs`
  - Verifies the canonical `rollout_summary_file` header is present and
  ordered after `updated_at`/`cwd` in `raw_memories.md`.
  - Verifies task-structured raw-memory content is preserved while the
  canonical header is added.
  - `codex-rs/core/templates/memories/*.md`
  - Updates the stage-1 raw-memory format to task-grouped sections
  (`task`, `task_group`, `task_outcome`).
  - Updates Phase 2 consolidation guidance around recency (`updated_at`),
  task-oriented `MEMORY.md` blocks, and richer evidence-backed
  consolidation.
  - Tweaks the quick memory pass wording to emphasize topics/workflows in
  addition to keywords.
  
  ## Testing
  - `cargo test -p codex-core memories`

  zuxin-oai · 2026-02-20 09:13:35 +00:00
  e747a8eb74
• [apps] Store apps tool cache in disk to reduce startup time. (#11822)

  We now write MCP tools from installed apps to disk cache so that they
  can be picked up instantly at startup. We still do a fresh fetch from
  remote MCP server but it's non blocking unless there's a cache miss.
  
  - [x] Store apps tool cache in disk to reduce startup time.

  Matthew Zeng · 2026-02-19 22:06:51 -08:00
  18bd6d2d71
• skill-creator: lazy-load PyYAML in frontmatter parsing (#12080)

  init-skill should work even without PyYAML

  xl-openai · 2026-02-19 15:09:12 -08:00
  e4456840f5
• feat(config): add permissions.network proxy config wiring (#12054)

  ## Summary
  
  Implements the `ConfigToml.permissions.network` and uses it to populate
  `NetworkProxyConfig`. We now parse a new nested permissions/network
  config shape which is converted into the proxy’s runtime config.
  
  When managed requirements exist, we still apply those constraints on top
  of user settings (so managed policy still wins).
  
  * Cleaned up the old constructor path so it now accepts both user config
  + managed constraints directly.
  * Updated the reload path so live proxy config reloads respect
  [permissions.network] too, while still supporting the existing top-level
  [network] format.
  
  ### Behavior
  - User-defined `[permissions.network]` values are now honored.
  - Managed constraints still take effect and are validated against the
  resulting policy.

  viyatb-oai · 2026-02-19 13:44:55 -08:00
  4edb1441a7
• Add configurable MCP OAuth callback URL for MCP login (#11382)

  ## Summary
  
  Implements a configurable MCP OAuth callback URL override for `codex mcp
  login` and app-server OAuth login flows, including support for non-local
  callback endpoints (for example, devbox ingress URLs).
  
  ## What changed
  
  - Added new config key: `mcp_oauth_callback_url` in
  `~/.codex/config.toml`.
  - OAuth authorization now uses `mcp_oauth_callback_url` as
  `redirect_uri` when set.
  - Callback handling validates the callback path against the configured
  redirect URI path.
  - Listener bind behavior is now host-aware:
  - local callback URL hosts (`localhost`, `127.0.0.1`, `::1`) bind to
  `127.0.0.1`
    - non-local callback URL hosts bind to `0.0.0.0`
  - `mcp_oauth_callback_port` remains supported and is used for the
  listener port.
  - Wired through:
    - CLI MCP login flow
    - App-server MCP OAuth login flow
    - Skill dependency OAuth login flow
  - Updated config schema and config tests.
  
  ## Why
  
  Some environments need OAuth callbacks to land on a specific reachable
  URL (for example ingress in remote devboxes), not loopback. This change
  allows that while preserving local defaults for existing users.
  
  ## Backward compatibility
  
  - No behavior change when `mcp_oauth_callback_url` is unset.
  - Existing `mcp_oauth_callback_port` behavior remains intact.
  - Local callback flows continue binding to loopback by default.
  
  ## Testing
  
  - `cargo test -p codex-rmcp-client callback -- --nocapture`
  - `cargo test -p codex-core --lib mcp_oauth_callback -- --nocapture`
  - `cargo check -p codex-cli -p codex-app-server -p codex-rmcp-client`
  
  ## Example config
  
  ```toml
  mcp_oauth_callback_port = 5555
  mcp_oauth_callback_url = "https://<devbox>-<namespace>.gateway.<cluster>.internal.api.openai.org/callback"

  dkumar-oai · 2026-02-19 13:32:10 -08:00
  1070a0a712
• fix(bazel): replace askama templates with include_str! in memories (#11778)

  ## Summary
  
  - The experimental Bazel CI builds fail on all platforms because askama
  resolves template paths relative to `CARGO_MANIFEST_DIR`, which points
  outside the Bazel sandbox. This produces errors like:
    ```
  error: couldn't read
  `codex-rs/core/src/memories/../../../../../../../../../../../work/codex/codex/codex-rs/core/templates/memories/consolidation.md`:
  No such file or directory
    ```
  - Replaced `#[derive(Template)]` + `#[template(path = "...")]` with
  `include_str!` + `str::replace()` for the three affected templates
  (`consolidation.md`, `stage_one_input.md`, `read_path.md`).
  `include_str!` resolves paths relative to the source file, which works
  correctly in both Cargo and Bazel builds.
  - The templates only use simple `{{ variable }}` substitution with no
  control flow or filters, so no askama functionality is lost.
  - Removes the `askama` dependency from `codex-core` since it was the
  only crate using it. The workspace-level dependency definition is left
  in place.
  - This matches the existing pattern used throughout the codebase — e.g.
  `codex-rs/core/src/memories/mod.rs` already uses
  `include_str!("../../templates/memories/stage_one_system.md")` for the
  fourth template file.
  
  ## Test plan
  
  - [ ] Verify Bazel (experimental) CI passes on all platforms
  - [ ] Verify rust-ci (Cargo) builds and tests continue to pass
  - [ ] Verify `cargo test -p codex-core` passes locally

  Alex Kwiatkowski · 2026-02-19 16:29:26 -05:00
  fe7054a346
• ws turn metadata via client_metadata (#11953)
  pash-openai · 2026-02-19 12:28:15 -08:00
  429cc4860e
• Clarify cumulative proposed_plan behavior in Plan mode (#12265)

  ## Summary
  - Require revised `<proposed_plan>` blocks in the same planning session
  to be complete replacements, not partial/delta plans.
  - Scope that cumulative replacement rule to the current planning session
  only.
  - Clarify that after leaving Plan mode (for example switching to Default
  mode to implement) or when explicitly asked for a new plan, the model
  should produce a new self-contained plan without inheriting prior plan
  blocks unless requested.
  
  ## Testing
  - Not run (prompt/template text-only change).

  Charley Cunningham · 2026-02-19 12:18:23 -08:00
  c3cb38eafb
• Skip removed features during metrics emission (#12253)

  Summary
  - avoid emitting metrics for features marked as `Stage::Removed`
  - keep feature metrics aligned with active and planned states only
  
  Testing
  - Not run (not requested)

  jif-oai · 2026-02-19 19:58:46 +00:00
  0362e12da6
• feat: add Reject approval policy with granular prompt rejection controls (#12087)

  ## Why
  
  We need a way to auto-reject specific approval prompt categories without
  switching all approvals off.
  
  The goal is to let users independently control:
  - sandbox escalation approvals,
  - execpolicy `prompt` rule approvals,
  - MCP elicitation prompts.
  
  ## What changed
  
  - Added a new primary approval mode in `protocol/src/protocol.rs`:
  
  ```rust
  pub enum AskForApproval {
      // ...
      Reject(RejectConfig),
      // ...
  }
  
  pub struct RejectConfig {
      pub sandbox_approval: bool,
      pub rules: bool,
      pub mcp_elicitations: bool,
  }
  ```
  
  - Wired `RejectConfig` semantics through approval paths in `core`:
    - `core/src/exec_policy.rs`
      - rejects rule-driven prompts when `rules = true`
      - rejects sandbox/escalation prompts when `sandbox_approval = true`
  - preserves rule priority when both rule and sandbox prompt conditions
  are present
    - `core/src/tools/sandboxing.rs`
  - applies `sandbox_approval` to default exec approval decisions and
  sandbox-failure retry gating
    - `core/src/safety.rs`
  - keeps `Reject { all false }` behavior aligned with `OnRequest` for
  patch safety
      - rejects out-of-root patch approvals when `sandbox_approval = true`
    - `core/src/mcp_connection_manager.rs`
      - auto-declines MCP elicitations when `mcp_elicitations = true`
  
  - Ensured approval policy used by MCP elicitation flow stays in sync
  with constrained session policy updates.
  
  - Updated app-server v2 conversions and generated schema/TypeScript
  artifacts for the new `Reject` shape.
  
  ## Verification
  
  Added focused unit coverage for the new behavior in:
  - `core/src/exec_policy.rs`
  - `core/src/tools/sandboxing.rs`
  - `core/src/mcp_connection_manager.rs`
  - `core/src/safety.rs`
  - `core/src/tools/runtimes/apply_patch.rs`
  
  Key cases covered include rule-vs-sandbox prompt precedence, MCP
  auto-decline behavior, and patch/sandbox retry behavior under
  `RejectConfig`.

  Michael Bolin · 2026-02-19 11:41:49 -08:00
  425fff7ad6
• try fix 2 (#12264)
  jif-oai · 2026-02-19 19:36:42 +00:00
  f6c06108b1
• Revert "feat: no timeout mode on ue" (#12256)

  Reverts openai/codex#12250

  jif-oai · 2026-02-19 19:02:29 +00:00
  928be5f515
• chore: consolidate new() and initialize() for McpConnectionManager (#12255)

  ## Why
  `McpConnectionManager` used a two-phase setup (`new()` followed by
  `initialize()`), which forced call sites to construct placeholder state
  and then mutate it asynchronously. That made MCP startup/refresh flows
  harder to follow and easier to misuse, especially around cancellation
  token ownership.
  
  ## What changed
  - Replaced the two-phase initialization flow with a single async
  constructor: `McpConnectionManager::new(...) -> (Self,
  CancellationToken)`.
  - Added `McpConnectionManager::new_uninitialized()` for places that need
  an empty manager before async startup begins.
  - Added `McpConnectionManager::new_mcp_connection_manager_for_tests()`
  for test-only construction.
  - Updated MCP startup and refresh call sites in
  `codex-rs/core/src/codex.rs` to build a fresh manager via `new(...)`,
  swap it in, and update the startup cancellation token consistently.
  - Updated MCP snapshot/connector call sites in
  `codex-rs/core/src/mcp/mod.rs` and `codex-rs/core/src/connectors.rs` to
  use the consolidated constructor.
  - Removed the now-obsolete `reset_mcp_startup_cancellation_token()`
  helper in favor of explicit token replacement at the call sites.
  
  ## Testing
  - Not run (refactor-only change; no new behavior was intended).

  Michael Bolin · 2026-02-19 10:59:51 -08:00
  7cd2e84026
• feat: no timeout mode on ue (#12250)
  jif-oai · 2026-02-19 18:58:13 +00:00
  9719dc502c
• Add configurable agent spawn depth (#12251)

  Summary
  - expose `agents.max_depth` in config schema and toml parsing, with
  defaults and validation
  - thread-spawn depth guards and multi-agent handler now respect the
  configured limit instead of a hardcoded value
  - ensure documentation and helpers account for agent depth limits

  jif-oai · 2026-02-19 18:40:41 +00:00
  d87cf7794c
• client side modelinfo overrides (#12101)

  TL;DR
  Add top-level `model_catalog_json` config support so users can supply a
  local model catalog override from a JSON file path (including adding new
  models) without backend changes.
  
  ### Problem
  Codex previously had no clean client-side way to replace/overlay model
  catalog data for local testing of model metadata and new model entries.
  
  ### Fix
  - Add top-level `model_catalog_json` config field (JSON file path).
  - Apply catalog entries when resolving `ModelInfo`:
    1. Base resolved model metadata (remote/fallback)
    2. Catalog overlay from `model_catalog_json`
  3. Existing global top-level overrides (`model_context_window`,
  `model_supports_reasoning_summaries`, etc.)
  
  ### Note
  Will revisit per-field overrides in a follow-up
  
  ### Tests
  Added tests

  sayan-oai · 2026-02-19 10:38:57 -08:00
  d54999d006