54 Commits

• feat: introduce Permissions (#11633)

  ## Why
  We currently carry multiple permission-related concepts directly on
  `Config` for shell/unified-exec behavior (`approval_policy`,
  `sandbox_policy`, `network`, `shell_environment_policy`,
  `windows_sandbox_mode`).
  
  Consolidating these into one in-memory struct makes permission handling
  easier to reason about and sets up the next step: supporting named
  permission profiles (`[permissions.PROFILE_NAME]`) without changing
  behavior now.
  
  This change is mostly mechanical: it updates existing callsites to go
  through `config.permissions`, but it does not yet refactor those
  callsites to take a single `Permissions` value in places where multiple
  permission fields are still threaded separately.
  
  This PR intentionally **does not** change the on-disk `config.toml`
  format yet and keeps compatibility with legacy config keys.
  
  ## What Changed
  - Introduced `Permissions` in `core/src/config/mod.rs`.
  - Added `Config::permissions` and moved effective runtime permission
  fields under it:
    - `approval_policy`
    - `sandbox_policy`
    - `network`
    - `shell_environment_policy`
    - `windows_sandbox_mode`
  - Updated config loading/building so these effective values are still
  derived from the same existing config inputs and constraints.
  - Updated Windows sandbox helpers/resolution to read/write via
  `permissions`.
  - Threaded the new field through all permission consumers across core
  runtime, app-server, CLI/exec, TUI, and sandbox summary code.
  - Updated affected tests to reference `config.permissions.*`.
  - Renamed the struct/field from
  `EffectivePermissions`/`effective_permissions` to
  `Permissions`/`permissions` and aligned variable naming accordingly.
  
  ## Verification
  - `just fix -p codex-core -p codex-tui -p codex-cli -p codex-app-server
  -p codex-exec -p codex-utils-sandbox-summary`
  - `cargo build -p codex-core -p codex-tui -p codex-cli -p
  codex-app-server -p codex-exec -p codex-utils-sandbox-summary`

  Michael Bolin · 2026-02-12 14:42:54 -08:00
  a4cc1a4a85
• feat: make sandbox read access configurable with ReadOnlyAccess (#11387)

  `SandboxPolicy::ReadOnly` previously implied broad read access and could
  not express a narrower read surface.
  This change introduces an explicit read-access model so we can support
  user-configurable read restrictions in follow-up work, while preserving
  current behavior today.
  
  It also ensures unsupported backends fail closed for restricted-read
  policies instead of silently granting broader access than intended.
  
  ## What
  
  - Added `ReadOnlyAccess` in protocol with:
    - `Restricted { include_platform_defaults, readable_roots }`
    - `FullAccess`
  - Updated `SandboxPolicy` to carry read-access configuration:
    - `ReadOnly { access: ReadOnlyAccess }`
    - `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
  - Preserved existing behavior by defaulting current construction paths
  to `ReadOnlyAccess::FullAccess`.
  - Threaded the new fields through sandbox policy consumers and call
  sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
  related tests.
  - Updated Seatbelt policy generation to honor restricted read roots by
  emitting scoped read rules when full read access is not granted.
  - Added fail-closed behavior on Linux and Windows backends when
  restricted read access is requested but not yet implemented there
  (`UnsupportedOperation`).
  - Regenerated app-server protocol schema and TypeScript artifacts,
  including `ReadOnlyAccess`.
  
  ## Compatibility / rollout
  
  - Runtime behavior remains unchanged by default (`FullAccess`).
  - API/schema changes are in place so future config wiring can enable
  restricted read access without another policy-shape migration.

  Michael Bolin · 2026-02-11 18:31:14 -08:00
  abbd74e2be
• chore(tui) Simplify /status Permissions (#11290)

  ## Summary
  Consolidate `/status` Permissions lines into a simpler view. It should
  only show "Default," "Full Access," or "Custom" (with specifics)
  
  ## Testing
  - [x] many snapshots updated

  Dylan Hurd · 2026-02-11 15:02:29 -08:00
  30cdfce1a5
• feat: split codex-common into smaller utils crates (#11422)

  We are removing feature-gated shared crates from the `codex-rs`
  workspace. `codex-common` grouped several unrelated utilities behind
  `[features]`, which made dependency boundaries harder to reason about
  and worked against the ongoing effort to eliminate feature flags from
  workspace crates.
  
  Splitting these utilities into dedicated crates under `utils/` aligns
  this area with existing workspace structure and keeps each dependency
  explicit at the crate boundary.
  
  ## What changed
  
  - Removed `codex-rs/common` (`codex-common`) from workspace members and
  workspace dependencies.
  - Added six new utility crates under `codex-rs/utils/`:
    - `codex-utils-cli`
    - `codex-utils-elapsed`
    - `codex-utils-sandbox-summary`
    - `codex-utils-approval-presets`
    - `codex-utils-oss`
    - `codex-utils-fuzzy-match`
  - Migrated the corresponding modules out of `codex-common` into these
  crates (with tests), and added matching `BUILD.bazel` targets.
  - Updated direct consumers to use the new crates instead of
  `codex-common`:
    - `codex-rs/cli`
    - `codex-rs/tui`
    - `codex-rs/exec`
    - `codex-rs/app-server`
    - `codex-rs/mcp-server`
    - `codex-rs/chatgpt`
    - `codex-rs/cloud-tasks`
  - Updated workspace lockfile entries to reflect the new dependency graph
  and removal of `codex-common`.

  Michael Bolin · 2026-02-11 12:59:24 +00:00
  8b7f8af343
• Remove test-support feature from codex-core and replace it with explicit test toggles (#11405)

  ## Why
  
  `codex-core` was being built in multiple feature-resolved permutations
  because test-only behavior was modeled as crate features. For a large
  crate, those permutations increase compile cost and reduce cache reuse.
  
  ## Net Change
  
  - Removed the `test-support` crate feature and related feature wiring so
  `codex-core` no longer needs separate feature shapes for test consumers.
  - Standardized cross-crate test-only access behind
  `codex_core::test_support`.
  - External test code now imports helpers from
  `codex_core::test_support`.
  - Underlying implementation hooks are kept internal (`pub(crate)`)
  instead of broadly public.
  
  ## Outcome
  
  - Fewer `codex-core` build permutations.
  - Better incremental cache reuse across test targets.
  - No intended production behavior change.

  Michael Bolin · 2026-02-10 22:44:02 -08:00
  476c1a7160
• feat: support multiple rate limits (#11260)

  Added multi-limit support end-to-end by carrying limit_name in
  rate-limit snapshots and handling multiple buckets instead of only
  codex.
  Extended /usage client parsing to consume additional_rate_limits
  Updated TUI /status and in-memory state to store/render per-limit
  snapshots
  Extended app-server rate-limit read response: kept rate_limits and added
  rate_limits_by_name.
  Adjusted usage-limit error messaging for non-default codex limit buckets

  xl-openai · 2026-02-10 20:09:31 -08:00
  fdd0cd1de9
• fix(auth): isolate chatgptAuthTokens concept to auth manager and app-server (#10423)

  So that the rest of the codebase (like TUI) don't need to be concerned
  whether ChatGPT auth was handled by Codex itself or passed in via
  app-server's external auth mode.

  Owen Lin · 2026-02-05 10:46:06 -08:00
  3582b74d01
• feat(tui): add /statusline command for interactive status line configuration (#10546)

  ## Summary
  - Adds a new `/statusline` command to configure TUI footer status line
  - Introduces reusable `MultiSelectPicker` component with keyboard
  navigation, optional ordering and toggle support
  - Implement status line setup modal that persist configuration to
  config.toml
  
    ## Status Line Items
    The following items can be displayed in the status line:
    - **Model**: Current model name (with optional reasoning level)
    - **Context**: Remaining/used context window percentage
    - **Rate Limits**: 5-day and weekly usage limits
    - **Git**: Current branch (with optimized lookups)
    - **Tokens**: Used tokens, input/output token counts
    - **Session**: Session ID (full or shortened prefix)
    - **Paths**: Current directory, project root
    - **Version**: Codex version
  
    ## Features
    - Live preview while configuring status line items
    - Fuzzy search filtering in the picker
    - Intelligent truncation when items don't fit
    - Items gracefully omit when data is unavailable
    - Configuration persists to `config.toml`
    - Validates and warns about invalid status line items
  
    ## Test plan
    - [x] Run `/statusline` and verify picker UI appears
    - [x] Toggle items on/off and verify live preview updates
    - [x] Confirm selection persists after restart
    - [x] Verify truncation behavior with many items selected
    - [x] Test git branch detection in and out of git repos
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Felipe Coury · 2026-02-05 08:50:21 -08:00
  b0e5a6305b
• chore: rename ChatGpt -> Chatgpt in type names (#10244)

  When using ChatGPT in names of types, we should be consistent, so this
  renames some types with `ChatGpt` in the name to `Chatgpt`. From
  https://rust-lang.github.io/api-guidelines/naming.html:
  
  > In `UpperCamelCase`, acronyms and contractions of compound words count
  as one word: use `Uuid` rather than `UUID`, `Usize` rather than `USize`
  or `Stdin` rather than `StdIn`. In `snake_case`, acronyms and
  contractions are lower-cased: `is_xid_start`.
  
  This PR updates existing uses of `ChatGpt` and changes them to
  `Chatgpt`. Though in all cases where it could affect the wire format, I
  visually inspected that we don't change anything there. That said, this
  _will_ change the codegen because it will affect the spelling of type
  names.
  
  For example, this renames `AuthMode::ChatGPT` to `AuthMode::Chatgpt` in
  `app-server-protocol`, but the wire format is still `"chatgpt"`.
  
  This PR also updates a number of types in `codex-rs/core/src/auth.rs`.

  Michael Bolin · 2026-01-30 11:18:39 -08:00
  e6d913af2d
• feat: refactor CodexAuth so invalid state cannot be represented (#10208)

  Previously, `CodexAuth` was defined as follows:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L39-L46
  
  But if you looked at its constructors, we had creation for
  `AuthMode::ApiKey` where `storage` was built using a nonsensical path
  (`PathBuf::new()`) and `auth_dot_json` was `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L212-L220
  
  By comparison, when `AuthMode::ChatGPT` was used, `api_key` was always
  `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L665-L671
  
  https://github.com/openai/codex/pull/10012 took things further because
  it introduced a new `ChatgptAuthTokens` variant to `AuthMode`, which is
  important in when invoking `account/login/start` via the app server, but
  most logic _internal_ to the app server should just reason about two
  `AuthMode` variants: `ApiKey` and `ChatGPT`.
  
  This PR tries to clean things up as follows:
  
  - `LoginAccountParams` and `AuthMode` in `codex-rs/app-server-protocol/`
  both continue to have the `ChatgptAuthTokens` variant, though it is used
  exclusively for the on-the-wire messaging.
  - `codex-rs/core/src/auth.rs` now has its own `AuthMode` enum, which
  only has two variants: `ApiKey` and `ChatGPT`.
  - `CodexAuth` has been changed from a struct to an enum. It is a
  disjoint union where each variant (`ApiKey`, `ChatGpt`, and
  `ChatGptAuthTokens`) have only the associated fields that make sense for
  that variant.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10208).
  * #10224
  * __->__ #10208

  Michael Bolin · 2026-01-30 09:33:23 -08:00
  377ab0c77c
• Conversation naming (#8991)

  Session renaming:
  - `/rename my_session`
  - `/rename` without arg and passing an argument in `customViewPrompt`
  - AppExitInfo shows resume hint using the session name if set instead of
  uuid, defaults to uuid if not set
  - Names are stored in `CODEX_HOME/sessions.jsonl`
  
  Session resuming:
  - codex resume <name> lookup for `CODEX_HOME/sessions.jsonl` first entry
  matching the name and resumes the session
  
  ---------
  
  Co-authored-by: jif-oai <jif@openai.com>

  pap-openai · 2026-01-30 10:40:09 +00:00
  1ef5455eb6
• feat(app-server): support external auth mode (#10012)

  This enables a new use case where `codex app-server` is embedded into a
  parent application that will directly own the user's ChatGPT auth
  lifecycle, which means it owns the user’s auth tokens and refreshes it
  when necessary. The parent application would just want a way to pass in
  the auth tokens for codex to use directly.
  
  The idea is that we are introducing a new "auth mode" currently only
  exposed via app server: **`chatgptAuthTokens`** which consist of the
  `id_token` (stores account metadata) and `access_token` (the bearer
  token used directly for backend API calls). These auth tokens are only
  stored in-memory. This new mode is in addition to the existing `apiKey`
  and `chatgpt` auth modes.
  
  This PR reuses the shape of our existing app-server account APIs as much
  as possible:
  - Update `account/login/start` with a new `chatgptAuthTokens` variant,
  which will allow the client to pass in the tokens and have codex
  app-server use them directly. Upon success, the server emits
  `account/login/completed` and `account/updated` notifications.
  - A new server->client request called
  `account/chatgptAuthTokens/refresh` which the server can use whenever
  the access token previously passed in has expired and it needs a new one
  from the parent application.
  
  I leveraged the core 401 retry loop which typically triggers auth token
  refreshes automatically, but made it pluggable:
  - **chatgpt** mode refreshes internally, as usual.
  - **chatgptAuthTokens** mode calls the client via
  `account/chatgptAuthTokens/refresh`, the client responds with updated
  tokens, codex updates its in-memory auth, then retries. This RPC has a
  10s timeout and handles JSON-RPC errors from the client.
  
  Also some additional things:
  - chatgpt logins are blocked while external auth is active (have to log
  out first. typically clients will pick one OR the other, not support
  both)
  - `account/logout` clears external auth in memory
  - Ensures that if `forced_chatgpt_workspace_id` is set via the user's
  config, we respect it in both:
  - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC
  error back to the client)
  - `account/chatgptAuthTokens/refresh` (fails the turn, and on next
  request app-server will send another `account/chatgptAuthTokens/refresh`
  request to the client).

  Owen Lin · 2026-01-29 23:46:04 +00:00
  81a17bb2c1
• Tui: use collaboration mode instead of model and effort (#9507)

  - Only use collaboration modes in the tui state to track model and
  effort.
  - No behavior change without the collaboration modes flag.
  - Change model and effort on /model, /collab (behind a flag), and
  shift+tab (behind flag)

  Ahmed Ibrahim · 2026-01-20 10:26:12 -08:00
  5ae6e70801
• TUI: collaboration mode UX + always submit UserTurn when enabled (#9461)

  - Adds experimental collaboration modes UX in TUI: Plan / Pair
  Programming / Execute.
  - Gated behind `Feature::CollaborationModes`; existing behavior remains
  unchanged when disabled.
  - Selection UX:
  - `Shift+Tab` cycles modes while idle (no task running, no modal/popup).
  - `/collab` cycles; `/collab <plan|pair|pp|execute|exec>` sets
  explicitly.
  - Footer flash after changes + shortcut overlay shows `Shift+Tab` “to
  change mode”.
    - `/status` shows “Collaboration mode”.
  - Submission semantics:
  - When enabled: every submit uses `Op::UserTurn` and always includes
  `collaboration_mode: Some(...)` (default Pair Programming).
    - Removes the one-shot “pending collaboration mode” behavior.
  - Implementation:
  - New `tui/src/collaboration_modes.rs` (selection enum/cycle, `/collab`
  parsing, resolve to `CollaborationMode`, footer flash line).
  - Fallback: `resolve_mode_or_fallback` synthesizes a `CollaborationMode`
  when presets are missing (uses current model + reasoning effort; no
  `developer_instructions`) to avoid core falling back to `Custom`.
    - TODO: migrate TUI to use `Op::UserTurn`.

  Ahmed Ibrahim · 2026-01-19 09:32:04 -08:00
  bf430ad9fe
• feat: show forked from session id in /status (#9330)

  Summary:
  - Add forked_from to SessionMeta/SessionConfiguredEvent and persist it
  for forked sessions.
  - Surface forked_from in /status for tui + tui2 and add snapshots.

  Anton Panasenko · 2026-01-16 13:41:46 -08:00
  c26fe64539
• Add model provider info to /status if non-default (#8981)

  Add model provider info to /status if non-default
  
  Enterprises are running Codex and migrating between proxied / API key
  auth and SIWC. If you accidentally run Codex with `OPENAI_BASE_URL=...`,
  which is surprisingly easy to do, we don't tend to surface this anywhere
  and it may lead to breakage. One suggestion was to include this
  information in `/status`:
  
  <img width="477" height="157" alt="Screenshot 2026-01-09 at 15 45 34"
  src="https://github.com/user-attachments/assets/630ce68f-c856-4a2b-a004-7df2fbe5de93"
  />

  gt-oai · 2026-01-10 00:53:34 +00:00
  8e49a2c0d1
• Immutable CodexAuth (#8857)

  Historically we started with a CodexAuth that knew how to refresh it's
  own tokens and then added AuthManager that did a different kind of
  refresh (re-reading from disk).
  
  I don't think it makes sense for both `CodexAuth` and `AuthManager` to
  be mutable and contain behaviors.
  
  Move all refresh logic into `AuthManager` and keep `CodexAuth` as a data
  object.

  pakrym-oai · 2026-01-08 11:43:56 -08:00
  634764ece9
• Merge Modelfamily into modelinfo (#8763)

  - Merge ModelFamily into ModelInfo
  - Remove logic for adding instructions to apply patch
  - Add compaction limit and visible context window to `ModelInfo`

  Ahmed Ibrahim · 2026-01-07 10:35:09 -08:00
  9179c9deac
• chore: unify conversation with thread name (#8830)

  Done and verified by Codex + refactor feature of RustRover

  jif-oai · 2026-01-07 17:04:53 +00:00
  116059c3a0
• Remove model family from tui (#8488)

  - Remove model family from tui

  Ahmed Ibrahim · 2026-01-02 11:30:04 -08:00
  2de731490e
• [tui] add optional details to TUI status header (#8293)

  ### What
  
  Add optional `details` field to TUI's status indicator header. `details`
  is shown under the header with text wrapping and a max height of 3
  lines.
  
  Duplicated changes to `tui2`.
  
  ### Why
  
  Groundwork for displaying error details under `Reconnecting...` for
  clarity with retryable errors.
  
  Basic examples
  <img width="1012" height="326" alt="image"
  src="https://github.com/user-attachments/assets/dd751ceb-b179-4fb2-8fd1-e4784d6366fb"
  />
  
  <img width="1526" height="358" alt="image"
  src="https://github.com/user-attachments/assets/bbe466fc-faff-4a78-af7f-3073ccdd8e34"
  />
  
  Truncation example
  <img width="936" height="189" alt="image"
  src="https://github.com/user-attachments/assets/f3f1b5dd-9050-438b-bb07-bd833c03e889"
  />
  
  ### Tests
  Tested locally, added tests for truncation.

  sayan-oai · 2025-12-23 12:40:40 -08:00
  53eb2e9f27
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• feat: introduce ExternalSandbox policy (#8290)

  ## Description
  
  Introduced `ExternalSandbox` policy to cover use case when sandbox
  defined by outside environment, effectively it translates to
  `SandboxMode#DangerFullAccess` for file system (since sandbox configured
  on container level) and configurable `network_access` (either Restricted
  or Enabled by outside environment).
  
  as example you can configure `ExternalSandbox` policy as part of
  `sendUserTurn` v1 app_server API:
  
  ```
   {
              "conversationId": <id>,
              "cwd": <cwd>,
              "approvalPolicy": "never",
              "sandboxPolicy": {
                    "type": ""external-sandbox",
                    "network_access": "enabled"/"restricted"
              },
              "model": <model>,
              "effort": <effort>,
              ....
          }
  ```

  Anton Panasenko · 2025-12-18 17:02:03 -08:00
  3429de21b3
• chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder (#8276)

  https://github.com/openai/codex/pull/8235 introduced `ConfigBuilder` and
  this PR updates all call non-test call sites to use it instead of
  `Config::load_from_base_config_with_overrides()`.
  
  This is important because `load_from_base_config_with_overrides()` uses
  an empty `ConfigRequirements`, which is a reasonable default for testing
  so the tests are not influenced by the settings on the host. This method
  is now guarded by `#[cfg(test)]` so it cannot be used by business logic.
  
  Because `ConfigBuilder::build()` is `async`, many of the test methods
  had to be migrated to be `async`, as well. On the bright side, this made
  it possible to eliminate a bunch of `block_on_future()` stuff.

  Michael Bolin · 2025-12-18 16:12:52 -08:00
  3d4ced3ff5
• make model optional in config (#7769)

  - Make Config.model optional and centralize default-selection logic in
  ModelsManager, including a default_model helper (with
  codex-auto-balanced when available) so sessions now carry an explicit
  chosen model separate from the base config.
  - Resolve `model` once in `core` and `tui` from config. Then store the
  state of it on other structs.
  - Move refreshing models to be before resolving the default model

  Ahmed Ibrahim · 2025-12-10 11:19:00 -08:00
  cb9a189857
• Remove legacy ModelInfo and merge it with ModelFamily (#7748)

  This is a step towards removing the need to know `model` when
  constructing config. We firstly don't need to know `model_info` and just
  respect if the user has already set it. Next step, we don't need to know
  `model` unless the user explicitly set it in `config.toml`

  Ahmed Ibrahim · 2025-12-08 15:29:37 -08:00
  382f047a10
• fix: taking plan type from usage endpoint instead of thru auth token (#7610)

  pull plan type from the usage endpoint, persist it in session state /
  tui state, and propagate through rate limit snapshots

  zhao-oai · 2025-12-04 23:34:13 -08:00
  b8eab7ce90
• Migrate model preset (#7542)

  - Introduce `openai_models` in `/core`
  - Move `PRESETS` under it
  - Move `ModelPreset`, `ModelUpgrade`, `ReasoningEffortPreset`,
  `ReasoningEffortPreset`, and `ReasoningEffortPreset` to `protocol`
  - Introduce `Op::ListModels` and `EventMsg::AvailableModels`
  
  Next steps:
  - migrate `app-server` and `tui` to use the introduced Operation

  Ahmed Ibrahim · 2025-12-03 20:30:43 +00:00
  71504325d3
• Show token used when context window is unknown (#7497)

  - Show context window usage in tokens instead of percentage when the
  window length is unknown.

  Ahmed Ibrahim · 2025-12-02 11:45:50 -08:00
  127e307f89
• storing credits (#6858)

  Expand the rate-limit cache/TUI: store credit snapshots alongside
  primary and secondary windows, render “Credits” when the backend reports
  they exist (unlimited vs rounded integer balances)

  zhao-oai · 2025-11-19 10:49:35 -08:00
  72af589398
• feat: arcticfox in the wild (#6906)

  <img width="485" height="600" alt="image"
  src="https://github.com/user-attachments/assets/4341740d-dd58-4a3e-b69a-33a3be0606c5"
  />
  
  ---------
  
  Co-authored-by: jif-oai <jif@openai.com>

  Ahmed Ibrahim · 2025-11-19 16:31:06 +00:00
  d5dfba2509
• fix: typos in model picker (#6859)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-11-19 06:29:02 +00:00
  793063070b
• Update defaults to gpt-5.1 (#6652)

  ## Summary
  - update documentation, example configs, and automation defaults to
  reference gpt-5.1 / gpt-5.1-codex
  - bump the CLI and core configuration defaults, model presets, and error
  messaging to the new models while keeping the model-family/tool coverage
  for legacy slugs
  - refresh tests, fixtures, and TUI snapshots so they expect the upgraded
  defaults
  
  ## Testing
  - `cargo test -p codex-core
  config::tests::test_precedence_fixture_with_gpt5_profile`
  
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6916c5b3c2b08321ace04ee38604fc6b)

  Ahmed Ibrahim · 2025-11-17 17:40:11 -08:00
  ddcc60a085
• Fixed status output to use auth information from AuthManager (#6529)

  This PR addresses https://github.com/openai/codex/issues/6360. The root
  problem is that the TUI was directly loading the `auth.json` file to
  access the auth information. It should instead be using the AuthManager,
  which records the current auth information. The `auth.json` file can be
  overwritten at any time by other instances of the CLI or extension, so
  its information can be out of sync with the current instance. The
  `/status` command should always report the auth information associated
  with the current instance.
  
  An alternative fix for this bug was submitted by @chojs23 in [this
  PR](https://github.com/openai/codex/pull/6495). That approach was only a
  partial fix.

  Eric Traut · 2025-11-12 10:26:50 -08:00
  ad09c138b9
• flip rate limit status bar (#6482)

  flipping rate limit status bar to match chat.com/codex/settings/usage
  
  <img width="848" height="420" alt="Screenshot 2025-11-10 at 4 53 41 PM"
  src="https://github.com/user-attachments/assets/e326db3f-4405-412d-9e62-337282ec9a35"
  />

  zhao-oai · 2025-11-11 01:13:10 +00:00
  930f81a17b
• Include reasoning tokens in the context window calculation (#6161)

  This value is used to determine whether mid-turn compaction is required.
  Reasoning items are only excluded between turns (and soon will start to
  be preserved even across turns) so it's incorrect to subtract
  reasoning_output_tokens mid term.
  
  This will result in higher values reported between turns but we are also
  looking into preserving reasoning items for the entire conversation to
  improve performance and caching.

  pakrym-oai · 2025-11-03 10:02:23 -08:00
  e5e13479d0
• fix: improve usage URLs in status card and snapshots (#6111)

  Hi OpenAI Codex team, currently "Visit chatgpt.com/codex/settings/usage
  for up-to-date information on rate limits and credits" message in status
  card and error messages. For now, without the "https://" prefix, the
  link cannot be clicked directly from most terminals or chat interfaces.
  
  <img width="636" height="127" alt="Screenshot 2025-11-02 at 22 47 06"
  src="https://github.com/user-attachments/assets/5ea11e8b-fb74-451c-85dc-f4d492b2678b"
  />
  
  ---
  
  The fix is intent to improve this issue:
  
  - It makes the link clickable in terminals that support it, hence better
  accessibility
  - It follows standard URL formatting practices
  - It maintains consistency with other links in the application (like the
  existing "https://openai.com/chatgpt/pricing" links)
  
  Thank you!

  Vinh Nguyen · 2025-11-02 21:44:59 -08:00
  a1ee10b438
• Windows Sandbox - Alpha version (#4905)

  - Added the new codex-windows-sandbox crate that builds both a library
  entry point (run_windows_sandbox_capture) and a CLI executable to launch
  commands inside a Windows restricted-token sandbox, including ACL
  management, capability SID provisioning, network lockdown, and output
  capture
  (windows-sandbox-rs/src/lib.rs:167, windows-sandbox-rs/src/main.rs:54).
  - Introduced the experimental WindowsSandbox feature flag and wiring so
  Windows builds can opt into the sandbox:
  SandboxType::WindowsRestrictedToken, the in-process execution path, and
  platform sandbox selection now honor the flag (core/src/features.rs:47,
  core/src/config.rs:1224, core/src/safety.rs:19,
  core/src/sandboxing/mod.rs:69, core/src/exec.rs:79,
  core/src/exec.rs:172).
  - Updated workspace metadata to include the new crate and its
  Windows-specific dependencies so the core crate can link against it
  (codex-rs/
      Cargo.toml:91, core/Cargo.toml:86).
  - Added a PowerShell bootstrap script that installs the Windows
  toolchain, required CLI utilities, and builds the workspace to ease
  development
      on the platform (scripts/setup-windows.ps1:1).
  - Landed a Python smoke-test suite that exercises
  read-only/workspace-write policies, ACL behavior, and network denial for
  the Windows sandbox
      binary (windows-sandbox-rs/sandbox_smoketests.py:1).

  iceweasel-oai · 2025-10-30 15:51:57 -07:00
  87cce88f48
• asdf (#5940)

  .

  zhao-oai · 2025-10-30 01:10:41 +00:00
  b34efde2f3
• [Auth] Choose which auth storage to use based on config (#5792)

  This PR is a follow-up to #5591. It allows users to choose which auth
  storage mode they want by using the new
  `cli_auth_credentials_store_mode` config.

  Celia Chen · 2025-10-27 19:41:49 -07:00
  4a42c4e142
• [Auth] Introduce New Auth Storage Abstraction for Codex CLI (#5569)

  This PR introduces a new `Auth Storage` abstraction layer that takes
  care of read, write, and load of auth tokens based on the
  AuthCredentialsStoreMode. It is similar to how we handle MCP client
  oauth
  [here](https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs).
  Instead of reading and writing directly from disk for auth tokens, Codex
  CLI workflows now should instead use this auth storage using the public
  helper functions.
  
  This PR is just a refactor of the current code so the behavior stays the
  same. We will add support for keyring and hybrid mode in follow-up PRs.
  
  I have read the CLA Document and I hereby sign the CLA

  Celia Chen · 2025-10-27 11:01:14 -07:00
  eb5b1b627f
• adding messaging for stale rate limits + when no rate limits are cached (#5570)
  zhao-oai · 2025-10-24 08:46:31 -07:00
  c72b2ad766
• Use int timestamps for rate limit reset_at (#5383)

  The backend will be returning unix timestamps (seconds since epoch)
  instead of RFC 3339 strings. This will make it more ergonomic for
  developers to integrate against - no string parsing.

  Owen Lin · 2025-10-20 12:26:46 -07:00
  c84fc83222
• Auto compact at ~90% (#5292)

  Users now hit a window exceeded limit and they usually don't know what
  to do. This starts auto compact at ~90% of the window.

  Ahmed Ibrahim · 2025-10-20 11:29:49 -07:00
  049a61bcfc
• fix: switch rate limit reset handling to timestamps (#5304)

  This change ensures that we store the absolute time instead of relative
  offsets of when the primary and secondary rate limits will reset.
  Previously these got recalculated relative to current time, which leads
  to the displayed reset times to change over time, including after doing
  a codex resume.
  
  For previously changed sessions, this will cause the reset times to not
  show due to this being a breaking change:
  <img width="524" height="55" alt="Screenshot 2025-10-17 at 5 14 18 PM"
  src="https://github.com/user-attachments/assets/53ebd43e-da25-4fef-9c47-94a529d40265"
  />
  
  Fixes https://github.com/openai/codex/issues/4761

  Thibault Sottiaux · 2025-10-17 17:39:37 -07:00
  0e08dd6055
• Fix status usage ratio (#4584)

  1. Removes "Token usage" line for chatgpt sub users
  2. Adds the word "used" to the context window line

  dedrisian-oai · 2025-10-02 10:27:10 -07:00
  b07aafa5f5
• canonicalize display of Agents.md paths on Windows. (#4577)

  Canonicalize path on Windows to 
  - remove unattractive path prefixes such as `\\?\`
  - simplify it (`../AGENTS.md` vs
  `C:\Users\iceweasel\code\coded\Agents.md`)
  before: <img width="1110" height="45" alt="Screenshot 2025-10-01 123520"
  src="https://github.com/user-attachments/assets/48920ae6-d89c-41b8-b4ea-df5c18fb5fad"
  />
  
  after: 
  <img width="585" height="46" alt="Screenshot 2025-10-01 123612"
  src="https://github.com/user-attachments/assets/70a1761a-9d97-4836-b14c-670b6f13e608"
  />

  iceweasel-oai · 2025-10-01 14:33:19 -07:00
  6f97ec4990
• Fall back to configured instruction files if AGENTS.md isn't available (#4544)

  Allow users to configure an agents.md alternative to consume, but warn
  the user it may degrade model performance.
  
  Fixes #4376

  easong-openai · 2025-10-01 18:19:59 +00:00
  400a5a90bf
• Show context window usage while tasks run (#4536)

  ## Summary
  - show the remaining context window percentage in `/status` alongside
  existing token usage details
  - replace the composer shortcut prompt with the context window
  percentage (or an unavailable message) while a task is running
  - update TUI snapshots to reflect the new context window line
  
  ## Testing
  - cargo test -p codex-tui
  
  ------
  https://chatgpt.com/codex/tasks/task_i_68dc6e7397ac8321909d7daff25a396c

  Ahmed Ibrahim · 2025-10-01 18:03:05 +00:00
  2f370e946d