2653 Commits

• fix: support split carveouts in windows elevated sandbox (#14568)

  ## Summary
  - preserve legacy Windows elevated sandbox behavior for existing
  policies
  - add elevated-only support for split filesystem policies that can be
  represented as readable-root overrides, writable-root overrides, and
  extra deny-write carveouts
  - resolve those elevated filesystem overrides during sandbox transform
  and thread them through setup and policy refresh
  - keep failing closed for explicit unreadable (`none`) carveouts and
  reopened writable descendants under read-only carveouts
  - for explicit read-only-under-writable-root carveouts, materialize
  missing carveout directories during elevated setup before applying the
  deny-write ACL
  - document the elevated vs restricted-token support split in the core
  README
  
  ## Example
  Given a split filesystem policy like:
  
  ```toml
  ":root" = "read"
  ":cwd" = "write"
  "./docs" = "read"
  "C:/scratch" = "write"
  ```
  
  the elevated backend now provisions the readable-root overrides,
  writable-root overrides, and extra deny-write carveouts during setup and
  refresh instead of collapsing back to the legacy workspace-only shape.
  
  If a read-only carveout under a writable root is missing at setup time,
  elevated setup creates that carveout as an empty directory before
  applying its deny-write ACE; otherwise the sandboxed command could
  create it later and bypass the carveout. This is only for explicit
  policy carveouts. Best-effort workspace protections like `.codex/` and
  `.agents/` still skip missing directories.
  
  A policy like:
  
  ```toml
  "/workspace" = "write"
  "/workspace/docs" = "read"
  "/workspace/docs/tmp" = "write"
  ```
  
  still fails closed, because the elevated backend does not reopen
  writable descendants under read-only carveouts yet.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-04-09 17:34:52 -07:00
  b976e701a8
• Stop Realtime V2 response.done delegation (#17267)

  Stop parsing Realtime V2 response completion as a Codex handoff;
  delegation stays tied to item completion.\n\nValidation: just fmt; git
  diff --check
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-09 17:17:49 -07:00
  32224878b3
• Omit empty app-server instruction overrides (#17258)

  ## Summary
  - omit serialized Responses instructions when an app-server base
  instruction override is empty
  - skip empty developer instruction messages and add v2 coverage for the
  empty-override request shape
  
  ## Validation
  - just fmt
  - git diff --check

  Ahmed Ibrahim · 2026-04-09 15:29:35 -07:00
  ecca34209d
• [mcp] Expand tool search to custom MCPs. (#16944)

  - [x] Expand tool search to custom MCPs.
  - [x] Rename several variables/fields to be more generic.
  
  Updated tool & server name lifecycles:
  
  **Raw Identity**
  
  ToolInfo.server_name is raw MCP server name.
  ToolInfo.tool.name is raw MCP tool name.
  MCP calls route back to raw via parse_tool_name() returning
  (tool.server_name, tool.tool.name).
  mcpServerStatus/list now groups by raw server and keys tools by
  Tool.name: mod.rs:599
  App-server just forwards that grouped raw snapshot:
  codex_message_processor.rs:5245
  
  **Callable Names**
  
  On list-tools, we create provisional callable_namespace / callable_name:
  mcp_connection_manager.rs:1556
  For non-app MCP, provisional callable name starts as raw tool name.
  For codex-apps, provisional callable name is sanitized and strips
  connector name/id prefix; namespace includes connector name.
  Then qualify_tools() sanitizes callable namespace + name to ASCII alnum
  / _ only: mcp_tool_names.rs:128
  Note: this is stricter than Responses API. Hyphen is currently replaced
  with _ for code-mode compatibility.
  
  **Collision Handling**
  
  We do initially collapse example-server and example_server to the same
  base.
  Then qualify_tools() detects distinct raw namespace identities behind
  the same sanitized namespace and appends a hash to the callable
  namespace: mcp_tool_names.rs:137
  Same idea for tool-name collisions: hash suffix goes on callable tool
  name.
  Final list_all_tools() map key is callable_namespace + callable_name:
  mcp_connection_manager.rs:769
  
  **Direct Model Tools**
  
  Direct MCP tool declarations use the full qualified sanitized key as the
  Responses function name.
  The raw rmcp Tool is converted but renamed for model exposure.
  
  **Tool Search / Deferred**
  
  Tool search result namespace = final ToolInfo.callable_namespace:
  tool_search.rs:85
  Tool search result nested name = final ToolInfo.callable_name:
  tool_search.rs:86
  Deferred tool handler is registered as "{namespace}:{name}":
  tool_registry_plan.rs:248
  When a function call comes back, core recombines namespace + name, looks
  up the full qualified key, and gets the raw server/tool for MCP
  execution: codex.rs:4353
  
  **Separate Legacy Snapshot**
  
  collect_mcp_snapshot_from_manager_with_detail() still returns a map
  keyed by qualified callable name.
  mcpServerStatus/list no longer uses that; it uses
  McpServerStatusSnapshot, which is raw-inventory shaped.

  Matthew Zeng · 2026-04-09 13:34:52 -07:00
  d7f99b0fa6
• Forward app-server turn clientMetadata to Responses (#16009)

  ## Summary
  App-server v2 already receives turn-scoped `clientMetadata`, but the
  Rust app-server was dropping it before the outbound Responses request.
  This change keeps the fix lightweight by threading that metadata through
  the existing turn-metadata path rather than inventing a new transport.
  
  ## What we're trying to do and why
  We want turn-scoped metadata from the app-server protocol layer,
  especially fields like Hermes/GAAS run IDs, to survive all the way to
  the actual Responses API request so it is visible in downstream
  websocket request logging and analytics.
  
  The specific bug was:
  - app-server protocol uses camelCase `clientMetadata`
  - Responses transport already has an existing turn metadata carrier:
  `x-codex-turn-metadata`
  - websocket transport already rewrites that header into
  `request.request_body.client_metadata["x-codex-turn-metadata"]`
  - but the Rust app-server never parsed or stored `clientMetadata`, so
  nothing from the app-server request was making it into that existing
  path
  
  This PR fixes that without adding a new header or a second metadata
  channel.
  
  ## How we did it
  ### Protocol surface
  - Add optional `clientMetadata` to v2 `TurnStartParams` and
  `TurnSteerParams`
  - Regenerate the JSON schema / TypeScript fixtures
  - Update app-server docs to describe the field and its behavior
  
  ### Runtime plumbing
  - Add a dedicated core op for app-server user input carrying turn-scoped
  metadata: `Op::UserInputWithClientMetadata`
  - Wire `turn/start` and `turn/steer` through that op / signature path
  instead of dropping the metadata at the message-processor boundary
  - Store the metadata in `TurnMetadataState`
  
  ### Transport behavior
  - Reuse the existing serialized `x-codex-turn-metadata` payload
  - Merge the new app-server `clientMetadata` into that JSON additively
  - Do **not** replace built-in reserved fields already present in the
  turn metadata payload
  - Keep websocket behavior unchanged at the outer shape level: it still
  sends only `client_metadata["x-codex-turn-metadata"]`, but that JSON
  string now contains the merged fields
  - Keep HTTP fallback behavior unchanged except that the existing
  `x-codex-turn-metadata` header now includes the merged fields too
  
  ### Request shape before / after
  Before, a websocket `response.create` looked like:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\"}"
    }
  }
  ```
  Even if the app-server caller supplied `clientMetadata`, it was not
  represented there.
  
  After, the same request shape is preserved, but the serialized payload
  now includes the new turn-scoped fields:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\",\"fiber_run_id\":\"fiber-start-123\",\"origin\":\"gaas\"}"
    }
  }
  ```
  
  ## Validation
  ### Targeted tests added / updated
  - protocol round-trip coverage for `clientMetadata` on `turn/start` and
  `turn/steer`
  - protocol round-trip coverage for `Op::UserInputWithClientMetadata`
  - `TurnMetadataState` merge test proving client metadata is added
  without overwriting reserved built-in fields
  - websocket request-shape test proving outbound `response.create`
  contains merged metadata inside
  `client_metadata["x-codex-turn-metadata"]`
  - app-server integration tests proving:
  - `turn/start` forwards `clientMetadata` into the outbound Responses
  request path
    - websocket warmup + real turn request both behave correctly
    - `turn/steer` updates the follow-up request metadata
  
  ### Commands run
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-protocol`
  - `cargo test -p codex-core
  turn_metadata_state_merges_client_metadata_without_replacing_reserved_fields
  --lib`
  - `cargo test -p codex-core --test all
  responses_websocket_preserves_custom_turn_metadata_fields`
  - `cargo test -p codex-app-server --test all client_metadata`
  - `cargo test -p codex-app-server --test all
  turn_start_forwards_client_metadata_to_responses_websocket_request_body_v2
  -- --nocapture`
  - `just fmt`
  - `just fix -p codex-core -p codex-protocol -p codex-app-server-protocol
  -p codex-app-server`
  - `just fix -p codex-exec -p codex-tui-app-server`
  - `just argument-comment-lint`
  
  ### Full suite note
  `cargo test` in `codex-rs` still fails in:
  -
  `suite::v2::turn_interrupt::turn_interrupt_resolves_pending_command_approval_request`
  
  I verified that same failure on a clean detached `HEAD` worktree with an
  isolated `CARGO_TARGET_DIR`, so it is not caused by this patch.

  neil-oai · 2026-04-09 11:52:37 -07:00
  a92a5085bd
• feat: add Codex Apps sediment file remapping (#15197)

  ## Summary
  - bridge Codex Apps tools that declare `_meta["openai/fileParams"]`
  through the OpenAI file upload flow
  - mask those file params in model-visible tool schemas so the model
  provides absolute local file paths instead of raw file payload objects
  - rewrite those local file path arguments client-side into
  `ProvidedFilePayload`-shaped objects before the normal MCP tool call
  
  ## Details
  - applies to scalar and array file params declared in
  `openai/fileParams`
  - Codex uploads local files directly to the backend and uses the
  uploaded file metadata to build the MCP tool arguments locally
  - this PR is input-only
  
  ## Verification
  - `just fmt`
  - `cargo test -p codex-core mcp_tool_call -- --nocapture`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Casey Chow · 2026-04-09 14:10:44 -04:00
  244b15c95d
• refactor(proxy): clarify sandbox block messages (#17168)

  ## Summary
  - Replace Codex-branded network-proxy block responses with concise
  reason text
  - Mention sandbox policy for local/private network and deny-policy
  wording
  - Remove “managed” from the proxy-disabled denial detail

  viyatb-oai · 2026-04-09 10:53:06 -07:00
  7ab825e047
• [codex] add memory extensions (#16276)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Kevin Liu · 2026-04-09 10:45:02 -07:00
  76de99ff25
• chore: merge name and title (#17116)

  Merge title and name concept to leverage the sqlite title column and
  have more efficient queries
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-09 18:44:26 +01:00
  12f0e0b0eb
• Skip local shell snapshots for remote unified exec (#17217)

  ## Summary
  - detect remote exec-server sessions in the unified-exec runtime
  - bypass the local shell-snapshot bootstrap only for those remote
  sessions
  - preserve existing local snapshot wrapping, PowerShell UTF-8 prefixing,
  sandbox orchestration, and zsh-fork handling
  
  ## Why
  The shell snapshot file is currently captured and stored next to Core.
  If Core wraps a remote command with `. /path/to/local/snapshot`, the
  process starts on the executor and tries to source a path from the
  orchestrator filesystem. This keeps remote commands from receiving that
  known-local path until shell snapshots are captured/restored on the
  executor side.
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - `cargo test -p codex-core --lib tools::runtimes::tests`
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-09 17:30:18 +01:00
  c0b5d8d24a
• Render statusline context as a meter (#17170)

  Problem: The statusline reported context as an “X% left” value, which
  could be mistaken for quota, and context usage was included in the
  default footer.
  
  Solution: Render configured context status items as a filling context
  meter, preserve `context-used` as a legacy alias while hiding it from
  the setup menu, and remove context from the default statusline. It will
  still be available as an opt-in option for users who want to see it.
  
  <img width="317" height="39" alt="image"
  src="https://github.com/user-attachments/assets/3aeb39bb-f80d-471f-88fe-d55e25b31491"
  />

  Eric Traut · 2026-04-09 07:52:07 -07:00
  598d6ff056
• [codex] Defer steering until after sampling the model post-compaction (#17163)

  ## Summary
  - keep pending steered input buffered until the active user prompt has
  received a model response
  - keep steering pending across auto-compact when there is real
  model/tool continuation to resume
  - allow queued steering to follow compaction immediately when the prior
  model response was already final
  - keep pending-input follow-up owned by `run_turn` instead of folding it
  into `SamplingRequestResult`
  - add regression coverage for mid-turn compaction, final-response
  compaction, and compaction triggered before the next request after tool
  output
  
  ## Root Cause
  Steered input was drained at the top of every `run_turn` loop. After
  auto-compaction, the loop continued and immediately appended any pending
  steer after the compact summary, making a queued prompt look like the
  newest task instead of letting the model first resume interrupted
  model/tool work.
  
  ## Implementation Notes
  This patch keeps the follow-up signals separated:
  
  - `SamplingRequestResult.needs_follow_up` means model/tool continuation
  is needed
  - `sess.has_pending_input().await` means queued user steering exists
  - `run_turn` computes the combined loop condition from those two signals
  
  In `run_turn`:
  
  ```rust
  let has_pending_input = sess.has_pending_input().await;
  let needs_follow_up = model_needs_follow_up || has_pending_input;
  ```
  
  After auto-compact we choose whether the next request may drain
  steering:
  
  ```rust
  can_drain_pending_input = !model_needs_follow_up;
  ```
  
  That means:
  
  - model/tool continuation + pending steer: compact -> resume once
  without draining steer
  - completed model answer + pending steer: compact -> drain/send the
  steer immediately
  - fresh user prompt: do not drain steering before the model has answered
  the prompt once
  
  The drain is still only `sess.get_pending_input().await`; when
  `can_drain_pending_input` is false, core uses an empty local vec and
  leaves the steer pending in session state.
  
  ## Validation
  - PASS `cargo test -p codex-core --test all steered_user_input --
  --nocapture`
  - PASS `just fmt`
  - PASS `git diff --check`
  - NOT PASSING HERE `just fix -p codex-core` currently stops before
  linting this change on an unrelated mainline test-build error:
  `core/src/tools/spec_tests.rs` initializes `ToolsConfigParams` without
  `image_generation_tool_auth_allowed`; this PR does not touch that file.

  jgershen-oai · 2026-04-09 02:08:41 -07:00
  8f705b0702
• make webrtc the default experience (#17188)

  ## Summary
  - make realtime default to the v2 WebRTC path
  - keep partial realtime config tables inheriting
  `RealtimeConfig::default()`
  
  ## Validation
  - CI found a stale config-test expectation; fixed in 974ba51bb3
  - just fmt
  - git diff --check
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 23:52:32 -07:00
  84a24fe333
• Default realtime startup to v2 model (#17183)

  - Default realtime sessions to v2 and gpt-realtime-1.5 when no override
  is configured.
  - Add Op::RealtimeConversationStart integration coverage and keep
  v1-specific tests explicit.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 22:11:30 -07:00
  1fdb695e42
• Add TUI notification condition config (#17175)

  Problem: TUI desktop notifications are hard-gated on terminal focus, so
  terminal/IDE hosts that want in-focus notifications cannot opt in.
  
  Solution: Add a flat `[tui] notification_condition` setting (`unfocused`
  by default, `always` opt-in), carry grouped TUI notification settings
  through runtime config, apply method + condition together in the TUI,
  and regenerate the config schema.

  Eric Traut · 2026-04-08 21:50:02 -07:00
  6dc5391c7c
• Add realtime voice selection (#17176)

  - Add realtime voice selection for realtime/start.
  - Expose the supported v1/v2 voice lists and cover explicit, configured,
  default, and invalid voice paths.

  Ahmed Ibrahim · 2026-04-08 20:19:15 -07:00
  2f9090be62
• Move default realtime prompt into core (#17165)

  - Adds a core-owned realtime backend prompt template and preparation
  path.
  - Makes omitted realtime start prompts use the core default, while null
  or empty prompts intentionally send empty instructions.
  - Covers the core realtime path and app-server v2 path with integration
  coverage.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 19:34:40 -07:00
  4c2a1ae31b
• Fix stale thread-name resume lookups (#16646)

  Addresses #15943
  
  Problem: Name-based resume could stop on a newer session_index entry
  whose rollout was never persisted, shadowing an older saved thread with
  the same name.
  
  Solution: Materialize rollouts before indexing thread names and make
  name lookup skip unresolved entries until it finds a persisted rollout.

  Eric Traut · 2026-04-08 18:51:29 -07:00
  36586eafed
• Auto-approve MCP server elicitations in Full Access mode (#17164)

  Currently, when a MCP server sends an elicitation to Codex running in
  Full Access (`sandbox_policy: DangerFullAccess` + `approval_policy:
  Never`), the elicitations are auto-cancelled.
  
  This PR updates the automatic handling of MCP elicitations to be
  consistent with other approvals in full-access, where they are
  auto-approved. Because MCP elicitations may actually require user input,
  this mechanism is limited to empty form elicitations.
  
  ## Changeset
  - Add policy helper shared with existing MCP tool call approval
  auto-approve
  - Update `ElicitationRequestManager` to auto-approve elicitations in
  full access when `can_auto_accept_elicitation` is true.
  - Add tests
  
  Co-authored-by: Codex <noreply@openai.com>

  Leo Shimonaka · 2026-04-08 16:41:02 -07:00
  01537f0bd2
• Update guardian output schema (#17061)

  ## Summary
  - Update guardian output schema to separate risk, authorization,
  outcome, and rationale.
  - Feed guardian rationale into rejection messages.
  - Split the guardian policy into template and tenant-config sections.
  
  ## Validation
  - `cargo test -p codex-core mcp_tool_call`
  - `env -u CODEX_SANDBOX_NETWORK_DISABLED INSTA_UPDATE=always cargo test
  -p codex-core guardian::`
  
  ---------
  
  Co-authored-by: Owen Lin <owen@openai.com>

  maja-openai · 2026-04-08 15:47:29 -07:00
  dcbc91fd39
• Attach WebRTC realtime starts to sideband websocket (#17057)

  Summary:
  - parse the realtime call Location header and join that call over the
  direct realtime WebSocket
  - keep WebRTC starts alive on the existing realtime conversation path
  
  Validation:
  - just fmt
  - git diff --check
  - cargo check -p codex-api
  - cargo check -p codex-core --tests
  - local cargo tests not run; relying on PR CI

  Ahmed Ibrahim · 2026-04-08 15:25:42 -07:00
  794a0240f9
• Fix missing fields (#17149)

  Fix missing `image_generation_tool_auth_allowed` in two locations.

  canvrno-oai · 2026-04-08 13:53:53 -07:00
  58ad79b60e
• [codex] Support remote exec cwd in TUI startup (#17142)

  When running with remote executor the cwd is the remote path. Today we
  check for existence of a local directory on startup and attempt to load
  config from it.
  
  For remote executors don't do that.

  pakrym-oai · 2026-04-08 13:09:28 -07:00
  e4d6702b87
• release ready, enabling only for siwc users (#17046)

  **Disabling Image-Gen for Non-SIWC Codex Users**
  
  We are only enabling image-gen feature for SIWC Codex users until there
  comes a fix in ResponsesAPI to omit output from responses.completed, to
  prevent the following issues:
  
  1. websocket blows up due to heavier load (images) than before (text) 
  2. http parser streams through n^2 of n-base64 bytes (sum of base64s of
  all images generated in turn) that causes long delays in
  turn_completion.

  Won Park · 2026-04-08 11:22:39 -07:00
  e003f84e1e
• fix(debug-config, guardian): fix /debug-config rendering and guardian… (#17138)

  ## Description
  
  This PR fixes `/debug-config` so it shows more of the active
  requirements state, including reviewer requirements and managed feature
  pins. This made it clear that legacy MDM config was setting
  `approvals_reviewer = "guardian_subagent"` and that we were translating
  that into a requirements constraint.
  
  Also, translate `approvals_reviewer = "guardian_subagent"` (from legacy
  managed_config.toml) to `allowed_approvals_reviewers: guardian_subagent,
  user` instead of `allowed_approvals_reviewers: guardian_subagent`.
  
  Example `/debug-config`:
  ```
  Config layer stack (lowest precedence first):
    1. system (/etc/codex/config.toml) (enabled)
    2. user (/Users/owen/.codex/config.toml) (enabled)
    3. project (/Users/owen/repos/codex/.codex/config.toml) (enabled)
    4. legacy managed_config.toml (MDM) (enabled)
       MDM value:
         ...
  
         # Enable Guardian Mode
         features.guardian_approval = true
         approvals_reviewer = "guardian_subagent"
  
  Requirements:
    - allowed_approvals_reviewers: guardian_subagent, user (source: MDM managed_config.toml (legacy))
    - features: apps=true, plugins=true (source: cloud requirements)
  ```
  
  Before this PR, the `Requirements` section showed None.

  Owen Lin · 2026-04-08 11:08:09 -07:00
  e794457a59
• Use AbsolutePathBuf for exec cwd plumbing (#17063)

  ## Summary
  - Carry `AbsolutePathBuf` through tool cwd parsing/resolution instead of
  resolving workdirs to raw `PathBuf`s.
  - Type exec/sandbox request cwd fields as `AbsolutePathBuf` through
  `ExecParams`, `ExecRequest`, `SandboxCommand`, and unified exec runtime
  requests.
  - Keep `PathBuf` conversions at external/event boundaries and update
  existing tests/fixtures for the typed cwd.
  
  ## Validation
  - `cargo check -p codex-core --tests`
  - `cargo check -p codex-sandboxing --tests`
  - `cargo test -p codex-sandboxing`
  - `cargo test -p codex-core --lib tools::handlers::`
  - `just fix -p codex-sandboxing`
  - `just fix -p codex-core`
  - `just fmt`
  
  Full `codex-core` test suite was not run locally; per repo guidance I
  kept local validation targeted.

  pakrym-oai · 2026-04-08 10:54:12 -07:00
  35b5720e8d
• Add realtime transport config (#17097)

  Adds realtime.transport config with websocket as the default and webrtc
  wired through the effective config.
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-08 09:53:53 -07:00
  06d88b7e81
• Show global AGENTS.md in /status (#17091)

  Addresses #3793
  
  Problem: /status only reported project-level AGENTS files, so sessions
  with a loaded global $CODEX_HOME/AGENTS.md still showed Agents.md as
  <none>.
  
  Solution: Track the global instructions file loaded during config
  initialization and prepend that path to the /status Agents.md summary,
  with coverage for AGENTS.md, AGENTS.override.md, and global-plus-project
  ordering.

  Eric Traut · 2026-04-08 09:04:32 -07:00
  dc5feb916d
• Configure multi_agent_v2 spawn agent hints (#17071)

  Allow multi_agent_v2 features to have its own temporary configuration
  under `[features.multi_agent_v2]`
  
  ```
  [features.multi_agent_v2]
  enabled = true
  usage_hint_enabled = false
  usage_hint_text = "Custom delegation guidance."
  hide_spawn_agent_metadata = true
  ```
  
  Absent `usage_hint_text` means use the default hint.
  
  ```
  [features]
  multi_agent_v2 = true
  ```
  
  still works as the boolean shorthand.

  pakrym-oai · 2026-04-08 08:42:18 -07:00
  4c07dd4d25
• codex debug 2 (guardian approved) (#17118)

  Removes lines 8-14 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:14:06 +01:00
  11eff760d1
• codex debug 15 (guardian approved) (#17131)

  Removes lines 99-106 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:11:01 +01:00
  2b65f24de6
• codex debug 13 (guardian approved) (#17129)

  Removes lines 85-91 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:54 +01:00
  95d27bfe8c
• codex debug 11 (guardian approved) (#17127)

  Removes lines 71-77 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:47 +01:00
  6e9ffa9a1c
• codex debug 9 (guardian approved) (#17125)

  Removes lines 57-63 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:41 +01:00
  c39477a7d5
• codex debug 7 (guardian approved) (#17123)

  Removes lines 43-49 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:34 +01:00
  cb77bbfed0
• codex debug 5 (guardian approved) (#17121)

  Removes lines 29-35 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:28 +01:00
  5f1363d6d0
• codex debug 3 (guardian approved) (#17119)

  Removes lines 15-21 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:22 +01:00
  8558e8aa51
• codex debug 1 (guardian approved) (#17117)

  Removes lines 1-7 from core/templates/agents/orchestrator.md.

  jif-oai · 2026-04-08 14:10:15 +01:00
  22c1fc0131
• Render namespace description for tools (#16879)
  Vivian Fang · 2026-04-08 02:39:40 -07:00
  d47b755aa2
• Render function attribute descriptions (#16880)
  Vivian Fang · 2026-04-08 02:10:45 -07:00
  9091999c83
• Support anyOf and enum in JsonSchema (#16875)

  This brings us into better alignment with the JSON schema subset that is
  supported in
  <https://developers.openai.com/api/docs/guides/structured-outputs#supported-schemas>,
  and also allows us to render richer function signatures in code mode
  (e.g., anyOf{null, OtherObjectType})

  Vivian Fang · 2026-04-08 01:07:55 -07:00
  ea516f9a40
• fix: refresh network proxy settings when sandbox mode changes (#17040)

  ## Summary
  
  Fix network proxy sessions so changing sandbox mode recomputes the
  effective managed network policy and applies it to the already-running
  per-session proxy.
  
  ## Root Cause
  
  `danger_full_access_denylist_only` injects `"*"` only while building the
  proxy spec for Full Access. Sessions built that spec once at startup, so
  a later permission switch to Full Access left the live proxy in its
  original restricted policy. Switching back needed the same recompute
  path to remove the synthetic wildcard again.
  
  ## What Changed
  
  - Preserve the original managed network proxy config/requirements so the
  effective spec can be recomputed for a new sandbox policy.
  - Refresh the current session proxy when sandbox settings change, then
  reapply exec-policy network overlays.
  - Add an in-place proxy state update path while rejecting
  listener/port/SOCKS changes that cannot be hot-reloaded.
  - Keep runtime proxy settings cheap to snapshot and update.
  - Add regression coverage for workspace-write -> Full Access ->
  workspace-write.

  viyatb-oai · 2026-04-08 03:07:55 +00:00
  3c1adbabcd
• Use model metadata for Fast Mode status (#16949)

  Fast Mode status was still tied to one model name in the TUI and
  model-list plumbing. This changes the model metadata shape so a model
  can advertise additional speed tiers, carries that field through the
  app-server model list, and uses it to decide when to show Fast Mode
  status.
  
  For people using Codex, the behavior is intended to stay the same for
  existing models. Fast Mode still requires the existing signed-in /
  feature-gated path; the difference is that the UI can now recognize any
  model the model list marks as Fast-capable, instead of requiring a new
  client-side slug check.

  pash-openai · 2026-04-07 17:55:40 -07:00
  80ebc80be5
• [codex] Apply patches through executor filesystem (#17048)

  ## Summary
  - run apply_patch through the executor filesystem when a remote
  environment is present instead of shelling out to the local process
  - thread the executor FileSystem into apply_patch interception and keep
  existing local behavior for non-remote turns
  - make the apply_patch integration harness use the executor filesystem
  for setup/assertions
  - add remote-aware skips for turn-diff coverage that still reads the
  test-runner filesystem
  
  ## Why
  Remote apply_patch needed to mutate the remote workspace instead of the
  local checkout. The tests also needed to seed and assert workspace state
  through the same filesystem abstraction so local and remote runs
  exercise the same behavior.
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  - `cargo check -p core_test_support --tests`
  - `cargo test -p codex-core --test all
  suite::shell_serialization::apply_patch_custom_tool_call -- --nocapture`
  - `cargo test -p codex-core --test all
  suite::apply_patch_cli::apply_patch_cli_updates_file_appends_trailing_newline
  -- --nocapture`
  - remote `cargo test -p codex-core --test all apply_patch_cli --
  --nocapture` (229 passed)

  pakrym-oai · 2026-04-07 16:35:02 -07:00
  600c3e49e0
• Add WebRTC transport to realtime start (#16960)

  Adds WebRTC startup to the experimental app-server
  `thread/realtime/start` method with an optional transport enum. The
  websocket path remains the default; WebRTC offers create the realtime
  session through the shared start flow and emit the answer SDP via
  `thread/realtime/sdp`.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-07 15:43:38 -07:00
  fb3dcfde1d
• fix(app-server) revert null instructions changes (#17047)
  Dylan Hurd · 2026-04-07 15:18:34 -07:00
  6c36e7d688
• [codex] Migrate apply_patch to executor filesystem (#17027)

  - Migrate apply-patch verification and application internals to use the
  async `ExecutorFileSystem` abstraction from `exec-server`.
  - Convert apply-patch `cwd` handling to `AbsolutePathBuf` through the
  verifier/parser/handler boundary.
  
  Doesn't change how the tool itself works.

  pakrym-oai · 2026-04-07 21:20:22 +00:00
  e9702411ab
• fix(core) revert Command line in unified exec output (#17031)

  ## Summary
  https://github.com/openai/codex/pull/13860 changed the serialized output
  format of Unified Exec. This PR reverts those changes and some related
  test changes
  
  ## Testing
  - [x] Update tests
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Dylan Hurd · 2026-04-07 13:35:40 -07:00
  d45513ce5a
• [codex] Fix unified exec test build (#17032)

  ## Summary
  - Remove the stale `?` after `AbsolutePathBuf::join` in the unified exec
  integration test helper.
  
  ## Root Cause
  - `AbsolutePathBuf::join` was made infallible, but
  `core/tests/suite/unified_exec.rs` still treated it as a `Result`, which
  broke the Windows test build for the `all` integration test target.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-core --test all
  unified_exec_resolves_relative_workdir`

  pakrym-oai · 2026-04-07 12:01:06 -07:00
  8614f92fc4
• Add full-ci branch trigger (#16980)

  Allow branches to trigger full ci (helpful to run remote tests)

  pakrym-oai · 2026-04-07 11:33:35 -07:00
  470b3592e6