337 Commits

• chore: save more about turn context in rollout log file (#8458)

  ### Motivation
  - Persist richer per-turn configuration in rollouts so resumed/forked
  sessions and tooling can reason about the exact instruction inputs and
  output constraints used for a turn.
  
  ### Description
  - Extend `TurnContextItem` to include optional `base_instructions`,
  `user_instructions`, and `developer_instructions`.
  - Record the optional `final_output_json_schema` associated with a turn.
  - Add an optional `truncation_policy` to `TurnContextItem` and populate
  it when writing turn-context rollout items.
  - Introduce a protocol-level `TruncationPolicy` representation and
  convert from core truncation policy when recording.
  
  ### Testing
  - `cargo test -p codex-protocol` (pass)

  Anton Panasenko · 2025-12-22 19:51:07 -08:00
  cbc5fb9acf
• feat: load ExecPolicyManager from ConfigLayerStack (#8453)

  https://github.com/openai/codex/pull/8354 added support for in-repo
  `.config/` files, so this PR updates the logic for loading `*.rules`
  files to load `*.rules` files from all relevant layers. The main change
  to the business logic is `load_exec_policy()` in
  `codex-rs/core/src/exec_policy.rs`.
  
  Note this adds a `config_folder()` method to `ConfigLayerSource` that
  returns `Option<AbsolutePathBuf>` so that it is straightforward to
  iterate over the sources and get the associated config folder, if any.

  Michael Bolin · 2025-12-22 17:24:17 -08:00
  277babba79
• Add ExecPolicyManager (#8349)

  Move exec policy management into services to keep turn context
  immutable.

  pakrym-oai · 2025-12-22 09:59:32 -08:00
  96fdbdd434
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• feat: make ConstraintError an enum (#8330)

  This will make it easier to test for expected errors in unit tests since
  we can compare based on the field values rather than the message (which
  might change over time). See https://github.com/openai/codex/pull/8298
  for an example.
  
  It also ensures more consistency in the way a `ConstraintError` is
  constructed.

  Michael Bolin · 2025-12-19 19:03:50 +00:00
  7e5c343ef5
• chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder (#8276)

  https://github.com/openai/codex/pull/8235 introduced `ConfigBuilder` and
  this PR updates all call non-test call sites to use it instead of
  `Config::load_from_base_config_with_overrides()`.
  
  This is important because `load_from_base_config_with_overrides()` uses
  an empty `ConfigRequirements`, which is a reasonable default for testing
  so the tests are not influenced by the settings on the host. This method
  is now guarded by `#[cfg(test)]` so it cannot be used by business logic.
  
  Because `ConfigBuilder::build()` is `async`, many of the test methods
  had to be migrated to be `async`, as well. On the bright side, this made
  it possible to eliminate a bunch of `block_on_future()` stuff.

  Michael Bolin · 2025-12-18 16:12:52 -08:00
  3d4ced3ff5
• Support skills shortDescription. (#8278)

  Allow SKILL.md to specify a more human-readable short description as
  skill metadata.

  xl-openai · 2025-12-18 23:13:18 +00:00
  358a5baba0
• Reintroduce feature flags for skills. (#8244)

  1. Reintroduce feature flags for skills;
  2. UI tweaks (truncate descriptions, better validation error display).

  xl-openai · 2025-12-18 01:14:11 -08:00
  5c8d22138a
• Support SYSTEM skills. (#8220)

  1. Remove PUBLIC skills and introduce SYSTEM skills embedded in the
  binary and installed into $CODEX_HOME/skills/.system at startup.
  2. Skills are now always enabled (feature flag removed).
  3. Update skills/list to accept forceReload and plumb it through (not
  used by clients yet).

  xl-openai · 2025-12-17 18:48:28 -08:00
  da3869eeb6
• fix: session downgrade (#8196)

  The problem is that the `tokio` task own an `Arc` reference of the
  session and that this task only exit with the broadcast channel get
  closed. But this never get closed if the session is not dropped. So it's
  a snake biting his tail basically
  
  The most notable result was that non of the `Drop` implementation were
  triggered (temporary files, shell snapshots, session cleaning etc etc)
  when closing the session (through a `/new` for example)
  
  The fix is just to weaken the `Arc` and upgrade it on the fly

  jif-oai · 2025-12-17 10:44:39 -08:00
  167553f00d
• feat: Constrain values for approval_policy (#7778)

  Constrain `approval_policy` through new `admin_policy` config.
  
  This PR will:
  1. Add a `admin_policy` section to config, with a single field (for now)
  `allowed_approval_policies`. This list constrains the set of
  user-settable `approval_policy`s.
  2. Introduce a new `Constrained<T>` type, which combines a current value
  and a validator function. The validator function ensures disallowed
  values are not set.
  3. Change the type of `approval_policy` on `Config` and
  `SessionConfiguration` from `AskForApproval` to
  `Constrained<AskForApproval>`. The validator function is set by the
  values passed into `allowed_approval_policies`.
  4. `GenericDisplayRow`: add a `disabled_reason: Option<String>`. When
  set, it disables selection of the value and indicates as such in the
  menu. This also makes it unselectable with arrow keys or numbers. This
  is used in the `/approvals` menu.
  
  Follow ups are:
  1. Do the same thing to `sandbox_policy`.
  2. Propagate the allowed set of values through app-server for the
  extension (though already this should prevent app-server from setting
  this values, it's just that we want to disable UI elements that are
  unsettable).
  
  Happy to split this PR up if you prefer, into the logical numbered areas
  above. Especially if there are parts we want to gavel on separately
  (e.g. admin_policy).
  
  Disabled full access:
  <img width="1680" height="380" alt="image"
  src="https://github.com/user-attachments/assets/1fb61c8c-1fcb-4dc4-8355-2293edb52ba0"
  />
  
  Disabled `--yolo` on startup:
  <img width="749" height="76" alt="image"
  src="https://github.com/user-attachments/assets/0a1211a0-6eb1-40d6-a1d7-439c41e94ddb"
  />
  
  CODEX-4087

  gt-oai · 2025-12-17 16:19:27 +00:00
  9352c6b235
• Add public skills + improve repo skill discovery and error UX (#8098)

  1. Adds SkillScope::Public end-to-end (core + protocol) and loads skills
  from the public cache directory
  2. Improves repo skill discovery by searching upward for the nearest
  .codex/skills within a git repo
  3. Deduplicates skills by name with deterministic ordering to avoid
  duplicates across sources
  4. Fixes garbled “Skill errors” overlay rendering by preventing pending
  history lines from being injected during the modal
  5. Updates the project docs “Skills” intro wording to avoid hardcoded
  paths

  xl-openai · 2025-12-17 01:35:49 -08:00
  4897efcced
• nit: trace span for regular task (#8053)

  Logs are too spammy
  
  ---------
  
  Co-authored-by: Anton Panasenko <apanasenko@openai.com>

  jif-oai · 2025-12-16 16:53:15 +00:00
  d7482510b1
• feat: do not compact on last user turn (#8060)
  jif-oai · 2025-12-16 15:36:33 +00:00
  c9f5b9a6df
• fix parallel tool calls (#7956)
  Ahmed Ibrahim · 2025-12-16 01:28:27 +00:00
  d802b18716
• feat: config ghost commits (#7873)
  jif-oai · 2025-12-15 09:13:06 +01:00
  4274e6189a
• Reimplement skills loading using SkillsManager + skills/list op. (#7914)

  refactor the way we load and manage skills:
  1. Move skill discovery/caching into SkillsManager and reuse it across
  sessions.
  2. Add the skills/list API (Op::ListSkills/SkillsListResponse) to fetch
  skills for one or more cwds. Also update app-server for VSCE/App;
  3. Trigger skills/list during session startup so UIs preload skills and
  handle errors immediately.

  xl-openai · 2025-12-14 09:58:17 -08:00
  5d77d4db6b
• [codex] add otel tracing (#7844)
  Anton Panasenko · 2025-12-12 17:07:17 -08:00
  ad7b9d63c3
• fix: restore MCP startup progress messages in TUI (fixes #7827) (#7828)

  ## Problem
  
  The introduction of `notify_sandbox_state_change()` in #7112 caused a
  regression where the blocking call in `Session::new()` waits for all MCP
  servers to fully initialize before returning. This prevents the TUI
  event loop from starting, resulting in `McpStartupUpdateEvent` messages
  being emitted but never consumed or displayed. As a result, the app
  appears to hang during startup, and users do not see the expected
  "Booting MCP server: {name}" status line.
  
  Issue: [#7827](https://github.com/openai/codex/issues/7827)
  
  ## Solution
  This change moves sandbox state notification into each MCP server's
  background initialization task. The notification is sent immediately
  after the server transitions to the Ready state. This approach:
  - Avoids blocking `Session::new()`, allowing the TUI event loop to start
  promptly.
  - Ensures each MCP server receives its sandbox state before handling any
  tool calls.
  - Restores the display of "Booting MCP server" status lines during
  startup.
  
  ## Key Changes
  - Added `ManagedClient::notify_sandbox_state()` method.
  - Passed sandbox_state to `McpConnectionManager::initialize()`.
  - Sends sandbox state notification in the background task after the
  server reaches Ready status.
  - Removed blocking notify_sandbox_state_change() methods.
  - Added a chatwidget snapshot test for the "Booting MCP server" status
  line.
  
  ## Regression Details
  
  Regression was bisected to #7112, which introduced the blocking
  behavior.
  
  ---------
  
  Co-authored-by: Michael Bolin <bolinfest@gmail.com>
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  Ivan Murashko · 2025-12-12 22:07:03 +00:00
  c978b6e222
• Remote compact for API-key users (#7835)
  pakrym-oai · 2025-12-12 10:05:02 -08:00
  b3ddd50eee
• Added deprecation notice for "chat" wire_api (#7897)

  This PR adds a deprecation notice that appears once per invocation of
  codex (not per conversation) when a conversation is started using a
  custom model provider configured with the "chat" wire_api. We have
  [announced](https://github.com/openai/codex/discussions/7782) that this
  feature is deprecated and will be removed in early Feb 2026, so we want
  to notify users of this fact.
  
  The deprecation notice was added in a way that works with the
  non-interactive "codex exec", the TUI, and with the extension. Screen
  shots of each are below.
  
  <img width="1000" height="89" alt="image"
  src="https://github.com/user-attachments/assets/72cc08bb-d158-4a89-b3c8-7a896abd016f"
  />
  
  <img width="1000" height="38" alt="Screenshot 2025-12-11 at 2 22 29 PM"
  src="https://github.com/user-attachments/assets/7b2128ca-9afc-48be-9ce1-2ce81bc00fcb"
  />
  
  <img width="479" height="106" alt="Screenshot 2025-12-11 at 2 21 26 PM"
  src="https://github.com/user-attachments/assets/858ec1cc-ebfc-4c99-b22b-63015154d752"
  />

  Eric Traut · 2025-12-11 15:24:43 -08:00
  43e6e75317
• Inject SKILL.md when it's explicitly mentioned. (#7763)

  1. Skills load once in core at session start; the cached outcome is
  reused across core and surfaced to TUI via SessionConfigured.
  2. TUI detects explicit skill selections, and core injects the matching
  SKILL.md content into the turn when a selected skill is present.

  xl-openai · 2025-12-10 13:59:17 -08:00
  b36ecb6c32
• make model optional in config (#7769)

  - Make Config.model optional and centralize default-selection logic in
  ModelsManager, including a default_model helper (with
  codex-auto-balanced when available) so sessions now carry an explicit
  chosen model separate from the base config.
  - Resolve `model` once in `core` and `tui` from config. Then store the
  state of it on other structs.
  - Move refreshing models to be before resolving the default model

  Ahmed Ibrahim · 2025-12-10 11:19:00 -08:00
  cb9a189857
• Removed experimental "command risk assessment" feature (#7799)

  This experimental feature received lukewarm reception during internal
  testing. Removing from the code base.

  Eric Traut · 2025-12-10 09:48:11 -08:00
  c4af707e09
• refactoring with_escalated_permissions to use SandboxPermissions instead (#7750)

  helpful in the future if we want more granularity for requesting
  escalated permissions:
  e.g when running in readonly sandbox, model can request to escalate to a
  sandbox that allows writes

  zhao-oai · 2025-12-10 17:18:48 +00:00
  e0fb3ca1db
• feat: shell snapshotting (#7641)
  jif-oai · 2025-12-09 18:36:58 +00:00
  7836aeddae
• chore: enable parallel tc (#7589)
  jif-oai · 2025-12-09 17:00:56 +00:00
  6382dc2338
• Remove legacy ModelInfo and merge it with ModelFamily (#7748)

  This is a step towards removing the need to know `model` when
  constructing config. We firstly don't need to know `model_info` and just
  respect if the user has already set it. Next step, we don't need to know
  `model` unless the user explicitly set it in `config.toml`

  Ahmed Ibrahim · 2025-12-08 15:29:37 -08:00
  382f047a10
• fix: refine the warning message and docs for deprecated tools config (#7685)

  Issue #7661 revealed that users are confused by deprecation warnings
  like:
  > `tools.web_search` is deprecated. Use `web_search_request` instead.
  
  This message misleadingly suggests renaming the config key from
  `web_search` to `web_search_request`, when the actual required change is
  to **move and rename the configuration from the `[tools]` section to the
  `[features]` section**.
  
  This PR clarifies the warning messages and documentation to make it
  clear that deprecated `[tools]` configurations should be moved to
  `[features]`. Changes made:
  - Updated deprecation warning format in `codex-rs/core/src/codex.rs:520`
  to include `[features].` prefix
  - Updated corresponding test expectations in
  `codex-rs/core/tests/suite/deprecation_notice.rs:39`
  - Improved documentation in `docs/config.md` to clarify upfront that
  `[tools]` options are deprecated in favor of `[features]`

  gameofby · 2025-12-08 01:23:21 -08:00
  98923654d0
• Add remote models feature flag (#7648)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-07 09:47:48 -08:00
  53a486f7ea
• Wire with_remote_overrides to construct model families (#7621)

  - This PR wires `with_remote_overrides` and make the
  `construct_model_families` an async function
  - Moves getting model family a level above to keep the function `sync`
  - Updates the tests to local, offline, and `sync` helper for model
  families

  Ahmed Ibrahim · 2025-12-05 10:40:15 -08:00
  d08efb1743
• fix: taking plan type from usage endpoint instead of thru auth token (#7610)

  pull plan type from the usage endpoint, persist it in session state /
  tui state, and propagate through rate limit snapshots

  zhao-oai · 2025-12-04 23:34:13 -08:00
  b8eab7ce90
• Call models endpoint in models manager (#7616)

  - Introduce `with_remote_overrides` and update
  `refresh_available_models`
  - Put `auth_manager` instead of `auth_mode` on `models_manager`
  - Remove `ShellType` and `ReasoningLevel` to use already existing
  structs

  Ahmed Ibrahim · 2025-12-04 18:28:03 -08:00
  7b359c9c8e
• chore: refactor to move Arc<RwLock> concern outside exec_policy_for (#7615)

  The caller should decide whether wrapping the policy in `Arc<RwLock>` is
  necessary. This should make https://github.com/openai/codex/pull/7609 a
  bit smoother.
  
  - `exec_policy_for()` -> `load_exec_policy_for_features()`
  - introduce `load_exec_policy()` that does not take `Features` as an arg
  - both return `Result<Policy, ExecPolicyError>` instead of
  Result<Arc<RwLock<Policy>>, ExecPolicyError>`
  
  This simplifies the tests as they have no need for `Arc<RwLock>`.

  Michael Bolin · 2025-12-04 15:13:27 -08:00
  0972cd9404
• Inline response recording and remove process_items indirection (#7310)

  - Inline response recording during streaming: `run_turn` now records
  items as they arrive instead of building a `ProcessedResponseItem` list
  and post‑processing via `process_items`.
  - Simplify turn handling: `handle_output_item_done` returns the
  follow‑up signal + optional tool future; `needs_follow_up` is set only
  there, and in‑flight tool futures are drained once at the end (errors
  logged, no extra state writes).
  - Flattened stream loop: removed `process_items` indirection and the
  extra output queue
  - - Tests: relaxed `tool_parallelism::tool_results_grouped` to allow any
  completion order while still requiring matching call/output IDs.

  Ahmed Ibrahim · 2025-12-04 12:17:54 -08:00
  6e6338aa87
• remove model_family from `config (#7571)

  - Remove `model_family` from `config`
  - Make sure to still override config elements related to `model_family`
  like supporting reasoning

  Ahmed Ibrahim · 2025-12-04 11:57:58 -08:00
  9b2055586d
• Refactor execpolicy fallback evaluation (#7544)

  ## Refactor of the `execpolicy` crate
  
  To illustrate why we need this refactor, consider an agent attempting to
  run `apple | rm -rf ./`. Suppose `apple` is allowed by `execpolicy`.
  Before this PR, `execpolicy` would consider `apple` and `pear` and only
  render one rule match: `Allow`. We would skip any heuristics checks on
  `rm -rf ./` and immediately approve `apple | rm -rf ./` to run.
  
  To fix this, we now thread a `fallback` evaluation function into
  `execpolicy` that runs when no `execpolicy` rules match a given command.
  In our example, we would run `fallback` on `rm -rf ./` and prevent
  `apple | rm -rf ./` from being run without approval.

  zhao-oai · 2025-12-03 23:39:48 -08:00
  3d35cb4619
• whitelist command prefix integration in core and tui (#7033)

  this PR enables TUI to approve commands and add their prefixes to an
  allowlist:
  <img width="708" height="605" alt="Screenshot 2025-11-21 at 4 18 07 PM"
  src="https://github.com/user-attachments/assets/56a19893-4553-4770-a881-becf79eeda32"
  />
  
  note: we only show the option to whitelist the command when 
  1) command is not multi-part (e.g `git add -A && git commit -m 'hello
  world'`)
  2) command is not already matched by an existing rule

  zhao-oai · 2025-12-03 23:17:02 -08:00
  e925a380dc
• Migrate model family to models manager (#7565)

  This PR moves `ModelsFamily` to `openai_models`. It also propagates
  `ModelsManager` to session services and use it to drive model family. We
  also make `derive_default_model_family` private because it's a step
  towards what we want: one place that gives model configuration.
  
  This is a second step at having one source of truth for models
  information and config: `ModelsManager`.
  
  Next steps would be to remove `ModelsFamily` from config. That's massive
  because it's being used in 41 occasions mostly pre launching `codex`.
  Also, we need to make `find_family_for_model` private. It's also big
  because it's being used in 21 occasions ~ all tests.

  Ahmed Ibrahim · 2025-12-03 18:49:47 -08:00
  cee37a32b2
• Introduce ModelsManager and migrate app-server to use it. (#7552)
  Ahmed Ibrahim · 2025-12-03 17:17:56 -08:00
  00cc00ead8
• fix: Features should be immutable over the lifetime of a session/thread (#7540)

  I noticed that `features: Features` was defined on `struct
  SessionConfiguration`, which is commonly owned by `SessionState`, which
  is in turn owned by `Session`.
  
  Though I do not believe that `Features` should be allowed to be modified
  over the course of a session (if the feature state is not invariant, it
  makes it harder to reason about), which argues that it should live on
  `Session` rather than `SessionState` or `SessionConfiguration`.
  
  This PR moves `Features` to `Session` and updates all call sites. It
  appears the only place we were mutating `Features` was:
  
  - in tests
  - the sub-agent config for a review task:
  
  
  https://github.com/openai/codex/blob/3ef76ff29d5eed258fb6b8550e0e2b973d0dca21/codex-rs/core/src/tasks/review.rs#L86-L89
  
  Note this change also means it is no longer an `async` call to check the
  state of a feature, eliminating the possibility of a
  [TOCTTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use)
  error between checking the state of a feature and acting on it:
  
  
  https://github.com/openai/codex/blob/3ef76ff29d5eed258fb6b8550e0e2b973d0dca21/codex-rs/core/src/codex.rs#L1069-L1076

  Michael Bolin · 2025-12-03 16:12:31 -08:00
  1cfc967eb8
• Migrate model preset (#7542)

  - Introduce `openai_models` in `/core`
  - Move `PRESETS` under it
  - Move `ModelPreset`, `ModelUpgrade`, `ReasoningEffortPreset`,
  `ReasoningEffortPreset`, and `ReasoningEffortPreset` to `protocol`
  - Introduce `Op::ListModels` and `EventMsg::AvailableModels`
  
  Next steps:
  - migrate `app-server` and `tui` to use the introduced Operation

  Ahmed Ibrahim · 2025-12-03 20:30:43 +00:00
  71504325d3
• feat: support list mcp servers in app server (#7505)

  ### Summary
  Added `mcp/servers/list` which is equivalent to `/mcp` slash command in
  CLI for response. This will be used in VSCE MCP settings to show log in
  status, available tools etc.

  Shijie Rao · 2025-12-03 09:51:46 -08:00
  4785344c9c
• feat: retroactive image placeholder to prevent poisoning (#6774)

  If an image can't be read by the API, it will poison the entire history,
  preventing any new turn on the conversation.
  This detect such cases and replace the image by a placeholder

  jif-oai · 2025-12-03 11:35:56 +00:00
  51307eaf07
• persisting credits if new snapshot does not contain credit info (#7490)

  in response to incoming changes to responses headers where the header
  may sometimes not contain credits info (no longer forcing a credit
  check)

  zhao-oai · 2025-12-02 16:23:24 -05:00
  5ebdc9af1b
• Use non-blocking mutex (#7467)
  Ahmed Ibrahim · 2025-12-02 10:50:46 -08:00
  21ad1c1c90
• feat: add warning message for the model (#7445)

  Add a warning message as a user turn to the model if the model does not
  behave as expected (here, for example, if the model opens too many
  `unified_exec` sessions)

  jif-oai · 2025-12-02 11:56:00 +00:00
  9ee855ec57
• chore: review everywhere (#7444)
  jif-oai · 2025-12-02 11:26:27 +00:00
  4b78e2ab09
• feat: detached review (#7292)
  jif-oai · 2025-11-28 11:34:57 +00:00
  aaec8abf58