26 Commits

• feat: introduce Permissions (#11633)

  ## Why
  We currently carry multiple permission-related concepts directly on
  `Config` for shell/unified-exec behavior (`approval_policy`,
  `sandbox_policy`, `network`, `shell_environment_policy`,
  `windows_sandbox_mode`).
  
  Consolidating these into one in-memory struct makes permission handling
  easier to reason about and sets up the next step: supporting named
  permission profiles (`[permissions.PROFILE_NAME]`) without changing
  behavior now.
  
  This change is mostly mechanical: it updates existing callsites to go
  through `config.permissions`, but it does not yet refactor those
  callsites to take a single `Permissions` value in places where multiple
  permission fields are still threaded separately.
  
  This PR intentionally **does not** change the on-disk `config.toml`
  format yet and keeps compatibility with legacy config keys.
  
  ## What Changed
  - Introduced `Permissions` in `core/src/config/mod.rs`.
  - Added `Config::permissions` and moved effective runtime permission
  fields under it:
    - `approval_policy`
    - `sandbox_policy`
    - `network`
    - `shell_environment_policy`
    - `windows_sandbox_mode`
  - Updated config loading/building so these effective values are still
  derived from the same existing config inputs and constraints.
  - Updated Windows sandbox helpers/resolution to read/write via
  `permissions`.
  - Threaded the new field through all permission consumers across core
  runtime, app-server, CLI/exec, TUI, and sandbox summary code.
  - Updated affected tests to reference `config.permissions.*`.
  - Renamed the struct/field from
  `EffectivePermissions`/`effective_permissions` to
  `Permissions`/`permissions` and aligned variable naming accordingly.
  
  ## Verification
  - `just fix -p codex-core -p codex-tui -p codex-cli -p codex-app-server
  -p codex-exec -p codex-utils-sandbox-summary`
  - `cargo build -p codex-core -p codex-tui -p codex-cli -p
  codex-app-server -p codex-exec -p codex-utils-sandbox-summary`

  Michael Bolin · 2026-02-12 14:42:54 -08:00
  a4cc1a4a85
• feat: make sandbox read access configurable with ReadOnlyAccess (#11387)

  `SandboxPolicy::ReadOnly` previously implied broad read access and could
  not express a narrower read surface.
  This change introduces an explicit read-access model so we can support
  user-configurable read restrictions in follow-up work, while preserving
  current behavior today.
  
  It also ensures unsupported backends fail closed for restricted-read
  policies instead of silently granting broader access than intended.
  
  ## What
  
  - Added `ReadOnlyAccess` in protocol with:
    - `Restricted { include_platform_defaults, readable_roots }`
    - `FullAccess`
  - Updated `SandboxPolicy` to carry read-access configuration:
    - `ReadOnly { access: ReadOnlyAccess }`
    - `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
  - Preserved existing behavior by defaulting current construction paths
  to `ReadOnlyAccess::FullAccess`.
  - Threaded the new fields through sandbox policy consumers and call
  sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
  related tests.
  - Updated Seatbelt policy generation to honor restricted read roots by
  emitting scoped read rules when full read access is not granted.
  - Added fail-closed behavior on Linux and Windows backends when
  restricted read access is requested but not yet implemented there
  (`UnsupportedOperation`).
  - Regenerated app-server protocol schema and TypeScript artifacts,
  including `ReadOnlyAccess`.
  
  ## Compatibility / rollout
  
  - Runtime behavior remains unchanged by default (`FullAccess`).
  - API/schema changes are in place so future config wiring can enable
  restricted read access without another policy-shape migration.

  Michael Bolin · 2026-02-11 18:31:14 -08:00
  abbd74e2be
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• refactoring with_escalated_permissions to use SandboxPermissions instead (#7750)

  helpful in the future if we want more granularity for requesting
  escalated permissions:
  e.g when running in readonly sandbox, model can request to escalate to a
  sandbox that allows writes

  zhao-oai · 2025-12-10 17:18:48 +00:00
  e0fb3ca1db
• Use use_model (#7121)
  pakrym-oai · 2025-11-21 22:10:52 +00:00
  e52cc38dfd
• Update defaults to gpt-5.1 (#6652)

  ## Summary
  - update documentation, example configs, and automation defaults to
  reference gpt-5.1 / gpt-5.1-codex
  - bump the CLI and core configuration defaults, model presets, and error
  messaging to the new models while keeping the model-family/tool coverage
  for legacy slugs
  - refresh tests, fixtures, and TUI snapshots so they expect the upgraded
  defaults
  
  ## Testing
  - `cargo test -p codex-core
  config::tests::test_precedence_fixture_with_gpt5_profile`
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6916c5b3c2b08321ace04ee38604fc6b)

  Ahmed Ibrahim · 2025-11-17 17:40:11 -08:00
  ddcc60a085
• tests: replace mount_sse_once_match with mount_sse_once for SSE mocking (#6640)
  pakrym-oai · 2025-11-13 18:04:05 -08:00
  6c384eb9c6
• Promote shared helpers for suite tests (#6460)

  ## Summary
  - add `TestCodex::submit_turn_with_policies` and extend the response
  helpers with reusable tool-call utilities
  - update the grep_files, read_file, list_dir, shell_serialization, and
  tools suites to rely on the shared helpers instead of local copies
  - make the list_dir helper return `anyhow::Result` so clippy no longer
  warns about `expect`
  
  ## Testing
  - `just fix -p codex-core`
  - `cargo test -p codex-core --test all
  suite::grep_files::grep_files_tool_collects_matches`
  - `cargo test -p codex-core
  suite::grep_files::grep_files_tool_collects_matches -- --ignored`
  (filter requests ignored tests so nothing runs, but the build stays
  clean)
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69112d53abac83219813cab4d7cb6446)

  Ahmed Ibrahim · 2025-11-13 17:12:10 -08:00
  2a6e9b20df
• Avoid hang when tool's process spawns grandchild that shares stderr/stdout (#6575)

  We've received many reports of codex hanging when calling certain tools.
  [Here](https://github.com/openai/codex/issues/3204) is one example. This
  is likely a major cause. The problem occurs when
  `consume_truncated_output` waits for `stdout` and `stderr` to be closed
  once the child process terminates. This normally works fine, but it
  doesn't handle the case where the child has spawned grandchild processes
  that inherits `stdout` and `stderr`.
  
  The fix was originally written by @md-oai in [this
  PR](https://github.com/openai/codex/pull/1852), which has gone stale.
  I've copied the original fix (which looks sound to me) and added an
  integration test to prevent future regressions.

  Eric Traut · 2025-11-12 20:08:12 -08:00
  73ed30d7e5
• feat: add output even in sandbox denied (#5908)
  jif-oai · 2025-10-29 18:21:18 +00:00
  3183935bd7
• Move changing turn input functionalities to ConversationHistory (#5473)

  We are doing some ad-hoc logic while dealing with conversation history.
  Ideally, we shouldn't mutate `vec[responseitem]` manually at all and
  should depend on `ConversationHistory` for those changes.
  
  Those changes are:
  - Adding input to the history
  - Removing items from the history
  - Correcting history
  
  I am also adding some `error` logs for cases we shouldn't ideally face.
  For example, we shouldn't be missing `toolcalls` or `outputs`. We
  shouldn't hit `ContextWindowExceeded` while performing `compact`
  
  This refactor will give us granular control over our context management.

  Ahmed Ibrahim · 2025-10-22 13:08:46 -07:00
  273819aaae
• chore: align unified_exec (#5442)

  Align `unified_exec` with b implementation

  jif-oai · 2025-10-22 11:50:18 +01:00
  00b1e130b3
• Add ItemStarted/ItemCompleted events for UserInputItem (#5306)

  Adds a new ItemStarted event and delivers UserMessage as the first item
  type (more to come).
  
  
  Renames `InputItem` to `UserInput` considering we're using the `Item`
  suffix for actual items.

  pakrym-oai · 2025-10-20 13:34:44 -07:00
  9c903c4716
• feat: feature flag (#4948)

  Add proper feature flag instead of having custom flags for everything.
  This is just for experimental/wip part of the code
  It can be used through CLI:
  ```bash
  codex --enable unified_exec --disable view_image_tool
  ```
  
  Or in the `config.toml`
  ```toml
  # Global toggles applied to every profile unless overridden.
  [features]
  apply_patch_freeform = true
  view_image_tool = false
  ```
  
  Follow-up:
  In a following PR, the goal is to have a default have `bundles` of
  features that we can associate to a model

  jif-oai · 2025-10-14 17:50:00 +00:00
  f7b4e29609
• bug: sandbox denied error logs (#4874)

  Check on STDOUT / STDERR or aggregated output for some logs when sanbox
  is denied

  jif-oai · 2025-10-09 16:01:01 +00:00
  ca6a0358de
• feat: list_dir tool (#4817)

  Add a tool to list_dir. It is useful because we can mark it as
  non-mutating and so use it in parallel

  jif-oai · 2025-10-07 19:33:19 +01:00
  226215f36d
• Simplify request body assertions (#4845)

  We'll have a lot more test like these

  pakrym-oai · 2025-10-07 09:56:39 +01:00
  35a770e871
• Trim double Total output lines (#4787)
  pakrym-oai · 2025-10-05 16:41:55 -07:00
  a90a58f7a1
• Make output assertions more explicit (#4784)

  Match using precise regexes.

  pakrym-oai · 2025-10-05 16:01:38 -07:00
  b2d81a7cac
• Add helper for response created SSE events in tests (#4758)

  ## Summary
  - add a reusable `ev_response_created` helper that builds
  `response.created` SSE events for integration tests
  - update the exec and core integration suites to use the new helper
  instead of repeating manual JSON literals
  - keep the streaming fixtures consistent by relying on the shared helper
  in every touched test
  
  ## Testing
  - `just fmt`
  
  
  ------
  https://chatgpt.com/codex/tasks/task_i_68e1fe885bb883208aafffb94218da61

  pakrym-oai · 2025-10-05 21:11:43 +00:00
  aecbe0f333
• Use wait_for_event helpers in tests (#4753)

  ## Summary
  - replace manual event polling loops in several core test suites with
  the shared wait_for_event helpers
  - keep prior assertions intact by using closure captures for stateful
  expectations, including plan updates, patch lifecycles, and review flow
  checks
  - rely on wait_for_event_with_timeout where longer waits are required,
  simplifying timeout handling
  
  ## Testing
  - just fmt
  
  
  ------
  https://chatgpt.com/codex/tasks/task_i_68e1d58582d483208febadc5f90dd95e

  pakrym-oai · 2025-10-04 22:04:05 -07:00
  06853d94f0
• Add truncation hint on truncated exec output. (#4740)

  When truncating output, add a hint of the total number of lines

  Ahmed Ibrahim · 2025-10-05 03:29:07 +00:00
  cc2f4aafd7
• feat: Freeform apply_patch with simple shell output (#4718)

  ## Summary
  This PR is an alternative approach to #4711, but instead of changing our
  storage, parses out shell calls in the client and reserializes them on
  the fly before we send them out as part of the request.
  
  What this changes:
  1. Adds additional serialization logic when the
  ApplyPatchToolType::Freeform is in use.
  2. Adds a --custom-apply-patch flag to enable this setting on a
  session-by-session basis.
  
  This change is delicate, but is not meant to be permanent. It is meant
  to be the first step in a migration:
  1. (This PR) Add in-flight serialization with config
  2. Update model_family default
  3. Update serialization logic to store turn outputs in a structured
  format, with logic to serialize based on model_family setting.
  4. Remove this rewrite in-flight logic.
  
  ## Test Plan
  - [x] Additional unit tests added
  - [x] Integration tests added
  - [x] Tested locally

  Dylan · 2025-10-04 19:16:36 -07:00
  4764fc1ee7
• fix: exec commands that blows up context window. (#4706)

  We truncate the output of exec commands to not blow the context window.
  However, some cases we weren't doing that. This caused reports of people
  with 76% context window left facing `input exceeded context window`
  which is weird.

  Ahmed Ibrahim · 2025-10-04 11:49:56 -07:00
  d7acd146fb
• Fix flaky test (#4672)

  This issue was due to the fact that the timeout is not always sufficient
  to have enough character for truncation + a race between synthetic
  timeout and process kill

  jif-oai · 2025-10-03 18:09:41 +01:00
  bfe3328129
• chore: refactor tool handling (#4510)

  # Tool System Refactor
  
  - Centralizes tool definitions and execution in `core/src/tools/*`:
  specs (`spec.rs`), handlers (`handlers/*`), router (`router.rs`),
  registry/dispatch (`registry.rs`), and shared context (`context.rs`).
  One registry now builds the model-visible tool list and binds handlers.
  - Router converts model responses to tool calls; Registry dispatches
  with consistent telemetry via `codex-rs/otel` and unified error
  handling. Function, Local Shell, MCP, and experimental `unified_exec`
  all flow through this path; legacy shell aliases still work.
  - Rationale: reduce per‑tool boilerplate, keep spec/handler in sync, and
  make adding tools predictable and testable.
  
  Example: `read_file`
  - Spec: `core/src/tools/spec.rs` (see `create_read_file_tool`,
  registered by `build_specs`).
  - Handler: `core/src/tools/handlers/read_file.rs` (absolute `file_path`,
  1‑indexed `offset`, `limit`, `L#: ` prefixes, safe truncation).
  - E2E test: `core/tests/suite/read_file.rs` validates the tool returns
  the requested lines.
  
  ## Next steps:
  - Decompose `handle_container_exec_with_params` 
  - Add parallel tool calls

  jif-oai · 2025-10-03 13:21:06 +01:00
  33d3ecbccc