codex

Add WebRTC transport to realtime start (#16960 )

Adds WebRTC startup to the experimental app-server
`thread/realtime/start` method with an optional transport enum. The
websocket path remains the default; WebRTC offers create the realtime
session through the shared start flow and emit the answer SDP via
`thread/realtime/sdp`.

---------

Co-authored-by: Codex <noreply@openai.com>

Ahmed Ibrahim · 2026-04-07 15:43:38 -07:00

fb3dcfde1d

fix(app-server) revert null instructions changes (#17047 )

Dylan Hurd · 2026-04-07 15:18:34 -07:00

6c36e7d688

[app-server-protocol] introduce generic ServerResponse for app-server-protocol (#17044 )

- introduces `ServerResponse` as the symmetrical typed response union to
`ServerRequest` for app-server-protocol
- enables scalable event stream ingestion for use cases such as
analytics, particularly for tools/approvals
- no runtime behavior changes, protocol/schema plumbing only
- mirrors #15921

rhan-oai · 2026-04-07 14:50:27 -07:00

f480b98984

[codex] Migrate apply_patch to executor filesystem (#17027 )

- Migrate apply-patch verification and application internals to use the
async `ExecutorFileSystem` abstraction from `exec-server`.
- Convert apply-patch `cwd` handling to `AbsolutePathBuf` through the
verifier/parser/handler boundary.

Doesn't change how the tool itself works.

pakrym-oai · 2026-04-07 21:20:22 +00:00

e9702411ab

fix(core) revert Command line in unified exec output (#17031 )

## Summary
https://github.com/openai/codex/pull/13860 changed the serialized output
format of Unified Exec. This PR reverts those changes and some related
test changes

## Testing
- [x] Update tests

---------

Co-authored-by: Codex <noreply@openai.com>

Dylan Hurd · 2026-04-07 13:35:40 -07:00

d45513ce5a

[codex] Fix unified exec test build (#17032 )

## Summary
- Remove the stale `?` after `AbsolutePathBuf::join` in the unified exec
integration test helper.

## Root Cause
- `AbsolutePathBuf::join` was made infallible, but
`core/tests/suite/unified_exec.rs` still treated it as a `Result`, which
broke the Windows test build for the `all` integration test target.

## Validation
- `just fmt`
- `cargo test -p codex-core --test all
unified_exec_resolves_relative_workdir`

pakrym-oai · 2026-04-07 12:01:06 -07:00

8614f92fc4

app-server: Allow enabling remote control in runtime (#16973 )

Refresh the feature flag on writes to the config.

Ruslan Nigmatullin · 2026-04-07 11:36:17 -07:00

59af4a730c

Add full-ci branch trigger (#16980 )

Allow branches to trigger full ci (helpful to run remote tests)

pakrym-oai · 2026-04-07 11:33:35 -07:00

470b3592e6

app-server: Move watch_id to request of fs/watch (#17026 )

It's easier for clients to maintain watchers if they define the watch
id, so move it into the request.
It's not used yet, so should be a safe change.

Ruslan Nigmatullin · 2026-04-07 11:22:28 -07:00

8a13f82204

[mcp] Support MCP Apps part 2 - Add meta to mcp tool call result. (#16465 )

- [x] Add meta to mcp tool call result.

Matthew Zeng · 2026-04-07 11:10:21 -07:00

252d79f5eb

[codex] Make unified exec tests remote aware (#16977 )

## Summary
- Convert unified exec integration tests that can run against the remote
executor to use the remote-aware test harness.
- Create workspace directories through the executor filesystem for
remote runs.
- Install `python3` and `zsh` in the remote test container so restored
Python/zsh-based test commands work in fresh Ubuntu containers.

## Validation
- `just fmt`
- `cargo test -p codex-core --test all unified_exec_defaults_to_pipe`
- `cargo test -p codex-core --test all unified_exec_can_enable_tty`
- `cargo test -p codex-core --test all unified_exec`
- Remote on `codex-remote`: `source scripts/test-remote-env.sh && cd
codex-rs && cargo test -p codex-core --test all unified_exec`
- `just fix -p codex-core`

pakrym-oai · 2026-04-07 10:56:08 -07:00

365154d5da

Update README (#16348 )

Rename ChatGPT Team to ChatGPT Business as the correct plan name in the
README.

Romain Huet · 2026-04-07 10:55:58 -07:00

b525b5a3a7

[codex] Make AbsolutePathBuf joins infallible (#16981 )

Having to check for errors every time join is called is painful and
unnecessary.

pakrym-oai · 2026-04-07 10:52:08 -07:00

f1a2b920f9

fix(guardian): don't throw away transcript when over budget (#16956 )

## Description

This PR changes guardian transcript compaction so oversized
conversations no longer collapse into a nearly empty placeholder.

Before this change, if the retained user history alone exceeded the
message budget, guardian would replace the entire transcript with
`<transcript omitted to preserve budget for planned action>`!

That meant approvals, especially network approvals, could lose the
recent tool call and tool result that explained what guardian was
actually reviewing. Now we keep a compact but usable transcript instead
of dropping it all.

### Before
```
The following is the Codex agent history whose request action you are assessing...
>>> TRANSCRIPT START
<transcript omitted to preserve budget for planned action>
>>> TRANSCRIPT END

Conversation transcript omitted due to size.

The Codex agent has requested the following action:
>>> APPROVAL REQUEST START
Retry reason:
Sandbox blocked outbound network access.

Assess the exact planned action below. Use read-only tool checks when local state matters.
Planned action JSON:
{
  "tool": "network_access",
  "target": "https://example.com:443",
  "host": "example.com",
  "protocol": "https",
  "port": 443
}
>>> APPROVAL REQUEST END
```

### After
```
The following is the Codex agent history whose request action you are assessing...
>>> TRANSCRIPT START
[1] user: Please investigate why uploads to example.com are failing and retry if needed.
[8] user: If the request looks correct, go ahead and try again with network access.
[9] tool shell call: {"command":["curl","-X","POST","https://example.com/upload"],"cwd":"/repo"}
[10] tool shell result: sandbox blocked outbound network access
>>> TRANSCRIPT END

Some conversation entries were omitted.

The Codex agent has requested the following action:
>>> APPROVAL REQUEST START
Retry reason:
Sandbox blocked outbound network access.

Assess the exact planned action below. Use read-only tool checks when local state matters.
Planned action JSON:
{
  "tool": "network_access",
  "target": "https://example.com:443",
  "host": "example.com",
  "protocol": "https",
  "port": 443
}
>>> APPROVAL REQUEST END
```

Owen Lin · 2026-04-07 10:19:16 -07:00

0b9e42f6f7

feat(analytics): generate an installation_id and pass it in responsesapi client_metadata (#16912 )

## Summary

This adds a stable Codex installation ID and includes it on Responses
API requests via `x-codex-installation-id` passed in via the
`client_metadata` field for analytics/debugging.

The main pieces are:
- persist a UUID in `$CODEX_HOME/installation_id`
- thread the installation ID into `ModelClient`
- send it in `client_metadata` on Responses requests so it works
consistently across HTTP and WebSocket transports

Owen Lin · 2026-04-07 09:52:17 -07:00

5d1671ca70

Fix missing resume hint on zero-token exits (#16987 )

Addresses #16421

Problem: Resumed interactive sessions exited before new token usage
skipped all footer lines, hiding the `codex resume` continuation
command.

It's not clear whether this was an intentional design choice, but I
think it's reasonable to expect this message under these circumstances.

Solution: Compose token usage and resume hints independently so
resumable sessions still print the continuation command with zero usage.

Eric Traut · 2026-04-07 09:34:04 -07:00

2b9bf5d3d4

Preserve null developer instructions (#16976 )

Preserve explicit null developer-instruction overrides across app-server
resume and fork flows.

Ahmed Ibrahim · 2026-04-07 09:32:14 -07:00

cd591dc457

Fix nested exec thread ID restore (#16882 )

Addresses #15527

Problem: Nested `codex exec` commands could source a shell snapshot that
re-exported the parent `CODEX_THREAD_ID`, so commands inside the nested
session were attributed to the wrong thread.

Solution: Reapply the live command env's `CODEX_THREAD_ID` after
sourcing the snapshot.

Eric Traut · 2026-04-07 09:26:22 -07:00

feb4f0051a

Fix read-only apply_patch rejection message (#16885 )

Addresses #15532

Problem: Nested read-only `apply_patch` rejections report in-project
files as outside the project.

Solution: Choose the rejection message based on sandbox mode so
read-only sessions report a read-only-specific reason, and add focused
safety coverage.

Eric Traut · 2026-04-07 09:25:39 -07:00

82506527f1

Stabilize flaky multi-agent followup interrupt test (#16739 )

Problem: The multi-agent followup interrupt test polled history before
interrupt cleanup and mailbox wakeup were guaranteed to settle, which
made it flaky under CI scheduling variance.

Solution: Wait for the child turn's `TurnAborted(Interrupted)` event
before asserting that the redirected assistant envelope is recorded and
no plain user message is left behind.

Eric Traut · 2026-04-07 09:24:14 -07:00

3b32de4fab

chore: keep request_user_input tool to persist cache on multi-agents (#17009 )

jif-oai · 2026-04-07 16:53:31 +01:00

4cc6818996

[codex] reduce module visibility (#16978 )

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

pakrym-oai · 2026-04-07 08:03:35 -07:00

413c1e1fdf

feat: /feedback cascade (#16442 )

Example here:
https://openai.sentry.io/issues/7380240430/?project=4510195390611458&query=019d498f-bec4-7ba2-96d2-612b1e4507df&referrer=issue-stream

jif-oai · 2026-04-07 12:47:37 +01:00

89f1a44afa

chore: hide nickname for debug flag (#17007 )

jif-oai · 2026-04-07 11:31:13 +01:00

99f167e6bf

chore: send_message and followup_task do not return anything (#17008 )

jif-oai · 2026-04-07 11:26:36 +01:00

68e16baabe

feat: drop agent ID from v2 (#17005 )

jif-oai · 2026-04-07 10:56:01 +01:00

2a8c3a2a52

chore: debug flag to hide some parameters (#17002 )

jif-oai · 2026-04-07 10:42:19 +01:00

e2bb45bb24

feat: empty role ok (#16999 )

jif-oai · 2026-04-07 10:34:08 +01:00

51f75e2f56

[codex] ez - rename env=>request in codex-rs/core/src/unified_exec/process_manager.rs (#16724 )

# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.

starr-openai · 2026-04-07 10:17:31 +01:00

741e2fdeb8

collapse dev message into one (#16988 )

collapse image-gen dev message into one

Won Park · 2026-04-06 23:49:47 -07:00

90320fc51a

Honor null thread instructions (#16964 )

- Treat explicit null thread instructions as a blank-slate override
while preserving omitted-field fallback behavior.
- Preserve null through rollout resume/fork and keep explicit empty
strings distinct.
- Add app-server v2 start/fork coverage for the tri-state instruction
params.

Ahmed Ibrahim · 2026-04-07 04:10:19 +00:00

24c598e8a9

Make AGENTS.md discovery FS-aware (#15826 )

## Summary
- make AGENTS.md discovery and loading fully FS-aware and remove the
non-FS discover helper
- migrate remote-aware codex-core tests to use TestEnv workspace setup
instead of syncing a local workspace copy
- add AGENTS.md corner-case coverage, including directory fallbacks and
remote-aware integration coverage

## Testing
- cargo test -p codex-core project_doc -- --nocapture
- cargo test -p codex-core hierarchical_agents -- --nocapture
- cargo test -p codex-core agents_md -- --nocapture
- cargo test -p codex-tui status -- --nocapture
- cargo test -p codex-tui-app-server status -- --nocapture
- just fix
- just fmt
- just bazel-lock-update
- just bazel-lock-check
- just argument-comment-lint
- remote Linux executor tests in progress via scripts/test-remote-env.sh

pakrym-oai · 2026-04-06 20:26:21 -07:00

4bb507d2c4

app-server: Fix compilation of a test in mcp_resource (#16972 )

Ruslan Nigmatullin · 2026-04-06 20:17:08 -07:00

232db0613a

[codex] Add danger-full-access denylist-only network mode (#16946 )

## Summary

This adds `experimental_network.danger_full_access_denylist_only` for
orgs that want yolo / danger-full-access sessions to keep full network
access while still enforcing centrally managed deny rules.

When the flag is true and the session sandbox is `danger-full-access`,
the network proxy starts with:

- domain allowlist set to `*`
- managed domain `deny` entries enforced
- upstream proxy use allowed
- all Unix sockets allowed
- local/private binding allowed

Caveat: the denylist is best effort only. In yolo / danger-full-access
mode, Codex or the model can use an allowed socket or other
local/private network path to bypass the proxy denylist, so this should
not be treated as a hard security boundary.

The flag is intentionally scoped to `SandboxPolicy::DangerFullAccess`.
Read-only and workspace-write modes keep the existing managed/user
allowlist, denylist, Unix socket, and local-binding behavior. This does
not enable the non-loopback proxy listener setting; that still requires
its own explicit config.

This also threads the new field through config requirements parsing,
app-server protocol/schema output, config API mapping, and the TUI debug
config output.

## How to use

Add the flag under `[experimental_network]` in the network policy config
that is delivered to Codex. The setting is not under `[permissions]`.

```toml
[experimental_network]
enabled = true
danger_full_access_denylist_only = true

[experimental_network.domains]
"blocked.example.com" = "deny"
"*.blocked.example.com" = "deny"
```

With that configuration, yolo / danger-full-access sessions get broad
network access except for the managed denied domains above. The denylist
remains a best-effort proxy policy because the session may still use
allowed sockets to bypass it. Other sandbox modes do not get the
wildcard domain allowlist or the socket/local-binding relaxations from
this flag.

## Verification

- `cargo test -p codex-config network_requirements`
- `cargo test -p codex-core network_proxy_spec`
- `cargo test -p codex-app-server map_requirements_toml_to_api`
- `cargo test -p codex-tui debug_config_output`
- `cargo test -p codex-app-server-protocol`
- `just write-app-server-schema`
- `just fmt`
- `just fix -p codex-config -p codex-core -p codex-app-server-protocol
-p codex-app-server -p codex-tui`
- `just fix -p codex-core -p codex-config`
- `git diff --check`
- `cargo clean`

viyatb-oai · 2026-04-06 19:38:51 -07:00

9d13d29acd

fix: warn when bwrap cannot create user namespaces (#15893 )

## Summary
- add a Linux startup warning when system `bwrap` is present but cannot
create user namespaces
- keep the Linux-specific probe, sandbox-policy gate, and stderr
matching in `codex-sandboxing`
- polish the missing-`bwrap` warning to point users at the sandbox
prerequisites and OS package-manager install path

## Details
- probes system `bwrap` with `--unshare-user`, `--unshare-net`, and a
minimal bind before command execution
- detects known bubblewrap setup failures for `RTM_NEWADDR`,
`RTM_NEWLINK`, uid-map permission denial, and `No permissions to create
a new namespace`
- preserves the existing suppression for sandbox-bypassed policies such
as `danger-full-access` and `external-sandbox`
- updates the Linux sandbox docs to call out the user-namespace
requirement

---------

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai · 2026-04-06 19:19:35 -07:00

806e5f7c69

[mcp] Support MCP Apps part 1. (#16082 )

- [x] Add `mcpResource/read` method to read mcp resource.

Matthew Zeng · 2026-04-06 19:17:14 -07:00

5fe9ef06ce

Validate exec input before starting app-server (#16890 )

Addresses #16443

This was a regression introduced when we moved exec on top of the app
server APIs.

Problem: codex exec resolved prompt/stdin and output schema after
starting the in-process app-server, so early `process::exit(1)` paths
could bypass session shutdown.

Solution: Resolve prompt/stdin and output schema before app-server
startup so validation failures happen before any exec session is
created.

Eric Traut · 2026-04-06 18:13:05 -07:00

ee12772e80

app-server: Unify config changes handling a bit (#16961 )

Ruslan Nigmatullin · 2026-04-06 18:04:00 -07:00

b34a3a6e92

Add setTimeout support to code mode (#16153 )

The implementation is less than ideal - it starts a thread per timer. A
better approach might be to switch to tokio and use their timer
imlementation.

pakrym-oai · 2026-04-06 17:46:28 -07:00

0de7662dab

Refactor config types into a separate crate (#16962 )

Move config types into a separate crate because their macros expand into
a lot of new code.

pakrym-oai · 2026-04-07 00:32:41 +00:00

1f2411629f

Promote image_detail_original to experimental (#16957 )

Curtis 'Fjord' Hawthorne · 2026-04-06 17:25:16 -07:00

d2df7c54b2

Disable env-bound tools when exec server is none (#16349 )

## Summary
- make `CODEX_EXEC_SERVER_URL=none` map to an explicit disabled
environment mode instead of inferring from a missing URL
- expose environment capabilities (`exec_enabled`, `filesystem_enabled`)
so tool building can gate behavior explicitly and future
multi-environment work has a clearer seam
- suppress env-backed tools when the relevant capability is unavailable,
including exec tools, `js_repl`, `apply_patch`, `list_dir`, and
`view_image`
- keep handler/runtime backstops so disabled environments still reject
execution if a tool path somehow bypasses registration

## Testing
- `just fmt`
- `cargo test -p codex-exec-server`
- `cargo test -p codex-tools
disabled_environment_omits_environment_backed_tools`
- `cargo test -p codex-tools
environment_capabilities_gate_exec_and_filesystem_tools_independently`
- remote devbox Bazel build via `codex-applied-devbox`:
`//codex-rs/cli:cli`

starr-openai · 2026-04-06 17:22:06 -07:00

a504d8f0fa

Speed up /mcp inventory listing (#16831 )

Addresses #16244

This was a performance regression introduced when we moved the TUI on
top of the app server API.

Problem: `/mcp` rebuilt a full MCP inventory through
`mcpServerStatus/list`, including resources and resource templates that
made the TUI wait on slow inventory probes.

Solution: add a lightweight `detail` mode to `mcpServerStatus/list`,
have `/mcp` request tools-and-auth only, and cover the fast path with
app-server and TUI tests.

Testing: Confirmed slow (multi-second) response prior to change and
immediate response after change.

I considered two options:
1. Change the existing `mcpServerStatus/list` API to accept an optional
"details" parameter so callers can request only a subset of the
information.
2. Add a separate `mcpServer/list` API that returns only the servers,
tools, and auth but omits the resources.

I chose option 1, but option 2 is also a reasonable approach.

Eric Traut · 2026-04-06 16:27:02 -07:00

9f737c28dd

[codex-analytics] add protocol-native turn timestamps (#16638 )

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/16638).
* #16870
* #16706
* #16659
* #16641
* #16640
* __->__ #16638

rhan-oai · 2026-04-06 16:22:59 -07:00

756c45ec61

tui: route device-code auth through app server (#16827 )

Addresses #7646
Also enables device code auth for remote TUI sessions

Problem: TUI onboarding handled device-code login directly rather than
using the recently-added app server support for device auth. Also, auth
screens kept animating while users needed to copy login details.

Solution: Route device-code onboarding through app-server login APIs and
make the auth screens static while those copy-oriented flows are
visible.

Eric Traut · 2026-04-06 15:47:26 -07:00

e88c2cf4d7

Respect residency requirements in mcp-server (#16952 )

Addresses #16951

Problem: codex mcp-server did not apply the configured residency
requirement, so requests from non-US regions could miss the `residency`
header and fail with a 401.

Solution: Set the default client residency requirement after loading
config in the MCP server startup path, matching the existing exec and
TUI behavior.

Eric Traut · 2026-04-06 15:46:55 -07:00

54faa76960

feat: refresh non-curated cache from plugin list. (#16191 )

1. Use versions for non-curated plugin (defined in plugin.json) for
cache refresh
2. Trigger refresh from plugin/list roots

xl-openai · 2026-04-06 15:40:00 -07:00

e62d645e67

feat: fallback curated plugin download from backend endpint. (#16947 )

Add one more fallback for downloading the curated plugin repo from
chatgpt.com.

Have to be the last fallback for now as it is a lagging backup.

xl-openai · 2026-04-06 15:36:20 -07:00

03edd4fbee

[codex] Allow PyTorch libomp shm in Seatbelt (#16945 )

## Summary
- Add a targeted macOS Seatbelt allow rule for PyTorch/libomp KMP
registration shared-memory objects.
- Scope the rule to read/create/unlink operations on names matching
`^/__KMP_REGISTERED_LIB_[0-9]+$`.
- Add a base-policy regression assertion in `seatbelt_tests.rs`.

## Why
Importing PyTorch on macOS under the Codex sandbox can abort when libomp
attempts to create the KMP registration POSIX shm object and Seatbelt
denies `ipc-posix-shm-write-create`.

## Validation
- `just fmt`
- `cargo test -p codex-sandboxing`
- `cargo clippy -p codex-sandboxing --all-targets`
- `just argument-comment-lint`
- `git diff --check`
- End-to-end PyTorch import under `codex sandbox macos` exited `0` with
no KMP shm denial
- `cargo clean`

viyatb-oai · 2026-04-06 22:12:30 +00:00

36cd163504

app-server: Add transport for remote control (#15951 )

Ruslan Nigmatullin · 2026-04-06 14:55:59 -07:00

73dab2046f

5160 Commits