codex

feat: use shell policy in shell snapshot (#11759 )

Honor `shell_environment_policy.set` even after a shell snapshot

jif-oai · 2026-02-16 09:11:00 +00:00

825a4af42f

feat(core): add structured network approval plumbing and policy decision model (#11672 )

### Description
#### Summary
Introduces the core plumbing required for structured network approvals

#### What changed
- Added structured network policy decision modeling in core.
- Added approval payload/context types needed for network approval
semantics.
- Wired shell/unified-exec runtime plumbing to consume structured
decisions.
- Updated related core error/event surfaces for structured handling.
- Updated protocol plumbing used by core approval flow.
- Included small CLI debug sandbox compatibility updates needed by this
layer.

#### Why
establishes the minimal backend foundation for network approvals without
yet changing high-level orchestration or TUI behavior.

#### Notes
- Behavior remains constrained by existing requirements/config gating.
- Follow-up PRs in the stack handle orchestration, UX, and app-server
integration.

---------

Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

viyatb-oai · 2026-02-14 04:18:12 +00:00

b527ee2890

Remove test-support feature from codex-core and replace it with explicit test toggles (#11405 )

## Why

`codex-core` was being built in multiple feature-resolved permutations
because test-only behavior was modeled as crate features. For a large
crate, those permutations increase compile cost and reduce cache reuse.

## Net Change

- Removed the `test-support` crate feature and related feature wiring so
`codex-core` no longer needs separate feature shapes for test consumers.
- Standardized cross-crate test-only access behind
`codex_core::test_support`.
- External test code now imports helpers from
`codex_core::test_support`.
- Underlying implementation hooks are kept internal (`pub(crate)`)
instead of broadly public.

## Outcome

- Fewer `codex-core` build permutations.
- Better incremental cache reuse across test targets.
- No intended production behavior change.

Michael Bolin · 2026-02-10 22:44:02 -08:00

476c1a7160

Remove deterministic_process_ids feature to avoid duplicate codex-core builds (#11393 )

## Why

`codex-core` enabled `deterministic_process_ids` through a self
dev-dependency.
That forced a second feature-resolved build of the same crate, which
increased
compile time and test latency.

## What Changed

- Removed the `deterministic_process_ids` feature from
`codex-rs/core/Cargo.toml`.
- Removed the self dev-dependency on `codex-core` that enabled that
feature.
- Removed the Bazel `deterministic_process_ids` crate feature for
`codex-core`.
- Added a test-only `AtomicBool` override in unified exec process-id
allocation.
- Added a test-support setter for that override and re-exported it from
`codex-core`.
- Enabled deterministic process IDs in integration tests via
`core_test_support` ctor.

## Behavior

- Production behavior remains random process IDs.
- Unit tests remain deterministic via `cfg(test)`.
- Integration tests remain deterministic via explicit test-support
initialization.

## Validation

- `just fmt`
- `cargo test -p codex-core unified_exec::`
- `cargo test -p codex-core --test all unified_exec -- --test-threads=1`
- `cargo tree -p codex-core -e features` (verified the removed feature
path)

Michael Bolin · 2026-02-10 19:07:01 -08:00

b68a84ee8e

feat(sandbox): enforce proxy-aware network routing in sandbox (#11113 )

## Summary
- expand proxy env injection to cover common tool env vars
(`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`/`NO_PROXY` families +
tool-specific variants)
- harden macOS Seatbelt network policy generation to route through
inferred loopback proxy endpoints and fail closed when proxy env is
malformed
- thread proxy-aware Linux sandbox flags and add minimal bwrap netns
isolation hook for restricted non-proxy runs
- add/refresh tests for proxy env wiring, Seatbelt policy generation,
and Linux sandbox argument wiring

viyatb-oai · 2026-02-10 07:44:21 +00:00

3391e5ea86

feat: use a notify instead of grace to close ue process (#11219 )

jif-oai · 2026-02-09 22:14:33 +00:00

c2ca51273f

feat: include NetworkConfig through ExecParams (#11105 )

This PR adds the following field to `Config`:

```rust
pub network: Option<NetworkProxy>,
```

Though for the moment, it will always be initialized as `None` (this
will be addressed in a subsequent PR).

This PR does the work to thread `network` through to `execute_exec_env()`, `process_exec_tool_call()`, and `UnifiedExecRuntime.run()` to ensure it is available whenever we span a process.

Michael Bolin · 2026-02-09 03:32:17 +00:00

383b45279e

Removed "exec_policy" feature flag (#10851 )

This is no longer needed because it's on by default

Eric Traut · 2026-02-06 08:59:47 -08:00

4521a6e852

Inject CODEX_THREAD_ID into the terminal environment (#10096 )

Inject CODEX_THREAD_ID (when applicable) into the terminal environment
so that the agent (and skills) can refer to the current thread / session
ID.

Discussion:
https://openai.slack.com/archives/C095U48JNL9/p1769542492067109

Max Johnson · 2026-02-03 11:31:12 -08:00

66b196a725

feat(core) RequestRule (#9489 )

## Summary
Instead of trying to derive the prefix_rule for a command mechanically,
let's let the model decide for us.

## Testing
- [x] tested locally

Dylan Hurd · 2026-01-28 08:43:17 +00:00

996e09ca24

fix unified_exec::tests::unified_exec_timeouts to use a more unique match value (#9414 )

Fix unified_exec_timeouts to use a unique variable value rather than
"codex" which was causing false positives when running tests locally
(presumably from my bash prompts). Discovered while running tests to
validate another change.

Fixes https://github.com/openai/codex/issues/9413

Test Plan:

Ran test locally on my fedora 43 x86_64 machine with:
```
cd codex/cargo-rs
cargo nextest run --all-features --no-fail-fast unified_exec::tests::unified_exec_timeouts
```

Before, unified_exec_timeouts fails:
```
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.38s
────────────
 Nextest run ID fa2b4949-a66c-408c-8002-32c52c70ec4f with nextest profile: default
    Starting 1 test across 107 binaries (3211 tests skipped)
        FAIL [   5.667s] codex-core unified_exec::tests::unified_exec_timeouts
  stdout ───

    running 1 test
    test unified_exec::tests::unified_exec_timeouts ... FAILED

    failures:

    failures:
        unified_exec::tests::unified_exec_timeouts

    test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 774 filtered out; finished in 5.66s

  stderr ───

    thread 'unified_exec::tests::unified_exec_timeouts' (459601) panicked at core/src/unified_exec/mod.rs:381:9:
    timeout too short should yield incomplete output
    note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

────────────
     Summary [   5.677s] 1 test run: 0 passed, 1 failed, 3211 skipped
        FAIL [   5.667s] codex-core unified_exec::tests::unified_exec_timeouts
error: test run failed

```

After, works:
```
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.34s
────────────
 Nextest run ID f49e9004-e30b-4049-b0ff-283b543a1cd7 with nextest profile: default
    Starting 1 test across 107 binaries (3211 tests skipped)
        SLOW [> 15.000s] codex-core unified_exec::tests::unified_exec_timeouts
        PASS [  17.666s] codex-core unified_exec::tests::unified_exec_timeouts
────────────
     Summary [  17.676s] 1 test run: 1 passed (1 slow), 3211 skipped
```

Alex Hornby · 2026-01-17 09:05:53 -08:00

b877a2041e

chore: close pipe on non-pty processes (#9369 )

Closing the STDIN of piped process when starting them to avoid commands
like `rg` to wait for content on STDIN and hangs for ever

jif-oai · 2026-01-16 15:54:32 +01:00

1668ca726f

feat: CODEX_CI (#9366 )

jif-oai · 2026-01-16 13:52:16 +00:00

7fc49697dd

feat: adding piped process to replace PTY when needed (#8797 )

jif-oai · 2026-01-14 18:44:04 +00:00

577e1fd1b2

chore: clamp min yield time for empty write_stdin (#9156 )

After evals, 0 impact on performance

jif-oai · 2026-01-14 16:25:40 +00:00

32b1795ff4

fix: drop double waiting header in TUI (#9145 )

jif-oai · 2026-01-14 09:52:34 +00:00

7532f34699

chore: rename unified exec sessions (#8822 )

Renaming done by Codex

jif-oai · 2026-01-07 16:12:47 +00:00

4cef89a122

feat: add head-tail buffer for unified_exec (#8735 )

jif-oai · 2026-01-06 15:48:44 +00:00

32db8ea5ca

chore: emit unified exec begin only when PTY exist (#8780 )

jif-oai · 2026-01-06 13:12:54 +00:00

8858012fd1

chore: GH pager (#8747 )

jif-oai · 2026-01-05 18:40:34 +00:00

fabb797097

fix: limit output size for exec command in unified exec (#8460 )

### Issue
[Investigation
thread](https://openai.slack.com/archives/C095U48JNL9/p1766426234975789)

Github issue: [issue one](https://github.com/openai/codex/issues/8197),
[issue two](https://github.com/openai/codex/issues/8358), [issue
three](https://github.com/openai/codex/issues/7585)
Commonality: working in monorepo and large projects. Multiple threads
going and showing sluggishness ending with a crash and grey background.
Potential high usage of context.
How to reproduce:
* Open the whole monorepo with cursor or VSC on the latest extension.
* Run ls -R in current CWD.

### Change
In unified exec, we do not have max output check to the delta we ouput
for shell commands. This causes issue with our VSCE UI which take the
delta and construct the shell output.

Shijie Rao · 2025-12-23 14:36:15 -08:00

fb24c47bea

Add ExecPolicyManager (#8349 )

Move exec policy management into services to keep turn context
immutable.

pakrym-oai · 2025-12-22 09:59:32 -08:00

96fdbdd434

chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder (#8276 )

https://github.com/openai/codex/pull/8235 introduced `ConfigBuilder` and
this PR updates all call non-test call sites to use it instead of
`Config::load_from_base_config_with_overrides()`.

This is important because `load_from_base_config_with_overrides()` uses
an empty `ConfigRequirements`, which is a reasonable default for testing
so the tests are not influenced by the settings on the host. This method
is now guarded by `#[cfg(test)]` so it cannot be used by business logic.

Because `ConfigBuilder::build()` is `async`, many of the test methods
had to be migrated to be `async`, as well. On the bright side, this made
it possible to eliminate a bunch of `block_on_future()` stuff.

Michael Bolin · 2025-12-18 16:12:52 -08:00

3d4ced3ff5

nit: prevent race in event rendering (#8181 )

jif-oai · 2025-12-17 13:24:02 +00:00

0abaf1b57c

refactoring with_escalated_permissions to use SandboxPermissions instead (#7750 )

helpful in the future if we want more granularity for requesting
escalated permissions:
e.g when running in readonly sandbox, model can request to escalate to a
sandbox that allows writes

zhao-oai · 2025-12-10 17:18:48 +00:00

e0fb3ca1db

fix: flaky test 2 (#7818 )

jif-oai · 2025-12-10 16:35:28 +00:00

463249eff3

chore: rework unified exec events (#7775 )

jif-oai · 2025-12-10 10:30:38 +00:00

0ad54982ae

Do not emit start/end events for write stdin (#7561 )

pakrym-oai · 2025-12-08 15:23:02 -08:00

ac5fa6baf8

fix: release session ID when not used (#7592 )

jif-oai · 2025-12-04 17:42:16 +00:00

36edb412b1

Use shared check sandboxing (#7547 )

pakrym-oai · 2025-12-04 08:34:09 -08:00

f1b7cdc3bd

Slightly better status display for unified exec (#7563 )

Trim bash -lc

pakrym-oai · 2025-12-04 08:32:54 -08:00

c4e18f1b63

whitelist command prefix integration in core and tui (#7033 )

this PR enables TUI to approve commands and add their prefixes to an
allowlist:
<img width="708" height="605" alt="Screenshot 2025-11-21 at 4 18 07 PM"
src="https://github.com/user-attachments/assets/56a19893-4553-4770-a881-becf79eeda32"
/>

note: we only show the option to whitelist the command when 
1) command is not multi-part (e.g `git add -A && git commit -m 'hello
world'`)
2) command is not already matched by an existing rule

zhao-oai · 2025-12-03 23:17:02 -08:00

e925a380dc

chore: update unified exec sandboxing detection (#7541 )

No integration test for now because it would make them flaky. Tracking
it in my todos to add some once we have a clock based system for
integration tests

jif-oai · 2025-12-03 20:06:47 +00:00

8d0f023fa9

chore: make create_approval_requirement_for_command an async fn (#7501 )

I think this might help with https://github.com/openai/codex/pull/7033
because `create_approval_requirement_for_command()` will soon need
access to `Session.state`, which is a `tokio::sync::Mutex` that needs to
be accessed via `async`.

Michael Bolin · 2025-12-02 15:01:15 -08:00

ec93b6daf3

feat: add warning message for the model (#7445 )

Add a warning message as a user turn to the model if the model does not
behave as expected (here, for example, if the model opens too many
`unified_exec` sessions)

jif-oai · 2025-12-02 11:56:00 +00:00

9ee855ec57

chore: better session recycling (#7368 )

jif-oai · 2025-11-30 12:42:26 -08:00

457c9fdb87

feat: update process ID for event handling (#7261 )

jif-oai · 2025-11-25 14:21:05 -08:00

28ff364c3a

fix: drop conversation when /new (#7297 )

jif-oai · 2025-11-25 17:20:25 +00:00

2845e2c006

feat: add custom env for unified exec process (#7286 )

jif-oai · 2025-11-25 10:35:35 +00:00

37d83e075e

fix: don't store early exit sessions (#7263 )

jif-oai · 2025-11-24 21:14:24 +00:00

fc2ff624ac

feat: unified exec basic pruning strategy (#7239 )

LRU + exited sessions first

jif-oai · 2025-11-24 17:22:32 +00:00

b2cddec3d7

Allow unified_exec to early exit (if the process terminates before yield_time_ms) (#6867 )

Thread through an `exit_notify` tokio `Notify` through to the
`UnifiedExecSession` so that we can return early if the command
terminates before `yield_time_ms`.

As Codex review correctly pointed out below 🙌 we also need a
`exit_signaled` flag so that commands which finish before we start
waiting can also exit early.

Since the default `yield_time_ms` is now 10s, this means that we don't
have to wait 10s for trivial commands like ls, sed, etc (which are the
majority of agent commands 😅)

---------

Co-authored-by: jif-oai <jif@openai.com>

hanson-openai · 2025-11-20 13:34:41 +01:00

b5dd189067

execpolicy2 core integration (#6641 )

This PR threads execpolicy2 into codex-core.

activated via feature flag: exec_policy (on by default)

reads and parses all .codexpolicy files in `codex_home/codex`

refactored tool runtime API to integrate execpolicy logic

---------

Co-authored-by: Michael Bolin <mbolin@openai.com>

zhao-oai · 2025-11-19 16:50:43 -08:00

65c13f1ae7

Move shell to use truncate_text (#6842 )

Move shell to use the configurable `truncate_text`

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

Ahmed Ibrahim · 2025-11-19 01:56:08 -08:00

efebc62fb7

Add the utility to truncate by tokens (#6746 )

- This PR is to make it on path for truncating by tokens. This path will
be initially used by unified exec and context manager (responsible for
MCP calls mainly).
- We are exposing new config `calls_output_max_tokens`
- Use `tokens` as the main budget unit but truncate based on the model
family by Introducing `TruncationPolicy`.
- Introduce `truncate_text` as a router for truncation based on the
mode.

In next PRs:
- remove truncate_with_line_bytes_budget
- Add the ability to the model to override the token budget.

Ahmed Ibrahim · 2025-11-18 11:36:23 -08:00

3de8790714

Refactor truncation helpers into its own file (#6683 )

That's to centralize the truncation in one place. Next step would be to
make only two methods public: one with bytes/lines and one with tokens.

Ahmed Ibrahim · 2025-11-15 06:44:23 +00:00

94dfb211af

feat: better UI for unified_exec (#6515 )

<img width="376" height="132" alt="Screenshot 2025-11-12 at 17 36 22"
src="https://github.com/user-attachments/assets/ce693f0d-5ca0-462e-b170-c20811dcc8d5"
/>

jif-oai · 2025-11-14 16:31:12 +01:00

63c8c01f40

Revert "Revert "Overhaul shell detection and centralize command generation for unified exec"" (#6607 )

Reverts openai/codex#6606

pakrym-oai · 2025-11-13 16:45:17 -08:00

7b027e7536

Update default yield time (#6610 )

10s for exec and 250ms for write_stdin

pakrym-oai · 2025-11-13 10:24:41 -08:00

0792a7953d

Revert "Overhaul shell detection and centralize command generation for unified exec" (#6606 )

Reverts openai/codex#6577

pakrym-oai · 2025-11-13 08:43:00 -08:00

e6995174c1

67 Commits