Termux rust-v0.155.0-alpha.7 - #418
Merged
Merged
Conversation
* Release 0.140.0-alpha.19
* Seed Termux release automation
* Prepare Termux rust-v0.140.0-alpha.19
* ## New Features
- Added `/usage` views for daily, weekly, and cumulative account token activity. (#27925)
- `/goal` now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#27508, #27509, #27510)
- Added permanent session deletion through `codex delete`, `/delete`, and app-server `thread/delete`, with confirmation safeguards and subagent cleanup. (#25018, #27476)
- Added `/import` for selectively importing setup, project configuration, and recent chats from Claude Code. (#27070, #27071, #27703)
- Typing `@` now opens the unified mentions menu for files, plugins, and skills by default. (#27499)
- Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#27443, #27689, #27504, #27535, #27539, #27541)
## Bug Fixes
- Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#26859, #27719)
- Prevented `/review` from crashing when `Esc` is pressed with queued guidance, while preserving that guidance when the review is canceled. (#22879)
- Improved MCP reliability by retrying transient startup failures, reporting unusable OAuth credentials as logged out, and preserving explicitly disabled servers. (#25147, #26713, #27414)
- Fixed remote plugin uninstall requests and correctly surfaced apps requiring authentication during installation. (#27085, #27223)
- Persisted “Don’t remind me” update dismissals reliably and cleared stale running-hook indicators after completed turns. (#27619, #27783)
- Non-TTY background commands can now be interrupted with Ctrl-C while preserving their final output and exit status. (#26734)
## Documentation
- Clarified contributor guidance around keeping crate APIs narrow and supporting Linux, macOS, and Windows. (#27939, #27966)
## Chores
- Improved responsiveness for large repositories and long sessions by preserving Git’s built-in filesystem monitor, avoiding duplicate history reads, accelerating archive lookup, and caching turn-diff rendering. (#26880, #27031, #27276, #27489)
- Removed the experimental `/realtime` voice controls and related audio dependencies from the TUI. (#27801)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.139.0...rust-v0.140.0
- #26880 [codex] preserve fsmonitor for worktree Git reads @tamird
- #27085 Use server app auth requirements for remote plugin install @xl-openai
- #27098 [codex] Return workspace directory installed plugins @xl-openai
- #27007 multi-agent: add path-based v2 activity tracking @jif-oai
- #27166 app-server: clear stale thread watches after v2 agent interruption @jif-oai
- #27080 [codex] Ignore pending PR review comments @anp-oai
- #26420 Avoid no-op backfill state writes @zanie-oai
- #27031 Avoid rereading rollout history during cold resume @zanie-oai
- #22879 fix: Prevent /review crash when entering Esc on steer message @canvrno-oai
- #27173 app-server: reject direct input to multi-agent v2 sub-agents @jif-oai
- #27184 Load selected executor skills through extensions @jif-oai
- #26835 [codex] Test extension API contracts @anp-oai
- #27063 [codex-analytics] add extensible feature thread sources @marksteinbrick-oai
- #26479 [codex] Speed up local nextest runs @anp-oai
- #27223 fix: use plugin service route for remote uninstall @ericning-o
- #22685 Add SOCKS5 TCP MITM coverage @winston-openai
- #26681 Allow creating a new goal after completion @etraut-openai
- #26711 Reduce TUI legacy core dependencies @etraut-openai
- #27110 [1/6] Add Python goal routing foundation @aibrahim-oai
- #27191 Route hosted Apps MCP through extensions @jif-oai
- #26830 [codex] Characterize global instruction lifecycle @anp-oai
- #26713 [codex] Report unusable MCP OAuth credentials as logged out @anp-oai
- #26734 [codex] Handle Ctrl-C for non-TTY unified exec @pakrym-oai
- #27116 Stop mirroring Codex user input into realtime @guinness-oai
- #27111 [2/6] Add private Python goal operations @aibrahim-oai
- #25147 [codex] Retry streamable HTTP initialize failures @ssetty-oai
- #27257 [codex] Tighten MCP connection manager API visibility and order @aibrahim-oai
- #26701 TUI Plugin Sharing 1 - add remote plugin identity @canvrno-oai
- #27129 feat: use provider defaults for memory models @celia-oai
- #27094 Add spans to build_tool_router @mchen-oai
- #24999 Add per-session realtime model and version overrides @guinness-oai
- #27078 [codex-analytics] emit goal lifecycle analytics @marksteinbrick-oai
- #27285 [codex] Fix post-merge analytics integration failures @anp-oai
- #27107 Add spans to run_turn @mchen-oai
- #27261 [codex] Make MCP connection startup fallible @aibrahim-oai
- #27174 feat: keep child MCP warnings out of parent transcript @jif-oai
- #27198 Use plugin-service MCP as the hosted plugin runtime @jif-oai
- #27375 [codex] Tag multi-agent spawn metrics with version @jif-oai
- #27383 Remove async-trait from extension contributors @jif-oai
- #27259 Use latest-wins MCP manager replacement @charliemarsh-oai
- #27264 [codex] Store compact window id in rollout @pakrym-oai
- #27280 [codex] add io PathUri native conversion APIs @anp-oai
- #27315 [codex] link Windows releases with LLD @tamird
- #27276 Reduce archive rollout lookup CPU @etraut-openai
- #27299 [codex] Outline ToolExecutor handler bodies @anp-oai
- #27391 Index visible thread list ordering @zanie-oai
- #27407 Fix compressed rollout search path matching @jif-oai
- #27304 [codex] Remove async_trait from ToolExecutor @anp-oai
- #26041 Add app-server background terminal process APIs @etraut-openai
- #25018 Add app-server `thread/delete` API @etraut-openai
- #26859 fix: Auto-recover from corrupted sqlite databases @ddr-oai
- #27064 [codex] remove blocking external agent migration flow @stefanstokic-oai
- #27421 [codex] Raise app-server recursion limit @anp-oai
- #27062 [codex] Retry transient Guardian review failures @kbazzi
- #27065 [codex] extract external agent import picker renderer @stefanstokic-oai
- #26409 [plugins] Inject remote_plugin_id into install elicitations @adaley-openai
- #27439 feat: make ThreadStore available on ThreadExtensionDependencies @bolinfest
- #27343 Guard core test subprocess cleanup @etraut-openai
- #27070 [codex] add external agent import picker UX @stefanstokic-oai
- #27321 [codex] Move release platform rules into bazel package @anp-oai
- #27071 [codex] add /import for external agents @stefanstokic-oai
- #27311 [codex] Skip local curated discovery for remote plugins @xl-openai
- #27414 [codex] Preserve disabled MCP servers across runtime overlays @e-provencher
- #27312 [codex] reuse release artifacts for npm staging @tamird
- #27319 Forward standalone assistant output to realtime @guinness-oai
- #27057 [codex] Add reusable OTEL gauge instruments @richardopenai
- #27245 image: add shared data URL preparation utilities @fjord-oai
- #27392 [codex-analytics] emit internally started turn events @marksteinbrick-oai
- #27322 [codex] Preserve build-script dependencies in rules_rs annotations @anp-oai
- #27489 core: cache turn diff rendering @nornagon-openai
- #27465 [codex] Remove redundant plugin app auth state @xl-openai
- #27484 Remove TUI legacy core test_support dependencies @etraut-openai
- #27476 Add session delete commands in CLI and TUI @etraut-openai
- #27247 core: resize all history images behind a feature flag @fjord-oai
- #27487 Trim TUI legacy telemetry and migration dependencies @etraut-openai
- #27438 [codex] Add token budget context feature @pakrym-oai
- #27501 [codex] Expand hosted web search citation guidance @yuning-oai
- #27526 tools: simplify default tool search text @sayan-oai
- #27488 [codex] Add new context window tool @pakrym-oai
- #27443 feat: add Bedrock API key as a managed auth mode @celia-oai
- #27532 [codex] Add comp_hash to model metadata @aibrahim-oai
- #27246 core: strip image detail from Responses Lite requests @fjord-oai
- #27517 [codex] Pass auth mode to plugin manager @xl-openai
- #27520 [codex] Compact when comp_hash changes @aibrahim-oai
- #27518 [codex] Add context remaining tool @pakrym-oai
- #27266 image: preserve metadata when resizing prompt images @fjord-oai
- #27103 [codex-analytics] report cached input tokens for v2 compaction @rhan-oai
- #27356 Use generic search metadata for dynamic tools @sayan-oai
- #27082 [codex-analytics] Emit structured compaction codex errors @rhan-oai
- #26513 [codex] Tune cloud config cache intervals @alexsong-oai
- #27387 skills: make backend plugin skills invocable without an executor @jif-oai
- #27403 skills: cache remote catalog failures per thread @jif-oai
- #27573 core: enable remote compaction v2 by default @jif-oai
- #27388 skills: expose remote skill resource tools @jif-oai
- #27569 multi-agent: move concurrency guidance into v2 usage hints @jif-oai
- #27585 nit: cap error @jif-oai
- #27404 test: cover referenced backend skill reads without an executor @jif-oai
- #27591 skills: render catalog locators by authority @jif-oai
- #27413 skills: decouple the skills extension from core @jif-oai
- #27527 [codex] publish npm packages concurrently @tamird
- #27528 [codex] publish DotSlash alongside npm @tamird
- #27529 [codex] download only release artifacts @tamird
- #27490 Remove TUI legacy Windows sandbox dependency @etraut-openai
- #27483 Emit plugin ID on MCP tool call analytics events @chrisdong-oai
- #27417 Print TUI session info on fatal exits @etraut-openai
- #27507 lint: allow self-documenting builder arguments @anp-oai
- #27420 [codex] Propagate plugin app categories @charlesgong-openai
- #27454 [codex] add cross-platform filesystem adapter coverage @anp-oai
- #27415 [codex] Surface runtime warnings in codex exec @anp-oai
- #27639 [codex] revert concurrent npm publishing @tamird
- #27646 feat: disable orchestrator skills for now @jif-oai
- #27323 [codex] Provide ARM64 MinGW powl compatibility support @anp-oai
- #27433 [codex] remove EnvironmentPathRef @anp-oai
- #27424 [codex] migrate ExecutorFileSystem paths to PathUri @anp-oai
- #27101 [codex] Load user instructions through an injected provider @anp-oai
- #27634 Resolve MCP server registrations through a catalog @jif-oai
- #27122 core: Consolidate Responses API Codex metadata @owenlin0
- #27450 [codex-rs] enforce PAT workspace restrictions @cooper-oai
- #27653 [codex] migrate exec-server filesystem protocol to PathUri @anp-oai
- #27663 Include thread id in token budget context @pakrym-oai
- #26418 [codex] Avoid duplicate hooks.json discovery with profiles @abhinav-oai
- #27689 feat: prefer managed Bedrock auth in model provider @celia-oai
- #27700 Remove fs/join and fs/parent from exec-server protocol @anp-oai
- #26426 Warn when hooks.json has unsupported top-level fields @abhinav-oai
- #27318 [codex] Move persistence policy application into ThreadStore @wiltzius-openai
- #27498 Route image extension reads through turn environments v2 @won-openai
- #27623 Add spans to turn lifecycle gaps @mchen-oai
- #27619 tui: clear stale hook row after turn completion @kotakem-openai
- #27711 Fix image extension PathUri conversion @anp-oai
- #27475 [codex] Remove async_trait from first-party code @anp-oai
- #27719 fix: Recover from sqlite directory being a file @ddr-oai
- #27715 ci(v8): gate Windows source builds on relevant changes @cconger
- #27702 [codex] parallelize release code generation @tamird
- #27709 [codex] resolve environment shell metadata eagerly @pakrym-oai
- #27445 feat(app-server): persist remote-control desired state @apanasenko-oai
- #27508 [1 of 3] Support long raw TUI goal objectives @etraut-openai
- #27256 Add request_user_input auto-resolution window contract @shijie-oai
- #27724 code-mode standalone: extract protocol and add host crate @cconger
- #27778 Translate non-English issues @etraut-openai
- #27316 Keep request_user_input direct-model only @shijie-oai
- #27696 [codex] Load AGENTS.md from all bound environments @anp-oai
- #27670 Make MCP server contributions thread-scoped @jif-oai
- #27732 [code-mode] Reject remote image URLs from output helpers @rka-oai
- #27692 Add executor-owned plugin resolution @jif-oai
- #27863 Extract shared plugin MCP config parsing @jif-oai
- #27703 [codex] restore source-specific import copy @stefanstokic-oai
- #27879 fix: serialize auth environment tests @jif-oai
- #27791 Reject transcript backtrack in side conversations @etraut-openai
- #27075 [ez][codex-rs] Support approvals reviewer in app defaults @zamoshchin-openai
- #27538 Use dependency groups for Python SDK tooling @charliemarsh-oai
- #27783 Persist update dismissal without cache @etraut-openai
- #27814 tui: Allow extra o's in /goal command @btraut-openai
- #27901 Use uv as Python SDK build backend @charliemarsh-oai
- #27720 realtime: add AVAS architecture override @bakks
- #27919 chore: prompt MAv2 @jif-oai
- #27816 sandboxing: migrate cwd inputs to PathUri @anp-oai
- #27890 [codex] expose remote plugin share URL @ericning-o
- #27913 [codex] unify apply patch parsing @pakrym-oai
- #27920 Handle standalone image generation failures as terminal items @won-openai
- #27927 [codex] Add size to internal filesystem metadata @pakrym-oai
- #27504 feat: add secret auth storage configuration @celia-oai
- #27674 [login] revoke existing auth before starting login @cooper-oai
- #27535 feat: add auth-specific encrypted secret namespaces @celia-oai
- #27939 [codex] Add crate API surface review rule @pakrym-oai
- #27926 [codex] Align implicit skill reads with parser @alexsong-oai
- #23254 fix(plugins) rm plugin descriptions @dylan-hurd-oai
- #27830 Support plaintext agent messages @jif-oai
- #27801 Remove TUI realtime voice support @etraut-openai
- #27539 feat: use encrypted local secrets for CLI auth @celia-oai
- #27076 Warn for structured feature toggles @canvrno-oai
- #27541 feat: use encrypted local secrets for MCP OAuth @celia-oai
- #27936 [codex] add roles to realtime append text @agamble-oai
- #27509 [2 of 3] Support long pasted text in TUI goals @etraut-openai
- #27109 Add Guardian catalog diagnostics metadata @won-openai
- #27966 Specify platform support in AGENTS.md @anp-oai
- #27855 [codex] parallelize Windows compression @tamird
- #27499 Promote TUI unified mentions in composer to default mentions feature @canvrno-oai
- #27972 [codex] Let generic test turns inherit their environment @pakrym-oai
- #27856 [codex] package Windows symbols in parallel @tamird
- #27976 [codex] make PathUri::from_abs_path infallible @anp-oai
- #27854 [codex] parallelize Windows package archives @tamird
- #27853 [codex] stage npm packages concurrently @tamird
- #27710 [codex] add latency tracing spans @rphilizaire-openai
- #27510 [3 of 3] Support images in TUI goals @etraut-openai
- #27925 feat(tui): reland token activity command @fcoury-oai
- #27988 [codex] Limit app-based plugin suggestions to remote catalogs @xl-openai
- #27652 [codex] Add auth mode to plugin manager constructor @felixxia-oai
- #27964 [codex] Add hermetic Wine test support @anp-oai
- #27459 [codex] Gate plugin MCP servers by auth route @felixxia-oai
- #27961 feat(app-server): enforce managed remote control disable @apanasenko-oai
- #27937 [codex] Add hermetic Wine exec-server test @anp-oai
- #27996 [codex] Send request-scoped turn state over WebSocket @aibrahim-oai
- #28002 [codex] Send turn state through compact requests @aibrahim-oai
* Seed Termux release automation
* Prepare Termux rust-v0.140.0
* Release 0.141.0-alpha.3
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.3
* Release 0.141.0-alpha.5
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.5
* Release 0.141.0-alpha.6
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.6
* Release 0.141.0-alpha.7
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.7
* checkpoint: into wallentx/termux-target from release/0.141.0 @ 512c55a29a8f (#242)
* ## New Features
- Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
- Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
- Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
- App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
- Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
- TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
## Bug Fixes
- Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
- Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
- Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
- Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
- Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
- TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
## Chores
- Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
- Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
- Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.140.0...rust-v0.141.0
- #28001 [codex] package Windows ARM64 on x64 @tamird
- #28032 [codex] Carry exec-server cwd as PathUri @anp-oai
- #27607 [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
- #27992 [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
- #28125 build: run buildifier from just fmt @anp-oai
- #28120 bazel: add PowerShell to Wine test harness @anp-oai
- #27819 path-uri: render native paths across platforms @anp-oai
- #28122 [codex] exec-server honors remote environment cwd and shell @anp-oai
- #26662 feat(app-server): filter threads by parent @btraut-openai
- #27884 Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
- #27870 Discover stdio MCP servers from selected executor plugins @jif-oai
- #28283 [codex] update multi-agent v2 prompts @jif-oai
- #27602 [codex] Preserve plugin apps in connector listings @felixxia-oai
- #27461 [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
- #27893 Activate selected executor plugin MCPs in app-server @jif-oai
- #28332 [codex] Cap feedback upload subtrees @jif-oai
- #27365 Represent dynamic tools with explicit namespaces internally @sayan-oai
- #28333 skills: hide orchestrator skills with a local executor @jif-oai
- #27756 [codex] simplify shell snapshot ownership @pakrym-oai
- #27794 Remove terminal resize reflow flag gates @etraut-openai
- #28286 chore: restore exec-server relay keepalives @jif-oai
- #28164 [codex] simplify memory read metrics @pakrym-oai
- #27371 Expose explicit dynamic tool namespaces in thread start @sayan-oai
- #28309 linearize history output normalization @jif-oai
- #28306 avoid cloning sampling request input @jif-oai
- #28323 serialize websocket requests directly @jif-oai
- #28313 avoid cloning websocket request history @jif-oai
- #28344 [codex] remove stale PathExt import @pakrym-oai
- #27059 [codex] Cover OTLP HTTP log and trace event export @richardopenai
- #28327 reuse encoded Responses request bodies @jif-oai
- #27995 [codex] preserve explicit environment cwd @pakrym-oai
- #28285 guardian: isolate review context from skills and memories @jif-oai
- #26702 TUI Plugin Sharing 2 - add remote plugin section plumbing @canvrno-oai
- #28294 bound prompt image cache retention @jif-oai
- #28257 Support staging OAuth client ID overrides @apanasenko-oai
- #28341 core: let steer interrupt wait_agent @jif-oai
- #28336 skills: cache orchestrator resources per thread @jif-oai
- #28357 Extract shared Windows sandbox session runner @iceweasel-oai
- #27706 Use aws-lc-rs for rustls crypto provider @malsamiri-oai
- #28347 [codex] add path-types skill @anp-oai
- #28235 Add request user input auto-resolution timer @shijie-oai
- #28234 [mcp] Increase default tool timeout to 300 seconds @adaley-openai
- #28008 [codex] Add external agent import result accounting @charlesgong-openai
- #27944 recover stale Windows sandbox credentials @iceweasel-oai
- #27086 Add Windows unified exec yield floor @iceweasel-oai
- #28358 Add hidden Windows sandbox wrapper entrypoint @iceweasel-oai
- #27258 core: cache the tool search handler per session @mchen-oai
- #28143 feat(app-server): expose rate-limit reset credits @jayp-oai
- #28355 feat(core): add metadata field to ResponseItem @owenlin0
- #28203 [codex] Add created-by-me remote plugin marketplace @ericning-o
- #28365 Respect blocking PostToolUse hooks in code mode @abhinav-oai
- #27813 [codex] Reuse Apps policy evaluation across MCP tool exposure @mzeng-openai
- #28300 Deflake realtime handoff steering test @felixxia-oai
- #28395 [codex] Preserve remote plugin directory order @jameswt-oai
- #27955 [codex] retain resolved environments across turns @pakrym-oai
- #27917 Add realtime speech append control @guinness-oai
- #27093 [codex-analytics] Analytics Capture to File in Debug Builds @jameswt-oai
- #26242 exec-server: add Noise relay transport @viyatb-oai
- #28165 Use PathUri in filesystem permission paths for exec-server @anp-oai
- #28415 [codex] Fix missing response item metadata in tests @adaley-openai
- #27058 [codex] Add second-based OTEL duration histograms @richardopenai
- #27902 [codex] Centralize plugin auth capability filtering @felixxia-oai
- #28405 Add a toggle for realtime startup context @guinness-oai
- #26434 Preserve hook trust bypass in codex exec threads @abhinav-oai
- #26245 exec-server: default remote transport to Noise @viyatb-oai
- #28383 [codex] Load API curated marketplace by auth @felixxia-oai
- #27958 [codex] Make plugin details capability aware @felixxia-oai
- #28367 Use ApiPathString in app-server filesystem permission paths @anp-oai
- #28421 [codex] Bind shell snapshots to retained thread environments @pakrym-oai
- #28429 [codex] Add interruptible sleep tool @pakrym-oai
- #28441 [codex] Use expect in integration tests @pakrym-oai
- #28163 [codex] Use local environment for user shell commands @pakrym-oai
* Seed Termux release automation
* Prepare Termux rust-v0.141.0
---------
Co-authored-by: sayan-oai <sayan@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ 8f4b05f9cc47 (#244)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
representation
- restore Wine coverage for retained Windows cwd values and successful
completion
* [codex] Split plugin and skill warmup tracing (#28605)
## What changed
- promote plugin config loading to an info-level `plugins_for_config`
span
- promote skill config loading to an info-level `skills_for_config` span
- attach stable OpenTelemetry names to both spans
## Why
`session_init.plugin_skill_warmup` currently combines plugin loading and
skill loading, which makes cold-start traces unable to identify which
phase dominates. These child spans preserve the existing aggregate while
making the two costs independently visible.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
This is observability-only. It does not change plugin or skill loading
behavior.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins` (347 passed)
- `just fmt`
* [codex] Pass plugin namespace into skill loading (#28608)
## What changed
- retain the parsed plugin manifest namespace on loaded plugins
- carry that namespace through `PluginSkillRoot` and `SkillRoot`
- use the provided namespace when qualifying plugin skill names
- include the namespace in the skills cache key
## Why
Plugin loading has already parsed `plugin.json`, but skill parsing
currently walks every `SKILL.md` ancestor and probes/reads the manifest
again to reconstruct the same namespace. Passing the parsed namespace
removes those repeated filesystem calls, which are particularly costly
on remote filesystems.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
Plugin skill names remain unchanged. A regression test uses a
deliberately different on-disk manifest name to verify that plugin roots
use the provided parsed namespace.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins` (352 passed)
- `just fix -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins`
- `just fmt`
* [codex] add rollout token budget configuration (varlength 1/N) (#28746)
## What
This PR defines the structured configuration contract for shared rollout
token budgets (across ALL agent threads under 1 rollout).
```toml
[features.rollout_budget]
enabled = true
limit_tokens = 100000
reminder_interval_tokens = 10000
sampling_token_weight = 1.0
prefill_token_weight = 0.1
```
The reminder interval defaults to 10% of the rollout limit. Sampling and
prefill weights default to `1.0`.
## Scope
This PR only defines and validates configuration. It does not track
usage, inject reminders, or stop a rollout. Accounting and reminders are
implemented in the stacked follow-up #28494.
The existing `token_budget` feature remains unchanged. `rollout_budget`
has its own feature key and configuration type.
## Tests
The config test verifies that the structured fields resolve into
`RolloutBudgetConfig` and do not enable the existing `token_budget`
feature.
Local checks:
- `just write-config-schema`
- `just test -p codex-core load_config_resolves_rollout_budget`
- `cargo check -p codex-thread-manager-sample`
- `git diff --check`
The full workspace test suite was not run locally.
* Add network environment ID plumbing (#28766)
## Why
Prepare network approval scoping to distinguish execution environments
without changing behavior yet.
## What changed
- Add optional environment IDs to network policy requests.
- Add optional network environment IDs to exec and sandbox request
structs.
- Thread default None values through existing construction points.
- Fix stale constructor call sites that caused the CI compile failures.
## Not included
- Per-environment proxy listeners.
- Network approval cache or prompt behavior changes.
- Ambiguous request attribution handling.
Those behavior changes moved to stacked follow-up #28899.
## Validation
- just fmt
- CI will run tests and clippy
* Avoid sandbox helper in apply_patch approval tests (#28915)
## Summary
This keeps the apply_patch approval tests focused on approval behavior
instead of macOS sandboxed filesystem helper startup.
The changed cases still force patch approval with `UnlessTrusted`, but
use `DangerFullAccess` after approval so the patch write is direct and
cheap. Workspace-write and sandbox-helper behavior remain covered by the
filesystem and apply_patch sandbox tests.
* Pause active goals before TUI interrupts (#28813)
Fixes #28104.
## Summary
Active `/goal` turns should leave the persisted goal paused whenever the
TUI interrupts the running turn. The bug in #28104 showed this most
visibly through `Esc`: some interrupt paths aborted the turn without
updating the goal status, so the goal could remain active and continue
automatically.
This change makes `ChatWidget` pause an active goal before the TUI sends
an interrupt from the status-row path, the pending-steer path, `Ctrl+C`,
or a request-user-input overlay. The modal overlay now reports whether a
key will interrupt the turn, which keeps modal `Esc` and `Ctrl+C`
behavior aligned with the normal interrupt paths.
## Manual Testing
Built the local CLI with `just codex --help`, then launched the local
TUI with goals enabled. Started an active `/goal` turn and interrupted
it with `Esc`, then resumed and repeated with `Ctrl+C`; both paths
showed `Goal paused`, the interrupted-conversation message, and the
`Goal paused (/goal resume)` footer. I also stopped the background
terminal and exited the TUI cleanly after the run.
I did not find a reliable standalone manual path to force the
request-user-input overlay case, so that path is covered by the focused
automated test.
* Recover exec process stdin writes (#28895)
## Summary
Remote stdio MCP servers send tool calls by writing JSON-RPC bytes
through `process/write`.
When the exec-server websocket drops at the wrong time, the remote
process can survive session recovery, but the stdin write can still fail
back to RMCP as a transport send error. RMCP then closes the stdio MCP
transport, so tools like `node_repl` are lost even though the
process/session recovery path is working.
This changes `process/write` to be safe to retry across exec-server
recovery:
- adds a required `writeId` to `process/write`
- retries remote `Session::write` with the same `writeId` after
reconnect
- remembers accepted write ids per process so duplicate retries return
`Accepted` without writing the same bytes to child stdin again
- covers both the client retry path and server-side write id dedupe with
tests
In simple terms:
```text
before:
write to MCP stdin -> websocket closes -> write errors -> RMCP closes node_repl
after:
write to MCP stdin -> websocket closes -> reconnect -> retry same writeId
server either writes once or recognizes it already did
```
* Pin Windows argument lint to Windows 2022 (#28940)
## What
Run the Windows argument-comment-lint job on the `windows-2022` hosted
runner instead of the custom Windows runner pool.
## Why
The custom pool recently moved from the Visual Studio 2022 Windows image
to `windows-2025-vs2026`. Since that migration, the job fails while
Bazel materializes LLVM external repository sources, before the argument
lint itself runs. The same failure appears across unrelated PRs.
This narrow change tests GitHub’s recommended mitigation for workloads
that still require the Visual Studio 2022 image:
https://github.com/actions/runner-images/issues/14017
## How
Use the standard `windows-2022` runner for only the Windows
argument-comment-lint matrix entry. No product code or lint behavior
changes.
* Scope MCP sandbox metadata to server environment (#28914)
Scope MCP sandbox metadata to the MCP server's owning environment.
Previously, `codex/sandbox-state-meta` always used the turn's primary
cwd and rebuilt a legacy sandbox policy from that cwd. That can be wrong
for MCP servers owned by a different execution environment.
This now sends the owning environment cwd as a `file:` URI in
`sandboxCwd`, keeps `permissionProfile` as the permission source of
truth, and omits sandbox-state metadata when a non-default server
environment is not selected for the turn. Local/default MCP servers keep
the existing fallback cwd behavior.
Tests:
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `just test -p codex-mcp`
- `just test -p codex-core mcp_sandbox_cwd`
- `cargo build -p codex-rmcp-client --bin test_stdio_server`
- `just test -p codex-core
stdio_mcp_tool_call_includes_sandbox_state_meta`
* Add turn-scoped context contributions (#28911)
## Summary
- keep context injection on a single ContextContributor trait
- split context injection into thread-scoped and turn-scoped
contribution methods
- wire turn-scoped fragments into initial context assembly so extensions
can contribute context from turn-local state
* Fix goal-first live threads missing from thread/list (#28808)
Fixes #28263.
## Why
When a thread starts with `/goal`, the goal extension can update SQLite
goal state before the thread has any user-turn rollout items.
`thread/list` and `thread/search` rely on persisted listing metadata, so
a goal-first live thread could be absent from app-server listings after
restart even though the goal itself existed.
This regressed when goal handling moved out of core: the core path wrote
the goal update through the live thread rollout path, while the
extension-backed app-server path only updated goal state and emitted the
live notification.
## What
- Add `GoalSetOutcome::thread_goal_updated_item()` so the goal extension
owns the canonical `ThreadGoalUpdated` rollout item shape.
- Expose a narrow `CodexThread::append_rollout_items()` helper that
appends through the live thread and keeps derived SQLite metadata in
sync.
- When app-server sets a goal on an active live thread, persist the goal
update through that live-thread path.
- Add an app-server regression test that starts a live thread with
`thread/goal/set` and verifies it appears in state-DB-only
`thread/list`.
## Verification
- `env -u CODEX_SQLITE_HOME just test -p codex-app-server
goal_first_live_thread_appears_in_state_db_thread_list`
* [codex] Initialize exec-server OpenTelemetry at startup (#25019)
## Summary
- Initialize stderr tracing and the configured OpenTelemetry provider
for local and remote `codex exec-server` startup.
- Instrument the local and remote server entrypoints with a root runtime
span.
- Keep raw Noise environment, registration, and stream identifiers out
of exported spans while preserving them in local debug events.
- Keep telemetry setup in a focused CLI module instead of growing the
top-level command entrypoint.
## Stack
- Previous: none (`#27058` has merged)
- Next: #27466
## Validation
- `just test -p codex-exec-server --lib` (139 passed)
- `just test -p codex-cli --test exec_server` (3 passed)
- `just bazel-lock-check`
- `just fix -p codex-exec-server -p codex-cli`
- `just fmt`
---------
Co-authored-by: Richard Lee <richardlee@openai.com>
* [codex] Fix Windows sandbox runtime ACL refresh (#28943)
## Why
Codex Desktop repairs sandbox-user read/execute access for binaries
copied to `%LOCALAPPDATA%\OpenAI\Codex\bin`, but Computer Use launches
its bundled Node runtime from `%LOCALAPPDATA%\OpenAI\Codex\runtimes`.
On fresh Windows installations, `CodexSandboxUsers` may therefore be
unable to execute the bundled Node binary. The command runner starts,
but `CreateProcessAsUserW` fails with error 5 (`ACCESS_DENIED`), causing
the Node REPL to exit before Computer Use can discover applications.
This is a follow-up to #21564, which added the original runtime `bin`
ACL repair.
## What changed
- Expand the Codex Desktop runtime ACL roots from only `bin` to both
`bin` and `runtimes`.
- Apply the existing inherited read/execute ACL repair to each runtime
directory when it exists.
- Rename the setup helper to reflect that it now handles multiple
runtime paths.
## Validation
- `cargo fmt -- --check`
- `just test -p codex-windows-sandbox` was run: 113 tests passed and
five environment-dependent legacy execution tests failed because
`CreateRestrictedToken` returned error 87.
* Synchronize realtime notification test requests (#28946)
## What
Deliver the scripted realtime notification batch after the assistant
text append request instead of after the preceding developer text append
request.
## Why
The batch ends with an upstream error that closes the realtime
conversation. When it is emitted after the developer append, it races
the subsequent assistant append: the app-server RPC can acknowledge the
append before its downstream WebSocket send completes, and the test
intermittently observes three requests instead of four.
Making the fake server wait for the assistant append before emitting the
terminal batch establishes the ordering the test asserts without sleeps
or production-code changes.
## Validation
- `git diff --check`
- CI (the failure is timing-dependent and most reproducible in the
Windows Bazel shard)
* Add Config for Time Reminders (varlatency 1/n) (#28822)
## Summary
Example:
> [features.current_time_reminder]
enabled = true
reminder_interval_model_requests = 1
clock_source = "system"
## Testing
- `just test -p codex-core varlatency`
- `just test -p codex-core
lock_contains_prompts_and_materializes_features`
- `just fix -p codex-core -p codex-config -p codex-features`
* [codex] rollout budget implementation (varlength 2/N) (#28494)
## Stack
Depends on #28746. This PR implements shared rollout-budget accounting
and model-visible reminders using the configuration defined in #28746.
# Description / Main changes to Core:
`AgentControl` will now be the area where "rollout level" features &
accounting will have to live. It is incorrectly named for this
responsibility, but I think it can hold all the necessary shared state &
features (rollout token budget, mutliple thread interruption
responsibilitym etc)
In this PR, we have one "token ledger" that each thread will subtract
from when sampling. The "charge" will occur when response.completed() is
done and the calculation will be done on the responses api usage
carrier. The calculation will weigh sampling and pre-fill tokens as
specified.
Every time the budget crosses the configured reminder threshold, a
developer message is appended before the thread's next request
This remaining budget will _always_ be restated/reminded after a
compaction event.
Expiration and fan-out interruption will be in the stacked follow-up
(and also live in Agent Control).
## Reminders
"You have weighted {session_tokens_left} tokens left in the shared
session token budget."
The first request in each thread context receives the current remainder.
Later reminders are emitted after aggregate weighted usage crosses a
configured interval. If several intervals are crossed before a thread
sends another request, Core inserts one reminder with the latest
remainder.
Compaction response usage is charged before the next context starts. The
next reminder is appended after the compaction summary, leaving the
initial context content stable.
## Tests
Integration coverage verifies:
- weighted output and non-cached input accounting
- initial and periodic reminders
- shared accounting between a root and sub-agent
- post-compaction remainder and message placement
Local checks:
- `just fmt`
- `just test -p codex-core rollout_budget`
- `git diff --check`
The full workspace test suite was not run locally.
* Support `openai/form` extended form elicitations (#27500)
# Summary
Allow App Server clients to opt into `openai/form` MCP elicitations.
* [codex] Make thread store turn filter optional (#28949)
Make `ListItemsParams::turn_id` optional so callers can list persisted
items across an entire thread or narrow the result to one turn. This
aligns the thread-store API and documentation with thread-wide item
listing while preserving the optional turn-filter behavior for
implementations.
* current time reminders impl for system clock (varlatency 2/n) (#28824)
Stacked on #28822.
## Summary
- add a host-injectable current-time provider with a built-in system
implementation
- record UTC developer reminders in history immediately before due model
requests
- keep cadence state per session and force a refresh after compaction
This does NOT include the app server client <-> server clock logic. This
PR is only for the reminder message & system clock that will be used in
prod.
## Testing
- `just test -p codex-core varlatency_`
- `just clippy -p codex-core -p codex-app-server -p codex-mcp-server -p
codex-thread-manager-sample`
- `just fmt`
* [codex] Cache plugin metadata for tool suggestions (#27812)
## Why
`built_tools` runs for every sampling request, and local plugin
discovery was repeatedly rereading plugin manifests, skills, MCP
configuration, and app declarations to build the same tool-suggest
metadata.
That source-derived metadata is stable until the existing plugin manager
reloads its cache. Runtime eligibility still needs to reflect the
current install, disable, policy, app-overlap, and authentication state.
## What changed
- Add a bounded, in-memory tool-suggest metadata cache owned by
`PluginsManager`.
- Key cached metadata by plugin identity and source, while applying
authentication routing each time the metadata is projected.
- Invalidate the metadata alongside the existing loaded-plugin cache,
including its normal configuration, marketplace refresh, and
remote-installed-plugin invalidation paths.
- Guard against an in-flight load repopulating stale metadata after
invalidation.
- Keep marketplace membership and all runtime eligibility filtering live
rather than introducing a separate catalog or revision model.
## Impact
Repeated sampling requests reuse already-loaded plugin capability
metadata while retaining the existing plugin-manager lifecycle as the
single freshness boundary.
## Validation
- `just test -p codex-core-plugins` — 252 passed
- Added focused coverage for cache invalidation and authentication
reprojection.
* apply-patch: carry paths as PathUri (#28854)
## Why
Allows the model to edit files that are hosted on a different OS than
where app-server is running.
## What
* Use `PathUri` for apply_patch-internal data structures
* Limit `PathUri` -> `AbsolutePathBuf` conversion to cases where the
inferred path convention matches the host OS, allows requiring valid
paths to pass to perms check
* Adds `PathConvention::path_segments()` for iterating over path
segments regardless of OS
* Handle cross-platform relative paths in path filename parsing for
sniffing a shell
* Ensure we can apply patches in the wine e2e test
* Add app-server current-time impl (varlatency 3/n) (#28835)
## What
Server should request:
```
{
"id": 42,
"method": "currentTime/read",
"params": {
"threadId": "11111111-1111-1111-1111-aaaaafdc2c11"
}
}
```
Client should respond with something like:
```rust
{
"id": 42,
"result": {
"currentTimeAt": 1781717655
}
}
```
## Why
Sessions configured with `clock_source = "external"` need a
thread-specific external time source before inference. The system clock
remains the default production provider.
## Validation
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-app-server --test all
current_time_read_round_trip_adds_reminder_to_model_input`
- `cargo test -p codex-app-server
first_attestation_capable_connection_for_thread_only_uses_thread_subscribers`
- `cargo test -p codex-analytics`
- `just fix -p codex-app-server-protocol`
- `just fix -p codex-app-server`
Stacked on #28824.
* Make auto-review on-request prompt more proactive (#26496)
## Why
`on-request` approval policy text is currently tuned for user-reviewed
approvals. For auto-reviewed productivity runs, likely sandbox blocks
should be escalated earlier so commands that need remote services,
authentication, or other out-of-sandbox access do not first fail or hang
inside the sandbox.
## What changed
- Adds a separate `on_request_auto_review.md` permissions prompt
selected for `AskForApproval::OnRequest` with
`ApprovalsReviewer::AutoReview`.
- Keeps the normal user-reviewed `on-request` wording unchanged.
- Makes the `When to request escalation` bullets more explicit about
likely sandbox blocks, network access, remote
auth/cluster/cloud/database access, out-of-sandbox environment access,
git operations that may write lock files, and short-timeout reruns after
likely sandbox-blocked attempts.
- Omits approved command prefix and `prefix_rule` guidance for the
auto-review on-request prompt.
- Adds prompt tests covering the auto-review path, normal on-request
wording, and inline permission request behavior.
* [codex] Remove hardcoded app ID filters (#28947)
## Summary
- remove the duplicated originator-specific connector ID denylists
- stop filtering connector directory/accessibility results and
live/cached Codex Apps MCP tools by hardcoded connector ID
- remove the now-unused `codex-login` dependency from
`codex-utils-plugins`
- update regression coverage so formerly blocked connector IDs are
preserved
## Why
The client-side policy was duplicated across crates, used opaque IDs
without ownership or expiry information, and could drift between app
listing and MCP tool behavior. Server-provided visibility,
authorization, plugin discoverability, accessibility, enabled-state
handling, and consequential-tool approval templates remain unchanged.
## Validation
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `git diff --check`
- confirmed the final diff contains no hardcoded denylist symbols
A targeted `codex-mcp` test build spent an unusually long time in local
compilation/linking. Its first attempt exposed a test-only `PartialEq`
assertion issue, which was corrected. A follow-up non-linking `cargo
check -p codex-mcp --tests` was still running when this draft was
opened; CI should provide the complete Rust validation.
* TUI: improve unified mention selection visibility (#28959)
## Summary
[@milanglacier reported in
#28653](https://github.com/openai/codex/issues/28653) that the active
mention candidate is hard to distinguish. I suspect [@binbjz’s #28500
report](https://github.com/openai/codex/issues/28500) _(where arrow-key
navigation appeared not to work)_ may describe the same presentation
problem: the selection may have been changing, but the UI was not
showing the active row clearly in their terminal. This PR makes two
small changes to the selection indication behavior:
- Reserve a two-character gutter and mark the active candidate with `> `
for color-agnostic indicator coverage.
- Apply the shared theme-aware accent to the entire selected row for
extra emphasis.
- Update the existing popup snapshot.
Reverse-video styling was considered, but avoided it because it is
overly dependent on the user’s terminal palette.
<img width="2046" height="482" alt="image"
src="https://github.com/user-attachments/assets/b5eb62c3-fd24-4c09-906e-7bd66913b5c6"
/>
## Testing
- `just test -p codex-tui default_unified_mention_popup_snapshot`
- `just clippy -p codex-tui`
- `just fmt`
- Compiled `codex-cli` and tested the unified mentions picker in the
terminal.
* Emit Trusted MCP App Identity on Tool-Call Items (#27132)
## Summary
- Add optional `appContext` to app-server MCP tool-call items with
trusted `connectorId`, `linkId`, and `mcpAppResourceUri` metadata.
- Preserve that context across tool-call events, persisted history,
reconnects, and thread resume.
- Keep the deprecated top-level `mcpAppResourceUri` temporarily for
client migration.
The consumer contract is `{ appContext: { connectorId, linkId,
mcpAppResourceUri }, tool }`.
## Validation
- Full GitHub Actions suite passes, including CLA, Bazel tests, clippy,
release builds, and argument-comment lint.
---------
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
* feat: opt ChatGPT auth into agent identity (#19049)
## Stack
This is PR 2 of the simplified HAI single-run-task stack:
- [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
assertion and task-registration primitives, including the shared
run-task helper used by existing Agent Identity JWT auth.
- [#19049](https://github.com/openai/codex/pull/19049)
Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
Agent Identity runtime auth and its single run task.
- [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
provider auth that uses one backend-owned task id for first-party
inference and compaction requests.
[#19054](https://github.com/openai/codex/pull/19054) collapsed out of
the active stack because the simplified design no longer needs a
separate background/control-plane task helper.
## Summary
This PR adds the disabled-by-default path for normal ChatGPT-login Codex
sessions to obtain Agent Identity runtime auth through the Codex
backend. Existing Agent Identity JWT startup mode remains a separate
path and does not require the feature flag.
What changed:
- adds the experimental `use_agent_identity` feature flag and config
schema entry
- adds an explicit `AgentIdentityAuthPolicy` so call sites choose
`JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
- stores standalone Agent Identity JWT credentials separately from
backend-registered Agent Identity records
- persists the registered Agent Identity record, private key, and single
run task id in `auth.json` so process restarts reuse the same identity
- derives the agent/task registration base URL from ChatGPT/Codex auth
config while keeping JWT JWKS lookup separate
- provisions and caches ChatGPT-derived Agent Identity runtime auth when
`use_agent_identity` is enabled
- reuses the shared run-task registration helper from PR1 rather than
adding a second task-registration path
This PR intentionally does not switch model inference over to
`AgentAssertion` auth. The provider-auth integration lands in the next
PR.
## Testing
- `just test -p codex-login`
* [connectors] Ignore synthetic links for app accessibility (#28770)
Summary
- Stop treating Codex Apps MCP tools with
`_meta._codex_apps.synthetic_link: true` as evidence that a connector is
accessible in `app/list`.
- Preserve synthetic tools in the agent-facing MCP connector set so they
remain available for install/auth flows.
- Keep the app-list accessibility cache limited to connectors backed by
at least one non-synthetic tool.
- Add focused regression coverage for both sides of the boundary.
Validation
- `just fmt`
- `just test -p codex-core
synthetic_links_are_exposed_to_the_agent_but_not_accessible_in_app_list`
- `git diff --check`
- A crate-wide `just test -p codex-core` run completed with 2,699
passing and 51 unrelated local sandbox/state failures, primarily state
DB migration races (`UNIQUE constraint failed:
_sqlx_migrations.version`).
* [codex] Preserve remote plugin download status errors (#28863)
## Summary
- preserve the original HTTP status when a remote plugin bundle download
returns a non-success response
- retain at most 8 KiB of the error response body and annotate
truncation or body-read failures
- add regression coverage for an oversized error response
## Root cause
The non-success response path reused the normal size-limited body
reader. When an error response exceeded 8 KiB, that reader returned
`DownloadTooLarge` before the code constructed `DownloadStatus`, masking
the upstream HTTP status and response context.
## Impact
Remote plugin installation failures now retain the actionable upstream
HTTP status without allowing unbounded error bodies into logs.
## Validation
- `just test -p codex-app-server
plugin_install_preserves_status_when_remote_bundle_error_body_is_too_large`
- `just fmt`
- `git diff --check`
* core: load AGENTS.md from foreign environments (#28958)
## Why
Make it possible to load AGENTS.md from remote exec-servers whose OS is
different than app-server.
## What
- keep `AGENTS.md` discovery and provenance as `PathUri`, with
root-aware parent and ancestor traversal
- expose lifecycle instruction sources as legacy app-server path strings
in events while retaining `PathUri` internally
- preserve and test mixed POSIX and Windows paths in model context and
TUI status output
- cover remote Windows loading end to end by seeding the Wine prefix
through host filesystem APIs
- fix bug in `PathUri`'s parent() implementation that would erase
Windows drive letters
* [codex] Support marketplace plugin manifest fallback (#28789)
## Summary
Support marketplace plugins whose source directory does not include a
discoverable plugin manifest. Metadata-rich `marketplace.json` entries
now act as fallback plugin manifests for listing, local detail reads,
install, and non-curated cache refresh.
The fallback preserves marketplace-entry plugin fields wholesale, then
adds the small Codex-facing compatibility bridge for presentation
metadata. A real source `plugin.json` always wins when present.
## Details
- Capture flattened marketplace-entry fields into
`MarketplacePluginManifestFallback`, preserving fields such as
`version`, `description`, `skills`, `mcpServers`, `apps`, `hooks`,
`agents`, `commands`, `strict`, `author`, and future manifest fields
without a per-field translation list.
- Bridge Claude-style top-level `displayName`, `author.name`,
`homepage`, and marketplace `category` into Codex's nested `interface`
fields only when the nested values are absent.
- Treat fallback metadata as installable only when the marketplace entry
contributes metadata beyond bare `name` and `source`; existing
missing-manifest behavior remains for metadata-free entries.
- Read local plugin details from the already parsed fallback manifest,
including fallback-declared app and MCP paths, instead of rereading only
an on-disk manifest.
- Pass fallback contents into `PluginStore`, which validates them and
injects `.codex-plugin/plugin.json` into Store's existing atomic copy.
Local marketplace source directories are never mutated, and the fallback
path no longer needs an additional staging directory.
- Keep Git source materialization unchanged; Git clones still use the
existing marketplace source staging area before Store installation.
* [codex] Remove child AGENTS.md prompt experiment (#28993)
## Why
`child_agents_md` is a disabled, under-development experiment that adds
a second model-visible explanation of hierarchical `AGENTS.md` behavior.
Keeping it leaves unused prompt, configuration, documentation, and test
surface.
## What changed
- remove the `Chil…
…nt/wallentx_termux-target_from_release_0.146.0_210d5620e56b # Conflicts: # .github/workflows/rust-release.yml # codex-rs/Cargo.toml
…et_from_release_0.146.0_210d5620e56b checkpoint: into wallentx/termux-target from release/0.146.0 @ 210d562
(cherry picked from commit 5c36e86)
* ## New Features
- Added `/usage` views for daily, weekly, and cumulative account token activity. (#27925)
- `/goal` now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#27508, #27509, #27510)
- Added permanent session deletion through `codex delete`, `/delete`, and app-server `thread/delete`, with confirmation safeguards and subagent cleanup. (#25018, #27476)
- Added `/import` for selectively importing setup, project configuration, and recent chats from Claude Code. (#27070, #27071, #27703)
- Typing `@` now opens the unified mentions menu for files, plugins, and skills by default. (#27499)
- Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#27443, #27689, #27504, #27535, #27539, #27541)
## Bug Fixes
- Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#26859, #27719)
- Prevented `/review` from crashing when `Esc` is pressed with queued guidance, while preserving that guidance when the review is canceled. (#22879)
- Improved MCP reliability by retrying transient startup failures, reporting unusable OAuth credentials as logged out, and preserving explicitly disabled servers. (#25147, #26713, #27414)
- Fixed remote plugin uninstall requests and correctly surfaced apps requiring authentication during installation. (#27085, #27223)
- Persisted “Don’t remind me” update dismissals reliably and cleared stale running-hook indicators after completed turns. (#27619, #27783)
- Non-TTY background commands can now be interrupted with Ctrl-C while preserving their final output and exit status. (#26734)
## Documentation
- Clarified contributor guidance around keeping crate APIs narrow and supporting Linux, macOS, and Windows. (#27939, #27966)
## Chores
- Improved responsiveness for large repositories and long sessions by preserving Git’s built-in filesystem monitor, avoiding duplicate history reads, accelerating archive lookup, and caching turn-diff rendering. (#26880, #27031, #27276, #27489)
- Removed the experimental `/realtime` voice controls and related audio dependencies from the TUI. (#27801)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.139.0...rust-v0.140.0
- #26880 [codex] preserve fsmonitor for worktree Git reads @tamird
- #27085 Use server app auth requirements for remote plugin install @xl-openai
- #27098 [codex] Return workspace directory installed plugins @xl-openai
- #27007 multi-agent: add path-based v2 activity tracking @jif-oai
- #27166 app-server: clear stale thread watches after v2 agent interruption @jif-oai
- #27080 [codex] Ignore pending PR review comments @anp-oai
- #26420 Avoid no-op backfill state writes @zanie-oai
- #27031 Avoid rereading rollout history during cold resume @zanie-oai
- #22879 fix: Prevent /review crash when entering Esc on steer message @canvrno-oai
- #27173 app-server: reject direct input to multi-agent v2 sub-agents @jif-oai
- #27184 Load selected executor skills through extensions @jif-oai
- #26835 [codex] Test extension API contracts @anp-oai
- #27063 [codex-analytics] add extensible feature thread sources @marksteinbrick-oai
- #26479 [codex] Speed up local nextest runs @anp-oai
- #27223 fix: use plugin service route for remote uninstall @ericning-o
- #22685 Add SOCKS5 TCP MITM coverage @winston-openai
- #26681 Allow creating a new goal after completion @etraut-openai
- #26711 Reduce TUI legacy core dependencies @etraut-openai
- #27110 [1/6] Add Python goal routing foundation @aibrahim-oai
- #27191 Route hosted Apps MCP through extensions @jif-oai
- #26830 [codex] Characterize global instruction lifecycle @anp-oai
- #26713 [codex] Report unusable MCP OAuth credentials as logged out @anp-oai
- #26734 [codex] Handle Ctrl-C for non-TTY unified exec @pakrym-oai
- #27116 Stop mirroring Codex user input into realtime @guinness-oai
- #27111 [2/6] Add private Python goal operations @aibrahim-oai
- #25147 [codex] Retry streamable HTTP initialize failures @ssetty-oai
- #27257 [codex] Tighten MCP connection manager API visibility and order @aibrahim-oai
- #26701 TUI Plugin Sharing 1 - add remote plugin identity @canvrno-oai
- #27129 feat: use provider defaults for memory models @celia-oai
- #27094 Add spans to build_tool_router @mchen-oai
- #24999 Add per-session realtime model and version overrides @guinness-oai
- #27078 [codex-analytics] emit goal lifecycle analytics @marksteinbrick-oai
- #27285 [codex] Fix post-merge analytics integration failures @anp-oai
- #27107 Add spans to run_turn @mchen-oai
- #27261 [codex] Make MCP connection startup fallible @aibrahim-oai
- #27174 feat: keep child MCP warnings out of parent transcript @jif-oai
- #27198 Use plugin-service MCP as the hosted plugin runtime @jif-oai
- #27375 [codex] Tag multi-agent spawn metrics with version @jif-oai
- #27383 Remove async-trait from extension contributors @jif-oai
- #27259 Use latest-wins MCP manager replacement @charliemarsh-oai
- #27264 [codex] Store compact window id in rollout @pakrym-oai
- #27280 [codex] add io PathUri native conversion APIs @anp-oai
- #27315 [codex] link Windows releases with LLD @tamird
- #27276 Reduce archive rollout lookup CPU @etraut-openai
- #27299 [codex] Outline ToolExecutor handler bodies @anp-oai
- #27391 Index visible thread list ordering @zanie-oai
- #27407 Fix compressed rollout search path matching @jif-oai
- #27304 [codex] Remove async_trait from ToolExecutor @anp-oai
- #26041 Add app-server background terminal process APIs @etraut-openai
- #25018 Add app-server `thread/delete` API @etraut-openai
- #26859 fix: Auto-recover from corrupted sqlite databases @ddr-oai
- #27064 [codex] remove blocking external agent migration flow @stefanstokic-oai
- #27421 [codex] Raise app-server recursion limit @anp-oai
- #27062 [codex] Retry transient Guardian review failures @kbazzi
- #27065 [codex] extract external agent import picker renderer @stefanstokic-oai
- #26409 [plugins] Inject remote_plugin_id into install elicitations @adaley-openai
- #27439 feat: make ThreadStore available on ThreadExtensionDependencies @bolinfest
- #27343 Guard core test subprocess cleanup @etraut-openai
- #27070 [codex] add external agent import picker UX @stefanstokic-oai
- #27321 [codex] Move release platform rules into bazel package @anp-oai
- #27071 [codex] add /import for external agents @stefanstokic-oai
- #27311 [codex] Skip local curated discovery for remote plugins @xl-openai
- #27414 [codex] Preserve disabled MCP servers across runtime overlays @e-provencher
- #27312 [codex] reuse release artifacts for npm staging @tamird
- #27319 Forward standalone assistant output to realtime @guinness-oai
- #27057 [codex] Add reusable OTEL gauge instruments @richardopenai
- #27245 image: add shared data URL preparation utilities @fjord-oai
- #27392 [codex-analytics] emit internally started turn events @marksteinbrick-oai
- #27322 [codex] Preserve build-script dependencies in rules_rs annotations @anp-oai
- #27489 core: cache turn diff rendering @nornagon-openai
- #27465 [codex] Remove redundant plugin app auth state @xl-openai
- #27484 Remove TUI legacy core test_support dependencies @etraut-openai
- #27476 Add session delete commands in CLI and TUI @etraut-openai
- #27247 core: resize all history images behind a feature flag @fjord-oai
- #27487 Trim TUI legacy telemetry and migration dependencies @etraut-openai
- #27438 [codex] Add token budget context feature @pakrym-oai
- #27501 [codex] Expand hosted web search citation guidance @yuning-oai
- #27526 tools: simplify default tool search text @sayan-oai
- #27488 [codex] Add new context window tool @pakrym-oai
- #27443 feat: add Bedrock API key as a managed auth mode @celia-oai
- #27532 [codex] Add comp_hash to model metadata @aibrahim-oai
- #27246 core: strip image detail from Responses Lite requests @fjord-oai
- #27517 [codex] Pass auth mode to plugin manager @xl-openai
- #27520 [codex] Compact when comp_hash changes @aibrahim-oai
- #27518 [codex] Add context remaining tool @pakrym-oai
- #27266 image: preserve metadata when resizing prompt images @fjord-oai
- #27103 [codex-analytics] report cached input tokens for v2 compaction @rhan-oai
- #27356 Use generic search metadata for dynamic tools @sayan-oai
- #27082 [codex-analytics] Emit structured compaction codex errors @rhan-oai
- #26513 [codex] Tune cloud config cache intervals @alexsong-oai
- #27387 skills: make backend plugin skills invocable without an executor @jif-oai
- #27403 skills: cache remote catalog failures per thread @jif-oai
- #27573 core: enable remote compaction v2 by default @jif-oai
- #27388 skills: expose remote skill resource tools @jif-oai
- #27569 multi-agent: move concurrency guidance into v2 usage hints @jif-oai
- #27585 nit: cap error @jif-oai
- #27404 test: cover referenced backend skill reads without an executor @jif-oai
- #27591 skills: render catalog locators by authority @jif-oai
- #27413 skills: decouple the skills extension from core @jif-oai
- #27527 [codex] publish npm packages concurrently @tamird
- #27528 [codex] publish DotSlash alongside npm @tamird
- #27529 [codex] download only release artifacts @tamird
- #27490 Remove TUI legacy Windows sandbox dependency @etraut-openai
- #27483 Emit plugin ID on MCP tool call analytics events @chrisdong-oai
- #27417 Print TUI session info on fatal exits @etraut-openai
- #27507 lint: allow self-documenting builder arguments @anp-oai
- #27420 [codex] Propagate plugin app categories @charlesgong-openai
- #27454 [codex] add cross-platform filesystem adapter coverage @anp-oai
- #27415 [codex] Surface runtime warnings in codex exec @anp-oai
- #27639 [codex] revert concurrent npm publishing @tamird
- #27646 feat: disable orchestrator skills for now @jif-oai
- #27323 [codex] Provide ARM64 MinGW powl compatibility support @anp-oai
- #27433 [codex] remove EnvironmentPathRef @anp-oai
- #27424 [codex] migrate ExecutorFileSystem paths to PathUri @anp-oai
- #27101 [codex] Load user instructions through an injected provider @anp-oai
- #27634 Resolve MCP server registrations through a catalog @jif-oai
- #27122 core: Consolidate Responses API Codex metadata @owenlin0
- #27450 [codex-rs] enforce PAT workspace restrictions @cooper-oai
- #27653 [codex] migrate exec-server filesystem protocol to PathUri @anp-oai
- #27663 Include thread id in token budget context @pakrym-oai
- #26418 [codex] Avoid duplicate hooks.json discovery with profiles @abhinav-oai
- #27689 feat: prefer managed Bedrock auth in model provider @celia-oai
- #27700 Remove fs/join and fs/parent from exec-server protocol @anp-oai
- #26426 Warn when hooks.json has unsupported top-level fields @abhinav-oai
- #27318 [codex] Move persistence policy application into ThreadStore @wiltzius-openai
- #27498 Route image extension reads through turn environments v2 @won-openai
- #27623 Add spans to turn lifecycle gaps @mchen-oai
- #27619 tui: clear stale hook row after turn completion @kotakem-openai
- #27711 Fix image extension PathUri conversion @anp-oai
- #27475 [codex] Remove async_trait from first-party code @anp-oai
- #27719 fix: Recover from sqlite directory being a file @ddr-oai
- #27715 ci(v8): gate Windows source builds on relevant changes @cconger
- #27702 [codex] parallelize release code generation @tamird
- #27709 [codex] resolve environment shell metadata eagerly @pakrym-oai
- #27445 feat(app-server): persist remote-control desired state @apanasenko-oai
- #27508 [1 of 3] Support long raw TUI goal objectives @etraut-openai
- #27256 Add request_user_input auto-resolution window contract @shijie-oai
- #27724 code-mode standalone: extract protocol and add host crate @cconger
- #27778 Translate non-English issues @etraut-openai
- #27316 Keep request_user_input direct-model only @shijie-oai
- #27696 [codex] Load AGENTS.md from all bound environments @anp-oai
- #27670 Make MCP server contributions thread-scoped @jif-oai
- #27732 [code-mode] Reject remote image URLs from output helpers @rka-oai
- #27692 Add executor-owned plugin resolution @jif-oai
- #27863 Extract shared plugin MCP config parsing @jif-oai
- #27703 [codex] restore source-specific import copy @stefanstokic-oai
- #27879 fix: serialize auth environment tests @jif-oai
- #27791 Reject transcript backtrack in side conversations @etraut-openai
- #27075 [ez][codex-rs] Support approvals reviewer in app defaults @zamoshchin-openai
- #27538 Use dependency groups for Python SDK tooling @charliemarsh-oai
- #27783 Persist update dismissal without cache @etraut-openai
- #27814 tui: Allow extra o's in /goal command @btraut-openai
- #27901 Use uv as Python SDK build backend @charliemarsh-oai
- #27720 realtime: add AVAS architecture override @bakks
- #27919 chore: prompt MAv2 @jif-oai
- #27816 sandboxing: migrate cwd inputs to PathUri @anp-oai
- #27890 [codex] expose remote plugin share URL @ericning-o
- #27913 [codex] unify apply patch parsing @pakrym-oai
- #27920 Handle standalone image generation failures as terminal items @won-openai
- #27927 [codex] Add size to internal filesystem metadata @pakrym-oai
- #27504 feat: add secret auth storage configuration @celia-oai
- #27674 [login] revoke existing auth before starting login @cooper-oai
- #27535 feat: add auth-specific encrypted secret namespaces @celia-oai
- #27939 [codex] Add crate API surface review rule @pakrym-oai
- #27926 [codex] Align implicit skill reads with parser @alexsong-oai
- #23254 fix(plugins) rm plugin descriptions @dylan-hurd-oai
- #27830 Support plaintext agent messages @jif-oai
- #27801 Remove TUI realtime voice support @etraut-openai
- #27539 feat: use encrypted local secrets for CLI auth @celia-oai
- #27076 Warn for structured feature toggles @canvrno-oai
- #27541 feat: use encrypted local secrets for MCP OAuth @celia-oai
- #27936 [codex] add roles to realtime append text @agamble-oai
- #27509 [2 of 3] Support long pasted text in TUI goals @etraut-openai
- #27109 Add Guardian catalog diagnostics metadata @won-openai
- #27966 Specify platform support in AGENTS.md @anp-oai
- #27855 [codex] parallelize Windows compression @tamird
- #27499 Promote TUI unified mentions in composer to default mentions feature @canvrno-oai
- #27972 [codex] Let generic test turns inherit their environment @pakrym-oai
- #27856 [codex] package Windows symbols in parallel @tamird
- #27976 [codex] make PathUri::from_abs_path infallible @anp-oai
- #27854 [codex] parallelize Windows package archives @tamird
- #27853 [codex] stage npm packages concurrently @tamird
- #27710 [codex] add latency tracing spans @rphilizaire-openai
- #27510 [3 of 3] Support images in TUI goals @etraut-openai
- #27925 feat(tui): reland token activity command @fcoury-oai
- #27988 [codex] Limit app-based plugin suggestions to remote catalogs @xl-openai
- #27652 [codex] Add auth mode to plugin manager constructor @felixxia-oai
- #27964 [codex] Add hermetic Wine test support @anp-oai
- #27459 [codex] Gate plugin MCP servers by auth route @felixxia-oai
- #27961 feat(app-server): enforce managed remote control disable @apanasenko-oai
- #27937 [codex] Add hermetic Wine exec-server test @anp-oai
- #27996 [codex] Send request-scoped turn state over WebSocket @aibrahim-oai
- #28002 [codex] Send turn state through compact requests @aibrahim-oai
* Seed Termux release automation
* Prepare Termux rust-v0.140.0
* Release 0.141.0-alpha.3
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.3
* Release 0.141.0-alpha.5
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.5
* Release 0.141.0-alpha.6
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.6
* Release 0.141.0-alpha.7
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.7
* checkpoint: into wallentx/termux-target from release/0.141.0 @ 512c55a29a8f (#242)
* ## New Features
- Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
- Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
- Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
- App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
- Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
- TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
## Bug Fixes
- Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
- Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
- Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
- Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
- Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
- TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
## Chores
- Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
- Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
- Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.140.0...rust-v0.141.0
- #28001 [codex] package Windows ARM64 on x64 @tamird
- #28032 [codex] Carry exec-server cwd as PathUri @anp-oai
- #27607 [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
- #27992 [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
- #28125 build: run buildifier from just fmt @anp-oai
- #28120 bazel: add PowerShell to Wine test harness @anp-oai
- #27819 path-uri: render native paths across platforms @anp-oai
- #28122 [codex] exec-server honors remote environment cwd and shell @anp-oai
- #26662 feat(app-server): filter threads by parent @btraut-openai
- #27884 Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
- #27870 Discover stdio MCP servers from selected executor plugins @jif-oai
- #28283 [codex] update multi-agent v2 prompts @jif-oai
- #27602 [codex] Preserve plugin apps in connector listings @felixxia-oai
- #27461 [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
- #27893 Activate selected executor plugin MCPs in app-server @jif-oai
- #28332 [codex] Cap feedback upload subtrees @jif-oai
- #27365 Represent dynamic tools with explicit namespaces internally @sayan-oai
- #28333 skills: hide orchestrator skills with a local executor @jif-oai
- #27756 [codex] simplify shell snapshot ownership @pakrym-oai
- #27794 Remove terminal resize reflow flag gates @etraut-openai
- #28286 chore: restore exec-server relay keepalives @jif-oai
- #28164 [codex] simplify memory read metrics @pakrym-oai
- #27371 Expose explicit dynamic tool namespaces in thread start @sayan-oai
- #28309 linearize history output normalization @jif-oai
- #28306 avoid cloning sampling request input @jif-oai
- #28323 serialize websocket requests directly @jif-oai
- #28313 avoid cloning websocket request history @jif-oai
- #28344 [codex] remove stale PathExt import @pakrym-oai
- #27059 [codex] Cover OTLP HTTP log and trace event export @richardopenai
- #28327 reuse encoded Responses request bodies @jif-oai
- #27995 [codex] preserve explicit environment cwd @pakrym-oai
- #28285 guardian: isolate review context from skills and memories @jif-oai
- #26702 TUI Plugin Sharing 2 - add remote plugin section plumbing @canvrno-oai
- #28294 bound prompt image cache retention @jif-oai
- #28257 Support staging OAuth client ID overrides @apanasenko-oai
- #28341 core: let steer interrupt wait_agent @jif-oai
- #28336 skills: cache orchestrator resources per thread @jif-oai
- #28357 Extract shared Windows sandbox session runner @iceweasel-oai
- #27706 Use aws-lc-rs for rustls crypto provider @malsamiri-oai
- #28347 [codex] add path-types skill @anp-oai
- #28235 Add request user input auto-resolution timer @shijie-oai
- #28234 [mcp] Increase default tool timeout to 300 seconds @adaley-openai
- #28008 [codex] Add external agent import result accounting @charlesgong-openai
- #27944 recover stale Windows sandbox credentials @iceweasel-oai
- #27086 Add Windows unified exec yield floor @iceweasel-oai
- #28358 Add hidden Windows sandbox wrapper entrypoint @iceweasel-oai
- #27258 core: cache the tool search handler per session @mchen-oai
- #28143 feat(app-server): expose rate-limit reset credits @jayp-oai
- #28355 feat(core): add metadata field to ResponseItem @owenlin0
- #28203 [codex] Add created-by-me remote plugin marketplace @ericning-o
- #28365 Respect blocking PostToolUse hooks in code mode @abhinav-oai
- #27813 [codex] Reuse Apps policy evaluation across MCP tool exposure @mzeng-openai
- #28300 Deflake realtime handoff steering test @felixxia-oai
- #28395 [codex] Preserve remote plugin directory order @jameswt-oai
- #27955 [codex] retain resolved environments across turns @pakrym-oai
- #27917 Add realtime speech append control @guinness-oai
- #27093 [codex-analytics] Analytics Capture to File in Debug Builds @jameswt-oai
- #26242 exec-server: add Noise relay transport @viyatb-oai
- #28165 Use PathUri in filesystem permission paths for exec-server @anp-oai
- #28415 [codex] Fix missing response item metadata in tests @adaley-openai
- #27058 [codex] Add second-based OTEL duration histograms @richardopenai
- #27902 [codex] Centralize plugin auth capability filtering @felixxia-oai
- #28405 Add a toggle for realtime startup context @guinness-oai
- #26434 Preserve hook trust bypass in codex exec threads @abhinav-oai
- #26245 exec-server: default remote transport to Noise @viyatb-oai
- #28383 [codex] Load API curated marketplace by auth @felixxia-oai
- #27958 [codex] Make plugin details capability aware @felixxia-oai
- #28367 Use ApiPathString in app-server filesystem permission paths @anp-oai
- #28421 [codex] Bind shell snapshots to retained thread environments @pakrym-oai
- #28429 [codex] Add interruptible sleep tool @pakrym-oai
- #28441 [codex] Use expect in integration tests @pakrym-oai
- #28163 [codex] Use local environment for user shell commands @pakrym-oai
* Seed Termux release automation
* Prepare Termux rust-v0.141.0
---------
Co-authored-by: sayan-oai <sayan@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ 8f4b05f9cc47 (#244)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
representation
- restore Wine coverage for retained Windows cwd values and successful
completion
* [codex] Split plugin and skill warmup tracing (#28605)
## What changed
- promote plugin config loading to an info-level `plugins_for_config`
span
- promote skill config loading to an info-level `skills_for_config` span
- attach stable OpenTelemetry names to both spans
## Why
`session_init.plugin_skill_warmup` currently combines plugin loading and
skill loading, which makes cold-start traces unable to identify which
phase dominates. These child spans preserve the existing aggregate while
making the two costs independently visible.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
This is observability-only. It does not change plugin or skill loading
behavior.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins` (347 passed)
- `just fmt`
* [codex] Pass plugin namespace into skill loading (#28608)
## What changed
- retain the parsed plugin manifest namespace on loaded plugins
- carry that namespace through `PluginSkillRoot` and `SkillRoot`
- use the provided namespace when qualifying plugin skill names
- include the namespace in the skills cache key
## Why
Plugin loading has already parsed `plugin.json`, but skill parsing
currently walks every `SKILL.md` ancestor and probes/reads the manifest
again to reconstruct the same namespace. Passing the parsed namespace
removes those repeated filesystem calls, which are particularly costly
on remote filesystems.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
Plugin skill names remain unchanged. A regression test uses a
deliberately different on-disk manifest name to verify that plugin roots
use the provided parsed namespace.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins` (352 passed)
- `just fix -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins`
- `just fmt`
* [codex] add rollout token budget configuration (varlength 1/N) (#28746)
## What
This PR defines the structured configuration contract for shared rollout
token budgets (across ALL agent threads under 1 rollout).
```toml
[features.rollout_budget]
enabled = true
limit_tokens = 100000
reminder_interval_tokens = 10000
sampling_token_weight = 1.0
prefill_token_weight = 0.1
```
The reminder interval defaults to 10% of the rollout limit. Sampling and
prefill weights default to `1.0`.
## Scope
This PR only defines and validates configuration. It does not track
usage, inject reminders, or stop a rollout. Accounting and reminders are
implemented in the stacked follow-up #28494.
The existing `token_budget` feature remains unchanged. `rollout_budget`
has its own feature key and configuration type.
## Tests
The config test verifies that the structured fields resolve into
`RolloutBudgetConfig` and do not enable the existing `token_budget`
feature.
Local checks:
- `just write-config-schema`
- `just test -p codex-core load_config_resolves_rollout_budget`
- `cargo check -p codex-thread-manager-sample`
- `git diff --check`
The full workspace test suite was not run locally.
* Add network environment ID plumbing (#28766)
## Why
Prepare network approval scoping to distinguish execution environments
without changing behavior yet.
## What changed
- Add optional environment IDs to network policy requests.
- Add optional network environment IDs to exec and sandbox request
structs.
- Thread default None values through existing construction points.
- Fix stale constructor call sites that caused the CI compile failures.
## Not included
- Per-environment proxy listeners.
- Network approval cache or prompt behavior changes.
- Ambiguous request attribution handling.
Those behavior changes moved to stacked follow-up #28899.
## Validation
- just fmt
- CI will run tests and clippy
* Avoid sandbox helper in apply_patch approval tests (#28915)
## Summary
This keeps the apply_patch approval tests focused on approval behavior
instead of macOS sandboxed filesystem helper startup.
The changed cases still force patch approval with `UnlessTrusted`, but
use `DangerFullAccess` after approval so the patch write is direct and
cheap. Workspace-write and sandbox-helper behavior remain covered by the
filesystem and apply_patch sandbox tests.
* Pause active goals before TUI interrupts (#28813)
Fixes #28104.
## Summary
Active `/goal` turns should leave the persisted goal paused whenever the
TUI interrupts the running turn. The bug in #28104 showed this most
visibly through `Esc`: some interrupt paths aborted the turn without
updating the goal status, so the goal could remain active and continue
automatically.
This change makes `ChatWidget` pause an active goal before the TUI sends
an interrupt from the status-row path, the pending-steer path, `Ctrl+C`,
or a request-user-input overlay. The modal overlay now reports whether a
key will interrupt the turn, which keeps modal `Esc` and `Ctrl+C`
behavior aligned with the normal interrupt paths.
## Manual Testing
Built the local CLI with `just codex --help`, then launched the local
TUI with goals enabled. Started an active `/goal` turn and interrupted
it with `Esc`, then resumed and repeated with `Ctrl+C`; both paths
showed `Goal paused`, the interrupted-conversation message, and the
`Goal paused (/goal resume)` footer. I also stopped the background
terminal and exited the TUI cleanly after the run.
I did not find a reliable standalone manual path to force the
request-user-input overlay case, so that path is covered by the focused
automated test.
* Recover exec process stdin writes (#28895)
## Summary
Remote stdio MCP servers send tool calls by writing JSON-RPC bytes
through `process/write`.
When the exec-server websocket drops at the wrong time, the remote
process can survive session recovery, but the stdin write can still fail
back to RMCP as a transport send error. RMCP then closes the stdio MCP
transport, so tools like `node_repl` are lost even though the
process/session recovery path is working.
This changes `process/write` to be safe to retry across exec-server
recovery:
- adds a required `writeId` to `process/write`
- retries remote `Session::write` with the same `writeId` after
reconnect
- remembers accepted write ids per process so duplicate retries return
`Accepted` without writing the same bytes to child stdin again
- covers both the client retry path and server-side write id dedupe with
tests
In simple terms:
```text
before:
write to MCP stdin -> websocket closes -> write errors -> RMCP closes node_repl
after:
write to MCP stdin -> websocket closes -> reconnect -> retry same writeId
server either writes once or recognizes it already did
```
* Pin Windows argument lint to Windows 2022 (#28940)
## What
Run the Windows argument-comment-lint job on the `windows-2022` hosted
runner instead of the custom Windows runner pool.
## Why
The custom pool recently moved from the Visual Studio 2022 Windows image
to `windows-2025-vs2026`. Since that migration, the job fails while
Bazel materializes LLVM external repository sources, before the argument
lint itself runs. The same failure appears across unrelated PRs.
This narrow change tests GitHub’s recommended mitigation for workloads
that still require the Visual Studio 2022 image:
https://github.com/actions/runner-images/issues/14017
## How
Use the standard `windows-2022` runner for only the Windows
argument-comment-lint matrix entry. No product code or lint behavior
changes.
* Scope MCP sandbox metadata to server environment (#28914)
Scope MCP sandbox metadata to the MCP server's owning environment.
Previously, `codex/sandbox-state-meta` always used the turn's primary
cwd and rebuilt a legacy sandbox policy from that cwd. That can be wrong
for MCP servers owned by a different execution environment.
This now sends the owning environment cwd as a `file:` URI in
`sandboxCwd`, keeps `permissionProfile` as the permission source of
truth, and omits sandbox-state metadata when a non-default server
environment is not selected for the turn. Local/default MCP servers keep
the existing fallback cwd behavior.
Tests:
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `just test -p codex-mcp`
- `just test -p codex-core mcp_sandbox_cwd`
- `cargo build -p codex-rmcp-client --bin test_stdio_server`
- `just test -p codex-core
stdio_mcp_tool_call_includes_sandbox_state_meta`
* Add turn-scoped context contributions (#28911)
## Summary
- keep context injection on a single ContextContributor trait
- split context injection into thread-scoped and turn-scoped
contribution methods
- wire turn-scoped fragments into initial context assembly so extensions
can contribute context from turn-local state
* Fix goal-first live threads missing from thread/list (#28808)
Fixes #28263.
## Why
When a thread starts with `/goal`, the goal extension can update SQLite
goal state before the thread has any user-turn rollout items.
`thread/list` and `thread/search` rely on persisted listing metadata, so
a goal-first live thread could be absent from app-server listings after
restart even though the goal itself existed.
This regressed when goal handling moved out of core: the core path wrote
the goal update through the live thread rollout path, while the
extension-backed app-server path only updated goal state and emitted the
live notification.
## What
- Add `GoalSetOutcome::thread_goal_updated_item()` so the goal extension
owns the canonical `ThreadGoalUpdated` rollout item shape.
- Expose a narrow `CodexThread::append_rollout_items()` helper that
appends through the live thread and keeps derived SQLite metadata in
sync.
- When app-server sets a goal on an active live thread, persist the goal
update through that live-thread path.
- Add an app-server regression test that starts a live thread with
`thread/goal/set` and verifies it appears in state-DB-only
`thread/list`.
## Verification
- `env -u CODEX_SQLITE_HOME just test -p codex-app-server
goal_first_live_thread_appears_in_state_db_thread_list`
* [codex] Initialize exec-server OpenTelemetry at startup (#25019)
## Summary
- Initialize stderr tracing and the configured OpenTelemetry provider
for local and remote `codex exec-server` startup.
- Instrument the local and remote server entrypoints with a root runtime
span.
- Keep raw Noise environment, registration, and stream identifiers out
of exported spans while preserving them in local debug events.
- Keep telemetry setup in a focused CLI module instead of growing the
top-level command entrypoint.
## Stack
- Previous: none (`#27058` has merged)
- Next: #27466
## Validation
- `just test -p codex-exec-server --lib` (139 passed)
- `just test -p codex-cli --test exec_server` (3 passed)
- `just bazel-lock-check`
- `just fix -p codex-exec-server -p codex-cli`
- `just fmt`
---------
Co-authored-by: Richard Lee <richardlee@openai.com>
* [codex] Fix Windows sandbox runtime ACL refresh (#28943)
## Why
Codex Desktop repairs sandbox-user read/execute access for binaries
copied to `%LOCALAPPDATA%\OpenAI\Codex\bin`, but Computer Use launches
its bundled Node runtime from `%LOCALAPPDATA%\OpenAI\Codex\runtimes`.
On fresh Windows installations, `CodexSandboxUsers` may therefore be
unable to execute the bundled Node binary. The command runner starts,
but `CreateProcessAsUserW` fails with error 5 (`ACCESS_DENIED`), causing
the Node REPL to exit before Computer Use can discover applications.
This is a follow-up to #21564, which added the original runtime `bin`
ACL repair.
## What changed
- Expand the Codex Desktop runtime ACL roots from only `bin` to both
`bin` and `runtimes`.
- Apply the existing inherited read/execute ACL repair to each runtime
directory when it exists.
- Rename the setup helper to reflect that it now handles multiple
runtime paths.
## Validation
- `cargo fmt -- --check`
- `just test -p codex-windows-sandbox` was run: 113 tests passed and
five environment-dependent legacy execution tests failed because
`CreateRestrictedToken` returned error 87.
* Synchronize realtime notification test requests (#28946)
## What
Deliver the scripted realtime notification batch after the assistant
text append request instead of after the preceding developer text append
request.
## Why
The batch ends with an upstream error that closes the realtime
conversation. When it is emitted after the developer append, it races
the subsequent assistant append: the app-server RPC can acknowledge the
append before its downstream WebSocket send completes, and the test
intermittently observes three requests instead of four.
Making the fake server wait for the assistant append before emitting the
terminal batch establishes the ordering the test asserts without sleeps
or production-code changes.
## Validation
- `git diff --check`
- CI (the failure is timing-dependent and most reproducible in the
Windows Bazel shard)
* Add Config for Time Reminders (varlatency 1/n) (#28822)
## Summary
Example:
> [features.current_time_reminder]
enabled = true
reminder_interval_model_requests = 1
clock_source = "system"
## Testing
- `just test -p codex-core varlatency`
- `just test -p codex-core
lock_contains_prompts_and_materializes_features`
- `just fix -p codex-core -p codex-config -p codex-features`
* [codex] rollout budget implementation (varlength 2/N) (#28494)
## Stack
Depends on #28746. This PR implements shared rollout-budget accounting
and model-visible reminders using the configuration defined in #28746.
# Description / Main changes to Core:
`AgentControl` will now be the area where "rollout level" features &
accounting will have to live. It is incorrectly named for this
responsibility, but I think it can hold all the necessary shared state &
features (rollout token budget, mutliple thread interruption
responsibilitym etc)
In this PR, we have one "token ledger" that each thread will subtract
from when sampling. The "charge" will occur when response.completed() is
done and the calculation will be done on the responses api usage
carrier. The calculation will weigh sampling and pre-fill tokens as
specified.
Every time the budget crosses the configured reminder threshold, a
developer message is appended before the thread's next request
This remaining budget will _always_ be restated/reminded after a
compaction event.
Expiration and fan-out interruption will be in the stacked follow-up
(and also live in Agent Control).
## Reminders
"You have weighted {session_tokens_left} tokens left in the shared
session token budget."
The first request in each thread context receives the current remainder.
Later reminders are emitted after aggregate weighted usage crosses a
configured interval. If several intervals are crossed before a thread
sends another request, Core inserts one reminder with the latest
remainder.
Compaction response usage is charged before the next context starts. The
next reminder is appended after the compaction summary, leaving the
initial context content stable.
## Tests
Integration coverage verifies:
- weighted output and non-cached input accounting
- initial and periodic reminders
- shared accounting between a root and sub-agent
- post-compaction remainder and message placement
Local checks:
- `just fmt`
- `just test -p codex-core rollout_budget`
- `git diff --check`
The full workspace test suite was not run locally.
* Support `openai/form` extended form elicitations (#27500)
# Summary
Allow App Server clients to opt into `openai/form` MCP elicitations.
* [codex] Make thread store turn filter optional (#28949)
Make `ListItemsParams::turn_id` optional so callers can list persisted
items across an entire thread or narrow the result to one turn. This
aligns the thread-store API and documentation with thread-wide item
listing while preserving the optional turn-filter behavior for
implementations.
* current time reminders impl for system clock (varlatency 2/n) (#28824)
Stacked on #28822.
## Summary
- add a host-injectable current-time provider with a built-in system
implementation
- record UTC developer reminders in history immediately before due model
requests
- keep cadence state per session and force a refresh after compaction
This does NOT include the app server client <-> server clock logic. This
PR is only for the reminder message & system clock that will be used in
prod.
## Testing
- `just test -p codex-core varlatency_`
- `just clippy -p codex-core -p codex-app-server -p codex-mcp-server -p
codex-thread-manager-sample`
- `just fmt`
* [codex] Cache plugin metadata for tool suggestions (#27812)
## Why
`built_tools` runs for every sampling request, and local plugin
discovery was repeatedly rereading plugin manifests, skills, MCP
configuration, and app declarations to build the same tool-suggest
metadata.
That source-derived metadata is stable until the existing plugin manager
reloads its cache. Runtime eligibility still needs to reflect the
current install, disable, policy, app-overlap, and authentication state.
## What changed
- Add a bounded, in-memory tool-suggest metadata cache owned by
`PluginsManager`.
- Key cached metadata by plugin identity and source, while applying
authentication routing each time the metadata is projected.
- Invalidate the metadata alongside the existing loaded-plugin cache,
including its normal configuration, marketplace refresh, and
remote-installed-plugin invalidation paths.
- Guard against an in-flight load repopulating stale metadata after
invalidation.
- Keep marketplace membership and all runtime eligibility filtering live
rather than introducing a separate catalog or revision model.
## Impact
Repeated sampling requests reuse already-loaded plugin capability
metadata while retaining the existing plugin-manager lifecycle as the
single freshness boundary.
## Validation
- `just test -p codex-core-plugins` — 252 passed
- Added focused coverage for cache invalidation and authentication
reprojection.
* apply-patch: carry paths as PathUri (#28854)
## Why
Allows the model to edit files that are hosted on a different OS than
where app-server is running.
## What
* Use `PathUri` for apply_patch-internal data structures
* Limit `PathUri` -> `AbsolutePathBuf` conversion to cases where the
inferred path convention matches the host OS, allows requiring valid
paths to pass to perms check
* Adds `PathConvention::path_segments()` for iterating over path
segments regardless of OS
* Handle cross-platform relative paths in path filename parsing for
sniffing a shell
* Ensure we can apply patches in the wine e2e test
* Add app-server current-time impl (varlatency 3/n) (#28835)
## What
Server should request:
```
{
"id": 42,
"method": "currentTime/read",
"params": {
"threadId": "11111111-1111-1111-1111-aaaaafdc2c11"
}
}
```
Client should respond with something like:
```rust
{
"id": 42,
"result": {
"currentTimeAt": 1781717655
}
}
```
## Why
Sessions configured with `clock_source = "external"` need a
thread-specific external time source before inference. The system clock
remains the default production provider.
## Validation
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-app-server --test all
current_time_read_round_trip_adds_reminder_to_model_input`
- `cargo test -p codex-app-server
first_attestation_capable_connection_for_thread_only_uses_thread_subscribers`
- `cargo test -p codex-analytics`
- `just fix -p codex-app-server-protocol`
- `just fix -p codex-app-server`
Stacked on #28824.
* Make auto-review on-request prompt more proactive (#26496)
## Why
`on-request` approval policy text is currently tuned for user-reviewed
approvals. For auto-reviewed productivity runs, likely sandbox blocks
should be escalated earlier so commands that need remote services,
authentication, or other out-of-sandbox access do not first fail or hang
inside the sandbox.
## What changed
- Adds a separate `on_request_auto_review.md` permissions prompt
selected for `AskForApproval::OnRequest` with
`ApprovalsReviewer::AutoReview`.
- Keeps the normal user-reviewed `on-request` wording unchanged.
- Makes the `When to request escalation` bullets more explicit about
likely sandbox blocks, network access, remote
auth/cluster/cloud/database access, out-of-sandbox environment access,
git operations that may write lock files, and short-timeout reruns after
likely sandbox-blocked attempts.
- Omits approved command prefix and `prefix_rule` guidance for the
auto-review on-request prompt.
- Adds prompt tests covering the auto-review path, normal on-request
wording, and inline permission request behavior.
* [codex] Remove hardcoded app ID filters (#28947)
## Summary
- remove the duplicated originator-specific connector ID denylists
- stop filtering connector directory/accessibility results and
live/cached Codex Apps MCP tools by hardcoded connector ID
- remove the now-unused `codex-login` dependency from
`codex-utils-plugins`
- update regression coverage so formerly blocked connector IDs are
preserved
## Why
The client-side policy was duplicated across crates, used opaque IDs
without ownership or expiry information, and could drift between app
listing and MCP tool behavior. Server-provided visibility,
authorization, plugin discoverability, accessibility, enabled-state
handling, and consequential-tool approval templates remain unchanged.
## Validation
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `git diff --check`
- confirmed the final diff contains no hardcoded denylist symbols
A targeted `codex-mcp` test build spent an unusually long time in local
compilation/linking. Its first attempt exposed a test-only `PartialEq`
assertion issue, which was corrected. A follow-up non-linking `cargo
check -p codex-mcp --tests` was still running when this draft was
opened; CI should provide the complete Rust validation.
* TUI: improve unified mention selection visibility (#28959)
## Summary
[@milanglacier reported in
#28653](https://github.com/openai/codex/issues/28653) that the active
mention candidate is hard to distinguish. I suspect [@binbjz’s #28500
report](https://github.com/openai/codex/issues/28500) _(where arrow-key
navigation appeared not to work)_ may describe the same presentation
problem: the selection may have been changing, but the UI was not
showing the active row clearly in their terminal. This PR makes two
small changes to the selection indication behavior:
- Reserve a two-character gutter and mark the active candidate with `> `
for color-agnostic indicator coverage.
- Apply the shared theme-aware accent to the entire selected row for
extra emphasis.
- Update the existing popup snapshot.
Reverse-video styling was considered, but avoided it because it is
overly dependent on the user’s terminal palette.
<img width="2046" height="482" alt="image"
src="https://github.com/user-attachments/assets/b5eb62c3-fd24-4c09-906e-7bd66913b5c6"
/>
## Testing
- `just test -p codex-tui default_unified_mention_popup_snapshot`
- `just clippy -p codex-tui`
- `just fmt`
- Compiled `codex-cli` and tested the unified mentions picker in the
terminal.
* Emit Trusted MCP App Identity on Tool-Call Items (#27132)
## Summary
- Add optional `appContext` to app-server MCP tool-call items with
trusted `connectorId`, `linkId`, and `mcpAppResourceUri` metadata.
- Preserve that context across tool-call events, persisted history,
reconnects, and thread resume.
- Keep the deprecated top-level `mcpAppResourceUri` temporarily for
client migration.
The consumer contract is `{ appContext: { connectorId, linkId,
mcpAppResourceUri }, tool }`.
## Validation
- Full GitHub Actions suite passes, including CLA, Bazel tests, clippy,
release builds, and argument-comment lint.
---------
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
* feat: opt ChatGPT auth into agent identity (#19049)
## Stack
This is PR 2 of the simplified HAI single-run-task stack:
- [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
assertion and task-registration primitives, including the shared
run-task helper used by existing Agent Identity JWT auth.
- [#19049](https://github.com/openai/codex/pull/19049)
Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
Agent Identity runtime auth and its single run task.
- [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
provider auth that uses one backend-owned task id for first-party
inference and compaction requests.
[#19054](https://github.com/openai/codex/pull/19054) collapsed out of
the active stack because the simplified design no longer needs a
separate background/control-plane task helper.
## Summary
This PR adds the disabled-by-default path for normal ChatGPT-login Codex
sessions to obtain Agent Identity runtime auth through the Codex
backend. Existing Agent Identity JWT startup mode remains a separate
path and does not require the feature flag.
What changed:
- adds the experimental `use_agent_identity` feature flag and config
schema entry
- adds an explicit `AgentIdentityAuthPolicy` so call sites choose
`JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
- stores standalone Agent Identity JWT credentials separately from
backend-registered Agent Identity records
- persists the registered Agent Identity record, private key, and single
run task id in `auth.json` so process restarts reuse the same identity
- derives the agent/task registration base URL from ChatGPT/Codex auth
config while keeping JWT JWKS lookup separate
- provisions and caches ChatGPT-derived Agent Identity runtime auth when
`use_agent_identity` is enabled
- reuses the shared run-task registration helper from PR1 rather than
adding a second task-registration path
This PR intentionally does not switch model inference over to
`AgentAssertion` auth. The provider-auth integration lands in the next
PR.
## Testing
- `just test -p codex-login`
* [connectors] Ignore synthetic links for app accessibility (#28770)
Summary
- Stop treating Codex Apps MCP tools with
`_meta._codex_apps.synthetic_link: true` as evidence that a connector is
accessible in `app/list`.
- Preserve synthetic tools in the agent-facing MCP connector set so they
remain available for install/auth flows.
- Keep the app-list accessibility cache limited to connectors backed by
at least one non-synthetic tool.
- Add focused regression coverage for both sides of the boundary.
Validation
- `just fmt`
- `just test -p codex-core
synthetic_links_are_exposed_to_the_agent_but_not_accessible_in_app_list`
- `git diff --check`
- A crate-wide `just test -p codex-core` run completed with 2,699
passing and 51 unrelated local sandbox/state failures, primarily state
DB migration races (`UNIQUE constraint failed:
_sqlx_migrations.version`).
* [codex] Preserve remote plugin download status errors (#28863)
## Summary
- preserve the original HTTP status when a remote plugin bundle download
returns a non-success response
- retain at most 8 KiB of the error response body and annotate
truncation or body-read failures
- add regression coverage for an oversized error response
## Root cause
The non-success response path reused the normal size-limited body
reader. When an error response exceeded 8 KiB, that reader returned
`DownloadTooLarge` before the code constructed `DownloadStatus`, masking
the upstream HTTP status and response context.
## Impact
Remote plugin installation failures now retain the actionable upstream
HTTP status without allowing unbounded error bodies into logs.
## Validation
- `just test -p codex-app-server
plugin_install_preserves_status_when_remote_bundle_error_body_is_too_large`
- `just fmt`
- `git diff --check`
* core: load AGENTS.md from foreign environments (#28958)
## Why
Make it possible to load AGENTS.md from remote exec-servers whose OS is
different than app-server.
## What
- keep `AGENTS.md` discovery and provenance as `PathUri`, with
root-aware parent and ancestor traversal
- expose lifecycle instruction sources as legacy app-server path strings
in events while retaining `PathUri` internally
- preserve and test mixed POSIX and Windows paths in model context and
TUI status output
- cover remote Windows loading end to end by seeding the Wine prefix
through host filesystem APIs
- fix bug in `PathUri`'s parent() implementation that would erase
Windows drive letters
* [codex] Support marketplace plugin manifest fallback (#28789)
## Summary
Support marketplace plugins whose source directory does not include a
discoverable plugin manifest. Metadata-rich `marketplace.json` entries
now act as fallback plugin manifests for listing, local detail reads,
install, and non-curated cache refresh.
The fallback preserves marketplace-entry plugin fields wholesale, then
adds the small Codex-facing compatibility bridge for presentation
metadata. A real source `plugin.json` always wins when present.
## Details
- Capture flattened marketplace-entry fields into
`MarketplacePluginManifestFallback`, preserving fields such as
`version`, `description`, `skills`, `mcpServers`, `apps`, `hooks`,
`agents`, `commands`, `strict`, `author`, and future manifest fields
without a per-field translation list.
- Bridge Claude-style top-level `displayName`, `author.name`,
`homepage`, and marketplace `category` into Codex's nested `interface`
fields only when the nested values are absent.
- Treat fallback metadata as installable only when the marketplace entry
contributes metadata beyond bare `name` and `source`; existing
missing-manifest behavior remains for metadata-free entries.
- Read local plugin details from the already parsed fallback manifest,
including fallback-declared app and MCP paths, instead of rereading only
an on-disk manifest.
- Pass fallback contents into `PluginStore`, which validates them and
injects `.codex-plugin/plugin.json` into Store's existing atomic copy.
Local marketplace source directories are never mutated, and the fallback
path no longer needs an additional staging directory.
- Keep Git source materialization unchanged; Git clones still use the
existing marketplace source staging area before Store installation.
* [codex] Remove child AGENTS.md prompt experiment (#28993)
## Why
`child_agents_md` is a disabled, under-development experiment that adds
a second model-visible explanation of hierarchical `AGENTS.md` behavior.
Keeping it leaves unused prompt, configuration, documentation, and test
surface.
## What changed
- remove the `ChildAgentsMd` feature and `child_agents_md` config schema
entry
- remove the hierarchical prompt asset, …
…nt/wallentx_termux-target_from_release_0.146.0_a8124fe9b11a # Conflicts: # .github/workflows/rust-release.yml
…et_from_release_0.146.0_a8124fe9b11a checkpoint: into wallentx/termux-target from release/0.146.0 @ a8124fe
* Release 0.141.0-alpha.3
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.3
* Release 0.141.0-alpha.5
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.5
* Release 0.141.0-alpha.6
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.6
* Release 0.141.0-alpha.7
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.7
* checkpoint: into wallentx/termux-target from release/0.141.0 @ 512c55a29a8f (#242)
* ## New Features
- Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
- Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
- Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
- App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
- Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
- TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
## Bug Fixes
- Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
- Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
- Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
- Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
- Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
- TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
## Chores
- Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
- Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
- Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.140.0...rust-v0.141.0
- #28001 [codex] package Windows ARM64 on x64 @tamird
- #28032 [codex] Carry exec-server cwd as PathUri @anp-oai
- #27607 [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
- #27992 [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
- #28125 build: run buildifier from just fmt @anp-oai
- #28120 bazel: add PowerShell to Wine test harness @anp-oai
- #27819 path-uri: render native paths across platforms @anp-oai
- #28122 [codex] exec-server honors remote environment cwd and shell @anp-oai
- #26662 feat(app-server): filter threads by parent @btraut-openai
- #27884 Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
- #27870 Discover stdio MCP servers from selected executor plugins @jif-oai
- #28283 [codex] update multi-agent v2 prompts @jif-oai
- #27602 [codex] Preserve plugin apps in connector listings @felixxia-oai
- #27461 [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
- #27893 Activate selected executor plugin MCPs in app-server @jif-oai
- #28332 [codex] Cap feedback upload subtrees @jif-oai
- #27365 Represent dynamic tools with explicit namespaces internally @sayan-oai
- #28333 skills: hide orchestrator skills with a local executor @jif-oai
- #27756 [codex] simplify shell snapshot ownership @pakrym-oai
- #27794 Remove terminal resize reflow flag gates @etraut-openai
- #28286 chore: restore exec-server relay keepalives @jif-oai
- #28164 [codex] simplify memory read metrics @pakrym-oai
- #27371 Expose explicit dynamic tool namespaces in thread start @sayan-oai
- #28309 linearize history output normalization @jif-oai
- #28306 avoid cloning sampling request input @jif-oai
- #28323 serialize websocket requests directly @jif-oai
- #28313 avoid cloning websocket request history @jif-oai
- #28344 [codex] remove stale PathExt import @pakrym-oai
- #27059 [codex] Cover OTLP HTTP log and trace event export @richardopenai
- #28327 reuse encoded Responses request bodies @jif-oai
- #27995 [codex] preserve explicit environment cwd @pakrym-oai
- #28285 guardian: isolate review context from skills and memories @jif-oai
- #26702 TUI Plugin Sharing 2 - add remote plugin section plumbing @canvrno-oai
- #28294 bound prompt image cache retention @jif-oai
- #28257 Support staging OAuth client ID overrides @apanasenko-oai
- #28341 core: let steer interrupt wait_agent @jif-oai
- #28336 skills: cache orchestrator resources per thread @jif-oai
- #28357 Extract shared Windows sandbox session runner @iceweasel-oai
- #27706 Use aws-lc-rs for rustls crypto provider @malsamiri-oai
- #28347 [codex] add path-types skill @anp-oai
- #28235 Add request user input auto-resolution timer @shijie-oai
- #28234 [mcp] Increase default tool timeout to 300 seconds @adaley-openai
- #28008 [codex] Add external agent import result accounting @charlesgong-openai
- #27944 recover stale Windows sandbox credentials @iceweasel-oai
- #27086 Add Windows unified exec yield floor @iceweasel-oai
- #28358 Add hidden Windows sandbox wrapper entrypoint @iceweasel-oai
- #27258 core: cache the tool search handler per session @mchen-oai
- #28143 feat(app-server): expose rate-limit reset credits @jayp-oai
- #28355 feat(core): add metadata field to ResponseItem @owenlin0
- #28203 [codex] Add created-by-me remote plugin marketplace @ericning-o
- #28365 Respect blocking PostToolUse hooks in code mode @abhinav-oai
- #27813 [codex] Reuse Apps policy evaluation across MCP tool exposure @mzeng-openai
- #28300 Deflake realtime handoff steering test @felixxia-oai
- #28395 [codex] Preserve remote plugin directory order @jameswt-oai
- #27955 [codex] retain resolved environments across turns @pakrym-oai
- #27917 Add realtime speech append control @guinness-oai
- #27093 [codex-analytics] Analytics Capture to File in Debug Builds @jameswt-oai
- #26242 exec-server: add Noise relay transport @viyatb-oai
- #28165 Use PathUri in filesystem permission paths for exec-server @anp-oai
- #28415 [codex] Fix missing response item metadata in tests @adaley-openai
- #27058 [codex] Add second-based OTEL duration histograms @richardopenai
- #27902 [codex] Centralize plugin auth capability filtering @felixxia-oai
- #28405 Add a toggle for realtime startup context @guinness-oai
- #26434 Preserve hook trust bypass in codex exec threads @abhinav-oai
- #26245 exec-server: default remote transport to Noise @viyatb-oai
- #28383 [codex] Load API curated marketplace by auth @felixxia-oai
- #27958 [codex] Make plugin details capability aware @felixxia-oai
- #28367 Use ApiPathString in app-server filesystem permission paths @anp-oai
- #28421 [codex] Bind shell snapshots to retained thread environments @pakrym-oai
- #28429 [codex] Add interruptible sleep tool @pakrym-oai
- #28441 [codex] Use expect in integration tests @pakrym-oai
- #28163 [codex] Use local environment for user shell commands @pakrym-oai
* Seed Termux release automation
* Prepare Termux rust-v0.141.0
---------
Co-authored-by: sayan-oai <sayan@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ 8f4b05f9cc47 (#244)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
representation
- restore Wine coverage for retained Windows cwd values and successful
completion
* [codex] Split plugin and skill warmup tracing (#28605)
## What changed
- promote plugin config loading to an info-level `plugins_for_config`
span
- promote skill config loading to an info-level `skills_for_config` span
- attach stable OpenTelemetry names to both spans
## Why
`session_init.plugin_skill_warmup` currently combines plugin loading and
skill loading, which makes cold-start traces unable to identify which
phase dominates. These child spans preserve the existing aggregate while
making the two costs independently visible.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
This is observability-only. It does not change plugin or skill loading
behavior.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins` (347 passed)
- `just fmt`
* [codex] Pass plugin namespace into skill loading (#28608)
## What changed
- retain the parsed plugin manifest namespace on loaded plugins
- carry that namespace through `PluginSkillRoot` and `SkillRoot`
- use the provided namespace when qualifying plugin skill names
- include the namespace in the skills cache key
## Why
Plugin loading has already parsed `plugin.json`, but skill parsing
currently walks every `SKILL.md` ancestor and probes/reads the manifest
again to reconstruct the same namespace. Passing the parsed namespace
removes those repeated filesystem calls, which are particularly costly
on remote filesystems.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
Plugin skill names remain unchanged. A regression test uses a
deliberately different on-disk manifest name to verify that plugin roots
use the provided parsed namespace.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins` (352 passed)
- `just fix -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins`
- `just fmt`
* [codex] add rollout token budget configuration (varlength 1/N) (#28746)
## What
This PR defines the structured configuration contract for shared rollout
token budgets (across ALL agent threads under 1 rollout).
```toml
[features.rollout_budget]
enabled = true
limit_tokens = 100000
reminder_interval_tokens = 10000
sampling_token_weight = 1.0
prefill_token_weight = 0.1
```
The reminder interval defaults to 10% of the rollout limit. Sampling and
prefill weights default to `1.0`.
## Scope
This PR only defines and validates configuration. It does not track
usage, inject reminders, or stop a rollout. Accounting and reminders are
implemented in the stacked follow-up #28494.
The existing `token_budget` feature remains unchanged. `rollout_budget`
has its own feature key and configuration type.
## Tests
The config test verifies that the structured fields resolve into
`RolloutBudgetConfig` and do not enable the existing `token_budget`
feature.
Local checks:
- `just write-config-schema`
- `just test -p codex-core load_config_resolves_rollout_budget`
- `cargo check -p codex-thread-manager-sample`
- `git diff --check`
The full workspace test suite was not run locally.
* Add network environment ID plumbing (#28766)
## Why
Prepare network approval scoping to distinguish execution environments
without changing behavior yet.
## What changed
- Add optional environment IDs to network policy requests.
- Add optional network environment IDs to exec and sandbox request
structs.
- Thread default None values through existing construction points.
- Fix stale constructor call sites that caused the CI compile failures.
## Not included
- Per-environment proxy listeners.
- Network approval cache or prompt behavior changes.
- Ambiguous request attribution handling.
Those behavior changes moved to stacked follow-up #28899.
## Validation
- just fmt
- CI will run tests and clippy
* Avoid sandbox helper in apply_patch approval tests (#28915)
## Summary
This keeps the apply_patch approval tests focused on approval behavior
instead of macOS sandboxed filesystem helper startup.
The changed cases still force patch approval with `UnlessTrusted`, but
use `DangerFullAccess` after approval so the patch write is direct and
cheap. Workspace-write and sandbox-helper behavior remain covered by the
filesystem and apply_patch sandbox tests.
* Pause active goals before TUI interrupts (#28813)
Fixes #28104.
## Summary
Active `/goal` turns should leave the persisted goal paused whenever the
TUI interrupts the running turn. The bug in #28104 showed this most
visibly through `Esc`: some interrupt paths aborted the turn without
updating the goal status, so the goal could remain active and continue
automatically.
This change makes `ChatWidget` pause an active goal before the TUI sends
an interrupt from the status-row path, the pending-steer path, `Ctrl+C`,
or a request-user-input overlay. The modal overlay now reports whether a
key will interrupt the turn, which keeps modal `Esc` and `Ctrl+C`
behavior aligned with the normal interrupt paths.
## Manual Testing
Built the local CLI with `just codex --help`, then launched the local
TUI with goals enabled. Started an active `/goal` turn and interrupted
it with `Esc`, then resumed and repeated with `Ctrl+C`; both paths
showed `Goal paused`, the interrupted-conversation message, and the
`Goal paused (/goal resume)` footer. I also stopped the background
terminal and exited the TUI cleanly after the run.
I did not find a reliable standalone manual path to force the
request-user-input overlay case, so that path is covered by the focused
automated test.
* Recover exec process stdin writes (#28895)
## Summary
Remote stdio MCP servers send tool calls by writing JSON-RPC bytes
through `process/write`.
When the exec-server websocket drops at the wrong time, the remote
process can survive session recovery, but the stdin write can still fail
back to RMCP as a transport send error. RMCP then closes the stdio MCP
transport, so tools like `node_repl` are lost even though the
process/session recovery path is working.
This changes `process/write` to be safe to retry across exec-server
recovery:
- adds a required `writeId` to `process/write`
- retries remote `Session::write` with the same `writeId` after
reconnect
- remembers accepted write ids per process so duplicate retries return
`Accepted` without writing the same bytes to child stdin again
- covers both the client retry path and server-side write id dedupe with
tests
In simple terms:
```text
before:
write to MCP stdin -> websocket closes -> write errors -> RMCP closes node_repl
after:
write to MCP stdin -> websocket closes -> reconnect -> retry same writeId
server either writes once or recognizes it already did
```
* Pin Windows argument lint to Windows 2022 (#28940)
## What
Run the Windows argument-comment-lint job on the `windows-2022` hosted
runner instead of the custom Windows runner pool.
## Why
The custom pool recently moved from the Visual Studio 2022 Windows image
to `windows-2025-vs2026`. Since that migration, the job fails while
Bazel materializes LLVM external repository sources, before the argument
lint itself runs. The same failure appears across unrelated PRs.
This narrow change tests GitHub’s recommended mitigation for workloads
that still require the Visual Studio 2022 image:
https://github.com/actions/runner-images/issues/14017
## How
Use the standard `windows-2022` runner for only the Windows
argument-comment-lint matrix entry. No product code or lint behavior
changes.
* Scope MCP sandbox metadata to server environment (#28914)
Scope MCP sandbox metadata to the MCP server's owning environment.
Previously, `codex/sandbox-state-meta` always used the turn's primary
cwd and rebuilt a legacy sandbox policy from that cwd. That can be wrong
for MCP servers owned by a different execution environment.
This now sends the owning environment cwd as a `file:` URI in
`sandboxCwd`, keeps `permissionProfile` as the permission source of
truth, and omits sandbox-state metadata when a non-default server
environment is not selected for the turn. Local/default MCP servers keep
the existing fallback cwd behavior.
Tests:
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `just test -p codex-mcp`
- `just test -p codex-core mcp_sandbox_cwd`
- `cargo build -p codex-rmcp-client --bin test_stdio_server`
- `just test -p codex-core
stdio_mcp_tool_call_includes_sandbox_state_meta`
* Add turn-scoped context contributions (#28911)
## Summary
- keep context injection on a single ContextContributor trait
- split context injection into thread-scoped and turn-scoped
contribution methods
- wire turn-scoped fragments into initial context assembly so extensions
can contribute context from turn-local state
* Fix goal-first live threads missing from thread/list (#28808)
Fixes #28263.
## Why
When a thread starts with `/goal`, the goal extension can update SQLite
goal state before the thread has any user-turn rollout items.
`thread/list` and `thread/search` rely on persisted listing metadata, so
a goal-first live thread could be absent from app-server listings after
restart even though the goal itself existed.
This regressed when goal handling moved out of core: the core path wrote
the goal update through the live thread rollout path, while the
extension-backed app-server path only updated goal state and emitted the
live notification.
## What
- Add `GoalSetOutcome::thread_goal_updated_item()` so the goal extension
owns the canonical `ThreadGoalUpdated` rollout item shape.
- Expose a narrow `CodexThread::append_rollout_items()` helper that
appends through the live thread and keeps derived SQLite metadata in
sync.
- When app-server sets a goal on an active live thread, persist the goal
update through that live-thread path.
- Add an app-server regression test that starts a live thread with
`thread/goal/set` and verifies it appears in state-DB-only
`thread/list`.
## Verification
- `env -u CODEX_SQLITE_HOME just test -p codex-app-server
goal_first_live_thread_appears_in_state_db_thread_list`
* [codex] Initialize exec-server OpenTelemetry at startup (#25019)
## Summary
- Initialize stderr tracing and the configured OpenTelemetry provider
for local and remote `codex exec-server` startup.
- Instrument the local and remote server entrypoints with a root runtime
span.
- Keep raw Noise environment, registration, and stream identifiers out
of exported spans while preserving them in local debug events.
- Keep telemetry setup in a focused CLI module instead of growing the
top-level command entrypoint.
## Stack
- Previous: none (`#27058` has merged)
- Next: #27466
## Validation
- `just test -p codex-exec-server --lib` (139 passed)
- `just test -p codex-cli --test exec_server` (3 passed)
- `just bazel-lock-check`
- `just fix -p codex-exec-server -p codex-cli`
- `just fmt`
---------
Co-authored-by: Richard Lee <richardlee@openai.com>
* [codex] Fix Windows sandbox runtime ACL refresh (#28943)
## Why
Codex Desktop repairs sandbox-user read/execute access for binaries
copied to `%LOCALAPPDATA%\OpenAI\Codex\bin`, but Computer Use launches
its bundled Node runtime from `%LOCALAPPDATA%\OpenAI\Codex\runtimes`.
On fresh Windows installations, `CodexSandboxUsers` may therefore be
unable to execute the bundled Node binary. The command runner starts,
but `CreateProcessAsUserW` fails with error 5 (`ACCESS_DENIED`), causing
the Node REPL to exit before Computer Use can discover applications.
This is a follow-up to #21564, which added the original runtime `bin`
ACL repair.
## What changed
- Expand the Codex Desktop runtime ACL roots from only `bin` to both
`bin` and `runtimes`.
- Apply the existing inherited read/execute ACL repair to each runtime
directory when it exists.
- Rename the setup helper to reflect that it now handles multiple
runtime paths.
## Validation
- `cargo fmt -- --check`
- `just test -p codex-windows-sandbox` was run: 113 tests passed and
five environment-dependent legacy execution tests failed because
`CreateRestrictedToken` returned error 87.
* Synchronize realtime notification test requests (#28946)
## What
Deliver the scripted realtime notification batch after the assistant
text append request instead of after the preceding developer text append
request.
## Why
The batch ends with an upstream error that closes the realtime
conversation. When it is emitted after the developer append, it races
the subsequent assistant append: the app-server RPC can acknowledge the
append before its downstream WebSocket send completes, and the test
intermittently observes three requests instead of four.
Making the fake server wait for the assistant append before emitting the
terminal batch establishes the ordering the test asserts without sleeps
or production-code changes.
## Validation
- `git diff --check`
- CI (the failure is timing-dependent and most reproducible in the
Windows Bazel shard)
* Add Config for Time Reminders (varlatency 1/n) (#28822)
## Summary
Example:
> [features.current_time_reminder]
enabled = true
reminder_interval_model_requests = 1
clock_source = "system"
## Testing
- `just test -p codex-core varlatency`
- `just test -p codex-core
lock_contains_prompts_and_materializes_features`
- `just fix -p codex-core -p codex-config -p codex-features`
* [codex] rollout budget implementation (varlength 2/N) (#28494)
## Stack
Depends on #28746. This PR implements shared rollout-budget accounting
and model-visible reminders using the configuration defined in #28746.
# Description / Main changes to Core:
`AgentControl` will now be the area where "rollout level" features &
accounting will have to live. It is incorrectly named for this
responsibility, but I think it can hold all the necessary shared state &
features (rollout token budget, mutliple thread interruption
responsibilitym etc)
In this PR, we have one "token ledger" that each thread will subtract
from when sampling. The "charge" will occur when response.completed() is
done and the calculation will be done on the responses api usage
carrier. The calculation will weigh sampling and pre-fill tokens as
specified.
Every time the budget crosses the configured reminder threshold, a
developer message is appended before the thread's next request
This remaining budget will _always_ be restated/reminded after a
compaction event.
Expiration and fan-out interruption will be in the stacked follow-up
(and also live in Agent Control).
## Reminders
"You have weighted {session_tokens_left} tokens left in the shared
session token budget."
The first request in each thread context receives the current remainder.
Later reminders are emitted after aggregate weighted usage crosses a
configured interval. If several intervals are crossed before a thread
sends another request, Core inserts one reminder with the latest
remainder.
Compaction response usage is charged before the next context starts. The
next reminder is appended after the compaction summary, leaving the
initial context content stable.
## Tests
Integration coverage verifies:
- weighted output and non-cached input accounting
- initial and periodic reminders
- shared accounting between a root and sub-agent
- post-compaction remainder and message placement
Local checks:
- `just fmt`
- `just test -p codex-core rollout_budget`
- `git diff --check`
The full workspace test suite was not run locally.
* Support `openai/form` extended form elicitations (#27500)
# Summary
Allow App Server clients to opt into `openai/form` MCP elicitations.
* [codex] Make thread store turn filter optional (#28949)
Make `ListItemsParams::turn_id` optional so callers can list persisted
items across an entire thread or narrow the result to one turn. This
aligns the thread-store API and documentation with thread-wide item
listing while preserving the optional turn-filter behavior for
implementations.
* current time reminders impl for system clock (varlatency 2/n) (#28824)
Stacked on #28822.
## Summary
- add a host-injectable current-time provider with a built-in system
implementation
- record UTC developer reminders in history immediately before due model
requests
- keep cadence state per session and force a refresh after compaction
This does NOT include the app server client <-> server clock logic. This
PR is only for the reminder message & system clock that will be used in
prod.
## Testing
- `just test -p codex-core varlatency_`
- `just clippy -p codex-core -p codex-app-server -p codex-mcp-server -p
codex-thread-manager-sample`
- `just fmt`
* [codex] Cache plugin metadata for tool suggestions (#27812)
## Why
`built_tools` runs for every sampling request, and local plugin
discovery was repeatedly rereading plugin manifests, skills, MCP
configuration, and app declarations to build the same tool-suggest
metadata.
That source-derived metadata is stable until the existing plugin manager
reloads its cache. Runtime eligibility still needs to reflect the
current install, disable, policy, app-overlap, and authentication state.
## What changed
- Add a bounded, in-memory tool-suggest metadata cache owned by
`PluginsManager`.
- Key cached metadata by plugin identity and source, while applying
authentication routing each time the metadata is projected.
- Invalidate the metadata alongside the existing loaded-plugin cache,
including its normal configuration, marketplace refresh, and
remote-installed-plugin invalidation paths.
- Guard against an in-flight load repopulating stale metadata after
invalidation.
- Keep marketplace membership and all runtime eligibility filtering live
rather than introducing a separate catalog or revision model.
## Impact
Repeated sampling requests reuse already-loaded plugin capability
metadata while retaining the existing plugin-manager lifecycle as the
single freshness boundary.
## Validation
- `just test -p codex-core-plugins` — 252 passed
- Added focused coverage for cache invalidation and authentication
reprojection.
* apply-patch: carry paths as PathUri (#28854)
## Why
Allows the model to edit files that are hosted on a different OS than
where app-server is running.
## What
* Use `PathUri` for apply_patch-internal data structures
* Limit `PathUri` -> `AbsolutePathBuf` conversion to cases where the
inferred path convention matches the host OS, allows requiring valid
paths to pass to perms check
* Adds `PathConvention::path_segments()` for iterating over path
segments regardless of OS
* Handle cross-platform relative paths in path filename parsing for
sniffing a shell
* Ensure we can apply patches in the wine e2e test
* Add app-server current-time impl (varlatency 3/n) (#28835)
## What
Server should request:
```
{
"id": 42,
"method": "currentTime/read",
"params": {
"threadId": "11111111-1111-1111-1111-aaaaafdc2c11"
}
}
```
Client should respond with something like:
```rust
{
"id": 42,
"result": {
"currentTimeAt": 1781717655
}
}
```
## Why
Sessions configured with `clock_source = "external"` need a
thread-specific external time source before inference. The system clock
remains the default production provider.
## Validation
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-app-server --test all
current_time_read_round_trip_adds_reminder_to_model_input`
- `cargo test -p codex-app-server
first_attestation_capable_connection_for_thread_only_uses_thread_subscribers`
- `cargo test -p codex-analytics`
- `just fix -p codex-app-server-protocol`
- `just fix -p codex-app-server`
Stacked on #28824.
* Make auto-review on-request prompt more proactive (#26496)
## Why
`on-request` approval policy text is currently tuned for user-reviewed
approvals. For auto-reviewed productivity runs, likely sandbox blocks
should be escalated earlier so commands that need remote services,
authentication, or other out-of-sandbox access do not first fail or hang
inside the sandbox.
## What changed
- Adds a separate `on_request_auto_review.md` permissions prompt
selected for `AskForApproval::OnRequest` with
`ApprovalsReviewer::AutoReview`.
- Keeps the normal user-reviewed `on-request` wording unchanged.
- Makes the `When to request escalation` bullets more explicit about
likely sandbox blocks, network access, remote
auth/cluster/cloud/database access, out-of-sandbox environment access,
git operations that may write lock files, and short-timeout reruns after
likely sandbox-blocked attempts.
- Omits approved command prefix and `prefix_rule` guidance for the
auto-review on-request prompt.
- Adds prompt tests covering the auto-review path, normal on-request
wording, and inline permission request behavior.
* [codex] Remove hardcoded app ID filters (#28947)
## Summary
- remove the duplicated originator-specific connector ID denylists
- stop filtering connector directory/accessibility results and
live/cached Codex Apps MCP tools by hardcoded connector ID
- remove the now-unused `codex-login` dependency from
`codex-utils-plugins`
- update regression coverage so formerly blocked connector IDs are
preserved
## Why
The client-side policy was duplicated across crates, used opaque IDs
without ownership or expiry information, and could drift between app
listing and MCP tool behavior. Server-provided visibility,
authorization, plugin discoverability, accessibility, enabled-state
handling, and consequential-tool approval templates remain unchanged.
## Validation
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `git diff --check`
- confirmed the final diff contains no hardcoded denylist symbols
A targeted `codex-mcp` test build spent an unusually long time in local
compilation/linking. Its first attempt exposed a test-only `PartialEq`
assertion issue, which was corrected. A follow-up non-linking `cargo
check -p codex-mcp --tests` was still running when this draft was
opened; CI should provide the complete Rust validation.
* TUI: improve unified mention selection visibility (#28959)
## Summary
[@milanglacier reported in
#28653](https://github.com/openai/codex/issues/28653) that the active
mention candidate is hard to distinguish. I suspect [@binbjz’s #28500
report](https://github.com/openai/codex/issues/28500) _(where arrow-key
navigation appeared not to work)_ may describe the same presentation
problem: the selection may have been changing, but the UI was not
showing the active row clearly in their terminal. This PR makes two
small changes to the selection indication behavior:
- Reserve a two-character gutter and mark the active candidate with `> `
for color-agnostic indicator coverage.
- Apply the shared theme-aware accent to the entire selected row for
extra emphasis.
- Update the existing popup snapshot.
Reverse-video styling was considered, but avoided it because it is
overly dependent on the user’s terminal palette.
<img width="2046" height="482" alt="image"
src="https://github.com/user-attachments/assets/b5eb62c3-fd24-4c09-906e-7bd66913b5c6"
/>
## Testing
- `just test -p codex-tui default_unified_mention_popup_snapshot`
- `just clippy -p codex-tui`
- `just fmt`
- Compiled `codex-cli` and tested the unified mentions picker in the
terminal.
* Emit Trusted MCP App Identity on Tool-Call Items (#27132)
## Summary
- Add optional `appContext` to app-server MCP tool-call items with
trusted `connectorId`, `linkId`, and `mcpAppResourceUri` metadata.
- Preserve that context across tool-call events, persisted history,
reconnects, and thread resume.
- Keep the deprecated top-level `mcpAppResourceUri` temporarily for
client migration.
The consumer contract is `{ appContext: { connectorId, linkId,
mcpAppResourceUri }, tool }`.
## Validation
- Full GitHub Actions suite passes, including CLA, Bazel tests, clippy,
release builds, and argument-comment lint.
---------
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
* feat: opt ChatGPT auth into agent identity (#19049)
## Stack
This is PR 2 of the simplified HAI single-run-task stack:
- [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
assertion and task-registration primitives, including the shared
run-task helper used by existing Agent Identity JWT auth.
- [#19049](https://github.com/openai/codex/pull/19049)
Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
Agent Identity runtime auth and its single run task.
- [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
provider auth that uses one backend-owned task id for first-party
inference and compaction requests.
[#19054](https://github.com/openai/codex/pull/19054) collapsed out of
the active stack because the simplified design no longer needs a
separate background/control-plane task helper.
## Summary
This PR adds the disabled-by-default path for normal ChatGPT-login Codex
sessions to obtain Agent Identity runtime auth through the Codex
backend. Existing Agent Identity JWT startup mode remains a separate
path and does not require the feature flag.
What changed:
- adds the experimental `use_agent_identity` feature flag and config
schema entry
- adds an explicit `AgentIdentityAuthPolicy` so call sites choose
`JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
- stores standalone Agent Identity JWT credentials separately from
backend-registered Agent Identity records
- persists the registered Agent Identity record, private key, and single
run task id in `auth.json` so process restarts reuse the same identity
- derives the agent/task registration base URL from ChatGPT/Codex auth
config while keeping JWT JWKS lookup separate
- provisions and caches ChatGPT-derived Agent Identity runtime auth when
`use_agent_identity` is enabled
- reuses the shared run-task registration helper from PR1 rather than
adding a second task-registration path
This PR intentionally does not switch model inference over to
`AgentAssertion` auth. The provider-auth integration lands in the next
PR.
## Testing
- `just test -p codex-login`
* [connectors] Ignore synthetic links for app accessibility (#28770)
Summary
- Stop treating Codex Apps MCP tools with
`_meta._codex_apps.synthetic_link: true` as evidence that a connector is
accessible in `app/list`.
- Preserve synthetic tools in the agent-facing MCP connector set so they
remain available for install/auth flows.
- Keep the app-list accessibility cache limited to connectors backed by
at least one non-synthetic tool.
- Add focused regression coverage for both sides of the boundary.
Validation
- `just fmt`
- `just test -p codex-core
synthetic_links_are_exposed_to_the_agent_but_not_accessible_in_app_list`
- `git diff --check`
- A crate-wide `just test -p codex-core` run completed with 2,699
passing and 51 unrelated local sandbox/state failures, primarily state
DB migration races (`UNIQUE constraint failed:
_sqlx_migrations.version`).
* [codex] Preserve remote plugin download status errors (#28863)
## Summary
- preserve the original HTTP status when a remote plugin bundle download
returns a non-success response
- retain at most 8 KiB of the error response body and annotate
truncation or body-read failures
- add regression coverage for an oversized error response
## Root cause
The non-success response path reused the normal size-limited body
reader. When an error response exceeded 8 KiB, that reader returned
`DownloadTooLarge` before the code constructed `DownloadStatus`, masking
the upstream HTTP status and response context.
## Impact
Remote plugin installation failures now retain the actionable upstream
HTTP status without allowing unbounded error bodies into logs.
## Validation
- `just test -p codex-app-server
plugin_install_preserves_status_when_remote_bundle_error_body_is_too_large`
- `just fmt`
- `git diff --check`
* core: load AGENTS.md from foreign environments (#28958)
## Why
Make it possible to load AGENTS.md from remote exec-servers whose OS is
different than app-server.
## What
- keep `AGENTS.md` discovery and provenance as `PathUri`, with
root-aware parent and ancestor traversal
- expose lifecycle instruction sources as legacy app-server path strings
in events while retaining `PathUri` internally
- preserve and test mixed POSIX and Windows paths in model context and
TUI status output
- cover remote Windows loading end to end by seeding the Wine prefix
through host filesystem APIs
- fix bug in `PathUri`'s parent() implementation that would erase
Windows drive letters
* [codex] Support marketplace plugin manifest fallback (#28789)
## Summary
Support marketplace plugins whose source directory does not include a
discoverable plugin manifest. Metadata-rich `marketplace.json` entries
now act as fallback plugin manifests for listing, local detail reads,
install, and non-curated cache refresh.
The fallback preserves marketplace-entry plugin fields wholesale, then
adds the small Codex-facing compatibility bridge for presentation
metadata. A real source `plugin.json` always wins when present.
## Details
- Capture flattened marketplace-entry fields into
`MarketplacePluginManifestFallback`, preserving fields such as
`version`, `description`, `skills`, `mcpServers`, `apps`, `hooks`,
`agents`, `commands`, `strict`, `author`, and future manifest fields
without a per-field translation list.
- Bridge Claude-style top-level `displayName`, `author.name`,
`homepage`, and marketplace `category` into Codex's nested `interface`
fields only when the nested values are absent.
- Treat fallback metadata as installable only when the marketplace entry
contributes metadata beyond bare `name` and `source`; existing
missing-manifest behavior remains for metadata-free entries.
- Read local plugin details from the already parsed fallback manifest,
including fallback-declared app and MCP paths, instead of rereading only
an on-disk manifest.
- Pass fallback contents into `PluginStore`, which validates them and
injects `.codex-plugin/plugin.json` into Store's existing atomic copy.
Local marketplace source directories are never mutated, and the fallback
path no longer needs an additional staging directory.
- Keep Git source materialization unchanged; Git clones still use the
existing marketplace source staging area before Store installation.
* [codex] Remove child AGENTS.md prompt experiment (#28993)
## Why
`child_agents_md` is a disabled, under-development experiment that adds
a second model-visible explanation of hierarchical `AGENTS.md` behavior.
Keeping it leaves unused prompt, configuration, documentation, and test
surface.
## What changed
- remove the `ChildAgentsMd` feature and `child_agents_md` config schema
entry
- remove the hierarchical prompt asset, export, and instruction
injection
- remove feature-specific tests and documentation
- keep the generic unstable-feature warning coverage using
`apply_patch_streaming_events`
Normal project `AGENTS.md` discovery and composition are unchanged.
## Testing
- `just test -p codex-features`
- `just test -p codex-prompts`
- `just test -p codex-core agents_md`
- `just test -p codex-core unstable_features_warning`
* core: log AGENTS.md paths as URIs (#28989)
## Why
No need to do path contortions when it's for our own logs.
## What
Follow up on a previous PR's nit and update the path-types skill for
future reference.
* core: keep remote exec on reported shell (#28983)
## Why
We need to avoid resolving shells on the app-server's host for remote
environments. We might make it possible to do fancier shell resolution
from remote envs but for now just require the model to produce a shell
that matches the environment's default.
This gets my e2e demo working for shell commands after #28854 moved
shell resolution to PathUri and caused remote envs to hit the fallback
shell when the shell wasn't available on the host.
## What
Remote `exec_command` calls now accept only the environment's reported
default shell name or exact path, and execute with that reported path.
Other explicit shells return a concise error. A Wine-backed integration
test covers explicit PowerShell execution in the Windows cwd.
* [codex] Reuse parsed plugin skills during session startup (#28844)
## Summary
- Preserve raw plugin skill-root snapshots in the matching loaded-plugin
cache entry, keyed by the effective plugin root identity including
namespace.
- Pass those snapshots through `SkillsLoadInput` as an optional preload,
so session startup reuses plugin parsing while ordinary skill loads pass
`None`.
- Keep plugin skill loading cohesive: the existing loaders accept the
optional snapshots directly, and uncached or marketplace-detail paths do
not create a cache.
## Why
Plugin discovery already parses plugin skills to determine available
capabilities. Cold session startup then scanned and parsed the same
roots again while building the skills snapshot.
This solves the same duplicate-work problem as #28623 while keeping
ownership narrow: `PluginsManager` creates and owns
`PluginSkillSnapshots` only for its loaded-plugin cache entry;
`SkillsService` consumes an optional clone. Entry replacement or
clearing naturally drops the snapshots, with no separate generation,
capacity policy, or watcher coupling.
## Validation
- `cargo clippy -p codex-core-skills --all-targets -- -D warnings`
- `just test -p codex-core-plugins
skills_service_reuses_skills_parsed_during_plugin_load`
- `just test -p codex-core-skills
namespaces_plugin_skills_using_provided_namespace`
- `just fmt`
* Release 0.142.0-alpha.3
* Seed Termux release automation
* Prepare Termux rust-v0.142.0-alpha.3
---------
Co-authored-by: pakrym-oai <pakrym@openai.com>
Co-authored-by: Felipe Coury <felipe.coury@openai.com>
Co-authored-by: guinness-oai <guinness@openai.com>
Co-authored-by: jiayuhuang-openai <jiayuhuang@openai.com>
Co-authored-by: Anton Panasenko <apanasenko@openai.com>
Co-authored-by: Won Park <won@openai.com>
Co-authored-by: charlesgong-openai <charlesgong@openai.com>
Co-authored-by: Adam Perry @ OpenAI <anp@openai.com>
Co-authored-by: Matthew Zeng <mzeng@openai.com>
Co-authored-by: rka-oai <rka@openai.com>
Co-authored-by: jif <jif@openai.com>
Co-authored-by: Eric Traut <etraut@openai.com>
Co-authored-by: starr-openai <starr@openai.com>
Co-authored-by: Richard Lee <richardlee@openai.com>
Co-authored-by: iceweasel-oai <iceweasel@openai.com>
Co-authored-by: Gabriel Peal <gpeal@users.noreply.github.com>
Co-authored-by: Tom <wiltzius@openai.com>
Co-authored-by: maja-openai <163171781+maja-openai@users.noreply.github.com>
Co-authored-by: Eric Ning <ericning@openai.com>
Co-authored-by: canvrno-oai <kbond@openai.com>
Co-authored-by: martinauyeung-oai <martinauyeung@openai.com>
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
Co-authored-by: Adrian <145513011+adrian-openai@users.noreply.github.com>
Co-authored-by: Alex Daley <adaley@openai.com>
Co-authored-by: xl-openai <xl@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ fd29798c2dd4 (#246)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert c…
…nt/wallentx_termux-target_from_release_0.146.0_83cd65af74ea # Conflicts: # .github/workflows/rust-release.yml # codex-rs/Cargo.toml
…et_from_release_0.146.0_83cd65af74ea checkpoint: into wallentx/termux-target from release/0.146.0 @ 83cd65a
# Conflicts: # .github/scripts/publish_r2_release.py
Termux rust-v0.146.0-alpha.13
…nt/wallentx_termux-target_from_release_0.146.0_ee7e79c6ba05
…et_from_release_0.146.0_ee7e79c6ba05 checkpoint: into wallentx/termux-target from release/0.146.0 @ ee7e79c
* Release 0.141.0-alpha.6
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.6
* Release 0.141.0-alpha.7
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.7
* checkpoint: into wallentx/termux-target from release/0.141.0 @ 512c55a29a8f (#242)
* ## New Features
- Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
- Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
- Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
- App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
- Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
- TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
## Bug Fixes
- Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
- Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
- Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
- Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
- Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
- TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
## Chores
- Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
- Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
- Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.140.0...rust-v0.141.0
- #28001 [codex] package Windows ARM64 on x64 @tamird
- #28032 [codex] Carry exec-server cwd as PathUri @anp-oai
- #27607 [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
- #27992 [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
- #28125 build: run buildifier from just fmt @anp-oai
- #28120 bazel: add PowerShell to Wine test harness @anp-oai
- #27819 path-uri: render native paths across platforms @anp-oai
- #28122 [codex] exec-server honors remote environment cwd and shell @anp-oai
- #26662 feat(app-server): filter threads by parent @btraut-openai
- #27884 Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
- #27870 Discover stdio MCP servers from selected executor plugins @jif-oai
- #28283 [codex] update multi-agent v2 prompts @jif-oai
- #27602 [codex] Preserve plugin apps in connector listings @felixxia-oai
- #27461 [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
- #27893 Activate selected executor plugin MCPs in app-server @jif-oai
- #28332 [codex] Cap feedback upload subtrees @jif-oai
- #27365 Represent dynamic tools with explicit namespaces internally @sayan-oai
- #28333 skills: hide orchestrator skills with a local executor @jif-oai
- #27756 [codex] simplify shell snapshot ownership @pakrym-oai
- #27794 Remove terminal resize reflow flag gates @etraut-openai
- #28286 chore: restore exec-server relay keepalives @jif-oai
- #28164 [codex] simplify memory read metrics @pakrym-oai
- #27371 Expose explicit dynamic tool namespaces in thread start @sayan-oai
- #28309 linearize history output normalization @jif-oai
- #28306 avoid cloning sampling request input @jif-oai
- #28323 serialize websocket requests directly @jif-oai
- #28313 avoid cloning websocket request history @jif-oai
- #28344 [codex] remove stale PathExt import @pakrym-oai
- #27059 [codex] Cover OTLP HTTP log and trace event export @richardopenai
- #28327 reuse encoded Responses request bodies @jif-oai
- #27995 [codex] preserve explicit environment cwd @pakrym-oai
- #28285 guardian: isolate review context from skills and memories @jif-oai
- #26702 TUI Plugin Sharing 2 - add remote plugin section plumbing @canvrno-oai
- #28294 bound prompt image cache retention @jif-oai
- #28257 Support staging OAuth client ID overrides @apanasenko-oai
- #28341 core: let steer interrupt wait_agent @jif-oai
- #28336 skills: cache orchestrator resources per thread @jif-oai
- #28357 Extract shared Windows sandbox session runner @iceweasel-oai
- #27706 Use aws-lc-rs for rustls crypto provider @malsamiri-oai
- #28347 [codex] add path-types skill @anp-oai
- #28235 Add request user input auto-resolution timer @shijie-oai
- #28234 [mcp] Increase default tool timeout to 300 seconds @adaley-openai
- #28008 [codex] Add external agent import result accounting @charlesgong-openai
- #27944 recover stale Windows sandbox credentials @iceweasel-oai
- #27086 Add Windows unified exec yield floor @iceweasel-oai
- #28358 Add hidden Windows sandbox wrapper entrypoint @iceweasel-oai
- #27258 core: cache the tool search handler per session @mchen-oai
- #28143 feat(app-server): expose rate-limit reset credits @jayp-oai
- #28355 feat(core): add metadata field to ResponseItem @owenlin0
- #28203 [codex] Add created-by-me remote plugin marketplace @ericning-o
- #28365 Respect blocking PostToolUse hooks in code mode @abhinav-oai
- #27813 [codex] Reuse Apps policy evaluation across MCP tool exposure @mzeng-openai
- #28300 Deflake realtime handoff steering test @felixxia-oai
- #28395 [codex] Preserve remote plugin directory order @jameswt-oai
- #27955 [codex] retain resolved environments across turns @pakrym-oai
- #27917 Add realtime speech append control @guinness-oai
- #27093 [codex-analytics] Analytics Capture to File in Debug Builds @jameswt-oai
- #26242 exec-server: add Noise relay transport @viyatb-oai
- #28165 Use PathUri in filesystem permission paths for exec-server @anp-oai
- #28415 [codex] Fix missing response item metadata in tests @adaley-openai
- #27058 [codex] Add second-based OTEL duration histograms @richardopenai
- #27902 [codex] Centralize plugin auth capability filtering @felixxia-oai
- #28405 Add a toggle for realtime startup context @guinness-oai
- #26434 Preserve hook trust bypass in codex exec threads @abhinav-oai
- #26245 exec-server: default remote transport to Noise @viyatb-oai
- #28383 [codex] Load API curated marketplace by auth @felixxia-oai
- #27958 [codex] Make plugin details capability aware @felixxia-oai
- #28367 Use ApiPathString in app-server filesystem permission paths @anp-oai
- #28421 [codex] Bind shell snapshots to retained thread environments @pakrym-oai
- #28429 [codex] Add interruptible sleep tool @pakrym-oai
- #28441 [codex] Use expect in integration tests @pakrym-oai
- #28163 [codex] Use local environment for user shell commands @pakrym-oai
* Seed Termux release automation
* Prepare Termux rust-v0.141.0
---------
Co-authored-by: sayan-oai <sayan@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ 8f4b05f9cc47 (#244)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
representation
- restore Wine coverage for retained Windows cwd values and successful
completion
* [codex] Split plugin and skill warmup tracing (#28605)
## What changed
- promote plugin config loading to an info-level `plugins_for_config`
span
- promote skill config loading to an info-level `skills_for_config` span
- attach stable OpenTelemetry names to both spans
## Why
`session_init.plugin_skill_warmup` currently combines plugin loading and
skill loading, which makes cold-start traces unable to identify which
phase dominates. These child spans preserve the existing aggregate while
making the two costs independently visible.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
This is observability-only. It does not change plugin or skill loading
behavior.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins` (347 passed)
- `just fmt`
* [codex] Pass plugin namespace into skill loading (#28608)
## What changed
- retain the parsed plugin manifest namespace on loaded plugins
- carry that namespace through `PluginSkillRoot` and `SkillRoot`
- use the provided namespace when qualifying plugin skill names
- include the namespace in the skills cache key
## Why
Plugin loading has already parsed `plugin.json`, but skill parsing
currently walks every `SKILL.md` ancestor and probes/reads the manifest
again to reconstruct the same namespace. Passing the parsed namespace
removes those repeated filesystem calls, which are particularly costly
on remote filesystems.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
Plugin skill names remain unchanged. A regression test uses a
deliberately different on-disk manifest name to verify that plugin roots
use the provided parsed namespace.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins` (352 passed)
- `just fix -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins`
- `just fmt`
* [codex] add rollout token budget configuration (varlength 1/N) (#28746)
## What
This PR defines the structured configuration contract for shared rollout
token budgets (across ALL agent threads under 1 rollout).
```toml
[features.rollout_budget]
enabled = true
limit_tokens = 100000
reminder_interval_tokens = 10000
sampling_token_weight = 1.0
prefill_token_weight = 0.1
```
The reminder interval defaults to 10% of the rollout limit. Sampling and
prefill weights default to `1.0`.
## Scope
This PR only defines and validates configuration. It does not track
usage, inject reminders, or stop a rollout. Accounting and reminders are
implemented in the stacked follow-up #28494.
The existing `token_budget` feature remains unchanged. `rollout_budget`
has its own feature key and configuration type.
## Tests
The config test verifies that the structured fields resolve into
`RolloutBudgetConfig` and do not enable the existing `token_budget`
feature.
Local checks:
- `just write-config-schema`
- `just test -p codex-core load_config_resolves_rollout_budget`
- `cargo check -p codex-thread-manager-sample`
- `git diff --check`
The full workspace test suite was not run locally.
* Add network environment ID plumbing (#28766)
## Why
Prepare network approval scoping to distinguish execution environments
without changing behavior yet.
## What changed
- Add optional environment IDs to network policy requests.
- Add optional network environment IDs to exec and sandbox request
structs.
- Thread default None values through existing construction points.
- Fix stale constructor call sites that caused the CI compile failures.
## Not included
- Per-environment proxy listeners.
- Network approval cache or prompt behavior changes.
- Ambiguous request attribution handling.
Those behavior changes moved to stacked follow-up #28899.
## Validation
- just fmt
- CI will run tests and clippy
* Avoid sandbox helper in apply_patch approval tests (#28915)
## Summary
This keeps the apply_patch approval tests focused on approval behavior
instead of macOS sandboxed filesystem helper startup.
The changed cases still force patch approval with `UnlessTrusted`, but
use `DangerFullAccess` after approval so the patch write is direct and
cheap. Workspace-write and sandbox-helper behavior remain covered by the
filesystem and apply_patch sandbox tests.
* Pause active goals before TUI interrupts (#28813)
Fixes #28104.
## Summary
Active `/goal` turns should leave the persisted goal paused whenever the
TUI interrupts the running turn. The bug in #28104 showed this most
visibly through `Esc`: some interrupt paths aborted the turn without
updating the goal status, so the goal could remain active and continue
automatically.
This change makes `ChatWidget` pause an active goal before the TUI sends
an interrupt from the status-row path, the pending-steer path, `Ctrl+C`,
or a request-user-input overlay. The modal overlay now reports whether a
key will interrupt the turn, which keeps modal `Esc` and `Ctrl+C`
behavior aligned with the normal interrupt paths.
## Manual Testing
Built the local CLI with `just codex --help`, then launched the local
TUI with goals enabled. Started an active `/goal` turn and interrupted
it with `Esc`, then resumed and repeated with `Ctrl+C`; both paths
showed `Goal paused`, the interrupted-conversation message, and the
`Goal paused (/goal resume)` footer. I also stopped the background
terminal and exited the TUI cleanly after the run.
I did not find a reliable standalone manual path to force the
request-user-input overlay case, so that path is covered by the focused
automated test.
* Recover exec process stdin writes (#28895)
## Summary
Remote stdio MCP servers send tool calls by writing JSON-RPC bytes
through `process/write`.
When the exec-server websocket drops at the wrong time, the remote
process can survive session recovery, but the stdin write can still fail
back to RMCP as a transport send error. RMCP then closes the stdio MCP
transport, so tools like `node_repl` are lost even though the
process/session recovery path is working.
This changes `process/write` to be safe to retry across exec-server
recovery:
- adds a required `writeId` to `process/write`
- retries remote `Session::write` with the same `writeId` after
reconnect
- remembers accepted write ids per process so duplicate retries return
`Accepted` without writing the same bytes to child stdin again
- covers both the client retry path and server-side write id dedupe with
tests
In simple terms:
```text
before:
write to MCP stdin -> websocket closes -> write errors -> RMCP closes node_repl
after:
write to MCP stdin -> websocket closes -> reconnect -> retry same writeId
server either writes once or recognizes it already did
```
* Pin Windows argument lint to Windows 2022 (#28940)
## What
Run the Windows argument-comment-lint job on the `windows-2022` hosted
runner instead of the custom Windows runner pool.
## Why
The custom pool recently moved from the Visual Studio 2022 Windows image
to `windows-2025-vs2026`. Since that migration, the job fails while
Bazel materializes LLVM external repository sources, before the argument
lint itself runs. The same failure appears across unrelated PRs.
This narrow change tests GitHub’s recommended mitigation for workloads
that still require the Visual Studio 2022 image:
https://github.com/actions/runner-images/issues/14017
## How
Use the standard `windows-2022` runner for only the Windows
argument-comment-lint matrix entry. No product code or lint behavior
changes.
* Scope MCP sandbox metadata to server environment (#28914)
Scope MCP sandbox metadata to the MCP server's owning environment.
Previously, `codex/sandbox-state-meta` always used the turn's primary
cwd and rebuilt a legacy sandbox policy from that cwd. That can be wrong
for MCP servers owned by a different execution environment.
This now sends the owning environment cwd as a `file:` URI in
`sandboxCwd`, keeps `permissionProfile` as the permission source of
truth, and omits sandbox-state metadata when a non-default server
environment is not selected for the turn. Local/default MCP servers keep
the existing fallback cwd behavior.
Tests:
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `just test -p codex-mcp`
- `just test -p codex-core mcp_sandbox_cwd`
- `cargo build -p codex-rmcp-client --bin test_stdio_server`
- `just test -p codex-core
stdio_mcp_tool_call_includes_sandbox_state_meta`
* Add turn-scoped context contributions (#28911)
## Summary
- keep context injection on a single ContextContributor trait
- split context injection into thread-scoped and turn-scoped
contribution methods
- wire turn-scoped fragments into initial context assembly so extensions
can contribute context from turn-local state
* Fix goal-first live threads missing from thread/list (#28808)
Fixes #28263.
## Why
When a thread starts with `/goal`, the goal extension can update SQLite
goal state before the thread has any user-turn rollout items.
`thread/list` and `thread/search` rely on persisted listing metadata, so
a goal-first live thread could be absent from app-server listings after
restart even though the goal itself existed.
This regressed when goal handling moved out of core: the core path wrote
the goal update through the live thread rollout path, while the
extension-backed app-server path only updated goal state and emitted the
live notification.
## What
- Add `GoalSetOutcome::thread_goal_updated_item()` so the goal extension
owns the canonical `ThreadGoalUpdated` rollout item shape.
- Expose a narrow `CodexThread::append_rollout_items()` helper that
appends through the live thread and keeps derived SQLite metadata in
sync.
- When app-server sets a goal on an active live thread, persist the goal
update through that live-thread path.
- Add an app-server regression test that starts a live thread with
`thread/goal/set` and verifies it appears in state-DB-only
`thread/list`.
## Verification
- `env -u CODEX_SQLITE_HOME just test -p codex-app-server
goal_first_live_thread_appears_in_state_db_thread_list`
* [codex] Initialize exec-server OpenTelemetry at startup (#25019)
## Summary
- Initialize stderr tracing and the configured OpenTelemetry provider
for local and remote `codex exec-server` startup.
- Instrument the local and remote server entrypoints with a root runtime
span.
- Keep raw Noise environment, registration, and stream identifiers out
of exported spans while preserving them in local debug events.
- Keep telemetry setup in a focused CLI module instead of growing the
top-level command entrypoint.
## Stack
- Previous: none (`#27058` has merged)
- Next: #27466
## Validation
- `just test -p codex-exec-server --lib` (139 passed)
- `just test -p codex-cli --test exec_server` (3 passed)
- `just bazel-lock-check`
- `just fix -p codex-exec-server -p codex-cli`
- `just fmt`
---------
Co-authored-by: Richard Lee <richardlee@openai.com>
* [codex] Fix Windows sandbox runtime ACL refresh (#28943)
## Why
Codex Desktop repairs sandbox-user read/execute access for binaries
copied to `%LOCALAPPDATA%\OpenAI\Codex\bin`, but Computer Use launches
its bundled Node runtime from `%LOCALAPPDATA%\OpenAI\Codex\runtimes`.
On fresh Windows installations, `CodexSandboxUsers` may therefore be
unable to execute the bundled Node binary. The command runner starts,
but `CreateProcessAsUserW` fails with error 5 (`ACCESS_DENIED`), causing
the Node REPL to exit before Computer Use can discover applications.
This is a follow-up to #21564, which added the original runtime `bin`
ACL repair.
## What changed
- Expand the Codex Desktop runtime ACL roots from only `bin` to both
`bin` and `runtimes`.
- Apply the existing inherited read/execute ACL repair to each runtime
directory when it exists.
- Rename the setup helper to reflect that it now handles multiple
runtime paths.
## Validation
- `cargo fmt -- --check`
- `just test -p codex-windows-sandbox` was run: 113 tests passed and
five environment-dependent legacy execution tests failed because
`CreateRestrictedToken` returned error 87.
* Synchronize realtime notification test requests (#28946)
## What
Deliver the scripted realtime notification batch after the assistant
text append request instead of after the preceding developer text append
request.
## Why
The batch ends with an upstream error that closes the realtime
conversation. When it is emitted after the developer append, it races
the subsequent assistant append: the app-server RPC can acknowledge the
append before its downstream WebSocket send completes, and the test
intermittently observes three requests instead of four.
Making the fake server wait for the assistant append before emitting the
terminal batch establishes the ordering the test asserts without sleeps
or production-code changes.
## Validation
- `git diff --check`
- CI (the failure is timing-dependent and most reproducible in the
Windows Bazel shard)
* Add Config for Time Reminders (varlatency 1/n) (#28822)
## Summary
Example:
> [features.current_time_reminder]
enabled = true
reminder_interval_model_requests = 1
clock_source = "system"
## Testing
- `just test -p codex-core varlatency`
- `just test -p codex-core
lock_contains_prompts_and_materializes_features`
- `just fix -p codex-core -p codex-config -p codex-features`
* [codex] rollout budget implementation (varlength 2/N) (#28494)
## Stack
Depends on #28746. This PR implements shared rollout-budget accounting
and model-visible reminders using the configuration defined in #28746.
# Description / Main changes to Core:
`AgentControl` will now be the area where "rollout level" features &
accounting will have to live. It is incorrectly named for this
responsibility, but I think it can hold all the necessary shared state &
features (rollout token budget, mutliple thread interruption
responsibilitym etc)
In this PR, we have one "token ledger" that each thread will subtract
from when sampling. The "charge" will occur when response.completed() is
done and the calculation will be done on the responses api usage
carrier. The calculation will weigh sampling and pre-fill tokens as
specified.
Every time the budget crosses the configured reminder threshold, a
developer message is appended before the thread's next request
This remaining budget will _always_ be restated/reminded after a
compaction event.
Expiration and fan-out interruption will be in the stacked follow-up
(and also live in Agent Control).
## Reminders
"You have weighted {session_tokens_left} tokens left in the shared
session token budget."
The first request in each thread context receives the current remainder.
Later reminders are emitted after aggregate weighted usage crosses a
configured interval. If several intervals are crossed before a thread
sends another request, Core inserts one reminder with the latest
remainder.
Compaction response usage is charged before the next context starts. The
next reminder is appended after the compaction summary, leaving the
initial context content stable.
## Tests
Integration coverage verifies:
- weighted output and non-cached input accounting
- initial and periodic reminders
- shared accounting between a root and sub-agent
- post-compaction remainder and message placement
Local checks:
- `just fmt`
- `just test -p codex-core rollout_budget`
- `git diff --check`
The full workspace test suite was not run locally.
* Support `openai/form` extended form elicitations (#27500)
# Summary
Allow App Server clients to opt into `openai/form` MCP elicitations.
* [codex] Make thread store turn filter optional (#28949)
Make `ListItemsParams::turn_id` optional so callers can list persisted
items across an entire thread or narrow the result to one turn. This
aligns the thread-store API and documentation with thread-wide item
listing while preserving the optional turn-filter behavior for
implementations.
* current time reminders impl for system clock (varlatency 2/n) (#28824)
Stacked on #28822.
## Summary
- add a host-injectable current-time provider with a built-in system
implementation
- record UTC developer reminders in history immediately before due model
requests
- keep cadence state per session and force a refresh after compaction
This does NOT include the app server client <-> server clock logic. This
PR is only for the reminder message & system clock that will be used in
prod.
## Testing
- `just test -p codex-core varlatency_`
- `just clippy -p codex-core -p codex-app-server -p codex-mcp-server -p
codex-thread-manager-sample`
- `just fmt`
* [codex] Cache plugin metadata for tool suggestions (#27812)
## Why
`built_tools` runs for every sampling request, and local plugin
discovery was repeatedly rereading plugin manifests, skills, MCP
configuration, and app declarations to build the same tool-suggest
metadata.
That source-derived metadata is stable until the existing plugin manager
reloads its cache. Runtime eligibility still needs to reflect the
current install, disable, policy, app-overlap, and authentication state.
## What changed
- Add a bounded, in-memory tool-suggest metadata cache owned by
`PluginsManager`.
- Key cached metadata by plugin identity and source, while applying
authentication routing each time the metadata is projected.
- Invalidate the metadata alongside the existing loaded-plugin cache,
including its normal configuration, marketplace refresh, and
remote-installed-plugin invalidation paths.
- Guard against an in-flight load repopulating stale metadata after
invalidation.
- Keep marketplace membership and all runtime eligibility filtering live
rather than introducing a separate catalog or revision model.
## Impact
Repeated sampling requests reuse already-loaded plugin capability
metadata while retaining the existing plugin-manager lifecycle as the
single freshness boundary.
## Validation
- `just test -p codex-core-plugins` — 252 passed
- Added focused coverage for cache invalidation and authentication
reprojection.
* apply-patch: carry paths as PathUri (#28854)
## Why
Allows the model to edit files that are hosted on a different OS than
where app-server is running.
## What
* Use `PathUri` for apply_patch-internal data structures
* Limit `PathUri` -> `AbsolutePathBuf` conversion to cases where the
inferred path convention matches the host OS, allows requiring valid
paths to pass to perms check
* Adds `PathConvention::path_segments()` for iterating over path
segments regardless of OS
* Handle cross-platform relative paths in path filename parsing for
sniffing a shell
* Ensure we can apply patches in the wine e2e test
* Add app-server current-time impl (varlatency 3/n) (#28835)
## What
Server should request:
```
{
"id": 42,
"method": "currentTime/read",
"params": {
"threadId": "11111111-1111-1111-1111-aaaaafdc2c11"
}
}
```
Client should respond with something like:
```rust
{
"id": 42,
"result": {
"currentTimeAt": 1781717655
}
}
```
## Why
Sessions configured with `clock_source = "external"` need a
thread-specific external time source before inference. The system clock
remains the default production provider.
## Validation
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-app-server --test all
current_time_read_round_trip_adds_reminder_to_model_input`
- `cargo test -p codex-app-server
first_attestation_capable_connection_for_thread_only_uses_thread_subscribers`
- `cargo test -p codex-analytics`
- `just fix -p codex-app-server-protocol`
- `just fix -p codex-app-server`
Stacked on #28824.
* Make auto-review on-request prompt more proactive (#26496)
## Why
`on-request` approval policy text is currently tuned for user-reviewed
approvals. For auto-reviewed productivity runs, likely sandbox blocks
should be escalated earlier so commands that need remote services,
authentication, or other out-of-sandbox access do not first fail or hang
inside the sandbox.
## What changed
- Adds a separate `on_request_auto_review.md` permissions prompt
selected for `AskForApproval::OnRequest` with
`ApprovalsReviewer::AutoReview`.
- Keeps the normal user-reviewed `on-request` wording unchanged.
- Makes the `When to request escalation` bullets more explicit about
likely sandbox blocks, network access, remote
auth/cluster/cloud/database access, out-of-sandbox environment access,
git operations that may write lock files, and short-timeout reruns after
likely sandbox-blocked attempts.
- Omits approved command prefix and `prefix_rule` guidance for the
auto-review on-request prompt.
- Adds prompt tests covering the auto-review path, normal on-request
wording, and inline permission request behavior.
* [codex] Remove hardcoded app ID filters (#28947)
## Summary
- remove the duplicated originator-specific connector ID denylists
- stop filtering connector directory/accessibility results and
live/cached Codex Apps MCP tools by hardcoded connector ID
- remove the now-unused `codex-login` dependency from
`codex-utils-plugins`
- update regression coverage so formerly blocked connector IDs are
preserved
## Why
The client-side policy was duplicated across crates, used opaque IDs
without ownership or expiry information, and could drift between app
listing and MCP tool behavior. Server-provided visibility,
authorization, plugin discoverability, accessibility, enabled-state
handling, and consequential-tool approval templates remain unchanged.
## Validation
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `git diff --check`
- confirmed the final diff contains no hardcoded denylist symbols
A targeted `codex-mcp` test build spent an unusually long time in local
compilation/linking. Its first attempt exposed a test-only `PartialEq`
assertion issue, which was corrected. A follow-up non-linking `cargo
check -p codex-mcp --tests` was still running when this draft was
opened; CI should provide the complete Rust validation.
* TUI: improve unified mention selection visibility (#28959)
## Summary
[@milanglacier reported in
#28653](https://github.com/openai/codex/issues/28653) that the active
mention candidate is hard to distinguish. I suspect [@binbjz’s #28500
report](https://github.com/openai/codex/issues/28500) _(where arrow-key
navigation appeared not to work)_ may describe the same presentation
problem: the selection may have been changing, but the UI was not
showing the active row clearly in their terminal. This PR makes two
small changes to the selection indication behavior:
- Reserve a two-character gutter and mark the active candidate with `> `
for color-agnostic indicator coverage.
- Apply the shared theme-aware accent to the entire selected row for
extra emphasis.
- Update the existing popup snapshot.
Reverse-video styling was considered, but avoided it because it is
overly dependent on the user’s terminal palette.
<img width="2046" height="482" alt="image"
src="https://github.com/user-attachments/assets/b5eb62c3-fd24-4c09-906e-7bd66913b5c6"
/>
## Testing
- `just test -p codex-tui default_unified_mention_popup_snapshot`
- `just clippy -p codex-tui`
- `just fmt`
- Compiled `codex-cli` and tested the unified mentions picker in the
terminal.
* Emit Trusted MCP App Identity on Tool-Call Items (#27132)
## Summary
- Add optional `appContext` to app-server MCP tool-call items with
trusted `connectorId`, `linkId`, and `mcpAppResourceUri` metadata.
- Preserve that context across tool-call events, persisted history,
reconnects, and thread resume.
- Keep the deprecated top-level `mcpAppResourceUri` temporarily for
client migration.
The consumer contract is `{ appContext: { connectorId, linkId,
mcpAppResourceUri }, tool }`.
## Validation
- Full GitHub Actions suite passes, including CLA, Bazel tests, clippy,
release builds, and argument-comment lint.
---------
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
* feat: opt ChatGPT auth into agent identity (#19049)
## Stack
This is PR 2 of the simplified HAI single-run-task stack:
- [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
assertion and task-registration primitives, including the shared
run-task helper used by existing Agent Identity JWT auth.
- [#19049](https://github.com/openai/codex/pull/19049)
Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
Agent Identity runtime auth and its single run task.
- [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
provider auth that uses one backend-owned task id for first-party
inference and compaction requests.
[#19054](https://github.com/openai/codex/pull/19054) collapsed out of
the active stack because the simplified design no longer needs a
separate background/control-plane task helper.
## Summary
This PR adds the disabled-by-default path for normal ChatGPT-login Codex
sessions to obtain Agent Identity runtime auth through the Codex
backend. Existing Agent Identity JWT startup mode remains a separate
path and does not require the feature flag.
What changed:
- adds the experimental `use_agent_identity` feature flag and config
schema entry
- adds an explicit `AgentIdentityAuthPolicy` so call sites choose
`JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
- stores standalone Agent Identity JWT credentials separately from
backend-registered Agent Identity records
- persists the registered Agent Identity record, private key, and single
run task id in `auth.json` so process restarts reuse the same identity
- derives the agent/task registration base URL from ChatGPT/Codex auth
config while keeping JWT JWKS lookup separate
- provisions and caches ChatGPT-derived Agent Identity runtime auth when
`use_agent_identity` is enabled
- reuses the shared run-task registration helper from PR1 rather than
adding a second task-registration path
This PR intentionally does not switch model inference over to
`AgentAssertion` auth. The provider-auth integration lands in the next
PR.
## Testing
- `just test -p codex-login`
* [connectors] Ignore synthetic links for app accessibility (#28770)
Summary
- Stop treating Codex Apps MCP tools with
`_meta._codex_apps.synthetic_link: true` as evidence that a connector is
accessible in `app/list`.
- Preserve synthetic tools in the agent-facing MCP connector set so they
remain available for install/auth flows.
- Keep the app-list accessibility cache limited to connectors backed by
at least one non-synthetic tool.
- Add focused regression coverage for both sides of the boundary.
Validation
- `just fmt`
- `just test -p codex-core
synthetic_links_are_exposed_to_the_agent_but_not_accessible_in_app_list`
- `git diff --check`
- A crate-wide `just test -p codex-core` run completed with 2,699
passing and 51 unrelated local sandbox/state failures, primarily state
DB migration races (`UNIQUE constraint failed:
_sqlx_migrations.version`).
* [codex] Preserve remote plugin download status errors (#28863)
## Summary
- preserve the original HTTP status when a remote plugin bundle download
returns a non-success response
- retain at most 8 KiB of the error response body and annotate
truncation or body-read failures
- add regression coverage for an oversized error response
## Root cause
The non-success response path reused the normal size-limited body
reader. When an error response exceeded 8 KiB, that reader returned
`DownloadTooLarge` before the code constructed `DownloadStatus`, masking
the upstream HTTP status and response context.
## Impact
Remote plugin installation failures now retain the actionable upstream
HTTP status without allowing unbounded error bodies into logs.
## Validation
- `just test -p codex-app-server
plugin_install_preserves_status_when_remote_bundle_error_body_is_too_large`
- `just fmt`
- `git diff --check`
* core: load AGENTS.md from foreign environments (#28958)
## Why
Make it possible to load AGENTS.md from remote exec-servers whose OS is
different than app-server.
## What
- keep `AGENTS.md` discovery and provenance as `PathUri`, with
root-aware parent and ancestor traversal
- expose lifecycle instruction sources as legacy app-server path strings
in events while retaining `PathUri` internally
- preserve and test mixed POSIX and Windows paths in model context and
TUI status output
- cover remote Windows loading end to end by seeding the Wine prefix
through host filesystem APIs
- fix bug in `PathUri`'s parent() implementation that would erase
Windows drive letters
* [codex] Support marketplace plugin manifest fallback (#28789)
## Summary
Support marketplace plugins whose source directory does not include a
discoverable plugin manifest. Metadata-rich `marketplace.json` entries
now act as fallback plugin manifests for listing, local detail reads,
install, and non-curated cache refresh.
The fallback preserves marketplace-entry plugin fields wholesale, then
adds the small Codex-facing compatibility bridge for presentation
metadata. A real source `plugin.json` always wins when present.
## Details
- Capture flattened marketplace-entry fields into
`MarketplacePluginManifestFallback`, preserving fields such as
`version`, `description`, `skills`, `mcpServers`, `apps`, `hooks`,
`agents`, `commands`, `strict`, `author`, and future manifest fields
without a per-field translation list.
- Bridge Claude-style top-level `displayName`, `author.name`,
`homepage`, and marketplace `category` into Codex's nested `interface`
fields only when the nested values are absent.
- Treat fallback metadata as installable only when the marketplace entry
contributes metadata beyond bare `name` and `source`; existing
missing-manifest behavior remains for metadata-free entries.
- Read local plugin details from the already parsed fallback manifest,
including fallback-declared app and MCP paths, instead of rereading only
an on-disk manifest.
- Pass fallback contents into `PluginStore`, which validates them and
injects `.codex-plugin/plugin.json` into Store's existing atomic copy.
Local marketplace source directories are never mutated, and the fallback
path no longer needs an additional staging directory.
- Keep Git source materialization unchanged; Git clones still use the
existing marketplace source staging area before Store installation.
* [codex] Remove child AGENTS.md prompt experiment (#28993)
## Why
`child_agents_md` is a disabled, under-development experiment that adds
a second model-visible explanation of hierarchical `AGENTS.md` behavior.
Keeping it leaves unused prompt, configuration, documentation, and test
surface.
## What changed
- remove the `ChildAgentsMd` feature and `child_agents_md` config schema
entry
- remove the hierarchical prompt asset, export, and instruction
injection
- remove feature-specific tests and documentation
- keep the generic unstable-feature warning coverage using
`apply_patch_streaming_events`
Normal project `AGENTS.md` discovery and composition are unchanged.
## Testing
- `just test -p codex-features`
- `just test -p codex-prompts`
- `just test -p codex-core agents_md`
- `just test -p codex-core unstable_features_warning`
* core: log AGENTS.md paths as URIs (#28989)
## Why
No need to do path contortions when it's for our own logs.
## What
Follow up on a previous PR's nit and update the path-types skill for
future reference.
* core: keep remote exec on reported shell (#28983)
## Why
We need to avoid resolving shells on the app-server's host for remote
environments. We might make it possible to do fancier shell resolution
from remote envs but for now just require the model to produce a shell
that matches the environment's default.
This gets my e2e demo working for shell commands after #28854 moved
shell resolution to PathUri and caused remote envs to hit the fallback
shell when the shell wasn't available on the host.
## What
Remote `exec_command` calls now accept only the environment's reported
default shell name or exact path, and execute with that reported path.
Other explicit shells return a concise error. A Wine-backed integration
test covers explicit PowerShell execution in the Windows cwd.
* [codex] Reuse parsed plugin skills during session startup (#28844)
## Summary
- Preserve raw plugin skill-root snapshots in the matching loaded-plugin
cache entry, keyed by the effective plugin root identity including
namespace.
- Pass those snapshots through `SkillsLoadInput` as an optional preload,
so session startup reuses plugin parsing while ordinary skill loads pass
`None`.
- Keep plugin skill loading cohesive: the existing loaders accept the
optional snapshots directly, and uncached or marketplace-detail paths do
not create a cache.
## Why
Plugin discovery already parses plugin skills to determine available
capabilities. Cold session startup then scanned and parsed the same
roots again while building the skills snapshot.
This solves the same duplicate-work problem as #28623 while keeping
ownership narrow: `PluginsManager` creates and owns
`PluginSkillSnapshots` only for its loaded-plugin cache entry;
`SkillsService` consumes an optional clone. Entry replacement or
clearing naturally drops the snapshots, with no separate generation,
capacity policy, or watcher coupling.
## Validation
- `cargo clippy -p codex-core-skills --all-targets -- -D warnings`
- `just test -p codex-core-plugins
skills_service_reuses_skills_parsed_during_plugin_load`
- `just test -p codex-core-skills
namespaces_plugin_skills_using_provided_namespace`
- `just fmt`
* Release 0.142.0-alpha.3
* Seed Termux release automation
* Prepare Termux rust-v0.142.0-alpha.3
---------
Co-authored-by: pakrym-oai <pakrym@openai.com>
Co-authored-by: Felipe Coury <felipe.coury@openai.com>
Co-authored-by: guinness-oai <guinness@openai.com>
Co-authored-by: jiayuhuang-openai <jiayuhuang@openai.com>
Co-authored-by: Anton Panasenko <apanasenko@openai.com>
Co-authored-by: Won Park <won@openai.com>
Co-authored-by: charlesgong-openai <charlesgong@openai.com>
Co-authored-by: Adam Perry @ OpenAI <anp@openai.com>
Co-authored-by: Matthew Zeng <mzeng@openai.com>
Co-authored-by: rka-oai <rka@openai.com>
Co-authored-by: jif <jif@openai.com>
Co-authored-by: Eric Traut <etraut@openai.com>
Co-authored-by: starr-openai <starr@openai.com>
Co-authored-by: Richard Lee <richardlee@openai.com>
Co-authored-by: iceweasel-oai <iceweasel@openai.com>
Co-authored-by: Gabriel Peal <gpeal@users.noreply.github.com>
Co-authored-by: Tom <wiltzius@openai.com>
Co-authored-by: maja-openai <163171781+maja-openai@users.noreply.github.com>
Co-authored-by: Eric Ning <ericning@openai.com>
Co-authored-by: canvrno-oai <kbond@openai.com>
Co-authored-by: martinauyeung-oai <martinauyeung@openai.com>
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
Co-authored-by: Adrian <145513011+adrian-openai@users.noreply.github.com>
Co-authored-by: Alex Daley <adaley@openai.com>
Co-authored-by: xl-openai <xl@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ fd29798c2dd4 (#246)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
r…
…nt/wallentx_termux-target_from_release_0.146.0_15612c81a276 # Conflicts: # .github/workflows/rust-release.yml # codex-rs/Cargo.toml
…et_from_release_0.146.0_15612c81a276 checkpoint: into wallentx/termux-target from release/0.146.0 @ 15612c8
- Name new sessions with `/new` or `/clear`, pin important threads, and switch between side conversations without closing them. (openai#34605, openai#34840, openai#35011) - Support Agent Plugins manifests, workspace plugin publishing, and additional plugin marketplaces for Amazon Bedrock and Claude Code. (openai#35105, openai#35254, openai#34931, openai#34979) - Fork threads with paginated history, including temporary forks that do not appear in thread listings. (openai#35220, openai#35251) - Connect app-server to remote Code Mode hosts over WebSocket. (openai#35078, openai#35098) - Enable standalone web search for compatible custom model providers. (openai#34846) - Discover executor-provided skills and securely read their associated resources, including explicitly selected skills. (openai#35184, openai#35198) ## Bug Fixes - Honor configured proxies across authentication, plugin downloads, MCP authorization, remote execution, WebSockets, redirects, and LM Studio connections. (openai#34479, openai#34509, openai#34655, openai#34678, openai#35023, openai#35056, openai#35239) - Keep MCP connections and Apps tools current when authentication or configuration changes, reconnecting closed servers without restarting healthy connections. (openai#34952, openai#34957, openai#35028, openai#35144, openai#35146, openai#35151) - Preserve submitted messages, final responses, failed-turn errors, imported timestamps, and approval settings across interruptions, replay, imports, and forks. (openai#34839, openai#34777, openai#35524, openai#34989, openai#34664) - Improve terminal responsiveness and rendering, including nonblocking interrupts, keyboard handling, narrow layouts, hyperlinks, and refreshed mention results. (openai#35000, openai#35021, openai#34775, openai#34778, openai#35365, openai#35375) - Fix Windows navigation keys, reliably terminate sandboxed process trees, and preserve proxy settings during security reviews. (openai#34625, openai#34624, openai#35036) - Retain more available skills under tight context budgets and warn when skill catalogs must be truncated. (openai#34732, openai#34738, openai#34997) ## Documentation - Document shared HTTP-client usage, proxy-aware connection pooling, and safe outbound request handling. (openai#34669) - Clarify Windows drive-letter canonicalization for `PathUri` values. (openai#34667) ## Chores - Publish release artifacts, channel metadata, and installer aliases through OpenAI-hosted release infrastructure, with GitHub fallback. (openai#34505, openai#34508, openai#34729, openai#34910) - Sign and notarize bundled macOS helper executables before packaging. (openai#35264) - Reduce app-server serialization overhead and unnecessary request-building allocations. (openai#34761, openai#34766, openai#34825) - Add enterprise-plan recognition and administrator controls for in-app updates. (openai#35238, openai#35537) ## Changelog Full Changelog: openai/codex@rust-v0.145.0...rust-v0.146.0 - openai#34447 Add a route-aware HTTP client pool @copyberry - openai#34449 Make external session detection limits configurable @copyberry - openai#34451 Attribute external agent imports by provider @copyberry - openai#34463 Support alpha hotfix release versions @copyberry - openai#34469 Preserve thread settings for goal-first and forked threads @copyberry - openai#34476 Separate HTTP execution from request logging @copyberry - openai#34478 Honor `CARGO_HTTP_CAINFO` in managed proxy environments @copyberry - openai#34479 Re-resolve system proxy routes across redirects @copyberry - openai#34481 Add route-aware redirect test coverage @copyberry - openai#34483 Expand route-aware proxy redirect coverage @copyberry - openai#34490 Route backend requests through the HTTP client factory @copyberry - openai#34491 Route cloud environment discovery through the HTTP client pool @copyberry - openai#34495 Honor system proxy settings in the daemon updater @copyberry - openai#34497 Preserve custom arg0 for sandboxed exec-server processes @copyberry - openai#34505 Mirror Rust release artifacts to Cloudflare R2 @copyberry - openai#34506 Respect system proxies during plugin startup sync @copyberry - openai#34508 Publish release metadata to R2 channels @copyberry - openai#34509 Honor system proxy settings for remote plugins @copyberry - openai#34514 Add an optional releases.openai.com installer source @copyberry - openai#34516 Allow `numer` in codespell checks @copyberry - openai#34517 Pass empty inherited FDs in the Wine PTY test @copyberry - openai#34522 Split MCP connection manager into focused modules @copyberry - openai#34525 Add step-scoped data to extension contributors @copyberry - openai#34533 Centralize compacted rollout item construction @copyberry - openai#34540 Detach Git metadata commands from stdin @copyberry - openai#34544 Size Noise handshake buffers to their messages @copyberry - openai#34547 Add reciprocal rank fusion skill selection @copyberry - openai#34550 Test thread-scoped MCP refresh behavior @copyberry - openai#34551 Simplify TUI restoration for the external editor @copyberry - openai#34552 Remove unused RtOptions setters @copyberry - openai#34553 Remove the unused TUI shutdown app command @copyberry - openai#34558 Remove obsolete ignored tests @copyberry - openai#34559 Add backend client support for Codex user settings @copyberry - openai#34561 Extract MCP binding clients from the connection manager @copyberry - openai#34562 Record rollout boundaries for materialized turns @copyberry - openai#34563 Page through inherited thread history @copyberry - openai#34566 Protect fork history references during rollout cleanup @copyberry - openai#34570 Highlight CUDA files as C++ in the TUI @copyberry - openai#34573 Accept `forceRefetch` in plugin list requests @copyberry - openai#34578 Gate the TUI suspend restore helper on Unix @copyberry - openai#34581 Add routing-card lexical skill selection @copyberry - openai#34588 Bind MCP calls to captured catalog revisions @copyberry - openai#34590 Add keyed shell environment policy filters @copyberry - openai#34597 Enforce exact values from managed config requirements @copyberry - openai#34598 Skip missing paths in filesystem sandbox entries @copyberry - openai#34601 Sanitize skill names in injection metrics @copyberry - openai#34603 Allow explicitly permitted loopback proxy targets @copyberry - openai#34605 Allow naming sessions with `/new` and `/clear` @copyberry - openai#34611 Add compatibility policies for skill catalog rendering @copyberry - openai#34612 Detach non-interactive subprocesses from stdin @copyberry - openai#34613 Route Windows sandbox proxy traffic by restricting SID @copyberry - openai#34615 Initialize missing-path behavior in exec-server sandbox test @copyberry - openai#34620 Add exec-server network policy callback types @copyberry - openai#34621 Load paginated model context across rollout lineages @copyberry - openai#34622 Increase the auto-review model override test timeout @copyberry - openai#34624 Terminate Windows process trees with job objects @copyberry - openai#34625 Fix Windows TUI navigation key handling @copyberry - openai#34626 Scale skill metadata budgets with model context windows @copyberry - openai#34629 Harden Windows elevated sandbox startup @copyberry - openai#34630 Add a policy-aware HTTP client builder @copyberry - openai#34631 Migrate agent identity to the shared HTTP client @copyberry - openai#34636 Keep the TUI open when starting a turn fails @copyberry - openai#34637 Attribute review findings to repository rules @copyberry - openai#34640 Update Windows process-tree tests for inherited FDs @copyberry - openai#34641 Harden managed proxy setup for sandboxed executions @copyberry - openai#34643 Migrate login HTTP construction to `HttpClient` @copyberry - openai#34644 Verify Git plugin SHA checkouts @copyberry - openai#34645 Always assign response item IDs @copyberry - openai#34649 Propagate resolved proxy policy through auth routing @copyberry - openai#34650 Require auth managers to receive routing configuration @copyberry - openai#34651 Migrate core test support to the shared HTTP client @copyberry - openai#34654 Render turn diffs for foreign environment paths @copyberry - openai#34655 Honor configured proxy routes for auth refreshes @copyberry - openai#34664 Preserve approvals reviewer when forking threads @copyberry - openai#34667 Document `PathUri` drive letter canonicalization @copyberry - openai#34669 Expand codex-http-client usage guidance @copyberry - openai#34678 Route LM Studio requests through the shared HTTP client @copyberry - openai#34681 Add session headers to realtime conversation starts @copyberry - openai#34687 Configure Codex Auto Review model metadata @copyberry - openai#34708 Rename the MCP connection manager to `McpConnectionSet` @copyberry - openai#34713 Order unified exec lifecycle events reliably @copyberry - openai#34728 Skip Git enrichment for prewarm and Guardian turns @copyberry - openai#34729 Publish stable installer aliases to R2 @copyberry - openai#34732 Preserve skill catalog entries under metadata pressure @copyberry - openai#34733 Make MCP resource clients follow the latest runtime @copyberry - openai#34734 Remove step-scoped data from extension contributors @copyberry - openai#34738 Drop skill descriptions before omitting catalog entries @copyberry - openai#34744 Update skills budget tests for extension API changes @copyberry - openai#34746 Match core skill ordering in extension catalogs @copyberry - openai#34747 Register the MCP 2026-07-28 feature flag @copyberry - openai#34761 Reduce app-server JSON serialization overhead @copyberry - openai#34763 Retry websocket requests when the previous response is missing @copyberry - openai#34766 Reduce typed app-server request serialization overhead @copyberry - openai#34769 Add the git attribution extension @copyberry - openai#34770 Enable exec-server network policy callbacks @copyberry - openai#34771 Size unified mention popups to visible results @copyberry - openai#34772 Normalize whitespace-only lines in agent messages @copyberry - openai#34775 Clamp session headers to narrow terminal widths @copyberry - openai#34777 Include the final agent message in turn completion summaries @copyberry - openai#34778 Coalesce wrapped OSC 8 hyperlinks in the TUI terminal @copyberry - openai#34779 Use the live parent history mode when forking agents @copyberry - openai#34781 Upgrade Bazel Rust and LLVM dependencies @copyberry - openai#34784 Reject dynamic environments named `local` @copyberry - openai#34785 Report skill catalog truncation during rendering @copyberry - openai#34786 Simplify app-server integration test setup @copyberry - openai#34789 Avoid unnecessary post-sampling token estimates @copyberry - openai#34795 Remove obsolete step store from git attribution tests @copyberry - openai#34796 Skip syntax highlighting for lines over 4 KiB @copyberry - openai#34797 Suppress omission notices in core-compatible skill catalogs @copyberry - openai#34806 Use path URIs in shell approval keys @copyberry - openai#34808 Centralize SQLite connection configuration @copyberry - openai#34811 Fix network access rendering in sandbox prompts @copyberry - openai#34814 Consolidate thread startup around `StartThreadOptions` @copyberry - openai#34816 Support configurable realtime BEM channel prefixes @copyberry - openai#34819 Enable git attribution across Codex entry points @copyberry - openai#34823 Run code-mode tests in non-Windows Bazel CI @copyberry - openai#34824 Normalize Guardian review cwd reuse keys @copyberry - openai#34825 Reduce cloning when building Responses requests @copyberry - openai#34827 Remove Windows Bazel lint toolchain overrides @copyberry - openai#34831 Flush analytics before in-process app server shutdown @copyberry - openai#34835 Track compaction time in turn profiles @copyberry - openai#34839 Preserve user input when MCP startup is interrupted @copyberry - openai#34840 Add persisted thread pinning to the app server @copyberry - openai#34844 Remove first-party type from app metadata @copyberry - openai#34845 Track multi-agent mode in world state @copyberry - openai#34846 Allow custom providers to opt into standalone web search @copyberry - openai#34847 Use Guardian model limits for review sessions @copyberry - openai#34849 Cache remote plugin catalogs by scope @copyberry - openai#34850 Disable image generation for Free-plan accounts @copyberry - openai#34851 Use batch metadata for plugin app summaries @copyberry - openai#34852 Wake sleeping threads for queued agent mail @copyberry - openai#34877 Wait for local plugin cache refreshes in `plugin/list` @copyberry - openai#34883 Set a default user agent for MCP HTTP requests @copyberry - openai#34887 Allow disabling the multi-agent wait tool @copyberry - openai#34910 Prefer releases.openai.com in standalone installers @copyberry - openai#34930 Centralize thread MCP state in `McpRuntime` @copyberry - openai#34931 Use the API plugin marketplace for Amazon Bedrock @copyberry - openai#34940 Keep session defaults static during config batch writes @copyberry - openai#34952 Reuse MCP connections across runtime refreshes @copyberry - openai#34957 Replace closed MCP connections during reconciliation @copyberry - openai#34959 Handle @ in local marketplace paths @copyberry - openai#34962 Move MCP connection helpers into the test module @copyberry - openai#34969 Keep the sleep tool outside code mode @copyberry - openai#34978 Honor disabled redirects in route-aware HTTP clients @copyberry - openai#34979 Infer the bundled Claude Code plugin marketplace @copyberry - openai#34981 Record externally completed agent config imports @copyberry - openai#34986 Enforce single-writer ownership for paginated threads @copyberry - openai#34989 Preserve timestamps when importing external agent sessions @copyberry - openai#34991 Allow omitting MCP tool prefixes per server @copyberry - openai#34994 Honor the configured SQLite home across state consumers @copyberry - openai#34995 Initialize execution environments with the final HTTP policy @copyberry - openai#34996 Separate Codex error details from retry metadata @copyberry - openai#34997 Warn when skill catalogs exceed their context budget @copyberry - openai#35000 Make TUI turn interrupts nonblocking @copyberry - openai#35011 Keep side conversations open when switching threads @copyberry - openai#35012 Expose remote skill icon URLs through app server @copyberry - openai#35013 Support incremental replay of updated thread items @copyberry - openai#35015 Align installed app duration metrics with the legacy baseline @copyberry - openai#35016 Add trusted plugin script attribution @copyberry - openai#35020 Attribute command executions to trusted plugin scripts @copyberry - openai#35021 Adapt keyboard event reporting to the terminal @copyberry - openai#35023 Route exec-server HTTP through configured proxy policy @copyberry - openai#35028 Preserve refreshed Apps tools across MCP runtime updates @copyberry - openai#35029 Preserve plugin attribution across command approvals @copyberry - openai#35031 Enforce writer ownership for thread archive and deletion @copyberry - openai#35033 Expose Browser Use requirements through the app server @copyberry - openai#35034 Route environment registry requests through the shared HTTP client @copyberry - openai#35036 Preserve Windows sandbox proxy settings in guardian sessions @copyberry - openai#35048 Track app/read request duration @copyberry - openai#35049 Register the Guardian V2 feature flag @copyberry - openai#35054 Allow disabling the update_plan tool @copyberry - openai#35056 Route exec-server WebSockets through configured proxies @copyberry - openai#35059 Decouple exec-server HTTP from reqwest types @copyberry - openai#35063 Track deferred tool namespaces in world state @copyberry - openai#35065 Avoid duplicating deferred sources in tool search @copyberry - openai#35067 Fix Bazel test configuration for platform-specific data @copyberry - openai#35078 Add WebSocket transport to the code-mode host @copyberry - openai#35098 Support remote code-mode hosts in app-server @copyberry - openai#35105 Support Agent Plugins manifests @copyberry - openai#35106 Allow hosts to customize `wait_for_environment` descriptions @copyberry - openai#35144 Prewarm MCP runtime updates in the background @copyberry - openai#35146 Refresh MCP runtimes when session auth changes @copyberry - openai#35151 Reconnect MCP servers on explicit refresh @copyberry - openai#35164 Encapsulate MCP refresh coordination @copyberry - openai#35168 Route extension warnings to app-server threads @copyberry - openai#35172 Compact host skill paths under metadata pressure @copyberry - openai#35175 Wait for reloaded worker completion in the resume test @copyberry - openai#35184 Expose executor skills through skill tools @copyberry - openai#35194 Preserve output from hooks that exit before reading stdin @copyberry - openai#35196 Make the Apps recovery exposure test deterministic @copyberry - openai#35198 Enable resource reads for explicit executor skills @copyberry - openai#35204 Refresh MCP runtimes across thread startup @copyberry - openai#35205 Use current MCP authority for elicitation reviews @copyberry - openai#35213 Refresh managed MCP requirements for active threads @copyberry - openai#35216 Refresh MCP config independently across threads @copyberry - openai#35220 Support paginated thread forks @copyberry - openai#35221 Avoid persisting non-local threads for hook transcripts @copyberry - openai#35238 Support the ent26 enterprise plan @copyberry - openai#35239 Route MCP auth discovery through runtime HTTP clients @copyberry - openai#35251 Support ephemeral forks of paginated threads @copyberry - openai#35254 Expose workspace plugin publish capability @copyberry - openai#35261 Propagate remote plugin IDs to skill metadata @copyberry - openai#35262 Track remote plugin IDs in skill invocation analytics @copyberry - openai#35264 Sign bundled macOS helper binaries @copyberry - openai#35266 Allow disabling the in-process code-mode host fallback @copyberry - openai#35267 Harden network approval cancellation and concurrency @copyberry - openai#35271 Include code-mode tool names in Responses Lite metadata @copyberry - openai#35275 Trace remote exec-server connection setup @copyberry - openai#35280 Skip plugin MCP filtering when no allowlists are configured @copyberry - openai#35359 Handle exec-server network policy requests in the client @copyberry - openai#35363 Include item start times in completion events @copyberry - openai#35364 Bound Code Mode metadata compatibility headers @copyberry - openai#35365 Keep unified mention results fresh @copyberry - openai#35375 Make the keymap action menu responsive @copyberry - openai#35408 Ignore generated system skills in the skills watcher @copyberry - openai#35414 Raise the MCP server recursion limit @copyberry - openai#35523 Shut down the in-process outbound router explicitly @copyberry - openai#35524 Preserve terminal turn errors in replayed history @copyberry - openai#35525 Skip inactive TUI threads without pending user interaction @copyberry - openai#35530 Track model and personality in world state @copyberry - openai#35537 Add managed policy for in-app updates @copyberry
* Release 0.146.0-alpha.5
* Seed Termux release automation
* Termux rust-v0.146.0-alpha.5 (#326)
* Release 0.140.0-alpha.17
* Seed Termux release automation
* Prepare Termux rust-v0.140.0-alpha.17
* Release 0.140.0-alpha.18
* Remove stale TUI realtime audio modules
* Seed Termux release automation
* Prepare Termux rust-v0.140.0-alpha.18
* Release 0.140.0-alpha.19
* Seed Termux release automation
* Prepare Termux rust-v0.140.0-alpha.19
* ## New Features
- Added `/usage` views for daily, weekly, and cumulative account token activity. (#27925)
- `/goal` now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#27508, #27509, #27510)
- Added permanent session deletion through `codex delete`, `/delete`, and app-server `thread/delete`, with confirmation safeguards and subagent cleanup. (#25018, #27476)
- Added `/import` for selectively importing setup, project configuration, and recent chats from Claude Code. (#27070, #27071, #27703)
- Typing `@` now opens the unified mentions menu for files, plugins, and skills by default. (#27499)
- Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#27443, #27689, #27504, #27535, #27539, #27541)
## Bug Fixes
- Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#26859, #27719)
- Prevented `/review` from crashing when `Esc` is pressed with queued guidance, while preserving that guidance when the review is canceled. (#22879)
- Improved MCP reliability by retrying transient startup failures, reporting unusable OAuth credentials as logged out, and preserving explicitly disabled servers. (#25147, #26713, #27414)
- Fixed remote plugin uninstall requests and correctly surfaced apps requiring authentication during installation. (#27085, #27223)
- Persisted “Don’t remind me” update dismissals reliably and cleared stale running-hook indicators after completed turns. (#27619, #27783)
- Non-TTY background commands can now be interrupted with Ctrl-C while preserving their final output and exit status. (#26734)
## Documentation
- Clarified contributor guidance around keeping crate APIs narrow and supporting Linux, macOS, and Windows. (#27939, #27966)
## Chores
- Improved responsiveness for large repositories and long sessions by preserving Git’s built-in filesystem monitor, avoiding duplicate history reads, accelerating archive lookup, and caching turn-diff rendering. (#26880, #27031, #27276, #27489)
- Removed the experimental `/realtime` voice controls and related audio dependencies from the TUI. (#27801)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.139.0...rust-v0.140.0
- #26880 [codex] preserve fsmonitor for worktree Git reads @tamird
- #27085 Use server app auth requirements for remote plugin install @xl-openai
- #27098 [codex] Return workspace directory installed plugins @xl-openai
- #27007 multi-agent: add path-based v2 activity tracking @jif-oai
- #27166 app-server: clear stale thread watches after v2 agent interruption @jif-oai
- #27080 [codex] Ignore pending PR review comments @anp-oai
- #26420 Avoid no-op backfill state writes @zanie-oai
- #27031 Avoid rereading rollout history during cold resume @zanie-oai
- #22879 fix: Prevent /review crash when entering Esc on steer message @canvrno-oai
- #27173 app-server: reject direct input to multi-agent v2 sub-agents @jif-oai
- #27184 Load selected executor skills through extensions @jif-oai
- #26835 [codex] Test extension API contracts @anp-oai
- #27063 [codex-analytics] add extensible feature thread sources @marksteinbrick-oai
- #26479 [codex] Speed up local nextest runs @anp-oai
- #27223 fix: use plugin service route for remote uninstall @ericning-o
- #22685 Add SOCKS5 TCP MITM coverage @winston-openai
- #26681 Allow creating a new goal after completion @etraut-openai
- #26711 Reduce TUI legacy core dependencies @etraut-openai
- #27110 [1/6] Add Python goal routing foundation @aibrahim-oai
- #27191 Route hosted Apps MCP through extensions @jif-oai
- #26830 [codex] Characterize global instruction lifecycle @anp-oai
- #26713 [codex] Report unusable MCP OAuth credentials as logged out @anp-oai
- #26734 [codex] Handle Ctrl-C for non-TTY unified exec @pakrym-oai
- #27116 Stop mirroring Codex user input into realtime @guinness-oai
- #27111 [2/6] Add private Python goal operations @aibrahim-oai
- #25147 [codex] Retry streamable HTTP initialize failures @ssetty-oai
- #27257 [codex] Tighten MCP connection manager API visibility and order @aibrahim-oai
- #26701 TUI Plugin Sharing 1 - add remote plugin identity @canvrno-oai
- #27129 feat: use provider defaults for memory models @celia-oai
- #27094 Add spans to build_tool_router @mchen-oai
- #24999 Add per-session realtime model and version overrides @guinness-oai
- #27078 [codex-analytics] emit goal lifecycle analytics @marksteinbrick-oai
- #27285 [codex] Fix post-merge analytics integration failures @anp-oai
- #27107 Add spans to run_turn @mchen-oai
- #27261 [codex] Make MCP connection startup fallible @aibrahim-oai
- #27174 feat: keep child MCP warnings out of parent transcript @jif-oai
- #27198 Use plugin-service MCP as the hosted plugin runtime @jif-oai
- #27375 [codex] Tag multi-agent spawn metrics with version @jif-oai
- #27383 Remove async-trait from extension contributors @jif-oai
- #27259 Use latest-wins MCP manager replacement @charliemarsh-oai
- #27264 [codex] Store compact window id in rollout @pakrym-oai
- #27280 [codex] add io PathUri native conversion APIs @anp-oai
- #27315 [codex] link Windows releases with LLD @tamird
- #27276 Reduce archive rollout lookup CPU @etraut-openai
- #27299 [codex] Outline ToolExecutor handler bodies @anp-oai
- #27391 Index visible thread list ordering @zanie-oai
- #27407 Fix compressed rollout search path matching @jif-oai
- #27304 [codex] Remove async_trait from ToolExecutor @anp-oai
- #26041 Add app-server background terminal process APIs @etraut-openai
- #25018 Add app-server `thread/delete` API @etraut-openai
- #26859 fix: Auto-recover from corrupted sqlite databases @ddr-oai
- #27064 [codex] remove blocking external agent migration flow @stefanstokic-oai
- #27421 [codex] Raise app-server recursion limit @anp-oai
- #27062 [codex] Retry transient Guardian review failures @kbazzi
- #27065 [codex] extract external agent import picker renderer @stefanstokic-oai
- #26409 [plugins] Inject remote_plugin_id into install elicitations @adaley-openai
- #27439 feat: make ThreadStore available on ThreadExtensionDependencies @bolinfest
- #27343 Guard core test subprocess cleanup @etraut-openai
- #27070 [codex] add external agent import picker UX @stefanstokic-oai
- #27321 [codex] Move release platform rules into bazel package @anp-oai
- #27071 [codex] add /import for external agents @stefanstokic-oai
- #27311 [codex] Skip local curated discovery for remote plugins @xl-openai
- #27414 [codex] Preserve disabled MCP servers across runtime overlays @e-provencher
- #27312 [codex] reuse release artifacts for npm staging @tamird
- #27319 Forward standalone assistant output to realtime @guinness-oai
- #27057 [codex] Add reusable OTEL gauge instruments @richardopenai
- #27245 image: add shared data URL preparation utilities @fjord-oai
- #27392 [codex-analytics] emit internally started turn events @marksteinbrick-oai
- #27322 [codex] Preserve build-script dependencies in rules_rs annotations @anp-oai
- #27489 core: cache turn diff rendering @nornagon-openai
- #27465 [codex] Remove redundant plugin app auth state @xl-openai
- #27484 Remove TUI legacy core test_support dependencies @etraut-openai
- #27476 Add session delete commands in CLI and TUI @etraut-openai
- #27247 core: resize all history images behind a feature flag @fjord-oai
- #27487 Trim TUI legacy telemetry and migration dependencies @etraut-openai
- #27438 [codex] Add token budget context feature @pakrym-oai
- #27501 [codex] Expand hosted web search citation guidance @yuning-oai
- #27526 tools: simplify default tool search text @sayan-oai
- #27488 [codex] Add new context window tool @pakrym-oai
- #27443 feat: add Bedrock API key as a managed auth mode @celia-oai
- #27532 [codex] Add comp_hash to model metadata @aibrahim-oai
- #27246 core: strip image detail from Responses Lite requests @fjord-oai
- #27517 [codex] Pass auth mode to plugin manager @xl-openai
- #27520 [codex] Compact when comp_hash changes @aibrahim-oai
- #27518 [codex] Add context remaining tool @pakrym-oai
- #27266 image: preserve metadata when resizing prompt images @fjord-oai
- #27103 [codex-analytics] report cached input tokens for v2 compaction @rhan-oai
- #27356 Use generic search metadata for dynamic tools @sayan-oai
- #27082 [codex-analytics] Emit structured compaction codex errors @rhan-oai
- #26513 [codex] Tune cloud config cache intervals @alexsong-oai
- #27387 skills: make backend plugin skills invocable without an executor @jif-oai
- #27403 skills: cache remote catalog failures per thread @jif-oai
- #27573 core: enable remote compaction v2 by default @jif-oai
- #27388 skills: expose remote skill resource tools @jif-oai
- #27569 multi-agent: move concurrency guidance into v2 usage hints @jif-oai
- #27585 nit: cap error @jif-oai
- #27404 test: cover referenced backend skill reads without an executor @jif-oai
- #27591 skills: render catalog locators by authority @jif-oai
- #27413 skills: decouple the skills extension from core @jif-oai
- #27527 [codex] publish npm packages concurrently @tamird
- #27528 [codex] publish DotSlash alongside npm @tamird
- #27529 [codex] download only release artifacts @tamird
- #27490 Remove TUI legacy Windows sandbox dependency @etraut-openai
- #27483 Emit plugin ID on MCP tool call analytics events @chrisdong-oai
- #27417 Print TUI session info on fatal exits @etraut-openai
- #27507 lint: allow self-documenting builder arguments @anp-oai
- #27420 [codex] Propagate plugin app categories @charlesgong-openai
- #27454 [codex] add cross-platform filesystem adapter coverage @anp-oai
- #27415 [codex] Surface runtime warnings in codex exec @anp-oai
- #27639 [codex] revert concurrent npm publishing @tamird
- #27646 feat: disable orchestrator skills for now @jif-oai
- #27323 [codex] Provide ARM64 MinGW powl compatibility support @anp-oai
- #27433 [codex] remove EnvironmentPathRef @anp-oai
- #27424 [codex] migrate ExecutorFileSystem paths to PathUri @anp-oai
- #27101 [codex] Load user instructions through an injected provider @anp-oai
- #27634 Resolve MCP server registrations through a catalog @jif-oai
- #27122 core: Consolidate Responses API Codex metadata @owenlin0
- #27450 [codex-rs] enforce PAT workspace restrictions @cooper-oai
- #27653 [codex] migrate exec-server filesystem protocol to PathUri @anp-oai
- #27663 Include thread id in token budget context @pakrym-oai
- #26418 [codex] Avoid duplicate hooks.json discovery with profiles @abhinav-oai
- #27689 feat: prefer managed Bedrock auth in model provider @celia-oai
- #27700 Remove fs/join and fs/parent from exec-server protocol @anp-oai
- #26426 Warn when hooks.json has unsupported top-level fields @abhinav-oai
- #27318 [codex] Move persistence policy application into ThreadStore @wiltzius-openai
- #27498 Route image extension reads through turn environments v2 @won-openai
- #27623 Add spans to turn lifecycle gaps @mchen-oai
- #27619 tui: clear stale hook row after turn completion @kotakem-openai
- #27711 Fix image extension PathUri conversion @anp-oai
- #27475 [codex] Remove async_trait from first-party code @anp-oai
- #27719 fix: Recover from sqlite directory being a file @ddr-oai
- #27715 ci(v8): gate Windows source builds on relevant changes @cconger
- #27702 [codex] parallelize release code generation @tamird
- #27709 [codex] resolve environment shell metadata eagerly @pakrym-oai
- #27445 feat(app-server): persist remote-control desired state @apanasenko-oai
- #27508 [1 of 3] Support long raw TUI goal objectives @etraut-openai
- #27256 Add request_user_input auto-resolution window contract @shijie-oai
- #27724 code-mode standalone: extract protocol and add host crate @cconger
- #27778 Translate non-English issues @etraut-openai
- #27316 Keep request_user_input direct-model only @shijie-oai
- #27696 [codex] Load AGENTS.md from all bound environments @anp-oai
- #27670 Make MCP server contributions thread-scoped @jif-oai
- #27732 [code-mode] Reject remote image URLs from output helpers @rka-oai
- #27692 Add executor-owned plugin resolution @jif-oai
- #27863 Extract shared plugin MCP config parsing @jif-oai
- #27703 [codex] restore source-specific import copy @stefanstokic-oai
- #27879 fix: serialize auth environment tests @jif-oai
- #27791 Reject transcript backtrack in side conversations @etraut-openai
- #27075 [ez][codex-rs] Support approvals reviewer in app defaults @zamoshchin-openai
- #27538 Use dependency groups for Python SDK tooling @charliemarsh-oai
- #27783 Persist update dismissal without cache @etraut-openai
- #27814 tui: Allow extra o's in /goal command @btraut-openai
- #27901 Use uv as Python SDK build backend @charliemarsh-oai
- #27720 realtime: add AVAS architecture override @bakks
- #27919 chore: prompt MAv2 @jif-oai
- #27816 sandboxing: migrate cwd inputs to PathUri @anp-oai
- #27890 [codex] expose remote plugin share URL @ericning-o
- #27913 [codex] unify apply patch parsing @pakrym-oai
- #27920 Handle standalone image generation failures as terminal items @won-openai
- #27927 [codex] Add size to internal filesystem metadata @pakrym-oai
- #27504 feat: add secret auth storage configuration @celia-oai
- #27674 [login] revoke existing auth before starting login @cooper-oai
- #27535 feat: add auth-specific encrypted secret namespaces @celia-oai
- #27939 [codex] Add crate API surface review rule @pakrym-oai
- #27926 [codex] Align implicit skill reads with parser @alexsong-oai
- #23254 fix(plugins) rm plugin descriptions @dylan-hurd-oai
- #27830 Support plaintext agent messages @jif-oai
- #27801 Remove TUI realtime voice support @etraut-openai
- #27539 feat: use encrypted local secrets for CLI auth @celia-oai
- #27076 Warn for structured feature toggles @canvrno-oai
- #27541 feat: use encrypted local secrets for MCP OAuth @celia-oai
- #27936 [codex] add roles to realtime append text @agamble-oai
- #27509 [2 of 3] Support long pasted text in TUI goals @etraut-openai
- #27109 Add Guardian catalog diagnostics metadata @won-openai
- #27966 Specify platform support in AGENTS.md @anp-oai
- #27855 [codex] parallelize Windows compression @tamird
- #27499 Promote TUI unified mentions in composer to default mentions feature @canvrno-oai
- #27972 [codex] Let generic test turns inherit their environment @pakrym-oai
- #27856 [codex] package Windows symbols in parallel @tamird
- #27976 [codex] make PathUri::from_abs_path infallible @anp-oai
- #27854 [codex] parallelize Windows package archives @tamird
- #27853 [codex] stage npm packages concurrently @tamird
- #27710 [codex] add latency tracing spans @rphilizaire-openai
- #27510 [3 of 3] Support images in TUI goals @etraut-openai
- #27925 feat(tui): reland token activity command @fcoury-oai
- #27988 [codex] Limit app-based plugin suggestions to remote catalogs @xl-openai
- #27652 [codex] Add auth mode to plugin manager constructor @felixxia-oai
- #27964 [codex] Add hermetic Wine test support @anp-oai
- #27459 [codex] Gate plugin MCP servers by auth route @felixxia-oai
- #27961 feat(app-server): enforce managed remote control disable @apanasenko-oai
- #27937 [codex] Add hermetic Wine exec-server test @anp-oai
- #27996 [codex] Send request-scoped turn state over WebSocket @aibrahim-oai
- #28002 [codex] Send turn state through compact requests @aibrahim-oai
* Seed Termux release automation
* Prepare Termux rust-v0.140.0
* Release 0.141.0-alpha.3
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.3
* Release 0.141.0-alpha.5
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.5
* Release 0.141.0-alpha.6
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.6
* Release 0.141.0-alpha.7
* Seed Termux release automation
* Prepare Termux rust-v0.141.0-alpha.7
* checkpoint: into wallentx/termux-target from release/0.141.0 @ 512c55a29a8f (#242)
* ## New Features
- Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
- Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
- Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
- App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
- Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
- TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
## Bug Fixes
- Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
- Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
- Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
- Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
- Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
- TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
## Chores
- Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
- Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
- Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.140.0...rust-v0.141.0
- #28001 [codex] package Windows ARM64 on x64 @tamird
- #28032 [codex] Carry exec-server cwd as PathUri @anp-oai
- #27607 [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
- #27992 [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
- #28125 build: run buildifier from just fmt @anp-oai
- #28120 bazel: add PowerShell to Wine test harness @anp-oai
- #27819 path-uri: render native paths across platforms @anp-oai
- #28122 [codex] exec-server honors remote environment cwd and shell @anp-oai
- #26662 feat(app-server): filter threads by parent @btraut-openai
- #27884 Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
- #27870 Discover stdio MCP servers from selected executor plugins @jif-oai
- #28283 [codex] update multi-agent v2 prompts @jif-oai
- #27602 [codex] Preserve plugin apps in connector listings @felixxia-oai
- #27461 [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
- #27893 Activate selected executor plugin MCPs in app-server @jif-oai
- #28332 [codex] Cap feedback upload subtrees @jif-oai
- #27365 Represent dynamic tools with explicit namespaces internally @sayan-oai
- #28333 skills: hide orchestrator skills with a local executor @jif-oai
- #27756 [codex] simplify shell snapshot ownership @pakrym-oai
- #27794 Remove terminal resize reflow flag gates @etraut-openai
- #28286 chore: restore exec-server relay keepalives @jif-oai
- #28164 [codex] simplify memory read metrics @pakrym-oai
- #27371 Expose explicit dynamic tool namespaces in thread start @sayan-oai
- #28309 linearize history output normalization @jif-oai
- #28306 avoid cloning sampling request input @jif-oai
- #28323 serialize websocket requests directly @jif-oai
- #28313 avoid cloning websocket request history @jif-oai
- #28344 [codex] remove stale PathExt import @pakrym-oai
- #27059 [codex] Cover OTLP HTTP log and trace event export @richardopenai
- #28327 reuse encoded Responses request bodies @jif-oai
- #27995 [codex] preserve explicit environment cwd @pakrym-oai
- #28285 guardian: isolate review context from skills and memories @jif-oai
- #26702 TUI Plugin Sharing 2 - add remote plugin section plumbing @canvrno-oai
- #28294 bound prompt image cache retention @jif-oai
- #28257 Support staging OAuth client ID overrides @apanasenko-oai
- #28341 core: let steer interrupt wait_agent @jif-oai
- #28336 skills: cache orchestrator resources per thread @jif-oai
- #28357 Extract shared Windows sandbox session runner @iceweasel-oai
- #27706 Use aws-lc-rs for rustls crypto provider @malsamiri-oai
- #28347 [codex] add path-types skill @anp-oai
- #28235 Add request user input auto-resolution timer @shijie-oai
- #28234 [mcp] Increase default tool timeout to 300 seconds @adaley-openai
- #28008 [codex] Add external agent import result accounting @charlesgong-openai
- #27944 recover stale Windows sandbox credentials @iceweasel-oai
- #27086 Add Windows unified exec yield floor @iceweasel-oai
- #28358 Add hidden Windows sandbox wrapper entrypoint @iceweasel-oai
- #27258 core: cache the tool search handler per session @mchen-oai
- #28143 feat(app-server): expose rate-limit reset credits @jayp-oai
- #28355 feat(core): add metadata field to ResponseItem @owenlin0
- #28203 [codex] Add created-by-me remote plugin marketplace @ericning-o
- #28365 Respect blocking PostToolUse hooks in code mode @abhinav-oai
- #27813 [codex] Reuse Apps policy evaluation across MCP tool exposure @mzeng-openai
- #28300 Deflake realtime handoff steering test @felixxia-oai
- #28395 [codex] Preserve remote plugin directory order @jameswt-oai
- #27955 [codex] retain resolved environments across turns @pakrym-oai
- #27917 Add realtime speech append control @guinness-oai
- #27093 [codex-analytics] Analytics Capture to File in Debug Builds @jameswt-oai
- #26242 exec-server: add Noise relay transport @viyatb-oai
- #28165 Use PathUri in filesystem permission paths for exec-server @anp-oai
- #28415 [codex] Fix missing response item metadata in tests @adaley-openai
- #27058 [codex] Add second-based OTEL duration histograms @richardopenai
- #27902 [codex] Centralize plugin auth capability filtering @felixxia-oai
- #28405 Add a toggle for realtime startup context @guinness-oai
- #26434 Preserve hook trust bypass in codex exec threads @abhinav-oai
- #26245 exec-server: default remote transport to Noise @viyatb-oai
- #28383 [codex] Load API curated marketplace by auth @felixxia-oai
- #27958 [codex] Make plugin details capability aware @felixxia-oai
- #28367 Use ApiPathString in app-server filesystem permission paths @anp-oai
- #28421 [codex] Bind shell snapshots to retained thread environments @pakrym-oai
- #28429 [codex] Add interruptible sleep tool @pakrym-oai
- #28441 [codex] Use expect in integration tests @pakrym-oai
- #28163 [codex] Use local environment for user shell commands @pakrym-oai
* Seed Termux release automation
* Prepare Termux rust-v0.141.0
---------
Co-authored-by: sayan-oai <sayan@openai.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Allen <wallentx@users.noreply.github.com>
* checkpoint: into wallentx/termux-target from release/0.142.0 @ 8f4b05f9cc47 (#244)
* [codex] Add optional IDs to response items (#28812)
## Why
`ResponseItem` variants do not have a consistent internal ID shape: some
variants carry required IDs, some carry optional IDs, and some cannot
represent an ID at all. The existing fields also use inconsistent serde,
TypeScript, and JSON-schema annotations. A single enum-level access path
is needed before history recording can assign and retain IDs.
This PR establishes that internal model only. It intentionally does not
generate or serialize IDs; allocation and wire persistence are isolated
in the stacked follow-up.
## What changed
- Give every concrete `ResponseItem` variant an `Option<String>` ID
field.
- Apply the same internal-only annotations to every ID field:
`#[serde(default, skip_serializing)]`, `#[ts(skip)]`, and
`#[schemars(skip)]`.
- Add `ResponseItem::id()` and `ResponseItem::set_id()` as the shared
accessors.
- Preserve IDs when history items are rewritten for truncation.
- Adapt consumers that previously assumed reasoning and image-generation
IDs were required.
- Regenerate app-server schemas so the hidden fields are represented
consistently.
The serde catch-all `ResponseItem::Other` remains ID-less because it
must remain a unit variant.
## Test plan
- `cargo check --tests -p codex-core -p codex-api -p codex-rollout-trace
-p codex-image-generation-extension`
- `just test -p codex-protocol`
- `just test -p codex-app-server-protocol`
- `just test -p codex-api -p codex-rollout-trace -p
codex-image-generation-extension`
- `just test -p codex-core event_mapping`
* fix(install): support older awk checksum parsing (#28784)
## Why
The standalone installer validates package checksums with an awk
interval expression. Older mawk releases do not support that expression,
so they reject valid 64-character digests and report that the release
manifest is missing an entry. This affects both x64 and ARM64 systems on
common Debian-derived environments.
Fixes #24219.
## What Changed
Replace the awk interval expression with an explicit length check plus
rejection of non-hexadecimal characters. This preserves the existing
SHA-256 validation and lowercase normalization while working with older
awk implementations.
## How to Test
1. Build and run the checksum predicate with mawk 1.3.4 20121129.
2. Confirm the old interval predicate rejects a valid 64-character
digest.
3. Confirm the updated predicate accepts that digest.
4. Put the old mawk binary first on PATH as awk and run
scripts/install/install.sh with an isolated HOME, CODEX_HOME, and
CODEX_INSTALL_DIR.
5. Confirm Codex installs successfully and the installed binary reports
version 0.140.0.
6. Verify the predicate rejects wrong-length digests, non-hexadecimal
digests, and entries for another asset while accepting uppercase
hexadecimal digests.
* [codex] Use unique IDs for realtime-routed turns (#28826)
## Why
A durable realtime voice orchestrator can reconnect and resume through
multiple fresh `Session` instances. Realtime handoffs were using the
Session-local `auto-compact-N` counter as their turn identity, but that
counter restarts at zero for every resumed Session. The durable thread
could therefore accumulate duplicate turn IDs, violating the uniqueness
assumptions made by app-server and web clients. In Codex Apps, a new
delegated response stream could be attached to an older turn with the
same ID, placing live output higher in history and putting turn-scoped
actions at risk.
Persisted rollout and reconstructed model-context order were already
correct because raw response items remain append-only and chronological.
This change restores unique identity for reconstructed and live turn
surfaces.
## What changed
- Generate a UUIDv7 specifically for each realtime-routed delegation.
- Leave the existing `auto-compact-N` identity path unchanged for actual
internal auto-compaction turns.
- Extend the inbound realtime handoff integration test to require a UUID
turn ID from `turn/started`.
## Verification
- `just test -p codex-core inbound_handoff_request_starts_turn`
- `just fix -p codex-core`
- `just fmt`
* [codex] control automatic realtime handoff delivery (#27986)
## What
Built on the realtime speech-control plumbing merged in #27917.
- Add optional `codexResponseHandoffPrefix` to `thread/realtime/start`.
- Apply that prefix only to automatic V1 commentary sent through
`conversation.handoff.append`; final answers remain unprefixed.
- Add opt-in `clientManagedHandoffs`. When true, core suppresses
automatic response handoffs and completion output so delivery is
controlled by explicit client append APIs.
- Preserve existing automatic behavior by default.
`codexResponsesAsItems: true` continues to select item routing when
client-managed mode is disabled.
## Why
Voice clients need two delivery policies: automatic background context
with silent commentary instructions and fully client-owned handoffs.
Phase-aware prefixing keeps routine commentary silent without
suppressing the final answer, while client-managed mode lets an app
decide exactly which updates to append.
## Validation
- `just fmt`
- `cargo test -p codex-app-server-protocol
serialize_thread_realtime_start`
- `RUST_MIN_STACK=16777216 cargo test -p codex-core --test all
conversation_handoff_persists_across_item_done_until_turn_complete`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_client_managed_handoffs_disable_automatic_output`
- `RUST_MIN_STACK=16777216 cargo test -p codex-app-server --test all
webrtc_v1_final_automatic_handoff_omits_silent_prefix`
- `cargo build -p codex-cli --bin codex`
- Local Codex Apps compatibility check: 43 focused webview tests passed,
and a live voice session routed through the source-built app-server.
The explicit `RUST_MIN_STACK` avoids a macOS Tokio test-worker stack
overflow seen with the default test environment.
* [codex] Support assistant realtime append text (#28836)
## Why
Frontend realtime voice continuity needs to replay a tiny
previous-session overlap as actual conversation items, including
assistant text. The app-server `thread/realtime/appendText` API already
carries a role through to the Rust realtime websocket layer, but the
shared role enum only accepted `user` and `developer`.
## What Changed
- Added `assistant` to `ConversationTextRole` and regenerated the
app-server schema/type fixtures.
- Added `output_text` as a realtime conversation content type.
- Updated realtime websocket item creation so assistant appendText emits
`content: [{ type: "output_text", text }]`, while user and developer
continue to emit `input_text`.
- Updated app-server docs and tests to cover assistant appendText
alongside the existing developer role behavior.
## Validation
- `just write-app-server-schema`
- `just fmt` (first sandboxed attempt failed because `uv` could not
access `~/.cache/uv`; reran with filesystem access and passed)
- `just test -p codex-api` passed: 126/126
- `just test -p codex-app-server-protocol` passed: 239/239, including
generated JSON/TypeScript fixture checks
- `just test -p codex-app-server` was started locally but stopped per
request after unrelated local sandbox/Seatbelt failures (`sandbox-exec:
sandbox_apply: Operation not permitted`) and one missing local `codex`
binary failure; CI should be faster and more authoritative for the full
suite.
* Refresh signed exec-server URLs on reconnect (#28374)
## Summary
- add a provider API that supplies a fresh signed WebSocket URL for each
remote exec-server connection
- refresh the signed URL after disconnects and retry once when a
handshake returns `401 Unauthorized`
- allow `EnvironmentManager` consumers to register remote environments
backed by the URL provider
## Tests
- `just test -p codex-exec-server -E
'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake)
| test(remote_websocket_client_refreshes_url_after_disconnect)'` — 2
passed
- `cargo check -p codex-core-api` — passed
- `just fix -p codex-exec-server` — passed
- `just fix -p codex-core-api` — no test targets; no-op
- `just fmt` — passed
- `just test -p codex-exec-server` — 187 passed; 32 unrelated macOS
sandbox tests could not invoke nested `sandbox-exec` (`Operation not
permitted`)
* Expose selecte namespaces as direct model tools (#28825)
## Why
Som tools, such as history and notes, must remain top-level when MCP
deferral is enabled while staying unavailable through code-mode `exec`.
## What changed
- Added `features.code_mode.direct_only_tool_namespaces`.
- Classified matching MCP tools as `DirectModelOnly`.
- Kept those tools top-level in `code_mode_only`.
- Excluded them from `tool_search` deferral and the nested `exec`
surface.
- Updated the generated config schema.
## Validation
- `code_mode_only_exposes_direct_model_only_mcp_namespaces`
- `load_config_resolves_code_mode_config`
* [codex] Support plugin manifest path lists (#28790)
## Summary
Allow plugin manifests to declare `skills` as either a single path
string or an array of path strings in the core plugin loader.
## Why
Some plugin packages need to expose skills from more than one directory.
Before this change, `plugin.json` only accepted a single string for
`skills`, so manifests like this were ignored as an invalid `skills`
shape:
```json
{
"skills": ["./skills/abc", "./skills/edk"]
}
```
This keeps the existing single-string form working while adding support
for the list form. The final scope is intentionally limited to the core
plugin manifest/load path for `skills`; `apps`, file-backed
`mcpServers`, and the bundled plugin-creator assets are unchanged in
this PR.
## What changed
- Parse `skills` as either a string or an array of strings in
`plugin.json`.
- Store resolved skill paths as a list in `PluginManifestPaths`.
- Load manifest-declared skill roots in addition to the default
`./skills` root.
- Deduplicate exact duplicate skill roots before loading.
- Rely on existing skill-loader dedupe by canonical `SKILL.md` path for
overlapping roots such as `./skills` plus `./skills/abc`.
- Update plugin manifest tests to cover:
- single string `skills`
- list of string `skills`
- duplicate skill roots
- `./skills` as a manifest path
- explicit child roots like `./skills/abc` and `./skills/edk`
- overlapping-root dedupe
## Validation
- `just test -p codex-plugin`
- `just test -p codex-core-plugins`
- `just test -p codex-mcp-extension`
- `git diff --check`
* Record more path migration guidance for codex. (#28851)
Some common themes pulled out of both human and automated reviews from
the last couple of days' migrations to `PathUri` and
`LegacyAppPathString`.
* unified-exec: retain PathUri in command events (#28780)
## Why
App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.
## What changed
- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
representation
- restore Wine coverage for retained Windows cwd values and successful
completion
* [codex] Split plugin and skill warmup tracing (#28605)
## What changed
- promote plugin config loading to an info-level `plugins_for_config`
span
- promote skill config loading to an info-level `skills_for_config` span
- attach stable OpenTelemetry names to both spans
## Why
`session_init.plugin_skill_warmup` currently combines plugin loading and
skill loading, which makes cold-start traces unable to identify which
phase dominates. These child spans preserve the existing aggregate while
making the two costs independently visible.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
This is observability-only. It does not change plugin or skill loading
behavior.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins` (347 passed)
- `just fmt`
* [codex] Pass plugin namespace into skill loading (#28608)
## What changed
- retain the parsed plugin manifest namespace on loaded plugins
- carry that namespace through `PluginSkillRoot` and `SkillRoot`
- use the provided namespace when qualifying plugin skill names
- include the namespace in the skills cache key
## Why
Plugin loading has already parsed `plugin.json`, but skill parsing
currently walks every `SKILL.md` ancestor and probes/reads the manifest
again to reconstruct the same namespace. Passing the parsed namespace
removes those repeated filesystem calls, which are particularly costly
on remote filesystems.
Context:
https://openai.slack.com/archives/C0ARA9GF5D4/p1781639496496439?thread_ts=1781202444.891669&cid=C0ARA9GF5D4
## Impact
Plugin skill names remain unchanged. A regression test uses a
deliberately different on-disk manifest name to verify that plugin roots
use the provided parsed namespace.
## Validation
- `just test -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins` (352 passed)
- `just fix -p codex-core-skills -p codex-core-plugins -p codex-plugin
-p codex-utils-plugins`
- `just fmt`
* [codex] add rollout token budget configuration (varlength 1/N) (#28746)
## What
This PR defines the structured configuration contract for shared rollout
token budgets (across ALL agent threads under 1 rollout).
```toml
[features.rollout_budget]
enabled = true
limit_tokens = 100000
reminder_interval_tokens = 10000
sampling_token_weight = 1.0
prefill_token_weight = 0.1
```
The reminder interval defaults to 10% of the rollout limit. Sampling and
prefill weights default to `1.0`.
## Scope
This PR only defines and validates configuration. It does not track
usage, inject reminders, or stop a rollout. Accounting and reminders are
implemented in the stacked follow-up #28494.
The existing `token_budget` feature remains unchanged. `rollout_budget`
has its own feature key and configuration type.
## Tests
The config test verifies that the structured fields resolve into
`RolloutBudgetConfig` and do not enable the existing `token_budget`
feature.
Local checks:
- `just write-config-schema`
- `just test -p codex-core load_config_resolves_rollout_budget`
- `cargo check -p codex-thread-manager-sample`
- `git diff --check`
The full workspace test suite was not run locally.
* Add network environment ID plumbing (#28766)
## Why
Prepare network approval scoping to distinguish execution environments
without changing behavior yet.
## What changed
- Add optional environment IDs to network policy requests.
- Add optional network environment IDs to exec and sandbox request
structs.
- Thread default None values through existing construction points.
- Fix stale constructor call sites that caused the CI compile failures.
## Not included
- Per-environment proxy listeners.
- Network approval cache or prompt behavior changes.
- Ambiguous request attribution handling.
Those behavior changes moved to stacked follow-up #28899.
## Validation
- just fmt
- CI will run tests and clippy
* Avoid sandbox helper in apply_patch approval tests (#28915)
## Summary
This keeps the apply_patch approval tests focused on approval behavior
instead of macOS sandboxed filesystem helper startup.
The changed cases still force patch approval with `UnlessTrusted`, but
use `DangerFullAccess` after approval so the patch write is direct and
cheap. Workspace-write and sandbox-helper behavior remain covered by the
filesystem and apply_patch sandbox tests.
* Pause active goals before TUI interrupts (#28813)
Fixes #28104.
## Summary
Active `/goal` turns should leave the persisted goal paused whenever the
TUI interrupts the running turn. The bug in #28104 showed this most
visibly through `Esc`: some interrupt paths aborted the turn without
updating the goal status, so the goal could remain active and continue
automatically.
This change makes `ChatWidget` pause an active goal before the TUI sends
an interrupt from the status-row path, the pending-steer path, `Ctrl+C`,
or a request-user-input overlay. The modal overlay now reports whether a
key will interrupt the turn, which keeps modal `Esc` and `Ctrl+C`
behavior aligned with the normal interrupt paths.
## Manual Testing
Built the local CLI with `just codex --help`, then launched the local
TUI with goals enabled. Started an active `/goal` turn and interrupted
it with `Esc`, then resumed and repeated with `Ctrl+C`; both paths
showed `Goal paused`, the interrupted-conversation message, and the
`Goal paused (/goal resume)` footer. I also stopped the background
terminal and exited the TUI cleanly after the run.
I did not find a reliable standalone manual path to force the
request-user-input overlay case, so that path is covered by the focused
automated test.
* Recover exec process stdin writes (#28895)
## Summary
Remote stdio MCP servers send tool calls by writing JSON-RPC bytes
through `process/write`.
When the exec-server websocket drops at the wrong time, the remote
process can survive session recovery, but the stdin write can still fail
back to RMCP as a transport send error. RMCP then closes the stdio MCP
transport, so tools like `node_repl` are lost even though the
process/session recovery path is working.
This changes `process/write` to be safe to retry across exec-server
recovery:
- adds a required `writeId` to `process/write`
- retries remote `Session::write` with the same `writeId` after
reconnect
- remembers accepted write ids per process so duplicate retries return
`Accepted` without writing the same bytes to child stdin again
- covers both the client retry path and server-side write id dedupe with
tests
In simple terms:
```text
before:
write to MCP stdin -> websocket closes -> write errors -> RMCP closes node_repl
after:
write to MCP stdin -> websocket closes -> reconnect -> retry same writeId
server either writes once or recognizes it already did
```
* Pin Windows argument lint to Windows 2022 (#28940)
## What
Run the Windows argument-comment-lint job on the `windows-2022` hosted
runner instead of the custom Windows runner pool.
## Why
The custom pool recently moved from the Visual Studio 2022 Windows image
to `windows-2025-vs2026`. Since that migration, the job fails while
Bazel materializes LLVM external repository sources, before the argument
lint itself runs. The same failure appears across unrelated PRs.
This narrow change tests GitHub’s recommended mitigation for workloads
that still require the Visual Studio 2022 image:
https://github.com/actions/runner-images/issues/14017
## How
Use the standard `windows-2022` runner for only the Windows
argument-comment-lint matrix entry. No product code or lint behavior
changes.
* Scope MCP sandbox metadata to server environment (#28914)
Scope MCP sandbox metadata to the MCP server's owning environment.
Previously, `codex/sandbox-state-meta` always used the turn's primary
cwd and rebuilt a legacy sandbox policy from that cwd. That can be wrong
for MCP servers owned by a different execution environment.
This now sends the owning environment cwd as a `file:` URI in
`sandboxCwd`, keeps `permissionProfile` as the permission source of
truth, and omits sandbox-state metadata when a non-default server
environment is not selected for the turn. Local/default MCP servers keep
the existing fallback cwd behavior.
Tests:
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `just test -p codex-mcp`
- `just test -p codex-core mcp_sandbox_cwd`
- `cargo build -p codex-rmcp-client --bin test_stdio_server`
- `just test -p codex-core
stdio_mcp_tool_call_includes_sandbox_state_meta`
* Add turn-scoped context contributions (#28911)
## Summary
- keep context injection on a single ContextContributor trait
- split context injection into thread-scoped and turn-scoped
contribution methods
- wire turn-scoped fragments into initial context assembly so extensions
can contribute context from turn-local state
* Fix goal-first live threads missing from thread/list (#28808)
Fixes #28263.
## Why
When a thread starts with `/goal`, the goal extension can update SQLite
goal state before the thread has any user-turn rollout items.
`thread/list` and `thread/search` rely on persisted listing metadata, so
a goal-first live thread could be absent from app-server listings after
restart even though the goal itself existed.
This regressed when goal handling moved out of core: the core path wrote
the goal update through the live thread rollout path, while the
extension-backed app-server path only updated goal state and emitted the
live notification.
## What
- Add `GoalSetOutcome::thread_goal_updated_item()` so the goal extension
owns the canonical `ThreadGoalUpdated` rollout item shape.
- Expose a narrow `CodexThread::append_rollout_items()` helper that
appends through the live thread and keeps derived SQLite metadata in
sync.
- When app-server sets a goal on an active live thread, persist the goal
update through that live-thread path.
- Add an app-server regression test that starts a live thread with
`thread/goal/set` and verifies it appears in state-DB-only
`thread/list`.
## Verification
- `env -u CODEX_SQLITE_HOME just test -p codex-app-server
goal_first_live_thread_appears_in_state_db_thread_list`
* [codex] Initialize exec-server OpenTelemetry at startup (#25019)
## Summary
- Initialize stderr tracing and the configured OpenTelemetry provider
for local and remote `codex exec-server` startup.
- Instrument the local and remote server entrypoints with a root runtime
span.
- Keep raw Noise environment, registration, and stream identifiers out
of exported spans while preserving them in local debug events.
- Keep telemetry setup in a focused CLI module instead of growing the
top-level command entrypoint.
## Stack
- Previous: none (`#27058` has merged)
- Next: #27466
## Validation
- `just test -p codex-exec-server --lib` (139 passed)
- `just test -p codex-cli --test exec_server` (3 passed)
- `just bazel-lock-check`
- `just fix -p codex-exec-server -p codex-cli`
- `just fmt`
---------
Co-authored-by: Richard Lee <richardlee@openai.com>
* [codex] Fix Windows sandbox runtime ACL refresh (#28943)
## Why
Codex Desktop repairs sandbox-user read/execute access for binaries
copied to `%LOCALAPPDATA%\OpenAI\Codex\bin`, but Computer Use launches
its bundled Node runtime from `%LOCALAPPDATA%\OpenAI\Codex\runtimes`.
On fresh Windows installations, `CodexSandboxUsers` may therefore be
unable to execute the bundled Node binary. The command runner starts,
but `CreateProcessAsUserW` fails with error 5 (`ACCESS_DENIED`), causing
the Node REPL to exit before Computer Use can discover applications.
This is a follow-up to #21564, which added the original runtime `bin`
ACL repair.
## What changed
- Expand the Codex Desktop runtime ACL roots from only `bin` to both
`bin` and `runtimes`.
- Apply the existing inherited read/execute ACL repair to each runtime
directory when it exists.
- Rename the setup helper to reflect that it now handles multiple
runtime paths.
## Validation
- `cargo fmt -- --check`
- `just test -p codex-windows-sandbox` was run: 113 tests passed and
five environment-dependent legacy execution tests failed because
`CreateRestrictedToken` returned error 87.
* Synchronize realtime notification test requests (#28946)
## What
Deliver the scripted realtime notification batch after the assistant
text append request instead of after the preceding developer text append
request.
## Why
The batch ends with an upstream error that closes the realtime
conversation. When it is emitted after the developer append, it races
the subsequent assistant append: the app-server RPC can acknowledge the
append before its downstream WebSocket send completes, and the test
intermittently observes three requests instead of four.
Making the fake server wait for the assistant append before emitting the
terminal batch establishes the ordering the test asserts without sleeps
or production-code changes.
## Validation
- `git diff --check`
- CI (the failure is timing-dependent and most reproducible in the
Windows Bazel shard)
* Add Config for Time Reminders (varlatency 1/n) (#28822)
## Summary
Example:
> [features.current_time_reminder]
enabled = true
reminder_interval_model_requests = 1
clock_source = "system"
## Testing
- `just test -p codex-core varlatency`
- `just test -p codex-core
lock_contains_prompts_and_materializes_features`
- `just fix -p codex-core -p codex-config -p codex-features`
* [codex] rollout budget implementation (varlength 2/N) (#28494)
## Stack
Depends on #28746. This PR implements shared rollout-budget accounting
and model-visible reminders using the configuration defined in #28746.
# Description / Main changes to Core:
`AgentControl` will now be the area where "rollout level" features &
accounting will have to live. It is incorrectly named for this
responsibility, but I think it can hold all the necessary shared state &
features (rollout token budget, mutliple thread interruption
responsibilitym etc)
In this PR, we have one "token ledger" that each thread will subtract
from when sampling. The "charge" will occur when response.completed() is
done and the calculation will be done on the responses api usage
carrier. The calculation will weigh sampling and pre-fill tokens as
specified.
Every time the budget crosses the configured reminder threshold, a
developer message is appended before the thread's next request
This remaining budget will _always_ be restated/reminded after a
compaction event.
Expiration and fan-out interruption will be in the stacked follow-up
(and also live in Agent Control).
## Reminders
"You have weighted {session_tokens_left} tokens left in the shared
session token budget."
The first request in each thread context receives the current remainder.
Later reminders are emitted after aggregate weighted usage crosses a
configured interval. If several intervals are crossed before a thread
sends another request, Core inserts one reminder with the latest
remainder.
Compaction response usage is charged before the next context starts. The
next reminder is appended after the compaction summary, leaving the
initial context content stable.
## Tests
Integration coverage verifies:
- weighted output and non-cached input accounting
- initial and periodic reminders
- shared accounting between a root and sub-agent
- post-compaction remainder and message placement
Local checks:
- `just fmt`
- `just test -p codex-core rollout_budget`
- `git diff --check`
The full workspace test suite was not run locally.
* Support `openai/form` extended form elicitations (#27500)
# Summary
Allow App Server clients to opt into `openai/form` MCP elicitations.
* [codex] Make thread store turn filter optional (#28949)
Make `ListItemsParams::turn_id` optional so callers can list persisted
items across an entire thread or narrow the result to one turn. This
aligns the thread-store API and documentation with thread-wide item
listing while preserving the optional turn-filter behavior for
implementations.
* current time reminders impl for system clock (varlatency 2/n) (#28824)
Stacked on #28822.
## Summary
- add a host-injectable current-time provider with a built-in system
implementation
- record UTC developer reminders in history immediately before due model
requests
- keep cadence state per session and force a refresh after compaction
This does NOT include the app server client <-> server clock logic. This
PR is only for the reminder message & system clock that will be used in
prod.
## Testing
- `just test -p codex-core varlatency_`
- `just clippy -p codex-core -p codex-app-server -p codex-mcp-server -p
codex-thread-manager-sample`
- `just fmt`
* [codex] Cache plugin metadata for tool suggestions (#27812)
## Why
`built_tools` runs for every sampling request, and local plugin
discovery was repeatedly rereading plugin manifests, skills, MCP
configuration, and app declarations to build the same tool-suggest
metadata.
That source-derived metadata is stable until the existing plugin manager
reloads its cache. Runtime eligibility still needs to reflect the
current install, disable, policy, app-overlap, and authentication state.
## What changed
- Add a bounded, in-memory tool-suggest metadata cache owned by
`PluginsManager`.
- Key cached metadata by plugin identity and source, while applying
authentication routing each time the metadata is projected.
- Invalidate the metadata alongside the existing loaded-plugin cache,
including its normal configuration, marketplace refresh, and
remote-installed-plugin invalidation paths.
- Guard against an in-flight load repopulating stale metadata after
invalidation.
- Keep marketplace membership and all runtime eligibility filtering live
rather than introducing a separate catalog or revision model.
## Impact
Repeated sampling requests reuse already-loaded plugin capability
metadata while retaining the existing plugin-manager lifecycle as the
single freshness boundary.
## Validation
- `just test -p codex-core-plugins` — 252 passed
- Added focused coverage for cache invalidation and authentication
reprojection.
* apply-patch: carry paths as PathUri (#28854)
## Why
Allows the model to edit files that are hosted on a different OS than
where app-server is running.
## What
* Use `PathUri` for apply_patch-internal data structures
* Limit `PathUri` -> `AbsolutePathBuf` conversion to cases where the
inferred path convention matches the host OS, allows requiring valid
paths to pass to perms check
* Adds `PathConvention::path_segments()` for iterating over path
segments regardless of OS
* Handle cross-platform relative paths in path filename parsing for
sniffing a shell
* Ensure we can apply patches in the wine e2e test
* Add app-server current-time impl (varlatency 3/n) (#28835)
## What
Server should request:
```
{
"id": 42,
"method": "currentTime/read",
"params": {
"threadId": "11111111-1111-1111-1111-aaaaafdc2c11"
}
}
```
Client should respond with something like:
```rust
{
"id": 42,
"result": {
"currentTimeAt": 1781717655
}
}
```
## Why
Sessions configured with `clock_source = "external"` need a
thread-specific external time source before inference. The system clock
remains the default production provider.
## Validation
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-app-server --test all
current_time_read_round_trip_adds_reminder_to_model_input`
- `cargo test -p codex-app-server
first_attestation_capable_connection_for_thread_only_uses_thread_subscribers`
- `cargo test -p codex-analytics`
- `just fix -p codex-app-server-protocol`
- `just fix -p codex-app-server`
Stacked on #28824.
* Make auto-review on-request prompt more proactive (#26496)
## Why
`on-request` approval policy text is currently tuned for user-reviewed
approvals. For auto-reviewed productivity runs, likely sandbox blocks
should be escalated earlier so commands that need remote services,
authentication, or other out-of-sandbox access do not first fail or hang
inside the sandbox.
## What changed
- Adds a separate `on_request_auto_review.md` permissions prompt
selected for `AskForApproval::OnRequest` with
`ApprovalsReviewer::AutoReview`.
- Keeps the normal user-reviewed `on-request` wording unchanged.
- Makes the `When to request escalation` bullets more explicit about
likely sandbox blocks, network access, remote
auth/cluster/cloud/database access, out-of-sandbox environment access,
git operations that may write lock files, and short-timeout reruns after
likely sandbox-blocked attempts.
- Omits approved command prefix and `prefix_rule` guidance for the
auto-review on-request prompt.
- Adds prompt tests covering the auto-review path, normal on-request
wording, and inline permission request behavior.
* [codex] Remove hardcoded app ID filters (#28947)
## Summary
- remove the duplicated originator-specific connector ID denylists
- stop filtering connector directory/accessibility results and
live/cached Codex Apps MCP tools by hardcoded connector ID
- remove the now-unused `codex-login` dependency from
`codex-utils-plugins`
- update regression coverage so formerly blocked connector IDs are
preserved
## Why
The client-side policy was duplicated across crates, used opaque IDs
without ownership or expiry information, and could drift between app
listing and MCP tool behavior. Server-provided visibility,
authorization, plugin discoverability, accessibility, enabled-state
handling, and consequential-tool approval templates remain unchanged.
## Validation
- `just fmt`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `git diff --check`
- confirmed the final diff contains no hardcoded denylist symbols
A targeted `codex-mcp` test build spent an unusually long time in local
compilation/linking. Its first attempt exposed a test-only `PartialEq`
assertion issue, which was corrected. A follow-up non-linking `cargo
check -p codex-mcp --tests` was still running when this draft was
opened; CI should provide the complete Rust validation.
* TUI: improve unified mention selection visibility (#28959)
## Summary
[@milanglacier reported in
#28653](https://github.com/openai/codex/issues/28653) that the active
mention candidate is hard to distinguish. I suspect [@binbjz’s #28500
report](https://github.com/openai/codex/issues/28500) _(where arrow-key
navigation appeared not to work)_ may describe the same presentation
problem: the selection may have been changing, but the UI was not
showing the active row clearly in their terminal. This PR makes two
small changes to the selection indication behavior:
- Reserve a two-character gutter and mark the active candidate with `> `
for color-agnostic indicator coverage.
- Apply the shared theme-aware accent to the entire selected row for
extra emphasis.
- Update the existing popup snapshot.
Reverse-video styling was considered, but avoided it because it is
overly dependent on the user’s terminal palette.
<img width="2046" height="482" alt="image"
src="https://github.com/user-attachments/assets/b5eb62c3-fd24-4c09-906e-7bd66913b5c6"
/>
## Testing
- `just test -p codex-tui default_unified_mention_popup_snapshot`
- `just clippy -p codex-tui`
- `just fmt`
- Compiled `codex-cli` and tested the unified mentions picker in the
terminal.
* Emit Trusted MCP App Identity on Tool-Call Items (#27132)
## Summary
- Add optional `appContext` to app-server MCP tool-call items with
trusted `connectorId`, `linkId`, and `mcpAppResourceUri` metadata.
- Preserve that context across tool-call events, persisted history,
reconnects, and thread resume.
- Keep the deprecated top-level `mcpAppResourceUri` temporarily for
client migration.
The consumer contract is `{ appContext: { connectorId, linkId,
mcpAppResourceUri }, tool }`.
## Validation
- Full GitHub Actions suite passes, including CLA, Bazel tests, clippy,
release builds, and argument-comment lint.
---------
Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>
* feat: opt ChatGPT auth into agent identity (#19049)
## Stack
This is PR 2 of the simplified HAI single-run-task stack:
- [#19047](https://github.com/openai/codex/pull/19047) Agent Identity
assertion and task-registration primitives, including the shared
run-task helper used by existing Agent Identity JWT auth.
- [#19049](https://github.com/openai/codex/pull/19049)
Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted
Agent Identity runtime auth and its single run task.
- [#19051](https://github.com/openai/codex/pull/19051) Run-scoped
provider auth that uses one backend-owned task id for first-party
inference and compaction requests.
[#19054](https://github.com/openai/codex/pull/19054) collapsed out of
the active stack because the simplified design no longer needs a
separate background/control-plane task helper.
## Summary
This PR adds the disabled-by-default path for normal ChatGPT-login Codex
sessions to obtain Agent Identity runtime auth through the Codex
backend. Existing Agent Identity JWT startup mode remains a separate
path and does not require the feature flag.
What changed:
- adds the experimental `use_agent_identity` feature flag and config
schema entry
- adds an explicit `AgentIdentityAuthPolicy` so call sites choose
`JwtOnly` or `ChatGptAuth` instead of passing a bare boolean
- stores standalone Agent Identity JWT credentials separately from
backend-registered Agent Identity records
- persists the registered Agent Identity record, private key, and single
run task id in `auth.json` so process restarts reuse the same identity
- derives the agent/task registration base URL from ChatGPT/Codex auth
config while keeping JWT JWKS lookup separate
- provisions and caches ChatGPT-derived Agent Identity runtime auth when
`use_agent_identity` is enabled
- reuses the shared run-task registration helper from PR1 rather than
adding a second task-registration path
This PR intentionally does not switch model inference over to
`AgentAssertion` auth. The provider-auth integration lands in the next
PR.
## Testing
- `just test -p codex-login`
* [connectors] Ignore synthetic links for app accessibility (#28770)
Summary
- Stop treating Codex Apps MCP tools with
`_meta._codex_apps.synthetic_link: true` as evidence that a connector is
accessible in `app/list`.
- Preserve synthetic tools in the agent-facing MCP connector set so they
remain available for install/auth flows.
- Keep the app-list accessibility cache limited to connectors backed by
at least one non-synthetic tool.
- Add focused regression coverage for both sides of the boundary.
Validation
- `just fmt`
- `just test -p codex-core
synthetic_links_are_exposed_to_the_agent_but_not_accessible_in_app_list`
- `git diff --check`
- A crate-wide `just test -p codex-core` run completed with 2,699
passing and 51 unrelated local sandbox/state failures, primarily state
DB migration races (`UNIQUE constraint failed:
_sqlx_migrations.version`).
* [codex] Preserve remote plugin download status errors (#28863)
## Summary
- preserve the original HTTP status when a remote plugin bundle download
returns a non-success response
- retain at most 8 KiB of the error response body and annotate
truncation or body-read failures
- add regression coverage for an oversized error response
## Root cause
The non-success response path reused the normal size-limited body
reader. When an error response exceeded 8 KiB, that reader returned
`DownloadTooLarge` before the code constructed `DownloadStatus`, masking
the upstream HTTP status and response context.
## Impact
Remote plugin installation failures now retain the actionable upstream
HTTP status without allowing unbounded error bodies into logs.
## Validation
- `just test -p codex-app-server
plugin_install_preserves_status_when_remote_bundle_error_body_is_too_large`
- `just fmt`
- `git diff --check`
* core: load AGENTS.md from foreign environments (#28958)
## Why
Make it possible to load AGENTS.md from remote exec-servers whose OS is
different than app-server.
## What
- keep `AGENTS.md` discovery and provenance as `PathUri`, with
root-aware parent and ancestor traversal
- expose lifecycle instruction sources as legacy app-server path strings
in events while retaining `PathUri` internally
- preserve and test mixed POSIX and Windows paths in model context and
TUI status output
- cover remote Windows loading end to end by seeding the Wine prefix
through host filesystem APIs
- fix bug in `PathUri`'s parent() implementation that would erase
Windows drive letters
* [codex] Support marketplace plugin manifest fallback (#28789)
## Summary
Support marketplace plugins whose source directory does not include a
discoverable plugin manifest. Metadata-rich `marketplace.json` entries
now act as fallback plugin manifests for listing, local detail reads,
install, and non-curated cache refresh.
The fallback preserves marketplace-entry plugin fields wholesale, then
adds the small Codex-facing compatibility bridge for presentation
metadata. A real source `plugin.json` always wins when present.
## Details
- Capture flattened marketplace-entry fields into
`MarketplacePluginManifestFallback`, preserving fields such as
`version`, `description`, `skills`, `mcpServers`, `apps`, `hooks`,
`agents`, `commands`, `strict`, `author`, and future manifest fields
without a per-field translation list.
- Bridge Claude-style top-level `displayName`, `author.name`,
`homepage`, and marketplace `category` into Codex's nested `interface`
fields only when the nested values are absent.
- Treat fallback metadata as installable only when the marketplace entry
contributes metadata beyond bare `name` and `source`; existing
missing-manifest behavior remains for metadata-free entries.
- Read local plugin details from the already parsed fallback manifest,
including fallback-declared app and MCP paths, instead of rereading only
an on-disk manifest.
- Pass fallback contents into `PluginStore`, which validates them and
injects `.codex-plugin/plugin.json` into Store's existing atomic copy.
Local marketplace source directories are never mutated, and the fallback
path no longer needs an additional staging directory.
- Keep Git source materialization unchanged; Git clones still use the
existing marketplace source staging area before St…
…et_from_release_0.155.0_b621645860b1 checkpoint: into wallentx/termux-target from release/0.155.0 @ b621645
unemployabot
Bot
added
termux-release
unemployabot
Bot
force-pushed
the
release/0.155.0
branch
2 times, most recently
from
September 15, 2026 03:38
8a59361 to
0581251
Compare
unemployabot
Bot
changed the title
unemployabot
Bot
force-pushed
the
upstream/rust-v0.155.0
branch
from
September 15, 2026 03:38
9281f1b to
ff75f40
Compare
unemployabot
Bot
force-pushed
the
release/0.155.0
branch
from
September 15, 2026 21:28
0581251 to
8d1c9c7
Compare
unemployabot
Bot
force-pushed
the
upstream/rust-v0.155.0
branch
from
September 15, 2026 21:28
32abc09 to
8b498ea
Compare
unemployabot
Bot
changed the title
|
Termux Android artifact ready for testing:
You must be signed in to GitHub with repository access to download Actions artifacts. |
|
Termux Android artifact ready for testing:
You must be signed in to GitHub with repository access to download Actions artifacts. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Termux release train
rust-v0.155.0-alpha.7rust-v0.155.0-alpha.7-termuxrelease/0.155.0wallentx/termux-targetThis PR is intentionally created from
wallentx/termux-targetwith the Termux release automation files copied fromdev, then targeted at the upstream release branch. If GitHub reports conflicts, resolve them manually by keeping the upstream release code while preserving the Termux compatibility fixes.Auto-merge is enabled when GitHub reports the PR as mergeable. Required CI, including the Termux artifact smoke test, is the approval gate. After merge, the deployment workflow attaches the tested artifact to
rust-v0.155.0-alpha.7-termuxand opens the checkpoint PR.Upstream notes
Release 0.155.0-alpha.7