3657 Commits

• Add Guardian catalog diagnostics metadata (#27109)

  ## Why
  
  We need request-level evidence for Guardian cases where
  `codex-auto-review` is missing from the client-side model catalog and
  the review falls back to the parent model.
  
  ## What changed
  
  - Add `guardian_catalog_contains_auto_review` to Guardian Responses API
  client metadata.
  - Add `guardian_model_provider_id` to Guardian Responses API client
  metadata.
  - Keep review-session metadata optional so callers without metadata
  preserve the existing `None` path.
  - Add tests for override, normal preferred-model, and
  missing-auto-review-catalog behavior.
  
  ## Validation
  
  - `just test -p codex-core
  guardian_review_records_missing_auto_review_model_in_request_metadata`
  - `just test -p codex-core
  guardian_review_uses_model_catalog_override_when_preferred_review_model_exists`
  - `just test -p codex-core
  guardian_review_uses_preferred_review_model_without_model_catalog_override`
  - `git diff --check origin/main`

  Won Park · 2026-06-12 15:50:30 -07:00
  0605f9c14f
• [codex] add roles to realtime append text (#27936)

  ## Summary
  
  Add an explicit `user` or `developer` role to
  `thread/realtime/appendText` and propagate it through the realtime input
  queue into `conversation.item.create`. Older JSON clients that omit the
  field continue to default to `user`.
  
  This lets app-provided context such as memory retain developer authority
  without bypassing app-server through a renderer-owned data channel. The
  app-server schemas, API documentation, and focused protocol and
  websocket coverage are updated with the new contract.
  
  The Codex Apps consumer is tracked in
  [openai/openai#1025261](https://github.com/openai/openai/pull/1025261).

  Alex Gamble · 2026-06-12 15:05:37 -07:00
  216dee1189
• feat: use encrypted local secrets for MCP OAuth (#27541)

  ## Summary
  
  - store MCP OAuth credentials in the configured auth credential backend
  - support encrypted-local OAuth storage, including legacy keyring
  migration
  - propagate the credential backend through MCP refresh, session, CLI,
  and app-server paths
  
  ## Stack
  
  1. #27504 — config and feature flag
  2. #27535 — auth-specific secret namespaces
  3. #27539 — encrypted CLI auth storage
  4. this PR — encrypted MCP OAuth storage
  
  This is a parallel review stack; the original #17931 remains unchanged.
  
  ## Tests
  
  - `just test -p codex-rmcp-client` (the transport round-trip test passed
  after building the required `codex` binary and retrying)
  - `just test -p codex-mcp`
  - `just test -p codex-app-server
  refresh_config_uses_latest_auth_keyring_backend`
  - `just test -p codex-core
  refresh_mcp_servers_is_deferred_until_next_turn`
  - `just test -p codex-cli mcp`
  - `just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli
  -p codex-app-server -p codex-protocol`
  - `just bazel-lock-check`

  Celia Chen · 2026-06-12 22:03:51 +00:00
  9915d34684
• feat: use encrypted local secrets for CLI auth (#27539)

  ## Why
  
  Windows Credential Manager limits generic credential blobs to 2,560
  bytes. Large serialized ChatGPT auth payloads can exceed that limit, so
  keyring-mode CLI auth needs a backend that keeps only the encryption key
  in the OS keyring and stores the payload in Codex's encrypted
  local-secrets file.
  
  This is the third PR in the encrypted-auth stack:
  
  1. #27504 — feature and config selection
  2. #27535 — auth-specific local-secrets namespaces
  3. This PR — CLI auth implementation and activation
  4. MCP OAuth implementation and activation
  
  ## What Changed
  
  - Added encrypted CLI-auth storage using the `CliAuth` secrets
  namespace.
  - Preserved direct keyring storage for platforms/configurations where it
  remains selected.
  - Selected the backend consistently for login, logout, refresh,
  device-code login, auth loading, and login restrictions.
  - Threaded resolved bootstrap/full config through CLI, exec, TUI,
  app-server account handling, cloud config, and cloud tasks.
  - Removed stale `auth.json` fallback data after successful encrypted
  saves and removed encrypted, direct-keyring, and fallback data during
  logout.
  - Added storage and integration coverage for both direct and encrypted
  keyring modes.
  
  MCP OAuth persistence is intentionally left to the next PR.
  
  ## Validation
  
  - `just test -p codex-login` — 131 passed
  - `just test -p codex-cli` — 280 passed
  - `just test -p codex-app-server v2::account` — 25 passed
  - `just test -p codex-cloud-config service` — 21 passed, 7 skipped
  - `just fix -p codex-login`
  - `just fix -p codex-cli`
  - `just fmt`

  Celia Chen · 2026-06-12 21:23:50 +00:00
  56c97e3b5c
• Support plaintext agent messages (#27830)

  ## Why
  
  Multi-agent v2 `send_message` deliveries already reach the receiving
  model as typed `agent_message` items with encrypted content.
  Child-completion notifications are generated by Codex itself, so their
  content is plaintext and previously fell back to a serialized JSON
  envelope inside an assistant message.
  
  With plaintext `input_text` supported for `agent_message`, both delivery
  paths can use the same model-visible type while preserving explicit
  author and recipient metadata.
  
  ## What changed
  
  - add plaintext `input_text` support to `AgentMessageInputContent` and
  regenerate the affected app-server schemas
  - preserve `InterAgentCommunication` as structured mailbox input instead
  of converting it to assistant text
  - record delivered communications as typed `agent_message` history items
  - persist a dedicated rollout item so local delivery metadata such as
  `trigger_turn` remains available without leaking into the Responses
  request
  - reconstruct typed agent messages on resume and preserve fork-turn
  truncation behavior
  - remove request-time assistant-content parsing
  - preserve plaintext and encrypted inter-agent deliveries in stage-one
  memory inputs
  - normalize and link plaintext and encrypted agent messages in rollout
  traces without treating inbound messages as child results
  - cover the real MultiAgent V2 child-completion path end to end with
  deterministic mailbox synchronization
  
  ## Verification
  
  - `just test -p codex-core
  plaintext_multi_agent_v2_completion_sends_agent_message`
  - `just test -p codex-core input_queue_drains_mailbox_in_delivery_order
  record_initial_history_reconstructs_typed_inter_agent_message
  fork_turn_positions_use_inter_agent_delivery_metadata`
  - `just test -p codex-memories-write
  serializes_inter_agent_communications_for_memory`
  - `just test -p codex-rollout-trace
  agent_messages_preserve_routing_and_content
  sub_agent_started_activity_creates_spawn_edge`
  - `just test -p codex-rollout-trace
  agent_result_edge_falls_back_to_child_thread_without_result_message`
  - `just test -p codex-protocol -p codex-rollout -p
  codex-app-server-protocol`

  jif · 2026-06-12 13:50:04 -07:00
  8f2d6416ce
• fix(plugins) rm plugin descriptions (#23254)

  ## Summary
  Removes Plugin descriptions from the dev message, since descriptions of
  skills and MCPs cover the capabilities offered by the plugin.
  
  ## Testing
  - [x] Updates unit tests

  Dylan Hurd · 2026-06-12 13:31:11 -07:00
  3e2ee1da3f
• feat: add secret auth storage configuration (#27504)

  ## Why
  
  Windows Credential Manager limits generic credential blobs to 2,560
  bytes. The encrypted local secrets backend avoids storing large
  serialized auth payloads directly in the OS keyring, but selecting that
  backend needs an independently reviewable feature/config layer before
  the auth and secrets implementation is wired in.
  
  ## What Changed
  
  - Added the stable `secret_auth_storage` feature, enabled by default on
  Windows and disabled by default elsewhere.
  - Added `AuthKeyringBackendKind` and config resolution for full and
  bootstrap config loading.
  - Applied managed feature requirements when resolving the bootstrap auth
  backend.
  - Updated the generated config schema and added focused tests.
  
  This is the base PR for #17931. The auth, secrets, MCP, CLI, TUI, and
  app-server implementation remains in that follow-up PR.
  
  ## Validation
  
  - `just test -p codex-features`
  - `just test -p codex-config`
  - `just test -p codex-core
  resolve_bootstrap_auth_keyring_backend_kind_uses_secret_auth_storage_feature`
  - `just write-config-schema`
  - `just fix -p codex-core`
  
  The full `just test -p codex-core` run compiled successfully and ran
  2,690 tests; 2,589 passed, one was flaky, and 101 environment-sensitive
  tests failed because this shell injects a `pyenv` rehash warning into
  command output or because sandboxed subprocesses timed out.

  Celia Chen · 2026-06-12 19:15:21 +00:00
  b724f5966e
• Handle standalone image generation failures as terminal items (#27920)

  ## Why
  
  Standalone image generation emitted a started item but no terminal item
  when the backend failed. Clients could leave the operation unresolved or
  render it as successful.
  
  ## What changed
  
  - Emit a terminal image-generation item with `status: "failed"` when
  generation or editing fails.
  - Skip image persistence for failed terminal items.
  - Render failed image generation distinctly in TUI history.
  - Preserve the status when handling live and replayed terminal items.
  
  ## Looks for TUI, App-Side change needed 
  
  <img width="867" height="89" alt="image"
  src="https://github.com/user-attachments/assets/9e32342f-a982-411e-8498-456639fc468a"
  />
  
  ## Validation
  
  - `just test -p codex-image-generation-extension`
  - App-server image-generation tests
  - Core stream-event tests
  - TUI image-generation lifecycle and snapshot tests
  - Scoped Clippy and formatting

  Won Park · 2026-06-12 11:57:22 -07:00
  b6baa77eec
• sandboxing: migrate cwd inputs to PathUri (#27816)

  ## Why
  
  Sandbox cwd values can cross app-server and exec-server host boundaries.
  They should retain URI semantics until the receiving host validates them
  instead of being interpreted early as native paths.
  
  ## What
  
  - Carry `PathUri` through filesystem sandbox contexts, sandbox commands,
  and transform inputs.
  - Convert command and policy cwd once in `SandboxManager::transform`,
  then keep launch requests native.
  - Preserve sandbox cwd over remote filesystem transport and reject
  non-native URIs without fallback.
  - Cache paired native/URI turn-environment cwd values during migration,
  with immutable access to keep them synchronized.
  - Extend existing protocol, forwarding, transform, and core runtime
  tests.

  Adam Perry @ OpenAI · 2026-06-12 11:38:01 -07:00
  52a50aec70
• chore: prompt MAv2 (#27919)

  Prompt update of MAv2

  jif · 2026-06-12 20:17:12 +02:00
  84520225b9
• realtime: add AVAS architecture override (#27720)

  ## Summary
  
  Adds a `RealtimeConversationArchitecture` option for realtime
  conversation startup, with `realtimeapi` as the default and `avas` as an
  opt-in architecture.
  
  The AVAS path is limited to realtime v1 conversational WebRTC starts,
  and WebRTC call creation appends `intent=quicksilver&architecture=avas`
  to `/v1/realtime/calls`. The existing sideband websocket still joins by
  `call_id`.
  
  This also exposes the per-session architecture override through
  app-server v2 `thread/realtime/start` params and updates the config
  schema for `[realtime].architecture`.
  
  ## Validation
  
  - `just fmt`
  - `just write-config-schema`
  - `just test -p codex-api sends_avas_session_call_query_params`
  - `just test -p codex-core -E
  'test(~conversation_webrtc_start_uses_avas_architecture_query)'`
  - `just test -p codex-core -E 'test(realtime_loads_from_config_toml)'`
  - `just test -p codex-app-server-protocol -E
  'test(~serialize_thread_realtime_start) |
  test(generated_ts_optional_nullable_fields_only_in_params)'`
  - `just test -p codex-app-server -E
  'test(realtime_webrtc_start_emits_sdp_notification)'`

  Peter Bakkum · 2026-06-12 18:11:13 +00:00
  6652e82dd0
• [ez][codex-rs] Support approvals reviewer in app defaults (#27075)

  [from codex]
  
  ## Summary
  
  - add `approvals_reviewer` support to `[apps._default]`
  - resolve connected-app reviewers in per-app, app-default, then global
  order
  - expose the setting through the v2 config API and regenerate schema
  fixtures
  
  ## Context
  
  PR #25167 added `apps.<connector_id>.approvals_reviewer`, but the shared
  app defaults table could not specify the reviewer. This extends the same
  behavior to `[apps._default]` while preserving per-app overrides.
  
  Managed `allowed_approvals_reviewers` requirements still constrain both
  default and per-app values. A disallowed app value falls back to the
  global reviewer, and non-app MCP servers continue using the global
  reviewer.
  
  ## Testing
  
  - `just write-config-schema`
  - `just write-app-server-schema`
  - `just fmt`
  - `just test -p codex-config`
  - `just test -p codex-core app_approvals_reviewer`
  - `just test -p codex-app-server-protocol`
  - `just test -p codex-app-server config_read_includes_apps`

  Alex Zamoshchin · 2026-06-12 09:06:58 -07:00
  3cac2e0d3f
• [code-mode] Reject remote image URLs from output helpers (#27732)

  ## Summary
  
  - reject HTTP(S) image URLs from the shared code-mode output-image
  normalization path
  - return a concise model-visible tool error so the model can recover on
  its next turn
  - apply the targeted rejection to both `image()` and `generatedImage()`
  - leave other non-empty image URL values to existing downstream handling
  
  The returned error is:
  
  > Tool call failed: remote image URLs are not supported in tool outputs.
  Pass a base64 data URI instead
  
  ## Why
  
  Responses Lite cannot lower a remote image URL emitted from a structured
  tool output. Rejecting HTTP(S) values in the Codex harness preserves the
  tool-call metadata and gives the model a recoverable next turn instead
  of invalidating the sample.
  
  ## Test coverage
  
  The regression is covered primarily by a `test_codex()` agent
  integration test that simulates the Responses API exchange and asserts
  the failed model-visible exec output. A supplemental runtime test covers
  both `http://` and `https://` inputs across both image output helpers.
  
  ## Test plan
  
  - `cd codex-rs && just test -p codex-code-mode`
  - `cd codex-rs && just test -p codex-code-mode-protocol`
  - `cd codex-rs && just test -p codex-core
  code_mode_image_helper_rejects_remote_url`
  - `cd codex-rs && just fmt`
  - `git diff --check origin/main...HEAD`
  
  Related context: https://github.com/openai/openai/pull/1022346

  rka-oai · 2026-06-12 02:49:17 -07:00
  c09df9e353
• Make MCP server contributions thread-scoped (#27670)

  ## Why
  
  `selectedCapabilityRoots` belongs to one thread, but MCP contributors
  previously received only the global Codex config. That left no clean way
  for a selected executor capability to contribute MCP servers to its own
  thread.
  
  ## What this PR does
  
  - Gives MCP contributors a small context containing the config and, for
  a running thread, its frozen host-seeded inputs.
  - Uses the same thread inputs during startup, status queries, refreshes,
  and skill dependency checks.
  - Keeps threadless MCP operations and the existing hosted Apps behavior
  unchanged.
  - Adds coverage showing that two threads resolve independent
  registrations and that later lifecycle mutations do not change the
  frozen MCP inputs.
  
  This PR does not discover plugin manifests, add MCP servers, or launch
  anything new. It only establishes the thread-scoped registration
  boundary.
  
  ## Follow-ups
  
  - Resolve selected executor plugin roots through their owning
  environment filesystem.
  - Convert their stdio MCP declarations into environment-bound
  registrations and add an executor MCP end-to-end test.
  
  ## Verification
  
  - `just fmt`
  - `cargo check --tests -p codex-protocol -p codex-extension-api -p
  codex-mcp-extension -p codex-core -p codex-app-server`
  
  Tests and Clippy were not run.

  jif · 2026-06-12 11:20:34 +02:00
  693082f3c4
• [codex] Load AGENTS.md from all bound environments (#27696)

  ## Why
  
  We already have the machinery to support multiple environments on a
  single thread, but we only show the model the contents of `AGENTS.md`
  files in the primary environment.
  
  We should show the model all of the relevant project instructions when
  we know there's more than one environment.
  
  ## Known Gaps
  
  As discussed in the RFC, this implementation:
  
  1. doesn't handle environments being added/removed to/from the thread
  after its creation
  2. it doesn't enforce an aggregate context budget across environments,
  and instead applies the configured project maximum independently to each
  environment
  
  ## Implementation
  
  - Discover project instructions in environment order with an independent
  byte budget per environment and preserve source provenance/order.
  - Keep the legacy fragment byte-for-byte when exactly one environment
  contributes project instructions; use environment-labeled sections when
  two or more environments contribute.
  - Freeze the complete rendered fragment in `LoadedAgentsMd`, insert it
  directly into requests, and recognize both layouts in contextual and
  memory filtering.
  - Add exact rendering, independent-budget, source-order,
  creation-snapshot, and consumer coverage without changing app-server
  schemas.

  Adam Perry @ OpenAI · 2026-06-12 00:10:06 -07:00
  bf667c7003
• Keep request_user_input direct-model only (#27316)

  ## Why
  
  `request_user_input` has direct blocking semantics when invoked by the
  model. When it is exposed as a nested code-mode tool, the call has to
  flow through code-mode waiting and continuation behavior instead, which
  is not the behavior we want for this user-input request surface.
  
  ## What changed
  
  - Mark `request_user_input` with `ToolExposure::DirectModelOnly` when
  registering the core utility tool.
  - Keep `request_user_input` direct-model visible, including in
  code-mode-only planning.
  - Add focused `spec_plan_tests` coverage that verifies
  `request_user_input` remains visible and registered as
  direct-model-only, while it is omitted from the nested code-mode tool
  description.
  
  No active goal suppression or runtime unavailability behavior is
  included in this PR.
  
  ## Validation
  
  - No new build/test run for this housekeeping pass, per maintainer
  request.
  - Earlier targeted run, confirmed from session context: `just test -p
  codex-core request_user_input` passed.

  Shijie Rao · 2026-06-11 23:23:44 -07:00
  7a19b14229
• Add request_user_input auto-resolution window contract (#27256)

  ## Why
  
  `request_user_input` is moving beyond its original plan-mode-only
  workflow, and future default/goal-mode usage needs a way for the model
  to ask helpful but non-blocking questions without forcing the turn to
  wait forever. This PR adds an explicit `autoResolutionMs` contract so a
  later client/runtime change can auto-resolve unanswered prompts after a
  bounded window while leaving truly blocking questions unchanged.
  
  This is contract plumbing only; it does not implement the client-side
  timer or auto-selection behavior, and the model-facing description
  treats the field as reserved unless the current runtime explicitly
  supports auto-resolution.
  
  ## What Changed
  
  - Added optional `autoResolutionMs` to the model-facing
  `request_user_input` args and core `RequestUserInputEvent`.
  - Added model-facing schema text for `autoResolutionMs` while marking it
  reserved for runtimes that explicitly support auto-resolution.
  - Bounds `autoResolutionMs` to `60_000..=240_000` ms during argument
  normalization by clamping out-of-range model-provided values.
  - Propagated the field through app-server v2
  `ToolRequestUserInputParams`, app-server request forwarding, generated
  TypeScript, and JSON schema fixtures.
  - Updated app-server, core, protocol, and TUI call sites/tests so
  omitted values preserve existing `None`/`null` behavior and coverage
  verifies a `Some(60_000)` round trip.
  
  ## Verification
  
  - `just test -p codex-app-server-protocol`
  - `just test -p codex-core request_user_input`
  - `just test -p codex-app-server request_user_input_round_trip`
  - `just test -p codex-tui request_user_input`
  - `just test -p codex-protocol`

  Shijie Rao · 2026-06-11 22:30:41 -07:00
  216ce03031
• [codex] resolve environment shell metadata eagerly (#27709)

  ## Why
  
  Turn construction passed resolved environments through several layers
  while leaving the environment shell unresolved. As a result,
  model-visible environment context could fall back to the session shell
  instead of reporting the selected remote environment's shell.
  
  Resolve environment metadata at the turn-context boundary so each turn
  carries the shell that belongs to its selected environment. Keep request
  validation in app-server, where invalid selections can be returned as
  straightforward JSON-RPC errors without coupling core turn construction
  to that policy.
  
  ## What changed
  
  - resolve environment selections eagerly in
  `new_turn_context_from_configuration`
  - store the full resolved `Shell` on each `TurnEnvironment`
  - simplify the now-redundant resolved-environment constructor plumbing
  - keep duplicate and unknown-environment validation as a small
  app-server preflight
  - add a remote-environment integration test that runs a full
  `test_codex` turn and verifies the model-visible environment message
  reports `bash`
  
  ## Testing
  
  - `cargo check -p codex-core --test all -p codex-app-server`
  - `remote_test_env_exposes_bash_shell_to_model` on the Linux
  remote-executor harness

  pakrym-oai · 2026-06-11 20:35:28 -07:00
  be338ee9a2
• [codex] Remove async_trait from first-party code (#27475)

  ## Why
  
  First-party async traits should expose their `Send` contracts explicitly
  without requiring `async_trait`. This completes the migration pattern
  established in #27303 and #27304.
  
  ## What changed
  
  - Replaced the remaining first-party `async_trait` traits with native
  return-position `impl Future + Send` where statically dispatched and
  explicit boxed `Send` futures where object safety is required.
  - Kept implementations behavior-preserving, outlining existing async
  bodies into inherent methods where that keeps the diff reviewable.
  - Removed all direct first-party `async-trait` dependencies and the
  workspace dependency declaration.
  - Added a cargo-deny policy that permits `async-trait` only through the
  remaining transitive wrapper crates.
  - Updated `rand` from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and
  keep the full cargo-deny check passing.
  
  ## Validation
  
  - `just test -p codex-exec-server`: 216 passed, 2 skipped.
  - `just test -p codex-model-provider`: 39 passed.
  - `just test -p codex-core` and `just test`: changed tests passed;
  remaining failures are environment-sensitive suites unrelated to this
  migration.
  - `cargo deny check`
  - `just fix`
  - `just fmt`
  - `cargo shear`
  - `just bazel-lock-check`

  Adam Perry @ OpenAI · 2026-06-11 18:16:39 -07:00
  5a56caf18c
• Add spans to turn lifecycle gaps (#27623)

  ## Why
  Codex app-server latency traces do not granularly cover turn task
  startup and inter-request handoffs. These spans help attribute time
  across task execution, startup prewarm, in-flight tool completion, and
  rollout persistence.
  
  ## What changed
  - Add `session_task.run` spans around task execution and
  `session_task.flush_rollout` around flushing pending conversation
  transcript writes to durable storage
  - Add `regular_task.prepare_run_turn` around regular-turn startup (Send
  the `TurnStarted` event, reset turn-specific reasoning state, and
  resolve any startup prewarm)
  - Add `startup_prewarm.resolve` around waiting for background session
  prewarming to finish, fail, time out, or be cancelled
  - Add a function-level trace span around draining in-flight tool calls
  (Wait for tool calls to complete, record tool result in conversation
  history, and other bookkeeping)
  
  ## Verification
  Trigger Codex rollout and observe new spans are included

  mchen-oai · 2026-06-11 16:55:01 -07:00
  92d9036910
• Route image extension reads through turn environments v2 (#27498)

  ## Why
  
  Image generation used `std::fs::read` for referenced image paths, which
  did not support environment-backed filesystems or their sandbox context.
  
  ## What changed
  
  - Expose optional turn environments to extension tool calls.
  - Include each environment’s ID, working directory, filesystem, and
  sandbox context.
  - Read referenced images through the selected environment filesystem.
  - Keep sandbox usage at the extension call site so extensions can choose
  the appropriate access mode.
  - Consolidate image request construction into one async function.
  - Add coverage for successful environment reads and read failures.
  
  ## Validation
  
  - `cargo check -p codex-image-generation-extension --tests`
  - `just fmt`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  
  `just test -p codex-image-generation-extension` could not complete
  because the build exhausted available disk space.

  Won Park · 2026-06-11 16:32:52 -07:00
  19ce6394af
• [codex] Move persistence policy application into ThreadStore (#27318)

  Move the application of the persistence policy into the thread store, so
  thread stores can get raw append items rather than canonical append
  items. This will enable store-specific projections over the raw input
  items.

  Tom · 2026-06-11 16:24:12 -07:00
  b2cc01fc7c
• Include thread id in token budget context (#27663)

  ## Why
  
  The token budget full-context fragment identifies the current context
  window, but not the thread that owns that window. Including the thread
  id makes the initial context-window metadata self-contained, and
  `get_context_remaining` also needs to be usable from Code Mode without
  forcing callers to parse the model-facing fragment string.
  
  ## What changed
  
  - Include the session thread id in the initial `<token_budget>` context
  fragment.
  - Expose `get_context_remaining` as a Code Mode nested tool while
  keeping `new_context` direct-model-only.
  - Keep direct model-facing `get_context_remaining` output as the
  existing `<token_budget>` text fragment.
  - Return only `tokens_left` from the Code Mode structured result for
  `get_context_remaining`.
  - Update token-budget integration tests and add Code Mode coverage for
  the structured result.
  
  ## Verification
  
  - `just test -p codex-core token_budget`
  - `just test -p codex-core
  code_mode_get_context_remaining_returns_structured_result`
  - `just test -p core_test_support redacted_text_mode_normalizes_uuids`

  pakrym-oai · 2026-06-11 15:10:29 -07:00
  7516eb5c70
• core: Consolidate Responses API Codex metadata (#27122)

  ## What
  Introduce a `CodexResponsesMetadata` struct that defines all the core
  metadata we send to Responses API. Example fields are `thread_id`,
  `turn_id`, `window_id`, etc.
  
  Going forward, `client_metadata["x-codex-turn-metadata"]` will be the
  canonical way Codex sends metadata to Responses API across both HTTP and
  websocket transports.
  
  For now, we continue to emit the existing top-level HTTP headers and
  top-level `client_metadata` fields from the same
  `CodexResponsesMetadata` struct for compatibility reasons.
  
  Also, app-server clients who specify additional
  `responsesapi_client_metadata` via `turn/start` and `turn/steer` will
  have those fields merged into
  `client_metadata["x-codex-turn-metadata"]`, but cannot override the
  reserved fields that core uses (i.e. the fields in
  `CodexResponsesMetadata`).
  
  ## Why
  
  Responses API request instrumentation is the source of truth for
  downstream Codex analytics that join requests by Codex IDs such as
  session, thread, turn, and context window. Before this change, those
  values were assembled through several request-specific paths: HTTP
  request bodies, websocket handshake headers, websocket `response.create`
  payloads, compaction requests, and the rich `x-codex-turn-metadata`
  envelope all had their own wiring.
  
  That made metadata propagation easy to drift across API-key/direct
  Responses API requests, ChatGPT-auth/proxied requests, websocket
  requests, and compaction requests. It also made additions like
  `window_id` error-prone because a field could be added to one transport
  projection but missed in another.
  
  ## What changed
  
  - Added `CodexResponsesMetadata` as the core-owned snapshot for Codex
  metadata sent to ResponsesAPI.
  - Render `client_metadata["x-codex-turn-metadata"]`, flat
  `client_metadata` projections, and direct compatibility headers from
  that same snapshot.
  - Include the known Codex-owned fields in the turn metadata blob,
  including installation/session/thread/turn/window IDs, request kind,
  lineage, sandbox/workspace metadata, timing, and compaction details.
  - Treat app-server `responsesapi_client_metadata` as enrichment for the
  Codex turn metadata blob while preventing those extras from overriding
  Codex-owned fields.
  - Use the same metadata path for normal turns, websocket prewarm, local
  compaction, remote v1 compaction, and remote v2 compaction.
  - Keep websocket connection-only preconnect metadata separate so
  handshakes carry compatibility identity headers without inventing a fake
  turn metadata blob.
  
  ## Verification
  
  - `cargo check -p codex-core`
  - `just fix -p codex-core`

  Owen Lin · 2026-06-11 13:42:09 -07:00
  14df0e8833
• Resolve MCP server registrations through a catalog (#27634)

  ## Why
  
  MCP servers currently come from user config, local plugins,
  compatibility Apps synthesis, and host extensions. Those sources were
  composed by mutating a shared map, leaving registration identity,
  precedence, removal, and provenance implicit in assembly order.
  
  Before adding executor-owned MCPs, Codex needs one durable resolution
  boundary above `McpConnectionManager`. This PR introduces that boundary
  while preserving current server configuration, policy, and runtime
  behavior. Executor-scoped registrations and explicit policy layers
  remain follow-ups.
  
  ## What changed
  
  - Add typed `McpServerRegistration` inputs and an immutable
  `ResolvedMcpCatalog` in `codex-mcp`.
  - Retain each registration's complete `McpServerConfig`, including its
  environment binding, while recording its source and provenance.
  - Preserve the existing structural precedence between plugin, config,
  compatibility, and ordered extension sources.
  - Resolve equal-precedence actions by contribution order; provenance IDs
  are used only for diagnostics and cannot affect the winner.
  - Preserve extension removals and the existing name-scoped `enabled =
  false` veto.
  - Report same-tier conflicts with every contender and the final catalog
  outcome, including whether the winning action registers or removes the
  server.
  - Require MCP contributors to provide a stable diagnostic identity.
  - Derive materialized server maps and plugin ownership from the resolved
  catalog.
  
  `McpConnectionManager`, transport startup, tool calls, and resource
  routing continue to consume the same effective `McpServerConfig` values.
  
  ## Scope
  
  This PR does not add new MCP capabilities or change user-visible
  behavior. It does not add executor plugin discovery, thread-scoped
  registrations, dynamic refresh generations, or new user/managed policy
  semantics.
  
  ## Verification
  
  - Added focused catalog coverage for source precedence, complete
  configuration preservation, disabled vetoes, plugin ownership,
  contribution-order tie breaking, removal outcomes, and conflict
  diagnostics.
  - Extended hosted Apps coverage for ordered extension removal and
  Apps-disabled hosts with and without the hosted extension installed.
  - `cargo check -p codex-mcp --tests -p codex-extension-api -p
  codex-core`

  jif · 2026-06-11 21:54:52 +02:00
  4a5a676499
• [codex] Load user instructions through an injected provider (#27101)

  ## Why
  
  We want to remove implicit use of `$CODEX_HOME` from `codex-core` and
  make embedders responsible for supplying user-level instructions. This
  also ensures user instructions load when no primary environment is
  selected.
  
  ## What changed
  
  Stacked on #27415, which makes `codex exec` surface thread-scoped
  runtime warnings.
  
  - Added `UserInstructionsProvider` to `codex-extension-api`, with
  absolute source attribution and recoverable loading warnings.
  - Added `codex-home` with the filesystem-backed provider for
  `AGENTS.override.md` and `AGENTS.md`, preserving precedence, fallback,
  trimming, lossy UTF-8 handling, and the existing uncapped global
  instruction size.
  - Removed global instruction loading from `Config` and require
  `ThreadManager` callers to inject a provider.
  - Load provider instructions once for each fresh root runtime, including
  runtimes without a primary environment. Running sessions retain their
  snapshot, while child agents inherit the parent snapshot without
  invoking the provider.
  - Keep provider instructions separate while loading project `AGENTS.md`,
  then assemble the model-visible instructions with the existing ordering,
  source attribution, warning, and turn-context behavior.
  - Wired the Codex home provider through the CLI, app server, MCP server,
  core facade, and thread-manager sample.
  
  ## Validation
  
  - `just test -p codex-home -p codex-extension-api`
  - `just test -p codex-core agents_md`
  - `just test -p codex-core guardian`
  - `just test -p codex-app-server
  thread_start_without_selected_environment_includes_only_global_instruction_source`
  - `just test -p codex-exec warning`
  - `just bazel-lock-check`

  Adam Perry @ OpenAI · 2026-06-11 19:28:47 +00:00
  236b50125d
• [codex] migrate ExecutorFileSystem paths to PathUri (#27424)

  ## Why
  
  We're moving exec-server to use PathUri for its internal path
  representations.
  
  ## What
  
  Move `ExecutorFileSystem` APIs to use `PathUri` instead of
  `AbsolutePathBuf`. Future changes will convert higher-level parts of
  exec-server.

  Adam Perry @ OpenAI · 2026-06-11 18:44:18 +00:00
  b2a4e3be27
• multi-agent: move concurrency guidance into v2 usage hints (#27569)

  ## Why
  
  Native Codex currently teaches multi-agent concurrency through the
  `spawn_agent` tool description, while bridge-driven evals frame the same
  limit as a shared pool of active agent slots. That mismatch makes the
  model-facing story harder to reason about, especially because the
  tool-level wording does not make it explicit that the limit covers the
  whole agent team, including the current agent.
  
  This change gives native Codex the same mental model: tell the root
  agent and subagents how many active slots exist, and remove the separate
  `spawn_agent` limit wording.
  
  ## What changed
  
  - Extend the built-in `multi_agent_v2` root and subagent usage hints
  with shared-slot guidance derived from the resolved
  `max_concurrent_threads_per_session` value.
  - Keep the complete default hints in `MultiAgentV2Config` so initial
  context and forked histories consume the same canonical strings.
  - Drop the redundant `spawn_agent` description text and remove the
  now-unused limit plumbing from the tool spec path.
  
  ## Testing
  
  - `just test -p codex-core usage_hint`
  - `just test -p codex-core
  multi_agent_v2_default_session_thread_cap_counts_root`
  - `just test -p codex-core
  multi_agent_v2_default_usage_hints_use_configured_thread_cap`
  - `just test -p codex-core
  spawn_agent_tool_v2_requires_task_name_and_lists_visible_models`
  - `just test -p codex-core
  multi_agent_feature_selects_one_agent_tool_family`

  jif · 2026-06-11 12:41:44 +02:00
  0870352241
• core: enable remote compaction v2 by default (#27573)

  ## Why
  
  Remote compaction v2 is ready to become the default for providers that
  already support remote compaction. Leaving it behind an
  under-development opt-in keeps eligible sessions on the legacy
  remote-compaction path.
  
  This does not broaden provider eligibility: OpenAI and Azure move to v2,
  while Bedrock and OSS providers retain their existing local-compaction
  behavior.
  
  ## What changed
  
  - Mark `remote_compaction_v2` stable and enable it by default.
  - Make tests that intentionally cover legacy remote compaction
  explicitly disable v2.
  - Update parity coverage so v2 exercises the production default and only
  legacy mode opts out.
  
  ## Verification
  
  - `just test -p codex-core
  auto_compact_runs_after_resume_when_token_usage_is_over_limit
  auto_compact_counts_encrypted_reasoning_before_last_user
  auto_compact_runs_when_reasoning_header_clears_between_turns
  responses_lite_compact_request_uses_lite_transport_contract`

  jif · 2026-06-11 10:07:19 +00:00
  273a4aa4f2
• skills: make backend plugin skills invocable without an executor (#27387)

  ## Why
  
  #27198 made the extension-owned `codex_apps` MCP connection the hosted
  plugin runtime, but its `mcp/skill` resources still bypassed the skills
  extension. App-server could list and read those resources through
  generic MCP APIs, but a thread with no selected environment did not
  expose them in the model's skills catalog or load their `SKILL.md`
  through `$skill`.
  
  Hosted skills should stay remote while using the same typed catalog,
  source authority, deduplication, bounded contextual catalog, and
  selected-skill prompt injection as host and executor skills. They should
  not be downloaded or exposed as ambient filesystem paths.
  
  ## What changed
  
  - Add a session-scoped `McpResourceClient` over the replaceable MCP
  connection manager so resource list/read calls follow startup and
  refresh replacements.
  - Add a `BackendSkillProvider` that pages `codex_apps` resources,
  accepts bounded and validated `mcp/skill` entries, and reads a selected
  skill's `SKILL.md` through the same MCP connection.
  - Register the remote provider in app-server and include it in the
  skills catalog even when a thread has no selected capability roots or
  executor.
  - Contribute hosted skill metadata through the bounded
  `AvailableSkillsInstructions` developer-context path, exclude remote
  entries from per-turn catalog injection, and classify `<skills>`
  messages as contextual developer content so rollback can trim and
  rebuild them correctly.
  
  ## Testing
  
  - Extend the app-server MCP resource integration test with
  `environments: []` to exercise two-page discovery, filter a
  non-`mcp/skill` resource, verify the escaped developer catalog entry and
  user-role `<skill>` fragment containing the fetched `SKILL.md`, and
  preserve generic MCP resource reads.
  - Add core event-mapping coverage that classifies `<skills>` developer
  messages as contextual history.

  jif · 2026-06-11 11:28:16 +02:00
  a287c5dffd
• [codex-analytics] Emit structured compaction codex errors (#27082)

  ## Summary
  - replace raw compaction `error` analytics with `codex_error_kind` and
  `codex_error_http_status_code`
  - derive compaction error telemetry from `CodexErr` using the same
  `CodexErrKind` mapping and HTTP status helper used by turn events
  - remove the pre-compact hook stop reason from the internal compaction
  outcome now that it is no longer emitted as raw analytics text
  
  ## Why
  Compaction `error` was a raw `CodexErr::to_string()` value, which can
  carry free-form provider or user-derived text. Structured Codex error
  fields preserve useful low-cardinality telemetry without sending the raw
  string.
  
  ## Validation
  - `just fmt`
  - `just test -p codex-analytics`
  - `just test -p codex-core
  compact::tests::build_token_limited_compacted_history_appends_summary_message`
  
  Attempted `just test -p codex-core`; the changed crate compiled, but the
  full target failed in unrelated environment-dependent tests such as
  missing helper binaries and shell snapshot timeouts.

  rhan-oai · 2026-06-11 06:07:06 +00:00
  8d9f33c87c
• Use generic search metadata for dynamic tools (#27356)

  ## Why
  
  Dynamic tools maintained a separate search-text builder even though the
  shared tool search path already derives the same metadata from
  `ToolSpec`. Using the shared path removes duplicate behavior before
  adding explicit namespaces.
  
  ## What changed
  
  - Build dynamic-tool search entries with
  `ToolSearchInfo::from_tool_spec`.
  - Remove the custom search-text state and its implementation-only unit
  test.
  
  The old search text included the tool name, its space-separated form,
  description, namespace, and top-level parameter names. The shared
  builder preserves all of those terms and also indexes namespace
  descriptions and nested schema metadata.
  
  ## Test plan
  
  - `just test -p codex-core
  tool_search_returns_deferred_dynamic_tool_and_routes_follow_up_call`

  sayan-oai · 2026-06-10 23:06:34 -07:00
  b5a718ef67
• [codex-analytics] report cached input tokens for v2 compaction (#27103)

  ## Summary
  
  - add nullable `cached_input_tokens` to the compaction analytics event
  - populate it from response usage for compaction v2
  - leave it `null` for other compaction implementations
  
  This adds visibility into prompt-cache usage for v2 compaction without
  changing compaction behavior.
  
  ## Testing
  
  - `just test -p codex-analytics`
  - `just test -p codex-core
  collect_compaction_output_accepts_additional_output_items`

  rhan-oai · 2026-06-10 22:47:22 -07:00
  383708e74e
• [codex] Add context remaining tool (#27518)

  ## Why
  
  The token budget feature can inject remaining-context notices into
  model-visible context, but the model does not have a direct way to ask
  for that same remaining-token fragment on demand.
  
  This PR adds a small model tool for the token budget feature so the
  model can request the current remaining context window message without
  duplicating the fragment format.
  
  ## What changed
  
  - Adds a `get_context_remaining` direct-model tool behind
  `Feature::TokenBudget`.
  - Renders the tool output through `TokenBudgetRemainingContext`,
  matching the existing budget message shape.
  - Registers the tool alongside `new_context` in the token budget tool
  set.
  - Adds integration coverage that verifies the tool is exposed and
  returns the same `<token_budget>` remaining fragment already present in
  context.
  
  ## Validation
  
  - `just test -p codex-core token_budget`

  pakrym-oai · 2026-06-11 04:17:10 +00:00
  dac5f07403
• [codex] Compact when comp_hash changes (#27520)

  ## Summary
  - snapshot `comp_hash` into `TurnContext` when the turn is created and
  use that snapshot as the downstream source of truth
  - persist the turn hash in rollout context and recover it into
  previous-turn settings during resume and fork replay
  - compact existing history with the previous model only when both
  adjacent turns provide hashes and the values differ
  - record `comp_hash_changed` as the compaction reason
  - cover ordinary transitions, resume, and missing-hash compatibility
  with end-to-end tests
  
  ## Why
  History produced under one compaction-compatible model configuration may
  not be safe to carry directly into another. Compacting at the turn
  boundary converts that history before context updates and the new user
  message are added. Persisting the turn snapshot in `TurnContextItem`
  makes the same protection work after resuming a rollout.
  
  A missing hash is not treated as evidence of incompatibility. `None →
  Some`, `Some → None`, and `None → None` do not trigger compaction; only
  `Some(previous) → Some(current)` with unequal values does.
  
  ## Stack
  - depends on #27532
  - #27532 is based directly on `main`
  
  ## Testing
  - `just test -p codex-core pre_sampling_compact_` — 6 passed
  - `just test -p codex-core
  turn_context_item_uses_turn_context_comp_hash_snapshot` — passed
  - `just fix -p codex-core -p codex-protocol -p codex-analytics -p
  codex-models-manager`

  Ahmed Ibrahim · 2026-06-11 04:11:26 +00:00
  ba4925b3c2
• [codex] Pass auth mode to plugin manager (#27517)

  ## Summary
  - Add auth mode state to `PluginsManager`.
  - Sync the plugin manager auth mode when `ThreadManager` is created and
  when account auth changes.
  - Route plugin load outcomes through an auth-aware projection hook so
  follow-up plugin filtering can stay inside `core-plugins`.
  
  ## Motivation
  This prepares plugin capability loading to be configured by auth mode,
  such as hiding or exposing app/MCP-backed plugin surfaces based on
  whether the user is using ChatGPT auth or API-key auth, without leaking
  those details outside the plugin manager.
  
  ## Tests
  - `just fmt`
  - `just test -p codex-core-plugins`
  - `env -u CODEX_SANDBOX_NETWORK_DISABLED -u CODEX_SANDBOX just test -p
  codex-core thread_manager::tests`
  - `env -u CODEX_SANDBOX_NETWORK_DISABLED -u CODEX_SANDBOX just test -p
  codex-app-server`

  xl-openai · 2026-06-10 20:57:35 -07:00
  856855914f
• core: strip image detail from Responses Lite requests (#27246)

  ## Summary
  
  - Strip image `detail` fields from every Responses Lite request.
  - Apply stripping to message images and function/custom tool-output
  images.
  - Transform only the formatted request copy without mutating stored
  history.
  - Preserve image URLs byte-for-byte, including HTTP(S) URLs, without
  downloading, validating, or resizing them.
  - Preserve all image `detail` fields for non-Responses-Lite models.
  
  ## Motivation
  
  Responses Lite does not support image `detail` tags, so Codex must omit
  them whenever `model_info.use_responses_lite` is enabled. This transport
  requirement is independent of the `resize_all_images` feature.
  
  Stored history retains the original detail values. This keeps
  request-specific formatting isolated from conversation state and
  preserves the information for local image preparation and
  non-Responses-Lite requests.
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/27245
  - ✅ `2` https://github.com/openai/codex/pull/27247
  - 👉 `3` https://github.com/openai/codex/pull/27246
  - ⏳ `4` https://github.com/openai/codex/pull/27266

  Curtis 'Fjord' Hawthorne · 2026-06-10 20:43:03 -07:00
  4435ff2810
• [codex] Add comp_hash to model metadata (#27532)

  ## Summary
  - add optional `comp_hash` metadata to `ModelInfo`
  - update `ModelInfo` fixtures for the shared schema change
  - keep older model responses compatible by defaulting the field to
  `None`
  
  ## Why
  The models endpoint needs an opaque identifier for compaction-compatible
  model configurations. This PR only exposes that value in model metadata;
  it does not add it to turn context or change runtime behavior.
  
  Follow-up #27520 carries the value through turn context and rollouts,
  then uses it to trigger compaction.
  
  ## Stack
  - based directly on `main`
  - replaces #27519, which was accidentally merged into the wrong base
  branch
  - functionality follow-up: #27520
  
  ## Testing
  - `just test -p codex-protocol
  model_info_defaults_availability_nux_to_none_when_omitted`
  - `just fix -p codex-core -p codex-protocol -p codex-analytics -p
  codex-models-manager`

  Ahmed Ibrahim · 2026-06-10 20:42:55 -07:00
  e614fad02e
• feat: add Bedrock API key as a managed auth mode (#27443)

  ## Why
  
  Codex needs to manage Amazon Bedrock API key credentials through the
  existing auth lifecycle instead of introducing a separate auth manager
  or provider-specific credential file. Treating Bedrock API key login as
  a primary auth mode gives it the same persistence, keyring, reload, and
  logout behavior as the existing OpenAI API key and ChatGPT modes.
  
  The credential is valid only for the `amazon-bedrock` model provider.
  OpenAI-compatible providers must reject this auth mode rather than
  treating the Bedrock key as an OpenAI bearer token.
  
  ## What changed
  
  - Added `bedrockApiKey` as an app-server `AuthMode` and
  `CodexAuth::BedrockApiKey` as a primary `AuthManager` mode.
  - Added `BedrockApiKeyAuth`, containing the API key and AWS region, to
  the existing `AuthDotJson` payload stored in `$CODEX_HOME/auth.json` or
  the configured keyring backend.
  - Added `login_with_bedrock_api_key(...)`, parallel to
  `login_with_api_key(...)`, which replaces the current stored login with
  Bedrock credentials.
  - Reused generic auth reload and logout behavior instead of adding a
  Bedrock-specific auth manager or logout path.
  - Updated login restrictions, status reporting, diagnostics, telemetry
  classification, generated app-server schemas, and auth fixtures for the
  new mode.
  - Added explicit errors when Bedrock API key auth is selected with an
  OpenAI-compatible model provider.
  
  This PR establishes managed storage and auth-mode behavior. Routing the
  managed key and region into Amazon Bedrock requests will be in follow-up
  PRs.

  Celia Chen · 2026-06-10 20:42:38 -07:00
  06afd63f4a
• [codex] Add new context window tool (#27488)

  ## Why
  
  The token budget feature tells the model how much room remains in the
  current context window. When the model decides the current window is no
  longer useful, it needs a way to ask Codex to start over with a fresh
  context window without spending tokens on a compaction summary.
  
  This PR adds that model-requestable escape hatch on top of #27438.
  
  ## What changed
  
  - Added a direct-model-only `new_context` tool behind
  `Feature::TokenBudget`.
  - Stores the tool request on `AutoCompactWindow` and consumes it after
  sampling so the next follow-up request in the same turn starts in the
  new window.
  - Starts the new window as a no-summary compaction checkpoint that
  contains only fresh initial context, not preserved conversation history.
  - Keeps the new window aligned with token-budget startup context,
  including the `Current context window Z` message.
  - Added integration coverage and a snapshot showing the same-turn
  `new_context` flow into a fresh full-context follow-up request.
  
  ## Validation
  
  - `just test -p codex-core token_budget`

  pakrym-oai · 2026-06-11 03:39:07 +00:00
  87ab01834a
• [codex] Add token budget context feature (#27438)

  ## Why
  
  The model should be able to see bounded context-window budget metadata
  when the `token_budget` feature is enabled. The full-window message is
  only injected with full context, while normal turns get a smaller
  follow-up only when reported usage first crosses a budget threshold.
  
  ## What changed
  
  - Added the `TokenBudget` feature flag.
  - Added `<token_budget>` developer fragments for full context-window
  metadata and current-window remaining tokens.
  - Inserted the threshold message during normal turn handling by
  comparing token usage before and after sampling, avoiding persistent
  threshold bookkeeping.
  - Added core integration coverage for full-context-only metadata and
  25/50/75 percent threshold messages.
  
  ## Verification
  
  - `just test -p codex-core token_budget`
  - `git diff --check`

  pakrym-oai · 2026-06-10 20:07:06 -07:00
  658af936fd
• core: resize all history images behind a feature flag (#27247)

  ## Summary
  
  Adds complete client-side image preparation behind the default-off
  `resize_all_images` feature flag.
  
  When enabled, local image producers defer decoding and resizing. Images
  are prepared centrally before insertion into conversation history,
  covering user input, `view_image`, and structured tool-output images.
  
  ## Behavior
  
  - Processes base64 `data:` images in messages and function/custom tool
  outputs.
  - Leaves non-data URLs, including HTTP(S) URLs, unchanged.
  - Applies image-detail budgets:
    - `high` and omitted: 2048px maximum dimension and 2.5K 32px patches.
    - `original`: 6000px maximum dimension and 10K 32px patches.
    - `auto`: uses the same 2048px / 2.5K-patch budget as high.
    - `low`: unsupported and replaced with an actionable placeholder.
  - Preserves original image bytes when no resize or format conversion is
  needed.
  - Enforces the shared 1 GiB encoded and decoded data-URL sanity limits.
  - Replaces only an image that fails preparation, preserving sibling
  content and tool-output metadata.
  - Uses bounded placeholders distinguishing generic processing failures,
  oversized images, and unsupported `low` detail.
  - Prepares resumed and forked history before installing it as live
  history without modifying persisted rollouts.
  
  ## Flag-Off Behavior
  
  When `resize_all_images` is disabled:
  
  - Existing local user-input and `view_image` processing remains
  unchanged.
  - Existing decoding and error behavior remains unchanged.
  - Arbitrary tool-output images are not processed.
  - HTTP(S) image URLs continue to be forwarded unchanged.
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/27245
  - 👉 `2` https://github.com/openai/codex/pull/27247
  - ⏳ `3` https://github.com/openai/codex/pull/27246
  - ⏳ `4` https://github.com/openai/codex/pull/27266

  Curtis 'Fjord' Hawthorne · 2026-06-10 19:21:24 -07:00
  a6f435ea94
• core: cache turn diff rendering (#27489)

  ## Summary
  
  Turn diff updates repeatedly rendered and serialized the entire
  accumulated diff after every `apply_patch`. The event path also rendered
  once before updating the tracker solely to test whether a diff existed.
  In production feedback CODEX-20PW, 2,589 patches across 72 paths
  produced 401 notifications totaling 441 MB, with the hottest paths
  patched 518 and 495 times.
  
  This change:
  
  - replaces the pre-update render with a cheap cached-state check
  - caches each rendered file diff by path and content revision, so an
  update only invokes Myers for affected paths
  - caches the deterministic aggregate diff so event emission and turn
  completion reuse it without recomputation
  - preserves invalidation and net-zero clear notifications
  - applies a 100 ms per-file `similar` timeout; ordinary files complete
  far below this threshold, while pathological rewrites fall back to a
  coarse unified hunk that still represents the exact final contents
  
  The 100 ms deadline bounds synchronous tool-completion latency while
  leaving substantial headroom for normal diffs. The regression test
  applies the fallback diff through the repository's patch parser and
  verifies byte-for-byte final contents.
  
  ## Validation
  
  - `cargo test -p codex-core turn_diff_tracker::tests` (14 passed)
  - `cargo test -p codex-core tools::events::tests` (4 passed)
  - `just fix -p codex-core`
  - `just fmt`
  
  Focused coverage verifies that 42 updates across two files perform 42
  file renders rather than repeatedly rendering the accumulated set,
  unchanged paths are not re-diffed, clear events remain correct, and a
  48,000-line near-total rewrite returns promptly and applies to the exact
  expected result. The full `codex-core` suite was not used as the final
  gate because an unrelated existing multi-agent test hit a stack overflow
  when run during investigation.
  
  ## Bug context
  
  - Sentry feedback: CODEX-20PW
  - Correlation IDs: `019eb2a9-13d2-74e0-b690-27ee224ffb6d`,
  `019e9ad7-09c3-7cb2-b728-ee3acba103ab`

  Jeremy Rose · 2026-06-10 17:17:44 -07:00
  b389b950e1
• Forward standalone assistant output to realtime (#27319)

  ## Why
  
  When a realtime session is open without an active frontend-model
  handoff, completed Codex assistant messages are currently dropped. That
  prevents the frontend model from hearing orchestrator preambles and
  final responses produced by typed turns or other non-handoff work, which
  makes the two models present as disconnected personas.
  
  Active handoffs already forward each completed assistant message,
  including preambles. This change leaves those V1 and V2 paths intact and
  fills only the no-active-handoff gap.
  
  ## What changed
  
  - Send standalone V1 assistant messages through
  `conversation.handoff.append` with a stable synthetic handoff ID
  - Send standalone V2 assistant messages as normal `[BACKEND]`
  `conversation.item.create` message items, then enqueue `response.create`
  so the frontend model responds
  - Preserve the existing active V1 and V2 transport and completion
  behavior
  - Continue excluding user messages from realtime mirroring
  - Skip empty output and cap each complete context injection, including
  its V2 prefix, at 1,000 tokens
  - Add end-to-end coverage for both wire formats, V2 response creation,
  preambles, final responses, and truncation
  
  ## Test plan
  
  - CI

  guinness-oai · 2026-06-10 21:32:29 +00:00
  22dd6ebc7d
• [codex] Preserve disabled MCP servers across runtime overlays (#27414)

  ## Why
  
  Recent MCP runtime overlay changes replace same-name configured server
  entries with compatibility or extension-provided configs. Those
  replacement configs default to enabled, so an MCP server explicitly
  configured with `enabled = false` could be initialized anyway.
  
  The connection manager still filters disabled servers correctly, but the
  configured disabled state was lost before initialization reached that
  filter.
  
  ## What changed
  
  - Remember MCP servers that are disabled in the configured view before
  applying runtime fallbacks and extension overlays.
  - Restore `enabled = false` for those servers after overlays, while
  leaving all other overlay fields and `Remove` precedence unchanged.
  - Add focused extension-backed regression coverage for a disabled
  `codex_apps` server.
  
  ## Testing
  
  - `just fmt`
  - `just test -p codex-mcp-extension`
  - `just fix -p codex-core`
  - `just fix -p codex-mcp-extension`
  
  The full workspace `just test` suite was not run.

  e-provencher · 2026-06-10 16:11:20 -04:00
  980f60b664
• [codex] Skip local curated discovery for remote plugins (#27311)

  ## Summary
  
  - skip the local `openai-curated` marketplace before marketplace loading
  when tool-suggest discovery uses remote plugins
  - preserve existing marketplace listing behavior for all other callers
  and when remote plugins are disabled
  - add regression coverage proving the curated marketplace is excluded
  before its malformed manifest can be read
  
  ## Why
  
  Tool-suggest discovery previously loaded every local `openai-curated`
  plugin manifest and only discarded that marketplace afterward when
  remote plugins were enabled. The remote catalog is used in that mode, so
  the local scan consumed CPU without contributing discoverable plugins.
  
  ## Impact
  
  Remote-plugin tool suggestion discovery no longer reads the local
  curated marketplace and its plugin manifests. `openai-bundled`,
  configured marketplaces, normal `plugin/list` behavior, and local
  curated discovery when remote plugins are disabled are unchanged.
  
  ## Validation
  
  - `just test -p codex-core-plugins
  list_marketplaces_can_skip_openai_curated_before_loading`
  - `just test -p codex-core
  list_tool_suggest_discoverable_plugins_omits_openai_curated_when_remote_enabled`
  - `just fmt`
  - `git diff --check`

  xl-openai · 2026-06-10 13:11:09 -07:00
  7011044c1c
• Guard core test subprocess cleanup (#27343)

  ## Why
  
  Local integration-heavy `codex-core` CLI tests can time out or be
  interrupted after spawning `codex exec`. Stopping only the direct child
  is not enough: `codex exec` can leave grandchildren behind, including
  `python3`/`python3.12` processes that get reparented to PID 1 and keep
  running after the test is gone.
  
  This PR fixes that failure mode directly for the affected CLI
  integration tests, without changing production code or reducing local
  test concurrency.
  
  ## What
  
  - Run the `cli_stream` `codex exec` subprocesses through a small private
  wrapper in `core/tests/suite/cli_stream.rs`.
  - Spawn those subprocesses in their own process group before execution.
  - Keep `.output()`-style stdout/stderr capture and the existing
  30-second timeout behavior.
  - Own each spawned process with a drop guard that kills the whole
  process group on success, timeout, panic, or other early return.
  
  The switch from `assert_cmd::Command` to `std::process::Command` is only
  for these subprocess launches; `assert_cmd` does not expose a pre-spawn
  hook for setting the process group.
  
  ## Verification
  
  - `just test -p codex-core --test all responses_mode_stream_cli`
  
  This is limited to core integration tests; it does not change production
  `src` code paths.

  Eric Traut · 2026-06-10 12:19:26 -07:00
  13468115fc
• [plugins] Inject remote_plugin_id into install elicitations (#26409)

  Summary
  - Propagate cached remote plugin IDs through Codex plugin discovery.
  - Inject `remote_plugin_id` and connector IDs into
  `request_plugin_install` elicitation `_meta` from the resolved plugin.
  - Keep the remote plugin ID out of the model-facing tool schema,
  arguments, and result.
  
  Validation
  - `just test -p codex-tools`
  - `just test -p codex-core-plugins`
  - `just test -p codex-core
  list_tool_suggest_discoverable_plugins_includes_cached_remote_global_plugins`
  - `just fix -p codex-tools`
  - `just fix -p codex-core-plugins`
  - `just fix -p codex-core`
  - `git diff --check`
  - `just test -p codex-core` was also attempted: 2,581 passed, 55 failed,
  and 1 timed out across unrelated sandbox/environment-sensitive
  integration tests.

  Alex Daley · 2026-06-10 12:01:03 -07:00
  020bf49346
• [codex] Retry transient Guardian review failures (#27062)

  ## Background
  
  Codex can use **Auto Review** for permission requests. Instead of asking
  the user immediately, Codex starts a separate locked-down reviewer
  session called **Guardian**, which returns a structured `allow` or
  `deny` assessment.
  
  The Guardian reviewer is itself a Codex session, so its model request
  can fail for transient infrastructure reasons such as model overload,
  HTTP connection failure, or response-stream disconnect. Today, any such
  failure immediately ends the Auto Review attempt and blocks the action.
  
  This PR adds bounded retries for failures that the existing protocol
  explicitly identifies as transient.
  
  Linear context:
  [CA-539](https://linear.app/openai/issue/CA-539/retry-auto-review-infrastructure-failures-and-fall-back-to-manual)
  
  ## What changes
  
  A Guardian review can now make at most **three total attempts**:
  
  1. Run the review normally.
  2. Retry after a jittered delay of roughly 180–220 ms if the first
  attempt fails with an eligible error.
  3. Retry after a jittered delay of roughly 360–440 ms if the second
  attempt also fails with an eligible error.
  
  All attempts share the original review deadline. Jitter spreads retries
  from concurrent clients to reduce synchronized load during broader
  outages. The retries do not reset the user's maximum wait time, and the
  backoff waits terminate early if the review is cancelled or the deadline
  expires.
  
  Before retrying, the existing Guardian session lifecycle decides whether
  the session remains usable. Healthy trunks are reused, broken trunks are
  removed by the existing cleanup path, and ephemeral sessions continue to
  clean themselves up.
  
  The review still emits one logical lifecycle to clients. Recoverable
  intermediate failures do not produce warnings or terminal events.
  
  ## Retry policy
  
  ### Retried up to twice
  
  - model/server overload
  - HTTP connection failure
  - response-stream connection failure
  - response-stream disconnect
  - internal server error
  - a final reviewer message that cannot be parsed as the required
  Guardian assessment
  
  ### Not retried
  
  - bad or invalid requests
  - authentication failures
  - usage limits
  - cyber-policy failures
  - errors without a structured category
  - a request that already exhausted the lower-level Responses retry
  budget
  - a completed Guardian turn with no assessment payload
  - prompt-construction failures
  - Guardian review timeout
  - cancellation or abort
  - a valid `deny` assessment
  
  The session-error classification uses `ErrorEvent.codex_error_info`; it
  does not inspect error-message strings.
  
  ## Implementation notes
  
  - `wait_for_guardian_review` preserves the complete `ErrorEvent`,
  including structured `codex_error_info`.
  - Guardian session failures preserve the original message and optional
  structured `CodexErrorInfo`.
  - The retry policy classifies the explicitly transient `CodexErrorInfo`
  variants; unknown, absent, and deterministic categories are not retried.
  - The Guardian session manager receives the caller's deadline rather
  than creating a new timeout per attempt.
  - Analytics record the final `attempt_count`.
  - Retry orchestration does not add a separate session-cleanup protocol;
  it relies on the existing trunk and ephemeral lifecycle decisions.
  
  ## Automated testing
  
  Focused Guardian coverage verifies:
  
  - every supported transient `CodexErrorInfo` is classified as retryable,
  while absent and non-transient categories are not;
  - structured transient session failure -> retry -> approval with the
  healthy trunk reused;
  - two invalid Guardian responses -> third attempt -> approval, with
  exactly three requests;
  - three invalid responses -> existing fail-closed result, with exactly
  three requests and one terminal lifecycle;
  - valid denial, missing payload, invalid request, timeout, cancellation,
  and prompt/session construction failures are not retried;
  - retry eligibility ends after the third attempt;
  - retry delays use the shared exponential backoff helper and remain
  within the expected jitter bounds;
  - cancellation and deadline expiry interrupt the backoff wait;
  - healthy trunks are reused across retryable failures;
  - broken event streams remove the trunk through the existing lifecycle
  cleanup;
  - an ephemeral retry does not disturb a concurrent trunk review.
  
  Validation performed:
  
  - `just test -p codex-core guardian_review_
  guardian_ephemeral_retry_preserves_parallel_trunk_and_fork_history
  run_review_removes_trunk_when_event_stream_is_broken` — **42 passed**;
  - `just test -p codex-analytics` — **71 passed**;
  - scoped Clippy fixes for `codex-core` and `codex-analytics` passed.
  
  A prior full `codex-core` run had unrelated environment-sensitive
  failures outside Guardian coverage.
  
  ## Manual QA
  
  The focused integration tests use the local mock Responses server to
  inspect exact request counts and emitted lifecycle events. They confirm
  that retries are internal, a successful later attempt supplies the final
  decision, non-retryable failures issue only one request, and exhausted
  retries emit only one terminal result.

  kbazzi · 2026-06-10 11:46:57 -07:00
  ccf1a18518
• Add app-server thread/delete API (#25018)

  ## Why
  
  Clients can archive and unarchive threads today, but there is no
  app-server API for permanently removing a thread. Deletion also needs to
  cover the full session tree: deleting a main thread should remove
  spawned subagent threads and the related local metadata instead of
  leaving orphaned rollout files, goals, or subagent state behind.
  
  ## What
  
  - Adds the v2 `thread/delete` request and `thread/deleted` notification,
  with the response shape kept consistent with `thread/archive`.
  - Implements local hard delete for active and archived rollout files.
  - Deletes the requested thread's state DB row as the commit point, then
  best-effort cleans associated state including spawned descendants,
  goals, spawn edges, logs, dynamic tools, and agent job assignments.
  - Updates app-server API docs and generated protocol schema/TypeScript
  fixtures.

  Eric Traut · 2026-06-10 11:22:12 -07:00
  a19d43a40a