370 Commits

• Auto-upgrade configured marketplaces (#17425)

  ## Summary
  - Add best-effort auto-upgrade for user-configured Git marketplaces
  recorded in `config.toml`.
  - Track the last activated Git revision with `last_revision` so
  unchanged marketplace sources skip clone work.
  - Trigger the upgrade from plugin startup and `plugin/list`, while
  preserving existing fail-open plugin behavior with warning logs rather
  than new user-visible errors.
  
  ## Details
  - Remote configured marketplaces use `git ls-remote` to compare the
  source/ref against the recorded revision.
  - Upgrades clone into a staging directory, validate that
  `.agents/plugins/marketplace.json` exists and that the manifest name
  matches the configured marketplace key, then atomically activate the new
  root.
  - Local `.agents/plugins/marketplace.json` marketplaces remain live
  filesystem state and are not auto-pulled.
  - Existing non-curated plugin cache refresh is kicked after successful
  marketplace root upgrades.
  
  ## Validation
  - `just write-config-schema`
  - `cargo test -p codex-core marketplace_upgrade`
  - `cargo check -p codex-cli -p codex-app-server`
  - `just fix -p codex-core`
  
  Did not run the complete `cargo test` suite because the repo
  instructions require asking before a full core workspace run.

  xli-oai · 2026-04-16 10:36:34 -07:00
  faf48489f3
• chore: unify memory drop endpoints (#18134)

  Unify all the memories drop behind a single implementation that drops
  both the main memories and the extensions

  jif-oai · 2026-04-16 15:44:23 +01:00
  b33478c236
• Fix MCP startup cancellation through app server (#18078)

  Addresses https://github.com/openai/codex/issues/17143
  
  Problem: TUI interrupts without an active turn stopped cancelling slow
  MCP startup after routing through the app-server APIs.
  
  Solution: Route no-active-turn interrupts through app-server as startup
  cancels, acknowledge them immediately, and emit cancelled MCP startup
  updates.
  
  Testing: I manually confirmed that MCP cancellation didn't work prior to
  this PR and works after the fix was in place.

  Eric Traut · 2026-04-16 00:03:50 -07:00
  4cd85b28d2
• Extract plugin loading and marketplace logic into codex-core-plugins (#18070)

  Split plugin loading, marketplace, and related infrastructure out of
  core into codex-core-plugins, while keeping the core-facing
  configuration and orchestration flow in codex-core.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  xl-openai · 2026-04-15 23:13:17 -07:00
  48cf3ed7b0
• Async config loading (#18022)

  Parts of config will come from executor. Prepare for that by making
  config loading methods async.

  pakrym-oai · 2026-04-15 19:18:38 -07:00
  bd61737e8a
• Migrate archive/unarchive to local ThreadStore (#17892)

  # Summary
  - implement local ThreadStore archive/unarchive operations
  - implement local ThreadStore read_thread operation
  - break up the various ThreadStore local method implementations into
  separate files
  - migrate app-server archive/unarchive and core archive fixture to use
  ThreadStore (but not all read operations yet!)
  - use the ThreadStore's read operation as a proxy check for thread
  persistence/existence in the app server code
  - move all other filesystem operations related to archive (path
  validation etc) into the local thread store.
  
  # Tests
  - add dedicated local store archive/unarchive tests

  Tom · 2026-04-15 20:48:09 +00:00
  50d3128269
• [codex] Add local thread store listing (#17824)

  Builds on top of #17659 
  
  Move the filesystem + sqlite thread listing-related operations inside of
  a local ThreadStore implementation and call ThreadStore from the places
  that used to perform these filesystem/sqlite operations.
  
  This is the first of a series of PRs that will implement the rest of the
  local ThreadStore.
  
  Testing:
  - added unit tests for the thread store implementation
  - adjusted some unit tests in the realtime + personality packages whose
  callsites changed. Specifically I'm trying to hide ThreadMetadata inside
  of the local implementation and make ThreadMetadata a sqlite
  implementation detail concern rather than a public interface, preferring
  the more generate StoredThread interface instead
  - added a corner case test for the personality migration package that
  wasn't covered by the existing test suite
  - adjust the behavior of searched thread listing to run the existing
  local rollout repair/backfill pass _before_ querying SQLite results, so
  callers using ThreadStore::list_threads do not miss matches after a
  partial metadata warm-up

  Tom · 2026-04-15 11:34:27 -07:00
  cdfcd2ca92
• chore: do not disable memories for past rollouts on reset (#17919)
  jif-oai · 2026-04-15 12:05:39 +01:00
  5e544be3c9
• feat: add endpoint to delete memories (#17913)
  jif-oai · 2026-04-15 10:35:06 +01:00
  7579d5ad75
• Make skill loading filesystem-aware (#17720)

  Migrates skill loading to support reading repo skills from the remote
  environment.

  pakrym-oai · 2026-04-14 15:40:40 -07:00
  96254a763a
• Spread AbsolutePathBuf (#17792)

  Mechanical change to promote absolute paths through code.

  pakrym-oai · 2026-04-14 14:26:10 -07:00
  dd1321d11b
• Moving updated-at timestamps to unique millisecond times (#17489)

  To allow the ability to have guaranteed-unique cursors, we make two
  important updates:
  * Add new updated_at_ms and created_at_ms columns that are in
  millisecond precision
  * Guarantee uniqueness -- if multiple items are inserted at the same
  millisecond, bump the new one by one millisecond until it becomes unique
  
  This lets us use single-number cursors for forwards and backwards paging
  through resultsets and guarantee that the cursor is a fixed point to do
  (timestamp > cursor) and get new items only.
  
  This updated implementation is backwards-compatible since multiple
  appservers can be running and won't handle the previous method well.

  David de Regt · 2026-04-14 11:55:34 -04:00
  4f2fc3e3fa
• Add realtime output modality and transcript events (#17701)

  - Add outputModality to thread/realtime/start and wire text/audio output
  selection through app-server, core, API, and TUI.\n- Rename the realtime
  transcript delta notification and add a separate transcript done
  notification that forwards final text from item done without correlating
  it with deltas.

  Ahmed Ibrahim · 2026-04-14 00:13:13 -07:00
  2f6fc7c137
• [codex-analytics] feature plumbing and emittance (#16640)

  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/16640).
  * #16870
  * #16706
  * #16641
  * __->__ #16640

  rhan-oai · 2026-04-13 23:11:49 -07:00
  b704df85b8
• Refactor plugin loading to async (#17747)

  Simplifies skills migration.

  pakrym-oai · 2026-04-13 21:52:56 -07:00
  3b24a9a532
• [codex] Refactor marketplace add into shared core flow (#17717)

  ## Summary
  
  Move `codex marketplace add` onto a shared core implementation so the
  CLI and app-server path can use one source of truth.
  
  This change:
  - adds shared marketplace-add orchestration in `codex-core`
  - switches the CLI command to call that shared implementation
  - removes duplicated CLI-only marketplace add helpers
  - preserves focused parser and add-path coverage while moving the shared
  behavior into core tests
  
  ## Why
  
  The new `marketplace/add` RPC should reuse the same underlying
  marketplace-add flow as the CLI. This refactor lands that consolidation
  first so the follow-up app-server PR can be mostly protocol and handler
  wiring.
  
  ## Validation
  
  - `cargo test -p codex-core marketplace_add`
  - `cargo test -p codex-cli marketplace_cmd`
  - `just fix -p codex-core`
  - `just fix -p codex-cli`
  - `just fmt`

  xli-oai · 2026-04-13 20:37:11 -07:00
  ff584c5a4b
• Add turn item injection API (#17703)

  ## Summary
  - Add `turn/inject_items` app-server v2 request support for appending
  raw Responses API items to a loaded thread history without starting a
  turn.
  - Generate JSON schema and TypeScript protocol artifacts for the new
  params and empty response.
  - Document the new endpoint and include a request/response example.
  - Preserve compatibility with the typo alias `turn/injet_items` while
  returning the canonical method name.
  
  ## Testing
  - Not run (not requested)

  pakrym-oai · 2026-04-13 16:11:05 -07:00
  d4be06adea
• app-server: Only unload threads which were unused for some time (#17398)

  Currently app-server may unload actively running threads once the last
  connection disconnects, which is not expected.
  Instead track when was the last active turn & when there were any
  subscribers the last time, also add 30 minute idleness/no subscribers
  timer to reduce the churn.

  Ruslan Nigmatullin · 2026-04-13 12:25:26 -07:00
  a5507b59c4
• feat: disable memory endpoint (#17626)
  jif-oai · 2026-04-13 18:29:49 +01:00
  46a266cd6a
• Use AbsolutePathBuf in skill loading and codex_home (#17407)

  Helps with FS migration later

  pakrym-oai · 2026-04-13 10:26:51 -07:00
  ac82443d07
• Do not fail thread start when trust persistence fails (#17595)

  Addresses #17593
  
  Problem: A regression introduced in
  https://github.com/openai/codex/pull/16492 made thread/start fail when
  Codex could not persist trusted project state, which crashes startup for
  users with read-only config.toml.
  
  Solution: Treat trusted project persistence as best effort and keep the
  current thread's config trusted in memory when writing config.toml
  fails.

  Eric Traut · 2026-04-13 10:03:21 -07:00
  d25a9822a7
• Expose instruction sources (AGENTS.md) via app server (#17506)

  Addresses #17498
  
  Problem: The TUI derived /status instruction source paths from the local
  client environment, which could show stale <none> output or incorrect
  paths when connected to a remote app server.
  
  Solution: Add an app-server v2 instructionSources snapshot to thread
  start/resume/fork responses, default it to an empty list when older
  servers omit it, and render TUI /status from that server-provided
  session data.
  
  Additional context: The app-server field is intentionally named
  instructionSources rather than AGENTS.md-specific terminology because
  the loaded instruction sources can include global instructions, project
  AGENTS.md files, AGENTS.override.md, user-defined instruction files, and
  future dynamic sources.

  Eric Traut · 2026-04-12 15:50:12 -07:00
  46ab9974dc
• Pass turn id with feedback uploads (#17314)

  ## Summary
  - Add an optional `tags` dictionary to feedback upload params.
  - Capture the active app-server turn id in the TUI and submit it as
  `tags.turn_id` with `/feedback` uploads.
  - Merge client-provided feedback tags into Sentry feedback tags while
  preserving reserved system fields like `thread_id`, `classification`,
  `cli_version`, `session_source`, and `reason`.
  
  ## Behavior / impact
  Existing feedback upload callers remain compatible because `tags` is
  optional and nullable. The wire shape is still a normal JSON object /
  TypeScript dictionary, so adding future feedback metadata will not
  require a new top-level protocol field each time. This change only adds
  feedback metadata for Codex CLI/TUI uploads; it does not affect existing
  pipelines, DAGs, exports, or downstream consumers unless they choose to
  read the new `turn_id` feedback tag.
  
  ## Tests
  - `cargo fmt -- --config imports_granularity=Item` passed; stable
  rustfmt warned that `imports_granularity` is nightly-only.
  - `cargo run -p codex-app-server-protocol --bin write_schema_fixtures`
  - `cargo test -p codex-feedback
  upload_tags_include_client_tags_and_preserve_reserved_fields`
  - `cargo test -p codex-app-server-protocol
  schema_fixtures_match_generated`
  - `cargo test -p codex-tui build_feedback_upload_params`
  - `cargo test -p codex-tui
  live_app_server_turn_started_sets_feedback_turn_id`
  - `cargo check -p codex-app-server --tests`
  - `git diff --check`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  ningyi-oai · 2026-04-11 00:23:50 -07:00
  be13f03c39
• Fix thread/list cwd filtering for Windows verbatim paths (#17414)

  Addresses #17302
  
  Problem: `thread/list` compared cwd filters with raw path equality, so
  `resume --last` could miss Windows sessions when the saved cwd used a
  verbatim path form and the current cwd did not.
  
  Solution: Normalize cwd comparisons through the existing path comparison
  utilities before falling back to direct equality, and add Windows
  regression coverage for verbatim paths. I made this a general utility
  function and replaced all of the duplicated instance of it across the
  code base.

  Eric Traut · 2026-04-10 23:08:02 -07:00
  e9e7ef3d36
• [mcp] Support MCP Apps part 3 - Add mcp tool call support. (#17364)

  - [x] Add a new app-server method so that MCP Apps can call their own
  MCP server directly.

  Matthew Zeng · 2026-04-11 04:39:19 +00:00
  b7139a7e8f
• Revert "Option to Notify Workspace Owner When Usage Limit is Reached" (#17391)

  Reverts openai/codex#16969
  
  #sev3-2026-04-10-accountscheckversion-500s-for-openai-workspace-7300

  Shijie Rao · 2026-04-10 23:33:13 +00:00
  930e5adb7e
• Support clear SessionStart source (#17073)

  ## Motivation
  
  The `SessionStart` hook already receives `startup` and `resume` sources,
  but sessions created from `/clear` previously looked like normal startup
  sessions. This makes it impossible for hook authors to distinguish
  between these with the matcher.
  
  ## Summary
  
  - Add `InitialHistory::Cleared` so `/clear`-created sessions can be
  distinguished from ordinary startup sessions.
  - Add `SessionStartSource::Clear` and wire it through core, app-server
  thread start params, and TUI clear-session flow.
  - Update app-server protocol schemas, generated TypeScript, docs, and
  related tests.
  
  
  https://github.com/user-attachments/assets/9cae3cb4-41c7-4d06-b34f-966252442e5c

  Abhinav · 2026-04-10 16:05:21 -07:00
  7999b0f60f
• fix: main (#17352)
  jif-oai · 2026-04-10 18:14:42 +01:00
  87328976f6
• fix: MCP leaks in app-server (#17223)

  The disconnect path now reuses the same teardown flow as explicit
  unsubscribe, and the thread-state bookkeeping consistently reports only
  threads that lost their last subscriber
  
  https://github.com/openai/codex/issues/16895

  jif-oai · 2026-04-10 15:31:26 +01:00
  8d58899297
• Option to Notify Workspace Owner When Usage Limit is Reached (#16969)

  ## Summary
  - Replace the manual `/notify-owner` flow with an inline confirmation
  prompt when a usage-based workspace member hits a credits-depleted
  limit.
  - Fetch the current workspace role from the live ChatGPT
  `accounts/check/v4-2023-04-27` endpoint so owner/member behavior matches
  the desktop and web clients.
  - Keep owner, member, and spend-cap messaging distinct so we only offer
  the owner nudge when the workspace is actually out of credits.
  
  ## What Changed
  - `backend-client`
  - Added a typed fetch for the current account role from
  `accounts/check`.
    - Mapped backend role values into a Rust workspace-role enum.
  - `app-server` and protocol
    - Added `workspaceRole` to `account/read` and `account/updated`.
  - Derived `isWorkspaceOwner` from the live role, with a fallback to the
  cached token claim when the role fetch is unavailable.
  - `tui`
    - Removed the explicit `/notify-owner` slash command.
  - When a member is blocked because the workspace is out of credits, the
  error now prompts:
  - `Your workspace is out of credits. Request more from your workspace
  owner? [y/N]`
    - Choosing `y` sends the existing owner-notification request.
  - Choosing `n`, pressing `Esc`, or accepting the default selection
  dismisses the prompt without sending anything.
  - Selection popups now honor explicit item shortcuts, which is how the
  `y` / `n` interaction is wired.
  
  ## Reviewer Notes
  - The main behavior change is scoped to usage-based workspace members
  whose workspace credits are depleted.
  - Spend-cap reached should not show the owner-notification prompt.
  - Owners and admins should continue to see `/usage` guidance instead of
  the member prompt.
  - The live role fetch is best-effort; if it fails, we fall back to the
  existing token-derived ownership signal.
  
  ## Testing
  - Manual verification
    - Workspace owner does not see the member prompt.
  - Workspace member with depleted credits sees the confirmation prompt
  and can send the nudge with `y`.
  - Workspace member with spend cap reached does not see the
  owner-notification prompt.
  
  ### Workspace member out of usage
  
  https://github.com/user-attachments/assets/341ac396-eff4-4a7f-bf0c-60660becbea1
  
  ### Workspace owner
  <img width="1728" height="1086" alt="Screenshot 2026-04-09 at 11 48
  22 AM"
  src="https://github.com/user-attachments/assets/06262a45-e3fc-4cc4-8326-1cbedad46ed6"
  />

  richardopenai · 2026-04-09 21:15:17 -07:00
  9f2a585153
• Emit live hook prompts before raw-event filtering (#17189)

  # What
  Project raw Stop-hook prompt response items into typed v2 hookPrompt
  item-completed notifications before applying the raw-response-event
  filter. Keep ordinary raw response items filtered for normal
  subscribers; only the existing hookPrompt bridge runs on the filtered
  raw-item path.
  
  # Why
  Blocked Stop hooks record their continuation instruction as a raw
  model-history user item. Normal v2 desktop subscribers do not opt into
  raw response events, so the app-server listener filtered that raw item
  before the existing hookPrompt translator could emit the typed live
  item/completed notification. As a result, the hook-prompt bubble only
  appeared after thread history was reloaded.

  Abhinav · 2026-04-09 19:48:21 -07:00
  f6cc2bb0cb
• [mcp] Expand tool search to custom MCPs. (#16944)

  - [x] Expand tool search to custom MCPs.
  - [x] Rename several variables/fields to be more generic.
  
  Updated tool & server name lifecycles:
  
  **Raw Identity**
  
  ToolInfo.server_name is raw MCP server name.
  ToolInfo.tool.name is raw MCP tool name.
  MCP calls route back to raw via parse_tool_name() returning
  (tool.server_name, tool.tool.name).
  mcpServerStatus/list now groups by raw server and keys tools by
  Tool.name: mod.rs:599
  App-server just forwards that grouped raw snapshot:
  codex_message_processor.rs:5245
  
  **Callable Names**
  
  On list-tools, we create provisional callable_namespace / callable_name:
  mcp_connection_manager.rs:1556
  For non-app MCP, provisional callable name starts as raw tool name.
  For codex-apps, provisional callable name is sanitized and strips
  connector name/id prefix; namespace includes connector name.
  Then qualify_tools() sanitizes callable namespace + name to ASCII alnum
  / _ only: mcp_tool_names.rs:128
  Note: this is stricter than Responses API. Hyphen is currently replaced
  with _ for code-mode compatibility.
  
  **Collision Handling**
  
  We do initially collapse example-server and example_server to the same
  base.
  Then qualify_tools() detects distinct raw namespace identities behind
  the same sanitized namespace and appends a hash to the callable
  namespace: mcp_tool_names.rs:137
  Same idea for tool-name collisions: hash suffix goes on callable tool
  name.
  Final list_all_tools() map key is callable_namespace + callable_name:
  mcp_connection_manager.rs:769
  
  **Direct Model Tools**
  
  Direct MCP tool declarations use the full qualified sanitized key as the
  Responses function name.
  The raw rmcp Tool is converted but renamed for model exposure.
  
  **Tool Search / Deferred**
  
  Tool search result namespace = final ToolInfo.callable_namespace:
  tool_search.rs:85
  Tool search result nested name = final ToolInfo.callable_name:
  tool_search.rs:86
  Deferred tool handler is registered as "{namespace}:{name}":
  tool_registry_plan.rs:248
  When a function call comes back, core recombines namespace + name, looks
  up the full qualified key, and gets the raw server/tool for MCP
  execution: codex.rs:4353
  
  **Separate Legacy Snapshot**
  
  collect_mcp_snapshot_from_manager_with_detail() still returns a map
  keyed by qualified callable name.
  mcpServerStatus/list no longer uses that; it uses
  McpServerStatusSnapshot, which is raw-inventory shaped.

  Matthew Zeng · 2026-04-09 13:34:52 -07:00
  d7f99b0fa6
• app-server: Use shared receivers for app-server message processors (#17256)

  We do not rely on the mutability here, so express it in the type system.

  Ruslan Nigmatullin · 2026-04-09 19:53:50 +00:00
  545f3daba0
• Forward app-server turn clientMetadata to Responses (#16009)

  ## Summary
  App-server v2 already receives turn-scoped `clientMetadata`, but the
  Rust app-server was dropping it before the outbound Responses request.
  This change keeps the fix lightweight by threading that metadata through
  the existing turn-metadata path rather than inventing a new transport.
  
  ## What we're trying to do and why
  We want turn-scoped metadata from the app-server protocol layer,
  especially fields like Hermes/GAAS run IDs, to survive all the way to
  the actual Responses API request so it is visible in downstream
  websocket request logging and analytics.
  
  The specific bug was:
  - app-server protocol uses camelCase `clientMetadata`
  - Responses transport already has an existing turn metadata carrier:
  `x-codex-turn-metadata`
  - websocket transport already rewrites that header into
  `request.request_body.client_metadata["x-codex-turn-metadata"]`
  - but the Rust app-server never parsed or stored `clientMetadata`, so
  nothing from the app-server request was making it into that existing
  path
  
  This PR fixes that without adding a new header or a second metadata
  channel.
  
  ## How we did it
  ### Protocol surface
  - Add optional `clientMetadata` to v2 `TurnStartParams` and
  `TurnSteerParams`
  - Regenerate the JSON schema / TypeScript fixtures
  - Update app-server docs to describe the field and its behavior
  
  ### Runtime plumbing
  - Add a dedicated core op for app-server user input carrying turn-scoped
  metadata: `Op::UserInputWithClientMetadata`
  - Wire `turn/start` and `turn/steer` through that op / signature path
  instead of dropping the metadata at the message-processor boundary
  - Store the metadata in `TurnMetadataState`
  
  ### Transport behavior
  - Reuse the existing serialized `x-codex-turn-metadata` payload
  - Merge the new app-server `clientMetadata` into that JSON additively
  - Do **not** replace built-in reserved fields already present in the
  turn metadata payload
  - Keep websocket behavior unchanged at the outer shape level: it still
  sends only `client_metadata["x-codex-turn-metadata"]`, but that JSON
  string now contains the merged fields
  - Keep HTTP fallback behavior unchanged except that the existing
  `x-codex-turn-metadata` header now includes the merged fields too
  
  ### Request shape before / after
  Before, a websocket `response.create` looked like:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\"}"
    }
  }
  ```
  Even if the app-server caller supplied `clientMetadata`, it was not
  represented there.
  
  After, the same request shape is preserved, but the serialized payload
  now includes the new turn-scoped fields:
  ```json
  {
    "type": "response.create",
    "client_metadata": {
      "x-codex-turn-metadata": "{\"session_id\":\"...\",\"turn_id\":\"...\",\"fiber_run_id\":\"fiber-start-123\",\"origin\":\"gaas\"}"
    }
  }
  ```
  
  ## Validation
  ### Targeted tests added / updated
  - protocol round-trip coverage for `clientMetadata` on `turn/start` and
  `turn/steer`
  - protocol round-trip coverage for `Op::UserInputWithClientMetadata`
  - `TurnMetadataState` merge test proving client metadata is added
  without overwriting reserved built-in fields
  - websocket request-shape test proving outbound `response.create`
  contains merged metadata inside
  `client_metadata["x-codex-turn-metadata"]`
  - app-server integration tests proving:
  - `turn/start` forwards `clientMetadata` into the outbound Responses
  request path
    - websocket warmup + real turn request both behave correctly
    - `turn/steer` updates the follow-up request metadata
  
  ### Commands run
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-protocol`
  - `cargo test -p codex-core
  turn_metadata_state_merges_client_metadata_without_replacing_reserved_fields
  --lib`
  - `cargo test -p codex-core --test all
  responses_websocket_preserves_custom_turn_metadata_fields`
  - `cargo test -p codex-app-server --test all client_metadata`
  - `cargo test -p codex-app-server --test all
  turn_start_forwards_client_metadata_to_responses_websocket_request_body_v2
  -- --nocapture`
  - `just fmt`
  - `just fix -p codex-core -p codex-protocol -p codex-app-server-protocol
  -p codex-app-server`
  - `just fix -p codex-exec -p codex-tui-app-server`
  - `just argument-comment-lint`
  
  ### Full suite note
  `cargo test` in `codex-rs` still fails in:
  -
  `suite::v2::turn_interrupt::turn_interrupt_resolves_pending_command_approval_request`
  
  I verified that same failure on a clean detached `HEAD` worktree with an
  isolated `CARGO_TARGET_DIR`, so it is not caused by this patch.

  neil-oai · 2026-04-09 11:52:37 -07:00
  a92a5085bd
• chore: merge name and title (#17116)

  Merge title and name concept to leverage the sqlite title column and
  have more efficient queries
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-09 18:44:26 +01:00
  12f0e0b0eb
• Add realtime voice selection (#17176)

  - Add realtime voice selection for realtime/start.
  - Expose the supported v1/v2 voice lists and cover explicit, configured,
  default, and invalid voice paths.

  Ahmed Ibrahim · 2026-04-08 20:19:15 -07:00
  2f9090be62
• Use AbsolutePathBuf for exec cwd plumbing (#17063)

  ## Summary
  - Carry `AbsolutePathBuf` through tool cwd parsing/resolution instead of
  resolving workdirs to raw `PathBuf`s.
  - Type exec/sandbox request cwd fields as `AbsolutePathBuf` through
  `ExecParams`, `ExecRequest`, `SandboxCommand`, and unified exec runtime
  requests.
  - Keep `PathBuf` conversions at external/event boundaries and update
  existing tests/fixtures for the typed cwd.
  
  ## Validation
  - `cargo check -p codex-core --tests`
  - `cargo check -p codex-sandboxing --tests`
  - `cargo test -p codex-sandboxing`
  - `cargo test -p codex-core --lib tools::handlers::`
  - `just fix -p codex-sandboxing`
  - `just fix -p codex-core`
  - `just fmt`
  
  Full `codex-core` test suite was not run locally; per repo guidance I
  kept local validation targeted.

  pakrym-oai · 2026-04-08 10:54:12 -07:00
  35b5720e8d
• Support anyOf and enum in JsonSchema (#16875)

  This brings us into better alignment with the JSON schema subset that is
  supported in
  <https://developers.openai.com/api/docs/guides/structured-outputs#supported-schemas>,
  and also allows us to render richer function signatures in code mode
  (e.g., anyOf{null, OtherObjectType})

  Vivian Fang · 2026-04-08 01:07:55 -07:00
  ea516f9a40
• Add WebRTC transport to realtime start (#16960)

  Adds WebRTC startup to the experimental app-server
  `thread/realtime/start` method with an optional transport enum. The
  websocket path remains the default; WebRTC offers create the realtime
  session through the shared start flow and emit the answer SDP via
  `thread/realtime/sdp`.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-04-07 15:43:38 -07:00
  fb3dcfde1d
• fix(app-server) revert null instructions changes (#17047)
  Dylan Hurd · 2026-04-07 15:18:34 -07:00
  6c36e7d688
• [codex] reduce module visibility (#16978)

  ## Summary
  - reduce public module visibility across Rust crates, preferring private
  or crate-private modules with explicit crate-root public exports
  - update external call sites and tests to use the intended public crate
  APIs instead of reaching through module trees
  - add the module visibility guideline to AGENTS.md
  
  ## Validation
  - `cargo check --workspace --all-targets --message-format=short` passed
  before the final fix/format pass
  - `just fix` completed successfully
  - `just fmt` completed successfully
  - `git diff --check` passed

  pakrym-oai · 2026-04-07 08:03:35 -07:00
  413c1e1fdf
• feat: /feedback cascade (#16442)

  Example here:
  https://openai.sentry.io/issues/7380240430/?project=4510195390611458&query=019d498f-bec4-7ba2-96d2-612b1e4507df&referrer=issue-stream

  jif-oai · 2026-04-07 12:47:37 +01:00
  89f1a44afa
• Honor null thread instructions (#16964)

  - Treat explicit null thread instructions as a blank-slate override
  while preserving omitted-field fallback behavior.
  - Preserve null through rollout resume/fork and keep explicit empty
  strings distinct.
  - Add app-server v2 start/fork coverage for the tri-state instruction
  params.

  Ahmed Ibrahim · 2026-04-07 04:10:19 +00:00
  24c598e8a9
• [mcp] Support MCP Apps part 1. (#16082)

  - [x] Add `mcpResource/read` method to read mcp resource.

  Matthew Zeng · 2026-04-06 19:17:14 -07:00
  5fe9ef06ce
• app-server: Unify config changes handling a bit (#16961)
  Ruslan Nigmatullin · 2026-04-06 18:04:00 -07:00
  b34a3a6e92
• Refactor config types into a separate crate (#16962)

  Move config types into a separate crate because their macros expand into
  a lot of new code.

  pakrym-oai · 2026-04-07 00:32:41 +00:00
  1f2411629f
• Speed up /mcp inventory listing (#16831)

  Addresses #16244
  
  This was a performance regression introduced when we moved the TUI on
  top of the app server API.
  
  Problem: `/mcp` rebuilt a full MCP inventory through
  `mcpServerStatus/list`, including resources and resource templates that
  made the TUI wait on slow inventory probes.
  
  Solution: add a lightweight `detail` mode to `mcpServerStatus/list`,
  have `/mcp` request tools-and-auth only, and cover the fast path with
  app-server and TUI tests.
  
  Testing: Confirmed slow (multi-second) response prior to change and
  immediate response after change.
  
  I considered two options:
  1. Change the existing `mcpServerStatus/list` API to accept an optional
  "details" parameter so callers can request only a subset of the
  information.
  2. Add a separate `mcpServer/list` API that returns only the servers,
  tools, and auth but omits the resources.
  
  I chose option 1, but option 2 is also a reasonable approach.

  Eric Traut · 2026-04-06 16:27:02 -07:00
  9f737c28dd
• [codex-analytics] add protocol-native turn timestamps (#16638)

  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/16638).
  * #16870
  * #16706
  * #16659
  * #16641
  * #16640
  * __->__ #16638

  rhan-oai · 2026-04-06 16:22:59 -07:00
  756c45ec61
• feat: refresh non-curated cache from plugin list. (#16191)

  1. Use versions for non-curated plugin (defined in plugin.json) for
  cache refresh
  2. Trigger refresh from plugin/list roots

  xl-openai · 2026-04-06 15:40:00 -07:00
  e62d645e67
• Revert "[codex-backend] Make thread metadata updates tolerate pending backfill" (#16923)

  Reverts openai/codex#16877

  joeytrasatti-openai · 2026-04-06 21:25:05 +00:00
  03c07956cf