diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index 7cc8d83419..8ae5bef17c 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -1449,8 +1449,8 @@ "resolv-conf_0.7.6": "{\"dependencies\":[],\"features\":{\"system\":[]}}", "rfc6979_0.4.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"hex-literal\",\"req\":\"^0.3\"},{\"default_features\":false,\"features\":[\"reset\"],\"name\":\"hmac\",\"req\":\"^0.12\"},{\"kind\":\"dev\",\"name\":\"sha2\",\"req\":\"^0.10\"},{\"default_features\":false,\"name\":\"subtle\",\"req\":\"^2\"}],\"features\":{}}", "ring_0.17.14": "{\"dependencies\":[{\"default_features\":false,\"kind\":\"build\",\"name\":\"cc\",\"req\":\"^1.2.8\"},{\"default_features\":false,\"name\":\"cfg-if\",\"req\":\"^1.0.0\"},{\"name\":\"getrandom\",\"req\":\"^0.2.10\"},{\"default_features\":false,\"name\":\"libc\",\"req\":\"^0.2.148\",\"target\":\"cfg(all(any(all(target_arch = \\\"aarch64\\\", target_endian = \\\"little\\\"), all(target_arch = \\\"arm\\\", target_endian = \\\"little\\\")), any(target_os = \\\"android\\\", target_os = \\\"linux\\\")))\"},{\"default_features\":false,\"name\":\"libc\",\"req\":\"^0.2.155\",\"target\":\"cfg(all(all(target_arch = \\\"aarch64\\\", target_endian = \\\"little\\\"), target_vendor = \\\"apple\\\", any(target_os = \\\"ios\\\", target_os = \\\"macos\\\", target_os = \\\"tvos\\\", target_os = \\\"visionos\\\", target_os = \\\"watchos\\\")))\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"libc\",\"req\":\"^0.2.148\",\"target\":\"cfg(any(unix, windows, target_os = \\\"wasi\\\"))\"},{\"name\":\"untrusted\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"std\"],\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3.37\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"features\":[\"Win32_Foundation\",\"Win32_System_Threading\"],\"name\":\"windows-sys\",\"req\":\"^0.52\",\"target\":\"cfg(all(all(target_arch = \\\"aarch64\\\", target_endian = \\\"little\\\"), target_os = \\\"windows\\\"))\"}],\"features\":{\"alloc\":[],\"default\":[\"alloc\",\"dev_urandom_fallback\"],\"dev_urandom_fallback\":[],\"less-safe-getrandom-custom-or-rdrand\":[],\"less-safe-getrandom-espidf\":[],\"slow_tests\":[],\"std\":[\"alloc\"],\"test_logging\":[],\"unstable-testing-arm-no-hw\":[],\"unstable-testing-arm-no-neon\":[],\"wasm32_unknown_unknown_js\":[\"getrandom/js\"]}}", - "rmcp-macros_1.7.0": "{\"dependencies\":[{\"name\":\"darling\",\"req\":\"^0.23\"},{\"name\":\"proc-macro2\",\"req\":\"^1\"},{\"name\":\"quote\",\"req\":\"^1\"},{\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"features\":[\"full\"],\"name\":\"syn\",\"req\":\"^2\"}],\"features\":{\"local\":[]}}", - "rmcp_1.7.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"anyhow\",\"req\":\"^1.0\"},{\"name\":\"async-trait\",\"req\":\"^0.1.89\"},{\"kind\":\"dev\",\"name\":\"async-trait\",\"req\":\"^0.1\"},{\"default_features\":false,\"features\":[\"http1\",\"tokio\"],\"kind\":\"dev\",\"name\":\"axum\",\"req\":\"^0.8\"},{\"name\":\"base64\",\"optional\":true,\"req\":\"^0.22\"},{\"name\":\"bytes\",\"optional\":true,\"req\":\"^1\"},{\"default_features\":false,\"features\":[\"serde\",\"clock\",\"std\",\"oldtime\"],\"name\":\"chrono\",\"req\":\"^0.4.38\",\"target\":\"cfg(all(target_family = \\\"wasm\\\", target_os = \\\"unknown\\\"))\"},{\"default_features\":false,\"features\":[\"serde\",\"now\"],\"name\":\"chrono\",\"req\":\"^0.4.38\",\"target\":\"cfg(not(all(target_family = \\\"wasm\\\", target_os = \\\"unknown\\\")))\"},{\"name\":\"futures\",\"req\":\"^0.3\"},{\"name\":\"http\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"http-body\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"http-body-util\",\"optional\":true,\"req\":\"^0.1\"},{\"features\":[\"client\",\"http1\"],\"name\":\"hyper\",\"optional\":true,\"req\":\"^1\"},{\"features\":[\"server\",\"http1\"],\"kind\":\"dev\",\"name\":\"hyper\",\"req\":\"^1\"},{\"features\":[\"tokio\"],\"name\":\"hyper-util\",\"optional\":true,\"req\":\"^0.1\"},{\"features\":[\"tokio\"],\"kind\":\"dev\",\"name\":\"hyper-util\",\"req\":\"^0.1\"},{\"name\":\"jsonwebtoken\",\"optional\":true,\"req\":\"^10\"},{\"default_features\":false,\"name\":\"oauth2\",\"optional\":true,\"req\":\"^5.0\"},{\"name\":\"pastey\",\"optional\":true,\"req\":\"^0.2.0\"},{\"name\":\"pin-project-lite\",\"req\":\"^0.2\"},{\"features\":[\"tokio1\"],\"name\":\"process-wrap\",\"optional\":true,\"req\":\"^9.0\"},{\"name\":\"rand\",\"optional\":true,\"req\":\"^0.10\"},{\"default_features\":false,\"features\":[\"json\",\"stream\"],\"name\":\"reqwest\",\"optional\":true,\"req\":\"^0.13.2\"},{\"name\":\"rmcp-macros\",\"optional\":true,\"req\":\"^1.7.0\"},{\"features\":[\"chrono04\"],\"name\":\"schemars\",\"optional\":true,\"req\":\"^1.0\"},{\"features\":[\"chrono04\"],\"kind\":\"dev\",\"name\":\"schemars\",\"req\":\"^1.1.0\"},{\"features\":[\"derive\",\"rc\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"name\":\"sse-stream\",\"optional\":true,\"req\":\"^0.2\"},{\"name\":\"thiserror\",\"req\":\"^2\"},{\"features\":[\"sync\",\"macros\",\"rt\",\"time\"],\"name\":\"tokio\",\"req\":\"^1\"},{\"features\":[\"full\"],\"kind\":\"dev\",\"name\":\"tokio\",\"req\":\"^1\"},{\"name\":\"tokio-stream\",\"optional\":true,\"req\":\"^0.1\"},{\"name\":\"tokio-util\",\"req\":\"^0.7\"},{\"name\":\"tower-service\",\"optional\":true,\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"tower-service\",\"req\":\"^0.3\"},{\"name\":\"tracing\",\"req\":\"^0.1\"},{\"features\":[\"env-filter\",\"std\",\"fmt\"],\"kind\":\"dev\",\"name\":\"tracing-subscriber\",\"req\":\"^0.3\"},{\"name\":\"url\",\"optional\":true,\"req\":\"^2.4\"},{\"kind\":\"dev\",\"name\":\"url\",\"req\":\"^2.4\"},{\"features\":[\"v4\"],\"name\":\"uuid\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"which\",\"optional\":true,\"req\":\"^8\"}],\"features\":{\"__reqwest\":[\"dep:reqwest\"],\"auth\":[\"dep:oauth2\",\"__reqwest\",\"dep:url\"],\"auth-client-credentials-jwt\":[\"auth\",\"dep:jsonwebtoken\",\"uuid\"],\"client\":[\"dep:tokio-stream\"],\"client-side-sse\":[\"dep:sse-stream\",\"dep:http\"],\"default\":[\"base64\",\"macros\",\"server\"],\"elicitation\":[\"dep:url\"],\"local\":[\"rmcp-macros?/local\"],\"macros\":[\"dep:rmcp-macros\",\"dep:pastey\"],\"reqwest\":[\"__reqwest\",\"reqwest?/rustls\"],\"reqwest-native-tls\":[\"__reqwest\",\"reqwest?/native-tls\"],\"reqwest-tls-no-provider\":[\"__reqwest\",\"reqwest?/rustls-no-provider\"],\"schemars\":[\"dep:schemars\"],\"server\":[\"transport-async-rw\",\"dep:schemars\",\"dep:pastey\"],\"server-side-http\":[\"uuid\",\"dep:rand\",\"dep:tokio-stream\",\"dep:http\",\"dep:http-body\",\"dep:http-body-util\",\"dep:bytes\",\"dep:sse-stream\",\"tower\"],\"tower\":[\"dep:tower-service\"],\"transport-async-rw\":[\"tokio/io-util\",\"tokio-util/codec\"],\"transport-child-process\":[\"transport-async-rw\",\"tokio/process\",\"dep:process-wrap\"],\"transport-io\":[\"transport-async-rw\",\"tokio/io-std\"],\"transport-streamable-http-client\":[\"client-side-sse\",\"transport-worker\"],\"transport-streamable-http-client-reqwest\":[\"transport-streamable-http-client\",\"__reqwest\"],\"transport-streamable-http-client-unix-socket\":[\"transport-streamable-http-client\",\"dep:hyper\",\"dep:hyper-util\",\"dep:http-body-util\",\"dep:http\",\"dep:bytes\",\"tokio/net\"],\"transport-streamable-http-server\":[\"transport-streamable-http-server-session\",\"server-side-http\",\"transport-worker\"],\"transport-streamable-http-server-session\":[\"transport-async-rw\",\"dep:tokio-stream\"],\"transport-worker\":[\"dep:tokio-stream\"],\"which-command\":[\"transport-child-process\",\"dep:which\"]}}", + "rmcp-macros_1.8.0": "{\"dependencies\":[{\"name\":\"darling\",\"req\":\"^0.23\"},{\"name\":\"proc-macro2\",\"req\":\"^1\"},{\"name\":\"quote\",\"req\":\"^1\"},{\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"features\":[\"full\"],\"name\":\"syn\",\"req\":\"^2\"}],\"features\":{\"local\":[]}}", + "rmcp_1.8.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"anyhow\",\"req\":\"^1.0\"},{\"name\":\"async-trait\",\"req\":\"^0.1.89\"},{\"kind\":\"dev\",\"name\":\"async-trait\",\"req\":\"^0.1\"},{\"default_features\":false,\"features\":[\"http1\",\"tokio\"],\"kind\":\"dev\",\"name\":\"axum\",\"req\":\"^0.8\"},{\"name\":\"base64\",\"optional\":true,\"req\":\"^0.22\"},{\"name\":\"bytes\",\"optional\":true,\"req\":\"^1\"},{\"default_features\":false,\"features\":[\"serde\",\"clock\",\"std\",\"oldtime\"],\"name\":\"chrono\",\"req\":\"^0.4.38\",\"target\":\"cfg(all(target_family = \\\"wasm\\\", target_os = \\\"unknown\\\"))\"},{\"default_features\":false,\"features\":[\"serde\",\"now\"],\"name\":\"chrono\",\"req\":\"^0.4.38\",\"target\":\"cfg(not(all(target_family = \\\"wasm\\\", target_os = \\\"unknown\\\")))\"},{\"name\":\"futures\",\"req\":\"^0.3\"},{\"name\":\"http\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"http-body\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"http-body-util\",\"optional\":true,\"req\":\"^0.1\"},{\"features\":[\"client\",\"http1\"],\"name\":\"hyper\",\"optional\":true,\"req\":\"^1\"},{\"features\":[\"server\",\"http1\"],\"kind\":\"dev\",\"name\":\"hyper\",\"req\":\"^1\"},{\"features\":[\"tokio\"],\"name\":\"hyper-util\",\"optional\":true,\"req\":\"^0.1\"},{\"features\":[\"tokio\"],\"kind\":\"dev\",\"name\":\"hyper-util\",\"req\":\"^0.1\"},{\"name\":\"jsonwebtoken\",\"optional\":true,\"req\":\"^10\"},{\"default_features\":false,\"name\":\"oauth2\",\"optional\":true,\"req\":\"^5.0\"},{\"name\":\"pastey\",\"optional\":true,\"req\":\"^0.2.0\"},{\"name\":\"pin-project-lite\",\"req\":\"^0.2\"},{\"features\":[\"tokio1\"],\"name\":\"process-wrap\",\"optional\":true,\"req\":\"^9.0\"},{\"name\":\"rand\",\"optional\":true,\"req\":\"^0.10\"},{\"default_features\":false,\"features\":[\"json\",\"stream\"],\"name\":\"reqwest\",\"optional\":true,\"req\":\"^0.13.2\"},{\"name\":\"rmcp-macros\",\"optional\":true,\"req\":\"^1.8.0\"},{\"features\":[\"chrono04\"],\"name\":\"schemars\",\"optional\":true,\"req\":\"^1.0\"},{\"features\":[\"chrono04\"],\"kind\":\"dev\",\"name\":\"schemars\",\"req\":\"^1.1.0\"},{\"features\":[\"derive\",\"rc\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"name\":\"sse-stream\",\"optional\":true,\"req\":\"^0.2\"},{\"name\":\"thiserror\",\"req\":\"^2\"},{\"features\":[\"sync\",\"macros\",\"rt\",\"time\"],\"name\":\"tokio\",\"req\":\"^1\"},{\"features\":[\"full\"],\"kind\":\"dev\",\"name\":\"tokio\",\"req\":\"^1\"},{\"name\":\"tokio-stream\",\"optional\":true,\"req\":\"^0.1\"},{\"name\":\"tokio-util\",\"req\":\"^0.7\"},{\"name\":\"tower-service\",\"optional\":true,\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"tower-service\",\"req\":\"^0.3\"},{\"name\":\"tracing\",\"req\":\"^0.1\"},{\"features\":[\"env-filter\",\"std\",\"fmt\"],\"kind\":\"dev\",\"name\":\"tracing-subscriber\",\"req\":\"^0.3\"},{\"name\":\"url\",\"optional\":true,\"req\":\"^2.4\"},{\"kind\":\"dev\",\"name\":\"url\",\"req\":\"^2.4\"},{\"features\":[\"v4\"],\"name\":\"uuid\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"which\",\"optional\":true,\"req\":\"^8\"}],\"features\":{\"__reqwest\":[\"dep:reqwest\"],\"auth\":[\"dep:oauth2\",\"__reqwest\",\"dep:url\"],\"auth-client-credentials-jwt\":[\"auth\",\"dep:jsonwebtoken\",\"uuid\"],\"client\":[\"dep:tokio-stream\"],\"client-side-sse\":[\"dep:sse-stream\",\"dep:http\"],\"default\":[\"base64\",\"macros\",\"server\"],\"elicitation\":[\"dep:url\"],\"local\":[\"rmcp-macros?/local\"],\"macros\":[\"dep:rmcp-macros\",\"dep:pastey\"],\"reqwest\":[\"__reqwest\",\"reqwest?/rustls\"],\"reqwest-native-tls\":[\"__reqwest\",\"reqwest?/native-tls\"],\"reqwest-tls-no-provider\":[\"__reqwest\",\"reqwest?/rustls-no-provider\"],\"schemars\":[\"dep:schemars\"],\"server\":[\"transport-async-rw\",\"dep:schemars\",\"dep:pastey\"],\"server-side-http\":[\"uuid\",\"dep:rand\",\"dep:tokio-stream\",\"dep:http\",\"dep:http-body\",\"dep:http-body-util\",\"dep:bytes\",\"dep:sse-stream\",\"tower\"],\"tower\":[\"dep:tower-service\"],\"transport-async-rw\":[\"tokio/io-util\",\"tokio-util/codec\"],\"transport-child-process\":[\"transport-async-rw\",\"tokio/process\",\"dep:process-wrap\"],\"transport-io\":[\"transport-async-rw\",\"tokio/io-std\"],\"transport-streamable-http-client\":[\"client-side-sse\",\"transport-worker\"],\"transport-streamable-http-client-reqwest\":[\"transport-streamable-http-client\",\"__reqwest\"],\"transport-streamable-http-client-unix-socket\":[\"transport-streamable-http-client\",\"dep:hyper\",\"dep:hyper-util\",\"dep:http-body-util\",\"dep:http\",\"dep:bytes\",\"tokio/net\"],\"transport-streamable-http-server\":[\"transport-streamable-http-server-session\",\"server-side-http\",\"transport-worker\"],\"transport-streamable-http-server-session\":[\"transport-async-rw\",\"dep:tokio-stream\"],\"transport-worker\":[\"dep:tokio-stream\"],\"which-command\":[\"transport-child-process\",\"dep:which\"]}}", "rtrb_0.3.3": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.8\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"crossbeam-utils\",\"req\":\"^0.8\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.10\"}],\"features\":{\"default\":[\"std\"],\"std\":[]}}", "rust-embed-impl_8.11.0": "{\"dependencies\":[{\"name\":\"proc-macro2\",\"req\":\"^1\"},{\"name\":\"quote\",\"req\":\"^1\"},{\"name\":\"rust-embed-utils\",\"req\":\"^8.11.0\"},{\"name\":\"shellexpand\",\"optional\":true,\"req\":\"^3\"},{\"default_features\":false,\"features\":[\"derive\",\"parsing\",\"proc-macro\",\"printing\"],\"name\":\"syn\",\"req\":\"^2\"},{\"name\":\"walkdir\",\"req\":\"^2.3.1\"}],\"features\":{\"compression\":[],\"debug-embed\":[],\"deterministic-timestamps\":[],\"include-exclude\":[\"rust-embed-utils/include-exclude\"],\"interpolate-folder-path\":[\"shellexpand\"],\"mime-guess\":[\"rust-embed-utils/mime-guess\"]}}", "rust-embed-utils_8.11.0": "{\"dependencies\":[{\"name\":\"globset\",\"optional\":true,\"req\":\"^0.4.8\"},{\"name\":\"mime_guess\",\"optional\":true,\"req\":\"^2.0.4\"},{\"name\":\"sha2\",\"req\":\"^0.10.5\"},{\"name\":\"walkdir\",\"req\":\"^2.3.1\"}],\"features\":{\"debug-embed\":[],\"include-exclude\":[\"globset\"],\"mime-guess\":[\"mime_guess\"]}}", diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock index 3cbc714d0c..360b8f49a9 100644 --- a/codex-rs/Cargo.lock +++ b/codex-rs/Cargo.lock @@ -2888,6 +2888,7 @@ dependencies = [ "codex-app-server-protocol", "codex-client", "codex-file-system", + "codex-network-proxy", "codex-protocol", "codex-sandboxing", "codex-shell-command", @@ -3981,6 +3982,7 @@ dependencies = [ "chrono", "codex-git-utils", "codex-install-context", + "codex-otel", "codex-protocol", "codex-rollout", "codex-state", @@ -9451,7 +9453,7 @@ version = "5.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d" dependencies = [ - "base64 0.21.7", + "base64 0.22.1", "chrono", "getrandom 0.2.17", "http 1.4.0", @@ -10537,7 +10539,7 @@ version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7" dependencies = [ - "heck 0.4.1", + "heck 0.5.0", "itertools 0.14.0", "log", "multimap", @@ -11457,9 +11459,9 @@ dependencies = [ [[package]] name = "rmcp" -version = "1.7.0" +version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0810a9f717d9828f475fe1f629f4c305c8464b7f496c3a854b58d29e65f4058e" +checksum = "1d1f571c72940a19d9532fe52dbea8bc9912bf1d766c2970bb824056b86f3f59" dependencies = [ "async-trait", "base64 0.22.1", @@ -11492,9 +11494,9 @@ dependencies = [ [[package]] name = "rmcp-macros" -version = "1.7.0" +version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aefac48c364756e97f04c0401ba3231e8607882c7c1d92da0437dc16307904d" +checksum = "1aad0035b69380782d78ea95b508327e6deaa2235909053e596eea8f27b5e1d5" dependencies = [ "darling 0.23.0", "proc-macro2", diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml index 9591f78afa..17c2d1561b 100644 --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml @@ -368,7 +368,7 @@ rcgen = { version = "0.14.7", default-features = false, features = [ regex = "1.12.3" regex-lite = "0.1.8" reqwest = { version = "0.12", features = ["cookies"] } -rmcp = { version = "1.7.0", default-features = false } +rmcp = { version = "1.8.0", default-features = false } runfiles = { git = "https://github.com/dzbarsky/rules_rust", rev = "b56cbaa8465e74127f1ea216f813cd377295ad81" } rustls = { version = "0.23", default-features = false, features = [ "aws_lc_rs", @@ -380,7 +380,7 @@ schemars = "0.8.22" seccompiler = "0.5.0" semver = "1.0" sentry = "0.46.0" -serde = "1" +serde = { version = "1", features = ["rc"] } serde_ignored = "0.1.14" serde_json = "1" serde_path_to_error = "0.1.20" diff --git a/codex-rs/analytics/src/analytics_client_tests.rs b/codex-rs/analytics/src/analytics_client_tests.rs index 091a85e11f..38d9539615 100644 --- a/codex-rs/analytics/src/analytics_client_tests.rs +++ b/codex-rs/analytics/src/analytics_client_tests.rs @@ -177,6 +177,7 @@ fn sample_thread_with_metadata( ) -> Thread { Thread { id: thread_id.to_string(), + extra: None, session_id: format!("session-{thread_id}"), forked_from_id: None, parent_thread_id, @@ -219,7 +220,7 @@ fn sample_thread_start_response( cwd: test_path_buf("/tmp").abs(), runtime_workspace_roots: Vec::new(), instruction_sources: Vec::new(), - approval_policy: AppServerAskForApproval::OnFailure, + approval_policy: AppServerAskForApproval::OnRequest, approvals_reviewer: AppServerApprovalsReviewer::User, sandbox: AppServerSandboxPolicy::DangerFullAccess, active_permission_profile: None, @@ -284,7 +285,7 @@ fn sample_thread_resume_response_with_source( cwd: test_path_buf("/tmp").abs(), runtime_workspace_roots: Vec::new(), instruction_sources: Vec::new(), - approval_policy: AppServerAskForApproval::OnFailure, + approval_policy: AppServerAskForApproval::OnRequest, approvals_reviewer: AppServerApprovalsReviewer::User, sandbox: AppServerSandboxPolicy::DangerFullAccess, active_permission_profile: None, @@ -3026,6 +3027,7 @@ fn plugin_used_event_serializes_expected_shape() { "event_type": "codex_plugin_used", "event_params": { "plugin_id": "sample@test", + "remote_plugin_id": null, "plugin_name": "sample", "marketplace_name": "test", "has_skills": true, @@ -3056,6 +3058,7 @@ fn plugin_management_event_serializes_expected_shape() { "event_type": "codex_plugin_installed", "event_params": { "plugin_id": "sample@test", + "remote_plugin_id": null, "plugin_name": "sample", "marketplace_name": "test", "has_skills": true, @@ -3085,6 +3088,7 @@ fn plugin_install_failed_event_serializes_expected_shape() { "event_type": "codex_plugin_install_failed", "event_params": { "plugin_id": "sample@test", + "remote_plugin_id": null, "plugin_name": "sample", "marketplace_name": "test", "has_skills": true, @@ -3098,7 +3102,7 @@ fn plugin_install_failed_event_serializes_expected_shape() { } #[test] -fn plugin_management_event_can_use_remote_plugin_id_override() { +fn plugin_management_event_keeps_plugin_id_local_when_remote_id_exists() { let mut plugin = sample_plugin_metadata(); plugin.remote_plugin_id = Some("plugins~Plugin_remote".to_string()); let event = TrackEventRequest::PluginInstalled(CodexPluginEventRequest { @@ -3109,11 +3113,21 @@ fn plugin_management_event_can_use_remote_plugin_id_override() { let payload = serde_json::to_value(&event).expect("serialize plugin installed event"); assert_eq!( - payload["event_params"]["plugin_id"], - "plugins~Plugin_remote" + payload, + json!({ + "event_type": "codex_plugin_installed", + "event_params": { + "plugin_id": "sample@test", + "remote_plugin_id": "plugins~Plugin_remote", + "plugin_name": "sample", + "marketplace_name": "test", + "has_skills": true, + "mcp_server_count": 2, + "connector_ids": ["calendar", "drive"], + "product_client_id": originator().value + } + }) ); - assert_eq!(payload["event_params"]["plugin_name"], "sample"); - assert_eq!(payload["event_params"]["marketplace_name"], "test"); } #[test] @@ -3453,6 +3467,7 @@ async fn reducer_ingests_plugin_state_changed_fact() { "event_type": "codex_plugin_disabled", "event_params": { "plugin_id": "sample@test", + "remote_plugin_id": null, "plugin_name": "sample", "marketplace_name": "test", "has_skills": true, @@ -3488,6 +3503,7 @@ async fn reducer_ingests_plugin_install_failed_fact() { "event_type": "codex_plugin_install_failed", "event_params": { "plugin_id": "sample@test", + "remote_plugin_id": null, "plugin_name": "sample", "marketplace_name": "test", "has_skills": true, @@ -3505,7 +3521,7 @@ async fn reducer_ingests_plugin_install_failed_fact_without_detail() { let mut reducer = AnalyticsReducer::default(); let mut events = Vec::new(); let plugin = PluginTelemetryMetadata { - plugin_id: PluginId::parse("unknown@openai-curated-remote").expect("valid plugin id"), + plugin_id: None, remote_plugin_id: Some("plugins~Plugin_00000000000000000000000000000000".to_string()), capability_summary: None, }; @@ -3528,9 +3544,10 @@ async fn reducer_ingests_plugin_install_failed_fact_without_detail() { json!([{ "event_type": "codex_plugin_install_failed", "event_params": { - "plugin_id": "plugins~Plugin_00000000000000000000000000000000", - "plugin_name": "unknown", - "marketplace_name": "openai-curated-remote", + "plugin_id": null, + "remote_plugin_id": "plugins~Plugin_00000000000000000000000000000000", + "plugin_name": null, + "marketplace_name": null, "has_skills": null, "mcp_server_count": null, "connector_ids": null, @@ -4569,7 +4586,7 @@ async fn turn_completed_without_started_notification_emits_null_started_at() { fn sample_plugin_metadata() -> PluginTelemetryMetadata { PluginTelemetryMetadata { - plugin_id: PluginId::parse("sample@test").expect("valid plugin id"), + plugin_id: Some(PluginId::parse("sample@test").expect("valid plugin id")), remote_plugin_id: None, capability_summary: Some(PluginCapabilitySummary { config_name: "sample@test".to_string(), diff --git a/codex-rs/analytics/src/client.rs b/codex-rs/analytics/src/client.rs index 671bbfa44f..e310d4463c 100644 --- a/codex-rs/analytics/src/client.rs +++ b/codex-rs/analytics/src/client.rs @@ -38,6 +38,7 @@ use codex_app_server_protocol::ServerResponse; use codex_login::AuthManager; use codex_login::CodexAuth; use codex_login::default_client::create_client; +use codex_plugin::PluginId; use codex_plugin::PluginTelemetryMetadata; use codex_protocol::request_permissions::RequestPermissionsResponse; use std::collections::HashSet; @@ -173,7 +174,15 @@ impl AnalyticsEventsQueue { if emitted.len() >= ANALYTICS_EVENT_DEDUPE_MAX_KEYS { emitted.clear(); } - emitted.insert((tracking.turn_id.clone(), plugin.plugin_id.as_key())) + let Some(plugin_id) = plugin + .plugin_id + .as_ref() + .map(PluginId::as_key) + .or_else(|| plugin.remote_plugin_id.clone()) + else { + return true; + }; + emitted.insert((tracking.turn_id.clone(), plugin_id)) } } diff --git a/codex-rs/analytics/src/client_tests.rs b/codex-rs/analytics/src/client_tests.rs index a14fe7bf2d..bbc5b5f0b6 100644 --- a/codex-rs/analytics/src/client_tests.rs +++ b/codex-rs/analytics/src/client_tests.rs @@ -277,6 +277,7 @@ fn sample_thread_archive_request() -> ClientRequest { fn sample_thread(thread_id: &str) -> Thread { Thread { id: thread_id.to_string(), + extra: None, session_id: format!("session-{thread_id}"), forked_from_id: None, parent_thread_id: None, @@ -309,7 +310,7 @@ fn sample_thread_start_response() -> ClientResponsePayload { cwd: test_path_buf("/tmp").abs(), runtime_workspace_roots: Vec::new(), instruction_sources: Vec::new(), - approval_policy: AppServerAskForApproval::OnFailure, + approval_policy: AppServerAskForApproval::OnRequest, approvals_reviewer: AppServerApprovalsReviewer::User, sandbox: AppServerSandboxPolicy::DangerFullAccess, active_permission_profile: None, @@ -327,7 +328,7 @@ fn sample_thread_resume_response() -> ClientResponsePayload { cwd: test_path_buf("/tmp").abs(), runtime_workspace_roots: Vec::new(), instruction_sources: Vec::new(), - approval_policy: AppServerAskForApproval::OnFailure, + approval_policy: AppServerAskForApproval::OnRequest, approvals_reviewer: AppServerApprovalsReviewer::User, sandbox: AppServerSandboxPolicy::DangerFullAccess, active_permission_profile: None, @@ -346,7 +347,7 @@ fn sample_thread_fork_response() -> ClientResponsePayload { cwd: test_path_buf("/tmp").abs(), runtime_workspace_roots: Vec::new(), instruction_sources: Vec::new(), - approval_policy: AppServerAskForApproval::OnFailure, + approval_policy: AppServerAskForApproval::OnRequest, approvals_reviewer: AppServerApprovalsReviewer::User, sandbox: AppServerSandboxPolicy::DangerFullAccess, active_permission_profile: None, diff --git a/codex-rs/analytics/src/events.rs b/codex-rs/analytics/src/events.rs index 29d896156b..2fe465c9bd 100644 --- a/codex-rs/analytics/src/events.rs +++ b/codex-rs/analytics/src/events.rs @@ -26,6 +26,7 @@ use crate::now_unix_millis; use codex_app_server_protocol::CodexErrorInfo; use codex_app_server_protocol::CommandExecutionSource; use codex_login::default_client::originator; +use codex_plugin::PluginId; use codex_plugin::PluginTelemetryMetadata; use codex_protocol::approvals::NetworkApprovalProtocol; use codex_protocol::models::AdditionalPermissionProfile; @@ -933,6 +934,7 @@ pub(crate) struct CodexTurnSteerEventRequest { #[derive(Serialize)] pub(crate) struct CodexPluginMetadata { pub(crate) plugin_id: Option, + pub(crate) remote_plugin_id: Option, pub(crate) plugin_name: Option, pub(crate) marketplace_name: Option, pub(crate) has_skills: Option, @@ -1040,11 +1042,13 @@ pub(crate) fn codex_plugin_metadata(plugin: PluginTelemetryMetadata) -> CodexPlu remote_plugin_id, capability_summary, } = plugin; - let event_plugin_id = remote_plugin_id.unwrap_or_else(|| plugin_id.as_key()); CodexPluginMetadata { - plugin_id: Some(event_plugin_id), - plugin_name: Some(plugin_id.plugin_name), - marketplace_name: Some(plugin_id.marketplace_name), + plugin_id: plugin_id.as_ref().map(PluginId::as_key), + remote_plugin_id, + plugin_name: plugin_id + .as_ref() + .map(|plugin_id| plugin_id.plugin_name.clone()), + marketplace_name: plugin_id.map(|plugin_id| plugin_id.marketplace_name), has_skills: capability_summary .as_ref() .map(|summary| summary.has_skills), diff --git a/codex-rs/app-server-protocol/schema/json/ClientRequest.json b/codex-rs/app-server-protocol/schema/json/ClientRequest.json index 28597eff62..490161486a 100644 --- a/codex-rs/app-server-protocol/schema/json/ClientRequest.json +++ b/codex-rs/app-server-protocol/schema/json/ClientRequest.json @@ -125,7 +125,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/ServerNotification.json b/codex-rs/app-server-protocol/schema/json/ServerNotification.json index b79e3cb13f..27753341bf 100644 --- a/codex-rs/app-server-protocol/schema/json/ServerNotification.json +++ b/codex-rs/app-server-protocol/schema/json/ServerNotification.json @@ -450,7 +450,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], @@ -3626,6 +3625,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -3765,6 +3765,10 @@ ], "type": "object" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadGoal": { "properties": { "createdAt": { @@ -5111,6 +5115,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index 597fd5a1b8..8e1000aaa1 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -6864,7 +6864,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], @@ -16831,6 +16830,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -17052,6 +17052,10 @@ "title": "ThreadDeletedNotification", "type": "object" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadForkParams": { "$schema": "http://json-schema.org/draft-07/schema#", "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using a non-empty path, the thread_id param will be ignored. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.", @@ -19699,6 +19703,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json index 3af48cc6c0..c98f7d44da 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json @@ -990,7 +990,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], @@ -14610,6 +14609,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -14831,6 +14831,10 @@ "title": "ThreadDeletedNotification", "type": "object" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadForkParams": { "$schema": "http://json-schema.org/draft-07/schema#", "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using a non-empty path, the thread_id param will be ignored. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.", @@ -17478,6 +17482,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json index ef2411534d..16f8363416 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json @@ -173,7 +173,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json index edbb7f0bcd..3fe6a89787 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json @@ -15,7 +15,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json index 545ae64d4a..4eb3489663 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json @@ -1438,6 +1438,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json index e72522a26a..ad0174cfe0 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json @@ -19,7 +19,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json index c19251667a..ac77905901 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json @@ -42,7 +42,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], @@ -1059,6 +1058,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -1165,6 +1165,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -2017,6 +2021,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json index 9925c5411e..71e698e5ac 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json @@ -865,6 +865,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -971,6 +972,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -1823,6 +1828,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json index 1e142947ed..203e5e9434 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json @@ -865,6 +865,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -971,6 +972,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -1823,6 +1828,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json index 532a712807..17eb143f6a 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json @@ -865,6 +865,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -971,6 +972,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -1823,6 +1828,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json index bc9cb524d6..af078af68e 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json @@ -63,7 +63,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json index 1a3b22f12c..6f9bf68112 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json @@ -42,7 +42,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], @@ -1059,6 +1058,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -1165,6 +1165,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -2017,6 +2021,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json index 9f394b31cf..fd58f93e87 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json @@ -865,6 +865,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -971,6 +972,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -1823,6 +1828,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadSettingsUpdatedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadSettingsUpdatedNotification.json index ca2b63634a..8d528246b5 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadSettingsUpdatedNotification.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadSettingsUpdatedNotification.json @@ -39,7 +39,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json index 9932456f1b..70a8772751 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json @@ -19,7 +19,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json index a754c6bc0f..530ea82217 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json @@ -42,7 +42,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], @@ -1059,6 +1058,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -1165,6 +1165,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -2017,6 +2021,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json index 22801809cd..b0bbf345d0 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json @@ -865,6 +865,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -971,6 +972,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -1823,6 +1828,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json index 3009e86e70..d311e39970 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json @@ -865,6 +865,7 @@ "description": "Optional Git metadata captured when the thread was created." }, "id": { + "description": "Identifier for this thread. Codex-generated thread IDs are UUIDv7.", "type": "string" }, "modelProvider": { @@ -971,6 +972,10 @@ ], "type": "string" }, + "ThreadExtra": { + "description": "Extra app-server data for a thread.", + "type": "object" + }, "ThreadId": { "type": "string" }, @@ -1823,6 +1828,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json index b9a940157c..fb703d511f 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json +++ b/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json @@ -1438,6 +1438,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json index bec8b7d89a..36b4d2a15d 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json @@ -41,7 +41,6 @@ { "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json index da10713dd1..a8a9d5a62b 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json @@ -1438,6 +1438,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json index 6b93498221..becf0d87cd 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json +++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json @@ -1438,6 +1438,7 @@ "description": "Only populated when the Turn's status is failed." }, "id": { + "description": "Identifier for this turn. Codex-generated turn IDs are UUIDv7.", "type": "string" }, "items": { diff --git a/codex-rs/app-server-protocol/schema/typescript/ThreadId.ts b/codex-rs/app-server-protocol/schema/typescript/ThreadId.ts index bfb3b4b4d7..801ffb35e4 100644 --- a/codex-rs/app-server-protocol/schema/typescript/ThreadId.ts +++ b/codex-rs/app-server-protocol/schema/typescript/ThreadId.ts @@ -2,4 +2,9 @@ // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. +/** + * Identifier for a Codex thread. + * + * Codex-generated thread IDs are UUIDv7, and some use cases rely on that. + */ export type ThreadId = string; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts index 8d41214e01..1d605501b2 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts @@ -2,4 +2,4 @@ // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. -export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "granular": { sandbox_approval: boolean, rules: boolean, skill_approval: boolean, request_permissions: boolean, mcp_elicitations: boolean, } } | "never"; +export type AskForApproval = "untrusted" | "on-request" | { "granular": { sandbox_approval: boolean, rules: boolean, skill_approval: boolean, request_permissions: boolean, mcp_elicitations: boolean, } } | "never"; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/Thread.ts b/codex-rs/app-server-protocol/schema/typescript/v2/Thread.ts index 1c288ccbd4..49e2411f42 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/Thread.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/Thread.ts @@ -8,87 +8,70 @@ import type { ThreadSource } from "./ThreadSource"; import type { ThreadStatus } from "./ThreadStatus"; import type { Turn } from "./Turn"; -export type Thread = { id: string, -/** +export type Thread = {/** + * Identifier for this thread. Codex-generated thread IDs are UUIDv7. + */ +id: string, /** * Session id shared by threads that belong to the same session tree. */ -sessionId: string, -/** +sessionId: string, /** * Source thread id when this thread was created by forking another thread. */ -forkedFromId: string | null, -/** +forkedFromId: string | null, /** * The ID of the parent thread. This will only be set if this thread is a subagent. */ -parentThreadId: string | null, -/** +parentThreadId: string | null, /** * Usually the first user message in the thread, if available. */ -preview: string, -/** +preview: string, /** * Whether the thread is ephemeral and should not be materialized on disk. */ -ephemeral: boolean, -/** +ephemeral: boolean, /** * Model provider used for this thread (for example, 'openai'). */ -modelProvider: string, -/** +modelProvider: string, /** * Unix timestamp (in seconds) when the thread was created. */ -createdAt: number, -/** +createdAt: number, /** * Unix timestamp (in seconds) when the thread was last updated. */ -updatedAt: number, -/** +updatedAt: number, /** * Unix timestamp (in seconds) used for thread recency ordering. */ -recencyAt: number | null, -/** +recencyAt: number | null, /** * Current runtime status for the thread. */ -status: ThreadStatus, -/** +status: ThreadStatus, /** * [UNSTABLE] Path to the thread on disk. */ -path: string | null, -/** +path: string | null, /** * Working directory captured for the thread. */ -cwd: AbsolutePathBuf, -/** +cwd: AbsolutePathBuf, /** * Version of the CLI that created the thread. */ -cliVersion: string, -/** +cliVersion: string, /** * Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.). */ -source: SessionSource, -/** +source: SessionSource, /** * Optional analytics source classification for this thread. */ -threadSource: ThreadSource | null, -/** +threadSource: ThreadSource | null, /** * Optional random unique nickname assigned to an AgentControl-spawned sub-agent. */ -agentNickname: string | null, -/** +agentNickname: string | null, /** * Optional role (agent_role) assigned to an AgentControl-spawned sub-agent. */ -agentRole: string | null, -/** +agentRole: string | null, /** * Optional Git metadata captured when the thread was created. */ -gitInfo: GitInfo | null, -/** +gitInfo: GitInfo | null, /** * Optional user-facing thread title. */ -name: string | null, -/** +name: string | null, /** * Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` * (when `includeTurns` is true) responses. * For all other responses and notifications returning a Thread, * the turns field will be an empty list. */ -turns: Array, }; +turns: Array}; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadExtra.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadExtra.ts new file mode 100644 index 0000000000..aa35e45f07 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadExtra.ts @@ -0,0 +1,8 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +/** + * Extra app-server data for a thread. + */ +export type ThreadExtra = Record; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/Turn.ts b/codex-rs/app-server-protocol/schema/typescript/v2/Turn.ts index 6505ec345f..b8680256d1 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/Turn.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/Turn.ts @@ -6,7 +6,11 @@ import type { TurnError } from "./TurnError"; import type { TurnItemsView } from "./TurnItemsView"; import type { TurnStatus } from "./TurnStatus"; -export type Turn = { id: string, +export type Turn = { +/** + * Identifier for this turn. Codex-generated turn IDs are UUIDv7. + */ +id: string, /** * Thread items currently included in this turn payload. */ diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts index 3e769d3fab..57c08391c7 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts @@ -395,6 +395,7 @@ export type { ThreadCompactStartResponse } from "./ThreadCompactStartResponse"; export type { ThreadDeleteParams } from "./ThreadDeleteParams"; export type { ThreadDeleteResponse } from "./ThreadDeleteResponse"; export type { ThreadDeletedNotification } from "./ThreadDeletedNotification"; +export type { ThreadExtra } from "./ThreadExtra"; export type { ThreadForkParams } from "./ThreadForkParams"; export type { ThreadForkResponse } from "./ThreadForkResponse"; export type { ThreadGoal } from "./ThreadGoal"; diff --git a/codex-rs/app-server-protocol/src/protocol/common.rs b/codex-rs/app-server-protocol/src/protocol/common.rs index ba63f59e9a..7fe20a84d5 100644 --- a/codex-rs/app-server-protocol/src/protocol/common.rs +++ b/codex-rs/app-server-protocol/src/protocol/common.rs @@ -2573,6 +2573,7 @@ mod tests { response: v2::ThreadStartResponse { thread: v2::Thread { id: "67e55044-10b1-426f-9247-bb680e5fe0c8".to_string(), + extra: None, session_id: "67e55044-10b1-426f-9247-bb680e5fe0c7".to_string(), forked_from_id: None, parent_thread_id: None, @@ -2604,7 +2605,7 @@ mod tests { "/tmp/AGENTS.md", )), ], - approval_policy: v2::AskForApproval::OnFailure, + approval_policy: v2::AskForApproval::OnRequest, approvals_reviewer: v2::ApprovalsReviewer::User, sandbox: v2::SandboxPolicy::DangerFullAccess, active_permission_profile: None, @@ -2622,6 +2623,7 @@ mod tests { "response": { "thread": { "id": "67e55044-10b1-426f-9247-bb680e5fe0c8", + "extra": null, "sessionId": "67e55044-10b1-426f-9247-bb680e5fe0c7", "forkedFromId": null, "parentThreadId": null, @@ -2651,7 +2653,7 @@ mod tests { "cwd": absolute_path_string("tmp"), "runtimeWorkspaceRoots": [], "instructionSources": [absolute_path_string("tmp/AGENTS.md")], - "approvalPolicy": "on-failure", + "approvalPolicy": "on-request", "approvalsReviewer": "user", "sandbox": { "type": "dangerFullAccess" diff --git a/codex-rs/app-server-protocol/src/protocol/v2/shared.rs b/codex-rs/app-server-protocol/src/protocol/v2/shared.rs index cb881d6267..94e650d923 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2/shared.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2/shared.rs @@ -163,7 +163,6 @@ pub enum AskForApproval { #[serde(rename = "untrusted")] #[ts(rename = "untrusted")] UnlessTrusted, - OnFailure, OnRequest, #[experimental("askForApproval.granular")] Granular { @@ -182,7 +181,6 @@ impl AskForApproval { pub fn to_core(self) -> CoreAskForApproval { match self { AskForApproval::UnlessTrusted => CoreAskForApproval::UnlessTrusted, - AskForApproval::OnFailure => CoreAskForApproval::OnFailure, AskForApproval::OnRequest => CoreAskForApproval::OnRequest, AskForApproval::Granular { sandbox_approval, @@ -206,7 +204,6 @@ impl From for AskForApproval { fn from(value: CoreAskForApproval) -> Self { match value { CoreAskForApproval::UnlessTrusted => AskForApproval::UnlessTrusted, - CoreAskForApproval::OnFailure => AskForApproval::OnFailure, CoreAskForApproval::OnRequest => AskForApproval::OnRequest, CoreAskForApproval::Granular(granular_config) => AskForApproval::Granular { sandbox_approval: granular_config.sandbox_approval, diff --git a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs index ba69b6d6e2..96ba995770 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs @@ -168,6 +168,7 @@ fn thread_resume_response_round_trips_initial_turns_page() { let response = ThreadResumeResponse { thread: Thread { id: "thr_123".to_string(), + extra: None, session_id: "thr_123".to_string(), forked_from_id: None, parent_thread_id: None, @@ -195,7 +196,7 @@ fn thread_resume_response_round_trips_initial_turns_page() { cwd: absolute_path("tmp"), runtime_workspace_roots: Vec::new(), instruction_sources: Vec::new(), - approval_policy: AskForApproval::OnFailure, + approval_policy: AskForApproval::OnRequest, approvals_reviewer: ApprovalsReviewer::User, sandbox: SandboxPolicy::DangerFullAccess, active_permission_profile: None, @@ -3689,7 +3690,7 @@ fn thread_lifecycle_responses_default_missing_optional_fields() { "modelProvider": "openai", "serviceTier": null, "cwd": absolute_path_string("tmp"), - "approvalPolicy": "on-failure", + "approvalPolicy": "on-request", "approvalsReviewer": "user", "sandbox": { "type": "dangerFullAccess" }, "reasoningEffort": null diff --git a/codex-rs/app-server-protocol/src/protocol/v2/thread_data.rs b/codex-rs/app-server-protocol/src/protocol/v2/thread_data.rs index 52a8d7017a..3338513df7 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2/thread_data.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2/thread_data.rs @@ -2,6 +2,7 @@ use super::CodexErrorInfo; use super::ThreadItem; use super::ThreadStatus; use super::TurnStatus; +use codex_experimental_api_macros::ExperimentalApi; use codex_protocol::protocol::SessionSource as CoreSessionSource; use codex_protocol::protocol::SubAgentSource as CoreSubAgentSource; use codex_protocol::protocol::ThreadSource as CoreThreadSource; @@ -120,6 +121,12 @@ impl From for CoreThreadSource { } } +/// Extra app-server data for a thread. +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] +#[serde(rename_all = "camelCase")] +#[ts(rename_all = "camelCase", export_to = "v2/")] +pub struct ThreadExtra {} + #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] @@ -129,11 +136,15 @@ pub struct GitInfo { pub origin_url: Option, } -#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)] +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS, ExperimentalApi)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] pub struct Thread { + /// Identifier for this thread. Codex-generated thread IDs are UUIDv7. pub id: String, + /// Optional implementation-specific thread data. + #[experimental("thread.extra")] + pub extra: Option, /// Session id shared by threads that belong to the same session tree. pub session_id: String, /// Source thread id when this thread was created by forking another thread. @@ -186,6 +197,7 @@ pub struct Thread { #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] pub struct Turn { + /// Identifier for this turn. Codex-generated turn IDs are UUIDv7. pub id: String, /// Thread items currently included in this turn payload. pub items: Vec, diff --git a/codex-rs/app-server-test-client/README.md b/codex-rs/app-server-test-client/README.md index 44687672a0..b1afc77872 100644 --- a/codex-rs/app-server-test-client/README.md +++ b/codex-rs/app-server-test-client/README.md @@ -46,12 +46,13 @@ cargo run -p codex-app-server-test-client -- \ Use `--capture-file /tmp/plugin-analytics.jsonl` to select the output path. The command validates one `codex_plugin_disabled`, `codex_plugin_enabled`, and -`codex_plugin_used` event with the expected local plugin identity and capability -metadata. The enabled and disabled events come from successful writes to the -temporary config; the command does not mutate the remote enabled state. It -prints the events and leaves the JSONL file in place for inspection. It does not -install or uninstall plugins and does not modify the profile's persistent -config. +`codex_plugin_used` event with the expected local and remote plugin identities +and capability metadata. Each event includes the local ID in `plugin_id` and the +backend ID in `remote_plugin_id`. The enabled and disabled events come from +successful writes to the temporary config; the command does not mutate the +remote enabled state. It prints the events and leaves the JSONL file in place +for inspection. It does not install or uninstall plugins and does not modify +the profile's persistent config. ### Testing remote install and uninstall analytics @@ -63,9 +64,11 @@ or CI. Choose a remote plugin that is available to the active account and is not currently installed. The command refuses to run when the plugin is already installed, installs it, validates `codex_plugin_installed`, uninstalls it, and -verifies that the original uninstalled state was restored. The current install -event uses the backend ID as `plugin_id`. Uninstall is part of cleanup but is -not yet an analytics assertion. +validates `codex_plugin_uninstalled`, and verifies that the original +uninstalled state was restored. + +The mutation events include the local Codex ID in `plugin_id` and the backend ID +in `remote_plugin_id`. `--remote-plugin-id` takes the backend ID, such as `plugins~Plugin_...`, not the local `@` ID. @@ -83,7 +86,7 @@ Analytics use the normal queue, reduction, batching, and serialization path, but the debug capture destination suppresses analytics network delivery. The command prints one of these final states: -- `PASS`: the install event validated and the plugin is uninstalled. +- `PASS`: the install and uninstall events validated and the plugin is uninstalled. - `FAIL-CLEAN`: validation failed, but the original uninstalled state was restored. - `FAIL-LOCAL-CACHE`: the backend is uninstalled, but local cleanup reported diff --git a/codex-rs/app-server-test-client/src/plugin_analytics_capture.rs b/codex-rs/app-server-test-client/src/plugin_analytics_capture.rs index 4ffd3fd23d..8a68a5746f 100644 --- a/codex-rs/app-server-test-client/src/plugin_analytics_capture.rs +++ b/codex-rs/app-server-test-client/src/plugin_analytics_capture.rs @@ -35,7 +35,7 @@ pub(super) fn read_events_for_remote_plugin( matching.extend( events .iter() - .filter(|event| event["event_params"]["plugin_id"] == remote_plugin_id) + .filter(|event| event["event_params"]["remote_plugin_id"] == remote_plugin_id) .cloned(), ); } @@ -44,6 +44,7 @@ pub(super) fn read_events_for_remote_plugin( pub(super) struct PluginEventIdentity<'a> { pub(super) plugin_id: &'a str, + pub(super) remote_plugin_id: &'a str, pub(super) plugin_name: &'a str, pub(super) marketplace_name: &'a str, } @@ -52,25 +53,29 @@ pub(super) fn validate_mutation_events( events: Vec, expected: PluginEventIdentity<'_>, ) -> Result> { - let event_type = "codex_plugin_installed"; - let matching = events - .iter() - .filter(|event| event["event_type"] == event_type) - .collect::>(); - let [event] = matching.as_slice() else { - bail!( - "expected exactly one `{event_type}` event for `{}`, found {}", - expected.plugin_id, - matching.len() - ); - }; - validate_event(event, &expected)?; - Ok(vec![(*event).clone()]) + let mut validated = Vec::new(); + for event_type in ["codex_plugin_installed", "codex_plugin_uninstalled"] { + let matching = events + .iter() + .filter(|event| event["event_type"] == event_type) + .collect::>(); + let [event] = matching.as_slice() else { + bail!( + "expected exactly one `{event_type}` event for `{}`, found {}", + expected.remote_plugin_id, + matching.len() + ); + }; + validate_event(event, &expected)?; + validated.push((*event).clone()); + } + Ok(validated) } fn validate_event(event: &Value, expected: &PluginEventIdentity<'_>) -> Result<()> { let params = &event["event_params"]; require_string(params, "plugin_id", expected.plugin_id)?; + require_string(params, "remote_plugin_id", expected.remote_plugin_id)?; require_string(params, "plugin_name", expected.plugin_name)?; require_string(params, "marketplace_name", expected.marketplace_name)?; for field in [ diff --git a/codex-rs/app-server-test-client/src/plugin_analytics_capture_tests.rs b/codex-rs/app-server-test-client/src/plugin_analytics_capture_tests.rs index 45a9c865b8..b85bd48b84 100644 --- a/codex-rs/app-server-test-client/src/plugin_analytics_capture_tests.rs +++ b/codex-rs/app-server-test-client/src/plugin_analytics_capture_tests.rs @@ -14,15 +14,17 @@ const REMOTE_PLUGIN_ID: &str = "plugins~Plugin_test"; fn reads_and_validates_remote_plugin_mutation_events() { let path = unique_capture_path("valid"); let installed = mutation_event("codex_plugin_installed"); + let uninstalled = mutation_event("codex_plugin_uninstalled"); let unrelated = json!({ "event_type": "codex_plugin_installed", "event_params": { - "plugin_id": "plugins~Plugin_other" + "plugin_id": "other@openai-curated-remote", + "remote_plugin_id": "plugins~Plugin_other" } }); let contents = [ json!({"events": [unrelated]}), - json!({"events": [installed]}), + json!({"events": [installed, uninstalled]}), ] .into_iter() .map(|payload| serde_json::to_string(&payload).expect("serialize capture payload")) @@ -35,7 +37,7 @@ fn reads_and_validates_remote_plugin_mutation_events() { let validated = validate_mutation_events(events, expected_identity()).expect("validate mutation events"); - assert_eq!(validated, vec![installed]); + assert_eq!(validated, vec![installed, uninstalled]); fs::remove_file(path).expect("remove capture file"); } @@ -62,7 +64,8 @@ fn mutation_event(event_type: &str) -> Value { json!({ "event_type": event_type, "event_params": { - "plugin_id": REMOTE_PLUGIN_ID, + "plugin_id": "sample@openai-curated-remote", + "remote_plugin_id": REMOTE_PLUGIN_ID, "plugin_name": "sample", "marketplace_name": "openai-curated-remote", "has_skills": true, @@ -75,7 +78,8 @@ fn mutation_event(event_type: &str) -> Value { fn expected_identity() -> PluginEventIdentity<'static> { PluginEventIdentity { - plugin_id: REMOTE_PLUGIN_ID, + plugin_id: "sample@openai-curated-remote", + remote_plugin_id: REMOTE_PLUGIN_ID, plugin_name: "sample", marketplace_name: "openai-curated-remote", } diff --git a/codex-rs/app-server-test-client/src/plugin_analytics_mutation_smoke.rs b/codex-rs/app-server-test-client/src/plugin_analytics_mutation_smoke.rs index 2c6d505412..70aa13ab9c 100644 --- a/codex-rs/app-server-test-client/src/plugin_analytics_mutation_smoke.rs +++ b/codex-rs/app-server-test-client/src/plugin_analytics_mutation_smoke.rs @@ -312,13 +312,19 @@ fn run_mutation_sequence( state_err } })?; + wait_for_remote_plugin_event( + capture_path, + &expected.remote_plugin_id, + "codex_plugin_uninstalled", + )?; let captured_events = read_events_for_remote_plugin(capture_path, &expected.remote_plugin_id)?; let events = validate_mutation_events( captured_events, PluginEventIdentity { - plugin_id: &expected.remote_plugin_id, + plugin_id: &expected.plugin_id, + remote_plugin_id: &expected.remote_plugin_id, plugin_name: &expected.plugin_name, marketplace_name: &expected.marketplace_name, }, diff --git a/codex-rs/app-server-test-client/src/plugin_analytics_smoke.rs b/codex-rs/app-server-test-client/src/plugin_analytics_smoke.rs index 701f6361a7..65704eeb65 100644 --- a/codex-rs/app-server-test-client/src/plugin_analytics_smoke.rs +++ b/codex-rs/app-server-test-client/src/plugin_analytics_smoke.rs @@ -159,6 +159,7 @@ fn wait_for_plugin_usage( #[derive(Debug)] struct ExpectedPlugin { plugin_id: String, + remote_plugin_id: String, plugin_name: String, marketplace_name: String, } @@ -208,13 +209,15 @@ fn expected_plugin(response: &PluginInstalledResponse, plugin_id: &str) -> Resul plugin.availability ); } - plugin + let remote_plugin_id = plugin .remote_plugin_id .as_ref() - .with_context(|| format!("plugin `{plugin_id}` does not have a remote plugin id"))?; + .with_context(|| format!("plugin `{plugin_id}` does not have a remote plugin id"))? + .clone(); Ok(ExpectedPlugin { plugin_id: plugin.id.clone(), + remote_plugin_id, plugin_name: plugin.name.clone(), marketplace_name: marketplace.name.clone(), }) @@ -444,6 +447,7 @@ fn event_count(events: &[Value], event_type: &str) -> usize { fn validate_identity(event: &Value, expected: &ExpectedPlugin) -> Result<()> { let params = &event["event_params"]; require_string(params, "plugin_id", &expected.plugin_id)?; + require_string(params, "remote_plugin_id", &expected.remote_plugin_id)?; require_string(params, "plugin_name", &expected.plugin_name)?; require_string(params, "marketplace_name", &expected.marketplace_name) } diff --git a/codex-rs/app-server/src/request_processors/plugins.rs b/codex-rs/app-server/src/request_processors/plugins.rs index 76123b6aa2..eb68feb544 100644 --- a/codex-rs/app-server/src/request_processors/plugins.rs +++ b/codex-rs/app-server/src/request_processors/plugins.rs @@ -23,6 +23,7 @@ use codex_mcp::McpOAuthLoginSupport; use codex_mcp::oauth_login_support; use codex_mcp::should_retry_without_scopes; use codex_plugin::PluginId; +use codex_plugin::PluginTelemetryMetadata; use codex_rmcp_client::perform_oauth_login_silent; #[derive(Clone)] @@ -1528,6 +1529,7 @@ impl PluginRequestProcessor { self.track_plugin_install_failed_for_remote_plugin( &remote_plugin_id, &remote_marketplace_name, + /*plugin_id*/ None, error_type, err.to_string(), ); @@ -1538,6 +1540,12 @@ impl PluginRequestProcessor { })?; let actual_remote_marketplace_name = remote_detail.marketplace_name.clone(); let remote_plugin_name = remote_detail.summary.name.clone(); + let resolved_plugin_id = PluginId::parse(&remote_detail.summary.id).map_err(|err| { + internal_error(format!( + "invalid resolved plugin id `{}`: {err}", + remote_detail.summary.id + )) + })?; if remote_detail.summary.availability == PluginAvailability::DisabledByAdmin { return Err(invalid_request(format!( "remote plugin {remote_plugin_id} is disabled by admin" @@ -1569,6 +1577,7 @@ impl PluginRequestProcessor { self.track_plugin_install_failed_for_remote_plugin( &remote_plugin_id, &actual_remote_marketplace_name, + Some(&resolved_plugin_id), error_type, err.to_string(), ); @@ -1585,6 +1594,7 @@ impl PluginRequestProcessor { self.track_plugin_install_failed_for_remote_plugin( &remote_plugin_id, &actual_remote_marketplace_name, + Some(&resolved_plugin_id), error_type, err.to_string(), ); @@ -1606,6 +1616,7 @@ impl PluginRequestProcessor { self.track_plugin_install_failed_for_remote_plugin( &remote_plugin_id, &actual_remote_marketplace_name, + Some(&result.plugin_id), error_type, err.to_string(), ); @@ -1702,6 +1713,7 @@ impl PluginRequestProcessor { &self, remote_plugin_id: &str, marketplace_name: &str, + plugin_id: Option<&PluginId>, error_type: &'static str, error_message: String, ) { @@ -1712,16 +1724,17 @@ impl PluginRequestProcessor { error = %error_message, "remote plugin install failed" ); - // The remote id is reported separately; this local name only satisfies - // PluginId validation before remote details are available. - let Ok(plugin_id) = PluginId::new("unknown".to_string(), marketplace_name.to_string()) - else { - return; + let plugin = if let Some(plugin_id) = plugin_id { + self.thread_manager + .plugins_manager() + .telemetry_metadata_for_plugin_id_with_remote_id(plugin_id, remote_plugin_id) + } else { + PluginTelemetryMetadata { + plugin_id: None, + remote_plugin_id: Some(remote_plugin_id.to_string()), + capability_summary: None, + } }; - let plugin = self - .thread_manager - .plugins_manager() - .telemetry_metadata_for_plugin_id_with_remote_id(&plugin_id, remote_plugin_id); self.analytics_events_client .track_plugin_install_failed(plugin, error_type.to_string()); } @@ -1980,11 +1993,31 @@ impl PluginRequestProcessor { let remote_plugin_service_config = RemotePluginServiceConfig { chatgpt_base_url: config.chatgpt_base_url.clone(), }; + let uninstall_target = codex_core_plugins::remote::resolve_remote_plugin_uninstall_target( + &remote_plugin_service_config, + auth.as_ref(), + &plugin_id, + ) + .await + .map_err(|err| { + remote_plugin_catalog_error_to_jsonrpc(err, "resolve remote plugin before uninstall") + })?; + let plugins_manager = self.thread_manager.plugins_manager(); + let mut plugin_telemetry = plugins_manager + .telemetry_metadata_for_installed_plugin_with_remote_id( + &uninstall_target.plugin_id, + &uninstall_target.remote_plugin_id, + ) + .await; + if plugin_telemetry.capability_summary.is_none() { + plugin_telemetry.capability_summary = + Some(uninstall_target.fallback_capability_summary.clone()); + } let uninstall_result = codex_core_plugins::remote::uninstall_remote_plugin( &remote_plugin_service_config, auth.as_ref(), config.codex_home.to_path_buf(), - &plugin_id, + uninstall_target, ) .await; @@ -1992,7 +2025,8 @@ impl PluginRequestProcessor { &uninstall_result, Ok(()) | Err(RemotePluginCatalogError::CacheRemove(_)) ) { - let plugins_manager = self.thread_manager.plugins_manager(); + self.analytics_events_client + .track_plugin_uninstalled(plugin_telemetry); if plugins_manager.clear_remote_installed_plugins_cache() { self.on_effective_plugins_changed(); } diff --git a/codex-rs/app-server/src/request_processors/thread_processor.rs b/codex-rs/app-server/src/request_processors/thread_processor.rs index a3e4b49ce8..89ef93f63d 100644 --- a/codex-rs/app-server/src/request_processors/thread_processor.rs +++ b/codex-rs/app-server/src/request_processors/thread_processor.rs @@ -2604,8 +2604,8 @@ impl ThreadRequestProcessor { self.resume_thread_from_history(history.as_slice()) .await .map(|thread_history| (thread_history, None)) - } else if let Some(stored_thread) = stored_thread_from_running_probe { - self.stored_thread_to_initial_history(&stored_thread) + } else if let Some(mut stored_thread) = stored_thread_from_running_probe { + self.stored_thread_to_initial_history(&mut stored_thread) .await .map(|thread_history| (thread_history, Some(*stored_thread))) } else { @@ -2758,7 +2758,7 @@ impl ThreadRequestProcessor { let token_usage_thread = include_turns.then(|| thread.clone()); let mut initial_turns_page = if let Some(params) = initial_turns_page.as_ref() { match build_thread_resume_initial_turns_page( - &response_history.get_rollout_items(), + response_history.get_rollout_items(), thread.status.clone(), /*has_live_running_thread*/ false, /*active_turn*/ None, @@ -2803,7 +2803,7 @@ impl ThreadRequestProcessor { // rebuilding history only to attribute a replayed usage update. if let Some(token_usage_thread) = token_usage_thread { let token_usage_turn_id = latest_token_usage_turn_id_from_rollout_items( - &response_history.get_rollout_items(), + response_history.get_rollout_items(), token_usage_thread.turns.as_slice(), ); // The client needs restored usage before it starts another turn. @@ -2901,7 +2901,7 @@ impl ThreadRequestProcessor { } }; - if let Some((existing_thread_id, existing_thread, source_thread)) = running_thread { + if let Some((existing_thread_id, existing_thread, mut source_thread)) = running_thread { let existing_thread_rollout_path = existing_thread.rollout_path(); let active_path = existing_thread_rollout_path .as_ref() @@ -2963,8 +2963,8 @@ impl ThreadRequestProcessor { should_redact_thread_resume_payloads(app_server_client_name.as_deref()); let history_items = source_thread .history - .as_ref() - .map(|history| history.items.clone()) + .take() + .map(|history| history.items) .ok_or_else(|| { internal_error(format!( "thread {existing_thread_id} did not include persisted history" @@ -2988,10 +2988,8 @@ impl ThreadRequestProcessor { ) .await?; - let mut summary_source_thread = source_thread; - summary_source_thread.history = None; let mut thread_summary = self.stored_thread_to_api_thread( - summary_source_thread, + source_thread, config_snapshot.model_provider_id.as_str(), /*include_turns*/ false, ); @@ -3060,11 +3058,11 @@ impl ThreadRequestProcessor { thread_id: &str, path: Option<&PathBuf>, ) -> Result<(InitialHistory, StoredThread), JSONRPCErrorError> { - let stored_thread = self + let mut stored_thread = self .read_stored_thread_for_resume(thread_id, path, /*include_history*/ true) .await?; let history = self - .stored_thread_to_initial_history(&stored_thread) + .stored_thread_to_initial_history(&mut stored_thread) .await?; Ok((history, stored_thread)) } @@ -3112,13 +3110,13 @@ impl ThreadRequestProcessor { #[tracing::instrument(level = "trace", skip_all)] async fn stored_thread_to_initial_history( &self, - stored_thread: &StoredThread, + stored_thread: &mut StoredThread, ) -> Result { let thread_id = stored_thread.thread_id; let history = stored_thread .history - .as_ref() - .map(|history| history.items.clone()) + .take() + .map(|history| history.items) .ok_or_else(|| { internal_error(format!( "thread {thread_id} did not include persisted history" @@ -3126,7 +3124,7 @@ impl ThreadRequestProcessor { })?; Ok(InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history, + history: Arc::new(history), rollout_path: stored_thread.rollout_path.clone(), })) } @@ -3255,7 +3253,7 @@ impl ThreadRequestProcessor { let history_items = thread_history.get_rollout_items(); populate_thread_turns_from_history( &mut thread, - &history_items, + history_items, /*active_turn*/ None, ); } @@ -3313,7 +3311,7 @@ impl ThreadRequestProcessor { "`permissions` cannot be combined with `sandbox`", )); } - let source_thread = self + let mut source_thread = self .read_stored_thread_for_resume(&thread_id, path.as_ref(), /*include_history*/ true) .await?; let source_thread_id = source_thread.thread_id; @@ -3323,8 +3321,8 @@ impl ThreadRequestProcessor { .and_then(codex_core::util::normalize_thread_name); let history_items = source_thread .history - .as_ref() - .map(|history| history.items.clone()) + .take() + .map(|history| Arc::new(history.items)) .ok_or_else(|| { internal_error(format!( "thread {source_thread_id} did not include persisted history" @@ -3391,7 +3389,7 @@ impl ThreadRequestProcessor { config, InitialHistory::Resumed(ResumedHistory { conversation_id: source_thread_id, - history: history_items.clone(), + history: Arc::clone(&history_items), rollout_path: source_thread.rollout_path.clone(), }), thread_source.map(Into::into), @@ -4158,6 +4156,7 @@ pub(crate) fn thread_from_stored_thread( let thread_id = thread.thread_id.to_string(); let thread = Thread { id: thread_id.clone(), + extra: None, session_id: thread_id, forked_from_id: thread.forked_from_id.map(|id| id.to_string()), parent_thread_id: thread.parent_thread_id.map(|id| id.to_string()), @@ -4368,6 +4367,7 @@ fn build_thread_from_snapshot( let now = time::OffsetDateTime::now_utc().unix_timestamp(); Thread { id: thread_id.to_string(), + extra: None, session_id, forked_from_id: None, parent_thread_id: config_snapshot.parent_thread_id.map(|id| id.to_string()), diff --git a/codex-rs/app-server/src/request_processors/thread_resume_redaction.rs b/codex-rs/app-server/src/request_processors/thread_resume_redaction.rs index b7d8640695..586828e8dd 100644 --- a/codex-rs/app-server/src/request_processors/thread_resume_redaction.rs +++ b/codex-rs/app-server/src/request_processors/thread_resume_redaction.rs @@ -183,6 +183,7 @@ mod tests { fn test_thread(items: Vec) -> Thread { Thread { id: "thread-1".to_string(), + extra: None, session_id: "session-1".to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/app-server/src/request_processors/thread_summary.rs b/codex-rs/app-server/src/request_processors/thread_summary.rs index bb2c6708cd..3b668e0a1e 100644 --- a/codex-rs/app-server/src/request_processors/thread_summary.rs +++ b/codex-rs/app-server/src/request_processors/thread_summary.rs @@ -314,6 +314,7 @@ pub(crate) fn summary_to_thread( let thread_id = conversation_id.to_string(); Thread { id: thread_id.clone(), + extra: None, session_id: thread_id, forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/app-server/src/request_processors/turn_processor.rs b/codex-rs/app-server/src/request_processors/turn_processor.rs index f7b4f7c14e..e0d79a0c3b 100644 --- a/codex-rs/app-server/src/request_processors/turn_processor.rs +++ b/codex-rs/app-server/src/request_processors/turn_processor.rs @@ -58,6 +58,7 @@ fn validate_response_item_image_urls(items: &[ResponseItem]) -> Result<(), JSONR | ResponseItem::Compaction { .. } | ResponseItem::CompactionTrigger { .. } | ResponseItem::ContextCompaction { .. } + | ResponseItem::AdditionalTools { .. } | ResponseItem::Other => false, }) { return Err(invalid_request(REMOTE_IMAGE_URL_ERROR)); @@ -1236,7 +1237,7 @@ impl TurnRequestProcessor { config.clone(), InitialHistory::Resumed(ResumedHistory { conversation_id: parent_thread_id, - history: parent_history.items, + history: Arc::new(parent_history.items), rollout_path: parent_thread.rollout_path(), }), /*thread_source*/ None, diff --git a/codex-rs/app-server/src/thread_status.rs b/codex-rs/app-server/src/thread_status.rs index a5997a58f5..32b79e1f69 100644 --- a/codex-rs/app-server/src/thread_status.rs +++ b/codex-rs/app-server/src/thread_status.rs @@ -889,6 +889,7 @@ mod tests { fn test_thread(thread_id: &str, source: codex_app_server_protocol::SessionSource) -> Thread { Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/app-server/tests/suite/v2/current_time.rs b/codex-rs/app-server/tests/suite/v2/current_time.rs index 74e734ae39..2179a86cb8 100644 --- a/codex-rs/app-server/tests/suite/v2/current_time.rs +++ b/codex-rs/app-server/tests/suite/v2/current_time.rs @@ -115,7 +115,7 @@ model_provider = "mock_provider" [features.current_time_reminder] enabled = true -reminder_interval_model_requests = 1 +reminder_interval_seconds = 1 clock_source = "external" [model_providers.mock_provider] diff --git a/codex-rs/app-server/tests/suite/v2/plugin_install.rs b/codex-rs/app-server/tests/suite/v2/plugin_install.rs index aebc30dfea..cc76ef1eb0 100644 --- a/codex-rs/app-server/tests/suite/v2/plugin_install.rs +++ b/codex-rs/app-server/tests/suite/v2/plugin_install.rs @@ -538,12 +538,10 @@ async fn plugin_install_tracks_analytics_when_remote_detail_fetch_fails() -> Res payload["events"][0]["event_type"], "codex_plugin_install_failed" ); - assert_eq!(event_params["plugin_id"], REMOTE_PLUGIN_ID); - assert_eq!(event_params["plugin_name"], "unknown"); - assert_eq!( - event_params["marketplace_name"], - "caller-marketplace-is-ignored" - ); + assert_eq!(event_params["plugin_id"], json!(null)); + assert_eq!(event_params["remote_plugin_id"], REMOTE_PLUGIN_ID); + assert_eq!(event_params["plugin_name"], json!(null)); + assert_eq!(event_params["marketplace_name"], json!(null)); assert_eq!( event_params["error_type"], "remote_catalog_unexpected_status" @@ -883,6 +881,7 @@ async fn plugin_install_tracks_analytics_event() -> Result<()> { "event_type": "codex_plugin_installed", "event_params": { "plugin_id": "sample-plugin@debug", + "remote_plugin_id": null, "plugin_name": "sample-plugin", "marketplace_name": "debug", "has_skills": false, @@ -946,6 +945,7 @@ async fn plugin_install_failure_tracks_analytics_event() -> Result<()> { "codex_plugin_install_failed" ); assert_eq!(event_params["plugin_id"], "sample-plugin@debug"); + assert_eq!(event_params["remote_plugin_id"], json!(null)); assert_eq!(event_params["plugin_name"], "sample-plugin"); assert_eq!(event_params["marketplace_name"], "debug"); assert_eq!(event_params["has_skills"], json!(null)); @@ -995,7 +995,8 @@ async fn plugin_install_tracks_remote_plugin_analytics_event() -> Result<()> { "events": [{ "event_type": "codex_plugin_installed", "event_params": { - "plugin_id": REMOTE_PLUGIN_ID, + "plugin_id": "linear@openai-curated-remote", + "remote_plugin_id": REMOTE_PLUGIN_ID, "plugin_name": "linear", "marketplace_name": "openai-curated-remote", "has_skills": true, @@ -1072,7 +1073,8 @@ async fn plugin_install_preserves_status_when_remote_bundle_error_body_is_too_la payload["events"][0]["event_type"], "codex_plugin_install_failed" ); - assert_eq!(event_params["plugin_id"], REMOTE_PLUGIN_ID); + assert_eq!(event_params["plugin_id"], "linear@openai-curated-remote"); + assert_eq!(event_params["remote_plugin_id"], REMOTE_PLUGIN_ID); assert_eq!(event_params["marketplace_name"], "openai-curated-remote"); assert_eq!(event_params["error_type"], "remote_bundle_download_status"); assert!( diff --git a/codex-rs/app-server/tests/suite/v2/plugin_uninstall.rs b/codex-rs/app-server/tests/suite/v2/plugin_uninstall.rs index 5d31d8390f..6f9041a74e 100644 --- a/codex-rs/app-server/tests/suite/v2/plugin_uninstall.rs +++ b/codex-rs/app-server/tests/suite/v2/plugin_uninstall.rs @@ -139,6 +139,7 @@ async fn plugin_uninstall_tracks_analytics_event() -> Result<()> { "event_type": "codex_plugin_uninstalled", "event_params": { "plugin_id": "sample-plugin@debug", + "remote_plugin_id": null, "plugin_name": "sample-plugin", "marketplace_name": "debug", "has_skills": false, @@ -216,6 +217,11 @@ async fn plugin_uninstall_writes_remote_plugin_to_cloud_when_remote_plugin_enabl ) .mount(&server) .await; + Mock::given(method("POST")) + .and(path("/backend-api/codex/analytics-events/events")) + .respond_with(ResponseTemplate::new(200).set_body_string(r#"{"status":"ok"}"#)) + .mount(&server) + .await; let remote_plugin_cache_root = codex_home .path() @@ -225,6 +231,11 @@ async fn plugin_uninstall_writes_remote_plugin_to_cloud_when_remote_plugin_enabl remote_plugin_cache_root.join("1.0.0/.codex-plugin/plugin.json"), r#"{"name":"linear","version":"1.0.0"}"#, )?; + std::fs::create_dir_all(remote_plugin_cache_root.join("1.0.0/skills/plan-work"))?; + std::fs::write( + remote_plugin_cache_root.join("1.0.0/skills/plan-work/SKILL.md"), + "---\nname: plan-work\ndescription: Plan work\n---\n", + )?; let legacy_remote_plugin_cache_root = codex_home.path().join(format!( "plugins/cache/openai-curated-remote/{REMOTE_PLUGIN_ID}" )); @@ -233,6 +244,10 @@ async fn plugin_uninstall_writes_remote_plugin_to_cloud_when_remote_plugin_enabl let mut mcp = TestAppServer::new(codex_home.path()).await?; timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??; + // Simulate a background remote-cache refresh removing the local bundle + // before the uninstall request captures its telemetry metadata. + std::fs::remove_dir_all(remote_plugin_cache_root.join("1.0.0"))?; + let request_id = mcp .send_plugin_uninstall_request(PluginUninstallParams { plugin_id: REMOTE_PLUGIN_ID.to_string(), @@ -255,6 +270,25 @@ async fn plugin_uninstall_writes_remote_plugin_to_cloud_when_remote_plugin_enabl .await?; assert!(!remote_plugin_cache_root.exists()); assert!(!legacy_remote_plugin_cache_root.exists()); + let payload = wait_for_plugin_analytics_payload(&server).await?; + assert_eq!( + payload, + json!({ + "events": [{ + "event_type": "codex_plugin_uninstalled", + "event_params": { + "plugin_id": "linear@openai-curated-remote", + "remote_plugin_id": REMOTE_PLUGIN_ID, + "plugin_name": "linear", + "marketplace_name": "openai-curated-remote", + "has_skills": true, + "mcp_server_count": 0, + "connector_ids": [], + "product_client_id": DEFAULT_CLIENT_NAME, + } + }] + }) + ); Ok(()) } @@ -638,7 +672,11 @@ async fn mount_remote_plugin_detail_with_name( "interface": {{ "short_description": "Plan and track work" }}, - "skills": [] + "skills": [{{ + "name": "plan-work", + "description": "Plan work", + "interface": null + }}] }} }}"# ); @@ -652,6 +690,29 @@ async fn mount_remote_plugin_detail_with_name( .await; } +async fn wait_for_plugin_analytics_payload(server: &MockServer) -> Result { + timeout(DEFAULT_TIMEOUT, async { + loop { + let Some(requests) = server.received_requests().await else { + tokio::time::sleep(Duration::from_millis(25)).await; + continue; + }; + if let Some(request) = requests.iter().find(|request| { + request.method == "POST" + && request + .url + .path() + .ends_with("/codex/analytics-events/events") + }) { + return serde_json::from_slice(&request.body) + .map_err(|err| anyhow::anyhow!("invalid analytics payload: {err}")); + } + tokio::time::sleep(Duration::from_millis(25)).await; + } + }) + .await? +} + async fn wait_for_remote_plugin_request_count( server: &MockServer, method_name: &str, diff --git a/codex-rs/app-server/tests/suite/v2/turn_start.rs b/codex-rs/app-server/tests/suite/v2/turn_start.rs index dd211a5d89..622e4284ef 100644 --- a/codex-rs/app-server/tests/suite/v2/turn_start.rs +++ b/codex-rs/app-server/tests/suite/v2/turn_start.rs @@ -100,6 +100,7 @@ const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10); const TEST_ORIGINATOR: &str = "codex_vscode"; const LOCAL_PRAGMATIC_TEMPLATE: &str = "You are a deeply pragmatic, effective software engineer."; +const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; const INVALID_REQUEST_ERROR_CODE: i64 = -32600; const TINY_PNG_BYTES: &[u8] = &[ 137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1, 8, 6, 0, @@ -3650,7 +3651,12 @@ async fn direct_input_to_multi_agent_v2_subagent_is_rejected() -> Result<()> { |req: &wiremock::Request| body_contains(req, PARENT_PROMPT), responses::sse(vec![ responses::ev_response_created("resp-parent-1"), - responses::ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args), + responses::ev_function_call_with_namespace( + SPAWN_CALL_ID, + MULTI_AGENT_V2_NAMESPACE, + "spawn_agent", + &spawn_args, + ), responses::ev_completed("resp-parent-1"), ]), ) diff --git a/codex-rs/cli/src/debug_sandbox.rs b/codex-rs/cli/src/debug_sandbox.rs index 5e5bcb6c4e..4f77a4b822 100644 --- a/codex-rs/cli/src/debug_sandbox.rs +++ b/codex-rs/cli/src/debug_sandbox.rs @@ -6,6 +6,7 @@ mod seatbelt; use std::path::PathBuf; use std::process::Stdio; +use anyhow::Context as _; use codex_config::LoaderOverrides; use codex_core::config::Config; use codex_core::config::ConfigBuilder; @@ -16,6 +17,8 @@ use codex_core::exec_env::create_env; use codex_core::spawn::CODEX_SANDBOX_ENV_VAR; use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR; use codex_protocol::config_types::SandboxMode; +use codex_protocol::models::PermissionProfile; +use codex_protocol::models::SandboxEnforcement; use codex_protocol::permissions::NetworkSandboxPolicy; use codex_sandboxing::landlock::allow_network_for_proxy; use codex_sandboxing::landlock::create_linux_sandbox_command_args_for_permission_profile; @@ -45,6 +48,7 @@ pub async fn run_command_under_seatbelt( loader_overrides: LoaderOverrides, ) -> anyhow::Result<()> { let SeatbeltCommand { + sandbox_state, permissions_profile, config_profile: _, cwd, @@ -60,6 +64,7 @@ pub async fn run_command_under_seatbelt( ); run_command_under_sandbox( DebugSandboxConfigOptions { + sandbox_state, permissions_profile, cwd, managed_requirements_mode, @@ -90,6 +95,7 @@ pub async fn run_command_under_landlock( loader_overrides: LoaderOverrides, ) -> anyhow::Result<()> { let LandlockCommand { + sandbox_state, permissions_profile, config_profile: _, cwd, @@ -103,6 +109,7 @@ pub async fn run_command_under_landlock( ); run_command_under_sandbox( DebugSandboxConfigOptions { + sandbox_state, permissions_profile, cwd, managed_requirements_mode, @@ -124,6 +131,7 @@ pub async fn run_command_under_windows_sandbox( loader_overrides: LoaderOverrides, ) -> anyhow::Result<()> { let WindowsCommand { + sandbox_state, permissions_profile, config_profile: _, cwd, @@ -137,6 +145,7 @@ pub async fn run_command_under_windows_sandbox( ); run_command_under_sandbox( DebugSandboxConfigOptions { + sandbox_state, permissions_profile, cwd, managed_requirements_mode, @@ -161,6 +170,7 @@ enum SandboxType { #[derive(Debug)] struct DebugSandboxConfigOptions { + sandbox_state: crate::SandboxStateArgs, permissions_profile: Option, cwd: Option, managed_requirements_mode: ManagedRequirementsMode, @@ -187,7 +197,7 @@ impl ManagedRequirementsMode { } async fn run_command_under_sandbox( - config_options: DebugSandboxConfigOptions, + mut config_options: DebugSandboxConfigOptions, command: Vec, config_overrides: CliConfigOverrides, codex_linux_sandbox_exe: Option, @@ -196,6 +206,34 @@ async fn run_command_under_sandbox( #[cfg_attr(not(target_os = "macos"), allow(unused_variables))] allow_unix_sockets: &[AbsolutePathBuf], ) -> anyhow::Result<()> { + let sandbox_state = config_options + .sandbox_state + .sandbox_state_json + .as_deref() + .map(serde_json::from_str::) + .transpose() + .map_err(|err| anyhow::anyhow!("invalid --sandbox-state-json value: {err}"))?; + let sandbox_state_readable_root = config_options + .sandbox_state + .sandbox_state_readable_root + .clone(); + let sandbox_state_disable_network = config_options.sandbox_state.sandbox_state_disable_network; + let codex_linux_sandbox_exe = match sandbox_state.as_ref() { + Some(state) => { + config_options.cwd = Some( + state + .sandbox_cwd + .to_abs_path() + .context("sandbox state cwd is not native to this host")? + .to_path_buf(), + ); + state + .codex_linux_sandbox_exe + .clone() + .or(codex_linux_sandbox_exe) + } + None => codex_linux_sandbox_exe, + }; let config = load_debug_sandbox_config( config_overrides .parse_overrides() @@ -220,12 +258,75 @@ async fn run_command_under_sandbox( &config.permissions.shell_environment_policy, /*thread_id*/ None, ); + let mut permission_profile = match sandbox_state.as_ref() { + Some(state) => match &state.permission_profile { + PermissionProfile::External { .. } => { + // `External` only says that the producer relies on an outer sandbox; it does not + // include filesystem permissions we can recreate here. The consumer may not share + // that sandbox, so use a locally enforceable read-only profile instead of spawning + // without a sandbox. + PermissionProfile::read_only() + } + permission_profile => permission_profile.clone(), + }, + None => config.permissions.effective_permission_profile(), + }; + if matches!(permission_profile, PermissionProfile::Disabled) && sandbox_state_disable_network { + anyhow::bail!( + "--sandbox-state-disable-network cannot be applied to a disabled permission profile" + ); + } + if !matches!(permission_profile, PermissionProfile::Disabled) + && (!sandbox_state_readable_root.is_empty() || sandbox_state_disable_network) + { + let file_system = permission_profile + .file_system_sandbox_policy() + .with_additional_readable_roots(&cwd, &sandbox_state_readable_root); + let network = if sandbox_state_disable_network { + NetworkSandboxPolicy::Restricted + } else { + permission_profile.network_sandbox_policy() + }; + permission_profile = PermissionProfile::from_runtime_permissions(&file_system, network); + } + let use_legacy_landlock = sandbox_state.as_ref().map_or_else( + || config.features.use_legacy_landlock(), + |state| state.use_legacy_landlock, + ); + + match permission_profile.enforcement() { + SandboxEnforcement::Managed => {} + SandboxEnforcement::Disabled | SandboxEnforcement::External => { + let (program, args) = command + .split_first() + .context("sandbox command must not be empty")?; + let mut child = spawn_debug_sandbox_child( + PathBuf::from(program), + args.to_vec(), + /*arg0*/ None, + cwd.to_path_buf(), + permission_profile.network_sandbox_policy(), + env, + |_| {}, + ) + .await?; + handle_exit_status(child.wait().await?); + } + } // Special-case Windows sandbox: execute and exit the process to emulate inherited stdio. if let SandboxType::Windows = sandbox_type { #[cfg(target_os = "windows")] { - run_command_under_windows_session(&config, command, cwd, workspace_roots, env).await; + run_command_under_windows_session( + &config, + &permission_profile, + command, + cwd, + workspace_roots, + env, + ) + .await; } #[cfg(not(target_os = "windows"))] { @@ -244,7 +345,7 @@ async fn run_command_under_sandbox( let network_proxy = match config.permissions.network.as_ref() { Some(spec) => Some( spec.start_proxy( - config.permissions.permission_profile(), + &permission_profile, /*policy_decider*/ None, /*blocked_request_observer*/ None, managed_network_requirements_enabled, @@ -266,7 +367,7 @@ async fn run_command_under_sandbox( None => None, }; let runtime_permission_profile = with_managed_mitm_ca_readable_root( - config.permissions.effective_permission_profile(), + permission_profile, managed_mitm_ca_trust_bundle_path.as_ref(), sandbox_policy_cwd.as_path(), ); @@ -282,6 +383,7 @@ async fn run_command_under_sandbox( network_sandbox_policy, sandbox_policy_cwd: sandbox_policy_cwd.as_path(), enforce_managed_network, + managed_network: None, environment_id: None, network: network.as_ref(), extra_allow_unix_sockets: allow_unix_sockets, @@ -308,7 +410,6 @@ async fn run_command_under_sandbox( let codex_linux_sandbox_exe = config .codex_linux_sandbox_exe .expect("codex-linux-sandbox executable not found"); - let use_legacy_landlock = config.features.use_legacy_landlock(); let network_sandbox_policy = runtime_permission_profile.network_sandbox_policy(); let args = create_linux_sandbox_command_args_for_permission_profile( command, @@ -364,6 +465,7 @@ async fn run_command_under_sandbox( #[cfg(target_os = "windows")] async fn run_command_under_windows_session( config: &Config, + permission_profile: &PermissionProfile, command: Vec, cwd: AbsolutePathBuf, workspace_roots: Vec, @@ -371,19 +473,20 @@ async fn run_command_under_windows_session( ) -> ! { use codex_core::windows_sandbox::WindowsSandboxLevelExt; use codex_protocol::config_types::WindowsSandboxLevel; + use codex_windows_sandbox::WindowsSandboxProxySettingsMode; use codex_windows_sandbox::WindowsSandboxSessionRequest; use codex_windows_sandbox::spawn_windows_sandbox_session_for_level; - let permission_profile = config.permissions.effective_permission_profile(); let empty_paths: &[AbsolutePathBuf] = &[]; let spawned = spawn_windows_sandbox_session_for_level(WindowsSandboxSessionRequest { - permission_profile: &permission_profile, + permission_profile, workspace_roots: workspace_roots.as_slice(), codex_home: config.codex_home.as_path(), command, cwd: cwd.as_path(), env_map: env, windows_sandbox_level: WindowsSandboxLevel::from_config(config), + proxy_settings_mode: WindowsSandboxProxySettingsMode::Reconcile, proxy_enforced: false, timeout_ms: None, read_roots_override: None, @@ -464,6 +567,7 @@ async fn load_debug_sandbox_config_with_codex_home( strict_config: bool, ) -> anyhow::Result { let DebugSandboxConfigOptions { + sandbox_state: _, permissions_profile, cwd, managed_requirements_mode, @@ -649,6 +753,7 @@ mod tests { Vec::new(), /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: None, cwd: None, managed_requirements_mode: ManagedRequirementsMode::Include, @@ -717,6 +822,7 @@ mod tests { Vec::new(), /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: None, cwd: None, managed_requirements_mode: ManagedRequirementsMode::Include, @@ -774,6 +880,7 @@ mod tests { cli_overrides, /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: None, cwd: None, managed_requirements_mode: ManagedRequirementsMode::Include, @@ -832,6 +939,7 @@ mod tests { Vec::new(), /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: None, cwd: None, managed_requirements_mode: ManagedRequirementsMode::Include, @@ -859,6 +967,7 @@ mod tests { Vec::new(), /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: Some(":workspace".to_string()), cwd: None, managed_requirements_mode: ManagedRequirementsMode::Ignore, @@ -898,6 +1007,7 @@ mod tests { Vec::new(), /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: Some("limited-read-test".to_string()), cwd: None, managed_requirements_mode: ManagedRequirementsMode::Ignore, @@ -937,6 +1047,7 @@ mod tests { Vec::new(), /*codex_linux_sandbox_exe*/ None, DebugSandboxConfigOptions { + sandbox_state: Default::default(), permissions_profile: Some(":workspace".to_string()), cwd: Some(cwd.path().to_path_buf()), managed_requirements_mode: ManagedRequirementsMode::Ignore, diff --git a/codex-rs/cli/src/lib.rs b/codex-rs/cli/src/lib.rs index 4e63df187e..1c0a2e7e02 100644 --- a/codex-rs/cli/src/lib.rs +++ b/codex-rs/cli/src/lib.rs @@ -2,6 +2,7 @@ pub(crate) mod debug_sandbox; mod exit_status; pub(crate) mod login; +use clap::Args; use clap::Parser; use codex_utils_absolute_path::AbsolutePathBuf; use codex_utils_cli::CliConfigOverrides; @@ -21,10 +22,36 @@ pub use login::run_login_with_device_code; pub use login::run_login_with_device_code_fallback_to_browser; pub use login::run_logout; +#[derive(Debug, Default, Args)] +pub struct SandboxStateArgs { + /// JSON value from `codex/sandbox-state-meta` to apply directly. + #[arg( + long = "sandbox-state-json", + value_name = "JSON", + conflicts_with_all = ["permissions_profile", "cwd", "include_managed_config"] + )] + pub sandbox_state_json: Option, + + /// Add a readable root to the supplied sandbox state. Repeat for multiple roots. + #[arg( + long, + requires = "sandbox_state_json", + value_parser = parse_absolute_path + )] + pub sandbox_state_readable_root: Vec, + + /// Disable direct network access in the supplied sandbox state. + #[arg(long, requires = "sandbox_state_json", default_value_t = false)] + pub sandbox_state_disable_network: bool, +} + // These command structs share common sandbox options, but remain separate // because each host backend has a slightly different option surface. #[derive(Debug, Parser)] pub struct SeatbeltCommand { + #[command(flatten)] + pub sandbox_state: SandboxStateArgs, + /// Named permissions profile to apply from the active configuration stack. #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")] pub permissions_profile: Option, @@ -51,7 +78,7 @@ pub struct SeatbeltCommand { pub include_managed_config: bool, /// Allow the sandboxed command to bind/connect AF_UNIX sockets rooted at this path. Relative paths are resolved against the current directory. Repeat to allow multiple paths. - #[arg(long = "allow-unix-socket", value_parser = parse_allow_unix_socket_path)] + #[arg(long = "allow-unix-socket", value_parser = parse_absolute_path)] pub allow_unix_sockets: Vec, /// While the command runs, capture macOS sandbox denials via `log stream` and print them after exit @@ -66,13 +93,16 @@ pub struct SeatbeltCommand { pub command: Vec, } -fn parse_allow_unix_socket_path(raw: &str) -> Result { +fn parse_absolute_path(raw: &str) -> Result { AbsolutePathBuf::relative_to_current_dir(raw) .map_err(|err| format!("invalid path {raw}: {err}")) } #[derive(Debug, Parser)] pub struct LandlockCommand { + #[command(flatten)] + pub sandbox_state: SandboxStateArgs, + /// Named permissions profile to apply from the active configuration stack. #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")] pub permissions_profile: Option, @@ -108,6 +138,9 @@ pub struct LandlockCommand { #[derive(Debug, Parser)] pub struct WindowsCommand { + #[command(flatten)] + pub sandbox_state: SandboxStateArgs, + /// Named permissions profile to apply from the active configuration stack. #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")] pub permissions_profile: Option, diff --git a/codex-rs/codex-api/src/common.rs b/codex-rs/codex-api/src/common.rs index ad37f6d5a4..bd037deb58 100644 --- a/codex-rs/codex-api/src/common.rs +++ b/codex-rs/codex-api/src/common.rs @@ -28,7 +28,8 @@ pub struct CompactionInput<'a> { pub input: &'a [ResponseItem], #[serde(skip_serializing_if = "str::is_empty")] pub instructions: &'a str, - pub tools: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub tools: Option>, pub parallel_tool_calls: bool, #[serde(skip_serializing_if = "Option::is_none")] pub reasoning: Option, @@ -210,7 +211,8 @@ pub struct ResponsesApiRequest { #[serde(skip_serializing_if = "String::is_empty")] pub instructions: String, pub input: Vec, - pub tools: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub tools: Option>, pub tool_choice: String, pub parallel_tool_calls: bool, pub reasoning: Option, @@ -258,7 +260,8 @@ pub struct ResponseCreateWsRequest { #[serde(skip_serializing_if = "Option::is_none")] pub previous_response_id: Option, pub input: Vec, - pub tools: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub tools: Option>, pub tool_choice: String, pub parallel_tool_calls: bool, pub reasoning: Option, diff --git a/codex-rs/codex-api/src/endpoint/responses_websocket.rs b/codex-rs/codex-api/src/endpoint/responses_websocket.rs index ea7565ef57..755228a9f5 100644 --- a/codex-rs/codex-api/src/endpoint/responses_websocket.rs +++ b/codex-rs/codex-api/src/endpoint/responses_websocket.rs @@ -838,11 +838,11 @@ mod tests { phase: None, internal_chat_message_metadata_passthrough: None, }], - tools: vec![json!({ + tools: Some(vec![json!({ "type": "function", "name": "lookup", "parameters": {"type": "object"} - })], + })]), tool_choice: "auto".to_string(), parallel_tool_calls: true, reasoning: None, diff --git a/codex-rs/codex-api/tests/clients.rs b/codex-rs/codex-api/tests/clients.rs index 2d69f83860..60a9852cfa 100644 --- a/codex-rs/codex-api/tests/clients.rs +++ b/codex-rs/codex-api/tests/clients.rs @@ -315,7 +315,7 @@ async fn responses_client_stream_request_preserves_item_ids() -> Result<()> { phase: None, internal_chat_message_metadata_passthrough: None, }], - tools: Vec::new(), + tools: Some(Vec::new()), tool_choice: "auto".into(), parallel_tool_calls: false, reasoning: None, @@ -401,7 +401,7 @@ async fn streaming_client_retries_on_transport_error() -> Result<()> { model: "gpt-test".into(), instructions: "Say hi".into(), input: Vec::new(), - tools: Vec::new(), + tools: Some(Vec::new()), tool_choice: "auto".into(), parallel_tool_calls: false, reasoning: None, @@ -520,7 +520,7 @@ async fn azure_store_sends_ids_and_headers() -> Result<()> { phase: None, internal_chat_message_metadata_passthrough: None, }], - tools: Vec::new(), + tools: Some(Vec::new()), tool_choice: "auto".into(), parallel_tool_calls: false, reasoning: None, diff --git a/codex-rs/codex-mcp/src/codex_apps.rs b/codex-rs/codex-mcp/src/codex_apps.rs index b22a45f0d1..437e750de8 100644 --- a/codex-rs/codex-mcp/src/codex_apps.rs +++ b/codex-rs/codex-mcp/src/codex_apps.rs @@ -8,7 +8,6 @@ use std::path::PathBuf; use std::time::Instant; -use crate::mcp::CODEX_APPS_MCP_SERVER_NAME; use crate::runtime::emit_duration; use crate::tools::MCP_TOOLS_CACHE_WRITE_DURATION_METRIC; use crate::tools::ToolInfo; @@ -66,15 +65,7 @@ pub(crate) enum CachedCodexAppsToolsLoad { Invalid, } -pub(crate) fn normalize_codex_apps_tool_title( - server_name: &str, - connector_name: Option<&str>, - value: &str, -) -> String { - if server_name != CODEX_APPS_MCP_SERVER_NAME { - return value.to_string(); - } - +pub(crate) fn normalize_codex_apps_tool_title(connector_name: Option<&str>, value: &str) -> String { let Some(connector_name) = connector_name .map(str::trim) .filter(|name| !name.is_empty()) @@ -93,15 +84,10 @@ pub(crate) fn normalize_codex_apps_tool_title( } pub(crate) fn normalize_codex_apps_callable_name( - server_name: &str, tool_name: &str, connector_id: Option<&str>, connector_name: Option<&str>, ) -> String { - if server_name != CODEX_APPS_MCP_SERVER_NAME { - return tool_name.to_string(); - } - let tool_name = sanitize_name(tool_name); if let Some(connector_name) = connector_name @@ -131,25 +117,18 @@ pub(crate) fn normalize_codex_apps_callable_namespace( server_name: &str, connector_name: Option<&str>, ) -> String { - if server_name == CODEX_APPS_MCP_SERVER_NAME - && let Some(connector_name) = connector_name - { + if let Some(connector_name) = connector_name { format!("{}__{}", server_name, sanitize_name(connector_name)) } else { server_name.to_string() } } -pub(crate) fn write_cached_codex_apps_tools_if_needed( - server_name: &str, +pub(crate) fn write_codex_apps_tools_cache( cache_context: Option<&CodexAppsToolsCacheContext>, server_info: &McpServerInfo, tools: &[ToolInfo], ) { - if server_name != CODEX_APPS_MCP_SERVER_NAME { - return; - } - if let Some(cache_context) = cache_context { let cache_write_start = Instant::now(); write_cached_codex_apps_tools(cache_context, tools); @@ -165,13 +144,8 @@ pub(crate) fn write_cached_codex_apps_tools_if_needed( } pub(crate) fn load_startup_cached_codex_apps_tools_snapshot( - server_name: &str, cache_context: Option<&CodexAppsToolsCacheContext>, ) -> Option> { - if server_name != CODEX_APPS_MCP_SERVER_NAME { - return None; - } - let cache_context = cache_context?; match load_cached_codex_apps_tools(cache_context) { @@ -181,13 +155,8 @@ pub(crate) fn load_startup_cached_codex_apps_tools_snapshot( } pub(crate) fn load_startup_cached_codex_apps_server_info( - server_name: &str, cache_context: Option<&CodexAppsToolsCacheContext>, ) -> Option { - if server_name != CODEX_APPS_MCP_SERVER_NAME { - return None; - } - load_cached_codex_apps_server_info(cache_context?) } diff --git a/codex-rs/codex-mcp/src/connection_manager.rs b/codex-rs/codex-mcp/src/connection_manager.rs index ea55d21379..33631393cc 100644 --- a/codex-rs/codex-mcp/src/connection_manager.rs +++ b/codex-rs/codex-mcp/src/connection_manager.rs @@ -7,6 +7,7 @@ //! `codex-core`. use std::collections::HashMap; +use std::path::Path; use std::path::PathBuf; use std::sync::Arc; use std::sync::atomic::Ordering; @@ -16,7 +17,7 @@ use std::time::Instant; use crate::McpAuthStatusEntry; use crate::codex_apps::CodexAppsToolsCacheContext; use crate::codex_apps::CodexAppsToolsCacheKey; -use crate::codex_apps::write_cached_codex_apps_tools_if_needed; +use crate::codex_apps::write_codex_apps_tools_cache; use crate::elicitation::ElicitationRequestManager; use crate::elicitation::ElicitationReviewerHandle; use crate::mcp::CODEX_APPS_MCP_SERVER_NAME; @@ -40,6 +41,7 @@ use anyhow::Context; use anyhow::Result; use anyhow::anyhow; use async_channel::Sender; +use codex_api::SharedAuthProvider; use codex_config::Constrained; use codex_config::McpServerTransportConfig; use codex_config::types::AuthKeyringBackendKind; @@ -109,7 +111,6 @@ pub struct McpConnectionManager { server_metadata: HashMap, required_servers: Vec, tool_plugin_provenance: Arc, - host_owned_codex_apps_enabled: bool, prefix_mcp_tool_names: bool, elicitation_requests: ElicitationRequestManager, startup_cancellation_token: CancellationToken, @@ -130,7 +131,6 @@ impl McpConnectionManager { runtime_context: McpRuntimeContext, codex_home: PathBuf, codex_apps_tools_cache_key: CodexAppsToolsCacheKey, - host_owned_codex_apps_enabled: bool, prefix_mcp_tool_names: bool, client_elicitation_capability: ElicitationCapability, supports_openai_form_elicitation: bool, @@ -173,29 +173,16 @@ impl McpConnectionManager { }, ) .await; - let codex_apps_tools_cache_context = if server_name == CODEX_APPS_MCP_SERVER_NAME { - Some(CodexAppsToolsCacheContext { - codex_home: codex_home.clone(), - user_key: codex_apps_tools_cache_key.clone(), - }) - } else { - None - }; - let uses_env_bearer_token = - server - .configured_config() - .is_some_and(|config| match &config.transport { - McpServerTransportConfig::StreamableHttp { - bearer_token_env_var, - .. - } => bearer_token_env_var.is_some(), - McpServerTransportConfig::Stdio { .. } => false, - }); - let runtime_auth_provider = - if server_name == CODEX_APPS_MCP_SERVER_NAME && !uses_env_bearer_token { - codex_apps_auth_provider.clone() + let (codex_apps_tools_cache_context, runtime_auth_provider) = + if server_name == CODEX_APPS_MCP_SERVER_NAME { + codex_apps_cache_context_and_auth_provider( + &server, + &codex_home, + &codex_apps_tools_cache_key, + codex_apps_auth_provider.clone(), + ) } else { - None + regular_mcp_cache_context_and_auth_provider() }; let async_managed_client = AsyncManagedClient::new( server_name.clone(), @@ -252,7 +239,6 @@ impl McpConnectionManager { server_metadata, required_servers, tool_plugin_provenance, - host_owned_codex_apps_enabled, prefix_mcp_tool_names, elicitation_requests: elicitation_requests.clone(), startup_cancellation_token: startup_cancellation_token.clone(), @@ -338,7 +324,6 @@ impl McpConnectionManager { server_metadata: HashMap::new(), required_servers: Vec::new(), tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()), - host_owned_codex_apps_enabled: false, prefix_mcp_tool_names, elicitation_requests: ElicitationRequestManager::new( approval_policy.value(), @@ -360,8 +345,15 @@ impl McpConnectionManager { /// Stop all MCP clients owned by this manager and terminate stdio server processes. pub async fn shutdown(&self) { self.startup_cancellation_token.cancel(); - for client in self.clients.values() { - client.shutdown().await; + let clients = self.clients.values().cloned().collect::>(); + // Keep cleanup alive if an interrupt cancels the refresh that requested it. + let shutdown_task = tokio::spawn(async move { + for client in clients { + client.shutdown().await; + } + }); + if let Err(error) = shutdown_task.await { + warn!("MCP client shutdown task failed: {error}"); } } @@ -406,7 +398,7 @@ impl McpConnectionManager { } pub fn is_host_owned_codex_apps_server(&self, server_name: &str) -> bool { - self.host_owned_codex_apps_enabled && server_name == CODEX_APPS_MCP_SERVER_NAME + server_name == CODEX_APPS_MCP_SERVER_NAME && self.server_metadata.contains_key(server_name) } pub fn set_approval_policy(&self, approval_policy: &Constrained) { @@ -510,6 +502,7 @@ impl McpConnectionManager { let fetch_start = Instant::now(); let tools = list_tools_for_client_uncached( CODEX_APPS_MCP_SERVER_NAME, + /*is_codex_apps_mcp_server*/ true, &managed_client.client, managed_client.tool_timeout, managed_client.server_instructions.as_deref(), @@ -524,8 +517,7 @@ impl McpConnectionManager { &[], ); - write_cached_codex_apps_tools_if_needed( - CODEX_APPS_MCP_SERVER_NAME, + write_codex_apps_tools_cache( managed_client.codex_apps_tools_cache_context.as_ref(), &managed_client.server_info, &tools, @@ -860,6 +852,50 @@ impl Drop for McpConnectionManager { } } +/// Creates the host-owned state used only by the Codex Apps server. +/// +/// The tools cache is scoped to the authenticated user. Runtime authentication is supplied only +/// when the server is not already configured to read a bearer token from the environment. +fn codex_apps_cache_context_and_auth_provider( + server: &EffectiveMcpServer, + codex_home: &Path, + codex_apps_tools_cache_key: &CodexAppsToolsCacheKey, + codex_apps_auth_provider: Option, +) -> ( + Option, + Option, +) { + let uses_env_bearer_token = + server + .configured_config() + .is_some_and(|config| match &config.transport { + McpServerTransportConfig::StreamableHttp { + bearer_token_env_var, + .. + } => bearer_token_env_var.is_some(), + McpServerTransportConfig::Stdio { .. } => false, + }); + ( + Some(CodexAppsToolsCacheContext { + codex_home: codex_home.to_path_buf(), + user_key: codex_apps_tools_cache_key.clone(), + }), + if uses_env_bearer_token { + None + } else { + codex_apps_auth_provider + }, + ) +} + +/// Keeps regular MCP servers isolated from the host-owned Codex Apps cache and auth provider. +fn regular_mcp_cache_context_and_auth_provider() -> ( + Option, + Option, +) { + (None, None) +} + async fn emit_update( submit_id: &str, tx_event: &Sender, diff --git a/codex-rs/codex-mcp/src/connection_manager_tests.rs b/codex-rs/codex-mcp/src/connection_manager_tests.rs index 52194b07f1..db7ef20abb 100644 --- a/codex-rs/codex-mcp/src/connection_manager_tests.rs +++ b/codex-rs/codex-mcp/src/connection_manager_tests.rs @@ -5,7 +5,7 @@ use crate::codex_apps::load_startup_cached_codex_apps_server_info; use crate::codex_apps::load_startup_cached_codex_apps_tools_snapshot; use crate::codex_apps::read_cached_codex_apps_tools; use crate::codex_apps::write_cached_codex_apps_tools; -use crate::codex_apps::write_cached_codex_apps_tools_if_needed; +use crate::codex_apps::write_codex_apps_tools_cache; use crate::declared_openai_file_input_param_names; use crate::elicitation::ElicitationRequestManager; use crate::elicitation::elicitation_is_rejected_by_policy; @@ -205,9 +205,6 @@ fn tool_with_model_visible_input_schema_leaves_tools_without_file_params_unchang #[test] fn elicitation_granular_policy_defaults_to_prompting() { - assert!(!elicitation_is_rejected_by_policy( - AskForApproval::OnFailure - )); assert!(!elicitation_is_rejected_by_policy( AskForApproval::OnRequest )); @@ -704,22 +701,11 @@ fn startup_cached_codex_apps_tools_loads_from_disk_cache() { "calendar_search", )]; let server_info = create_test_server_info("Codex Apps"); - write_cached_codex_apps_tools_if_needed( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - &server_info, - &cached_tools, - ); + write_codex_apps_tools_cache(Some(&cache_context), &server_info, &cached_tools); - let startup_tools = load_startup_cached_codex_apps_tools_snapshot( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - ) - .expect("expected startup snapshot to load from cache"); - let cached_server_info = load_startup_cached_codex_apps_server_info( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - ); + let startup_tools = load_startup_cached_codex_apps_tools_snapshot(Some(&cache_context)) + .expect("expected startup snapshot to load from cache"); + let cached_server_info = load_startup_cached_codex_apps_server_info(Some(&cache_context)); assert_eq!(startup_tools.len(), 1); assert_eq!(startup_tools[0].server_name, CODEX_APPS_MCP_SERVER_NAME); @@ -746,15 +732,9 @@ fn startup_cached_codex_apps_tools_loads_without_server_info_cache() { .expect("serialize"); std::fs::write(cache_path, bytes).expect("write"); - let startup_tools = load_startup_cached_codex_apps_tools_snapshot( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - ) - .expect("legacy startup snapshot should remain available"); - let cached_server_info = load_startup_cached_codex_apps_server_info( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - ); + let startup_tools = load_startup_cached_codex_apps_tools_snapshot(Some(&cache_context)) + .expect("legacy startup snapshot should remain available"); + let cached_server_info = load_startup_cached_codex_apps_server_info(Some(&cache_context)); assert_eq!(startup_tools.len(), 1); assert_eq!(startup_tools[0].callable_name, "calendar_search"); @@ -770,8 +750,7 @@ fn codex_apps_server_info_cache_survives_legacy_tools_cache_write() { Some("user-one"), ); let server_info = create_test_server_info("Codex Apps"); - write_cached_codex_apps_tools_if_needed( - CODEX_APPS_MCP_SERVER_NAME, + write_codex_apps_tools_cache( Some(&cache_context), &server_info, &[create_test_tool( @@ -792,19 +771,10 @@ fn codex_apps_server_info_cache_survives_legacy_tools_cache_write() { std::fs::write(cache_path, bytes).expect("write legacy tools cache"); assert_eq!( - load_startup_cached_codex_apps_server_info( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - ), + load_startup_cached_codex_apps_server_info(Some(&cache_context)), Some(server_info) ); - assert!( - load_startup_cached_codex_apps_tools_snapshot( - CODEX_APPS_MCP_SERVER_NAME, - Some(&cache_context), - ) - .is_none() - ); + assert!(load_startup_cached_codex_apps_tools_snapshot(Some(&cache_context)).is_none()); } #[tokio::test] @@ -816,7 +786,7 @@ async fn list_all_tools_uses_cached_tool_info_snapshot_while_client_is_pending() let pending_client = futures::future::pending::>() .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -827,6 +797,7 @@ async fn list_all_tools_uses_cached_tool_info_snapshot_while_client_is_pending() CODEX_APPS_MCP_SERVER_NAME.to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: true, cached_tool_info_snapshot: Some(startup_tools), cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -852,7 +823,7 @@ async fn list_available_server_infos_uses_cache_while_client_is_pending() { let pending_client = futures::future::pending::>() .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -864,6 +835,7 @@ async fn list_available_server_infos_uses_cache_while_client_is_pending() { CODEX_APPS_MCP_SERVER_NAME.to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: true, cached_tool_info_snapshot: Some(Vec::new()), cached_server_info: Some(server_info.clone()), startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -890,7 +862,7 @@ async fn list_all_tools_accepts_canonical_namespaced_tool_names() { let pending_client = futures::future::pending::>() .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -901,6 +873,7 @@ async fn list_all_tools_accepts_canonical_namespaced_tool_names() { "rmcp".to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: false, cached_tool_info_snapshot: Some(startup_tools), cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -933,7 +906,7 @@ async fn list_all_tools_applies_legacy_mcp_prefix_by_default() { let pending_client = futures::future::pending::>() .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -944,6 +917,7 @@ async fn list_all_tools_applies_legacy_mcp_prefix_by_default() { "rmcp".to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: false, cached_tool_info_snapshot: Some(startup_tools), cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -975,7 +949,7 @@ async fn list_all_tools_blocks_while_client_is_pending_without_cached_tool_info_ let pending_client = futures::future::pending::>() .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -986,6 +960,7 @@ async fn list_all_tools_blocks_while_client_is_pending_without_cached_tool_info_ CODEX_APPS_MCP_SERVER_NAME.to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: true, cached_tool_info_snapshot: None, cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -1011,7 +986,7 @@ async fn shutdown_cancels_pending_tool_listing() { } .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -1022,6 +997,7 @@ async fn shutdown_cancels_pending_tool_listing() { CODEX_APPS_MCP_SERVER_NAME.to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: true, cached_tool_info_snapshot: None, cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -1042,10 +1018,19 @@ async fn shutdown_cancels_pending_tool_listing() { } #[tokio::test] -async fn list_all_tools_does_not_block_when_cached_tool_info_snapshot_is_empty() { - let pending_client = futures::future::pending::>() - .boxed() - .shared(); +async fn shutdown_continues_after_caller_is_aborted() { + let (started_tx, started_rx) = tokio::sync::oneshot::channel(); + let (completed_tx, completed_rx) = tokio::sync::oneshot::channel(); + let release = Arc::new(tokio::sync::Notify::new()); + let release_for_client = Arc::clone(&release); + let blocking_client = async move { + let _ = started_tx.send(()); + release_for_client.notified().await; + let _ = completed_tx.send(()); + Err(StartupOutcomeError::Cancelled) + } + .boxed() + .shared(); let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( @@ -1053,10 +1038,55 @@ async fn list_all_tools_does_not_block_when_cached_tool_info_snapshot_is_empty() &permission_profile, /*prefix_mcp_tool_names*/ true, ); + manager.clients.insert( + CODEX_APPS_MCP_SERVER_NAME.to_string(), + AsyncManagedClient { + client: blocking_client, + is_codex_apps_mcp_server: true, + cached_tool_info_snapshot: None, + cached_server_info: None, + startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), + tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()), + cancel_token: CancellationToken::new(), + }, + ); + let manager = Arc::new(manager); + let shutdown_task = tokio::spawn({ + let manager = Arc::clone(&manager); + async move { manager.shutdown().await } + }); + + started_rx.await.expect("client shutdown should start"); + shutdown_task.abort(); + let shutdown_error = shutdown_task + .await + .expect_err("caller shutdown task should be aborted"); + assert!(shutdown_error.is_cancelled()); + release.notify_one(); + + tokio::time::timeout(Duration::from_secs(1), completed_rx) + .await + .expect("client shutdown should survive caller cancellation") + .expect("client shutdown completion sender should stay alive"); +} + +#[tokio::test] +async fn list_all_tools_does_not_block_when_cached_tool_info_snapshot_is_empty() { + let pending_client = futures::future::pending::>() + .boxed() + .shared(); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); + let permission_profile = Constrained::allow_any(PermissionProfile::default()); + let mut manager = McpConnectionManager::new_uninitialized( + &approval_policy, + &permission_profile, + /*prefix_mcp_tool_names*/ true, + ); manager.clients.insert( CODEX_APPS_MCP_SERVER_NAME.to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: true, cached_tool_info_snapshot: Some(Vec::new()), cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -1085,7 +1115,7 @@ async fn list_all_tools_uses_cached_tool_info_snapshot_when_client_startup_fails )) .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -1097,6 +1127,7 @@ async fn list_all_tools_uses_cached_tool_info_snapshot_when_client_startup_fails CODEX_APPS_MCP_SERVER_NAME.to_string(), AsyncManagedClient { client: failed_client, + is_codex_apps_mcp_server: true, cached_tool_info_snapshot: Some(startup_tools), cached_server_info: Some(server_info.clone()), startup_complete, @@ -1131,7 +1162,7 @@ async fn list_all_tools_adds_server_metadata_to_cached_tools() { let pending_client = futures::future::pending::>() .boxed() .shared(); - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let permission_profile = Constrained::allow_any(PermissionProfile::default()); let mut manager = McpConnectionManager::new_uninitialized( &approval_policy, @@ -1155,6 +1186,7 @@ async fn list_all_tools_adds_server_metadata_to_cached_tools() { server_name.to_string(), AsyncManagedClient { client: pending_client, + is_codex_apps_mcp_server: false, cached_tool_info_snapshot: Some(startup_tools), cached_server_info: None, startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)), @@ -1195,9 +1227,44 @@ fn server_metadata_preserves_tool_approval_policy() { ); } +#[test] +fn host_owned_codex_apps_requires_server_metadata() { + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); + let permission_profile = Constrained::allow_any(PermissionProfile::default()); + let manager = McpConnectionManager::new_uninitialized( + &approval_policy, + &permission_profile, + /*prefix_mcp_tool_names*/ true, + ); + + assert!(!manager.is_host_owned_codex_apps_server(CODEX_APPS_MCP_SERVER_NAME)); +} + +#[test] +fn host_owned_codex_apps_matches_reserved_name_with_server_metadata() { + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); + let permission_profile = Constrained::allow_any(PermissionProfile::default()); + let mut manager = McpConnectionManager::new_uninitialized( + &approval_policy, + &permission_profile, + /*prefix_mcp_tool_names*/ true, + ); + let server = EffectiveMcpServer::configured(crate::codex_apps_mcp_server_config( + "https://chatgpt.com", + /*apps_mcp_product_sku*/ None, + )); + manager.server_metadata.insert( + CODEX_APPS_MCP_SERVER_NAME.to_string(), + McpServerMetadata::from(&server), + ); + + assert!(manager.is_host_owned_codex_apps_server(CODEX_APPS_MCP_SERVER_NAME)); + assert!(!manager.is_host_owned_codex_apps_server("docs")); +} + #[tokio::test] async fn no_local_runtime_fails_local_stdio_but_keeps_local_http_server() { - let approval_policy = Constrained::allow_any(AskForApproval::OnFailure); + let approval_policy = Constrained::allow_any(AskForApproval::OnRequest); let (tx_event, rx_event) = async_channel::unbounded(); drop(rx_event); let codex_home = tempdir().expect("tempdir"); @@ -1276,7 +1343,6 @@ async fn no_local_runtime_fails_local_stdio_but_keeps_local_http_server() { chatgpt_user_id: None, is_workspace_account: false, }, - /*host_owned_codex_apps_enabled*/ false, /*prefix_mcp_tool_names*/ true, ElicitationCapability::default(), /*supports_openai_form_elicitation*/ false, diff --git a/codex-rs/codex-mcp/src/elicitation.rs b/codex-rs/codex-mcp/src/elicitation.rs index abd5a46899..d6a685b502 100644 --- a/codex-rs/codex-mcp/src/elicitation.rs +++ b/codex-rs/codex-mcp/src/elicitation.rs @@ -247,7 +247,6 @@ impl ElicitationRequestManager { pub(crate) fn elicitation_is_rejected_by_policy(approval_policy: AskForApproval) -> bool { match approval_policy { AskForApproval::Never => true, - AskForApproval::OnFailure => false, AskForApproval::OnRequest => false, AskForApproval::UnlessTrusted => false, AskForApproval::Granular(granular_config) => !granular_config.allows_mcp_elicitations(), diff --git a/codex-rs/codex-mcp/src/mcp/auth.rs b/codex-rs/codex-mcp/src/mcp/auth.rs index ec67f07a82..78d55fb789 100644 --- a/codex-rs/codex-mcp/src/mcp/auth.rs +++ b/codex-rs/codex-mcp/src/mcp/auth.rs @@ -10,6 +10,7 @@ use codex_protocol::protocol::McpAuthStatus; use codex_rmcp_client::OAuthProviderError; use codex_rmcp_client::determine_streamable_http_auth_status; use codex_rmcp_client::discover_streamable_http_oauth; +use futures::FutureExt; use futures::future::join_all; use tracing::warn; @@ -217,6 +218,7 @@ async fn compute_auth_status( store_mode, keyring_backend_kind, ) + .boxed() .await } } diff --git a/codex-rs/codex-mcp/src/mcp/mod.rs b/codex-rs/codex-mcp/src/mcp/mod.rs index 4076880c1d..4a765e6a62 100644 --- a/codex-rs/codex-mcp/src/mcp/mod.rs +++ b/codex-rs/codex-mcp/src/mcp/mod.rs @@ -277,7 +277,6 @@ pub async fn read_mcp_resource( uri: &str, ) -> anyhow::Result { let mut mcp_servers = effective_mcp_servers(config, auth); - let host_owned_codex_apps_enabled = host_owned_codex_apps_enabled(config, auth); mcp_servers.retain(|name, _| name == server); let auth_statuses = compute_auth_statuses( mcp_servers.iter(), @@ -302,7 +301,6 @@ pub async fn read_mcp_resource( runtime_context, config.codex_home.clone(), codex_apps_tools_cache_key(auth), - host_owned_codex_apps_enabled, config.prefix_mcp_tool_names, config.client_elicitation_capability.clone(), /*supports_openai_form_elicitation*/ false, @@ -337,7 +335,6 @@ pub async fn collect_mcp_server_status_snapshot_with_detail( detail: McpSnapshotDetail, ) -> McpServerStatusSnapshot { let mcp_servers = effective_mcp_servers(config, auth); - let host_owned_codex_apps_enabled = host_owned_codex_apps_enabled(config, auth); let tool_plugin_provenance = tool_plugin_provenance(config); if mcp_servers.is_empty() { return McpServerStatusSnapshot { @@ -377,7 +374,6 @@ pub async fn collect_mcp_server_status_snapshot_with_detail( runtime_context, config.codex_home.clone(), codex_apps_tools_cache_key(auth), - host_owned_codex_apps_enabled, config.prefix_mcp_tool_names, config.client_elicitation_capability.clone(), /*supports_openai_form_elicitation*/ false, diff --git a/codex-rs/codex-mcp/src/mcp/mod_tests.rs b/codex-rs/codex-mcp/src/mcp/mod_tests.rs index 31c31960c7..9617dca089 100644 --- a/codex-rs/codex-mcp/src/mcp/mod_tests.rs +++ b/codex-rs/codex-mcp/src/mcp/mod_tests.rs @@ -27,7 +27,7 @@ fn test_mcp_config(codex_home: PathBuf) -> McpConfig { mcp_oauth_callback_port: None, mcp_oauth_callback_url: None, skill_mcp_dependency_install_enabled: true, - approval_policy: Constrained::allow_any(AskForApproval::OnFailure), + approval_policy: Constrained::allow_any(AskForApproval::OnRequest), codex_linux_sandbox_exe: None, use_legacy_landlock: false, apps_enabled: false, @@ -83,7 +83,6 @@ fn mcp_prompt_auto_approval_honors_unrestricted_managed_profiles() { fn mcp_prompt_auto_approval_honors_approved_tools_in_all_permission_modes() { for approval_policy in [ AskForApproval::UnlessTrusted, - AskForApproval::OnFailure, AskForApproval::OnRequest, AskForApproval::Granular(GranularApprovalConfig { sandbox_approval: true, diff --git a/codex-rs/codex-mcp/src/rmcp_client.rs b/codex-rs/codex-mcp/src/rmcp_client.rs index 6c8b9a2415..f9cc6a5e81 100644 --- a/codex-rs/codex-mcp/src/rmcp_client.rs +++ b/codex-rs/codex-mcp/src/rmcp_client.rs @@ -25,7 +25,7 @@ use crate::codex_apps::load_startup_cached_codex_apps_tools_snapshot; use crate::codex_apps::normalize_codex_apps_callable_name; use crate::codex_apps::normalize_codex_apps_callable_namespace; use crate::codex_apps::normalize_codex_apps_tool_title; -use crate::codex_apps::write_cached_codex_apps_tools_if_needed; +use crate::codex_apps::write_codex_apps_tools_cache; use crate::elicitation::ElicitationRequestManager; use crate::mcp::CODEX_APPS_MCP_SERVER_NAME; use crate::mcp::ToolPluginProvenance; @@ -55,6 +55,7 @@ use codex_rmcp_client::ExecutorStdioServerLauncher; use codex_rmcp_client::LocalStdioServerLauncher; use codex_rmcp_client::RmcpClient; use codex_rmcp_client::StdioServerLauncher; +use codex_rmcp_client::ToolWithConnectorId; use futures::future::BoxFuture; use futures::future::FutureExt; use futures::future::Shared; @@ -129,6 +130,7 @@ impl ManagedClient { #[derive(Clone)] pub(crate) struct AsyncManagedClient { pub(crate) client: Shared>>, + pub(crate) is_codex_apps_mcp_server: bool, pub(crate) cached_tool_info_snapshot: Option>, pub(crate) cached_server_info: Option, pub(crate) startup_complete: Arc, @@ -155,20 +157,23 @@ impl AsyncManagedClient { client_elicitation_capability: ElicitationCapability, supports_openai_form_elicitation: bool, ) -> Self { + let is_codex_apps_mcp_server = server_name == CODEX_APPS_MCP_SERVER_NAME; let tool_filter = server .configured_config() .map(ToolFilter::from_config) .unwrap_or_default(); - let cached_tool_info_snapshot = load_startup_cached_codex_apps_tools_snapshot( - &server_name, - codex_apps_tools_cache_context.as_ref(), - ); + let (cached_tool_info_snapshot, cached_server_info) = if is_codex_apps_mcp_server { + ( + load_startup_cached_codex_apps_tools_snapshot( + codex_apps_tools_cache_context.as_ref(), + ), + load_startup_cached_codex_apps_server_info(codex_apps_tools_cache_context.as_ref()), + ) + } else { + (None, None) + }; let cached_tool_info_snapshot = cached_tool_info_snapshot.map(|tools| filter_tools(tools, &tool_filter)); - let cached_server_info = load_startup_cached_codex_apps_server_info( - &server_name, - codex_apps_tools_cache_context.as_ref(), - ); let startup_tool_filter = tool_filter; let startup_complete = Arc::new(AtomicBool::new(false)); let startup_complete_for_fut = Arc::clone(&startup_complete); @@ -194,6 +199,7 @@ impl AsyncManagedClient { server_name, client, StartServerTaskParams { + is_codex_apps_mcp_server, startup_timeout: server .configured_config() .and_then(|config| config.startup_timeout_sec) @@ -232,6 +238,7 @@ impl AsyncManagedClient { Self { client, + is_codex_apps_mcp_server, cached_tool_info_snapshot, cached_server_info, startup_complete, @@ -255,65 +262,7 @@ impl AsyncManagedClient { } } - fn cached_tool_info_snapshot_while_initializing(&self) -> Option> { - if !self.startup_complete.load(Ordering::Acquire) { - return self.cached_tool_info_snapshot.clone(); - } - None - } - pub(crate) async fn listed_tools(&self) -> Option> { - let annotate_tools = |tools: Vec| { - let mut tools = tools; - for tool in &mut tools { - if tool.server_name == CODEX_APPS_MCP_SERVER_NAME { - tool.tool = tool_with_model_visible_input_schema(&tool.tool); - } - - let plugin_names = match tool.connector_id.as_deref() { - Some(connector_id) => self - .tool_plugin_provenance - .plugin_display_names_for_connector_id(connector_id), - None => self - .tool_plugin_provenance - .plugin_display_names_for_mcp_server_name(tool.server_name.as_str()), - }; - tool.plugin_display_names = plugin_names.to_vec(); - - if plugin_names.is_empty() { - continue; - } - - let plugin_source_note = if plugin_names.len() == 1 { - format!("This tool is part of plugin `{}`.", plugin_names[0]) - } else { - format!( - "This tool is part of plugins {}.", - plugin_names - .iter() - .map(|plugin_name| format!("`{plugin_name}`")) - .collect::>() - .join(", ") - ) - }; - let description = tool - .tool - .description - .as_deref() - .map(str::trim) - .unwrap_or(""); - let annotated_description = if description.is_empty() { - plugin_source_note - } else if matches!(description.chars().last(), Some('.' | '!' | '?')) { - format!("{description} {plugin_source_note}") - } else { - format!("{description}. {plugin_source_note}") - }; - tool.tool.description = Some(Cow::Owned(annotated_description)); - } - tools - }; - // Keep cache payloads raw; plugin provenance is resolved per-session at read time. let tools = if let Some(startup_tools) = self.cached_tool_info_snapshot_while_initializing() { @@ -323,8 +272,19 @@ impl AsyncManagedClient { Ok(client) => Some(client.listed_tools()), Err(_) => self.cached_tool_info_snapshot.clone(), } - }; - tools.map(annotate_tools) + }?; + Some(if self.is_codex_apps_mcp_server { + prepare_codex_apps_tools_for_model(tools, &self.tool_plugin_provenance) + } else { + prepare_regular_mcp_tools_for_model(tools, &self.tool_plugin_provenance) + }) + } + + fn cached_tool_info_snapshot_while_initializing(&self) -> Option> { + if !self.startup_complete.load(Ordering::Acquire) { + return self.cached_tool_info_snapshot.clone(); + } + None } } @@ -348,6 +308,7 @@ impl From for StartupOutcomeError { pub(crate) async fn list_tools_for_client_uncached( server_name: &str, + is_codex_apps_mcp_server: bool, client: &Arc, timeout: Option, server_instructions: Option<&str>, @@ -359,68 +320,165 @@ pub(crate) async fn list_tools_for_client_uncached( .tools .into_iter() .map(|tool| { - let mut tool_def = tool.tool; - let (connector_id, connector_name, connector_description) = - sanitize_tool_connector_metadata( - server_name, - &mut tool_def, - tool.connector_id, - tool.connector_name, - tool.connector_description, - ); - let callable_name = normalize_codex_apps_callable_name( + tool_info_from_listed_tool( server_name, - &tool_def.name, - connector_id.as_deref(), - connector_name.as_deref(), - ); - let callable_namespace = - normalize_codex_apps_callable_namespace(server_name, connector_name.as_deref()); - if let Some(title) = tool_def.title.as_deref() { - let normalized_title = - normalize_codex_apps_tool_title(server_name, connector_name.as_deref(), title); - if tool_def.title.as_deref() != Some(normalized_title.as_str()) { - tool_def.title = Some(normalized_title); - } - } - let has_connector_metadata = connector_id.is_some() - || connector_name.is_some() - || connector_description.is_some(); - let namespace_description = if has_connector_metadata { - connector_description - } else { - server_instructions.map(str::to_string) - }; - ToolInfo { - server_name: server_name.to_owned(), - supports_parallel_tool_calls: false, - server_origin: None, - callable_name, - callable_namespace, - namespace_description, - tool: tool_def, - connector_id, - connector_name, - plugin_display_names: Vec::new(), - } + is_codex_apps_mcp_server, + server_instructions, + tool, + ) }) .collect(); Ok(tools) } -fn sanitize_tool_connector_metadata( - server_name: &str, - tool: &mut RmcpTool, - connector_id: Option, - connector_name: Option, - connector_description: Option, -) -> (Option, Option, Option) { - if server_name == CODEX_APPS_MCP_SERVER_NAME { - return (connector_id, connector_name, connector_description); +/// Presents declared Codex Apps file parameters to the model as local-path inputs and adds plugin +/// names to each tool. Plugin membership is resolved by connector ID, falling back to the MCP +/// server when absent. +fn prepare_codex_apps_tools_for_model( + mut tools: Vec, + tool_plugin_provenance: &ToolPluginProvenance, +) -> Vec { + for tool in &mut tools { + tool.tool = tool_with_model_visible_input_schema(&tool.tool); + let plugin_names = match tool.connector_id.as_deref() { + Some(connector_id) => { + tool_plugin_provenance.plugin_display_names_for_connector_id(connector_id) + } + None => tool_plugin_provenance + .plugin_display_names_for_mcp_server_name(tool.server_name.as_str()), + }; + add_plugin_provenance_to_tool(tool, plugin_names); + } + tools +} + +/// Stores plugin names on the tool and appends a model-visible plugin membership note. +fn add_plugin_provenance_to_tool(tool: &mut ToolInfo, plugin_names: &[String]) { + tool.plugin_display_names = plugin_names.to_vec(); + if plugin_names.is_empty() { + return; } - strip_untrusted_connector_meta(tool); - (None, None, None) + let plugin_source_note = if plugin_names.len() == 1 { + format!("This tool is part of plugin `{}`.", plugin_names[0]) + } else { + format!( + "This tool is part of plugins {}.", + plugin_names + .iter() + .map(|plugin_name| format!("`{plugin_name}`")) + .collect::>() + .join(", ") + ) + }; + let description = tool + .tool + .description + .as_deref() + .map(str::trim) + .unwrap_or(""); + let annotated_description = if description.is_empty() { + plugin_source_note + } else if matches!(description.chars().last(), Some('.' | '!' | '?')) { + format!("{description} {plugin_source_note}") + } else { + format!("{description}. {plugin_source_note}") + }; + tool.tool.description = Some(Cow::Owned(annotated_description)); +} + +/// Adds server-scoped plugin names to regular MCP tools without changing their input schemas. +fn prepare_regular_mcp_tools_for_model( + mut tools: Vec, + tool_plugin_provenance: &ToolPluginProvenance, +) -> Vec { + for tool in &mut tools { + let plugin_names = tool_plugin_provenance + .plugin_display_names_for_mcp_server_name(tool.server_name.as_str()); + add_plugin_provenance_to_tool(tool, plugin_names); + } + tools +} + +fn tool_info_from_listed_tool( + server_name: &str, + is_codex_apps_mcp_server: bool, + server_instructions: Option<&str>, + tool: ToolWithConnectorId, +) -> ToolInfo { + if is_codex_apps_mcp_server { + codex_apps_tool_info_from_listed_tool(server_name, server_instructions, tool) + } else { + regular_mcp_tool_info_from_listed_tool(server_name, server_instructions, tool) + } +} + +/// Converts a Codex Apps tool by preserving connector fields, removing connector prefixes from +/// model-visible names and titles, and using the connector description for its tool namespace. +fn codex_apps_tool_info_from_listed_tool( + server_name: &str, + server_instructions: Option<&str>, + tool: ToolWithConnectorId, +) -> ToolInfo { + let mut tool_def = tool.tool; + let connector_id = tool.connector_id; + let connector_name = tool.connector_name; + let connector_description = tool.connector_description; + let callable_name = normalize_codex_apps_callable_name( + &tool_def.name, + connector_id.as_deref(), + connector_name.as_deref(), + ); + let callable_namespace = + normalize_codex_apps_callable_namespace(server_name, connector_name.as_deref()); + if let Some(title) = tool_def.title.as_deref() { + let normalized_title = normalize_codex_apps_tool_title(connector_name.as_deref(), title); + if tool_def.title.as_deref() != Some(normalized_title.as_str()) { + tool_def.title = Some(normalized_title); + } + } + let has_connector_metadata = + connector_id.is_some() || connector_name.is_some() || connector_description.is_some(); + let namespace_description = if has_connector_metadata { + connector_description + } else { + server_instructions.map(str::to_string) + }; + ToolInfo { + server_name: server_name.to_owned(), + supports_parallel_tool_calls: false, + server_origin: None, + callable_name, + callable_namespace, + namespace_description, + tool: tool_def, + connector_id, + connector_name, + plugin_display_names: Vec::new(), + } +} + +/// Converts a regular MCP tool by removing reserved connector metadata, keeping its raw tool name, +/// and using the MCP server name and instructions for the model-visible namespace. +fn regular_mcp_tool_info_from_listed_tool( + server_name: &str, + server_instructions: Option<&str>, + tool: ToolWithConnectorId, +) -> ToolInfo { + let mut tool_def = tool.tool; + strip_untrusted_connector_meta(&mut tool_def); + ToolInfo { + server_name: server_name.to_owned(), + supports_parallel_tool_calls: false, + server_origin: None, + callable_name: tool_def.name.to_string(), + callable_namespace: server_name.to_string(), + namespace_description: server_instructions.map(str::to_string), + tool: tool_def, + connector_id: None, + connector_name: None, + plugin_display_names: Vec::new(), + } } fn strip_untrusted_connector_meta(tool: &mut RmcpTool) { @@ -477,6 +535,7 @@ async fn start_server_task( params: StartServerTaskParams, ) -> Result { let StartServerTaskParams { + is_codex_apps_mcp_server, startup_timeout, tool_timeout, tool_filter, @@ -508,6 +567,7 @@ async fn start_server_task( let fetch_start = Instant::now(); let tools = list_tools_for_client_uncached( &server_name, + is_codex_apps_mcp_server, &client, startup_timeout, initialize_result.instructions.as_deref(), @@ -520,19 +580,21 @@ async fn start_server_task( &[], ); let server_info = mcp_server_info_from_implementation(initialize_result.server_info); - write_cached_codex_apps_tools_if_needed( - &server_name, - codex_apps_tools_cache_context.as_ref(), - &server_info, - &tools, - ); - if server_name == CODEX_APPS_MCP_SERVER_NAME { + let codex_apps_tools_cache_context = if is_codex_apps_mcp_server { + write_codex_apps_tools_cache( + codex_apps_tools_cache_context.as_ref(), + &server_info, + &tools, + ); emit_duration( MCP_TOOLS_LIST_DURATION_METRIC, list_start.elapsed(), &[("cache", "miss")], ); - } + codex_apps_tools_cache_context + } else { + None + }; let tools = filter_tools(tools, &tool_filter); let managed = ManagedClient { @@ -585,6 +647,7 @@ fn mcp_server_info_from_implementation(server_info: Implementation) -> McpServer } struct StartServerTaskParams { + is_codex_apps_mcp_server: bool, startup_timeout: Option, // TODO: cancel_token should handle this. tool_timeout: Duration, tool_filter: ToolFilter, @@ -685,6 +748,7 @@ async fn make_rmcp_client( #[cfg(test)] mod tests { use super::*; + use pretty_assertions::assert_eq; use rmcp::model::JsonObject; use rmcp::model::Meta; @@ -737,18 +801,7 @@ mod tests { fn custom_mcp_connector_metadata_is_stripped() { let mut tool = tool_with_connector_meta(); - let (connector_id, connector_name, connector_description) = - sanitize_tool_connector_metadata( - "minimaltest", - &mut tool, - Some("connector_gmail".to_string()), - Some("Gmail".to_string()), - Some("Mail connector".to_string()), - ); - - assert_eq!(connector_id, None); - assert_eq!(connector_name, None); - assert_eq!(connector_description, None); + strip_untrusted_connector_meta(&mut tool); let meta = tool.meta.as_ref().expect("meta"); for key in [ @@ -771,32 +824,36 @@ mod tests { #[test] fn codex_apps_connector_metadata_is_preserved() { - let mut tool = tool_with_connector_meta(); + let tool = tool_with_connector_meta(); + let expected_tool = tool.clone(); - let (connector_id, connector_name, connector_description) = - sanitize_tool_connector_metadata( - CODEX_APPS_MCP_SERVER_NAME, - &mut tool, - Some("connector_gmail".to_string()), - Some("Gmail".to_string()), - Some("Mail connector".to_string()), - ); + let tool_info = tool_info_from_listed_tool( + CODEX_APPS_MCP_SERVER_NAME, + /*is_codex_apps_mcp_server*/ true, + /*server_instructions*/ None, + ToolWithConnectorId { + tool, + connector_id: Some("connector_gmail".to_string()), + connector_name: Some("Gmail".to_string()), + connector_description: Some("Mail connector".to_string()), + }, + ); - assert_eq!(connector_id.as_deref(), Some("connector_gmail")); - assert_eq!(connector_name.as_deref(), Some("Gmail")); - assert_eq!(connector_description.as_deref(), Some("Mail connector")); - - let meta = tool.meta.as_ref().expect("meta"); - for key in [ - "connector_id", - "connector_name", - "connector_display_name", - "connector_description", - "connectorDescription", - "connectorFutureField", - "CONNECTOR_UPPERCASE", - ] { - assert!(meta.0.contains_key(key), "{key} should be preserved"); - } + let expected = ToolInfo { + server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(), + supports_parallel_tool_calls: false, + server_origin: None, + callable_name: "capture_file_upload".to_string(), + callable_namespace: "codex_apps__gmail".to_string(), + namespace_description: Some("Mail connector".to_string()), + tool: expected_tool, + connector_id: Some("connector_gmail".to_string()), + connector_name: Some("Gmail".to_string()), + plugin_display_names: Vec::new(), + }; + assert_eq!( + serde_json::to_value(tool_info).expect("serialize actual tool info"), + serde_json::to_value(expected).expect("serialize expected tool info") + ); } } diff --git a/codex-rs/codex-mcp/src/runtime.rs b/codex-rs/codex-mcp/src/runtime.rs index e52048349c..e48bdc7f29 100644 --- a/codex-rs/codex-mcp/src/runtime.rs +++ b/codex-rs/codex-mcp/src/runtime.rs @@ -17,11 +17,10 @@ use codex_utils_path_uri::PathUri; use serde::Deserialize; use serde::Serialize; -#[derive(Debug, Clone, Serialize, Deserialize)] +#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)] #[serde(rename_all = "camelCase")] pub struct SandboxState { - #[serde(default, skip_serializing_if = "Option::is_none")] - pub permission_profile: Option, + pub permission_profile: PermissionProfile, pub codex_linux_sandbox_exe: Option, pub sandbox_cwd: PathUri, #[serde(default)] diff --git a/codex-rs/codex-mcp/src/tools.rs b/codex-rs/codex-mcp/src/tools.rs index 83cbfd5e74..f63ab002df 100644 --- a/codex-rs/codex-mcp/src/tools.rs +++ b/codex-rs/codex-mcp/src/tools.rs @@ -113,9 +113,9 @@ impl ToolFilter { } } -/// Returns the model-visible view of a tool while preserving the raw metadata -/// used by execution. Keep cache entries raw and call this at manager return -/// boundaries. +/// Returns the model-visible view of a tool while preserving the raw metadata used by execution. +/// Declared file parameters are presented as local file paths; execution later uploads those files +/// and replaces the paths with the uploaded-file objects expected by the app. pub(crate) fn tool_with_model_visible_input_schema(tool: &Tool) -> Tool { let file_params = declared_openai_file_input_param_names(tool.meta.as_deref()); if file_params.is_empty() { @@ -124,7 +124,7 @@ pub(crate) fn tool_with_model_visible_input_schema(tool: &Tool) -> Tool { let mut tool = tool.clone(); let mut input_schema = JsonValue::Object(tool.input_schema.as_ref().clone()); - mask_input_schema_for_file_path_params(&mut input_schema, &file_params); + rewrite_input_schema_for_local_file_paths(&mut input_schema, &file_params); if let JsonValue::Object(input_schema) = input_schema { tool.input_schema = Arc::new(input_schema); } @@ -262,15 +262,7 @@ const MAX_TOOL_NAME_LENGTH: usize = 64; const CALLABLE_NAME_HASH_LEN: usize = 12; const META_OPENAI_FILE_PARAMS: &str = "openai/fileParams"; -fn callable_namespace_with_prefix(namespace: &str, prefix_mcp_tool_names: bool) -> String { - if !prefix_mcp_tool_names || namespace.starts_with(LEGACY_MCP_TOOL_NAME_PREFIX) { - namespace.to_string() - } else { - format!("{LEGACY_MCP_TOOL_NAME_PREFIX}{namespace}") - } -} - -fn mask_input_schema_for_file_path_params(input_schema: &mut JsonValue, file_params: &[String]) { +fn rewrite_input_schema_for_local_file_paths(input_schema: &mut JsonValue, file_params: &[String]) { let Some(properties) = input_schema .as_object_mut() .and_then(|schema| schema.get_mut("properties")) @@ -283,11 +275,11 @@ fn mask_input_schema_for_file_path_params(input_schema: &mut JsonValue, file_par let Some(property_schema) = properties.get_mut(field_name) else { continue; }; - mask_input_property_schema(property_schema); + rewrite_input_property_schema_as_local_file_path(property_schema); } } -fn mask_input_property_schema(schema: &mut JsonValue) { +fn rewrite_input_property_schema_as_local_file_path(schema: &mut JsonValue) { let Some(object) = schema.as_object_mut() else { return; }; @@ -316,6 +308,14 @@ fn mask_input_property_schema(schema: &mut JsonValue) { } } +fn callable_namespace_with_prefix(namespace: &str, prefix_mcp_tool_names: bool) -> String { + if !prefix_mcp_tool_names || namespace.starts_with(LEGACY_MCP_TOOL_NAME_PREFIX) { + namespace.to_string() + } else { + format!("{LEGACY_MCP_TOOL_NAME_PREFIX}{namespace}") + } +} + fn sha1_hex(s: &str) -> String { let mut hasher = Sha1::new(); hasher.update(s.as_bytes()); diff --git a/codex-rs/config/src/config_requirements.rs b/codex-rs/config/src/config_requirements.rs index ac51734536..4ccf4523aa 100644 --- a/codex-rs/config/src/config_requirements.rs +++ b/codex-rs/config/src/config_requirements.rs @@ -2513,17 +2513,6 @@ allowed_approvals_reviewers = ["user"] .can_set(&AskForApproval::UnlessTrusted) .is_ok() ); - assert_eq!( - requirements - .approval_policy - .can_set(&AskForApproval::OnFailure), - Err(ConstraintError::InvalidValue { - field_name: "approval_policy", - candidate: "OnFailure".into(), - allowed: "[UnlessTrusted, OnRequest]".into(), - requirement_source: RequirementSource::Unknown, - }) - ); assert!( requirements .approval_policy diff --git a/codex-rs/config/src/state_tests.rs b/codex-rs/config/src/state_tests.rs index fb6e26968b..7ad4ed297d 100644 --- a/codex-rs/config/src/state_tests.rs +++ b/codex-rs/config/src/state_tests.rs @@ -52,7 +52,7 @@ fn active_user_layer_is_highest_precedence_user_layer() { toml::from_str( r#" model = "base" -approval_policy = "on-failure" +approval_policy = "on-request" "#, ) .expect("base config"), @@ -86,7 +86,7 @@ approval_policy = "on-failure" .expect("merged user config") .get("approval_policy") .and_then(toml::Value::as_str), - Some("on-failure") + Some("on-request") ); } @@ -107,7 +107,7 @@ fn with_user_config_updates_matching_user_layer_without_replacing_active_profile file: profile_file.clone(), profile: Some("work".to_string()), }, - toml::from_str(r#"approval_policy = "on-failure""#).expect("profile config"), + toml::from_str(r#"approval_policy = "on-request""#).expect("profile config"), ); let stack = ConfigLayerStack::new( vec![base_layer, profile_layer], @@ -136,6 +136,6 @@ fn with_user_config_updates_matching_user_layer_without_replacing_active_profile .expect("merged user config") .get("approval_policy") .and_then(toml::Value::as_str), - Some("on-failure") + Some("on-request") ); } diff --git a/codex-rs/core-plugins/src/manager.rs b/codex-rs/core-plugins/src/manager.rs index 19b48b2c01..e60ce50344 100644 --- a/codex-rs/core-plugins/src/manager.rs +++ b/codex-rs/core-plugins/src/manager.rs @@ -708,6 +708,37 @@ impl PluginsManager { remote_installed_plugins_to_config(plugins, &self.store) } + fn remote_plugin_id_for(&self, plugin_id: &PluginId) -> Option { + let cached_remote_plugin_id = { + let cache = match self.remote_installed_plugins_cache.read() { + Ok(cache) => cache, + Err(err) => err.into_inner(), + }; + cache.as_ref().and_then(|plugins| { + plugins.iter().find_map(|plugin| { + (plugin.name == plugin_id.plugin_name + && plugin.marketplace_name == plugin_id.marketplace_name) + .then(|| plugin.id.clone()) + }) + }) + }; + if cached_remote_plugin_id.is_some() { + return cached_remote_plugin_id; + } + + match self.store.remote_plugin_id(plugin_id) { + Ok(remote_plugin_id) => remote_plugin_id, + Err(err) => { + tracing::warn!( + plugin_id = %plugin_id.as_key(), + error = %err, + "failed to read persisted remote plugin identity" + ); + None + } + } + } + pub async fn telemetry_metadata_for_installed_plugin( &self, plugin_id: &PluginId, @@ -739,8 +770,8 @@ impl PluginsManager { plugin_id: &PluginId, ) -> PluginTelemetryMetadata { PluginTelemetryMetadata { - plugin_id: plugin_id.clone(), - remote_plugin_id: None, + plugin_id: Some(plugin_id.clone()), + remote_plugin_id: self.remote_plugin_id_for(plugin_id), capability_summary: None, } } @@ -762,8 +793,8 @@ impl PluginsManager { ) -> Option { let plugin_id = PluginId::parse(&summary.config_name).ok()?; Some(PluginTelemetryMetadata { - plugin_id, - remote_plugin_id: None, + remote_plugin_id: self.remote_plugin_id_for(&plugin_id), + plugin_id: Some(plugin_id), capability_summary: Some(summary.clone()), }) } diff --git a/codex-rs/core-plugins/src/manager_tests.rs b/codex-rs/core-plugins/src/manager_tests.rs index adf721fc6e..3dfcc2aa8b 100644 --- a/codex-rs/core-plugins/src/manager_tests.rs +++ b/codex-rs/core-plugins/src/manager_tests.rs @@ -859,7 +859,7 @@ async fn installed_plugin_telemetry_metadata_collects_capabilities() { assert_eq!( metadata, PluginTelemetryMetadata { - plugin_id, + plugin_id: Some(plugin_id), remote_plugin_id: None, capability_summary: Some(PluginCapabilitySummary { config_name: "sample@test".to_string(), @@ -873,6 +873,71 @@ async fn installed_plugin_telemetry_metadata_collects_capabilities() { ); } +#[tokio::test] +async fn installed_plugin_telemetry_metadata_resolves_persisted_remote_identity() { + let codex_home = TempDir::new().unwrap(); + write_cached_plugin(codex_home.path(), "openai-curated-remote", "linear"); + let plugin_id = + PluginId::parse("linear@openai-curated-remote").expect("plugin id should parse"); + PluginStore::new(codex_home.path().to_path_buf()) + .write_remote_plugin_id(&plugin_id, "plugins~Plugin_linear") + .expect("persist remote plugin id"); + let manager = PluginsManager::new(codex_home.path().to_path_buf()); + + let metadata = manager + .telemetry_metadata_for_installed_plugin(&plugin_id) + .await; + + assert_eq!( + metadata, + PluginTelemetryMetadata { + plugin_id: Some(plugin_id), + remote_plugin_id: Some("plugins~Plugin_linear".to_string()), + capability_summary: Some(PluginCapabilitySummary { + config_name: "linear@openai-curated-remote".to_string(), + display_name: "linear".to_string(), + description: None, + has_skills: true, + mcp_server_names: Vec::new(), + app_connector_ids: Vec::new(), + }), + } + ); +} + +#[tokio::test] +async fn installed_plugin_telemetry_metadata_prefers_remote_snapshot_identity() { + let codex_home = TempDir::new().unwrap(); + write_cached_plugin(codex_home.path(), "openai-curated-remote", "linear"); + let plugin_id = + PluginId::parse("linear@openai-curated-remote").expect("plugin id should parse"); + PluginStore::new(codex_home.path().to_path_buf()) + .write_remote_plugin_id(&plugin_id, "plugins~Plugin_stale") + .expect("persist remote plugin id"); + let manager = PluginsManager::new(codex_home.path().to_path_buf()); + manager.write_remote_installed_plugins_cache(vec![remote_installed_linear_plugin()]); + + let metadata = manager + .telemetry_metadata_for_installed_plugin(&plugin_id) + .await; + + assert_eq!( + metadata, + PluginTelemetryMetadata { + plugin_id: Some(plugin_id), + remote_plugin_id: Some("plugins~Plugin_linear".to_string()), + capability_summary: Some(PluginCapabilitySummary { + config_name: "linear@openai-curated-remote".to_string(), + display_name: "linear".to_string(), + description: None, + has_skills: true, + mcp_server_names: Vec::new(), + app_connector_ids: Vec::new(), + }), + } + ); +} + #[tokio::test] async fn installed_plugin_telemetry_metadata_accepts_authoritative_remote_identity() { let codex_home = TempDir::new().unwrap(); @@ -887,7 +952,7 @@ async fn installed_plugin_telemetry_metadata_accepts_authoritative_remote_identi assert_eq!( metadata, PluginTelemetryMetadata { - plugin_id, + plugin_id: Some(plugin_id), remote_plugin_id: Some("plugins~Plugin_linear".to_string()), capability_summary: None, } @@ -912,14 +977,46 @@ fn capability_summary_telemetry_metadata_uses_local_identity() { assert_eq!( metadata, Some(PluginTelemetryMetadata { - plugin_id: PluginId::parse("linear@openai-curated-remote") - .expect("plugin id should parse"), + plugin_id: Some( + PluginId::parse("linear@openai-curated-remote").expect("plugin id should parse"), + ), remote_plugin_id: None, capability_summary: Some(summary), }) ); } +#[test] +fn capability_summary_telemetry_metadata_resolves_persisted_remote_identity() { + let codex_home = TempDir::new().unwrap(); + write_cached_plugin(codex_home.path(), "openai-curated-remote", "linear"); + let plugin_id = + PluginId::parse("linear@openai-curated-remote").expect("plugin id should parse"); + PluginStore::new(codex_home.path().to_path_buf()) + .write_remote_plugin_id(&plugin_id, "plugins~Plugin_linear") + .expect("persist remote plugin id"); + let manager = PluginsManager::new(codex_home.path().to_path_buf()); + let summary = PluginCapabilitySummary { + config_name: "linear@openai-curated-remote".to_string(), + display_name: "Linear".to_string(), + description: Some("Track work".to_string()), + has_skills: true, + mcp_server_names: vec!["linear".to_string()], + app_connector_ids: vec![AppConnectorId("linear-app".to_string())], + }; + + let metadata = manager.telemetry_metadata_for_capability_summary(&summary); + + assert_eq!( + metadata, + Some(PluginTelemetryMetadata { + plugin_id: Some(plugin_id), + remote_plugin_id: Some("plugins~Plugin_linear".to_string()), + capability_summary: Some(summary), + }) + ); +} + #[tokio::test] async fn remote_installed_cache_prefers_local_curated_conflicts_when_remote_plugin_disabled() { let codex_home = TempDir::new().unwrap(); diff --git a/codex-rs/core-plugins/src/remote.rs b/codex-rs/core-plugins/src/remote.rs index 05ce110953..506b943b1e 100644 --- a/codex-rs/core-plugins/src/remote.rs +++ b/codex-rs/core-plugins/src/remote.rs @@ -12,8 +12,10 @@ use codex_login::CodexAuth; use codex_login::default_client::build_reqwest_client; use codex_plugin::AppConnectorId; use codex_plugin::AppDeclaration; +use codex_plugin::PluginCapabilitySummary; use codex_plugin::PluginId; use codex_plugin::app_connector_ids_from_declarations; +use codex_plugin::prompt_safe_plugin_description; use codex_utils_absolute_path::AbsolutePathBuf; use reqwest::RequestBuilder; use serde::Deserialize; @@ -120,6 +122,13 @@ pub struct RemotePluginServiceConfig { pub chatgpt_base_url: String, } +#[derive(Debug, Clone, PartialEq, Eq)] +pub struct RemotePluginUninstallTarget { + pub plugin_id: PluginId, + pub remote_plugin_id: String, + pub fallback_capability_summary: PluginCapabilitySummary, +} + #[derive(Debug, Clone, PartialEq)] pub struct RemoteMarketplace { pub name: String, @@ -1304,40 +1313,90 @@ pub async fn install_remote_plugin( }) } +pub async fn resolve_remote_plugin_uninstall_target( + config: &RemotePluginServiceConfig, + auth: Option<&CodexAuth>, + remote_plugin_id: &str, +) -> Result { + let auth = ensure_chatgpt_auth(auth)?; + let plugin = fetch_plugin_detail( + config, + auth, + remote_plugin_id, + /*include_download_urls*/ false, + ) + .await?; + let marketplace_name = remote_plugin_canonical_marketplace_name(&plugin)?.to_string(); + let plugin_id = PluginId::new(plugin.name.clone(), marketplace_name).map_err(|err| { + RemotePluginCatalogError::UnexpectedResponse(format!( + "invalid local plugin id for remote plugin `{}`: {err}", + plugin.id + )) + })?; + let app_declarations = plugin + .release + .app_manifest + .as_ref() + .map(plugin_app_declarations_from_value) + .unwrap_or_else(|| app_declarations_from_remote_app_ids(&plugin.release.app_ids)); + let mut mcp_server_names = plugin + .release + .mcp_servers + .iter() + .map(|server| server.key.clone()) + .collect::>(); + mcp_server_names.sort_unstable(); + mcp_server_names.dedup(); + let fallback_capability_summary = PluginCapabilitySummary { + config_name: plugin_id.as_key(), + display_name: plugin.release.display_name, + description: prompt_safe_plugin_description(Some(&plugin.release.description)), + has_skills: !plugin.release.skills.is_empty(), + mcp_server_names, + app_connector_ids: app_connector_ids_from_declarations(&app_declarations), + }; + Ok(RemotePluginUninstallTarget { + plugin_id, + remote_plugin_id: plugin.id, + fallback_capability_summary, + }) +} + pub async fn uninstall_remote_plugin( config: &RemotePluginServiceConfig, auth: Option<&CodexAuth>, codex_home: PathBuf, - plugin_id: &str, + target: RemotePluginUninstallTarget, ) -> Result<(), RemotePluginCatalogError> { let auth = ensure_chatgpt_auth(auth)?; - let plugin = fetch_plugin_detail( - config, auth, plugin_id, /*include_download_urls*/ false, - ) - .await?; - let marketplace_name = remote_plugin_canonical_marketplace_name(&plugin)?.to_string(); - let plugin_name = plugin.name; + let RemotePluginUninstallTarget { + plugin_id, + remote_plugin_id, + fallback_capability_summary: _, + } = target; + let marketplace_name = plugin_id.marketplace_name.clone(); + let plugin_name = plugin_id.plugin_name.clone(); let base_url = config.chatgpt_base_url.trim_end_matches('/'); - let url = format!("{base_url}/ps/plugins/{plugin_id}/uninstall"); + let url = format!("{base_url}/ps/plugins/{remote_plugin_id}/uninstall"); let client = build_reqwest_client(); let request = authenticated_request(client.post(&url), auth)?; let response: RemotePluginMutationResponse = send_and_decode(request, &url).await?; - if response.id != plugin_id { + if response.id != remote_plugin_id { return Err(RemotePluginCatalogError::UnexpectedPluginId { - expected: plugin_id.to_string(), + expected: remote_plugin_id, actual: response.id, }); } if response.enabled { return Err(RemotePluginCatalogError::UnexpectedEnabledState { - plugin_id: plugin_id.to_string(), + plugin_id: response.id, expected_enabled: false, actual_enabled: response.enabled, }); } - let legacy_plugin_id = plugin_id.to_string(); + let legacy_plugin_id = response.id; tokio::task::spawn_blocking(move || { remove_remote_plugin_cache(codex_home, marketplace_name, plugin_name, legacy_plugin_id) }) diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json index 31dcc667d1..5458f42671 100644 --- a/codex-rs/core/config.schema.json +++ b/codex-rs/core/config.schema.json @@ -252,13 +252,6 @@ ], "type": "string" }, - { - "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.", - "enum": [ - "on-failure" - ], - "type": "string" - }, { "description": "The model decides when to ask the user for approval.", "enum": [ @@ -826,7 +819,7 @@ "enabled": { "type": "boolean" }, - "reminder_interval_model_requests": { + "reminder_interval_seconds": { "format": "uint64", "minimum": 1.0, "type": "integer" diff --git a/codex-rs/core/gpt_5_1_prompt.md b/codex-rs/core/gpt_5_1_prompt.md index 440422ae6a..da2ec674f7 100644 --- a/codex-rs/core/gpt_5_1_prompt.md +++ b/codex-rs/core/gpt_5_1_prompt.md @@ -171,7 +171,7 @@ For all of testing, running, building, and formatting, do not attempt to fix unr Be mindful of whether to run validation commands proactively. In the absence of behavioral guidance: -- When running in non-interactive approval modes like **never** or **on-failure**, you can proactively run tests, lint and do whatever you need to ensure you've completed the task. If you are unable to run tests, you must still do your utmost best to complete the task. +- When running in the non-interactive approval mode **never**, you can proactively run tests, lint and do whatever you need to ensure you've completed the task. If you are unable to run tests, you must still do your utmost best to complete the task. - When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first. - When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task. diff --git a/codex-rs/core/gpt_5_2_prompt.md b/codex-rs/core/gpt_5_2_prompt.md index 7dd684bf06..8aa188f5e1 100644 --- a/codex-rs/core/gpt_5_2_prompt.md +++ b/codex-rs/core/gpt_5_2_prompt.md @@ -145,7 +145,7 @@ For all of testing, running, building, and formatting, do not attempt to fix unr Be mindful of whether to run validation commands proactively. In the absence of behavioral guidance: -- When running in non-interactive approval modes like **never** or **on-failure**, you can proactively run tests, lint and do whatever you need to ensure you've completed the task. If you are unable to run tests, you must still do your utmost best to complete the task. +- When running in the non-interactive approval mode **never**, you can proactively run tests, lint and do whatever you need to ensure you've completed the task. If you are unable to run tests, you must still do your utmost best to complete the task. - When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first. - When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task. diff --git a/codex-rs/core/prompt_with_apply_patch_instructions.md b/codex-rs/core/prompt_with_apply_patch_instructions.md index f9c308fbd1..2650c6709c 100644 --- a/codex-rs/core/prompt_with_apply_patch_instructions.md +++ b/codex-rs/core/prompt_with_apply_patch_instructions.md @@ -158,7 +158,7 @@ For all of testing, running, building, and formatting, do not attempt to fix unr Be mindful of whether to run validation commands proactively. In the absence of behavioral guidance: -- When running in non-interactive approval modes like **never** or **on-failure**, proactively run tests, lint and do whatever you need to ensure you've completed the task. +- When running in the non-interactive approval mode **never**, proactively run tests, lint and do whatever you need to ensure you've completed the task. - When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first. - When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task. diff --git a/codex-rs/core/src/agent/control/spawn.rs b/codex-rs/core/src/agent/control/spawn.rs index 05fac6aaf3..e208b418d3 100644 --- a/codex-rs/core/src/agent/control/spawn.rs +++ b/codex-rs/core/src/agent/control/spawn.rs @@ -41,7 +41,8 @@ fn keep_forked_rollout_item(item: &RolloutItem, preserve_reference_context_item: _ => false, }, RolloutItem::ResponseItem( - ResponseItem::AgentMessage { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::AgentMessage { .. } | ResponseItem::Reasoning { .. } | ResponseItem::LocalShellCall { .. } | ResponseItem::FunctionCall { .. } @@ -142,7 +143,7 @@ impl AgentControl { .items; let initial_history = InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history, + history: Arc::new(history), rollout_path: stored_thread.rollout_path, }); if initial_history.get_multi_agent_version() != Some(MultiAgentVersion::V2) { @@ -625,7 +626,7 @@ impl AgentControl { .items; let initial_history = InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history, + history: Arc::new(history), rollout_path: stored_thread.rollout_path, }); let parent_thread_id = stored_thread.parent_thread_id; diff --git a/codex-rs/core/src/client.rs b/codex-rs/core/src/client.rs index 8ebea984d6..9e240e968d 100644 --- a/codex-rs/core/src/client.rs +++ b/codex-rs/core/src/client.rs @@ -73,6 +73,7 @@ use codex_otel::current_span_w3c_trace_context; use codex_protocol::ThreadId; use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig; use codex_protocol::config_types::Verbosity as VerbosityConfig; +use codex_protocol::models::ContentItem; use codex_protocol::models::ResponseItem; use codex_protocol::openai_models::ModelInfo; use codex_protocol::openai_models::ReasoningEffort as ReasoningEffortConfig; @@ -162,6 +163,19 @@ pub(crate) struct CompactConversationRequestSettings { pub(crate) service_tier: Option, } +fn session_telemetry_for_request( + session_telemetry: &SessionTelemetry, + request: &ResponsesApiRequest, +) -> SessionTelemetry { + session_telemetry.clone().with_inference_request( + request.service_tier.as_deref(), + request + .reasoning + .as_ref() + .and_then(|reasoning| reasoning.effort.as_ref()), + ) +} + /// Session-scoped state shared by all [`ModelClient`] clones. /// /// This is intentionally kept minimal so `ModelClient` does not need to hold a full `Config`. Most @@ -777,7 +791,6 @@ impl ModelClient { service_tier: Option, responses_metadata: &CodexResponsesMetadata, ) -> Result { - let instructions = &prompt.base_instructions.text; let mut input = prompt.get_formatted_input_for_request(model_info.use_responses_lite); if !self.state.provider.info().is_openai() { input @@ -785,6 +798,28 @@ impl ModelClient { .for_each(ResponseItem::clear_internal_chat_message_metadata_passthrough); } let tools = create_tools_json_for_responses_api(&prompt.tools)?; + let (instructions, tools) = if model_info.use_responses_lite { + let mut prefix = vec![ResponseItem::AdditionalTools { + id: None, + role: "developer".to_string(), + tools, + }]; + if !prompt.base_instructions.text.is_empty() { + prefix.push(ResponseItem::Message { + id: None, + role: "developer".to_string(), + content: vec![ContentItem::InputText { + text: prompt.base_instructions.text.clone(), + }], + phase: None, + internal_chat_message_metadata_passthrough: None, + }); + } + input.splice(0..0, prefix); + (String::new(), None) + } else { + (prompt.base_instructions.text.clone(), Some(tools)) + }; let reasoning = Self::build_reasoning(model_info, effort, summary); let include = if reasoning.is_some() { vec!["reasoning.encrypted_content".to_string()] @@ -811,7 +846,7 @@ impl ModelClient { let service_tier = model_info.service_tier_for_request(service_tier); let request = ResponsesApiRequest { model: model_info.slug.clone(), - instructions: instructions.clone(), + instructions, input, tools, tool_choice: "auto".to_string(), @@ -1319,6 +1354,8 @@ impl ModelClientSession { let store = request.store; self.client .prepare_response_items_for_request(&mut request.input, store); + let request_session_telemetry = + session_telemetry_for_request(session_telemetry, &request); let inference_trace_attempt = inference_trace.start_attempt(); inference_trace_attempt.add_request_headers(&mut options.extra_headers); inference_trace_attempt.record_started(&request); @@ -1334,7 +1371,7 @@ impl ModelClientSession { Ok(stream) => { let (stream, _) = map_response_stream( stream, - session_telemetry.clone(), + request_session_telemetry, inference_trace_attempt, Arc::clone(&self.client.state.provider), ); @@ -1426,6 +1463,12 @@ impl ModelClientSession { service_tier.clone(), responses_metadata, )?; + let request_session_telemetry = if warmup { + // `generate=false` prewarm is connection setup, not an inference request. + session_telemetry.clone() + } else { + session_telemetry_for_request(session_telemetry, &request) + }; let mut client_metadata = self .client .build_ws_client_metadata(responses_metadata, model_info.use_responses_lite); @@ -1529,7 +1572,7 @@ impl ModelClientSession { })?; let (stream, last_request_rx) = map_response_stream( stream_result, - session_telemetry.clone(), + request_session_telemetry, inference_trace_attempt, Arc::clone(&self.client.state.provider), ); diff --git a/codex-rs/core/src/client_common.rs b/codex-rs/core/src/client_common.rs index e0c2ff03c3..54ad70daaa 100644 --- a/codex-rs/core/src/client_common.rs +++ b/codex-rs/core/src/client_common.rs @@ -83,7 +83,8 @@ fn strip_image_details(items: &mut [ResponseItem]) { } } } - ResponseItem::Reasoning { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::Reasoning { .. } | ResponseItem::AgentMessage { .. } | ResponseItem::LocalShellCall { .. } | ResponseItem::FunctionCall { .. } diff --git a/codex-rs/core/src/client_common_tests.rs b/codex-rs/core/src/client_common_tests.rs index 8b25c7e300..38c4aaecb5 100644 --- a/codex-rs/core/src/client_common_tests.rs +++ b/codex-rs/core/src/client_common_tests.rs @@ -110,7 +110,7 @@ fn serializes_text_verbosity_when_set() { model: "gpt-5.4".to_string(), instructions: "i".to_string(), input, - tools, + tools: Some(tools), tool_choice: "auto".to_string(), parallel_tool_calls: true, reasoning: None, @@ -157,7 +157,7 @@ fn serializes_text_schema_with_strict_format() { model: "gpt-5.4".to_string(), instructions: "i".to_string(), input, - tools, + tools: Some(tools), tool_choice: "auto".to_string(), parallel_tool_calls: true, reasoning: None, @@ -218,7 +218,7 @@ fn omits_text_when_not_set() { model: "gpt-5.4".to_string(), instructions: "i".to_string(), input, - tools, + tools: Some(tools), tool_choice: "auto".to_string(), parallel_tool_calls: true, reasoning: None, @@ -241,7 +241,7 @@ fn serializes_flex_service_tier_when_set() { model: "gpt-5.4".to_string(), instructions: "i".to_string(), input: vec![], - tools: vec![], + tools: Some(vec![]), tool_choice: "auto".to_string(), parallel_tool_calls: true, reasoning: None, diff --git a/codex-rs/core/src/compact.rs b/codex-rs/core/src/compact.rs index c60bd155e8..d049fd49f8 100644 --- a/codex-rs/core/src/compact.rs +++ b/codex-rs/core/src/compact.rs @@ -4,6 +4,7 @@ use std::time::Instant; use crate::Prompt; use crate::client::ModelClientSession; use crate::client_common::ResponseEvent; +use crate::context::world_state::WorldState; use crate::hook_runtime::PostCompactHookOutcome; use crate::hook_runtime::PreCompactHookOutcome; use crate::hook_runtime::run_post_compact_hooks; @@ -60,12 +61,29 @@ const COMPACT_USER_MESSAGE_MAX_TOKENS: usize = 20_000; /// Mid-turn compaction must use `BeforeLastUserMessage` because the model is trained to see the /// compaction summary as the last item in history after mid-turn compaction; we therefore inject /// initial context into the replacement history just above the last real user message. -#[derive(Clone, Copy, Debug, Eq, PartialEq)] +#[derive(Debug)] pub(crate) enum InitialContextInjection { - BeforeLastUserMessage, + BeforeLastUserMessage(Arc), DoNotInject, } +pub(crate) async fn build_compaction_initial_context( + sess: &Session, + turn_context: &TurnContext, + initial_context_injection: &InitialContextInjection, +) -> (Vec, Option>) { + // Return the rendered state with its items so history and its baseline stay identical. + match initial_context_injection { + InitialContextInjection::BeforeLastUserMessage(world_state) => { + let items = sess + .build_initial_context_with_world_state(turn_context, world_state.as_ref()) + .await; + (items, Some(Arc::clone(world_state))) + } + InitialContextInjection::DoNotInject => (Vec::new(), None), + } +} + pub(crate) fn should_use_remote_compact_task(provider: &ModelProviderInfo) -> bool { provider.supports_remote_compaction() } @@ -309,17 +327,21 @@ async fn run_compact_task_inner_impl( } let (window_number, window_ids) = sess.advance_auto_compact_window().await; - if matches!( - initial_context_injection, - InitialContextInjection::BeforeLastUserMessage - ) { - let initial_context = sess.build_initial_context(turn_context.as_ref()).await; + let (initial_context, world_state_baseline) = build_compaction_initial_context( + sess.as_ref(), + turn_context.as_ref(), + &initial_context_injection, + ) + .await; + if !initial_context.is_empty() { new_history = insert_initial_context_before_last_real_user_or_summary(new_history, initial_context); } let reference_context_item = match initial_context_injection { InitialContextInjection::DoNotInject => None, - InitialContextInjection::BeforeLastUserMessage => Some(turn_context.to_turn_context_item()), + InitialContextInjection::BeforeLastUserMessage(_) => { + Some(turn_context.to_turn_context_item()) + } }; let compacted_item = CompactedItem { message: summary_text.clone(), @@ -333,6 +355,7 @@ async fn run_compact_task_inner_impl( turn_context.as_ref(), new_history, reference_context_item, + world_state_baseline, compacted_item, ) .await; diff --git a/codex-rs/core/src/compact_remote.rs b/codex-rs/core/src/compact_remote.rs index 3d23140684..f9c5e656b1 100644 --- a/codex-rs/core/src/compact_remote.rs +++ b/codex-rs/core/src/compact_remote.rs @@ -6,8 +6,10 @@ use crate::client::CompactConversationRequestSettings; use crate::compact::CompactionAnalyticsAttempt; use crate::compact::CompactionAnalyticsDetails; use crate::compact::InitialContextInjection; +use crate::compact::build_compaction_initial_context; use crate::compact::compaction_status_from_result; use crate::compact::insert_initial_context_before_last_real_user_or_summary; +use crate::context::world_state::WorldState; use crate::context_manager::ContextManager; use crate::hook_runtime::PostCompactHookOutcome; use crate::hook_runtime::PreCompactHookOutcome; @@ -237,7 +239,7 @@ async fn run_remote_compact_task_inner_impl( window_id, CodexResponsesRequestKind::Compaction(compaction_metadata), ); - let mut new_history = sess + let new_history = sess .services .model_client .compact_conversation_history( @@ -259,17 +261,19 @@ async fn run_remote_compact_task_inner_impl( ) .await?; let (new_window_number, new_window_ids) = sess.advance_auto_compact_window().await; - new_history = process_compacted_history( + let (new_history, world_state_baseline) = process_compacted_history( sess.as_ref(), turn_context.as_ref(), new_history, - initial_context_injection, + &initial_context_injection, ) .await; let reference_context_item = match initial_context_injection { InitialContextInjection::DoNotInject => None, - InitialContextInjection::BeforeLastUserMessage => Some(turn_context.to_turn_context_item()), + InitialContextInjection::BeforeLastUserMessage(_) => { + Some(turn_context.to_turn_context_item()) + } }; let compacted_item = CompactedItem { message: String::new(), @@ -290,6 +294,7 @@ async fn run_remote_compact_task_inner_impl( turn_context.as_ref(), new_history, reference_context_item, + world_state_baseline, compacted_item, ) .await; @@ -304,22 +309,19 @@ pub(crate) async fn process_compacted_history( sess: &Session, turn_context: &TurnContext, mut compacted_history: Vec, - initial_context_injection: InitialContextInjection, -) -> Vec { + initial_context_injection: &InitialContextInjection, +) -> (Vec, Option>) { // Mid-turn compaction is the only path that must inject initial context above the last user // message in the replacement history. Pre-turn compaction instead injects context after the // compaction item, but mid-turn compaction keeps the compaction item last for model training. - let initial_context = if matches!( - initial_context_injection, - InitialContextInjection::BeforeLastUserMessage - ) { - sess.build_initial_context(turn_context).await - } else { - Vec::new() - }; + let (initial_context, world_state_baseline) = + build_compaction_initial_context(sess, turn_context, initial_context_injection).await; compacted_history.retain(should_keep_compacted_history_item); - insert_initial_context_before_last_real_user_or_summary(compacted_history, initial_context) + ( + insert_initial_context_before_last_real_user_or_summary(compacted_history, initial_context), + world_state_baseline, + ) } /// Returns whether an item from remote compaction output should be preserved. @@ -352,7 +354,8 @@ pub(crate) fn should_keep_compacted_history_item(item: &ResponseItem) -> bool { ResponseItem::AgentMessage { .. } => true, ResponseItem::Compaction { .. } | ResponseItem::ContextCompaction { .. } => true, ResponseItem::CompactionTrigger { .. } => false, - ResponseItem::Reasoning { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::Reasoning { .. } | ResponseItem::LocalShellCall { .. } | ResponseItem::FunctionCall { .. } | ResponseItem::ToolSearchCall { .. } diff --git a/codex-rs/core/src/compact_remote_v2.rs b/codex-rs/core/src/compact_remote_v2.rs index 54d139a0e1..192e5527d5 100644 --- a/codex-rs/core/src/compact_remote_v2.rs +++ b/codex-rs/core/src/compact_remote_v2.rs @@ -165,18 +165,18 @@ async fn run_remote_compact_task_inner( attempt .track(sess.as_ref(), status, codex_error, analytics_details) .await; - if matches!(&result, Err(CodexErr::TurnAborted)) { - return result; + match result { + Ok(()) => Ok(()), + Err(err @ CodexErr::TurnAborted) => Err(err), + Err(err) => { + sess.track_turn_codex_error(turn_context, &err); + let event = EventMsg::Error( + err.to_error_event(Some("Error running remote compact task".to_string())), + ); + sess.send_event(turn_context, event).await; + Err(err) + } } - if let Err(err) = result { - sess.track_turn_codex_error(turn_context, &err); - let event = EventMsg::Error( - err.to_error_event(Some("Error running remote compact task".to_string())), - ); - sess.send_event(turn_context, event).await; - return Err(err); - } - Ok(()) } async fn run_remote_compact_task_inner_impl( @@ -293,17 +293,19 @@ async fn run_remote_compact_task_inner_impl( build_v2_compacted_history(&prompt_input, compaction_output); analytics_details.retained_image_count = Some(retained_images); let (new_window_number, new_window_ids) = sess.advance_auto_compact_window().await; - let new_history = process_compacted_history( + let (new_history, world_state_baseline) = process_compacted_history( sess.as_ref(), turn_context.as_ref(), compacted_history, - initial_context_injection, + &initial_context_injection, ) .await; let reference_context_item = match initial_context_injection { InitialContextInjection::DoNotInject => None, - InitialContextInjection::BeforeLastUserMessage => Some(turn_context.to_turn_context_item()), + InitialContextInjection::BeforeLastUserMessage(_) => { + Some(turn_context.to_turn_context_item()) + } }; let compacted_item = CompactedItem { message: String::new(), @@ -321,6 +323,7 @@ async fn run_remote_compact_task_inner_impl( turn_context.as_ref(), new_history, reference_context_item, + world_state_baseline, compacted_item, ) .await; diff --git a/codex-rs/core/src/compact_tests.rs b/codex-rs/core/src/compact_tests.rs index bb6adf643d..19ca75b180 100644 --- a/codex-rs/core/src/compact_tests.rs +++ b/codex-rs/core/src/compact_tests.rs @@ -1,9 +1,11 @@ use super::*; +use crate::session::tests::build_world_state_from_turn_context; use codex_model_provider_info::ModelProviderInfo; use codex_model_provider_info::WireApi; use codex_protocol::models::DEFAULT_IMAGE_DETAIL; use codex_protocol::models::InternalChatMessageMetadataPassthrough; use pretty_assertions::assert_eq; +use std::sync::Arc; async fn process_compacted_history_with_test_session( compacted_history: Vec, @@ -13,12 +15,16 @@ async fn process_compacted_history_with_test_session( session .set_previous_turn_settings(previous_turn_settings.cloned()) .await; - let initial_context = session.build_initial_context(&turn_context).await; - let refreshed = crate::compact_remote::process_compacted_history( + let world_state = Arc::new(build_world_state_from_turn_context(&session, &turn_context).await); + let initial_context = session + .build_initial_context_with_world_state(&turn_context, world_state.as_ref()) + .await; + let initial_context_injection = InitialContextInjection::BeforeLastUserMessage(world_state); + let (refreshed, _) = crate::compact_remote::process_compacted_history( &session, &turn_context, compacted_history, - InitialContextInjection::BeforeLastUserMessage, + &initial_context_injection, ) .await; (refreshed, initial_context) diff --git a/codex-rs/core/src/config/config_loader_tests.rs b/codex-rs/core/src/config/config_loader_tests.rs index 1a9245b1aa..9142ac51de 100644 --- a/codex-rs/core/src/config/config_loader_tests.rs +++ b/codex-rs/core/src/config/config_loader_tests.rs @@ -640,7 +640,7 @@ async fn selected_user_config_file_layers_over_base_user_config() { tmp.path().join(CONFIG_TOML_FILE), r#" model = "gpt-main" -approval_policy = "on-failure" +approval_policy = "on-request" "#, ) .expect("write default user config"); @@ -697,7 +697,7 @@ approval_policy = "on-failure" .effective_config() .get("approval_policy") .and_then(TomlValue::as_str), - Some("on-failure") + Some("on-request") ); } @@ -1033,12 +1033,6 @@ personality = true config_requirements .approval_policy .can_set(&AskForApproval::Never)?; - assert!( - config_requirements - .approval_policy - .can_set(&AskForApproval::OnFailure) - .is_err() - ); assert_eq!( config_requirements.web_search_mode.value(), WebSearchMode::Cached diff --git a/codex-rs/core/src/config/config_tests.rs b/codex-rs/core/src/config/config_tests.rs index 67cb0932de..f098084609 100644 --- a/codex-rs/core/src/config/config_tests.rs +++ b/codex-rs/core/src/config/config_tests.rs @@ -620,11 +620,11 @@ current_time_reminder = true r#" [features.current_time_reminder] enabled = true -reminder_interval_model_requests = 4 +reminder_interval_seconds = 4 clock_source = "external" "#, CurrentTimeReminderConfig { - reminder_interval_model_requests: 4, + reminder_interval_seconds: 4, clock_source: CurrentTimeSource::External, }, ), @@ -642,7 +642,7 @@ async fn load_config_rejects_zero_current_time_reminder_interval() -> std::io::R r#" [features.current_time_reminder] enabled = true -reminder_interval_model_requests = 0 +reminder_interval_seconds = 0 "#, ) .await @@ -651,7 +651,7 @@ reminder_interval_model_requests = 0 assert_eq!(error.kind(), std::io::ErrorKind::InvalidInput); assert_eq!( error.to_string(), - "features.current_time_reminder.reminder_interval_model_requests must be positive" + "features.current_time_reminder.reminder_interval_seconds must be positive" ); Ok(()) } @@ -8272,7 +8272,7 @@ model_provider = "openai-custom" [profiles.zdr] model = "o3" model_provider = "openai" -approval_policy = "on-failure" +approval_policy = "on-request" [profiles.zdr.analytics] enabled = false @@ -8280,7 +8280,7 @@ enabled = false [profiles.gpt5] model = "gpt-5.4" model_provider = "openai" -approval_policy = "on-failure" +approval_policy = "on-request" model_reasoning_effort = "high" model_reasoning_summary = "detailed" model_verbosity = "high" diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs index 953d0af1a1..923dd67582 100644 --- a/codex-rs/core/src/config/mod.rs +++ b/codex-rs/core/src/config/mod.rs @@ -246,7 +246,8 @@ Payload: ``` You may also see them addressed as to=/root/..., which indicates your identity is /root/... "#; -const DEFAULT_MULTI_AGENT_V2_SHARED_USAGE_HINT_TEXT: &str = r#"Note that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.spawn_agent` without a configured namespace or `to=functions.agents.spawn_agent` with `tool_namespace = "agents"`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message. +const DEFAULT_MULTI_AGENT_V2_TOOL_NAMESPACE: &str = "collaboration"; +const DEFAULT_MULTI_AGENT_V2_SHARED_USAGE_HINT_TEXT: &str = r#"Note that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.collaboration.spawn_agent`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message. All agents share the same directory. In detail: - All agents have access to the same container and filesystem as you. @@ -1114,14 +1115,14 @@ pub struct RolloutBudgetConfig { #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)] pub struct CurrentTimeReminderConfig { - pub reminder_interval_model_requests: u64, + pub reminder_interval_seconds: u64, pub clock_source: CurrentTimeSource, } impl Default for CurrentTimeReminderConfig { fn default() -> Self { Self { - reminder_interval_model_requests: 1, + reminder_interval_seconds: 1, clock_source: CurrentTimeSource::System, } } @@ -1157,7 +1158,7 @@ impl MultiAgentV2Config { DEFAULT_MULTI_AGENT_V2_SUBAGENT_USAGE_HINT_TEXT, max_concurrent_threads_per_session, )), - tool_namespace: None, + tool_namespace: Some(DEFAULT_MULTI_AGENT_V2_TOOL_NAMESPACE.to_string()), hide_spawn_agent_metadata: true, non_code_mode_only: true, } @@ -2656,18 +2657,18 @@ fn resolve_current_time_reminder_config( let base = current_time_reminder_toml_config(config_toml.features.as_ref()); let default = CurrentTimeReminderConfig::default(); - let reminder_interval_model_requests = base - .and_then(|config| config.reminder_interval_model_requests) - .unwrap_or(default.reminder_interval_model_requests); - if reminder_interval_model_requests == 0 { + let reminder_interval_seconds = base + .and_then(|config| config.reminder_interval_seconds) + .unwrap_or(default.reminder_interval_seconds); + if reminder_interval_seconds == 0 { return Err(std::io::Error::new( std::io::ErrorKind::InvalidInput, - "features.current_time_reminder.reminder_interval_model_requests must be positive", + "features.current_time_reminder.reminder_interval_seconds must be positive", )); } Ok(Some(CurrentTimeReminderConfig { - reminder_interval_model_requests, + reminder_interval_seconds, clock_source: base .and_then(|config| config.clock_source) .unwrap_or(default.clock_source), diff --git a/codex-rs/core/src/connectors.rs b/codex-rs/core/src/connectors.rs index 86e5f07f9a..87c3097162 100644 --- a/codex-rs/core/src/connectors.rs +++ b/codex-rs/core/src/connectors.rs @@ -40,7 +40,6 @@ use codex_mcp::ToolPluginProvenance; use codex_mcp::codex_apps_tools_cache_key; use codex_mcp::compute_auth_statuses; use codex_mcp::effective_mcp_servers; -use codex_mcp::host_owned_codex_apps_enabled; use codex_mcp::tool_plugin_provenance; const CONNECTORS_READY_TIMEOUT_ON_EMPTY_TOOLS: Duration = Duration::from_secs(30); @@ -240,7 +239,6 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_mcp_manager( let mut mcp_servers = effective_mcp_servers(&mcp_config, auth.as_ref()); mcp_servers.retain(|name, _| name == CODEX_APPS_MCP_SERVER_NAME); - let host_owned_codex_apps_enabled = host_owned_codex_apps_enabled(&mcp_config, auth.as_ref()); if mcp_servers.is_empty() { return Ok(AccessibleConnectorsStatus { connectors: Vec::new(), @@ -275,7 +273,6 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_mcp_manager( McpRuntimeContext::new(environment_manager, config.cwd.to_path_buf()), config.codex_home.to_path_buf(), codex_apps_tools_cache_key(auth.as_ref()), - host_owned_codex_apps_enabled, mcp_config.prefix_mcp_tool_names, mcp_config.client_elicitation_capability, /*supports_openai_form_elicitation*/ false, diff --git a/codex-rs/core/src/context/world_state/environment.rs b/codex-rs/core/src/context/world_state/environment.rs index 589e8dbadf..d6e3284667 100644 --- a/codex-rs/core/src/context/world_state/environment.rs +++ b/codex-rs/core/src/context/world_state/environment.rs @@ -24,10 +24,6 @@ pub(crate) struct EnvironmentsState { } impl EnvironmentsState { - pub(crate) fn from_turn_context(turn_context: &TurnContext) -> Self { - Self::from_turn_context_with_environments(turn_context, &turn_context.environments) - } - pub(crate) fn from_turn_context_with_environments( turn_context: &TurnContext, environments: &TurnEnvironmentSnapshot, diff --git a/codex-rs/core/src/context_manager/history.rs b/codex-rs/core/src/context_manager/history.rs index 0244f7f96f..daa9e3cd40 100644 --- a/codex-rs/core/src/context_manager/history.rs +++ b/codex-rs/core/src/context_manager/history.rs @@ -86,18 +86,18 @@ impl ContextManager { pub(crate) fn update_world_state( &mut self, - world_state: WorldState, + world_state: Arc, ) -> Vec> { let fragments = self.world_state_baseline.as_deref().map_or_else( || world_state.render_full(), |previous| world_state.render_diff(previous), ); - self.world_state_baseline = Some(Arc::new(world_state)); + self.world_state_baseline = Some(world_state); fragments } - pub(crate) fn set_world_state_baseline(&mut self, world_state: WorldState) { - self.world_state_baseline = Some(Arc::new(world_state)); + pub(crate) fn set_world_state_baseline(&mut self, world_state: Arc) { + self.world_state_baseline = Some(world_state); } pub(crate) fn set_token_usage_full(&mut self, context_window: i64) { @@ -386,7 +386,8 @@ impl ContextManager { output: truncate_function_output_payload(output, policy_with_serialization_budget), internal_chat_message_metadata_passthrough: metadata.clone(), }, - ResponseItem::Message { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::Message { .. } | ResponseItem::AgentMessage { .. } | ResponseItem::Reasoning { .. } | ResponseItem::LocalShellCall { .. } @@ -476,7 +477,8 @@ pub(crate) fn truncate_function_output_payload( fn is_api_message(message: &ResponseItem) -> bool { match message { ResponseItem::Message { role, .. } => role.as_str() != "system", - ResponseItem::AgentMessage { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::AgentMessage { .. } | ResponseItem::FunctionCallOutput { .. } | ResponseItem::FunctionCall { .. } | ResponseItem::ToolSearchCall { .. } @@ -722,7 +724,8 @@ fn is_model_generated_item(item: &ResponseItem) -> bool { | ResponseItem::Compaction { .. } | ResponseItem::ContextCompaction { .. } => true, ResponseItem::CompactionTrigger { .. } => false, - ResponseItem::FunctionCallOutput { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::FunctionCallOutput { .. } | ResponseItem::ToolSearchOutput { .. } | ResponseItem::CustomToolCallOutput { .. } | ResponseItem::AgentMessage { .. } diff --git a/codex-rs/core/src/context_manager/history_tests.rs b/codex-rs/core/src/context_manager/history_tests.rs index da2f14fd4f..7e7f7c3773 100644 --- a/codex-rs/core/src/context_manager/history_tests.rs +++ b/codex-rs/core/src/context_manager/history_tests.rs @@ -32,6 +32,7 @@ use image::Luma; use image::Rgba; use pretty_assertions::assert_eq; use regex_lite::Regex; +use std::sync::Arc; const EXEC_FORMAT_MAX_BYTES: usize = 10_000; const EXEC_FORMAT_MAX_TOKENS: usize = 2_500; @@ -82,7 +83,7 @@ fn world_state_baseline_deduplicates_until_history_is_replaced() { state.add_section(EnvironmentsState::from_turn_context_item( &reference_context_item(), )); - state + Arc::new(state) }; let mut history = ContextManager::new(); diff --git a/codex-rs/core/src/exec.rs b/codex-rs/core/src/exec.rs index 647203db2e..015b20715a 100644 --- a/codex-rs/core/src/exec.rs +++ b/codex-rs/core/src/exec.rs @@ -377,6 +377,7 @@ pub fn build_exec_request( args: args.to_vec(), cwd, env, + managed_network: None, additional_permissions: None, }; let options = ExecOptions { @@ -459,6 +460,7 @@ pub(crate) async fn execute_exec_request( arg0, exec_server_sandbox: _, exec_server_enforce_managed_network: _, + exec_server_managed_network: _, } = exec_request; // TODO(anp): Keep PathUri through the local process launch boundary. diff --git a/codex-rs/core/src/exec_policy.rs b/codex-rs/core/src/exec_policy.rs index 7b33a196b0..d79faba1ac 100644 --- a/codex-rs/core/src/exec_policy.rs +++ b/codex-rs/core/src/exec_policy.rs @@ -177,7 +177,6 @@ pub(crate) fn prompt_is_rejected_by_policy( ) -> Option<&'static str> { match approval_policy { AskForApproval::Never => Some(PROMPT_CONFLICT_REASON), - AskForApproval::OnFailure => None, AskForApproval::OnRequest => None, AskForApproval::UnlessTrusted => None, AskForApproval::Granular(granular_config) => { @@ -689,15 +688,14 @@ pub(crate) fn render_decision_for_unmatched_command( Decision::Forbidden } } - AskForApproval::OnFailure - | AskForApproval::OnRequest + AskForApproval::OnRequest | AskForApproval::UnlessTrusted | AskForApproval::Granular(_) => Decision::Prompt, }; } match approval_policy { - AskForApproval::Never | AskForApproval::OnFailure => { + AskForApproval::Never => { // We allow the command to run, relying on the sandbox for // protection. Decision::Allow diff --git a/codex-rs/core/src/hook_runtime.rs b/codex-rs/core/src/hook_runtime.rs index 96ae6c9908..12627e2d52 100644 --- a/codex-rs/core/src/hook_runtime.rs +++ b/codex-rs/core/src/hook_runtime.rs @@ -738,10 +738,9 @@ fn hook_run_metric_tags(run: &HookRunSummary) -> [(&'static str, &'static str); fn hook_permission_mode(turn_context: &TurnContext) -> String { match turn_context.approval_policy.value() { AskForApproval::Never => "bypassPermissions", - AskForApproval::UnlessTrusted - | AskForApproval::OnFailure - | AskForApproval::OnRequest - | AskForApproval::Granular(_) => "default", + AskForApproval::UnlessTrusted | AskForApproval::OnRequest | AskForApproval::Granular(_) => { + "default" + } } .to_string() } diff --git a/codex-rs/core/src/image_preparation.rs b/codex-rs/core/src/image_preparation.rs index 87ac444df5..111ce9b955 100644 --- a/codex-rs/core/src/image_preparation.rs +++ b/codex-rs/core/src/image_preparation.rs @@ -57,7 +57,8 @@ pub(crate) fn prepare_response_items(items: &mut [ResponseItem]) { prepare_tool_output_content(content); } } - ResponseItem::Reasoning { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::Reasoning { .. } | ResponseItem::AgentMessage { .. } | ResponseItem::LocalShellCall { .. } | ResponseItem::FunctionCall { .. } diff --git a/codex-rs/core/src/mcp_openai_file.rs b/codex-rs/core/src/mcp_openai_file.rs index 4dee0da717..5044568cd6 100644 --- a/codex-rs/core/src/mcp_openai_file.rs +++ b/codex-rs/core/src/mcp_openai_file.rs @@ -8,8 +8,8 @@ //! and rewrite only the declared arguments into the provided-file payload //! shape expected by the downstream Apps tool. //! -//! Model-visible schema masking is owned by `codex-mcp` alongside MCP tool -//! inventory, so this module only handles the execution-time argument rewrite. +//! The model-facing local-path schema is owned by `codex-mcp` alongside MCP tool inventory, so this +//! module only handles uploading the files and rewriting the execution-time arguments. use crate::session::session::Session; use crate::session::turn_context::TurnContext; diff --git a/codex-rs/core/src/mcp_tool_call.rs b/codex-rs/core/src/mcp_tool_call.rs index 56d6e678a0..71b3e60b7e 100644 --- a/codex-rs/core/src/mcp_tool_call.rs +++ b/codex-rs/core/src/mcp_tool_call.rs @@ -653,10 +653,8 @@ async fn maybe_request_codex_apps_auth_elicitation( AskForApproval::Granular(granular_config) if !granular_config.allows_mcp_elicitations() => { return result; } - AskForApproval::OnFailure - | AskForApproval::OnRequest - | AskForApproval::UnlessTrusted - | AskForApproval::Granular(_) => {} + AskForApproval::OnRequest | AskForApproval::UnlessTrusted | AskForApproval::Granular(_) => { + } } let connector_id = metadata.and_then(|metadata| metadata.connector_id.as_deref()); @@ -744,7 +742,7 @@ async fn augment_mcp_tool_request_meta_with_sandbox_state( }; let permission_profile = turn_context.permission_profile(); let sandbox_state = serde_json::to_value(SandboxState { - permission_profile: Some(permission_profile), + permission_profile, codex_linux_sandbox_exe: turn_context.config.codex_linux_sandbox_exe.clone(), sandbox_cwd, use_legacy_landlock: turn_context.config.features.use_legacy_landlock(), diff --git a/codex-rs/core/src/mcp_tool_call_tests.rs b/codex-rs/core/src/mcp_tool_call_tests.rs index eb500b0f6c..89b4f9de6c 100644 --- a/codex-rs/core/src/mcp_tool_call_tests.rs +++ b/codex-rs/core/src/mcp_tool_call_tests.rs @@ -1335,15 +1335,25 @@ fn codex_apps_auth_failure_metadata() -> McpToolApprovalMetadata { async fn install_host_owned_codex_apps_manager(session: &Session, turn_context: &TurnContext) { let auth = session.services.auth_manager.auth().await; + let startup_cancellation_token = CancellationToken::new(); + startup_cancellation_token.cancel(); + let (tx_event, _rx_event) = async_channel::unbounded(); + let mcp_servers = HashMap::from([( + CODEX_APPS_MCP_SERVER_NAME.to_string(), + codex_mcp::EffectiveMcpServer::configured(codex_mcp::codex_apps_mcp_server_config( + "https://chatgpt.com", + /*apps_mcp_product_sku*/ None, + )), + )]); let manager = codex_mcp::McpConnectionManager::new( - &HashMap::new(), + &mcp_servers, turn_context.config.mcp_oauth_credentials_store_mode, turn_context.config.auth_keyring_backend_kind(), HashMap::new(), &turn_context.approval_policy, turn_context.sub_id.clone(), - session.get_tx_event(), - CancellationToken::new(), + tx_event, + startup_cancellation_token, turn_context.permission_profile(), codex_mcp::McpRuntimeContext::new( session.services.turn_environments.environment_manager(), @@ -1354,7 +1364,6 @@ async fn install_host_owned_codex_apps_manager(session: &Session, turn_context: ), turn_context.config.codex_home.to_path_buf(), codex_mcp::codex_apps_tools_cache_key(auth.as_ref()), - /*host_owned_codex_apps_enabled*/ true, turn_context.config.prefix_mcp_tool_names(), rmcp::model::ElicitationCapability::default(), /*supports_openai_form_elicitation*/ false, @@ -2906,7 +2915,6 @@ async fn approve_mode_skips_guardian_in_every_permission_mode() { for approval_policy in [ AskForApproval::UnlessTrusted, - AskForApproval::OnFailure, AskForApproval::OnRequest, AskForApproval::Granular(GranularApprovalConfig { sandbox_approval: true, diff --git a/codex-rs/core/src/safety.rs b/codex-rs/core/src/safety.rs index 916379705b..1fe9b0257b 100644 --- a/codex-rs/core/src/safety.rs +++ b/codex-rs/core/src/safety.rs @@ -44,10 +44,7 @@ pub fn assess_patch_safety( } match policy { - AskForApproval::OnFailure - | AskForApproval::Never - | AskForApproval::OnRequest - | AskForApproval::Granular(_) => { + AskForApproval::Never | AskForApproval::OnRequest | AskForApproval::Granular(_) => { // Continue to see if this can be auto-approved. } // TODO(ragona): I'm not sure this is actually correct? I believe in this case @@ -66,9 +63,7 @@ pub fn assess_patch_safety( // Even though the patch appears to be constrained to writable paths, it is // possible that paths in the patch are hard links to files outside the // writable roots, so we should still run `apply_patch` in a sandbox in that case. - if is_write_patch_constrained_to_writable_paths(action, file_system_sandbox_policy, cwd) - || matches!(policy, AskForApproval::OnFailure) - { + if is_write_patch_constrained_to_writable_paths(action, file_system_sandbox_policy, cwd) { if matches!( permission_profile, PermissionProfile::Disabled | PermissionProfile::External { .. } diff --git a/codex-rs/core/src/sandboxing/mod.rs b/codex-rs/core/src/sandboxing/mod.rs index d0006f8657..1c570e1bbb 100644 --- a/codex-rs/core/src/sandboxing/mod.rs +++ b/codex-rs/core/src/sandboxing/mod.rs @@ -15,6 +15,7 @@ use crate::exec::execute_exec_request; use crate::spawn::CODEX_SANDBOX_ENV_VAR; use crate::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR; use codex_file_system::FileSystemSandboxContext; +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_network_proxy::NetworkProxy; use codex_protocol::config_types::WindowsSandboxLevel; use codex_protocol::exec_output::ExecToolCallOutput; @@ -63,6 +64,7 @@ pub struct ExecRequest { pub arg0: Option, pub(crate) exec_server_sandbox: Option, pub(crate) exec_server_enforce_managed_network: bool, + pub(crate) exec_server_managed_network: Option, } impl ExecRequest { @@ -107,6 +109,7 @@ impl ExecRequest { arg0, exec_server_sandbox: None, exec_server_enforce_managed_network: false, + exec_server_managed_network: None, } } @@ -165,6 +168,7 @@ impl ExecRequest { arg0, exec_server_sandbox: None, exec_server_enforce_managed_network: false, + exec_server_managed_network: None, } } } diff --git a/codex-rs/core/src/session/config_lock.rs b/codex-rs/core/src/session/config_lock.rs index 035f7bce4d..13b6b48243 100644 --- a/codex-rs/core/src/session/config_lock.rs +++ b/codex-rs/core/src/session/config_lock.rs @@ -357,7 +357,7 @@ mod tests { features.current_time_reminder, Some(FeatureToml::Config(CurrentTimeReminderConfigToml { enabled: Some(true), - reminder_interval_model_requests: Some(1), + reminder_interval_seconds: Some(1), clock_source: Some(codex_features::CurrentTimeSource::System), })) ); diff --git a/codex-rs/core/src/session/mcp.rs b/codex-rs/core/src/session/mcp.rs index d03576aadc..737335c598 100644 --- a/codex-rs/core/src/session/mcp.rs +++ b/codex-rs/core/src/session/mcp.rs @@ -317,8 +317,6 @@ impl Session { let tool_plugin_provenance = codex_mcp::tool_plugin_provenance(&mcp_config); let mcp_servers = effective_mcp_servers_from_configured(mcp_servers, &mcp_config, auth.as_ref()); - let host_owned_codex_apps_enabled = - host_owned_codex_apps_enabled(&mcp_config, auth.as_ref()); let auth_statuses = compute_auth_statuses( mcp_servers.iter(), store_mode, @@ -359,7 +357,6 @@ impl Session { mcp_runtime_context, config.codex_home.to_path_buf(), codex_apps_tools_cache_key(auth.as_ref()), - host_owned_codex_apps_enabled, mcp_config.prefix_mcp_tool_names, mcp_config.client_elicitation_capability, self.services @@ -374,9 +371,11 @@ impl Session { let current_manager = self.services.mcp_connection_manager.load_full(); refreshed_manager.set_elicitations_auto_deny(current_manager.elicitations_auto_deny()); } - self.services + let superseded_manager = self + .services .mcp_connection_manager - .store(Arc::new(refreshed_manager)); + .swap(Arc::new(refreshed_manager)); + superseded_manager.shutdown().await; } pub(crate) async fn refresh_mcp_servers_if_requested( diff --git a/codex-rs/core/src/session/mod.rs b/codex-rs/core/src/session/mod.rs index cdf866c391..d01f20578c 100644 --- a/codex-rs/core/src/session/mod.rs +++ b/codex-rs/core/src/session/mod.rs @@ -248,7 +248,6 @@ use self::turn::realtime_text_for_event; use self::turn_context::TurnContext; use self::turn_context::TurnSkillsContext; use self::world_state::build_world_state_from_environment_snapshot; -use self::world_state::build_world_state_from_turn_context; use self::world_state::build_world_state_from_turn_context_item; #[cfg(test)] mod rollout_reconstruction_tests; @@ -345,7 +344,6 @@ use codex_git_utils::get_git_repo_root; use codex_mcp::McpConfig; use codex_mcp::compute_auth_statuses; use codex_mcp::effective_mcp_servers_from_configured; -use codex_mcp::host_owned_codex_apps_enabled; use codex_otel::SessionTelemetry; use codex_otel::THREAD_STARTED_METRIC; use codex_otel::TelemetryAuthMode; @@ -726,7 +724,7 @@ impl Codex { op: Op, trace: Option, ) -> CodexResult { - let id = Uuid::now_v7().to_string(); + let id = new_submission_id(); let sub = Submission { id: id.clone(), op, @@ -744,7 +742,7 @@ impl Codex { client_user_message_id: Option, ) -> CodexResult { debug_assert!(matches!(op, Op::UserInput { .. })); - let id = Uuid::now_v7().to_string(); + let id = new_submission_id(); let sub = Submission { id: id.clone(), op, @@ -871,6 +869,15 @@ impl Codex { } } +/// Generate a core submission ID. App-server exposes submission IDs that +/// create turns as a public-facing turn ID. +/// +/// Some use cases take advantage of the fact that these are UUID7 which +/// encodes a timestamp, so think carefully before changing this. +fn new_submission_id() -> String { + Uuid::now_v7().to_string() +} + fn get_service_tier( configured_service_tier: Option, fast_mode_enabled: bool, @@ -1391,7 +1398,9 @@ impl Session { let mut state = self.state.lock().await; state.replace_history(history, reference_context_item); if let Some(world_state) = world_state_baseline { - state.history.set_world_state_baseline(world_state); + state + .history + .set_world_state_baseline(Arc::new(world_state)); } let fallback_ids = state.auto_compact_window_ids(); let window_id = window_id.unwrap_or(fallback_ids.window_id); @@ -2237,8 +2246,7 @@ impl Session { strict_auto_review: false, }); } - AskForApproval::OnFailure - | AskForApproval::OnRequest + AskForApproval::OnRequest | AskForApproval::UnlessTrusted | AskForApproval::Granular(_) => {} } @@ -2716,6 +2724,7 @@ impl Session { continue; } let prefix = match item { + ResponseItem::AdditionalTools { .. } => "at", ResponseItem::Message { .. } => "msg", ResponseItem::Reasoning { .. } => "rs", ResponseItem::LocalShellCall { .. } => "lsh", @@ -2766,25 +2775,27 @@ impl Session { pub(crate) async fn record_step_environment_context_if_changed( &self, turn_context: &TurnContext, + previous_world_state: &Arc, step_context: &step_context::StepContext, - ) { - if !turn_context.config.include_environment_context { - return; + ) -> Arc { + let world_state = Arc::new( + self.build_world_state_for_environments(turn_context, &step_context.environments) + .await, + ); + let items = crate::context_manager::updates::merge_contextual_fragments( + world_state.render_diff(previous_world_state.as_ref()), + ); + if !items.is_empty() { + self.record_conversation_items(turn_context, &items).await; } - let world_state = - build_world_state_from_environment_snapshot(turn_context, &step_context.environments); - let items = { - let mut state = self.state.lock().await; - crate::context_manager::updates::merge_contextual_fragments( - state.history.update_world_state(world_state), - ) - }; - if items.is_empty() { - return; - } - - self.record_conversation_items(turn_context, &items).await; + // ContextManager remembers this for later turns; run_turn owns the live value. + self.state + .lock() + .await + .history + .set_world_state_baseline(Arc::clone(&world_state)); + world_state } pub(crate) async fn record_inter_agent_communication( @@ -2886,6 +2897,7 @@ impl Session { turn_context: &TurnContext, items: Vec, reference_context_item: Option, + world_state_baseline: Option>, compacted_item: CompactedItem, ) { let items = if turn_context.config.features.enabled(Feature::ItemIds) { @@ -2897,11 +2909,6 @@ impl Session { replacement_history: Some(items.clone()), ..compacted_item }; - let world_state_baseline = if reference_context_item.is_some() { - Some(self.build_world_state(turn_context).await) - } else { - None - }; { let mut state = self.state.lock().await; state.replace_history(items, reference_context_item.clone()); @@ -3033,16 +3040,11 @@ impl Session { items } - pub(crate) async fn build_initial_context( + pub(crate) async fn build_world_state_for_environments( &self, turn_context: &TurnContext, - ) -> Vec { - let world_state = self.build_world_state(turn_context).await; - self.build_initial_context_with_world_state(turn_context, &world_state) - .await - } - - async fn build_world_state(&self, turn_context: &TurnContext) -> WorldState { + environments: &TurnEnvironmentSnapshot, + ) -> WorldState { let environment_subagents = if turn_context.config.include_environment_context { self.services .agent_control @@ -3051,10 +3053,14 @@ impl Session { } else { String::new() }; - build_world_state_from_turn_context(turn_context, &environment_subagents) + build_world_state_from_environment_snapshot( + turn_context, + environments, + &environment_subagents, + ) } - async fn build_initial_context_with_world_state( + pub(crate) async fn build_initial_context_with_world_state( &self, turn_context: &TurnContext, world_state: &WorldState, @@ -3403,15 +3409,15 @@ impl Session { pub(crate) async fn maybe_start_new_context_window( &self, turn_context: &TurnContext, + world_state: Arc, ) -> Option { let window = { let mut state = self.state.lock().await; state.start_new_context_window_if_requested() }; let (window_number, window_ids) = window?; - let world_state = self.build_world_state(turn_context).await; let context_items = self - .build_initial_context_with_world_state(turn_context, &world_state) + .build_initial_context_with_world_state(turn_context, world_state.as_ref()) .await; let turn_context_item = turn_context.to_turn_context_item(); let replacement_history = context_items; @@ -3462,7 +3468,7 @@ impl Session { pub(crate) async fn record_context_updates_and_set_reference_context_item( &self, turn_context: &TurnContext, - ) { + ) -> Arc { let reference_context_item = { let state = self.state.lock().await; state.reference_context_item() @@ -3470,16 +3476,19 @@ impl Session { let turn_context_item = turn_context.to_turn_context_item(); let turn_context_changed = reference_context_item.as_ref() != Some(&turn_context_item); let should_inject_full_context = reference_context_item.is_none(); - let world_state = self.build_world_state(turn_context).await; + let world_state = Arc::new( + self.build_world_state_for_environments(turn_context, &turn_context.environments) + .await, + ); let mut context_items = if should_inject_full_context { let context_items = self - .build_initial_context_with_world_state(turn_context, &world_state) + .build_initial_context_with_world_state(turn_context, world_state.as_ref()) .await; self.state .lock() .await .history - .set_world_state_baseline(world_state); + .set_world_state_baseline(Arc::clone(&world_state)); context_items } else { // Steady-state path: append only built-in context diffs here; turn-scoped extension @@ -3490,7 +3499,7 @@ impl Session { let world_state_items = { let mut state = self.state.lock().await; crate::context_manager::updates::merge_contextual_fragments( - state.history.update_world_state(world_state), + state.history.update_world_state(Arc::clone(&world_state)), ) }; context_items.extend(world_state_items); @@ -3503,7 +3512,7 @@ impl Session { ); } if !turn_context_changed && context_items.is_empty() { - return; + return world_state; } if !context_items.is_empty() { self.record_conversation_items(turn_context, &context_items) @@ -3518,6 +3527,7 @@ impl Session { // context items. let mut state = self.state.lock().await; state.set_reference_context_item(Some(turn_context_item)); + world_state } pub(crate) async fn update_token_usage_info( diff --git a/codex-rs/core/src/session/rollout_reconstruction.rs b/codex-rs/core/src/session/rollout_reconstruction.rs index bf534c1e8a..6989ff80d0 100644 --- a/codex-rs/core/src/session/rollout_reconstruction.rs +++ b/codex-rs/core/src/session/rollout_reconstruction.rs @@ -355,7 +355,7 @@ impl Session { id: None, }); RolloutReconstruction { - history: history.raw_items().to_vec(), + history: history.into_raw_items(), previous_turn_settings, reference_context_item, window_number: window.number, diff --git a/codex-rs/core/src/session/rollout_reconstruction_tests.rs b/codex-rs/core/src/session/rollout_reconstruction_tests.rs index b28bd37c79..828c078586 100644 --- a/codex-rs/core/src/session/rollout_reconstruction_tests.rs +++ b/codex-rs/core/src/session/rollout_reconstruction_tests.rs @@ -69,7 +69,9 @@ async fn record_initial_history_reconstructs_typed_inter_agent_message() { session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: vec![RolloutItem::InterAgentCommunication(communication.clone())], + history: Arc::new(vec![RolloutItem::InterAgentCommunication( + communication.clone(), + )]), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -112,7 +114,7 @@ async fn record_initial_history_resumed_bare_turn_context_does_not_hydrate_previ session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -189,7 +191,7 @@ async fn record_initial_history_resumed_hydrates_previous_turn_settings_from_lif session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -757,7 +759,7 @@ async fn record_initial_history_resumed_rollback_skips_only_user_turns() { session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -841,7 +843,7 @@ async fn record_initial_history_resumed_rollback_drops_incomplete_user_turn_comp session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -871,7 +873,7 @@ async fn record_initial_history_resumed_bare_turn_context_does_not_seed_referenc session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -898,7 +900,7 @@ async fn record_initial_history_resumed_does_not_seed_reference_context_item_aft session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1070,7 +1072,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1215,7 +1217,7 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1338,7 +1340,7 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1454,7 +1456,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1505,7 +1507,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_preserves_turn_ session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1633,7 +1635,7 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs index b4740bea99..00c5b64e8a 100644 --- a/codex-rs/core/src/session/session.rs +++ b/codex-rs/core/src/session/session.rs @@ -748,15 +748,6 @@ impl Session { ) { post_session_configured_events.push(event); } - if config.permissions.approval_policy.value() == AskForApproval::OnFailure { - post_session_configured_events.push(Event { - id: "".to_owned(), - msg: EventMsg::Warning(WarningEvent { - message: "`on-failure` approval policy is deprecated and will be removed in a future release. Use `on-request` for interactive approvals or `never` for non-interactive runs.".to_string(), - }), - }); - } - let auth = auth.as_ref(); let auth_mode = auth.map(CodexAuth::auth_mode).map(TelemetryAuthMode::from); let account_id = auth.and_then(CodexAuth::get_account_id); @@ -1138,9 +1129,6 @@ impl Session { sess.send_event_raw(event).await; } - let host_owned_codex_apps_enabled = config - .features - .apps_enabled_for_auth(auth.as_ref().is_some_and(|auth| auth.uses_codex_backend())); let client_elicitation_capability = if config.features.enabled(Feature::AuthElicitation) { ElicitationCapability { form: Some(FormElicitationCapability::default()), @@ -1183,7 +1171,6 @@ impl Session { mcp_runtime_context, config.codex_home.to_path_buf(), codex_apps_tools_cache_key(auth), - host_owned_codex_apps_enabled, config.prefix_mcp_tool_names(), client_elicitation_capability, sess.services diff --git a/codex-rs/core/src/session/tests.rs b/codex-rs/core/src/session/tests.rs index 378dff58c9..eb30d45fab 100644 --- a/codex-rs/core/src/session/tests.rs +++ b/codex-rs/core/src/session/tests.rs @@ -222,6 +222,19 @@ fn assign_missing_response_item_ids_skips_agent_messages() { assert!(items[1].id().is_some_and(|id| id.starts_with("msg_"))); } +#[test] +fn assign_missing_response_item_ids_assigns_additional_tools_ids() { + let items = Cow::Owned(vec![ResponseItem::AdditionalTools { + id: None, + role: "developer".to_string(), + tools: Vec::new(), + }]); + + let items = Session::assign_missing_response_item_ids(items); + + assert!(items[0].id().is_some_and(|id| id.starts_with("at_"))); +} + fn assistant_message(text: &str) -> ResponseItem { ResponseItem::Message { id: None, @@ -1275,7 +1288,7 @@ async fn reload_user_config_layer_updates_base_and_selected_profile_layers() { let profile_config_path = codex_home.join("work.config.toml"); std::fs::write( &base_config_path, - "model = \"base\"\napproval_policy = \"on-failure\"\n", + "model = \"base\"\napproval_policy = \"on-request\"\n", ) .expect("write base user config"); std::fs::write(&profile_config_path, "model = \"profile-old\"\n") @@ -1684,7 +1697,7 @@ async fn record_initial_history_reconstructs_resumed_transcript() { session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1849,7 +1862,7 @@ async fn prepares_resumed_history_before_installing_it() { session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: vec![RolloutItem::ResponseItem(resumed_item)], + history: Arc::new(vec![RolloutItem::ResponseItem(resumed_item)]), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1892,7 +1905,7 @@ fn resolve_multi_agent_version_handles_unset_and_legacy_history() { resolve_multi_agent_version( &InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history: Vec::new(), + history: Arc::new(Vec::new()), rollout_path: None, }), /*inherited_multi_agent_version*/ None, @@ -1903,7 +1916,7 @@ fn resolve_multi_agent_version_handles_unset_and_legacy_history() { resolve_multi_agent_version( &InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history: Vec::new(), + history: Arc::new(Vec::new()), rollout_path: None, }), Some(MultiAgentVersion::V2), @@ -1914,10 +1927,10 @@ fn resolve_multi_agent_version_handles_unset_and_legacy_history() { resolve_multi_agent_version( &InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history: vec![session_meta_item( + history: Arc::new(vec![session_meta_item( thread_id, Some(MultiAgentVersion::Disabled) - )], + )]), rollout_path: None, }), Some(MultiAgentVersion::V2), @@ -1978,7 +1991,7 @@ async fn resumed_history_injects_initial_context_on_first_context_update_only() session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -1989,7 +2002,7 @@ async fn resumed_history_injects_initial_context_on_first_context_update_only() session .record_context_updates_and_set_reference_context_item(&turn_context) .await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; expected.extend(initial_context); let history_after_seed = session.clone_history().await; assert_eq!(expected, history_after_seed.raw_items()); @@ -2072,7 +2085,7 @@ async fn record_initial_history_seeds_token_info_from_rollout() { session .record_initial_history(InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: rollout_items, + history: Arc::new(rollout_items), rollout_path: Some(PathBuf::from("/tmp/resume.jsonl")), })) .await; @@ -2874,7 +2887,7 @@ async fn thread_rollback_drops_last_turn_from_history() { ) .await; - let initial_context = sess.build_initial_context(tc.as_ref()).await; + let initial_context = build_initial_context(&sess, tc.as_ref()).await; let turn_1 = vec![ user_message("turn 1 user"), assistant_message("turn 1 assistant"), @@ -2942,7 +2955,7 @@ async fn thread_rollback_clears_history_when_num_turns_exceeds_existing_turns() ) .await; - let initial_context = sess.build_initial_context(tc.as_ref()).await; + let initial_context = build_initial_context(&sess, tc.as_ref()).await; let turn_1 = vec![user_message("turn 1 user")]; let mut full_history = Vec::new(); full_history.extend(initial_context.clone()); @@ -2968,7 +2981,7 @@ async fn thread_rollback_clears_history_when_num_turns_exceeds_existing_turns() async fn thread_rollback_fails_without_persisted_thread_history() { let (sess, tc, rx) = make_session_and_context_with_rx().await; - let initial_context = sess.build_initial_context(tc.as_ref()).await; + let initial_context = build_initial_context(&sess, tc.as_ref()).await; sess.record_conversation_items(tc.as_ref(), &initial_context) .await; @@ -3378,7 +3391,7 @@ async fn thread_rollback_persists_marker_and_replays_cumulatively() { async fn thread_rollback_fails_when_turn_in_progress() { let (sess, tc, rx) = make_session_and_context_with_rx().await; - let initial_context = sess.build_initial_context(tc.as_ref()).await; + let initial_context = build_initial_context(&sess, tc.as_ref()).await; sess.record_conversation_items(tc.as_ref(), &initial_context) .await; @@ -3399,7 +3412,7 @@ async fn thread_rollback_fails_when_turn_in_progress() { async fn thread_rollback_fails_when_num_turns_is_zero() { let (sess, tc, rx) = make_session_and_context_with_rx().await; - let initial_context = sess.build_initial_context(tc.as_ref()).await; + let initial_context = build_initial_context(&sess, tc.as_ref()).await; sess.record_conversation_items(tc.as_ref(), &initial_context) .await; @@ -5020,6 +5033,22 @@ async fn session_new_fails_when_zsh_fork_enabled_without_packaged_zsh() { assert!(msg.contains("zsh fork feature enabled, but no packaged zsh fork is available")); } +async fn build_initial_context(session: &Session, turn_context: &TurnContext) -> Vec { + let world_state = build_world_state_from_turn_context(session, turn_context).await; + session + .build_initial_context_with_world_state(turn_context, &world_state) + .await +} + +pub(crate) async fn build_world_state_from_turn_context( + session: &Session, + turn_context: &TurnContext, +) -> WorldState { + session + .build_world_state_for_environments(turn_context, &turn_context.environments) + .await +} + // todo: use online model info pub(crate) async fn make_session_and_context() -> (Session, TurnContext) { let (tx_event, _rx_event) = async_channel::unbounded(); @@ -5495,7 +5524,7 @@ async fn resumed_root_session_uses_thread_id_as_session_id() { let (session, rx_event) = make_session_with_history_source_and_agent_control_and_rx( InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history: Vec::new(), + history: Arc::new(Vec::new()), rollout_path: None, }), SessionSource::Exec, @@ -5530,7 +5559,7 @@ async fn resumed_subagent_session_restores_persisted_session_id() { let (session, rx_event) = make_session_with_history_source_and_agent_control_and_rx( InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history: vec![RolloutItem::SessionMeta(SessionMetaLine { + history: Arc::new(vec![RolloutItem::SessionMeta(SessionMetaLine { meta: SessionMeta { session_id: parent_session_id, id: thread_id, @@ -5538,7 +5567,7 @@ async fn resumed_subagent_session_restores_persisted_session_id() { ..SessionMeta::default() }, git: None, - })], + })]), rollout_path: None, }), session_source, @@ -7680,7 +7709,7 @@ async fn build_initial_context_uses_previous_realtime_state() { let (session, mut turn_context) = make_session_and_context().await; turn_context.realtime_active = true; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_texts = developer_input_texts(&initial_context); assert!( developer_texts @@ -7694,7 +7723,7 @@ async fn build_initial_context_uses_previous_realtime_state() { let mut state = session.state.lock().await; state.set_reference_context_item(Some(previous_context_item)); } - let resumed_context = session.build_initial_context(&turn_context).await; + let resumed_context = build_initial_context(&session, &turn_context).await; let resumed_developer_texts = developer_input_texts(&resumed_context); assert!( !resumed_developer_texts @@ -7793,7 +7822,7 @@ async fn build_initial_context_includes_prompt_fragments_from_extensions() { .thread_extension_data .insert(PromptExtensionTestState); - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -7819,7 +7848,7 @@ async fn build_initial_context_includes_turn_context_fragments_from_extensions() expected_model_context_window: Some(50), }); - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -7846,7 +7875,7 @@ async fn record_context_updates_includes_turn_context_fragments_on_steady_state_ }); let mut previous_context_item = turn_context.to_turn_context_item(); previous_context_item.turn_id = Some("previous-turn-id".to_string()); - let world_state = session.build_world_state(&turn_context).await; + let world_state = Arc::new(build_world_state_from_turn_context(&session, &turn_context).await); { let mut state = session.state.lock().await; state.set_reference_context_item(Some(previous_context_item)); @@ -7873,7 +7902,7 @@ async fn build_initial_context_omits_prompt_fragments_without_extension_state() let (mut session, turn_context) = make_session_and_context().await; session.services.extensions = prompt_extension_test_registry(); - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -7890,7 +7919,7 @@ async fn build_initial_context_adds_multi_agent_v2_root_usage_hint_as_developer_ let (session, turn_context) = make_multi_agent_v2_usage_hint_test_session(/*enable_multi_agent_v2*/ true).await; - let initial_context = session.build_initial_context(turn_context.as_ref()).await; + let initial_context = build_initial_context(&session, turn_context.as_ref()).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -7928,7 +7957,7 @@ async fn build_initial_context_adds_multi_agent_v2_subagent_usage_hint_as_develo .expect("thread settings should not be shared") .session_source = session_source; - let initial_context = session.build_initial_context(turn_context.as_ref()).await; + let initial_context = build_initial_context(&session, turn_context.as_ref()).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -7950,7 +7979,7 @@ async fn build_initial_context_omits_multi_agent_v2_usage_hints_when_feature_dis let (session, turn_context) = make_multi_agent_v2_usage_hint_test_session(/*enable_multi_agent_v2*/ false).await; - let initial_context = session.build_initial_context(turn_context.as_ref()).await; + let initial_context = build_initial_context(&session, turn_context.as_ref()).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -7977,7 +8006,7 @@ async fn build_initial_context_omits_multi_agent_v2_usage_hints_when_hint_is_emp ) .await; - let initial_context = session.build_initial_context(turn_context.as_ref()).await; + let initial_context = build_initial_context(&session, turn_context.as_ref()).await; let developer_messages = developer_message_texts(&initial_context); assert!( @@ -8007,7 +8036,7 @@ async fn build_initial_context_omits_default_image_save_location_with_image_hist ) .await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_texts = developer_input_texts(&initial_context); assert!( !developer_texts @@ -8021,7 +8050,7 @@ async fn build_initial_context_omits_default_image_save_location_with_image_hist async fn build_initial_context_omits_default_image_save_location_without_image_history() { let (session, turn_context) = make_session_and_context().await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_texts = developer_input_texts(&initial_context); assert!( @@ -8063,7 +8092,7 @@ async fn build_initial_context_trims_skill_metadata_from_context_window_budget() turn_context.model_info.context_window = Some(100); turn_context.turn_skills = TurnSkillsContext::new(HostSkillsSnapshot::new(Arc::new(outcome))); - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_texts = developer_input_texts(&initial_context); assert!( @@ -8214,7 +8243,7 @@ async fn build_initial_context_emits_thread_start_skill_warning_on_repeated_buil turn_context.model_info.context_window = Some(100); turn_context.turn_skills = TurnSkillsContext::new(HostSkillsSnapshot::new(Arc::new(outcome))); - let _ = session.build_initial_context(&turn_context).await; + let _ = build_initial_context(&session, &turn_context).await; let warning_event = timeout(Duration::from_secs(1), rx.recv()) .await .expect("warning event should arrive") @@ -8225,7 +8254,7 @@ async fn build_initial_context_emits_thread_start_skill_warning_on_repeated_buil if message == "Exceeded skills context budget of 2%. All skill descriptions were removed and 2 additional skills were not included in the model-visible skills list." )); - let _ = session.build_initial_context(&turn_context).await; + let _ = build_initial_context(&session, &turn_context).await; let warning_event = timeout(Duration::from_secs(1), rx.recv()) .await .expect("warning event should arrive on repeated build") @@ -8345,7 +8374,7 @@ async fn build_initial_context_uses_previous_turn_settings_for_realtime_end() { session .set_previous_turn_settings(Some(previous_turn_settings)) .await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_texts = developer_input_texts(&initial_context); assert!( developer_texts @@ -8368,7 +8397,7 @@ async fn build_initial_context_restates_realtime_start_when_reference_context_is session .set_previous_turn_settings(Some(previous_turn_settings)) .await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let developer_texts = developer_input_texts(&initial_context); assert!( developer_texts @@ -8455,7 +8484,7 @@ async fn record_context_updates_and_set_reference_context_item_injects_full_cont .record_context_updates_and_set_reference_context_item(&turn_context) .await; let history = session.clone_history().await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; assert_eq!(history.raw_items().to_vec(), initial_context); let current_context = session.reference_context_item().await; @@ -8502,7 +8531,7 @@ async fn record_context_updates_and_set_reference_context_item_reinjects_full_co let history = session.clone_history().await; let mut expected_history = vec![compacted_summary]; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; expected_history.extend(initial_context); assert_eq!(history.raw_items().to_vec(), expected_history); } @@ -8520,7 +8549,8 @@ async fn record_context_updates_and_set_reference_context_item_persists_baseline .with_model(next_model.to_string(), &session.services.models_manager) .await; let previous_context_item = previous_context.to_turn_context_item(); - let world_state = session.build_world_state(&previous_context).await; + let world_state = + Arc::new(build_world_state_from_turn_context(&session, &previous_context).await); { let mut state = session.state.lock().await; state.set_reference_context_item(Some(previous_context_item.clone())); @@ -8614,7 +8644,7 @@ async fn build_initial_context_prepends_model_switch_message() { session .set_previous_turn_settings(Some(previous_turn_settings)) .await; - let initial_context = session.build_initial_context(&turn_context).await; + let initial_context = build_initial_context(&session, &turn_context).await; let ResponseItem::Message { role, content, .. } = &initial_context[0] else { panic!("expected developer message"); @@ -9939,9 +9969,7 @@ async fn sample_rollout( // Use the same turn_context source as record_initial_history so model_info (and thus // personality_spec) matches reconstruction. let reconstruction_turn = session.new_default_turn().await; - let mut initial_context = session - .build_initial_context(reconstruction_turn.as_ref()) - .await; + let mut initial_context = build_initial_context(session, reconstruction_turn.as_ref()).await; // Ensure personality_spec is present when Personality is enabled, so expected matches // what reconstruction produces (build_initial_context may omit it when baked into model). if !initial_context.iter().any(|m| { @@ -10119,7 +10147,7 @@ async fn rejects_escalated_permissions_when_policy_not_on_request() { // Ensure policy is NOT OnRequest so the early rejection path triggers turn_context_raw .approval_policy - .set(AskForApproval::OnFailure) + .set(AskForApproval::Never) .expect("test setup should allow updating approval policy"); let session = Arc::new(session); let mut turn_context = Arc::new(turn_context_raw); @@ -10282,7 +10310,7 @@ async fn unified_exec_rejects_escalated_permissions_when_policy_not_on_request() let (session, mut turn_context_raw) = make_session_and_context().await; turn_context_raw .approval_policy - .set(AskForApproval::OnFailure) + .set(AskForApproval::Never) .expect("test setup should allow updating approval policy"); let session = Arc::new(session); let turn_context = Arc::new(turn_context_raw); diff --git a/codex-rs/core/src/session/tests/guardian_tests.rs b/codex-rs/core/src/session/tests/guardian_tests.rs index e44b12ef72..aef75ccee9 100644 --- a/codex-rs/core/src/session/tests/guardian_tests.rs +++ b/codex-rs/core/src/session/tests/guardian_tests.rs @@ -407,7 +407,7 @@ async fn strict_auto_review_turn_grant_forces_guardian_for_shell_command_policy_ turn_context_raw .approval_policy - .set(AskForApproval::OnFailure) + .set(AskForApproval::Never) .expect("test setup should allow updating approval policy"); turn_context_raw.permission_profile = codex_protocol::models::PermissionProfile::Disabled; let mut config = (*turn_context_raw.config).clone(); @@ -523,8 +523,10 @@ async fn process_compacted_history_preserves_separate_guardian_developer_message } turn_context.session_source = guardian_source; turn_context.developer_instructions = Some(guardian_policy.clone()); + let world_state = Arc::new(build_world_state_from_turn_context(&session, &turn_context).await); + let initial_context_injection = InitialContextInjection::BeforeLastUserMessage(world_state); - let refreshed = crate::compact_remote::process_compacted_history( + let (refreshed, _) = crate::compact_remote::process_compacted_history( &session, &turn_context, vec![ @@ -547,7 +549,7 @@ async fn process_compacted_history_preserves_separate_guardian_developer_message internal_chat_message_metadata_passthrough: None, }, ], - InitialContextInjection::BeforeLastUserMessage, + &initial_context_injection, ) .await; diff --git a/codex-rs/core/src/session/time_reminder.rs b/codex-rs/core/src/session/time_reminder.rs index 058132a895..85831d2947 100644 --- a/codex-rs/core/src/session/time_reminder.rs +++ b/codex-rs/core/src/session/time_reminder.rs @@ -1,3 +1,5 @@ +use chrono::DateTime; +use chrono::Utc; use codex_protocol::error::CodexErr; use codex_protocol::error::Result as CodexResult; @@ -7,18 +9,27 @@ use crate::context::ContextualUserFragment; #[derive(Default)] pub(crate) struct CurrentTimeReminderState { - model_requests_since_delivery: u64, + last_delivery_time: Option>, last_window_id: Option, } impl CurrentTimeReminderState { - fn take_reminder_due(&mut self, window_id: &str, interval: u64) -> bool { - self.model_requests_since_delivery = self.model_requests_since_delivery.saturating_add(1); + fn take_reminder_due( + &mut self, + window_id: &str, + current_time: DateTime, + interval_seconds: u64, + ) -> bool { let reminder_is_due = self.last_window_id.as_deref() != Some(window_id) - || self.model_requests_since_delivery >= interval; + || self.last_delivery_time.is_none_or(|last_delivery_time| { + current_time + .signed_duration_since(last_delivery_time) + .num_seconds() + >= i64::try_from(interval_seconds).unwrap_or(i64::MAX) + }); if reminder_is_due { - self.model_requests_since_delivery = 0; + self.last_delivery_time = Some(current_time); self.last_window_id = Some(window_id.to_string()); } @@ -35,16 +46,6 @@ pub(super) async fn maybe_record_current_time_reminder( return Ok(()); }; - let reminder_is_due = { - let mut state = sess.state.lock().await; - state - .current_time_reminder - .take_reminder_due(window_id, config.reminder_interval_model_requests) - }; - if !reminder_is_due { - return Ok(()); - } - let current_time = sess .services .time_provider @@ -52,6 +53,18 @@ pub(super) async fn maybe_record_current_time_reminder( .await .map_err(|err| CodexErr::Fatal(format!("failed to read current time: {err:#}")))?; + let reminder_is_due = { + let mut state = sess.state.lock().await; + state.current_time_reminder.take_reminder_due( + window_id, + current_time, + config.reminder_interval_seconds, + ) + }; + if !reminder_is_due { + return Ok(()); + } + let response_item = ContextualUserFragment::into(crate::context::CurrentTimeReminder::new(current_time)); sess.record_conversation_items(turn_context, std::slice::from_ref(&response_item)) diff --git a/codex-rs/core/src/session/turn.rs b/codex-rs/core/src/session/turn.rs index cdb8468e55..5aa4aa4c50 100644 --- a/codex-rs/core/src/session/turn.rs +++ b/codex-rs/core/src/session/turn.rs @@ -164,7 +164,9 @@ pub(crate) async fn run_turn( return Ok(None); } - sess.record_context_updates_and_set_reference_context_item(turn_context.as_ref()) + // Keep the exact model-visible state used by this turn and its inline compactions. + let mut world_state = sess + .record_context_updates_and_set_reference_context_item(turn_context.as_ref()) .await; let Some((injection_items, explicitly_enabled_connectors)) = @@ -250,11 +252,13 @@ pub(crate) async fn run_turn( let step_context = StepContext { environments: sess.services.turn_environments.snapshot().await, }; - sess.record_step_environment_context_if_changed( - turn_context.as_ref(), - &step_context, - ) - .await; + world_state = sess + .record_step_environment_context_if_changed( + turn_context.as_ref(), + &world_state, + &step_context, + ) + .await; } // Construct the input that we will send to the model. @@ -341,7 +345,7 @@ pub(crate) async fn run_turn( .await; let started_new_context_window = sess - .maybe_start_new_context_window(turn_context.as_ref()) + .maybe_start_new_context_window(turn_context.as_ref(), Arc::clone(&world_state)) .await .is_some(); if started_new_context_window && needs_follow_up { @@ -361,7 +365,7 @@ pub(crate) async fn run_turn( &sess, &turn_context, &mut client_session, - InitialContextInjection::BeforeLastUserMessage, + InitialContextInjection::BeforeLastUserMessage(Arc::clone(&world_state)), CompactionReason::ContextLimit, CompactionPhase::MidTurn, ) @@ -2091,7 +2095,8 @@ async fn try_run_sampling_request( } ResponseItem::Reasoning { .. } => true, ResponseItem::AgentMessage { .. } => false, - ResponseItem::LocalShellCall { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::LocalShellCall { .. } | ResponseItem::FunctionCall { .. } | ResponseItem::ToolSearchCall { .. } | ResponseItem::FunctionCallOutput { .. } diff --git a/codex-rs/core/src/session/world_state.rs b/codex-rs/core/src/session/world_state.rs index 5d12857748..3d46522b8e 100644 --- a/codex-rs/core/src/session/world_state.rs +++ b/codex-rs/core/src/session/world_state.rs @@ -4,34 +4,21 @@ use crate::context::world_state::WorldState; use crate::environment_selection::TurnEnvironmentSnapshot; use codex_protocol::protocol::TurnContextItem; -pub(super) fn build_world_state_from_turn_context( +pub(super) fn build_world_state_from_environment_snapshot( turn_context: &TurnContext, + environments: &TurnEnvironmentSnapshot, environment_subagents: &str, ) -> WorldState { let mut world_state = WorldState::default(); if turn_context.config.include_environment_context { world_state.add_section( - EnvironmentsState::from_turn_context(turn_context) + EnvironmentsState::from_turn_context_with_environments(turn_context, environments) .with_subagents(environment_subagents.to_string()), ); } world_state } -pub(super) fn build_world_state_from_environment_snapshot( - turn_context: &TurnContext, - environments: &TurnEnvironmentSnapshot, -) -> WorldState { - let mut world_state = WorldState::default(); - if turn_context.config.include_environment_context { - world_state.add_section(EnvironmentsState::from_turn_context_with_environments( - turn_context, - environments, - )); - } - world_state -} - pub(super) fn build_world_state_from_turn_context_item( turn_context_item: &TurnContextItem, ) -> WorldState { diff --git a/codex-rs/core/src/tasks/user_shell.rs b/codex-rs/core/src/tasks/user_shell.rs index 844e327bdf..d588e5a356 100644 --- a/codex-rs/core/src/tasks/user_shell.rs +++ b/codex-rs/core/src/tasks/user_shell.rs @@ -226,6 +226,7 @@ pub(crate) async fn execute_user_shell_command( arg0: None, exec_server_sandbox: None, exec_server_enforce_managed_network: false, + exec_server_managed_network: None, }; let stdout_stream = Some(StdoutStream { diff --git a/codex-rs/core/src/thread_manager.rs b/codex-rs/core/src/thread_manager.rs index deba2864b6..816df89c39 100644 --- a/codex-rs/core/src/thread_manager.rs +++ b/codex-rs/core/src/thread_manager.rs @@ -1602,7 +1602,7 @@ fn stored_thread_to_initial_history( })?; Ok(InitialHistory::Resumed(ResumedHistory { conversation_id: thread_id, - history: history.items, + history: Arc::new(history.items), rollout_path: rollout_path.or(stored_thread.rollout_path), })) } @@ -1639,7 +1639,7 @@ fn truncate_before_nth_user_message( n: usize, snapshot_state: &SnapshotTurnState, ) -> InitialHistory { - let items: Vec = history.get_rollout_items(); + let items = history.get_rollout_items().to_vec(); let user_positions = truncation::user_message_positions_in_rollout(&items); let rolled = if snapshot_state.ends_mid_turn && n >= user_positions.len() { if let Some(cut_idx) = snapshot_state @@ -1671,7 +1671,7 @@ struct SnapshotTurnState { fn snapshot_turn_state(history: &InitialHistory) -> SnapshotTurnState { let rollout_items = history.get_rollout_items(); let mut builder = ThreadHistoryBuilder::new(); - for item in &rollout_items { + for item in rollout_items { builder.handle_rollout_item(item); } let active_turn_id = builder.active_turn_id_if_explicit(); @@ -1695,7 +1695,7 @@ fn snapshot_turn_state(history: &InitialHistory) -> SnapshotTurnState { }; } - let Some(last_user_position) = truncation::user_message_positions_in_rollout(&rollout_items) + let Some(last_user_position) = truncation::user_message_positions_in_rollout(rollout_items) .last() .copied() else { @@ -1736,7 +1736,9 @@ fn fork_history_from_snapshot( InitialHistory::New => InitialHistory::New, InitialHistory::Cleared => InitialHistory::Cleared, InitialHistory::Forked(history) => InitialHistory::Forked(history), - InitialHistory::Resumed(resumed) => InitialHistory::Forked(resumed.history), + InitialHistory::Resumed(resumed) => { + InitialHistory::Forked(Arc::unwrap_or_clone(resumed.history)) + } }; if snapshot_state.ends_mid_turn { append_interrupted_boundary( @@ -1782,12 +1784,13 @@ fn append_interrupted_boundary( history.push(aborted_event); InitialHistory::Forked(history) } - InitialHistory::Resumed(mut resumed) => { + InitialHistory::Resumed(resumed) => { + let mut history = Arc::unwrap_or_clone(resumed.history); if let Some(marker) = interrupted_turn_history_marker(interrupted_marker) { - resumed.history.push(RolloutItem::ResponseItem(marker)); + history.push(RolloutItem::ResponseItem(marker)); } - resumed.history.push(aborted_event); - InitialHistory::Forked(resumed.history) + history.push(aborted_event); + InitialHistory::Forked(history) } } } diff --git a/codex-rs/core/src/thread_manager_tests.rs b/codex-rs/core/src/thread_manager_tests.rs index afb103b883..ea9879bbd7 100644 --- a/codex-rs/core/src/thread_manager_tests.rs +++ b/codex-rs/core/src/thread_manager_tests.rs @@ -4,6 +4,7 @@ use crate::init_state_db; use crate::installation_id::INSTALLATION_ID_FILENAME; use crate::rollout::RolloutRecorder; use crate::session::session::SessionSettingsUpdate; +use crate::session::tests::build_world_state_from_turn_context; use crate::session::tests::make_session_and_context; use crate::tasks::InterruptedTurnHistoryMarker; use crate::tasks::interrupted_turn_history_marker; @@ -116,7 +117,7 @@ fn truncates_before_requested_user_message() { RolloutItem::ResponseItem(items[2].clone()), ]; assert_eq!( - serde_json::to_value(&got_items).unwrap(), + serde_json::to_value(got_items).unwrap(), serde_json::to_value(&expected_items).unwrap() ); @@ -225,7 +226,10 @@ fn out_of_range_truncation_drops_pre_user_active_turn_prefix() { #[tokio::test] async fn ignores_session_prefix_messages_when_truncating() { let (session, turn_context) = make_session_and_context().await; - let mut items = session.build_initial_context(&turn_context).await; + let world_state = build_world_state_from_turn_context(&session, &turn_context).await; + let mut items = session + .build_initial_context_with_world_state(&turn_context, &world_state) + .await; items.push(user_msg("feature request")); items.push(assistant_msg("ack")); items.push(user_msg("second question")); @@ -256,7 +260,7 @@ async fn ignores_session_prefix_messages_when_truncating() { ]; assert_eq!( - serde_json::to_value(&got_items).unwrap(), + serde_json::to_value(got_items).unwrap(), serde_json::to_value(&expected).unwrap() ); } @@ -963,7 +967,7 @@ async fn rollout_path_resume_and_fork_read_history_through_thread_store() { config.clone(), InitialHistory::Resumed(ResumedHistory { conversation_id: source.thread_id, - history: vec![RolloutItem::ResponseItem(user_msg("hello"))], + history: Arc::new(vec![RolloutItem::ResponseItem(user_msg("hello"))]), rollout_path: Some(rollout_path.clone()), }), auth_manager.clone(), @@ -1315,7 +1319,7 @@ async fn interrupted_fork_snapshot_does_not_synthesize_turn_id_for_legacy_histor assert!(!snapshot_turn_state(&history).ends_mid_turn); let rollout_items: Vec<_> = history .get_rollout_items() - .into_iter() + .iter() .filter(|item| !matches!(item, RolloutItem::SessionMeta(_))) .collect(); let interrupted_marker_json = serde_json::to_value(RolloutItem::ResponseItem( @@ -1435,7 +1439,7 @@ async fn interrupted_fork_snapshot_preserves_explicit_turn_id() { .expect("read forked rollout history"); let rollout_items: Vec<_> = history .get_rollout_items() - .into_iter() + .iter() .filter(|item| !matches!(item, RolloutItem::SessionMeta(_))) .collect(); @@ -1522,7 +1526,7 @@ async fn interrupted_fork_snapshot_uses_persisted_mid_turn_history_without_live_ let forked_rollout_items: Vec<_> = history .get_rollout_items() - .into_iter() + .iter() .filter(|item| !matches!(item, RolloutItem::SessionMeta(_))) .collect(); let interrupted_marker_json = serde_json::to_value(RolloutItem::ResponseItem( @@ -1560,7 +1564,7 @@ async fn interrupted_fork_snapshot_uses_persisted_mid_turn_history_without_live_ .expect("read re-forked rollout history"); let reforked_rollout_items: Vec<_> = reforked_history .get_rollout_items() - .into_iter() + .iter() .filter(|item| !matches!(item, RolloutItem::SessionMeta(_))) .collect(); diff --git a/codex-rs/core/src/thread_rollout_truncation_tests.rs b/codex-rs/core/src/thread_rollout_truncation_tests.rs index 2df3d1c98e..2e6d8fde7c 100644 --- a/codex-rs/core/src/thread_rollout_truncation_tests.rs +++ b/codex-rs/core/src/thread_rollout_truncation_tests.rs @@ -1,4 +1,5 @@ use super::*; +use crate::session::tests::build_world_state_from_turn_context; use crate::session::tests::make_session_and_context; use codex_protocol::AgentPath; use codex_protocol::models::ContentItem; @@ -166,7 +167,10 @@ fn truncates_rollout_from_start_applies_thread_rollback_markers() { #[tokio::test] async fn ignores_session_prefix_messages_when_truncating_rollout_from_start() { let (session, turn_context) = make_session_and_context().await; - let mut items = session.build_initial_context(&turn_context).await; + let world_state = build_world_state_from_turn_context(&session, &turn_context).await; + let mut items = session + .build_initial_context_with_world_state(&turn_context, &world_state) + .await; items.push(user_msg("feature request")); items.push(assistant_msg("ack")); items.push(user_msg("second question")); diff --git a/codex-rs/core/src/tools/network_approval_tests.rs b/codex-rs/core/src/tools/network_approval_tests.rs index 60c7215b1b..7a9ba86cef 100644 --- a/codex-rs/core/src/tools/network_approval_tests.rs +++ b/codex-rs/core/src/tools/network_approval_tests.rs @@ -250,7 +250,6 @@ fn allow_once_and_allow_for_session_both_allow_network() { fn only_never_policy_disables_network_approval_flow() { assert!(!allows_network_approval_flow(AskForApproval::Never)); assert!(allows_network_approval_flow(AskForApproval::OnRequest)); - assert!(allows_network_approval_flow(AskForApproval::OnFailure)); assert!(allows_network_approval_flow(AskForApproval::UnlessTrusted)); } diff --git a/codex-rs/core/src/tools/runtimes/apply_patch.rs b/codex-rs/core/src/tools/runtimes/apply_patch.rs index 7ef7687842..840a0dd01e 100644 --- a/codex-rs/core/src/tools/runtimes/apply_patch.rs +++ b/codex-rs/core/src/tools/runtimes/apply_patch.rs @@ -205,7 +205,6 @@ impl Approvable for ApplyPatchRuntime { match policy { AskForApproval::Never => false, AskForApproval::Granular(granular_config) => granular_config.allows_sandbox_approval(), - AskForApproval::OnFailure => true, AskForApproval::OnRequest => true, AskForApproval::UnlessTrusted => true, } diff --git a/codex-rs/core/src/tools/runtimes/mod.rs b/codex-rs/core/src/tools/runtimes/mod.rs index 27f4ee5946..db55cc2bbc 100644 --- a/codex-rs/core/src/tools/runtimes/mod.rs +++ b/codex-rs/core/src/tools/runtimes/mod.rs @@ -50,6 +50,7 @@ pub(crate) fn build_sandbox_command( args: args.to_vec(), cwd, env: env.clone(), + managed_network: None, additional_permissions, }) } @@ -67,26 +68,26 @@ pub(crate) fn exec_env_for_sandbox_permissions( env } -pub(crate) fn strip_managed_proxy_env(env: &mut HashMap) { - for key in PROXY_ENV_KEYS { - env.remove(*key); +pub(crate) fn is_managed_proxy_env_var(key: &str, value: &str) -> bool { + if PROXY_ENV_KEYS.contains(&key) { + return true; } - for key in CUSTOM_CA_ENV_KEYS { - if env - .get(key) - .is_some_and(|value| is_managed_mitm_ca_trust_bundle_path(value)) - { - env.remove(key); - } + if CUSTOM_CA_ENV_KEYS.contains(&key) { + return is_managed_mitm_ca_trust_bundle_path(value); } - // Only macOS injects a Codex-owned SSH wrapper for the managed SOCKS proxy. #[cfg(target_os = "macos")] - if env - .get(PROXY_GIT_SSH_COMMAND_ENV_KEY) - .is_some_and(|command| command.starts_with(CODEX_PROXY_GIT_SSH_COMMAND_MARKER)) { - env.remove(PROXY_GIT_SSH_COMMAND_ENV_KEY); + key == PROXY_GIT_SSH_COMMAND_ENV_KEY + && value.starts_with(CODEX_PROXY_GIT_SSH_COMMAND_MARKER) } + #[cfg(not(target_os = "macos"))] + { + false + } +} + +pub(crate) fn strip_managed_proxy_env(env: &mut HashMap) { + env.retain(|key, value| !is_managed_proxy_env_var(key, value)); } /// Prepends `path_entry` to `PATH`, removing duplicate and empty existing diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs index a77645f941..10cb460205 100644 --- a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs +++ b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs @@ -168,6 +168,7 @@ pub(super) async fn try_run_zsh_fork( arg0, exec_server_sandbox: _, exec_server_enforce_managed_network: _, + exec_server_managed_network: _, } = sandbox_exec_request; let ParsedShellCommand { script, login, .. } = extract_shell_script(&command)?; let effective_timeout = Duration::from_millis( @@ -902,6 +903,7 @@ impl CoreShellCommandExecutor { arg0: self.arg0.clone(), exec_server_sandbox: None, exec_server_enforce_managed_network: false, + exec_server_managed_network: None, }, /*stdout_stream*/ None, after_spawn, @@ -1010,6 +1012,7 @@ impl CoreShellCommandExecutor { args: args.to_vec(), cwd, env, + managed_network: None, additional_permissions, }; let options = ExecOptions { diff --git a/codex-rs/core/src/tools/runtimes/unified_exec.rs b/codex-rs/core/src/tools/runtimes/unified_exec.rs index c1d5191204..5df42cc979 100644 --- a/codex-rs/core/src/tools/runtimes/unified_exec.rs +++ b/codex-rs/core/src/tools/runtimes/unified_exec.rs @@ -41,6 +41,7 @@ use crate::unified_exec::NoopSpawnLifecycle; use crate::unified_exec::UnifiedExecError; use crate::unified_exec::UnifiedExecProcess; use crate::unified_exec::UnifiedExecProcessManager; +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_network_proxy::NetworkProxy; use codex_protocol::error::CodexErr; use codex_protocol::error::SandboxErr; @@ -117,6 +118,7 @@ fn build_unified_exec_sandbox_command( command: &[String], cwd: &PathUri, env: &HashMap, + managed_network: Option, additional_permissions: Option, ) -> Result { let (program, args) = command @@ -127,6 +129,7 @@ fn build_unified_exec_sandbox_command( args: args.to_vec(), cwd: cwd.clone(), env: env.clone(), + managed_network, additional_permissions, }) } @@ -321,22 +324,28 @@ impl<'a> ToolRuntime for UnifiedExecRunt req.network.as_ref(), launch_sandbox_permissions, ); - let mut env = exec_env_for_sandbox_permissions(&req.env, launch_sandbox_permissions); - if let Some(network) = managed_network { - network - .apply_to_env_for_optional_environment( - &mut env, - Some(&req.turn_environment.environment_id), - ) - .map_err(|err| { - ToolError::Codex(CodexErr::Io(io::Error::other(format!( - "failed to prepare network proxy for environment `{}`: {err}", - req.turn_environment.environment_id - )))) - })?; - } + let env = exec_env_for_sandbox_permissions(&req.env, launch_sandbox_permissions); + let (env, managed_network_context) = match managed_network { + Some(network) => { + let prepared = network + .prepare_for_optional_environment( + env, + Some(&req.turn_environment.environment_id), + ) + .map_err(|err| { + ToolError::Codex(CodexErr::Io(io::Error::other(format!( + "failed to prepare network proxy for environment `{}`: {err}", + req.turn_environment.environment_id + )))) + })?; + (prepared.env, Some(prepared.sandbox_context)) + } + None => (env, None), + }; let explicit_env_overrides = req.explicit_env_overrides.clone(); #[cfg(unix)] + let mut env = env; + #[cfg(unix)] let runtime_path_prepends = { let mut runtime_path_prepends = RuntimePathPrepends::default(); if !environment_is_remote { @@ -385,6 +394,7 @@ impl<'a> ToolRuntime for UnifiedExecRunt &command, &req.cwd, &env, + managed_network_context.clone(), req.additional_permissions.clone(), ) .map_err(|error| match error { @@ -450,6 +460,7 @@ impl<'a> ToolRuntime for UnifiedExecRunt &command, &req.cwd, &env, + managed_network_context, req.additional_permissions.clone(), ) .map_err(|error| match error { diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs index 77f68d96b5..8e9e274f24 100644 --- a/codex-rs/core/src/tools/sandboxing.rs +++ b/codex-rs/core/src/tools/sandboxing.rs @@ -196,7 +196,7 @@ impl ExecApprovalRequirement { } } -/// - Never, OnFailure: do not ask +/// - Never: do not ask /// - OnRequest: ask unless filesystem access is unrestricted /// - Granular: ask unless filesystem access is unrestricted, but auto-reject /// when granular sandbox approval is disabled. @@ -206,7 +206,7 @@ pub(crate) fn default_exec_approval_requirement( file_system_sandbox_policy: &FileSystemSandboxPolicy, ) -> ExecApprovalRequirement { let needs_approval = match policy { - AskForApproval::Never | AskForApproval::OnFailure => false, + AskForApproval::Never => false, AskForApproval::OnRequest | AskForApproval::Granular(_) => { matches!( file_system_sandbox_policy.kind, @@ -356,7 +356,6 @@ pub(crate) trait Approvable { /// Decide we can request an approval for no-sandbox execution. fn wants_no_sandbox_approval(&self, policy: AskForApproval) -> bool { match policy { - AskForApproval::OnFailure => true, AskForApproval::UnlessTrusted => true, AskForApproval::Never => false, AskForApproval::OnRequest => false, @@ -466,6 +465,7 @@ impl<'a> SandboxAttempt<'a> { network: Option<&NetworkProxy>, environment_id: Option<&str>, ) -> Result { + let managed_network = command.managed_network.clone(); let exec_server_permissions = effective_permission_profile( self.exec_server_permissions, command.additional_permissions.as_ref(), @@ -492,6 +492,7 @@ impl<'a> SandboxAttempt<'a> { options, self.workspace_roots.to_vec(), ); + exec_request.exec_server_managed_network = managed_network; if self.sandbox_requested { exec_request.exec_server_sandbox = Some(FileSystemSandboxContext { permissions: exec_server_permissions.into(), diff --git a/codex-rs/core/src/tools/sandboxing_tests.rs b/codex-rs/core/src/tools/sandboxing_tests.rs index c647e1c401..28b9de9ce1 100644 --- a/codex-rs/core/src/tools/sandboxing_tests.rs +++ b/codex-rs/core/src/tools/sandboxing_tests.rs @@ -1,6 +1,7 @@ use super::*; use crate::sandboxing::SandboxPermissions; use crate::tools::hook_names::HookToolName; +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_protocol::permissions::FileSystemAccessMode; use codex_protocol::permissions::FileSystemPath; use codex_protocol::permissions::FileSystemSandboxEntry; @@ -212,7 +213,7 @@ fn exec_server_env_keeps_command_native_and_carries_sandbox_context() { .clone() .materialize_project_roots_with_workspace_roots(std::slice::from_ref(&cwd)); let manager = SandboxManager::new(); - let attempt = SandboxAttempt { + let mut attempt = SandboxAttempt { sandbox: SandboxType::None, sandbox_requested: true, permissions: &permissions, @@ -227,20 +228,24 @@ fn exec_server_env_keeps_command_native_and_carries_sandbox_context() { windows_sandbox_private_desktop: false, network_denial_cancellation_token: None, }; - let command = SandboxCommand { + let managed_network = ManagedNetworkSandboxContext { + loopback_ports: vec![43123], + allow_local_binding: false, + }; + let command = || SandboxCommand { program: "/bin/bash".into(), args: vec!["-lc".to_string(), "pwd".to_string()], cwd: cwd_uri.clone(), env: HashMap::new(), + managed_network: Some(managed_network.clone()), additional_permissions: None, }; - let options = crate::sandboxing::ExecOptions { + let options = || crate::sandboxing::ExecOptions { expiration: crate::exec::ExecExpiration::DefaultTimeout, capture_policy: crate::exec::ExecCapturePolicy::ShellTool, }; - let request = attempt - .env_for_exec_server(command, options, /*network*/ None, Some("remote")) + .env_for_exec_server(command(), options(), /*network*/ None, Some("remote")) .expect("prepare remote exec request"); assert_eq!( @@ -256,8 +261,8 @@ fn exec_server_env_keeps_command_native_and_carries_sandbox_context() { assert_eq!( request.exec_server_sandbox, Some(codex_exec_server::FileSystemSandboxContext { - permissions: exec_server_permissions.into(), - cwd: Some(cwd_uri), + permissions: exec_server_permissions.clone().into(), + cwd: Some(cwd_uri.clone()), workspace_roots: Vec::new(), windows_sandbox_level: codex_protocol::config_types::WindowsSandboxLevel::Disabled, windows_sandbox_private_desktop: false, @@ -265,4 +270,17 @@ fn exec_server_env_keeps_command_native_and_carries_sandbox_context() { }) ); assert!(request.exec_server_enforce_managed_network); + assert_eq!( + request.exec_server_managed_network, + Some(managed_network.clone()) + ); + + attempt.sandbox_requested = false; + let request = attempt + .env_for_exec_server(command(), options(), /*network*/ None, Some("remote")) + .expect("prepare unsandboxed remote exec request"); + + assert_eq!(request.exec_server_sandbox, None); + assert!(!request.exec_server_enforce_managed_network); + assert_eq!(request.exec_server_managed_network, Some(managed_network)); } diff --git a/codex-rs/core/src/tools/spec_plan.rs b/codex-rs/core/src/tools/spec_plan.rs index 51cd436503..d161d2c3b9 100644 --- a/codex-rs/core/src/tools/spec_plan.rs +++ b/codex-rs/core/src/tools/spec_plan.rs @@ -96,6 +96,7 @@ use tracing::warn; const MULTI_AGENT_V2_NAMESPACE_DESCRIPTION: &str = "Tools for spawning and managing sub-agents."; const IMAGE_GEN_NAMESPACE: &str = "image_gen"; const IMAGEGEN_TOOL_NAME: &str = "imagegen"; +const ACTOR_AUTHORIZATION_HEADER: &str = "x-openai-actor-authorization"; type PlannedRuntime = Arc; @@ -383,10 +384,12 @@ fn image_generation_tool_enabled(turn_context: &TurnContext) -> bool { } fn image_generation_runtime_enabled(turn_context: &TurnContext) -> bool { - turn_context - .auth_manager - .as_deref() - .is_some_and(AuthManager::current_auth_uses_codex_backend) + (provider_uses_actor_authorization(turn_context) + || (turn_context.provider.info().requires_openai_auth + && turn_context + .auth_manager + .as_deref() + .is_some_and(AuthManager::current_auth_uses_codex_backend))) && turn_context.provider.capabilities().image_generation && turn_context .model_info @@ -394,6 +397,16 @@ fn image_generation_runtime_enabled(turn_context: &TurnContext) -> bool { .contains(&InputModality::Image) } +fn provider_uses_actor_authorization(turn_context: &TurnContext) -> bool { + let provider_info = turn_context.provider.info(); + !provider_info.requires_openai_auth + && provider_info.http_headers.as_ref().is_some_and(|headers| { + headers.iter().any(|(name, value)| { + name.eq_ignore_ascii_case(ACTOR_AUTHORIZATION_HEADER) && !value.trim().is_empty() + }) + }) +} + fn standalone_image_generation_model_visible(turn_context: &TurnContext) -> bool { if !image_generation_runtime_enabled(turn_context) || !namespace_tools_enabled(turn_context) { return false; diff --git a/codex-rs/core/src/tools/spec_plan_tests.rs b/codex-rs/core/src/tools/spec_plan_tests.rs index 5d70fb8f17..689948ad29 100644 --- a/codex-rs/core/src/tools/spec_plan_tests.rs +++ b/codex-rs/core/src/tools/spec_plan_tests.rs @@ -1,4 +1,5 @@ use std::collections::BTreeMap; +use std::collections::HashMap; use std::sync::Arc; use codex_features::Feature; @@ -39,6 +40,8 @@ use crate::tools::router::ToolRouterParams; use crate::tools::router::ToolSuggestCandidates; use crate::tools::router::ToolSuggestPresentation; +const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; + #[derive(Default)] struct ToolPlanInputs { mcp_tools: Option>, @@ -268,6 +271,29 @@ fn use_bedrock_provider(turn: &mut TurnContext) { turn.provider = create_model_provider(provider_info, turn.auth_manager.clone()); } +fn use_provider_auth( + turn: &mut TurnContext, + requires_openai_auth: bool, + actor_header: Option<(&str, &str)>, +) { + let mut provider_info = turn.config.model_provider.clone(); + provider_info.requires_openai_auth = requires_openai_auth; + provider_info.http_headers = actor_header.map(|(name, value)| { + HashMap::from([ + (name.to_string(), value.to_string()), + ( + "ChatGPT-Account-ID".to_string(), + "test-account-id".to_string(), + ), + ]) + }); + turn.auth_manager = None; + update_config(turn, |config| { + config.model_provider = provider_info.clone(); + }); + turn.provider = create_model_provider(provider_info, /*auth_manager*/ None); +} + struct WebRunExtensionTool; impl ToolExecutor for WebRunExtensionTool { @@ -1151,19 +1177,48 @@ async fn multi_agent_feature_selects_one_agent_tool_family() { }); }) .await; - v2.assert_visible_contains(&[ + v2.assert_visible_contains(&[MULTI_AGENT_V2_NAMESPACE]); + v2.assert_visible_lacks(&[ "spawn_agent", "send_message", "followup_task", "wait_agent", "interrupt_agent", "list_agents", + "send_input", + "resume_agent", + "assign_task", + "close_agent", ]); - v2.assert_visible_lacks(&["send_input", "resume_agent", "assign_task", "close_agent"]); - let spawn_agent_description = match v2.visible_spec("spawn_agent") { - ToolSpec::Function(tool) => tool.description.as_str(), - other => panic!("expected spawn_agent function spec, got {other:?}"), + for tool_name in [ + "spawn_agent", + "send_message", + "followup_task", + "wait_agent", + "interrupt_agent", + "list_agents", + ] { + assert!( + v2.namespace_function_names(MULTI_AGENT_V2_NAMESPACE) + .iter() + .any(|name| name == tool_name), + "expected {tool_name} in {MULTI_AGENT_V2_NAMESPACE} namespace" + ); + } + let ToolSpec::Namespace(namespace) = v2.visible_spec(MULTI_AGENT_V2_NAMESPACE) else { + panic!("expected {MULTI_AGENT_V2_NAMESPACE} namespace"); }; + let Some(ResponsesApiNamespaceTool::Function(spawn_agent)) = + namespace.tools.iter().find(|tool| { + matches!( + tool, + ResponsesApiNamespaceTool::Function(tool) if tool.name == "spawn_agent" + ) + }) + else { + panic!("expected spawn_agent in {MULTI_AGENT_V2_NAMESPACE} namespace"); + }; + let spawn_agent_description = spawn_agent.description.as_str(); assert!(!spawn_agent_description.contains("max_concurrent_threads_per_session")); assert!(spawn_agent_description.contains( "Note that passing `fork_turns=\"none\"` will not pass any surrounding context to the spawned subagent" @@ -1183,9 +1238,11 @@ async fn multi_agent_feature_selects_one_agent_tool_family() { }); }) .await; - direct_model_only.assert_visible_contains(&["spawn_agent", "send_message", "wait_agent"]); + direct_model_only.assert_visible_contains(&[MULTI_AGENT_V2_NAMESPACE]); + direct_model_only.assert_visible_lacks(&["spawn_agent", "send_message", "wait_agent"]); assert_eq!( - direct_model_only.exposure("spawn_agent"), + direct_model_only + .exposure(&ToolName::namespaced(MULTI_AGENT_V2_NAMESPACE, "spawn_agent").to_string()), ToolExposure::DirectModelOnly ); } @@ -1196,9 +1253,17 @@ async fn multi_agent_v2_message_schemas_are_encrypted() { set_feature(turn, Feature::MultiAgentV2, /*enabled*/ true); }) .await; + let ToolSpec::Namespace(namespace) = plan.visible_spec(MULTI_AGENT_V2_NAMESPACE) else { + panic!("expected {MULTI_AGENT_V2_NAMESPACE} namespace"); + }; for tool_name in ["spawn_agent", "send_message", "followup_task"] { - let ToolSpec::Function(tool) = plan.visible_spec(tool_name) else { - panic!("expected {tool_name} function spec"); + let Some(ResponsesApiNamespaceTool::Function(tool)) = namespace.tools.iter().find(|tool| { + matches!( + tool, + ResponsesApiNamespaceTool::Function(tool) if tool.name == tool_name + ) + }) else { + panic!("expected {tool_name} in {MULTI_AGENT_V2_NAMESPACE} namespace"); }; let properties = tool .parameters @@ -1414,6 +1479,110 @@ async fn hosted_tools_follow_provider_auth_model_and_config_gates() { .await; api_key_auth.assert_visible_lacks(&["image_generation"]); + let unrelated_chatgpt_auth = probe(|turn| { + use_chatgpt_auth(turn); + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + let mut provider_info = turn.provider.info().clone(); + provider_info.requires_openai_auth = false; + provider_info.http_headers = None; + update_config(turn, |config| { + config.model_provider = provider_info.clone(); + }); + turn.provider = create_model_provider(provider_info, turn.auth_manager.clone()); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + unrelated_chatgpt_auth.assert_visible_lacks(&["image_generation"]); + + let provider_without_actor_auth = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + use_provider_auth( + turn, /*requires_openai_auth*/ false, /*actor_header*/ None, + ); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + provider_without_actor_auth.assert_visible_lacks(&["image_generation"]); + + let provider_authenticated = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + use_provider_auth( + turn, + /*requires_openai_auth*/ false, + Some(("X-OpenAI-Actor-Authorization", "test-actor-authorization")), + ); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + provider_authenticated.assert_visible_contains(&["image_generation"]); + + let empty_actor_auth = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + use_provider_auth( + turn, + /*requires_openai_auth*/ false, + Some(("x-openai-actor-authorization", " ")), + ); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + empty_actor_auth.assert_visible_lacks(&["image_generation"]); + + let feature_disabled = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ false); + use_provider_auth( + turn, + /*requires_openai_auth*/ false, + Some(("x-openai-actor-authorization", "test-actor-authorization")), + ); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + feature_disabled.assert_visible_lacks(&["image_generation"]); + + let text_only_model = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + use_provider_auth( + turn, + /*requires_openai_auth*/ false, + Some(("x-openai-actor-authorization", "test-actor-authorization")), + ); + turn.model_info.input_modalities = vec![]; + }) + .await; + text_only_model.assert_visible_lacks(&["image_generation"]); + + let unsupported_image_generation_provider = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + use_bedrock_provider(turn); + let mut provider_info = turn.provider.info().clone(); + provider_info.requires_openai_auth = false; + provider_info.http_headers = Some(HashMap::from([( + "x-openai-actor-authorization".to_string(), + "test-actor-authorization".to_string(), + )])); + turn.auth_manager = None; + update_config(turn, |config| { + config.model_provider = provider_info.clone(); + }); + turn.provider = create_model_provider(provider_info, /*auth_manager*/ None); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + unsupported_image_generation_provider.assert_visible_lacks(&["image_generation"]); + + let codex_managed_auth_provider = probe(|turn| { + set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); + use_provider_auth( + turn, + /*requires_openai_auth*/ true, + Some(("x-openai-actor-authorization", "test-actor-authorization")), + ); + turn.model_info.input_modalities = vec![InputModality::Image]; + }) + .await; + codex_managed_auth_provider.assert_visible_lacks(&["image_generation"]); + let image_generation = probe(|turn| { use_chatgpt_auth(turn); set_feature(turn, Feature::ImageGeneration, /*enabled*/ true); @@ -1464,12 +1633,7 @@ async fn hosted_tools_follow_provider_auth_model_and_config_gates() { codex_code_mode::WAIT_TOOL_NAME, "request_user_input", // Multi-agent v2 tools. - "spawn_agent", - "send_message", - "followup_task", - "wait_agent", - "interrupt_agent", - "list_agents", + MULTI_AGENT_V2_NAMESPACE, // Hosted Responses tools. "web_search", "image_generation", diff --git a/codex-rs/core/src/turn_timing.rs b/codex-rs/core/src/turn_timing.rs index e7a90800b0..04f7aeb69b 100644 --- a/codex-rs/core/src/turn_timing.rs +++ b/codex-rs/core/src/turn_timing.rs @@ -380,7 +380,8 @@ fn response_item_records_turn_ttft(item: &ResponseItem) -> bool { | ResponseItem::Compaction { .. } | ResponseItem::ContextCompaction { .. } => true, ResponseItem::CompactionTrigger { .. } => false, - ResponseItem::FunctionCallOutput { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::FunctionCallOutput { .. } | ResponseItem::CustomToolCallOutput { .. } | ResponseItem::ToolSearchOutput { .. } | ResponseItem::Other => false, diff --git a/codex-rs/core/src/unified_exec/process_manager.rs b/codex-rs/core/src/unified_exec/process_manager.rs index 2cb62a6d4b..5e89445765 100644 --- a/codex-rs/core/src/unified_exec/process_manager.rs +++ b/codex-rs/core/src/unified_exec/process_manager.rs @@ -26,6 +26,7 @@ use crate::tools::events::ToolEventStage; use crate::tools::network_approval::DeferredNetworkApproval; use crate::tools::network_approval::finish_deferred_network_approval; use crate::tools::orchestrator::ToolOrchestrator; +use crate::tools::runtimes::is_managed_proxy_env_var; use crate::tools::runtimes::unified_exec::UnifiedExecRequest as UnifiedExecToolRequest; use crate::tools::runtimes::unified_exec::UnifiedExecRuntime; use crate::tools::sandboxing::SandboxAttempt; @@ -143,10 +144,16 @@ fn exec_server_env_for_request( HashMap, ) { if let Some(exec_server_env_config) = &request.exec_server_env_config { - ( - Some(exec_server_env_config.policy.clone()), - env_overlay_for_exec_server(&request.env, &exec_server_env_config.local_policy_env), - ) + let mut env = + env_overlay_for_exec_server(&request.env, &exec_server_env_config.local_policy_env); + if request.exec_server_managed_network.is_some() { + for (key, value) in &request.env { + if is_managed_proxy_env_var(key, value) { + env.insert(key.clone(), value.clone()); + } + } + } + (Some(exec_server_env_config.policy.clone()), env) } else { (None, request.env.clone()) } @@ -175,6 +182,7 @@ fn exec_server_params_for_request( arg0: request.arg0.clone(), sandbox: request.exec_server_sandbox.clone(), enforce_managed_network: request.exec_server_enforce_managed_network, + managed_network: request.exec_server_managed_network.clone(), } } diff --git a/codex-rs/core/src/unified_exec/process_manager_tests.rs b/codex-rs/core/src/unified_exec/process_manager_tests.rs index cd48d01c7c..93ffd0cedb 100644 --- a/codex-rs/core/src/unified_exec/process_manager_tests.rs +++ b/codex-rs/core/src/unified_exec/process_manager_tests.rs @@ -1,5 +1,6 @@ use super::*; use crate::unified_exec::clamp_yield_time; +use codex_network_proxy::ManagedNetworkSandboxContext; use pretty_assertions::assert_eq; use tokio::time::Duration; use tokio::time::Instant; @@ -76,6 +77,10 @@ fn exec_server_params_use_path_uri_and_env_policy_overlay_contract() { codex_protocol::permissions::FileSystemSandboxPolicy::unrestricted(); let network_sandbox_policy = codex_protocol::permissions::NetworkSandboxPolicy::Restricted; let permission_profile = codex_protocol::models::PermissionProfile::Disabled; + let managed_network = ManagedNetworkSandboxContext { + loopback_ports: vec![43123], + allow_local_binding: false, + }; let mut request = ExecRequest { command: vec!["bash".to_string(), "-lc".to_string(), "true".to_string()], cwd: cwd.clone().into(), @@ -83,6 +88,15 @@ fn exec_server_params_use_path_uri_and_env_policy_overlay_contract() { ("HOME".to_string(), "/client-home".to_string()), ("PATH".to_string(), "/sandbox-path".to_string()), ("CODEX_THREAD_ID".to_string(), "thread-1".to_string()), + ( + "HTTP_PROXY".to_string(), + "http://127.0.0.1:43123".to_string(), + ), + ("CODEX_NETWORK_PROXY_ACTIVE".to_string(), "1".to_string()), + ( + "SSL_CERT_FILE".to_string(), + "/client/custom-ca.pem".to_string(), + ), ]), exec_server_env_config: Some(ExecServerEnvConfig { policy: codex_exec_server::ExecEnvPolicy { @@ -95,6 +109,15 @@ fn exec_server_params_use_path_uri_and_env_policy_overlay_contract() { local_policy_env: HashMap::from([ ("HOME".to_string(), "/client-home".to_string()), ("PATH".to_string(), "/client-path".to_string()), + ( + "HTTP_PROXY".to_string(), + "http://127.0.0.1:43123".to_string(), + ), + ("CODEX_NETWORK_PROXY_ACTIVE".to_string(), "1".to_string()), + ( + "SSL_CERT_FILE".to_string(), + "/client/custom-ca.pem".to_string(), + ), ]), }), network: None, @@ -112,7 +135,8 @@ fn exec_server_params_use_path_uri_and_env_policy_overlay_contract() { windows_sandbox_filesystem_overrides: None, arg0: None, exec_server_sandbox: None, - exec_server_enforce_managed_network: false, + exec_server_enforce_managed_network: true, + exec_server_managed_network: Some(managed_network.clone()), }; let params = @@ -120,12 +144,19 @@ fn exec_server_params_use_path_uri_and_env_policy_overlay_contract() { assert_eq!(params.process_id.as_str(), "123"); assert_eq!(params.cwd, request.cwd); + assert!(params.enforce_managed_network); + assert_eq!(params.managed_network, Some(managed_network)); assert!(params.env_policy.is_some()); assert_eq!( params.env, HashMap::from([ ("PATH".to_string(), "/sandbox-path".to_string()), ("CODEX_THREAD_ID".to_string(), "thread-1".to_string()), + ( + "HTTP_PROXY".to_string(), + "http://127.0.0.1:43123".to_string(), + ), + ("CODEX_NETWORK_PROXY_ACTIVE".to_string(), "1".to_string(),), ]) ); request.exec_server_sandbox = Some( diff --git a/codex-rs/core/tests/suite/agent_execution.rs b/codex-rs/core/tests/suite/agent_execution.rs index f073d70089..69db20cc57 100644 --- a/codex-rs/core/tests/suite/agent_execution.rs +++ b/codex-rs/core/tests/suite/agent_execution.rs @@ -2,7 +2,7 @@ use anyhow::Result; use codex_features::Feature; use core_test_support::responses::ev_assistant_message; use core_test_support::responses::ev_completed; -use core_test_support::responses::ev_function_call; +use core_test_support::responses::ev_function_call_with_namespace; use core_test_support::responses::ev_response_created; use core_test_support::responses::mount_sse_once_match; use core_test_support::responses::sse; @@ -15,6 +15,7 @@ use std::time::Duration; const FIRST_PROMPT: &str = "spawn the first worker"; const FIRST_TASK: &str = "first worker task"; const SECOND_TASK: &str = "second worker task"; +const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; fn body_contains(request: &wiremock::Request, text: &str) -> bool { serde_json::from_slice::(&request.body) @@ -47,7 +48,12 @@ async fn v2_nested_spawn_checks_shared_active_execution_capacity() -> Result<()> |request: &wiremock::Request| body_contains(request, FIRST_PROMPT), sse(vec![ ev_response_created("first-response"), - ev_function_call("first-call", "spawn_agent", &first_args), + ev_function_call_with_namespace( + "first-call", + MULTI_AGENT_V2_NAMESPACE, + "spawn_agent", + &first_args, + ), ev_completed("first-response"), ]), ) @@ -63,7 +69,12 @@ async fn v2_nested_spawn_checks_shared_active_execution_capacity() -> Result<()> }, sse(vec![ ev_response_created("first-worker-response"), - ev_function_call("second-call", "spawn_agent", &second_args), + ev_function_call_with_namespace( + "second-call", + MULTI_AGENT_V2_NAMESPACE, + "spawn_agent", + &second_args, + ), ev_completed("first-worker-response"), ]), ) diff --git a/codex-rs/core/tests/suite/agent_websocket.rs b/codex-rs/core/tests/suite/agent_websocket.rs index f3e1047784..9e75e36e99 100644 --- a/codex-rs/core/tests/suite/agent_websocket.rs +++ b/codex-rs/core/tests/suite/agent_websocket.rs @@ -1,6 +1,10 @@ use anyhow::Result; use codex_features::Feature; use codex_protocol::config_types::ServiceTier; +use codex_protocol::protocol::EventMsg; +use codex_protocol::protocol::Op; +use codex_protocol::protocol::ThreadSettingsOverrides; +use codex_protocol::user_input::UserInput; use core_test_support::responses::WebSocketConnectionConfig; use core_test_support::responses::ev_assistant_message; use core_test_support::responses::ev_completed; @@ -10,12 +14,89 @@ use core_test_support::responses::start_websocket_server; use core_test_support::responses::start_websocket_server_with_headers; use core_test_support::skip_if_no_network; use core_test_support::test_codex::test_codex; +use core_test_support::wait_for_event; use pretty_assertions::assert_eq; use serde_json::Value; use std::time::Duration; const WS_V2_BETA_HEADER_VALUE: &str = "responses_websockets=2026-02-06"; +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn websocket_model_switch_to_responses_lite_omits_top_level_tools() -> Result<()> { + skip_if_no_network!(Ok(())); + + let server = start_websocket_server(vec![vec![ + vec![ev_response_created("warm-1"), ev_completed("warm-1")], + vec![ev_response_created("resp-1"), ev_completed("resp-1")], + vec![ev_response_created("resp-2"), ev_completed("resp-2")], + ]]) + .await; + + let mut builder = test_codex() + .with_model_info_override("gpt-5.4", |model_info| { + model_info.use_responses_lite = true; + }) + .with_model("gpt-5.3-codex"); + let test = builder.build_with_websocket_server(&server).await?; + + test.submit_turn("non-lite turn").await?; + test.codex + .submit(Op::UserInput { + items: vec![UserInput::Text { + text: "lite turn".into(), + text_elements: Vec::new(), + }], + final_output_json_schema: None, + responsesapi_client_metadata: None, + additional_context: Default::default(), + thread_settings: ThreadSettingsOverrides { + model: Some("gpt-5.4".to_string()), + ..Default::default() + }, + }) + .await?; + wait_for_event(&test.codex, |event| { + matches!(event, EventMsg::TurnComplete(_)) + }) + .await; + + assert_eq!(server.handshakes().len(), 1); + let connection = server.single_connection(); + assert_eq!(connection.len(), 3); + let non_lite_turn = connection + .get(1) + .expect("missing non-lite turn request") + .body_json(); + let lite_turn = connection + .get(2) + .expect("missing lite turn request") + .body_json(); + + assert_eq!(non_lite_turn["model"].as_str(), Some("gpt-5.3-codex")); + assert_eq!(lite_turn["model"].as_str(), Some("gpt-5.4")); + assert!( + non_lite_turn + .get("tools") + .and_then(Value::as_array) + .is_some_and(|tools| !tools.is_empty()) + ); + assert_eq!(lite_turn.get("previous_response_id"), None); + assert_eq!(lite_turn.get("tools"), None); + assert_eq!(lite_turn.get("instructions"), None); + let additional_tools = lite_turn + .get("input") + .and_then(Value::as_array) + .and_then(|input| input.first()) + .filter(|item| item.get("type").and_then(Value::as_str) == Some("additional_tools")) + .and_then(|item| item.get("tools")) + .and_then(Value::as_array) + .expect("lite turn should start with an additional_tools item"); + assert!(!additional_tools.is_empty()); + + server.shutdown().await; + Ok(()) +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn websocket_test_codex_shell_chain() -> Result<()> { skip_if_no_network!(Ok(())); diff --git a/codex-rs/core/tests/suite/approvals.rs b/codex-rs/core/tests/suite/approvals.rs index f26b8e4b85..f0ab48c5e1 100644 --- a/codex-rs/core/tests/suite/approvals.rs +++ b/codex-rs/core/tests/suite/approvals.rs @@ -1085,40 +1085,6 @@ fn scenarios() -> Vec { output_contains: "rejected by user", }, }, - ScenarioSpec { - name: "danger_full_access_on_failure_allows_outside_write", - approval_policy: OnFailure, - sandbox_policy: SandboxPolicy::DangerFullAccess, - action: ActionKind::WriteFile { - target: TargetPath::OutsideWorkspace("dfa_on_failure.txt"), - content: "danger-on-failure", - }, - sandbox_permissions: SandboxPermissions::UseDefault, - features: vec![], - model_override: Some("gpt-5.2"), - outcome: Outcome::Auto, - expectation: Expectation::FileCreated { - target: TargetPath::OutsideWorkspace("dfa_on_failure.txt"), - content: "danger-on-failure", - }, - }, - ScenarioSpec { - name: "danger_full_access_on_failure_allows_outside_write_gpt_5_1_no_exit", - approval_policy: OnFailure, - sandbox_policy: SandboxPolicy::DangerFullAccess, - action: ActionKind::WriteFile { - target: TargetPath::OutsideWorkspace("dfa_on_failure_5_1.txt"), - content: "danger-on-failure", - }, - sandbox_permissions: SandboxPermissions::UseDefault, - features: vec![], - model_override: Some("gpt-5.4"), - outcome: Outcome::Auto, - expectation: Expectation::FileCreatedNoExitCode { - target: TargetPath::OutsideWorkspace("dfa_on_failure_5_1.txt"), - content: "danger-on-failure", - }, - }, ScenarioSpec { name: "danger_full_access_unless_trusted_requests_approval", approval_policy: UnlessTrusted, @@ -1297,48 +1263,6 @@ fn scenarios() -> Vec { message_contains: &["exec command rejected by user"], }, }, - #[cfg(not(target_os = "linux"))] // TODO (pakrym): figure out why linux behaves differently - ScenarioSpec { - name: "read_only_on_failure_escalates_after_sandbox_error", - approval_policy: OnFailure, - sandbox_policy: SandboxPolicy::new_read_only_policy(), - action: ActionKind::WriteFile { - target: TargetPath::Workspace("ro_on_failure.txt"), - content: "read-only-on-failure", - }, - sandbox_permissions: SandboxPermissions::UseDefault, - features: vec![], - model_override: Some("gpt-5.2"), - outcome: Outcome::ExecApproval { - decision: ReviewDecision::Approved, - expected_reason: Some("command failed; retry without sandbox?"), - }, - expectation: Expectation::FileCreated { - target: TargetPath::Workspace("ro_on_failure.txt"), - content: "read-only-on-failure", - }, - }, - #[cfg(not(target_os = "linux"))] - ScenarioSpec { - name: "read_only_on_failure_escalates_after_sandbox_error_gpt_5_1_no_exit", - approval_policy: OnFailure, - sandbox_policy: SandboxPolicy::new_read_only_policy(), - action: ActionKind::WriteFile { - target: TargetPath::Workspace("ro_on_failure_5_1.txt"), - content: "read-only-on-failure", - }, - sandbox_permissions: SandboxPermissions::UseDefault, - features: vec![], - model_override: Some("gpt-5.4"), - outcome: Outcome::ExecApproval { - decision: ReviewDecision::Approved, - expected_reason: Some("command failed; retry without sandbox?"), - }, - expectation: Expectation::FileCreatedNoExitCode { - target: TargetPath::Workspace("ro_on_failure_5_1.txt"), - content: "read-only-on-failure", - }, - }, ScenarioSpec { name: "read_only_on_request_network_escalates_when_approved", approval_policy: OnRequest, @@ -1676,27 +1600,6 @@ fn scenarios() -> Vec { body_contains: "workspace-network-ok", }, }, - #[cfg(not(target_os = "linux"))] // TODO (pakrym): figure out why linux behaves differently - ScenarioSpec { - name: "workspace_write_on_failure_escalates_outside_workspace", - approval_policy: OnFailure, - sandbox_policy: workspace_write(false), - action: ActionKind::WriteFile { - target: TargetPath::OutsideWorkspace("ww_on_failure.txt"), - content: "workspace-on-failure", - }, - sandbox_permissions: SandboxPermissions::UseDefault, - features: vec![], - model_override: Some("gpt-5.2"), - outcome: Outcome::ExecApproval { - decision: ReviewDecision::Approved, - expected_reason: Some("command failed; retry without sandbox?"), - }, - expectation: Expectation::FileCreated { - target: TargetPath::OutsideWorkspace("ww_on_failure.txt"), - content: "workspace-on-failure", - }, - }, ScenarioSpec { name: "workspace_write_unless_trusted_requires_approval_outside_workspace", approval_policy: UnlessTrusted, @@ -2982,7 +2885,7 @@ mode = "limited" allow_local_binding = true "#, )?; - let approval_policy = AskForApproval::OnFailure; + let approval_policy = AskForApproval::OnRequest; let sandbox_policy = SandboxPolicy::WorkspaceWrite { writable_roots: vec![], network_access: true, @@ -3467,7 +3370,7 @@ mode = "limited" allow_local_binding = true "#, )?; - let approval_policy = AskForApproval::OnFailure; + let approval_policy = AskForApproval::OnRequest; let turn_sandbox_policy = SandboxPolicy::WorkspaceWrite { writable_roots: vec![], network_access: true, diff --git a/codex-rs/core/tests/suite/code_mode.rs b/codex-rs/core/tests/suite/code_mode.rs index 14bee0fb8d..9ec8182c66 100644 --- a/codex-rs/core/tests/suite/code_mode.rs +++ b/codex-rs/core/tests/suite/code_mode.rs @@ -881,7 +881,7 @@ text(JSON.stringify(result)); .enable(Feature::CurrentTimeReminder) .expect("test config should allow current-time reminders"); config.current_time_reminder = Some(CurrentTimeReminderConfig { - reminder_interval_model_requests: 50, + reminder_interval_seconds: 3_000, clock_source: CurrentTimeSource::System, }); }, diff --git a/codex-rs/core/tests/suite/current_time_reminder.rs b/codex-rs/core/tests/suite/current_time_reminder.rs index fda9b85b03..ec55da431c 100644 --- a/codex-rs/core/tests/suite/current_time_reminder.rs +++ b/codex-rs/core/tests/suite/current_time_reminder.rs @@ -37,6 +37,7 @@ use serde_json::json; const FIRST_REMINDER: &str = "It is 2026-06-17 17:34:15 UTC."; const SECOND_REMINDER: &str = "It is 2026-06-17 17:35:15 UTC."; +const THIRD_REMINDER: &str = "It is 2026-06-17 17:36:15 UTC."; const FIRST_TIME_UNIX_SECONDS: i64 = 1_781_717_655; struct TestTimeProvider(AtomicI64); @@ -83,13 +84,13 @@ fn enable_current_time_reminder( .enable(Feature::CurrentTimeReminder) .expect("test config should allow current-time reminders"); config.current_time_reminder = Some(CurrentTimeReminderConfig { - reminder_interval_model_requests: interval, + reminder_interval_seconds: interval, clock_source, }); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn current_time_reminders_follow_request_interval_and_persist_in_history() -> Result<()> { +async fn current_time_reminders_follow_time_interval_and_persist_in_history() -> Result<()> { skip_if_no_network!(Ok(())); let server = start_mock_server().await; @@ -120,7 +121,7 @@ async fn current_time_reminders_follow_request_interval_and_persist_in_history() .await; let test = test_codex() .with_config(|config| { - enable_current_time_reminder(config, /*interval*/ 2, CurrentTimeSource::External) + enable_current_time_reminder(config, /*interval*/ 120, CurrentTimeSource::External) }) .with_external_time_provider(Arc::new(TestTimeProvider::default())) .build(&server) @@ -136,7 +137,7 @@ async fn current_time_reminders_follow_request_interval_and_persist_in_history() assert_eq!(current_time_reminders(&requests[1]), vec![FIRST_REMINDER]); assert_eq!( current_time_reminders(&requests[2]), - vec![FIRST_REMINDER, SECOND_REMINDER] + vec![FIRST_REMINDER, THIRD_REMINDER] ); Ok(()) } @@ -195,7 +196,11 @@ async fn current_time_reminder_is_refreshed_after_compaction() -> Result<()> { let test = test_codex() .with_config(move |config| { config.model_provider = model_provider; - enable_current_time_reminder(config, /*interval*/ 50, CurrentTimeSource::External); + enable_current_time_reminder( + config, + /*interval*/ 3_000, + CurrentTimeSource::External, + ); }) .with_external_time_provider(Arc::new(TestTimeProvider::default())) .build(&server) @@ -295,7 +300,11 @@ async fn current_time_tool_returns_the_latest_time() -> Result<()> { .await; let test = test_codex() .with_config(|config| { - enable_current_time_reminder(config, /*interval*/ 50, CurrentTimeSource::External) + enable_current_time_reminder( + config, + /*interval*/ 3_000, + CurrentTimeSource::External, + ) }) .with_external_time_provider(Arc::new(TestTimeProvider::default())) .build(&server) diff --git a/codex-rs/core/tests/suite/fork_thread.rs b/codex-rs/core/tests/suite/fork_thread.rs index d51ba7d2f6..cc1d4e9177 100644 --- a/codex-rs/core/tests/suite/fork_thread.rs +++ b/codex-rs/core/tests/suite/fork_thread.rs @@ -1,3 +1,5 @@ +use std::sync::Arc; + use codex_core::ForkSnapshot; use codex_core::NewThread; use codex_core::parse_turn_item; @@ -196,7 +198,7 @@ async fn fork_thread_from_history_does_not_require_source_rollout_path() { test.config.clone(), InitialHistory::Resumed(ResumedHistory { conversation_id: test.session_configured.thread_id, - history: source_items.clone(), + history: Arc::new(source_items.clone()), rollout_path: None, }), /*thread_source*/ None, diff --git a/codex-rs/core/tests/suite/hooks.rs b/codex-rs/core/tests/suite/hooks.rs index f0ad29fd68..71c0acfe84 100644 --- a/codex-rs/core/tests/suite/hooks.rs +++ b/codex-rs/core/tests/suite/hooks.rs @@ -2200,7 +2200,7 @@ allow_local_binding = true ) .await; - let approval_policy = AskForApproval::OnFailure; + let approval_policy = AskForApproval::OnRequest; let permission_profile = network_workspace_write_profile(); let permission_profile_for_config = permission_profile.clone(); let test = test_codex() @@ -2283,71 +2283,6 @@ allow_local_binding = true Ok(()) } -#[cfg(not(target_os = "linux"))] -#[tokio::test] -async fn permission_request_hook_sees_retry_context_after_sandbox_denial() -> Result<()> { - skip_if_no_network!(Ok(())); - - let server = start_mock_server().await; - let call_id = "permissionrequest-retry-shell-command"; - let marker = "permissionrequest_retry_marker.txt"; - let command = format!("printf retry > {marker}"); - let args = serde_json::json!({ "command": command }); - let responses = mount_sse_sequence( - &server, - vec![ - sse(vec![ - ev_response_created("resp-1"), - core_test_support::responses::ev_function_call( - call_id, - "shell_command", - &serde_json::to_string(&args)?, - ), - ev_completed("resp-1"), - ]), - sse(vec![ - ev_response_created("resp-2"), - ev_assistant_message("msg-1", "permission request hook allowed retry"), - ev_completed("resp-2"), - ]), - ], - ) - .await; - - let mut builder = test_codex() - .with_pre_build_hook(|home| { - install_allow_permission_request_hook(home) - .expect("failed to write permission request hook test fixture"); - }) - .with_config(trust_discovered_hooks); - let test = builder.build(&server).await?; - let marker_path = test.workspace_path(marker); - let _ = fs::remove_file(&marker_path); - - test.submit_turn_with_approval_and_permission_profile( - "retry the shell command after sandbox denial", - AskForApproval::OnFailure, - PermissionProfile::read_only(), - ) - .await?; - - let requests = responses.requests(); - assert_eq!(requests.len(), 2); - requests[1].function_call_output(call_id); - assert_eq!( - fs::read_to_string(&marker_path).context("read retry marker")?, - "retry" - ); - - assert_single_permission_request_hook_input( - test.codex_home_path(), - &command, - /*description*/ None, - )?; - - Ok(()) -} - #[tokio::test] async fn pre_tool_use_blocks_shell_command_before_execution() -> Result<()> { skip_if_no_network!(Ok(())); diff --git a/codex-rs/core/tests/suite/mcp_refresh_cleanup.rs b/codex-rs/core/tests/suite/mcp_refresh_cleanup.rs new file mode 100644 index 0000000000..a8e06bb35b --- /dev/null +++ b/codex-rs/core/tests/suite/mcp_refresh_cleanup.rs @@ -0,0 +1,127 @@ +use std::collections::HashMap; +use std::fs; +use std::sync::Arc; +use std::time::Duration; + +use codex_config::DEFAULT_MCP_SERVER_ENVIRONMENT_ID; +use codex_config::types::McpServerConfig; +use codex_config::types::McpServerTransportConfig; +use core_test_support::process::process_is_alive; +use core_test_support::process::wait_for_pid_file; +use core_test_support::process::wait_for_process_exit; +use core_test_support::responses; +use core_test_support::skip_if_no_network; +use core_test_support::stdio_server_bin; +use core_test_support::test_codex::test_codex; +use core_test_support::wait_for_mcp_server; + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn refresh_shuts_down_superseded_mcp_stdio_server() -> anyhow::Result<()> { + skip_if_no_network!(Ok(())); + + let server = responses::start_mock_server().await; + let temp_dir = tempfile::tempdir()?; + let pid_file = temp_dir.path().join("mcp.pid"); + let pid_file_for_config = pid_file.clone(); + let command = stdio_server_bin()?; + let fixture = test_codex() + .with_config(move |config| { + let mut servers = config.mcp_servers.get().clone(); + servers.insert( + "refresh_cleanup".to_string(), + McpServerConfig { + transport: McpServerTransportConfig::Stdio { + command, + args: Vec::new(), + env: Some(HashMap::from([( + "MCP_TEST_PID_FILE".to_string(), + pid_file_for_config.to_string_lossy().into_owned(), + )])), + env_vars: Vec::new(), + cwd: None, + }, + environment_id: DEFAULT_MCP_SERVER_ENVIRONMENT_ID.to_string(), + enabled: true, + required: false, + supports_parallel_tool_calls: false, + disabled_reason: None, + startup_timeout_sec: Some(Duration::from_secs(10)), + tool_timeout_sec: None, + default_tools_approval_mode: None, + enabled_tools: None, + disabled_tools: None, + scopes: None, + oauth: None, + oauth_resource: None, + tools: HashMap::new(), + }, + ); + config + .mcp_servers + .set(servers) + .expect("test MCP servers should accept any configuration"); + }) + .build(&server) + .await?; + wait_for_mcp_server(&fixture.codex, "refresh_cleanup").await?; + + let superseded_pid = wait_for_pid_file(&pid_file).await?; + assert!(process_is_alive(&superseded_pid)?); + + let barrier = serde_json::json!({ + "id": "mcp-refresh-cleanup", + "participants": 2, + "timeout_ms": 1_000 + }); + let long_call = tokio::spawn({ + let codex = Arc::clone(&fixture.codex); + let barrier = barrier.clone(); + async move { + codex + .call_mcp_tool( + "refresh_cleanup", + "sync", + Some(serde_json::json!({ + "barrier": barrier, + "sleep_after_ms": 30_000 + })), + /*meta*/ None, + ) + .await + } + }); + fixture + .codex + .call_mcp_tool( + "refresh_cleanup", + "sync", + Some(serde_json::json!({ "barrier": barrier })), + /*meta*/ None, + ) + .await?; + fs::remove_file(&pid_file)?; + + responses::mount_sse_once( + &server, + responses::sse(vec![ + responses::ev_response_created("resp-1"), + responses::ev_assistant_message("msg-1", "done"), + responses::ev_completed("resp-1"), + ]), + ) + .await; + fixture + .codex + .set_openai_form_elicitation_support(/*supported*/ true) + .await?; + fixture.submit_turn("refresh MCP servers").await?; + + let replacement_pid = wait_for_pid_file(&pid_file).await?; + assert_ne!(replacement_pid, superseded_pid); + wait_for_process_exit(&superseded_pid).await?; + assert!(process_is_alive(&replacement_pid)?); + assert!(long_call.await?.is_err()); + + fixture.codex.shutdown_and_wait().await?; + wait_for_process_exit(&replacement_pid).await +} diff --git a/codex-rs/core/tests/suite/mod.rs b/codex-rs/core/tests/suite/mod.rs index a9298ec6d9..3d4a191f12 100644 --- a/codex-rs/core/tests/suite/mod.rs +++ b/codex-rs/core/tests/suite/mod.rs @@ -65,6 +65,8 @@ mod image_rollout; mod items; mod json_result; mod live_cli; +#[cfg(unix)] +mod mcp_refresh_cleanup; mod mcp_tool_exposure; mod mcp_turn_metadata; mod model_overrides; diff --git a/codex-rs/core/tests/suite/model_runtime_selectors.rs b/codex-rs/core/tests/suite/model_runtime_selectors.rs index d893e389d3..0c6a87605d 100644 --- a/codex-rs/core/tests/suite/model_runtime_selectors.rs +++ b/codex-rs/core/tests/suite/model_runtime_selectors.rs @@ -37,6 +37,7 @@ use tokio::time::sleep; const CHILD_MODEL: &str = "test-multi-agent-child"; const ROOT_MODEL: &str = "test-multi-agent-root"; const ROOT_PROMPT: &str = "spawn a child"; +const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; const UNSUPPORTED_CODE_MODE_WARNING: &str = "does not advertise Code Mode support"; struct RemoteModelResponse { @@ -335,7 +336,7 @@ async fn remote_multi_agent_selector_overrides_feature_flags() -> Result<()> { .expect("test config should allow feature update"); }) .await?; - assert!(tool_names(&v2_body).contains(&"send_message".to_string())); + assert!(tool_names(&v2_body).contains(&MULTI_AGENT_V2_NAMESPACE.to_string())); let mut disabled_model = remote_model("test-multi-agent-disabled"); disabled_model.multi_agent_version = Some(MultiAgentVersion::Disabled); @@ -349,7 +350,12 @@ async fn remote_multi_agent_selector_overrides_feature_flags() -> Result<()> { let disabled_tools = tool_names(&disabled_body); assert!(disabled_tools.iter().all(|name| !matches!( name.as_str(), - "multi_agent_v1" | "spawn_agent" | "send_message" | "wait_agent" | "list_agents" + "multi_agent_v1" + | MULTI_AGENT_V2_NAMESPACE + | "spawn_agent" + | "send_message" + | "wait_agent" + | "list_agents" ))); Ok(()) @@ -432,7 +438,7 @@ async fn remote_multi_agent_selector_uses_model_selected_before_first_turn() -> .expect("expected response request") .body_json(), ) - .contains(&"send_message".to_string()), + .contains(&MULTI_AGENT_V2_NAMESPACE.to_string()), ), (1, Some(MultiAgentVersion::V2), true) ); diff --git a/codex-rs/core/tests/suite/network_approval.rs b/codex-rs/core/tests/suite/network_approval.rs index f476fb7287..e644fcf6b8 100644 --- a/codex-rs/core/tests/suite/network_approval.rs +++ b/codex-rs/core/tests/suite/network_approval.rs @@ -165,7 +165,7 @@ mode = "limited" allow_local_binding = true "#, )?; - let approval_policy = AskForApproval::OnFailure; + let approval_policy = AskForApproval::OnRequest; let permission_profile = PermissionProfile::workspace_write_with( &[], NetworkSandboxPolicy::Enabled, @@ -263,7 +263,7 @@ async fn submit_managed_network_turn( additional_context: Default::default(), thread_settings: codex_protocol::protocol::ThreadSettingsOverrides { environments: Some(turn_environment_selections), - approval_policy: Some(AskForApproval::OnFailure), + approval_policy: Some(AskForApproval::OnRequest), approvals_reviewer: Some(ApprovalsReviewer::User), sandbox_policy: Some(sandbox_policy), permission_profile, diff --git a/codex-rs/core/tests/suite/otel.rs b/codex-rs/core/tests/suite/otel.rs index 95811d3f63..e3415d945b 100644 --- a/codex-rs/core/tests/suite/otel.rs +++ b/codex-rs/core/tests/suite/otel.rs @@ -3,6 +3,7 @@ use codex_features::Feature; use codex_otel::SessionTelemetry; use codex_otel::TelemetryAuthMode; use codex_protocol::ThreadId; +use codex_protocol::config_types::ServiceTier; use codex_protocol::models::PermissionProfile; use codex_protocol::openai_models::ReasoningEffort; use codex_protocol::protocol::AskForApproval; @@ -114,9 +115,17 @@ fn extract_log_field_does_not_confuse_similar_keys() { async fn responses_api_emits_api_request_event() { let server = start_mock_server().await; - mount_sse_once(&server, sse(vec![ev_completed("done")])).await; + let response_mock = mount_sse_once(&server, sse(vec![ev_completed("done")])).await; - let TestCodex { codex, .. } = test_codex().build(&server).await.unwrap(); + let TestCodex { codex, .. } = test_codex() + .with_model("gpt-5.4") + .with_config(|config| { + config.service_tier = Some(ServiceTier::Fast.request_value().to_string()); + config.model_reasoning_effort = Some(ReasoningEffort::High); + }) + .build(&server) + .await + .unwrap(); codex .submit(Op::UserInput { @@ -134,6 +143,10 @@ async fn responses_api_emits_api_request_event() { wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await; + let request_body = response_mock.single_request().body_json(); + assert_eq!(request_body["service_tier"].as_str(), Some("priority")); + assert_eq!(request_body["reasoning"]["effort"].as_str(), Some("high")); + logs_assert(|lines: &[&str]| { lines .iter() @@ -142,6 +155,21 @@ async fn responses_api_emits_api_request_event() { .unwrap_or_else(|| Err("expected codex.api_request event".to_string())) }); + logs_assert(|lines: &[&str]| { + lines + .iter() + .find(|line| { + line.contains("codex.sse_event") + && line.contains("event.kind=response.completed") + && line.contains("service_tier=\"priority\"") + && line.contains("model_reasoning_effort=\"high\"") + }) + .map(|_| Ok(())) + .unwrap_or_else(|| { + Err("expected response.completed event with inference attributes".to_string()) + }) + }); + logs_assert(|lines: &[&str]| { lines .iter() diff --git a/codex-rs/core/tests/suite/pending_input.rs b/codex-rs/core/tests/suite/pending_input.rs index 269beae638..17e00513fe 100644 --- a/codex-rs/core/tests/suite/pending_input.rs +++ b/codex-rs/core/tests/suite/pending_input.rs @@ -20,6 +20,7 @@ use core_test_support::responses; use core_test_support::responses::ev_completed; use core_test_support::responses::ev_completed_with_tokens; use core_test_support::responses::ev_function_call; +use core_test_support::responses::ev_function_call_with_namespace; use core_test_support::responses::ev_message_item_added; use core_test_support::responses::ev_output_text_delta; use core_test_support::responses::ev_reasoning_item; @@ -290,11 +291,13 @@ async fn steer_interrupts_wait_agent_and_is_sent_in_follow_up_request() { const WAIT_CALL_ID: &str = "wait-call"; const INITIAL_PROMPT: &str = "wait for an agent"; const STEER_PROMPT: &str = "stop waiting and continue"; + const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; let first_chunks = vec![ chunk(ev_response_created("resp-1")), - chunk(ev_function_call( + chunk(ev_function_call_with_namespace( WAIT_CALL_ID, + MULTI_AGENT_V2_NAMESPACE, "wait_agent", r#"{"timeout_ms":10000}"#, )), diff --git a/codex-rs/core/tests/suite/remote_env.rs b/codex-rs/core/tests/suite/remote_env.rs index 2df03f92a8..fab1f01a47 100644 --- a/codex-rs/core/tests/suite/remote_env.rs +++ b/codex-rs/core/tests/suite/remote_env.rs @@ -1,6 +1,7 @@ use anyhow::Context; use anyhow::Result; use codex_config::types::ApprovalsReviewer; +use codex_core::compact::SUMMARIZATION_PROMPT; use codex_core::config::Constrained; use codex_exec_server::CopyOptions; use codex_exec_server::CreateDirectoryOptions; @@ -38,6 +39,7 @@ use core_test_support::get_remote_test_env; use core_test_support::responses::ev_apply_patch_custom_tool_call; use core_test_support::responses::ev_assistant_message; use core_test_support::responses::ev_completed; +use core_test_support::responses::ev_completed_with_tokens; use core_test_support::responses::ev_function_call; use core_test_support::responses::ev_response_created; use core_test_support::responses::mount_sse_once; @@ -313,151 +315,6 @@ async fn explicit_remote_shell_runs_in_remote_cwd() -> Result<()> { Ok(()) } -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn remote_sandbox_denial_requests_approval_and_retries() -> Result<()> { - skip_if_no_network!(Ok(())); - skip_if_wine_exec!(Ok(()), "requires the Docker-backed POSIX executor"); - let Some(_remote_env) = get_remote_test_env() else { - return Ok(()); - }; - - const CALL_ID: &str = "remote-sandbox-denial"; - const CONTENTS: &str = "remote sandbox retry succeeded"; - - let server = start_mock_server().await; - let test = unified_exec_test(&server).await?; - let nonce = SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis(); - let remote_cwd = PathBuf::from(format!("/tmp/codex-remote-denial-cwd-{nonce}")).abs(); - let target_path = PathBuf::from(format!("/tmp/codex-remote-denial-target-{nonce}")).abs(); - let remote_cwd_uri = PathUri::from_host_native_path(&remote_cwd)?; - let target_uri = PathUri::from_host_native_path(&target_path)?; - test.fs() - .create_directory( - &remote_cwd_uri, - CreateDirectoryOptions { recursive: true }, - /*sandbox*/ None, - ) - .await?; - test.fs() - .remove( - &target_uri, - RemoveOptions { - recursive: false, - force: true, - }, - /*sandbox*/ None, - ) - .await?; - - let command = format!("printf {CONTENTS:?} > {target_path:?} && cat {target_path:?}"); - let response_mock = mount_sse_sequence( - &server, - vec![ - sse(vec![ - ev_response_created("resp-remote-denial-1"), - ev_function_call( - CALL_ID, - "exec_command", - &json!({ - "shell": "/bin/sh", - "cmd": command, - "login": false, - "yield_time_ms": 5_000, - "environment_id": REMOTE_ENVIRONMENT_ID, - }) - .to_string(), - ), - ev_completed("resp-remote-denial-1"), - ]), - sse(vec![ - ev_response_created("resp-remote-denial-2"), - ev_assistant_message("msg-remote-denial", "done"), - ev_completed("resp-remote-denial-2"), - ]), - ], - ) - .await; - - submit_turn_with_approval_and_environments( - &test, - "retry a sandbox-denied command in the remote environment", - vec![TurnEnvironmentSelection { - environment_id: REMOTE_ENVIRONMENT_ID.to_string(), - cwd: PathUri::from_abs_path(&remote_cwd), - }], - AskForApproval::OnFailure, - ) - .await?; - - let event = wait_for_event(&test.codex, |event| { - matches!( - event, - EventMsg::ExecApprovalRequest(_) | EventMsg::TurnComplete(_) - ) - }) - .await; - let EventMsg::ExecApprovalRequest(approval) = event else { - panic!("expected remote sandbox approval before completion: {event:?}"); - }; - assert_eq!(approval.call_id, CALL_ID); - assert_eq!( - approval.environment_id.as_deref(), - Some(REMOTE_ENVIRONMENT_ID) - ); - assert_eq!( - approval.reason.as_deref(), - Some("command failed; retry without sandbox?") - ); - - test.codex - .submit(Op::ExecApproval { - id: approval.effective_approval_id(), - turn_id: None, - decision: ReviewDecision::Approved, - }) - .await?; - wait_for_event(&test.codex, |event| { - matches!(event, EventMsg::TurnComplete(_)) - }) - .await; - - assert!( - response_mock - .function_call_output_text(CALL_ID) - .is_some_and(|output| output.contains(CONTENTS)), - "approved retry should return the remote command output" - ); - assert_eq!( - test.fs() - .read_file_text(&target_uri, /*sandbox*/ None) - .await?, - CONTENTS - ); - - test.fs() - .remove( - &target_uri, - RemoveOptions { - recursive: false, - force: true, - }, - /*sandbox*/ None, - ) - .await?; - test.fs() - .remove( - &remote_cwd_uri, - RemoveOptions { - recursive: true, - force: true, - }, - /*sandbox*/ None, - ) - .await?; - - Ok(()) -} - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn deferred_executor_does_not_duplicate_initial_environment_context() -> Result<()> { let server = start_mock_server().await; @@ -683,6 +540,141 @@ async fn deferred_executor_updates_model_context_after_startup() -> Result<()> { Ok(()) } +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn deferred_executor_compaction_preserves_then_updates_environment_once() -> Result<()> { + let listener = TcpListener::bind("127.0.0.1:0").await?; + let server = start_mock_server().await; + let response_mock = mount_sse_sequence( + &server, + vec![ + sse(vec![ + ev_response_created("resp-1"), + ev_function_call( + "wait-for-startup", + "request_user_input", + &json!({ + "questions": [{ + "id": "continue", + "header": "Continue", + "question": "Continue after startup?", + "options": [{ + "label": "Yes (Recommended)", + "description": "Continue the test." + }, { + "label": "No", + "description": "Stop the test." + }] + }] + }) + .to_string(), + ), + ev_completed_with_tokens("resp-1", /*total_tokens*/ 96), + ]), + sse(vec![ + ev_assistant_message("msg-compact", "AUTO_COMPACT_SUMMARY"), + ev_completed_with_tokens("resp-compact", /*total_tokens*/ 10), + ]), + sse(vec![ + ev_response_created("resp-2"), + ev_assistant_message("msg-2", "done"), + ev_completed("resp-2"), + ]), + ], + ) + .await; + let mut builder = test_codex() + .with_exec_server_url(format!("ws://{}", listener.local_addr()?)) + .with_config(|config| { + assert!(config.features.enable(Feature::DeferredExecutor).is_ok()); + assert!( + config + .features + .enable(Feature::DefaultModeRequestUserInput) + .is_ok() + ); + config.model_provider.name = "OpenAI (test)".to_string(); + config.compact_prompt = Some(SUMMARIZATION_PROMPT.to_string()); + config.model_context_window = Some(100); + config.model_auto_compact_token_limit = Some(90); + }); + let test = timeout(Duration::from_secs(5), builder.build(&server)) + .await + .context("thread startup should not wait for the remote environment")??; + + test.codex + .submit(Op::UserInput { + items: vec![UserInput::Text { + text: "wait for the environment".into(), + text_elements: Vec::new(), + }], + final_output_json_schema: None, + responsesapi_client_metadata: None, + additional_context: Default::default(), + thread_settings: Default::default(), + }) + .await?; + let request = wait_for_event_match(&test.codex, |event| match event { + EventMsg::RequestUserInput(request) => Some(request.clone()), + _ => None, + }) + .await; + + serve_environment_info(listener).await; + test.codex + .submit(Op::UserInputAnswer { + id: request.turn_id, + response: RequestUserInputResponse { + answers: HashMap::from([( + "continue".to_string(), + RequestUserInputAnswer { + answers: vec!["Yes (Recommended)".to_string()], + }, + )]), + }, + }) + .await?; + wait_for_event(&test.codex, |event| { + matches!(event, EventMsg::TurnComplete(_)) + }) + .await; + + let requests = response_mock.requests(); + assert_eq!(requests.len(), 3); + let initial_context = requests[0].message_input_texts("user"); + assert!( + initial_context + .iter() + .any(|text| text.contains("starting")) + ); + + let post_compaction_context = requests[2].message_input_texts("user"); + assert_eq!( + post_compaction_context + .iter() + .filter(|text| text.contains("starting")) + .count(), + 1 + ); + assert_eq!( + post_compaction_context + .iter() + .filter(|text| text.contains("zsh")) + .count(), + 1 + ); + let starting_index = post_compaction_context + .iter() + .position(|text| text.contains("starting")) + .expect("compaction should preserve the prior environment state"); + let ready_index = post_compaction_context + .iter() + .position(|text| text.contains("zsh")) + .expect("the next sampling step should report that the environment is ready"); + assert!(starting_index < ready_index); + + Ok(()) +} + fn absolute_path(path: PathBuf) -> AbsolutePathBuf { AbsolutePathBuf::try_from(path).expect("path should be absolute") } diff --git a/codex-rs/core/tests/suite/responses_lite.rs b/codex-rs/core/tests/suite/responses_lite.rs index 8e633522f4..4d2a38f6f8 100644 --- a/codex-rs/core/tests/suite/responses_lite.rs +++ b/codex-rs/core/tests/suite/responses_lite.rs @@ -54,6 +54,70 @@ fn has_hosted_tool(tools: &[Value], tool_type: &str) -> bool { .any(|tool| tool.get("type").and_then(Value::as_str) == Some(tool_type)) } +fn additional_tools(body: &Value) -> Result<&[Value]> { + body["input"] + .as_array() + .context("Responses request input should be an array")? + .first() + .filter(|item| item.get("type").and_then(Value::as_str) == Some("additional_tools")) + .context("Responses request should start with additional_tools")?["tools"] + .as_array() + .map(Vec::as_slice) + .context("additional_tools tools should be an array") +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn responses_lite_uses_input_items_for_instructions_and_tools() -> Result<()> { + skip_if_no_network!(Ok(())); + + let server = responses::start_mock_server().await; + let response_mock = responses::mount_sse_once( + &server, + responses::sse(vec![ + responses::ev_response_created("resp-1"), + responses::ev_completed("resp-1"), + ]), + ) + .await; + + let mut builder = test_codex() + .with_model_info_override("gpt-5.4", |model_info| { + model_info.use_responses_lite = true; + }) + .with_config(|config| { + config.base_instructions = Some("test instructions".to_string()); + }); + let test = builder.build(&server).await?; + + test.submit_turn("hello").await?; + + let body = response_mock.single_request().body_json(); + assert!(body.get("instructions").is_none()); + assert!(body.get("tools").is_none()); + + let input = body["input"] + .as_array() + .context("Responses request input should be an array")?; + assert_eq!(input[0]["type"], "additional_tools"); + assert_eq!(input[0]["role"], "developer"); + assert_eq!( + input[1], + serde_json::json!({ + "type": "message", + "role": "developer", + "content": [{ + "type": "input_text", + "text": "test instructions", + }], + }) + ); + + let tools = additional_tools(&body)?; + assert!(!tools.is_empty()); + + Ok(()) +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn responses_lite_prepares_images() -> Result<()> { skip_if_no_network!(Ok(())); @@ -158,17 +222,10 @@ async fn responses_lite_uses_standalone_web_search_and_image_generation() -> Res request.header(RESPONSES_LITE_HEADER).as_deref(), Some("true") ); - request - .tool_by_name("web", "run") - .context("Responses Lite should expose standalone web search")?; - request - .tool_by_name("image_gen", "imagegen") - .context("Responses Lite should expose standalone image generation")?; - let body = request.body_json(); - let tools = body["tools"] - .as_array() - .context("Responses request tools should be an array")?; + assert!(body.get("tools").is_none()); + let tools = additional_tools(&body)?; + assert!(!tools.is_empty()); assert!(!has_hosted_tool(tools, "web_search")); assert!(!has_hosted_tool(tools, "image_generation")); @@ -256,9 +313,8 @@ async fn responses_lite_omits_hosted_tools_without_standalone_extensions() -> Re test.submit_turn("Do not use hosted tools").await?; let body = response_mock.single_request().body_json(); - let tools = body["tools"] - .as_array() - .context("Responses request tools should be an array")?; + assert!(body.get("tools").is_none()); + let tools = additional_tools(&body)?; assert!(!has_hosted_tool(tools, "web_search")); assert!(!has_hosted_tool(tools, "image_generation")); diff --git a/codex-rs/core/tests/suite/resume_warning.rs b/codex-rs/core/tests/suite/resume_warning.rs index 073e6d8b49..50395b2ecb 100644 --- a/codex-rs/core/tests/suite/resume_warning.rs +++ b/codex-rs/core/tests/suite/resume_warning.rs @@ -1,5 +1,7 @@ #![allow(clippy::unwrap_used)] +use std::sync::Arc; + use codex_core::NewThread; use codex_login::CodexAuth; use codex_protocol::ThreadId; @@ -51,7 +53,7 @@ fn resume_history( InitialHistory::Resumed(ResumedHistory { conversation_id: ThreadId::default(), - history: vec![ + history: Arc::new(vec![ RolloutItem::EventMsg(EventMsg::TurnStarted(TurnStartedEvent { turn_id: turn_id.clone(), trace_id: None, @@ -75,7 +77,7 @@ fn resume_history( duration_ms: None, time_to_first_token_ms: None, })), - ], + ]), rollout_path: Some(rollout_path.to_path_buf()), }) } diff --git a/codex-rs/core/tests/suite/rmcp_client.rs b/codex-rs/core/tests/suite/rmcp_client.rs index 78fa73ce50..8000ed1c00 100644 --- a/codex-rs/core/tests/suite/rmcp_client.rs +++ b/codex-rs/core/tests/suite/rmcp_client.rs @@ -26,6 +26,7 @@ use codex_exec_server::Environment; use codex_exec_server::HttpRequestParams; use codex_login::CodexAuth; use codex_mcp::MCP_SANDBOX_STATE_META_CAPABILITY; +use codex_mcp::SandboxState; use codex_models_manager::manager::RefreshStrategy; use codex_utils_path_uri::LegacyAppPathString; @@ -933,13 +934,16 @@ async fn stdio_mcp_tool_call_includes_sandbox_state_meta() -> anyhow::Result<()> let sandbox_meta = meta .get(MCP_SANDBOX_STATE_META_CAPABILITY) .expect("sandbox state metadata should be present"); - assert_eq!(sandbox_meta.get("sandboxPolicy"), None); - let expected_sandbox_cwd = PathUri::from_abs_path(&fixture.config.cwd).to_string(); + let sandbox_state: SandboxState = serde_json::from_value(sandbox_meta.clone())?; assert_eq!( - sandbox_meta.get("sandboxCwd").and_then(Value::as_str), - Some(expected_sandbox_cwd.as_str()) + sandbox_state, + SandboxState { + permission_profile: PermissionProfile::read_only(), + codex_linux_sandbox_exe: fixture.config.codex_linux_sandbox_exe.clone(), + sandbox_cwd: PathUri::from_abs_path(&fixture.config.cwd), + use_legacy_landlock: false, + } ); - assert_eq!(sandbox_meta.get("useLegacyLandlock"), Some(&json!(false))); server.verify().await; diff --git a/codex-rs/core/tests/suite/rollout_budget.rs b/codex-rs/core/tests/suite/rollout_budget.rs index feafdc51ef..6aa211bcc2 100644 --- a/codex-rs/core/tests/suite/rollout_budget.rs +++ b/codex-rs/core/tests/suite/rollout_budget.rs @@ -10,7 +10,7 @@ use core_test_support::responses::ResponsesRequest; use core_test_support::responses::ev_assistant_message; use core_test_support::responses::ev_completed; use core_test_support::responses::ev_completed_with_tokens; -use core_test_support::responses::ev_function_call; +use core_test_support::responses::ev_function_call_with_namespace; use core_test_support::responses::ev_response_created; use core_test_support::responses::mount_sse_once_match; use core_test_support::responses::mount_sse_sequence; @@ -25,6 +25,8 @@ use std::time::Duration; use test_case::test_case; use tokio::time::timeout; +const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; + fn rollout_budget() -> RolloutBudgetConfig { RolloutBudgetConfig { limit_tokens: 100, @@ -130,7 +132,12 @@ async fn subagent_usage_draws_from_the_shared_budget() -> Result<()> { |request: &wiremock::Request| wire_request_contains(request, ROOT_PROMPT), sse(vec![ ev_response_created("root-1"), - ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args), + ev_function_call_with_namespace( + SPAWN_CALL_ID, + MULTI_AGENT_V2_NAMESPACE, + "spawn_agent", + &spawn_args, + ), ev_completed_with_tokens("root-1", /*total_tokens*/ 10), ]), ) @@ -284,15 +291,8 @@ async fn compaction_budget_exhaustion_aborts_without_error_or_retry(remote_v2: b ]) }; let responses = mount_sse_sequence(&server, vec![compact_response]).await; - let mut model_provider = built_in_model_providers(/*openai_base_url*/ None)["openai"].clone(); - model_provider.base_url = Some(format!("{}/v1", server.uri())); - model_provider.supports_websockets = false; - if !remote_v2 { - model_provider.name = "OpenAI-compatible test provider".to_string(); - } let test = test_codex() .with_config(move |config| { - config.model_provider = model_provider; config.rollout_budget = Some(RolloutBudgetConfig { limit_tokens: 10, reminder_at_remaining_tokens: vec![5], @@ -303,6 +303,8 @@ async fn compaction_budget_exhaustion_aborts_without_error_or_retry(remote_v2: b .features .enable(Feature::RemoteCompactionV2) .expect("test config should allow remote compaction v2"); + } else { + config.model_provider.name = "OpenAI-compatible test provider".to_string(); } }) .build(&server) diff --git a/codex-rs/core/tests/suite/subagent_notifications.rs b/codex-rs/core/tests/suite/subagent_notifications.rs index c49e474965..53f9a97bc7 100644 --- a/codex-rs/core/tests/suite/subagent_notifications.rs +++ b/codex-rs/core/tests/suite/subagent_notifications.rs @@ -17,7 +17,6 @@ use core_test_support::hooks::trust_discovered_hooks; use core_test_support::responses::ResponsesRequest; use core_test_support::responses::ev_assistant_message; use core_test_support::responses::ev_completed; -use core_test_support::responses::ev_function_call; use core_test_support::responses::ev_function_call_with_namespace; use core_test_support::responses::ev_response_created; use core_test_support::responses::ev_tool_search_call; @@ -48,6 +47,7 @@ use wiremock::MockServer; const SPAWN_CALL_ID: &str = "spawn-call-1"; const MULTI_AGENT_V1_NAMESPACE: &str = "multi_agent_v1"; +const MULTI_AGENT_V2_NAMESPACE: &str = "collaboration"; const TURN_0_FORK_PROMPT: &str = "seed fork context"; const TURN_1_PROMPT: &str = "spawn a child and continue"; const TURN_2_NO_WAIT_PROMPT: &str = "follow up without wait"; @@ -63,6 +63,23 @@ const SUBAGENT_STOP_CONTINUATION: &str = "continue only the child"; const INTERNAL_SUBAGENT_PROMPT: &str = "internal subagent: review"; fn body_contains(req: &wiremock::Request, text: &str) -> bool { + decoded_body(req) + .and_then(|body| String::from_utf8(body).ok()) + .is_some_and(|body| body.contains(text)) +} + +fn request_has_input_type(req: &wiremock::Request, ty: &str) -> bool { + decoded_body(req) + .and_then(|body| serde_json::from_slice::(&body).ok()) + .and_then(|body| body.get("input").and_then(Value::as_array).cloned()) + .is_some_and(|items| { + items + .iter() + .any(|item| item.get("type").and_then(Value::as_str) == Some(ty)) + }) +} + +fn decoded_body(req: &wiremock::Request) -> Option> { let is_zstd = req .headers .get("content-encoding") @@ -72,14 +89,11 @@ fn body_contains(req: &wiremock::Request, text: &str) -> bool { .split(',') .any(|entry| entry.trim().eq_ignore_ascii_case("zstd")) }); - let bytes = if is_zstd { + if is_zstd { zstd::stream::decode_all(std::io::Cursor::new(&req.body)).ok() } else { Some(req.body.clone()) - }; - bytes - .and_then(|body| String::from_utf8(body).ok()) - .is_some_and(|body| body.contains(text)) + } } fn has_subagent_notification(req: &ResponsesRequest) -> bool { @@ -1040,14 +1054,19 @@ async fn encrypted_multi_agent_v2_spawn_sends_agent_message_to_child() -> Result |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT), sse(vec![ ev_response_created("resp-parent-1"), - ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args), + ev_function_call_with_namespace( + SPAWN_CALL_ID, + MULTI_AGENT_V2_NAMESPACE, + "spawn_agent", + &spawn_args, + ), ev_completed("resp-parent-1"), ]), ) .await; let child_request_log = mount_sse_once_match( &server, - |req: &wiremock::Request| body_contains(req, "\"type\":\"agent_message\""), + |req: &wiremock::Request| request_has_input_type(req, "agent_message"), sse(vec![ ev_response_created("resp-child-1"), ev_completed("resp-child-1"), @@ -1057,7 +1076,7 @@ async fn encrypted_multi_agent_v2_spawn_sends_agent_message_to_child() -> Result mount_sse_once_match( &server, |req: &wiremock::Request| { - body_contains(req, SPAWN_CALL_ID) && !body_contains(req, "\"type\":\"agent_message\"") + body_contains(req, SPAWN_CALL_ID) && !request_has_input_type(req, "agent_message") }, sse(vec![ ev_response_created("resp-parent-2"), @@ -1129,7 +1148,12 @@ async fn plaintext_multi_agent_v2_completion_sends_agent_message( |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT), sse(vec![ ev_response_created("resp-parent-1"), - ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args), + ev_function_call_with_namespace( + SPAWN_CALL_ID, + MULTI_AGENT_V2_NAMESPACE, + "spawn_agent", + &spawn_args, + ), ev_completed("resp-parent-1"), ]), ) @@ -1144,7 +1168,7 @@ async fn plaintext_multi_agent_v2_completion_sends_agent_message( }; let child_request = mount_response_once_match( &server, - |req: &wiremock::Request| body_contains(req, "\"type\":\"agent_message\""), + |req: &wiremock::Request| request_has_input_type(req, "agent_message"), sse_response(sse(child_events)).set_delay(Duration::from_secs(1)), ) .await; @@ -1183,7 +1207,12 @@ async fn plaintext_multi_agent_v2_completion_sends_agent_message( }, sse(vec![ ev_response_created("resp-parent-3"), - ev_function_call("wait-agent-call", "wait_agent", "{}"), + ev_function_call_with_namespace( + "wait-agent-call", + MULTI_AGENT_V2_NAMESPACE, + "wait_agent", + "{}", + ), ev_completed("resp-parent-3"), ]), ) diff --git a/codex-rs/exec-server/Cargo.toml b/codex-rs/exec-server/Cargo.toml index 31fc4ea0aa..02f23dfc49 100644 --- a/codex-rs/exec-server/Cargo.toml +++ b/codex-rs/exec-server/Cargo.toml @@ -20,6 +20,7 @@ codex-app-server-protocol = { workspace = true } codex-api = { workspace = true } codex-client = { workspace = true } codex-file-system = { workspace = true } +codex-network-proxy = { workspace = true } codex-protocol = { workspace = true } codex-sandboxing = { workspace = true } codex-shell-command = { workspace = true } diff --git a/codex-rs/exec-server/src/environment.rs b/codex-rs/exec-server/src/environment.rs index 40d73cade5..ee0e303caf 100644 --- a/codex-rs/exec-server/src/environment.rs +++ b/codex-rs/exec-server/src/environment.rs @@ -1162,6 +1162,7 @@ mod tests { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await .expect("start process"); @@ -1201,6 +1202,7 @@ mod tests { arg0: None, sandbox: Some(sandbox), enforce_managed_network: false, + managed_network: None, }) .await; let Err(err) = result else { diff --git a/codex-rs/exec-server/src/fs_sandbox.rs b/codex-rs/exec-server/src/fs_sandbox.rs index 3dbcf73c14..41a3e12215 100644 --- a/codex-rs/exec-server/src/fs_sandbox.rs +++ b/codex-rs/exec-server/src/fs_sandbox.rs @@ -115,6 +115,7 @@ impl FileSystemSandboxRunner { args: vec![CODEX_FS_HELPER_ARG1.to_string()], cwd: cwd.uri.clone(), env: self.helper_env.clone(), + managed_network: None, additional_permissions: None, }; let native_workspace_roots = sandbox_context @@ -130,6 +131,8 @@ impl FileSystemSandboxRunner { sandbox_manager .transform_for_direct_spawn(SandboxDirectSpawnTransformRequest { workspace_roots, + windows_sandbox_proxy_settings_mode: + codex_sandboxing::WindowsSandboxProxySettingsMode::Preserve, transform: SandboxTransformRequest { command, permissions: permission_profile, diff --git a/codex-rs/exec-server/src/local_process.rs b/codex-rs/exec-server/src/local_process.rs index 1f0dc5fec9..d77209e7cf 100644 --- a/codex-rs/exec-server/src/local_process.rs +++ b/codex-rs/exec-server/src/local_process.rs @@ -965,6 +965,7 @@ mod tests { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, } } diff --git a/codex-rs/exec-server/src/process_sandbox.rs b/codex-rs/exec-server/src/process_sandbox.rs index d157f4c6dc..ef97d0ce5f 100644 --- a/codex-rs/exec-server/src/process_sandbox.rs +++ b/codex-rs/exec-server/src/process_sandbox.rs @@ -1,6 +1,8 @@ use std::collections::HashMap; use codex_app_server_protocol::JSONRPCErrorError; +use codex_network_proxy::CUSTOM_CA_ENV_KEYS; +use codex_network_proxy::is_managed_mitm_ca_trust_bundle_path; use codex_protocol::models::PermissionProfile; use codex_sandboxing::SandboxCommand; use codex_sandboxing::SandboxDirectSpawnTransformRequest; @@ -8,6 +10,7 @@ use codex_sandboxing::SandboxManager; use codex_sandboxing::SandboxTransformRequest; use codex_sandboxing::SandboxType; use codex_sandboxing::SandboxablePreference; +use codex_sandboxing::with_managed_mitm_ca_readable_root; use codex_utils_absolute_path::AbsolutePathBuf; use codex_utils_path_uri::PathUri; @@ -59,6 +62,20 @@ pub(crate) fn prepare_exec_request( native_workspace_roots.as_slice() }; let permissions = permissions.materialize_project_roots_with_workspace_roots(workspace_roots); + let managed_mitm_ca_trust_bundle_path = params.managed_network.as_ref().and_then(|_| { + CUSTOM_CA_ENV_KEYS.iter().find_map(|key| { + let path = env.get(*key)?; + if !is_managed_mitm_ca_trust_bundle_path(path) { + return None; + } + AbsolutePathBuf::from_absolute_path(path).ok() + }) + }); + let permissions = with_managed_mitm_ca_readable_root( + permissions, + managed_mitm_ca_trust_bundle_path.as_ref(), + native_sandbox_policy_cwd.as_path(), + ); let (file_system_policy, network_policy) = permissions.to_runtime_permissions(); let sandbox_manager = SandboxManager::new(); let sandbox = sandbox_manager.select_initial( @@ -90,6 +107,8 @@ pub(crate) fn prepare_exec_request( let request = sandbox_manager .transform_for_direct_spawn(SandboxDirectSpawnTransformRequest { workspace_roots, + windows_sandbox_proxy_settings_mode: + codex_sandboxing::WindowsSandboxProxySettingsMode::Reconcile, transform: SandboxTransformRequest { // TODO(jif): Preserve params.arg0 for the inner command across the sandbox // wrapper, or reject sandboxed requests with a custom arg0. @@ -98,6 +117,7 @@ pub(crate) fn prepare_exec_request( args: args.to_vec(), cwd: params.cwd.clone(), env, + managed_network: params.managed_network.clone(), additional_permissions: None, }, permissions: &permissions, diff --git a/codex-rs/exec-server/src/process_sandbox_tests.rs b/codex-rs/exec-server/src/process_sandbox_tests.rs index 1b0408afd8..bc71b57320 100644 --- a/codex-rs/exec-server/src/process_sandbox_tests.rs +++ b/codex-rs/exec-server/src/process_sandbox_tests.rs @@ -1,5 +1,7 @@ use std::collections::HashMap; +#[cfg(target_os = "macos")] +use codex_network_proxy::ManagedNetworkSandboxContext; #[cfg(unix)] use codex_protocol::models::PermissionProfile; use codex_utils_absolute_path::AbsolutePathBuf; @@ -44,6 +46,7 @@ fn sandbox_request_wraps_native_argv_on_executor() { arg0: None, sandbox: Some(sandbox), enforce_managed_network: false, + managed_network: None, }; let prepared = prepare_exec_request(¶ms, HashMap::new(), Some(&runtime_paths)) @@ -78,6 +81,49 @@ fn sandbox_request_wraps_native_argv_on_executor() { ); } +#[cfg(target_os = "macos")] +#[test] +fn sandbox_request_allows_prepared_managed_proxy_port() { + let cwd: AbsolutePathBuf = std::env::current_dir() + .expect("current directory") + .try_into() + .expect("absolute cwd"); + let cwd_uri = PathUri::from_abs_path(&cwd); + let self_exe = std::env::current_exe().expect("current executable"); + let runtime_paths = + ExecServerRuntimePaths::new(self_exe.clone(), Some(self_exe)).expect("runtime paths"); + let sandbox = FileSystemSandboxContext::from_permission_profile_with_cwd( + PermissionProfile::workspace_write(), + cwd_uri.clone(), + ); + let params = ExecParams { + process_id: ProcessId::from("process-managed-network"), + argv: vec!["/usr/bin/true".to_string()], + cwd: cwd_uri, + env_policy: None, + env: HashMap::new(), + tty: false, + pipe_stdin: false, + arg0: None, + sandbox: Some(sandbox), + enforce_managed_network: true, + managed_network: Some(ManagedNetworkSandboxContext { + loopback_ports: vec![43123], + allow_local_binding: false, + }), + }; + + let prepared = prepare_exec_request(¶ms, HashMap::new(), Some(&runtime_paths)) + .expect("prepare managed-network sandbox request"); + let policy = prepared + .command + .windows(2) + .find_map(|args| (args[0] == "-p").then_some(args[1].as_str())) + .expect("Seatbelt policy argument"); + + assert!(policy.contains("(allow network-outbound (remote ip \"localhost:43123\"))")); +} + #[test] fn native_request_preserves_native_launch_fields() { let cwd: AbsolutePathBuf = std::env::current_dir() @@ -97,6 +143,7 @@ fn native_request_preserves_native_launch_fields() { arg0: Some("custom-arg0".to_string()), sandbox: None, enforce_managed_network: false, + managed_network: None, }; let prepared = prepare_exec_request(¶ms, env.clone(), /*runtime_paths*/ None) diff --git a/codex-rs/exec-server/src/protocol.rs b/codex-rs/exec-server/src/protocol.rs index 8771e869df..921223e312 100644 --- a/codex-rs/exec-server/src/protocol.rs +++ b/codex-rs/exec-server/src/protocol.rs @@ -2,6 +2,7 @@ use std::collections::HashMap; use base64::engine::general_purpose::STANDARD as BASE64_STANDARD; use codex_file_system::FileSystemSandboxContext; +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_protocol::config_types::ShellEnvironmentPolicyInherit; use codex_utils_path_uri::PathUri; use serde::Deserialize; @@ -109,6 +110,12 @@ pub struct ExecParams { /// Whether the eventual executor-side sandbox must enforce managed networking. #[serde(default)] pub enforce_managed_network: bool, + /// Optional details for enforcing managed networking without a live proxy object. + /// + /// When `enforce_managed_network` is true and these details are absent, the executor must + /// continue to fail closed. This preserves compatibility with older clients. + #[serde(default)] + pub managed_network: Option, } #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] @@ -504,12 +511,60 @@ mod base64_bytes { #[cfg(test)] mod tests { + use super::ExecParams; use super::FsReadFileParams; use super::HttpRequestParams; + use super::ProcessId; use codex_file_system::FileSystemSandboxContext; + use codex_network_proxy::ManagedNetworkSandboxContext; use codex_protocol::models::PermissionProfile; use codex_utils_path_uri::PathUri; use pretty_assertions::assert_eq; + use std::collections::HashMap; + + #[test] + fn exec_params_managed_network_context_round_trips_and_defaults_for_legacy_peers() { + let cwd = + PathUri::from_host_native_path(std::env::current_dir().expect("current directory")) + .expect("cwd URI"); + let params = ExecParams { + process_id: ProcessId::from("managed-network"), + argv: vec!["true".to_string()], + cwd, + env_policy: None, + env: HashMap::new(), + tty: false, + pipe_stdin: false, + arg0: None, + sandbox: None, + enforce_managed_network: true, + managed_network: Some(ManagedNetworkSandboxContext { + loopback_ports: vec![43123, 48081], + allow_local_binding: false, + }), + }; + + let mut serialized = serde_json::to_value(¶ms).expect("serialize exec params"); + assert_eq!( + serialized["managedNetwork"], + serde_json::json!({ + "loopbackPorts": [43123, 48081], + "allowLocalBinding": false, + }) + ); + let round_trip: ExecParams = + serde_json::from_value(serialized.clone()).expect("deserialize exec params"); + assert_eq!(round_trip, params); + + serialized + .as_object_mut() + .expect("exec params object") + .remove("managedNetwork"); + let legacy: ExecParams = + serde_json::from_value(serialized).expect("deserialize legacy exec params"); + assert!(legacy.enforce_managed_network); + assert_eq!(legacy.managed_network, None); + } #[test] fn filesystem_protocol_accepts_legacy_absolute_paths_and_serializes_path_uris() { diff --git a/codex-rs/exec-server/src/server/handler/tests.rs b/codex-rs/exec-server/src/server/handler/tests.rs index ebb2b6e6ea..2cea99b214 100644 --- a/codex-rs/exec-server/src/server/handler/tests.rs +++ b/codex-rs/exec-server/src/server/handler/tests.rs @@ -36,6 +36,7 @@ fn exec_params_with_argv(process_id: &str, argv: Vec) -> ExecParams { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, } } diff --git a/codex-rs/exec-server/src/server/processor.rs b/codex-rs/exec-server/src/server/processor.rs index e9316e0d54..d960e53ca0 100644 --- a/codex-rs/exec-server/src/server/processor.rs +++ b/codex-rs/exec-server/src/server/processor.rs @@ -441,6 +441,7 @@ mod tests { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, } } diff --git a/codex-rs/exec-server/tests/exec_process.rs b/codex-rs/exec-server/tests/exec_process.rs index 2f9b9c1dbe..8fe5fe0be9 100644 --- a/codex-rs/exec-server/tests/exec_process.rs +++ b/codex-rs/exec-server/tests/exec_process.rs @@ -83,6 +83,7 @@ async fn assert_exec_process_starts_and_exits(use_remote: bool) -> Result<()> { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), "proc-1"); @@ -226,6 +227,7 @@ async fn assert_exec_process_streams_output(use_remote: bool) -> Result<()> { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -259,6 +261,7 @@ async fn assert_exec_process_pushes_events(use_remote: bool) -> Result<()> { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -308,6 +311,7 @@ async fn assert_exec_process_replays_events_after_close(use_remote: bool) -> Res arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -358,6 +362,7 @@ async fn assert_exec_process_retains_output_after_exit_until_streams_close( arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -433,6 +438,7 @@ async fn assert_exec_process_write_then_read(use_remote: bool) -> Result<()> { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -472,6 +478,7 @@ async fn assert_exec_process_write_then_read_without_tty(use_remote: bool) -> Re arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -507,6 +514,7 @@ async fn assert_exec_process_rejects_write_without_pipe_stdin(use_remote: bool) arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -543,6 +551,7 @@ async fn assert_exec_process_signal_interrupts_process(use_remote: bool) -> Resu arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!(session.process.process_id().as_str(), process_id); @@ -598,6 +607,7 @@ async fn assert_exec_process_signal_reports_unsupported_on_windows(use_remote: b arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; @@ -640,6 +650,7 @@ async fn assert_exec_process_preserves_queued_events_before_subscribe( arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; @@ -700,6 +711,7 @@ async fn remote_exec_process_recovers_after_transport_disconnect() -> Result<()> arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; diff --git a/codex-rs/exec-server/tests/relay.rs b/codex-rs/exec-server/tests/relay.rs index 30ce1459b7..918cba7393 100644 --- a/codex-rs/exec-server/tests/relay.rs +++ b/codex-rs/exec-server/tests/relay.rs @@ -152,6 +152,7 @@ async fn remote_environment_routes_encrypted_exec_server_rpc() -> Result<()> { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await?; assert_eq!( diff --git a/codex-rs/exec/src/lib_tests.rs b/codex-rs/exec/src/lib_tests.rs index 4e341d773b..9f345eb334 100644 --- a/codex-rs/exec/src/lib_tests.rs +++ b/codex-rs/exec/src/lib_tests.rs @@ -334,6 +334,7 @@ async fn resume_lookup_model_providers_filters_only_last_lookup() { fn turn_items_for_thread_returns_matching_turn_items() { let thread = AppServerThread { id: "thread-1".to_string(), + extra: None, session_id: "thread-1".to_string(), forked_from_id: None, parent_thread_id: None, @@ -753,6 +754,7 @@ fn sample_thread_start_response() -> ThreadStartResponse { ThreadStartResponse { thread: codex_app_server_protocol::Thread { id: "67e55044-10b1-426f-9247-bb680e5fe0c8".to_string(), + extra: None, session_id: "67e55044-10b1-426f-9247-bb680e5fe0c7".to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/ext/image-generation/src/tool.rs b/codex-rs/ext/image-generation/src/tool.rs index 3e2cfd1792..d4451a8926 100644 --- a/codex-rs/ext/image-generation/src/tool.rs +++ b/codex-rs/ext/image-generation/src/tool.rs @@ -256,7 +256,8 @@ fn recent_images(history: &[ResponseItem], count: usize) -> Vec { ResponseItem::CustomToolCall { call_id, .. } => { custom_tool_call_ids.insert(call_id.as_str()); } - ResponseItem::Message { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::Message { .. } | ResponseItem::AgentMessage { .. } | ResponseItem::Reasoning { .. } | ResponseItem::LocalShellCall { .. } @@ -296,7 +297,8 @@ fn recent_images(history: &[ResponseItem], count: usize) -> Vec { ResponseItem::ImageGenerationCall { result, .. } if !result.is_empty() => { image_urls.push(format!("data:image/png;base64,{result}")); } - ResponseItem::Reasoning { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::Reasoning { .. } | ResponseItem::AgentMessage { .. } | ResponseItem::LocalShellCall { .. } | ResponseItem::FunctionCall { .. } diff --git a/codex-rs/features/src/feature_configs.rs b/codex-rs/features/src/feature_configs.rs index 35b669b0a0..be06bd157f 100644 --- a/codex-rs/features/src/feature_configs.rs +++ b/codex-rs/features/src/feature_configs.rs @@ -144,7 +144,7 @@ pub struct CurrentTimeReminderConfigToml { pub enabled: Option, #[serde(skip_serializing_if = "Option::is_none")] #[schemars(range(min = 1))] - pub reminder_interval_model_requests: Option, + pub reminder_interval_seconds: Option, #[serde(skip_serializing_if = "Option::is_none")] pub clock_source: Option, } diff --git a/codex-rs/mcp-server/src/codex_tool_config.rs b/codex-rs/mcp-server/src/codex_tool_config.rs index f90686dbea..531c8f8038 100644 --- a/codex-rs/mcp-server/src/codex_tool_config.rs +++ b/codex-rs/mcp-server/src/codex_tool_config.rs @@ -36,7 +36,7 @@ pub struct CodexToolCallParam { pub cwd: Option, /// Approval policy for shell commands generated by the model: - /// `untrusted`, `on-failure`, `on-request`, `never`. + /// `untrusted`, `on-request`, `never`. #[serde(default, skip_serializing_if = "Option::is_none")] pub approval_policy: Option, @@ -68,7 +68,6 @@ pub struct CodexToolCallParam { #[serde(rename_all = "kebab-case")] pub enum CodexToolCallApprovalPolicy { Untrusted, - OnFailure, OnRequest, Never, } @@ -77,7 +76,6 @@ impl From for AskForApproval { fn from(value: CodexToolCallApprovalPolicy) -> Self { match value { CodexToolCallApprovalPolicy::Untrusted => AskForApproval::UnlessTrusted, - CodexToolCallApprovalPolicy::OnFailure => AskForApproval::OnFailure, CodexToolCallApprovalPolicy::OnRequest => AskForApproval::OnRequest, CodexToolCallApprovalPolicy::Never => AskForApproval::Never, } @@ -301,10 +299,9 @@ mod tests { "additionalProperties": false, "properties": { "approval-policy": { - "description": "Approval policy for shell commands generated by the model: `untrusted`, `on-failure`, `on-request`, `never`.", + "description": "Approval policy for shell commands generated by the model: `untrusted`, `on-request`, `never`.", "enum": [ "untrusted", - "on-failure", "on-request", "never" ], diff --git a/codex-rs/models-manager/models.json b/codex-rs/models-manager/models.json index 213fdcf6c4..d17785476f 100644 --- a/codex-rs/models-manager/models.json +++ b/codex-rs/models-manager/models.json @@ -404,7 +404,7 @@ "migration_markdown": "Introducing GPT-5.4\n\nCodex just got an upgrade with GPT-5.4, our most capable model for professional work. It outperforms prior models while being more token efficient, with notable improvements on long-running tasks, tool calling, computer use, and frontend development.\n\nLearn more: https://openai.com/index/introducing-gpt-5-4\n\nYou can always keep using GPT-5.3-Codex if you prefer.\n" }, "priority": 10, - "base_instructions": "You are GPT-5.2 running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an open source project led by OpenAI. You are expected to be precise, safe, and helpful.\n\nYour capabilities:\n\n- Receive user prompts and other context provided by the harness, such as files in the workspace.\n- Communicate with the user by streaming thinking & responses, and by making & updating plans.\n- Emit function calls to run terminal commands and apply patches. Depending on how this specific run is configured, you can request that these function calls be escalated to the user for approval before running. More on this in the \"Sandbox and approvals\" section.\n\nWithin this context, Codex refers to the open-source agentic coding interface (not the old Codex language model built by OpenAI).\n\n# How you work\n\n## Personality\n\nYour default personality and tone is concise, direct, and friendly. You communicate efficiently, always keeping the user clearly informed about ongoing actions without unnecessary detail. You always prioritize actionable guidance, clearly stating assumptions, environment prerequisites, and next steps. Unless explicitly asked, you avoid excessively verbose explanations about your work.\n\n## AGENTS.md spec\n- Repos often contain AGENTS.md files. These files can appear anywhere within the repository.\n- These files are a way for humans to give you (the agent) instructions or tips for working within the container.\n- Some examples might be: coding conventions, info about how code is organized, or instructions for how to run or test code.\n- Instructions in AGENTS.md files:\n - The scope of an AGENTS.md file is the entire directory tree rooted at the folder that contains it.\n - For every file you touch in the final patch, you must obey instructions in any AGENTS.md file whose scope includes that file.\n - Instructions about code style, structure, naming, etc. apply only to code within the AGENTS.md file's scope, unless the file states otherwise.\n - More-deeply-nested AGENTS.md files take precedence in the case of conflicting instructions.\n - Direct system/developer/user instructions (as part of a prompt) take precedence over AGENTS.md instructions.\n- The contents of the AGENTS.md file at the root of the repo and any directories from the CWD up to the root are included with the developer message and don't need to be re-read. When working in a subdirectory of CWD, or a directory outside the CWD, check for any AGENTS.md files that may be applicable.\n\n## Autonomy and Persistence\nPersist until the task is fully handled end-to-end within the current turn whenever feasible: do not stop at analysis or partial fixes; carry changes through implementation, verification, and a clear explanation of outcomes unless the user explicitly pauses or redirects you.\n\nUnless the user explicitly asks for a plan, asks a question about the code, is brainstorming potential solutions, or some other intent that makes it clear that code should not be written, assume the user wants you to make code changes or run tools to solve the user's problem. In these cases, it's bad to output your proposed solution in a message, you should go ahead and actually implement the change. If you encounter challenges or blockers, you should attempt to resolve them yourself.\n\n## Responsiveness\n\n## Planning\n\nYou have access to an `update_plan` tool which tracks steps and progress and renders them to the user. Using the tool helps demonstrate that you've understood the task and convey how you're approaching it. Plans can help to make complex, ambiguous, or multi-phase work clearer and more collaborative for the user. A good plan should break the task into meaningful, logically ordered steps that are easy to verify as you go.\n\nNote that plans are not for padding out simple work with filler steps or stating the obvious. The content of your plan should not involve doing anything that you aren't capable of doing (i.e. don't try to test things that you can't test). Do not use plans for simple or single-step queries that you can just do or answer immediately.\n\nDo not repeat the full contents of the plan after an `update_plan` call — the harness already displays it. Instead, summarize the change made and highlight any important context or next step.\n\nBefore running a command, consider whether or not you have completed the previous step, and make sure to mark it as completed before moving on to the next step. It may be the case that you complete all steps in your plan after a single pass of implementation. If this is the case, you can simply mark all the planned steps as completed. Sometimes, you may need to change plans in the middle of a task: call `update_plan` with the updated plan and make sure to provide an `explanation` of the rationale when doing so.\n\nMaintain statuses in the tool: exactly one item in_progress at a time; mark items complete when done; post timely status transitions. Do not jump an item from pending to completed: always set it to in_progress first. Do not batch-complete multiple items after the fact. Finish with all items completed or explicitly canceled/deferred before ending the turn. Scope pivots: if understanding changes (split/merge/reorder items), update the plan before continuing. Do not let the plan go stale while coding.\n\nUse a plan when:\n\n- The task is non-trivial and will require multiple actions over a long time horizon.\n- There are logical phases or dependencies where sequencing matters.\n- The work has ambiguity that benefits from outlining high-level goals.\n- You want intermediate checkpoints for feedback and validation.\n- When the user asked you to do more than one thing in a single prompt\n- The user has asked you to use the plan tool (aka \"TODOs\")\n- You generate additional steps while working, and plan to do them before yielding to the user\n\n### Examples\n\n**High-quality plans**\n\nExample 1:\n\n1. Add CLI entry with file args\n2. Parse Markdown via CommonMark library\n3. Apply semantic HTML template\n4. Handle code blocks, images, links\n5. Add error handling for invalid files\n\nExample 2:\n\n1. Define CSS variables for colors\n2. Add toggle with localStorage state\n3. Refactor components to use variables\n4. Verify all views for readability\n5. Add smooth theme-change transition\n\nExample 3:\n\n1. Set up Node.js + WebSocket server\n2. Add join/leave broadcast events\n3. Implement messaging with timestamps\n4. Add usernames + mention highlighting\n5. Persist messages in lightweight DB\n6. Add typing indicators + unread count\n\n**Low-quality plans**\n\nExample 1:\n\n1. Create CLI tool\n2. Add Markdown parser\n3. Convert to HTML\n\nExample 2:\n\n1. Add dark mode toggle\n2. Save preference\n3. Make styles look good\n\nExample 3:\n\n1. Create single-file HTML game\n2. Run quick sanity check\n3. Summarize usage instructions\n\nIf you need to write a plan, only write high quality plans, not low quality ones.\n\n## Task execution\n\nYou are a coding agent. You must keep going until the query or task is completely resolved, before ending your turn and yielding back to the user. Persist until the task is fully handled end-to-end within the current turn whenever feasible and persevere even when function calls fail. Only terminate your turn when you are sure that the problem is solved. Autonomously resolve the query to the best of your ability, using the tools available to you, before coming back to the user. Do NOT guess or make up an answer.\n\nYou MUST adhere to the following criteria when solving queries:\n\n- Working on the repo(s) in the current environment is allowed, even if they are proprietary.\n- Analyzing code for vulnerabilities is allowed.\n- Showing user code and tool call details is allowed.\n- Use the `apply_patch` tool to edit files (NEVER try `applypatch` or `apply-patch`, only `apply_patch`). This is a FREEFORM tool, so do not wrap the patch in JSON.\n\nIf completing the user's task requires writing or modifying files, your code and final answer should follow these coding guidelines, though user instructions (i.e. AGENTS.md) may override these guidelines:\n\n- Fix the problem at the root cause rather than applying surface-level patches, when possible.\n- Avoid unneeded complexity in your solution.\n- Do not attempt to fix unrelated bugs or broken tests. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)\n- Update documentation as necessary.\n- Keep changes consistent with the style of the existing codebase. Changes should be minimal and focused on the task.\n- If you're building a web app from scratch, give it a beautiful and modern UI, imbued with best UX practices.\n- Use `git log` and `git blame` to search the history of the codebase if additional context is required.\n- NEVER add copyright or license headers unless specifically requested.\n- Do not waste tokens by re-reading files after calling `apply_patch` on them. The tool call will fail if it didn't work. The same goes for making folders, deleting folders, etc.\n- Do not `git commit` your changes or create new git branches unless explicitly requested.\n- Do not add inline comments within code unless explicitly requested.\n- Do not use one-letter variable names unless explicitly requested.\n- NEVER output inline citations like \"【F:README.md†L5-L14】\" in your outputs. The CLI is not able to render these so they will just be broken in the UI. Instead, if you output valid filepaths, users will be able to click on them to open the files in their editor.\n\n## Validating your work\n\nIf the codebase has tests, or the ability to build or run tests, consider using them to verify changes once your work is complete.\n\nWhen testing, your philosophy should be to start as specific as possible to the code you changed so that you can catch issues efficiently, then make your way to broader tests as you build confidence. If there's no test for the code you changed, and if the adjacent patterns in the codebases show that there's a logical place for you to add a test, you may do so. However, do not add tests to codebases with no tests.\n\nSimilarly, once you're confident in correctness, you can suggest or use formatting commands to ensure that your code is well formatted. If there are issues you can iterate up to 3 times to get formatting right, but if you still can't manage it's better to save the user time and present them a correct solution where you call out the formatting in your final message. If the codebase does not have a formatter configured, do not add one.\n\nFor all of testing, running, building, and formatting, do not attempt to fix unrelated bugs. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)\n\nBe mindful of whether to run validation commands proactively. In the absence of behavioral guidance:\n\n- When running in non-interactive approval modes like **never** or **on-failure**, you can proactively run tests, lint and do whatever you need to ensure you've completed the task. If you are unable to run tests, you must still do your utmost best to complete the task.\n- When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first.\n- When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task.\n\n## Ambition vs. precision\n\nFor tasks that have no prior context (i.e. the user is starting something brand new), you should feel free to be ambitious and demonstrate creativity with your implementation.\n\nIf you're operating in an existing codebase, you should make sure you do exactly what the user asks with surgical precision. Treat the surrounding codebase with respect, and don't overstep (i.e. changing filenames or variables unnecessarily). You should balance being sufficiently ambitious and proactive when completing tasks of this nature.\n\nYou should use judicious initiative to decide on the right level of detail and complexity to deliver based on the user's needs. This means showing good judgment that you're capable of doing the right extras without gold-plating. This might be demonstrated by high-value, creative touches when scope of the task is vague; while being surgical and targeted when scope is tightly specified.\n\n## Presenting your work \n\nYour final message should read naturally, like an update from a concise teammate. For casual conversation, brainstorming tasks, or quick questions from the user, respond in a friendly, conversational tone. You should ask questions, suggest ideas, and adapt to the user’s style. If you've finished a large amount of work, when describing what you've done to the user, you should follow the final answer formatting guidelines to communicate substantive changes. You don't need to add structured formatting for one-word answers, greetings, or purely conversational exchanges.\n\nYou can skip heavy formatting for single, simple actions or confirmations. In these cases, respond in plain sentences with any relevant next step or quick option. Reserve multi-section structured responses for results that need grouping or explanation.\n\nThe user is working on the same computer as you, and has access to your work. As such there's no need to show the contents of files you have already written unless the user explicitly asks for them. Similarly, if you've created or modified files using `apply_patch`, there's no need to tell users to \"save the file\" or \"copy the code into a file\"—just reference the file path.\n\nIf there's something that you think you could help with as a logical next step, concisely ask the user if they want you to do so. Good examples of this are running tests, committing changes, or building out the next logical component. If there’s something that you couldn't do (even with approval) but that the user might want to do (such as verifying changes by running the app), include those instructions succinctly.\n\nBrevity is very important as a default. You should be very concise (i.e. no more than 10 lines), but can relax this requirement for tasks where additional detail and comprehensiveness is important for the user's understanding.\n\n### Final answer structure and style guidelines\n\nYou are producing plain text that will later be styled by the CLI. Follow these rules exactly. Formatting should make results easy to scan, but not feel mechanical. Use judgment to decide how much structure adds value.\n\n**Section Headers**\n\n- Use only when they improve clarity — they are not mandatory for every answer.\n- Choose descriptive names that fit the content\n- Keep headers short (1–3 words) and in `**Title Case**`. Always start headers with `**` and end with `**`\n- Leave no blank line before the first bullet under a header.\n- Section headers should only be used where they genuinely improve scanability; avoid fragmenting the answer.\n\n**Bullets**\n\n- Use `-` followed by a space for every bullet.\n- Merge related points when possible; avoid a bullet for every trivial detail.\n- Keep bullets to one line unless breaking for clarity is unavoidable.\n- Group into short lists (4–6 bullets) ordered by importance.\n- Use consistent keyword phrasing and formatting across sections.\n\n**Monospace**\n\n- Wrap all commands, file paths, env vars, code identifiers, and code samples in backticks (`` `...` ``).\n- Apply to inline examples and to bullet keywords if the keyword itself is a literal file/command.\n- Never mix monospace and bold markers; choose one based on whether it’s a keyword (`**`) or inline code/path (`` ` ``).\n\n**File References**\nWhen referencing files in your response, make sure to include the relevant start line and always follow the below rules:\n * Use inline code to make file paths clickable.\n * Each reference should have a stand alone path. Even if it's the same file.\n * Accepted: absolute, workspace‑relative, a/ or b/ diff prefixes, or bare filename/suffix.\n * Line/column (1‑based, optional): :line[:column] or #Lline[Ccolumn] (column defaults to 1).\n * Do not use URIs like file://, vscode://, or https://.\n * Do not provide range of lines\n * Examples: src/app.ts, src/app.ts:42, b/server/index.js#L10, C:\\repo\\project\\main.rs:12:5\n\n**Structure**\n\n- Place related bullets together; don’t mix unrelated concepts in the same section.\n- Order sections from general → specific → supporting info.\n- For subsections (e.g., “Binaries” under “Rust Workspace”), introduce with a bolded keyword bullet, then list items under it.\n- Match structure to complexity:\n - Multi-part or detailed results → use clear headers and grouped bullets.\n - Simple results → minimal headers, possibly just a short list or paragraph.\n\n**Tone**\n\n- Keep the voice collaborative and natural, like a coding partner handing off work.\n- Be concise and factual — no filler or conversational commentary and avoid unnecessary repetition\n- Use present tense and active voice (e.g., “Runs tests” not “This will run tests”).\n- Keep descriptions self-contained; don’t refer to “above” or “below”.\n- Use parallel structure in lists for consistency.\n\n**Verbosity**\n- Final answer compactness rules (enforced):\n - Tiny/small single-file change (≤ ~10 lines): 2–5 sentences or ≤3 bullets. No headings. 0–1 short snippet (≤3 lines) only if essential.\n - Medium change (single area or a few files): ≤6 bullets or 6–10 sentences. At most 1–2 short snippets total (≤8 lines each).\n - Large/multi-file change: Summarize per file with 1–2 bullets; avoid inlining code unless critical (still ≤2 short snippets total).\n - Never include \"before/after\" pairs, full method bodies, or large/scrolling code blocks in the final message. Prefer referencing file/symbol names instead.\n\n**Don’t**\n\n- Don’t use literal words “bold” or “monospace” in the content.\n- Don’t nest bullets or create deep hierarchies.\n- Don’t output ANSI escape codes directly — the CLI renderer applies them.\n- Don’t cram unrelated keywords into a single bullet; split for clarity.\n- Don’t let keyword lists run long — wrap or reformat for scanability.\n\nGenerally, ensure your final answers adapt their shape and depth to the request. For example, answers to code explanations should have a precise, structured explanation with code references that answer the question directly. For tasks with a simple implementation, lead with the outcome and supplement only with what’s needed for clarity. Larger changes can be presented as a logical walkthrough of your approach, grouping related steps, explaining rationale where it adds value, and highlighting next actions to accelerate the user. Your answers should provide the right level of detail while being easily scannable.\n\nFor casual greetings, acknowledgements, or other one-off conversational messages that are not delivering substantive information or structured results, respond naturally without section headers or bullet formatting.\n\n# Tool Guidelines\n\n## Shell commands\n\nWhen using the shell, you must adhere to the following guidelines:\n\n- When searching for text or files, prefer using `rg` or `rg --files` respectively because `rg` is much faster than alternatives like `grep`. (If the `rg` command is not found, then use alternatives.)\n- Do not use python scripts to attempt to output larger chunks of a file.\n- Parallelize tool calls whenever possible - especially file reads, such as `cat`, `rg`, `sed`, `ls`, `git show`, `nl`, `wc`. Use `multi_tool_use.parallel` to parallelize tool calls and only this.\n\n## apply_patch\n\nUse the `apply_patch` tool to edit files. Your patch language is a stripped‑down, file‑oriented diff format designed to be easy to parse and safe to apply. You can think of it as a high‑level envelope:\n\n*** Begin Patch\n[ one or more file sections ]\n*** End Patch\n\nWithin that envelope, you get a sequence of file operations.\nYou MUST include a header to specify the action you are taking.\nEach operation starts with one of three headers:\n\n*** Add File: - create a new file. Every following line is a + line (the initial contents).\n*** Delete File: - remove an existing file. Nothing follows.\n*** Update File: - patch an existing file in place (optionally with a rename).\n\nExample patch:\n\n```\n*** Begin Patch\n*** Add File: hello.txt\n+Hello world\n*** Update File: src/app.py\n*** Move to: src/main.py\n@@ def greet():\n-print(\"Hi\")\n+print(\"Hello, world!\")\n*** Delete File: obsolete.txt\n*** End Patch\n```\n\nIt is important to remember:\n\n- You must include a header with your intended action (Add/Delete/Update)\n- You must prefix new lines with `+` even when creating a new file\n\n## `update_plan`\n\nA tool named `update_plan` is available to you. You can use it to keep an up‑to‑date, step‑by‑step plan for the task.\n\nTo create a new plan, call `update_plan` with a short list of 1‑sentence steps (no more than 5-7 words each) with a `status` for each step (`pending`, `in_progress`, or `completed`).\n\nWhen steps have been completed, use `update_plan` to mark each finished step as `completed` and the next step you are working on as `in_progress`. There should always be exactly one `in_progress` step until everything is done. You can mark multiple items as complete in a single `update_plan` call.\n\nIf all steps are complete, ensure you call `update_plan` to mark all steps as `completed`.\n", + "base_instructions": "You are GPT-5.2 running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an open source project led by OpenAI. You are expected to be precise, safe, and helpful.\n\nYour capabilities:\n\n- Receive user prompts and other context provided by the harness, such as files in the workspace.\n- Communicate with the user by streaming thinking & responses, and by making & updating plans.\n- Emit function calls to run terminal commands and apply patches. Depending on how this specific run is configured, you can request that these function calls be escalated to the user for approval before running. More on this in the \"Sandbox and approvals\" section.\n\nWithin this context, Codex refers to the open-source agentic coding interface (not the old Codex language model built by OpenAI).\n\n# How you work\n\n## Personality\n\nYour default personality and tone is concise, direct, and friendly. You communicate efficiently, always keeping the user clearly informed about ongoing actions without unnecessary detail. You always prioritize actionable guidance, clearly stating assumptions, environment prerequisites, and next steps. Unless explicitly asked, you avoid excessively verbose explanations about your work.\n\n## AGENTS.md spec\n- Repos often contain AGENTS.md files. These files can appear anywhere within the repository.\n- These files are a way for humans to give you (the agent) instructions or tips for working within the container.\n- Some examples might be: coding conventions, info about how code is organized, or instructions for how to run or test code.\n- Instructions in AGENTS.md files:\n - The scope of an AGENTS.md file is the entire directory tree rooted at the folder that contains it.\n - For every file you touch in the final patch, you must obey instructions in any AGENTS.md file whose scope includes that file.\n - Instructions about code style, structure, naming, etc. apply only to code within the AGENTS.md file's scope, unless the file states otherwise.\n - More-deeply-nested AGENTS.md files take precedence in the case of conflicting instructions.\n - Direct system/developer/user instructions (as part of a prompt) take precedence over AGENTS.md instructions.\n- The contents of the AGENTS.md file at the root of the repo and any directories from the CWD up to the root are included with the developer message and don't need to be re-read. When working in a subdirectory of CWD, or a directory outside the CWD, check for any AGENTS.md files that may be applicable.\n\n## Autonomy and Persistence\nPersist until the task is fully handled end-to-end within the current turn whenever feasible: do not stop at analysis or partial fixes; carry changes through implementation, verification, and a clear explanation of outcomes unless the user explicitly pauses or redirects you.\n\nUnless the user explicitly asks for a plan, asks a question about the code, is brainstorming potential solutions, or some other intent that makes it clear that code should not be written, assume the user wants you to make code changes or run tools to solve the user's problem. In these cases, it's bad to output your proposed solution in a message, you should go ahead and actually implement the change. If you encounter challenges or blockers, you should attempt to resolve them yourself.\n\n## Responsiveness\n\n## Planning\n\nYou have access to an `update_plan` tool which tracks steps and progress and renders them to the user. Using the tool helps demonstrate that you've understood the task and convey how you're approaching it. Plans can help to make complex, ambiguous, or multi-phase work clearer and more collaborative for the user. A good plan should break the task into meaningful, logically ordered steps that are easy to verify as you go.\n\nNote that plans are not for padding out simple work with filler steps or stating the obvious. The content of your plan should not involve doing anything that you aren't capable of doing (i.e. don't try to test things that you can't test). Do not use plans for simple or single-step queries that you can just do or answer immediately.\n\nDo not repeat the full contents of the plan after an `update_plan` call — the harness already displays it. Instead, summarize the change made and highlight any important context or next step.\n\nBefore running a command, consider whether or not you have completed the previous step, and make sure to mark it as completed before moving on to the next step. It may be the case that you complete all steps in your plan after a single pass of implementation. If this is the case, you can simply mark all the planned steps as completed. Sometimes, you may need to change plans in the middle of a task: call `update_plan` with the updated plan and make sure to provide an `explanation` of the rationale when doing so.\n\nMaintain statuses in the tool: exactly one item in_progress at a time; mark items complete when done; post timely status transitions. Do not jump an item from pending to completed: always set it to in_progress first. Do not batch-complete multiple items after the fact. Finish with all items completed or explicitly canceled/deferred before ending the turn. Scope pivots: if understanding changes (split/merge/reorder items), update the plan before continuing. Do not let the plan go stale while coding.\n\nUse a plan when:\n\n- The task is non-trivial and will require multiple actions over a long time horizon.\n- There are logical phases or dependencies where sequencing matters.\n- The work has ambiguity that benefits from outlining high-level goals.\n- You want intermediate checkpoints for feedback and validation.\n- When the user asked you to do more than one thing in a single prompt\n- The user has asked you to use the plan tool (aka \"TODOs\")\n- You generate additional steps while working, and plan to do them before yielding to the user\n\n### Examples\n\n**High-quality plans**\n\nExample 1:\n\n1. Add CLI entry with file args\n2. Parse Markdown via CommonMark library\n3. Apply semantic HTML template\n4. Handle code blocks, images, links\n5. Add error handling for invalid files\n\nExample 2:\n\n1. Define CSS variables for colors\n2. Add toggle with localStorage state\n3. Refactor components to use variables\n4. Verify all views for readability\n5. Add smooth theme-change transition\n\nExample 3:\n\n1. Set up Node.js + WebSocket server\n2. Add join/leave broadcast events\n3. Implement messaging with timestamps\n4. Add usernames + mention highlighting\n5. Persist messages in lightweight DB\n6. Add typing indicators + unread count\n\n**Low-quality plans**\n\nExample 1:\n\n1. Create CLI tool\n2. Add Markdown parser\n3. Convert to HTML\n\nExample 2:\n\n1. Add dark mode toggle\n2. Save preference\n3. Make styles look good\n\nExample 3:\n\n1. Create single-file HTML game\n2. Run quick sanity check\n3. Summarize usage instructions\n\nIf you need to write a plan, only write high quality plans, not low quality ones.\n\n## Task execution\n\nYou are a coding agent. You must keep going until the query or task is completely resolved, before ending your turn and yielding back to the user. Persist until the task is fully handled end-to-end within the current turn whenever feasible and persevere even when function calls fail. Only terminate your turn when you are sure that the problem is solved. Autonomously resolve the query to the best of your ability, using the tools available to you, before coming back to the user. Do NOT guess or make up an answer.\n\nYou MUST adhere to the following criteria when solving queries:\n\n- Working on the repo(s) in the current environment is allowed, even if they are proprietary.\n- Analyzing code for vulnerabilities is allowed.\n- Showing user code and tool call details is allowed.\n- Use the `apply_patch` tool to edit files (NEVER try `applypatch` or `apply-patch`, only `apply_patch`). This is a FREEFORM tool, so do not wrap the patch in JSON.\n\nIf completing the user's task requires writing or modifying files, your code and final answer should follow these coding guidelines, though user instructions (i.e. AGENTS.md) may override these guidelines:\n\n- Fix the problem at the root cause rather than applying surface-level patches, when possible.\n- Avoid unneeded complexity in your solution.\n- Do not attempt to fix unrelated bugs or broken tests. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)\n- Update documentation as necessary.\n- Keep changes consistent with the style of the existing codebase. Changes should be minimal and focused on the task.\n- If you're building a web app from scratch, give it a beautiful and modern UI, imbued with best UX practices.\n- Use `git log` and `git blame` to search the history of the codebase if additional context is required.\n- NEVER add copyright or license headers unless specifically requested.\n- Do not waste tokens by re-reading files after calling `apply_patch` on them. The tool call will fail if it didn't work. The same goes for making folders, deleting folders, etc.\n- Do not `git commit` your changes or create new git branches unless explicitly requested.\n- Do not add inline comments within code unless explicitly requested.\n- Do not use one-letter variable names unless explicitly requested.\n- NEVER output inline citations like \"【F:README.md†L5-L14】\" in your outputs. The CLI is not able to render these so they will just be broken in the UI. Instead, if you output valid filepaths, users will be able to click on them to open the files in their editor.\n\n## Validating your work\n\nIf the codebase has tests, or the ability to build or run tests, consider using them to verify changes once your work is complete.\n\nWhen testing, your philosophy should be to start as specific as possible to the code you changed so that you can catch issues efficiently, then make your way to broader tests as you build confidence. If there's no test for the code you changed, and if the adjacent patterns in the codebases show that there's a logical place for you to add a test, you may do so. However, do not add tests to codebases with no tests.\n\nSimilarly, once you're confident in correctness, you can suggest or use formatting commands to ensure that your code is well formatted. If there are issues you can iterate up to 3 times to get formatting right, but if you still can't manage it's better to save the user time and present them a correct solution where you call out the formatting in your final message. If the codebase does not have a formatter configured, do not add one.\n\nFor all of testing, running, building, and formatting, do not attempt to fix unrelated bugs. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)\n\nBe mindful of whether to run validation commands proactively. In the absence of behavioral guidance:\n\n- When running in the non-interactive approval mode **never**, you can proactively run tests, lint and do whatever you need to ensure you've completed the task. If you are unable to run tests, you must still do your utmost best to complete the task.\n- When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first.\n- When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task.\n\n## Ambition vs. precision\n\nFor tasks that have no prior context (i.e. the user is starting something brand new), you should feel free to be ambitious and demonstrate creativity with your implementation.\n\nIf you're operating in an existing codebase, you should make sure you do exactly what the user asks with surgical precision. Treat the surrounding codebase with respect, and don't overstep (i.e. changing filenames or variables unnecessarily). You should balance being sufficiently ambitious and proactive when completing tasks of this nature.\n\nYou should use judicious initiative to decide on the right level of detail and complexity to deliver based on the user's needs. This means showing good judgment that you're capable of doing the right extras without gold-plating. This might be demonstrated by high-value, creative touches when scope of the task is vague; while being surgical and targeted when scope is tightly specified.\n\n## Presenting your work \n\nYour final message should read naturally, like an update from a concise teammate. For casual conversation, brainstorming tasks, or quick questions from the user, respond in a friendly, conversational tone. You should ask questions, suggest ideas, and adapt to the user’s style. If you've finished a large amount of work, when describing what you've done to the user, you should follow the final answer formatting guidelines to communicate substantive changes. You don't need to add structured formatting for one-word answers, greetings, or purely conversational exchanges.\n\nYou can skip heavy formatting for single, simple actions or confirmations. In these cases, respond in plain sentences with any relevant next step or quick option. Reserve multi-section structured responses for results that need grouping or explanation.\n\nThe user is working on the same computer as you, and has access to your work. As such there's no need to show the contents of files you have already written unless the user explicitly asks for them. Similarly, if you've created or modified files using `apply_patch`, there's no need to tell users to \"save the file\" or \"copy the code into a file\"—just reference the file path.\n\nIf there's something that you think you could help with as a logical next step, concisely ask the user if they want you to do so. Good examples of this are running tests, committing changes, or building out the next logical component. If there’s something that you couldn't do (even with approval) but that the user might want to do (such as verifying changes by running the app), include those instructions succinctly.\n\nBrevity is very important as a default. You should be very concise (i.e. no more than 10 lines), but can relax this requirement for tasks where additional detail and comprehensiveness is important for the user's understanding.\n\n### Final answer structure and style guidelines\n\nYou are producing plain text that will later be styled by the CLI. Follow these rules exactly. Formatting should make results easy to scan, but not feel mechanical. Use judgment to decide how much structure adds value.\n\n**Section Headers**\n\n- Use only when they improve clarity — they are not mandatory for every answer.\n- Choose descriptive names that fit the content\n- Keep headers short (1–3 words) and in `**Title Case**`. Always start headers with `**` and end with `**`\n- Leave no blank line before the first bullet under a header.\n- Section headers should only be used where they genuinely improve scanability; avoid fragmenting the answer.\n\n**Bullets**\n\n- Use `-` followed by a space for every bullet.\n- Merge related points when possible; avoid a bullet for every trivial detail.\n- Keep bullets to one line unless breaking for clarity is unavoidable.\n- Group into short lists (4–6 bullets) ordered by importance.\n- Use consistent keyword phrasing and formatting across sections.\n\n**Monospace**\n\n- Wrap all commands, file paths, env vars, code identifiers, and code samples in backticks (`` `...` ``).\n- Apply to inline examples and to bullet keywords if the keyword itself is a literal file/command.\n- Never mix monospace and bold markers; choose one based on whether it’s a keyword (`**`) or inline code/path (`` ` ``).\n\n**File References**\nWhen referencing files in your response, make sure to include the relevant start line and always follow the below rules:\n * Use inline code to make file paths clickable.\n * Each reference should have a stand alone path. Even if it's the same file.\n * Accepted: absolute, workspace‑relative, a/ or b/ diff prefixes, or bare filename/suffix.\n * Line/column (1‑based, optional): :line[:column] or #Lline[Ccolumn] (column defaults to 1).\n * Do not use URIs like file://, vscode://, or https://.\n * Do not provide range of lines\n * Examples: src/app.ts, src/app.ts:42, b/server/index.js#L10, C:\\repo\\project\\main.rs:12:5\n\n**Structure**\n\n- Place related bullets together; don’t mix unrelated concepts in the same section.\n- Order sections from general → specific → supporting info.\n- For subsections (e.g., “Binaries” under “Rust Workspace”), introduce with a bolded keyword bullet, then list items under it.\n- Match structure to complexity:\n - Multi-part or detailed results → use clear headers and grouped bullets.\n - Simple results → minimal headers, possibly just a short list or paragraph.\n\n**Tone**\n\n- Keep the voice collaborative and natural, like a coding partner handing off work.\n- Be concise and factual — no filler or conversational commentary and avoid unnecessary repetition\n- Use present tense and active voice (e.g., “Runs tests” not “This will run tests”).\n- Keep descriptions self-contained; don’t refer to “above” or “below”.\n- Use parallel structure in lists for consistency.\n\n**Verbosity**\n- Final answer compactness rules (enforced):\n - Tiny/small single-file change (≤ ~10 lines): 2–5 sentences or ≤3 bullets. No headings. 0–1 short snippet (≤3 lines) only if essential.\n - Medium change (single area or a few files): ≤6 bullets or 6–10 sentences. At most 1–2 short snippets total (≤8 lines each).\n - Large/multi-file change: Summarize per file with 1–2 bullets; avoid inlining code unless critical (still ≤2 short snippets total).\n - Never include \"before/after\" pairs, full method bodies, or large/scrolling code blocks in the final message. Prefer referencing file/symbol names instead.\n\n**Don’t**\n\n- Don’t use literal words “bold” or “monospace” in the content.\n- Don’t nest bullets or create deep hierarchies.\n- Don’t output ANSI escape codes directly — the CLI renderer applies them.\n- Don’t cram unrelated keywords into a single bullet; split for clarity.\n- Don’t let keyword lists run long — wrap or reformat for scanability.\n\nGenerally, ensure your final answers adapt their shape and depth to the request. For example, answers to code explanations should have a precise, structured explanation with code references that answer the question directly. For tasks with a simple implementation, lead with the outcome and supplement only with what’s needed for clarity. Larger changes can be presented as a logical walkthrough of your approach, grouping related steps, explaining rationale where it adds value, and highlighting next actions to accelerate the user. Your answers should provide the right level of detail while being easily scannable.\n\nFor casual greetings, acknowledgements, or other one-off conversational messages that are not delivering substantive information or structured results, respond naturally without section headers or bullet formatting.\n\n# Tool Guidelines\n\n## Shell commands\n\nWhen using the shell, you must adhere to the following guidelines:\n\n- When searching for text or files, prefer using `rg` or `rg --files` respectively because `rg` is much faster than alternatives like `grep`. (If the `rg` command is not found, then use alternatives.)\n- Do not use python scripts to attempt to output larger chunks of a file.\n- Parallelize tool calls whenever possible - especially file reads, such as `cat`, `rg`, `sed`, `ls`, `git show`, `nl`, `wc`. Use `multi_tool_use.parallel` to parallelize tool calls and only this.\n\n## apply_patch\n\nUse the `apply_patch` tool to edit files. Your patch language is a stripped‑down, file‑oriented diff format designed to be easy to parse and safe to apply. You can think of it as a high‑level envelope:\n\n*** Begin Patch\n[ one or more file sections ]\n*** End Patch\n\nWithin that envelope, you get a sequence of file operations.\nYou MUST include a header to specify the action you are taking.\nEach operation starts with one of three headers:\n\n*** Add File: - create a new file. Every following line is a + line (the initial contents).\n*** Delete File: - remove an existing file. Nothing follows.\n*** Update File: - patch an existing file in place (optionally with a rename).\n\nExample patch:\n\n```\n*** Begin Patch\n*** Add File: hello.txt\n+Hello world\n*** Update File: src/app.py\n*** Move to: src/main.py\n@@ def greet():\n-print(\"Hi\")\n+print(\"Hello, world!\")\n*** Delete File: obsolete.txt\n*** End Patch\n```\n\nIt is important to remember:\n\n- You must include a header with your intended action (Add/Delete/Update)\n- You must prefix new lines with `+` even when creating a new file\n\n## `update_plan`\n\nA tool named `update_plan` is available to you. You can use it to keep an up‑to‑date, step‑by‑step plan for the task.\n\nTo create a new plan, call `update_plan` with a short list of 1‑sentence steps (no more than 5-7 words each) with a `status` for each step (`pending`, `in_progress`, or `completed`).\n\nWhen steps have been completed, use `update_plan` to mark each finished step as `completed` and the next step you are working on as `in_progress`. There should always be exactly one `in_progress` step until everything is done. You can mark multiple items as complete in a single `update_plan` call.\n\nIf all steps are complete, ensure you call `update_plan` to mark all steps as `completed`.\n", "model_messages": null, "experimental_supported_tools": [], "available_in_plans": [ diff --git a/codex-rs/models-manager/prompt.md b/codex-rs/models-manager/prompt.md index 4886c7ef44..907ff8b877 100644 --- a/codex-rs/models-manager/prompt.md +++ b/codex-rs/models-manager/prompt.md @@ -158,7 +158,7 @@ For all of testing, running, building, and formatting, do not attempt to fix unr Be mindful of whether to run validation commands proactively. In the absence of behavioral guidance: -- When running in non-interactive approval modes like **never** or **on-failure**, proactively run tests, lint and do whatever you need to ensure you've completed the task. +- When running in the non-interactive approval mode **never**, proactively run tests, lint and do whatever you need to ensure you've completed the task. - When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first. - When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task. diff --git a/codex-rs/network-proxy/README.md b/codex-rs/network-proxy/README.md index d5d0730227..484fa817aa 100644 --- a/codex-rs/network-proxy/README.md +++ b/codex-rs/network-proxy/README.md @@ -34,9 +34,9 @@ allow_upstream_proxy = true dangerously_allow_non_loopback_proxy = false mode = "full" # default when unset; use "limited" for read-only mode # HTTPS MITM is enabled automatically when `mode = "limited"` or when MITM hooks are configured. -# CA cert/key are managed internally under $CODEX_HOME/proxy/ (ca.pem + ca.key). -# When MITM is active, spawned commands receive CA bundle env vars pointing at -# immutable bundles under $CODEX_HOME/proxy/ so common HTTPS clients trust the managed CA. +# The CA private key remains in proxy memory. When MITM is active, spawned commands receive CA +# bundle env vars pointing at immutable public files under $CODEX_HOME/proxy/ so common HTTPS +# clients trust the managed CA. # If false, local/private networking is rejected. Explicit allowlisting of local IP literals # (or `localhost`) is required to permit them. diff --git a/codex-rs/network-proxy/src/certs.rs b/codex-rs/network-proxy/src/certs.rs index 2ff7cc03b4..442211f60b 100644 --- a/codex-rs/network-proxy/src/certs.rs +++ b/codex-rs/network-proxy/src/certs.rs @@ -32,6 +32,8 @@ use std::net::IpAddr; use std::path::Path; use std::path::PathBuf; use std::sync::Arc; +use std::sync::LazyLock; +use std::sync::Mutex; use std::time::SystemTime; use std::time::UNIX_EPOCH; use tracing::info; @@ -39,15 +41,60 @@ use tracing::warn; pub(super) struct ManagedMitmCa { issuer: Issuer<'static, KeyPair>, + certificate_path: PathBuf, + _artifact_lease: File, } +static MANAGED_MITM_CAS: LazyLock>>> = + LazyLock::new(|| Mutex::new(HashMap::new())); + impl ManagedMitmCa { - pub(super) fn load_or_create() -> Result { - let (ca_cert_pem, ca_key_pem) = load_or_create_ca()?; - let ca_key = KeyPair::from_pem(&ca_key_pem).context("failed to parse CA key")?; - let issuer: Issuer<'static, KeyPair> = - Issuer::from_ca_cert_pem(&ca_cert_pem, ca_key).context("failed to parse CA cert")?; - Ok(Self { issuer }) + pub(super) fn load_or_create() -> Result> { + let proxy_dir = managed_ca_dir()?; + let mut managed_cas = MANAGED_MITM_CAS + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner); + if let Some(ca) = managed_cas.get(&proxy_dir) { + return Ok(ca.clone()); + } + + let ca = Arc::new(Self::create(&proxy_dir)?); + managed_cas.insert(proxy_dir, ca.clone()); + Ok(ca) + } + + fn create(proxy_dir: &Path) -> Result { + fs::create_dir_all(proxy_dir) + .with_context(|| format!("failed to create {}", proxy_dir.display()))?; + + let (certificate_pem, private_key) = generate_ca()?; + let artifact_lock = match lock_managed_ca_artifacts(proxy_dir) { + Ok(lock) => Some(lock), + Err(err) => { + warn!("failed to lock managed MITM CA artifacts; skipping pruning: {err}"); + None + } + }; + let certificate_path = persist_managed_ca_certificate(proxy_dir, &certificate_pem)?; + let issuer = Issuer::from_ca_cert_pem(&certificate_pem, private_key) + .context("failed to parse managed MITM CA certificate")?; + let artifact_lease = lock_managed_ca_certificate(&certificate_path)?; + if artifact_lock.is_some() { + prune_managed_ca_artifacts(proxy_dir); + } + info!( + cert_path = %certificate_path.display(), + "generated process-local MITM CA" + ); + Ok(Self { + issuer, + certificate_path, + _artifact_lease: artifact_lease, + }) + } + + fn certificate_path(&self) -> &Path { + &self.certificate_path } pub(super) fn tls_acceptor_data_for_host(&self, host: &str) -> Result { @@ -100,8 +147,8 @@ fn issue_host_certificate_pem( } const MANAGED_MITM_CA_DIR: &str = "proxy"; -const MANAGED_MITM_CA_CERT: &str = "ca.pem"; -const MANAGED_MITM_CA_KEY: &str = "ca.key"; +const MANAGED_MITM_CA_ARTIFACT_LOCK: &str = ".artifacts.lock"; +const MANAGED_MITM_CA_CERT_PREFIX: &str = "ca"; const MANAGED_MITM_CA_TRUST_BUNDLE_PREFIX: &str = "ca-bundle"; pub(crate) const SSL_CERT_DIR_ENV_KEY: &str = "SSL_CERT_DIR"; @@ -135,22 +182,17 @@ pub(crate) struct ManagedMitmCaTrustBundle { pub(crate) startup_env_values: HashMap<&'static str, String>, } -fn managed_ca_paths() -> Result<(PathBuf, PathBuf)> { +fn managed_ca_dir() -> Result { let codex_home = find_codex_home().context("failed to resolve CODEX_HOME for managed MITM CA")?; - let proxy_dir = codex_home.join(MANAGED_MITM_CA_DIR); - Ok(( - proxy_dir.join(MANAGED_MITM_CA_CERT).to_path_buf(), - proxy_dir.join(MANAGED_MITM_CA_KEY).to_path_buf(), - )) + Ok(codex_home.join(MANAGED_MITM_CA_DIR).to_path_buf()) } pub(crate) fn managed_ca_trust_bundle( env: &HashMap<&'static str, String>, ) -> Result { - load_or_create_ca()?; - let (cert_path, _) = managed_ca_paths()?; - managed_ca_trust_bundle_for_cert_path(&cert_path, env) + let ca = ManagedMitmCa::load_or_create()?; + managed_ca_trust_bundle_for_cert_path(ca.certificate_path(), env) } fn managed_ca_trust_bundle_for_cert_path( @@ -175,8 +217,8 @@ fn managed_ca_trust_bundle_for_cert_path( pub(crate) fn upstream_tls_root_store( env: &HashMap<&'static str, String>, ) -> Result> { - let (managed_ca_cert_path, _) = managed_ca_paths()?; - upstream_tls_root_store_for_cert_path(&managed_ca_cert_path, env) + let ca = ManagedMitmCa::load_or_create()?; + upstream_tls_root_store_for_cert_path(ca.certificate_path(), env) } pub(crate) fn upstream_tls_root_store_for_cert_path( @@ -360,6 +402,9 @@ fn is_current_generated_trust_bundle_path(path: &Path, managed_ca_cert_path: &Pa let Some(proxy_dir) = managed_ca_cert_path.parent() else { return false; }; + if is_generated_trust_bundle_path(path, proxy_dir) { + return true; + } let Some(file_name) = path.file_name().and_then(|file_name| file_name.to_str()) else { return false; }; @@ -381,12 +426,39 @@ fn is_current_generated_trust_bundle_path(path: &Path, managed_ca_cert_path: &Pa .any(|window| window == managed_ca_cert) } -/// Returns whether `path` points at a current Codex-generated MITM CA bundle. -pub fn is_managed_mitm_ca_trust_bundle_path(path: &str) -> bool { - let Ok((managed_ca_cert_path, _)) = managed_ca_paths() else { +fn is_generated_trust_bundle_path(path: &Path, proxy_dir: &Path) -> bool { + is_generated_managed_ca_artifact_path(path, proxy_dir, MANAGED_MITM_CA_TRUST_BUNDLE_PREFIX) +} + +fn is_generated_managed_ca_artifact_path(path: &Path, proxy_dir: &Path, prefix: &str) -> bool { + let Some(file_name) = path.file_name().and_then(|file_name| file_name.to_str()) else { return false; }; - is_current_generated_trust_bundle_path(Path::new(path), &managed_ca_cert_path) + let Some(expected_hash) = file_name + .strip_prefix(prefix) + .and_then(|suffix| suffix.strip_prefix('-')) + .and_then(|suffix| suffix.strip_suffix(".pem")) + else { + return false; + }; + if path.parent() != Some(proxy_dir) + || expected_hash.len() != 64 + || !expected_hash.bytes().all(|byte| byte.is_ascii_hexdigit()) + { + return false; + } + let Ok(trust_bundle) = fs::read(path) else { + return false; + }; + format!("{:x}", Sha256::digest(trust_bundle)) == expected_hash +} + +/// Returns whether `path` points at a current Codex-generated MITM CA bundle. +pub fn is_managed_mitm_ca_trust_bundle_path(path: &str) -> bool { + let Ok(proxy_dir) = managed_ca_dir() else { + return false; + }; + is_generated_trust_bundle_path(Path::new(path), &proxy_dir) } fn persist_managed_ca_trust_bundle( @@ -439,56 +511,160 @@ fn push_certificate_pem(bundle: &mut String, der: &[u8]) { bundle.push_str("-----END CERTIFICATE-----\n"); } -fn load_or_create_ca() -> Result<(String, String)> { - let (cert_path, key_path) = managed_ca_paths()?; - - if cert_path.exists() || key_path.exists() { - if !cert_path.exists() || !key_path.exists() { - return Err(anyhow!( - "both managed MITM CA files must exist (cert={}, key={})", - cert_path.display(), - key_path.display() - )); - } - validate_existing_ca_key_file(&key_path)?; - let cert_pem = fs::read_to_string(&cert_path) - .with_context(|| format!("failed to read CA cert {}", cert_path.display()))?; - let key_pem = fs::read_to_string(&key_path) - .with_context(|| format!("failed to read CA key {}", key_path.display()))?; - return Ok((cert_pem, key_pem)); - } - - if let Some(parent) = cert_path.parent() { - fs::create_dir_all(parent) - .with_context(|| format!("failed to create {}", parent.display()))?; - } - if let Some(parent) = key_path.parent() { - fs::create_dir_all(parent) - .with_context(|| format!("failed to create {}", parent.display()))?; - } - - let (cert_pem, key_pem) = generate_ca()?; - // The CA key is a high-value secret. Create it atomically with restrictive permissions. - // The cert can be world-readable, but we still write it atomically to avoid partial writes. - // - // We intentionally use create-new semantics: if a key already exists, we should not overwrite - // it silently (that would invalidate previously-trusted cert chains). - write_atomic_create_new(&key_path, key_pem.as_bytes(), /*mode*/ 0o600) - .with_context(|| format!("failed to persist CA key {}", key_path.display()))?; - if let Err(err) = write_atomic_create_new(&cert_path, cert_pem.as_bytes(), /*mode*/ 0o644) - .with_context(|| format!("failed to persist CA cert {}", cert_path.display())) - { - // Avoid leaving a partially-created CA around (cert missing) if the second write fails. - let _ = fs::remove_file(&key_path); - return Err(err); - } - let cert_path = cert_path.display(); - let key_path = key_path.display(); - info!("generated MITM CA (cert_path={cert_path}, key_path={key_path})"); - Ok((cert_pem, key_pem)) +fn persist_managed_ca_certificate(proxy_dir: &Path, cert_pem: &str) -> Result { + let hash = Sha256::digest(cert_pem.as_bytes()); + let cert_path = proxy_dir.join(format!("{MANAGED_MITM_CA_CERT_PREFIX}-{hash:x}.pem")); + write_atomic_create_new_or_reuse(&cert_path, cert_pem.as_bytes(), /*mode*/ 0o644) + .with_context(|| { + format!( + "failed to persist managed MITM CA certificate {}", + cert_path.display() + ) + })?; + Ok(cert_path) } -fn generate_ca() -> Result<(String, String)> { +fn lock_managed_ca_certificate(certificate_path: &Path) -> Result { + let lock_path = managed_ca_certificate_lock_path(certificate_path) + .ok_or_else(|| anyhow!("managed MITM CA certificate path is missing a file name"))?; + let file = open_managed_ca_lock(&lock_path)?; + file.lock_shared() + .with_context(|| format!("failed to lock {}", lock_path.display()))?; + Ok(file) +} + +fn lock_managed_ca_artifacts(proxy_dir: &Path) -> Result { + let lock_path = proxy_dir.join(MANAGED_MITM_CA_ARTIFACT_LOCK); + let file = open_managed_ca_lock(&lock_path)?; + file.lock() + .with_context(|| format!("failed to lock {}", lock_path.display()))?; + Ok(file) +} + +fn managed_ca_certificate_lock_path(certificate_path: &Path) -> Option { + let file_name = certificate_path.file_name()?.to_string_lossy(); + Some(certificate_path.with_file_name(format!(".{file_name}.lock"))) +} + +fn open_managed_ca_lock(path: &Path) -> Result { + if fs::symlink_metadata(path) + .ok() + .is_some_and(|metadata| metadata.file_type().is_symlink()) + { + return Err(anyhow!( + "refusing to use symlink lock file {}", + path.display() + )); + } + + #[cfg(unix)] + use std::os::unix::fs::OpenOptionsExt; + + let mut options = OpenOptions::new(); + options.read(true).write(true).create(true).truncate(false); + #[cfg(unix)] + options.mode(0o600); + options + .open(path) + .with_context(|| format!("failed to open {}", path.display())) +} + +fn prune_managed_ca_artifacts(proxy_dir: &Path) { + for certificate_path in + generated_managed_ca_artifact_paths(proxy_dir, MANAGED_MITM_CA_CERT_PREFIX) + { + remove_inactive_managed_ca_certificate(&certificate_path); + } + + let remaining_certificates = + generated_managed_ca_artifact_paths(proxy_dir, MANAGED_MITM_CA_CERT_PREFIX) + .into_iter() + .filter_map(|path| fs::read(path).ok()) + .filter(|certificate| !certificate.is_empty()) + .collect::>(); + let bundle_paths = + generated_managed_ca_artifact_paths(proxy_dir, MANAGED_MITM_CA_TRUST_BUNDLE_PREFIX); + for bundle_path in bundle_paths { + let Ok(contents) = fs::read(&bundle_path) else { + continue; + }; + if remaining_certificates.iter().any(|certificate| { + contents + .windows(certificate.len()) + .any(|window| window == certificate) + }) { + continue; + } + if let Err(err) = fs::remove_file(&bundle_path) + && err.kind() != std::io::ErrorKind::NotFound + { + warn!( + path = %bundle_path.display(), + "failed to prune stale managed MITM CA trust bundle: {err}" + ); + } + } +} + +fn generated_managed_ca_artifact_paths(proxy_dir: &Path, prefix: &str) -> Vec { + let Ok(entries) = fs::read_dir(proxy_dir) else { + return Vec::new(); + }; + entries + .filter_map(std::result::Result::ok) + .filter_map(|entry| { + let path = entry.path(); + if !is_generated_managed_ca_artifact_path(&path, proxy_dir, prefix) { + return None; + } + Some(path) + }) + .collect() +} + +fn remove_inactive_managed_ca_certificate(certificate_path: &Path) { + let Some(lock_path) = managed_ca_certificate_lock_path(certificate_path) else { + return; + }; + let Ok(lock_file) = open_managed_ca_lock(&lock_path) else { + return; + }; + match lock_file.try_lock() { + Ok(()) => {} + Err(std::fs::TryLockError::WouldBlock) => return, + Err(err) => { + warn!( + path = %lock_path.display(), + "failed to inspect managed MITM CA artifact lease: {err}" + ); + return; + } + } + + let removed = match fs::remove_file(certificate_path) { + Ok(()) => true, + Err(err) if err.kind() == std::io::ErrorKind::NotFound => true, + Err(err) => { + warn!( + path = %certificate_path.display(), + "failed to prune stale managed MITM CA certificate: {err}" + ); + false + } + }; + drop(lock_file); + if removed + && let Err(err) = fs::remove_file(&lock_path) + && err.kind() != std::io::ErrorKind::NotFound + { + warn!( + path = %lock_path.display(), + "failed to prune stale managed MITM CA artifact lease: {err}" + ); + } +} + +fn generate_ca() -> Result<(String, KeyPair)> { let mut params = CertificateParams::default(); params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); params.key_usages = vec![ @@ -505,7 +681,7 @@ fn generate_ca() -> Result<(String, String)> { let cert = params .self_signed(&key_pair) .map_err(|err| anyhow!("failed to generate CA cert: {err}"))?; - Ok((cert.pem(), key_pair.serialize_pem())) + Ok((cert.pem(), key_pair)) } fn write_atomic_create_new(path: &Path, contents: &[u8], mode: u32) -> Result<()> { @@ -604,41 +780,6 @@ fn write_atomic_create_new_or_reuse(path: &Path, contents: &[u8], mode: u32) -> } } -#[cfg(unix)] -fn validate_existing_ca_key_file(path: &Path) -> Result<()> { - use std::os::unix::fs::PermissionsExt; - - let metadata = fs::symlink_metadata(path) - .with_context(|| format!("failed to stat CA key {}", path.display()))?; - if metadata.file_type().is_symlink() { - return Err(anyhow!( - "refusing to use symlink for managed MITM CA key {}", - path.display() - )); - } - if !metadata.is_file() { - return Err(anyhow!( - "managed MITM CA key is not a regular file: {}", - path.display() - )); - } - - let mode = metadata.permissions().mode() & 0o777; - if mode & 0o077 != 0 { - return Err(anyhow!( - "managed MITM CA key {} must not be group/world accessible (mode={mode:o}; expected <= 600)", - path.display() - )); - } - - Ok(()) -} - -#[cfg(not(unix))] -fn validate_existing_ca_key_file(_path: &Path) -> Result<()> { - Ok(()) -} - #[cfg(unix)] fn open_create_new_with_mode(path: &Path, mode: u32) -> Result { use std::os::unix::fs::OpenOptionsExt; @@ -664,12 +805,83 @@ fn open_create_new_with_mode(path: &Path, _mode: u32) -> Result { mod tests { use super::*; - #[cfg(unix)] + use codex_utils_rustls_provider::ensure_rustls_crypto_provider; use pretty_assertions::assert_eq; - #[cfg(unix)] - use std::os::unix::fs::PermissionsExt; use tempfile::tempdir; + #[test] + fn managed_ca_private_key_is_not_persisted() { + ensure_rustls_crypto_provider(); + let dir = tempdir().unwrap(); + let ca = ManagedMitmCa::create(dir.path()).unwrap(); + ca.tls_acceptor_data_for_host("example.com").unwrap(); + let mut persisted_files = fs::read_dir(dir.path()) + .unwrap() + .map(|entry| entry.unwrap().path()) + .collect::>(); + persisted_files.sort(); + let mut expected_files = vec![ + ca.certificate_path().to_path_buf(), + managed_ca_certificate_lock_path(ca.certificate_path()).unwrap(), + dir.path().join(MANAGED_MITM_CA_ARTIFACT_LOCK), + ]; + expected_files.sort(); + + assert_eq!(persisted_files, expected_files); + assert_eq!( + fs::read(managed_ca_certificate_lock_path(ca.certificate_path()).unwrap()).unwrap(), + Vec::::new() + ); + } + + #[test] + fn managed_ca_artifact_pruning_preserves_only_active_certificates() { + let dir = tempdir().unwrap(); + let mut artifacts = Vec::new(); + let mut active_lease = None; + for index in 0..3 { + let certificate = format!("certificate {index}\n"); + let certificate_path = + persist_managed_ca_certificate(dir.path(), &certificate).unwrap(); + let lease = lock_managed_ca_certificate(&certificate_path).unwrap(); + if index == 0 { + active_lease = Some(lease); + } else { + drop(lease); + } + let bundle_path = persist_managed_ca_trust_bundle( + &certificate_path, + &format!("roots\n{certificate}"), + ) + .unwrap(); + artifacts.push((certificate_path, bundle_path)); + } + let unrelated_path = dir.path().join("ca-user.pem"); + fs::write(&unrelated_path, "user managed").unwrap(); + + prune_managed_ca_artifacts(dir.path()); + + let remaining_certificate_count = + generated_managed_ca_artifact_paths(dir.path(), MANAGED_MITM_CA_CERT_PREFIX).len(); + assert_eq!(remaining_certificate_count, 1); + assert!(artifacts[0].0.exists()); + assert!(artifacts[0].1.exists()); + assert!(!artifacts[1].0.exists()); + assert!(!artifacts[1].1.exists()); + assert!(!artifacts[2].0.exists()); + assert!(!artifacts[2].1.exists()); + assert!(unrelated_path.exists()); + + drop(active_lease.take()); + prune_managed_ca_artifacts(dir.path()); + + let remaining_certificates = + generated_managed_ca_artifact_paths(dir.path(), MANAGED_MITM_CA_CERT_PREFIX); + assert!(remaining_certificates.is_empty()); + assert!(!artifacts[0].0.exists()); + assert!(!artifacts[0].1.exists()); + } + #[test] fn current_generated_trust_bundle_path_rejects_stale_bundle() { let dir = tempdir().unwrap(); @@ -683,6 +895,24 @@ mod tests { )); } + #[test] + fn generated_trust_bundle_path_requires_matching_content_hash() { + let dir = tempdir().unwrap(); + let managed_ca_cert_path = dir.path().join("ca.pem"); + let trust_bundle_path = + persist_managed_ca_trust_bundle(&managed_ca_cert_path, "trusted roots").unwrap(); + + assert!(is_generated_trust_bundle_path( + &trust_bundle_path, + dir.path() + )); + fs::write(&trust_bundle_path, "tampered roots").unwrap(); + assert!(!is_generated_trust_bundle_path( + &trust_bundle_path, + dir.path() + )); + } + #[test] fn managed_ca_trust_bundle_appends_startup_file_and_directory_certificates() { let dir = tempdir().unwrap(); @@ -691,6 +921,7 @@ mod tests { let startup_ca_dir = dir.path().join("startup-certs"); let (managed_ca_cert, _) = generate_ca().unwrap(); let (startup_ca_cert, startup_ca_key) = generate_ca().unwrap(); + let startup_ca_key = startup_ca_key.serialize_pem(); let (directory_ca_cert, _) = generate_ca().unwrap(); let mut trusted_ca_der = CertificateDer::from_pem_slice(startup_ca_cert.as_bytes()) .unwrap() @@ -760,50 +991,6 @@ mod tests { assert_eq!(baseline_bundle.matches(&managed_ca_cert).count(), 1); } - #[cfg(unix)] - #[test] - fn validate_existing_ca_key_file_rejects_group_world_permissions() { - let dir = tempdir().unwrap(); - let key_path = dir.path().join("ca.key"); - fs::write(&key_path, "key").unwrap(); - fs::set_permissions(&key_path, fs::Permissions::from_mode(0o644)).unwrap(); - - let err = validate_existing_ca_key_file(&key_path).unwrap_err(); - assert!( - err.to_string().contains("group/world accessible"), - "unexpected error: {err:#}" - ); - } - - #[cfg(unix)] - #[test] - fn validate_existing_ca_key_file_rejects_symlink() { - use std::os::unix::fs::symlink; - - let dir = tempdir().unwrap(); - let target = dir.path().join("real.key"); - let link = dir.path().join("ca.key"); - fs::write(&target, "key").unwrap(); - symlink(&target, &link).unwrap(); - - let err = validate_existing_ca_key_file(&link).unwrap_err(); - assert!( - err.to_string().contains("symlink"), - "unexpected error: {err:#}" - ); - } - - #[cfg(unix)] - #[test] - fn validate_existing_ca_key_file_allows_private_permissions() { - let dir = tempdir().unwrap(); - let key_path = dir.path().join("ca.key"); - fs::write(&key_path, "key").unwrap(); - fs::set_permissions(&key_path, fs::Permissions::from_mode(0o600)).unwrap(); - - validate_existing_ca_key_file(&key_path).unwrap(); - } - #[cfg(unix)] #[test] fn write_atomic_create_new_or_reuse_rejects_matching_symlink_target() { diff --git a/codex-rs/network-proxy/src/lib.rs b/codex-rs/network-proxy/src/lib.rs index c8950f1f55..5bce990303 100644 --- a/codex-rs/network-proxy/src/lib.rs +++ b/codex-rs/network-proxy/src/lib.rs @@ -47,6 +47,7 @@ pub use proxy::Args; #[cfg(target_os = "macos")] pub use proxy::CODEX_PROXY_GIT_SSH_COMMAND_MARKER; pub use proxy::DEFAULT_NO_PROXY_VALUE; +pub use proxy::ManagedNetworkSandboxContext; pub use proxy::NO_PROXY_ENV_KEYS; pub use proxy::NetworkProxy; pub use proxy::NetworkProxyBuilder; @@ -56,6 +57,7 @@ pub use proxy::PROXY_ENV_KEYS; #[cfg(target_os = "macos")] pub use proxy::PROXY_GIT_SSH_COMMAND_ENV_KEY; pub use proxy::PROXY_URL_ENV_KEYS; +pub use proxy::PreparedManagedNetwork; pub use proxy::has_proxy_url_env_vars; pub use proxy::proxy_url_env_value; pub use runtime::BlockedRequest; diff --git a/codex-rs/network-proxy/src/mitm.rs b/codex-rs/network-proxy/src/mitm.rs index 70175ca706..6607d2ac08 100644 --- a/codex-rs/network-proxy/src/mitm.rs +++ b/codex-rs/network-proxy/src/mitm.rs @@ -53,7 +53,7 @@ use tracing::warn; /// State needed to terminate a CONNECT tunnel and enforce policy on inner HTTPS requests. pub struct MitmState { - ca: ManagedMitmCa, + ca: Arc, upstream: UpstreamClient, inspect: bool, max_body_bytes: usize, @@ -104,7 +104,7 @@ impl MitmState { // MITM exists when HTTPS policy depends on the inner request: limited-mode method clamps // and host-specific hooks both need visibility after CONNECT is established. We - // generate/load a local CA and issue per-host leaf certs so we can terminate TLS and + // generate a process-local CA and issue per-host leaf certs so we can terminate TLS and // apply policy. let ca = ManagedMitmCa::load_or_create()?; let upstream_tls_root_store = diff --git a/codex-rs/network-proxy/src/proxy.rs b/codex-rs/network-proxy/src/proxy.rs index 13998dd447..7d2372f179 100644 --- a/codex-rs/network-proxy/src/proxy.rs +++ b/codex-rs/network-proxy/src/proxy.rs @@ -10,6 +10,8 @@ use anyhow::Context; use anyhow::Result; use clap::Parser; use codex_utils_absolute_path::AbsolutePathBuf; +use serde::Deserialize; +use serde::Serialize; use std::collections::HashMap; use std::net::SocketAddr; use std::net::TcpListener as StdTcpListener; @@ -328,6 +330,27 @@ struct EnvironmentProxyAddrs { socks_addr: SocketAddr, } +/// Portable managed-network facts needed by an operating-system sandbox. +#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct ManagedNetworkSandboxContext { + /// Loopback proxy ports that sandboxed commands may connect to. + #[serde(default)] + pub loopback_ports: Vec, + /// Whether the command may bind local sockets and exchange loopback traffic. + #[serde(default)] + pub allow_local_binding: bool, +} + +/// Environment-specific managed-network settings prepared for one command launch. +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct PreparedManagedNetwork { + /// Complete command environment with managed proxy variables applied. + pub env: HashMap, + /// Matching portable sandbox inputs for the command environment. + pub sandbox_context: ManagedNetworkSandboxContext, +} + struct EnvironmentProxy { addrs: EnvironmentProxyAddrs, http_task: JoinHandle>, @@ -653,22 +676,49 @@ impl NetworkProxy { }) } - fn apply_to_env_for_addrs( + fn prepare_for_addrs( &self, - env: &mut HashMap, + mut env: HashMap, addrs: EnvironmentProxyAddrs, - ) { + ) -> PreparedManagedNetwork { let runtime_settings = self.runtime_settings(); // Enforce proxying for child processes. Proxy endpoint values are always rewritten; // managed MITM CA vars preserve child-scoped overrides after proxy startup. apply_proxy_env_overrides( - env, + &mut env, addrs.http_addr, addrs.socks_addr, self.socks_enabled, runtime_settings.allow_local_binding, runtime_settings.mitm_ca_trust_bundle.as_ref(), ); + let mut loopback_ports = [ + Some(addrs.http_addr), + self.socks_enabled.then_some(addrs.socks_addr), + ] + .into_iter() + .flatten() + .filter(|addr| addr.ip().is_loopback()) + .map(|addr| addr.port()) + .collect::>(); + loopback_ports.sort_unstable(); + loopback_ports.dedup(); + PreparedManagedNetwork { + env, + sandbox_context: ManagedNetworkSandboxContext { + loopback_ports, + allow_local_binding: runtime_settings.allow_local_binding, + }, + } + } + + fn apply_to_env_for_addrs( + &self, + env: &mut HashMap, + addrs: EnvironmentProxyAddrs, + ) { + let prepared = self.prepare_for_addrs(std::mem::take(env), addrs); + *env = prepared.env; } pub fn apply_to_env(&self, env: &mut HashMap) { @@ -705,6 +755,23 @@ impl NetworkProxy { } } + /// Applies the environment-specific proxy settings and returns the matching portable sandbox + /// projection from the same runtime configuration snapshot. + pub fn prepare_for_optional_environment( + &self, + env: HashMap, + environment_id: Option<&str>, + ) -> Result { + let addrs = match environment_id { + Some(environment_id) => self.environment_proxy_addrs(environment_id)?, + None => EnvironmentProxyAddrs { + http_addr: self.http_addr, + socks_addr: self.socks_addr, + }, + }; + Ok(self.prepare_for_addrs(env, addrs)) + } + fn environment_proxy_addrs(&self, environment_id: &str) -> Result { let mut proxies = self .environment_proxies @@ -1071,27 +1138,59 @@ mod tests { } #[tokio::test] - async fn apply_to_env_for_environment_uses_distinct_proxy_ports() -> Result<()> { + async fn prepare_for_environment_keeps_env_and_sandbox_ports_in_sync() -> Result<()> { let state = Arc::new(network_proxy_state_for_policy( NetworkProxySettings::default(), )); let proxy = NetworkProxy::builder().state(state).build().await?; let handle = proxy.run().await?; - let mut local_env = HashMap::new(); - proxy.apply_to_env_for_environment(&mut local_env, "local")?; - let mut remote_env = HashMap::new(); - proxy.apply_to_env_for_environment(&mut remote_env, "remote")?; + let base_env = HashMap::from([("PRESERVED".to_string(), "value".to_string())]); + let local = proxy.prepare_for_optional_environment(base_env.clone(), Some("local"))?; + let remote = proxy.prepare_for_optional_environment(HashMap::new(), Some("remote"))?; - assert_ne!(local_env.get("HTTP_PROXY"), remote_env.get("HTTP_PROXY")); + assert_eq!( + local.env.get("PRESERVED").map(String::as_str), + Some("value") + ); + assert_ne!(local.env.get("HTTP_PROXY"), remote.env.get("HTTP_PROXY")); assert_ne!( - local_env.get("HTTP_PROXY"), + local.env.get("HTTP_PROXY"), Some(&format!("http://{}", proxy.http_addr())) ); assert_ne!( - remote_env.get("HTTP_PROXY"), + remote.env.get("HTTP_PROXY"), Some(&format!("http://{}", proxy.http_addr())) ); + for prepared in [&local, &remote] { + let http_port = prepared + .env + .get("HTTP_PROXY") + .and_then(|value| value.strip_prefix("http://")) + .and_then(|value| value.parse::().ok()) + .map(|addr| addr.port()) + .expect("managed HTTP proxy address"); + let socks_port = prepared + .env + .get("ALL_PROXY") + .and_then(|value| value.strip_prefix("socks5h://")) + .and_then(|value| value.parse::().ok()) + .map(|addr| addr.port()) + .expect("managed SOCKS proxy address"); + let mut expected_ports = vec![http_port, socks_port]; + expected_ports.sort_unstable(); + expected_ports.dedup(); + assert_eq!( + prepared.sandbox_context, + ManagedNetworkSandboxContext { + loopback_ports: expected_ports, + allow_local_binding: false, + } + ); + } + let mut legacy_env = base_env; + proxy.apply_to_env_for_environment(&mut legacy_env, "local")?; + assert_eq!(legacy_env, local.env); handle.shutdown().await?; Ok(()) diff --git a/codex-rs/otel/src/events/session_telemetry.rs b/codex-rs/otel/src/events/session_telemetry.rs index efff5c24e3..7e2700236b 100644 --- a/codex-rs/otel/src/events/session_telemetry.rs +++ b/codex-rs/otel/src/events/session_telemetry.rs @@ -94,6 +94,8 @@ pub struct SessionTelemetryMetadata { pub(crate) session_source: String, pub(crate) model: String, pub(crate) slug: String, + pub(crate) service_tier: Option, + pub(crate) model_reasoning_effort: Option, pub(crate) log_user_prompts: bool, pub(crate) app_version: &'static str, pub(crate) terminal_type: String, @@ -118,6 +120,16 @@ impl SessionTelemetry { self } + pub fn with_inference_request( + mut self, + service_tier: Option<&str>, + model_reasoning_effort: Option<&ReasoningEffort>, + ) -> Self { + self.metadata.service_tier = service_tier.map(str::to_owned); + self.metadata.model_reasoning_effort = model_reasoning_effort.map(ToString::to_string); + self + } + pub fn with_metrics_service_name(mut self, service_name: &str) -> Self { self.metadata.service_name = Some(sanitize_metric_tag_value(service_name)); self @@ -389,6 +401,8 @@ impl SessionTelemetry { session_source: session_source.to_string(), model: model.to_owned(), slug: slug.to_owned(), + service_tier: None, + model_reasoning_effort: None, log_user_prompts, app_version: env!("CARGO_PKG_VERSION"), terminal_type, @@ -896,6 +910,8 @@ impl SessionTelemetry { cached_token_count = cached_token_count, reasoning_token_count = reasoning_token_count, tool_token_count = %tool_token_count, + service_tier = self.metadata.service_tier.as_deref(), + model_reasoning_effort = self.metadata.model_reasoning_effort.as_deref(), }, log: {}, trace: {}, @@ -1182,6 +1198,7 @@ impl SessionTelemetry { fn responses_item_type(item: &ResponseItem) -> String { match item { + ResponseItem::AdditionalTools { .. } => "additional_tools".into(), ResponseItem::Message { role, .. } => format!("message_from_{role}"), ResponseItem::AgentMessage { .. } => "agent_message".into(), ResponseItem::Reasoning { .. } => "reasoning".into(), diff --git a/codex-rs/plugin/src/lib.rs b/codex-rs/plugin/src/lib.rs index 1a4eb23af1..8a00d8c5ef 100644 --- a/codex-rs/plugin/src/lib.rs +++ b/codex-rs/plugin/src/lib.rs @@ -70,9 +70,10 @@ pub struct PluginHookSource { #[derive(Debug, Clone, PartialEq, Eq)] pub struct PluginTelemetryMetadata { - pub plugin_id: PluginId, - /// Optional backend identifier for remote plugins, used when analytics - /// should report the remote id instead of the local plugin cache id. + /// Local plugin identifier used by Codex configuration and the plugin cache, + /// when it has been resolved. + pub plugin_id: Option, + /// Optional backend identifier for remote plugins. pub remote_plugin_id: Option, pub capability_summary: Option, } diff --git a/codex-rs/prompts/src/permissions_instructions.rs b/codex-rs/prompts/src/permissions_instructions.rs index a4a043f24f..090254705e 100644 --- a/codex-rs/prompts/src/permissions_instructions.rs +++ b/codex-rs/prompts/src/permissions_instructions.rs @@ -18,8 +18,6 @@ const APPROVAL_POLICY_NEVER: &str = include_str!("../templates/permissions/approval_policy/never.md"); const APPROVAL_POLICY_UNLESS_TRUSTED: &str = include_str!("../templates/permissions/approval_policy/unless_trusted.md"); -const APPROVAL_POLICY_ON_FAILURE: &str = - include_str!("../templates/permissions/approval_policy/on_failure.md"); const APPROVAL_POLICY_ON_REQUEST_RULE: &str = include_str!("../templates/permissions/approval_policy/on_request.md"); const APPROVAL_POLICY_ON_REQUEST_AUTO_REVIEW: &str = @@ -231,7 +229,6 @@ fn approval_text( AskForApproval::UnlessTrusted => { with_request_permissions_tool(APPROVAL_POLICY_UNLESS_TRUSTED) } - AskForApproval::OnFailure => with_request_permissions_tool(APPROVAL_POLICY_ON_FAILURE), AskForApproval::OnRequest => on_request_instructions(), AskForApproval::Granular(granular_config) => granular_instructions( granular_config, diff --git a/codex-rs/prompts/src/permissions_instructions_tests.rs b/codex-rs/prompts/src/permissions_instructions_tests.rs index 8564a7cf1e..8250aea57d 100644 --- a/codex-rs/prompts/src/permissions_instructions_tests.rs +++ b/codex-rs/prompts/src/permissions_instructions_tests.rs @@ -175,26 +175,6 @@ fn includes_request_permissions_tool_instructions_for_unless_trusted_when_enable assert!(text.contains("# request_permissions Tool")); } -#[test] -fn includes_request_permissions_tool_instructions_for_on_failure_when_enabled() { - let instructions = PermissionsInstructions::from_permissions_with_network( - SandboxMode::WorkspaceWrite, - NetworkAccess::Enabled, - PermissionsPromptConfig { - approval_policy: AskForApproval::OnFailure, - approvals_reviewer: ApprovalsReviewer::User, - exec_policy: &Policy::empty(), - exec_permission_approvals_enabled: false, - request_permissions_tool_enabled: true, - }, - /*writable_roots*/ None, - ); - - let text = instructions.body(); - assert!(text.contains("`approval_policy` is `on-failure`")); - assert!(text.contains("# request_permissions Tool")); -} - #[test] fn includes_request_permission_rule_instructions_for_on_request_when_enabled() { let instructions = PermissionsInstructions::from_permissions_with_network( diff --git a/codex-rs/prompts/templates/permissions/approval_policy/on_failure.md b/codex-rs/prompts/templates/permissions/approval_policy/on_failure.md deleted file mode 100644 index 7ee26dbd49..0000000000 --- a/codex-rs/prompts/templates/permissions/approval_policy/on_failure.md +++ /dev/null @@ -1 +0,0 @@ -Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `on-failure`: The harness will allow all commands to run in the sandbox (if enabled), and failures will be escalated to the user for approval to run again without the sandbox. diff --git a/codex-rs/protocol/src/models.rs b/codex-rs/protocol/src/models.rs index e107013a78..2faad87349 100644 --- a/codex-rs/protocol/src/models.rs +++ b/codex-rs/protocol/src/models.rs @@ -932,6 +932,14 @@ impl InternalChatMessageMetadataPassthrough { #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, JsonSchema, TS)] #[serde(tag = "type", rename_all = "snake_case")] pub enum ResponseItem { + #[schemars(skip)] + #[ts(skip)] + AdditionalTools { + #[serde(default, skip_serializing_if = "Option::is_none")] + id: Option, + role: String, + tools: Vec, + }, Message { #[serde(default, skip_serializing_if = "Option::is_none")] #[ts(optional)] @@ -1160,7 +1168,8 @@ impl ResponseItem { /// Returns the non-empty Responses API item ID, if present. pub fn id(&self) -> Option<&str> { match self { - Self::Message { id, .. } + Self::AdditionalTools { id, .. } + | Self::Message { id, .. } | Self::AgentMessage { id, .. } | Self::LocalShellCall { id, .. } | Self::FunctionCall { id, .. } @@ -1181,7 +1190,8 @@ impl ResponseItem { /// Sets or clears the Responses API item ID for variants that carry one. pub fn set_id(&mut self, new_id: Option) { match self { - Self::Message { id, .. } + Self::AdditionalTools { id, .. } + | Self::Message { id, .. } | Self::AgentMessage { id, .. } | Self::LocalShellCall { id, .. } | Self::FunctionCall { id, .. } @@ -1282,7 +1292,7 @@ impl ResponseItem { internal_chat_message_metadata_passthrough: metadata, .. } => metadata.as_ref(), - Self::CompactionTrigger { .. } | Self::Other => None, + Self::CompactionTrigger { .. } | Self::AdditionalTools { .. } | Self::Other => None, } } @@ -1346,7 +1356,7 @@ impl ResponseItem { internal_chat_message_metadata_passthrough: metadata, .. } => Some(metadata), - Self::CompactionTrigger { .. } | Self::Other => None, + Self::CompactionTrigger { .. } | Self::AdditionalTools { .. } | Self::Other => None, } } } @@ -2237,6 +2247,14 @@ mod tests { item.set_id(/*new_id*/ None); assert_eq!(item.id(), None); + + let mut additional_tools = ResponseItem::AdditionalTools { + id: None, + role: "developer".to_string(), + tools: Vec::new(), + }; + additional_tools.set_id(Some("at_test".to_string())); + assert_eq!(additional_tools.id(), Some("at_test")); } fn response_item_with_passthrough_metadata( diff --git a/codex-rs/protocol/src/prompts/base_instructions/default.md b/codex-rs/protocol/src/prompts/base_instructions/default.md index 4886c7ef44..907ff8b877 100644 --- a/codex-rs/protocol/src/prompts/base_instructions/default.md +++ b/codex-rs/protocol/src/prompts/base_instructions/default.md @@ -158,7 +158,7 @@ For all of testing, running, building, and formatting, do not attempt to fix unr Be mindful of whether to run validation commands proactively. In the absence of behavioral guidance: -- When running in non-interactive approval modes like **never** or **on-failure**, proactively run tests, lint and do whatever you need to ensure you've completed the task. +- When running in the non-interactive approval mode **never**, proactively run tests, lint and do whatever you need to ensure you've completed the task. - When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first. - When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task. diff --git a/codex-rs/protocol/src/protocol.rs b/codex-rs/protocol/src/protocol.rs index e1fe605462..6e93dc9120 100644 --- a/codex-rs/protocol/src/protocol.rs +++ b/codex-rs/protocol/src/protocol.rs @@ -10,6 +10,7 @@ use std::ops::Mul; use std::path::Path; use std::path::PathBuf; use std::str::FromStr; +use std::sync::Arc; use std::time::Duration; use strum_macros::EnumIter; @@ -869,15 +870,8 @@ pub enum AskForApproval { #[strum(serialize = "untrusted")] UnlessTrusted, - /// DEPRECATED: *All* commands are auto‑approved, but they are expected to - /// run inside a sandbox where network access is disabled and writes are - /// confined to a specific set of paths. If the command fails, it will be - /// escalated to the user to approve execution without a sandbox. - /// Prefer `OnRequest` for interactive runs or `Never` for non-interactive - /// runs. - OnFailure, - /// The model decides when to ask the user for approval. + #[serde(alias = "on-failure")] #[default] OnRequest, @@ -2460,7 +2454,7 @@ pub struct ConversationPathResponseEvent { #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)] pub struct ResumedHistory { pub conversation_id: ThreadId, - pub history: Vec, + pub history: Arc>, pub rollout_path: Option, } @@ -2505,11 +2499,11 @@ impl InitialHistory { } } - pub fn get_rollout_items(&self) -> Vec { + pub fn get_rollout_items(&self) -> &[RolloutItem] { match self { - InitialHistory::New | InitialHistory::Cleared => Vec::new(), - InitialHistory::Resumed(resumed) => resumed.history.clone(), - InitialHistory::Forked(items) => items.clone(), + InitialHistory::New | InitialHistory::Cleared => &[], + InitialHistory::Resumed(resumed) => &resumed.history, + InitialHistory::Forked(items) => items, } } @@ -5438,6 +5432,20 @@ mod tests { Ok(()) } + #[test] + fn turn_context_item_deserializes_legacy_on_failure_as_on_request() -> Result<()> { + let item: TurnContextItem = serde_json::from_value(json!({ + "cwd": test_path_buf("/tmp"), + "approval_policy": "on-failure", + "sandbox_policy": { "type": "danger-full-access" }, + "model": "gpt-5", + "summary": "auto", + }))?; + + assert_eq!(item.approval_policy, AskForApproval::OnRequest); + Ok(()) + } + #[test] fn multi_agent_version_uses_newest_present_session_meta_value() -> Result<()> { let thread_id = ThreadId::from_string("67e55044-10b1-426f-9247-bb680e5fe0c8")?; diff --git a/codex-rs/protocol/src/thread_id.rs b/codex-rs/protocol/src/thread_id.rs index d6e9a8825e..dcfedc7f52 100644 --- a/codex-rs/protocol/src/thread_id.rs +++ b/codex-rs/protocol/src/thread_id.rs @@ -10,6 +10,9 @@ use uuid::Uuid; #[derive(Debug, Clone, Copy, PartialEq, Eq, TS, Hash)] #[ts(type = "string")] +/// Identifier for a Codex thread. +/// +/// Codex-generated thread IDs are UUIDv7, and some use cases rely on that. pub struct ThreadId { pub(crate) uuid: Uuid, } diff --git a/codex-rs/rmcp-client/src/rmcp_client.rs b/codex-rs/rmcp-client/src/rmcp_client.rs index f5c7da5297..003f65cd93 100644 --- a/codex-rs/rmcp-client/src/rmcp_client.rs +++ b/codex-rs/rmcp-client/src/rmcp_client.rs @@ -455,7 +455,7 @@ impl RmcpClient { .peer() .peer_info() .ok_or_else(|| anyhow!("handshake succeeded but server info was missing"))?; - let initialize_result = initialize_result_rmcp.clone(); + let initialize_result = initialize_result_rmcp.as_ref().clone(); { let mut initialize_context = self.initialize_context.lock().await; diff --git a/codex-rs/rmcp-client/src/stdio_server_launcher.rs b/codex-rs/rmcp-client/src/stdio_server_launcher.rs index bc1a8924d5..7d03e1437e 100644 --- a/codex-rs/rmcp-client/src/stdio_server_launcher.rs +++ b/codex-rs/rmcp-client/src/stdio_server_launcher.rs @@ -509,6 +509,7 @@ impl ExecutorStdioServerLauncher { arg0: None, sandbox: None, enforce_managed_network: false, + managed_network: None, }) .await .map_err(io::Error::other)?; diff --git a/codex-rs/rollout-trace/src/reducer/conversation/normalize.rs b/codex-rs/rollout-trace/src/reducer/conversation/normalize.rs index e7a3253f6f..f97cc65f67 100644 --- a/codex-rs/rollout-trace/src/reducer/conversation/normalize.rs +++ b/codex-rs/rollout-trace/src/reducer/conversation/normalize.rs @@ -37,6 +37,9 @@ pub(super) fn normalize_model_items( ) -> Result> { let mut normalized_items = Vec::new(); for item in items { + if item.get("type").and_then(Value::as_str) == Some("additional_tools") { + continue; + } normalized_items.push(normalize_model_item(item, raw_payload)?); } Ok(normalized_items) diff --git a/codex-rs/rollout-trace/src/reducer/conversation_tests.rs b/codex-rs/rollout-trace/src/reducer/conversation_tests.rs index 1cf13b1fa8..18d38a4170 100644 --- a/codex-rs/rollout-trace/src/reducer/conversation_tests.rs +++ b/codex-rs/rollout-trace/src/reducer/conversation_tests.rs @@ -735,6 +735,48 @@ fn unsupported_model_item_is_reducer_error() -> anyhow::Result<()> { ) } +#[test] +fn additional_tools_are_excluded_from_request_conversation() -> anyhow::Result<()> { + let temp = TempDir::new()?; + let writer = create_started_writer(&temp)?; + start_turn(&writer, "turn-1")?; + + let request = writer.write_json_payload( + RawPayloadKind::InferenceRequest, + &json!({ + "input": [ + { + "type": "additional_tools", + "role": "developer", + "tools": [{ + "type": "function", + "name": "lookup", + "parameters": {"type": "object", "properties": {}} + }] + }, + message("user", "find it") + ] + }), + )?; + append_inference_start(&writer, "inference-1", "turn-1", request)?; + + let rollout = replay_bundle(temp.path())?; + let request_item_ids = &rollout.inference_calls["inference-1"].request_item_ids; + + assert_eq!(request_item_ids.len(), 1); + assert_eq!(rollout.conversation_items.len(), 1); + assert_eq!( + rollout.conversation_items[&request_item_ids[0]].body, + ConversationBody { + parts: vec![ConversationPart::Text { + text: "find it".to_string(), + }], + } + ); + + Ok(()) +} + #[test] fn missing_request_input_is_reducer_error() -> anyhow::Result<()> { let temp = TempDir::new()?; diff --git a/codex-rs/rollout/src/lib.rs b/codex-rs/rollout/src/lib.rs index 23be07996c..804b8ac101 100644 --- a/codex-rs/rollout/src/lib.rs +++ b/codex-rs/rollout/src/lib.rs @@ -8,6 +8,7 @@ pub(crate) mod compression; pub(crate) mod config; pub(crate) mod list; pub(crate) mod metadata; +mod persistence_metrics; pub(crate) mod policy; pub(crate) mod recorder; pub(crate) mod search; @@ -60,6 +61,9 @@ pub use list::read_session_meta_line; pub use list::read_thread_item_from_rollout; pub use list::rollout_date_parts; pub use metadata::builder_from_items; +pub use persistence_metrics::RolloutPersistenceBatchMeasurement; +pub use persistence_metrics::RolloutPersistenceTelemetry; +pub use persistence_metrics::measure_and_filter_rollout_items; pub use policy::is_persisted_rollout_item; pub use policy::persisted_rollout_items; pub use policy::should_persist_response_item_for_memories; diff --git a/codex-rs/rollout/src/persistence_metrics.rs b/codex-rs/rollout/src/persistence_metrics.rs new file mode 100644 index 0000000000..c851ea6245 --- /dev/null +++ b/codex-rs/rollout/src/persistence_metrics.rs @@ -0,0 +1,407 @@ +use std::io::Write; +use std::sync::Arc; +use std::sync::Mutex; + +use codex_otel::MetricsClient; +use codex_protocol::ThreadId; +use codex_protocol::items::TurnItem; +use codex_protocol::models::ResponseItem; +use codex_protocol::protocol::EventMsg; +use codex_protocol::protocol::RolloutItem; + +use crate::policy::is_persisted_rollout_item; + +const ITEM_BYTES_METRIC: &str = "codex.rollout.persistence.item_bytes"; +const APPEND_METRIC: &str = "codex.rollout.persistence.append"; +const TURN_BYTES_METRIC: &str = "codex.rollout.persistence.turn_bytes"; +const MEASUREMENT_ERROR_METRIC: &str = "codex.rollout.persistence.measurement_error"; +const SAMPLE_DENOMINATOR: u64 = 100; +const SAMPLE_RATE_LABEL: &str = "0.01"; + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub enum PersistenceDecision { + Kept, + Dropped, +} + +impl PersistenceDecision { + fn as_str(self) -> &'static str { + match self { + Self::Kept => "kept", + Self::Dropped => "dropped", + } + } +} + +#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)] +pub struct RolloutSizeTotals { + pub items: u64, + pub payload_bytes: u64, +} + +#[derive(Debug, Clone, PartialEq, Eq)] +pub struct RolloutItemMeasurement { + pub decision: PersistenceDecision, + pub rollout_item_type: String, + pub payload_bytes: Option, +} + +#[derive(Debug, Clone, Default, PartialEq, Eq)] +pub struct RolloutPersistenceBatchMeasurement { + pub pre_filter: RolloutSizeTotals, + pub post_filter: RolloutSizeTotals, + pub items: Vec, +} + +#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)] +struct TurnSizeTotals { + pre_filter: RolloutSizeTotals, + post_filter: RolloutSizeTotals, +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum TurnOutcome { + Completed, + Aborted, +} + +impl TurnOutcome { + fn as_str(self) -> &'static str { + match self { + Self::Completed => "completed", + Self::Aborted => "aborted", + } + } +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +struct CompletedTurnMeasurement { + totals: TurnSizeTotals, + outcome: TurnOutcome, +} + +#[derive(Debug, Default, PartialEq, Eq)] +struct TurnMeasurementState { + pending: TurnSizeTotals, + active: Option, +} + +#[derive(Debug, Default, PartialEq, Eq)] +struct TurnMeasurementUpdate { + completed: Vec, + boundary_errors: Vec<&'static str>, +} + +/// Measures logical JSON sizes while applying the shared rollout persistence policy once. +pub fn measure_and_filter_rollout_items( + items: &[RolloutItem], +) -> (Vec, RolloutPersistenceBatchMeasurement) { + let mut persisted = Vec::new(); + let mut measurement = RolloutPersistenceBatchMeasurement { + items: Vec::with_capacity(items.len()), + ..Default::default() + }; + + for item in items { + let kept = is_persisted_rollout_item(item); + let decision = if kept { + PersistenceDecision::Kept + } else { + PersistenceDecision::Dropped + }; + let payload_bytes = serialized_len(item).ok(); + add_to_totals(&mut measurement.pre_filter, payload_bytes); + if kept { + add_to_totals(&mut measurement.post_filter, payload_bytes); + persisted.push(item.clone()); + } + measurement.items.push(RolloutItemMeasurement { + decision, + rollout_item_type: rollout_item_type(item), + payload_bytes, + }); + } + + (persisted, measurement) +} + +fn add_to_totals(totals: &mut RolloutSizeTotals, payload_bytes: Option) { + totals.items = totals.items.saturating_add(1); + if let Some(payload_bytes) = payload_bytes { + totals.payload_bytes = totals.payload_bytes.saturating_add(payload_bytes); + } +} + +fn update_turn_measurements( + state: &mut TurnMeasurementState, + items: &[RolloutItem], + measurement: &RolloutPersistenceBatchMeasurement, +) -> TurnMeasurementUpdate { + let mut update = TurnMeasurementUpdate::default(); + for (item, item_measurement) in items.iter().zip(&measurement.items) { + match item { + RolloutItem::EventMsg(EventMsg::TurnStarted(_)) => { + if state.active.take().is_some() { + update.boundary_errors.push("event.turn_started"); + } + let mut totals = std::mem::take(&mut state.pending); + add_item_to_turn(&mut totals, item_measurement); + state.active = Some(totals); + } + RolloutItem::EventMsg(EventMsg::TurnComplete(_)) => { + finish_turn( + state, + item_measurement, + TurnOutcome::Completed, + "event.turn_complete", + &mut update, + ); + } + RolloutItem::EventMsg(EventMsg::TurnAborted(_)) => { + finish_turn( + state, + item_measurement, + TurnOutcome::Aborted, + "event.turn_aborted", + &mut update, + ); + } + _ => match state.active.as_mut() { + Some(totals) => add_item_to_turn(totals, item_measurement), + None => add_item_to_turn(&mut state.pending, item_measurement), + }, + } + } + update +} + +fn finish_turn( + state: &mut TurnMeasurementState, + item: &RolloutItemMeasurement, + outcome: TurnOutcome, + boundary_type: &'static str, + update: &mut TurnMeasurementUpdate, +) { + let Some(mut totals) = state.active.take() else { + state.pending = TurnSizeTotals::default(); + update.boundary_errors.push(boundary_type); + return; + }; + add_item_to_turn(&mut totals, item); + update + .completed + .push(CompletedTurnMeasurement { totals, outcome }); +} + +fn add_item_to_turn(totals: &mut TurnSizeTotals, item: &RolloutItemMeasurement) { + add_to_totals(&mut totals.pre_filter, item.payload_bytes); + if item.decision == PersistenceDecision::Kept { + add_to_totals(&mut totals.post_filter, item.payload_bytes); + } +} + +fn serialized_len(item: &RolloutItem) -> serde_json::Result { + let mut writer = CountingWriter::default(); + serde_json::to_writer(&mut writer, item)?; + Ok(writer.bytes) +} + +#[derive(Default)] +struct CountingWriter { + bytes: u64, +} + +impl Write for CountingWriter { + fn write(&mut self, buf: &[u8]) -> std::io::Result { + self.bytes = self.bytes.saturating_add(buf.len() as u64); + Ok(buf.len()) + } + + fn flush(&mut self) -> std::io::Result<()> { + Ok(()) + } +} + +fn rollout_item_type(item: &RolloutItem) -> String { + match item { + RolloutItem::SessionMeta(_) => "session_meta".to_string(), + RolloutItem::ResponseItem(item) => response_item_type(item).to_string(), + RolloutItem::InterAgentCommunication(_) => "inter_agent_communication".to_string(), + RolloutItem::Compacted(_) => "compacted".to_string(), + RolloutItem::TurnContext(_) => "turn_context".to_string(), + RolloutItem::EventMsg(EventMsg::ItemCompleted(event)) => { + format!("event.item_completed.{}", turn_item_type(&event.item)) + } + RolloutItem::EventMsg(event) => format!("event.{event}"), + } +} + +fn turn_item_type(item: &TurnItem) -> &'static str { + match item { + TurnItem::UserMessage(_) => "user_message", + TurnItem::HookPrompt(_) => "hook_prompt", + TurnItem::AgentMessage(_) => "agent_message", + TurnItem::Plan(_) => "plan", + TurnItem::Reasoning(_) => "reasoning", + TurnItem::WebSearch(_) => "web_search", + TurnItem::ImageView(_) => "image_view", + TurnItem::Sleep(_) => "sleep", + TurnItem::ImageGeneration(_) => "image_generation", + TurnItem::FileChange(_) => "file_change", + TurnItem::McpToolCall(_) => "mcp_tool_call", + TurnItem::ContextCompaction(_) => "context_compaction", + } +} + +fn response_item_type(item: &ResponseItem) -> &'static str { + match item { + ResponseItem::Message { .. } => "response.message", + ResponseItem::AdditionalTools { .. } => "response.additional_tools", + ResponseItem::AgentMessage { .. } => "response.agent_message", + ResponseItem::Reasoning { .. } => "response.reasoning", + ResponseItem::LocalShellCall { .. } => "response.local_shell_call", + ResponseItem::FunctionCall { .. } => "response.function_call", + ResponseItem::ToolSearchCall { .. } => "response.tool_search_call", + ResponseItem::FunctionCallOutput { .. } => "response.function_call_output", + ResponseItem::ToolSearchOutput { .. } => "response.tool_search_output", + ResponseItem::CustomToolCall { .. } => "response.custom_tool_call", + ResponseItem::CustomToolCallOutput { .. } => "response.custom_tool_call_output", + ResponseItem::WebSearchCall { .. } => "response.web_search_call", + ResponseItem::ImageGenerationCall { .. } => "response.image_generation_call", + ResponseItem::Compaction { .. } => "response.compaction", + ResponseItem::CompactionTrigger { .. } => "response.compaction_trigger", + ResponseItem::ContextCompaction { .. } => "response.context_compaction", + ResponseItem::Other => "response.other", + } +} + +#[derive(Clone)] +pub struct RolloutPersistenceTelemetry { + metrics: Option, + sampled: bool, + turn_state: Option>>, +} + +impl RolloutPersistenceTelemetry { + pub fn new(thread_id: ThreadId) -> Self { + let metrics = codex_otel::global(); + let sampled = metrics.is_some() && is_thread_sampled(thread_id); + Self { + metrics, + sampled, + turn_state: sampled.then(|| Arc::new(Mutex::new(TurnMeasurementState::default()))), + } + } + + pub fn is_enabled(&self) -> bool { + self.enabled_metrics().is_some() + } + + pub fn record_batch( + &self, + items: &[RolloutItem], + measurement: &RolloutPersistenceBatchMeasurement, + ) { + let Some(metrics) = self.enabled_metrics() else { + return; + }; + + for item in &measurement.items { + if let Some(payload_bytes) = item.payload_bytes { + let _ = metrics.histogram( + ITEM_BYTES_METRIC, + saturating_i64(payload_bytes), + &[ + ("decision", item.decision.as_str()), + ("rollout_item_type", item.rollout_item_type.as_str()), + ("encoding", "rollout_item_json_v1"), + ("sample_rate", SAMPLE_RATE_LABEL), + ], + ); + } else { + let _ = metrics.counter( + MEASUREMENT_ERROR_METRIC, + /*inc*/ 1, + &[ + ("rollout_item_type", item.rollout_item_type.as_str()), + ("phase", "serialize"), + ], + ); + } + } + // Count successful input appends and the subset that remain storage operations after the + // persistence policy removes filtered items. + let _ = metrics.counter( + APPEND_METRIC, + /*inc*/ 1, + &[("stage", "pre_filter"), ("sample_rate", SAMPLE_RATE_LABEL)], + ); + if measurement.post_filter.items > 0 { + let _ = metrics.counter( + APPEND_METRIC, + /*inc*/ 1, + &[("stage", "post_filter"), ("sample_rate", SAMPLE_RATE_LABEL)], + ); + } + + let Some(turn_state) = self.turn_state.as_ref() else { + return; + }; + let turn_update = update_turn_measurements( + &mut turn_state + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner), + items, + measurement, + ); + for boundary_type in turn_update.boundary_errors { + let _ = metrics.counter( + MEASUREMENT_ERROR_METRIC, + /*inc*/ 1, + &[ + ("rollout_item_type", boundary_type), + ("phase", "turn_boundary"), + ], + ); + } + for turn in turn_update.completed { + for (stage, totals) in [ + ("pre_filter", turn.totals.pre_filter), + ("post_filter", turn.totals.post_filter), + ] { + let _ = metrics.histogram( + TURN_BYTES_METRIC, + saturating_i64(totals.payload_bytes), + &[ + ("stage", stage), + ("outcome", turn.outcome.as_str()), + ("encoding", "rollout_item_json_v1"), + ("sample_rate", SAMPLE_RATE_LABEL), + ], + ); + } + } + } + + fn enabled_metrics(&self) -> Option<&MetricsClient> { + self.sampled.then_some(self.metrics.as_ref()).flatten() + } +} + +fn saturating_i64(value: u64) -> i64 { + value.try_into().unwrap_or(i64::MAX) +} + +fn is_thread_sampled(thread_id: ThreadId) -> bool { + let hash = thread_id + .to_string() + .bytes() + .fold(0xcbf29ce484222325_u64, |hash, byte| { + (hash ^ u64::from(byte)).wrapping_mul(0x100000001b3) + }); + hash % SAMPLE_DENOMINATOR == 0 +} + +#[cfg(test)] +#[path = "persistence_metrics_tests.rs"] +mod tests; diff --git a/codex-rs/rollout/src/persistence_metrics_tests.rs b/codex-rs/rollout/src/persistence_metrics_tests.rs new file mode 100644 index 0000000000..963805f43d --- /dev/null +++ b/codex-rs/rollout/src/persistence_metrics_tests.rs @@ -0,0 +1,260 @@ +use codex_protocol::ThreadId; +use codex_protocol::items::TurnItem; +use codex_protocol::items::UserMessageItem; +use codex_protocol::models::ContentItem; +use codex_protocol::models::ResponseItem; +use codex_protocol::protocol::EventMsg; +use codex_protocol::protocol::ItemCompletedEvent; +use codex_protocol::protocol::RolloutItem; +use codex_protocol::protocol::TurnAbortReason; +use codex_protocol::protocol::TurnAbortedEvent; +use codex_protocol::protocol::TurnCompleteEvent; +use codex_protocol::protocol::TurnStartedEvent; +use pretty_assertions::assert_eq; + +use super::CompletedTurnMeasurement; +use super::TurnMeasurementState; +use super::TurnOutcome; +use super::TurnSizeTotals; +use super::is_thread_sampled; +use super::measure_and_filter_rollout_items; +use super::update_turn_measurements; + +fn retained_message(text: &str) -> RolloutItem { + RolloutItem::ResponseItem(ResponseItem::Message { + id: None, + role: "user".to_string(), + content: vec![ContentItem::InputText { + text: text.to_string(), + }], + phase: None, + internal_chat_message_metadata_passthrough: None, + }) +} + +fn turn_started(turn_id: &str) -> RolloutItem { + RolloutItem::EventMsg(EventMsg::TurnStarted(TurnStartedEvent { + turn_id: turn_id.to_string(), + trace_id: None, + started_at: None, + model_context_window: None, + collaboration_mode_kind: Default::default(), + })) +} + +fn turn_complete(turn_id: &str) -> RolloutItem { + RolloutItem::EventMsg(EventMsg::TurnComplete(TurnCompleteEvent { + turn_id: turn_id.to_string(), + last_agent_message: None, + completed_at: None, + duration_ms: None, + time_to_first_token_ms: None, + })) +} + +fn turn_aborted(turn_id: &str) -> RolloutItem { + RolloutItem::EventMsg(EventMsg::TurnAborted(TurnAbortedEvent { + turn_id: Some(turn_id.to_string()), + reason: TurnAbortReason::Interrupted, + completed_at: None, + duration_ms: None, + })) +} + +fn update_for_batch( + state: &mut TurnMeasurementState, + items: &[RolloutItem], +) -> super::TurnMeasurementUpdate { + let (_, measurement) = measure_and_filter_rollout_items(items); + update_turn_measurements(state, items, &measurement) +} + +#[test] +fn thread_sampling_is_stable_and_selects_whole_threads() { + let mut sampled = None; + let mut unsampled = None; + for value in 0..10_000_u128 { + let thread_id = ThreadId::from_string(&format!("00000000-0000-0000-0000-{value:012x}")) + .expect("valid thread id"); + if is_thread_sampled(thread_id) { + sampled.get_or_insert(thread_id); + } else { + unsampled.get_or_insert(thread_id); + } + if sampled.is_some() && unsampled.is_some() { + break; + } + } + + let sampled = sampled.expect("at least one sampled thread"); + let unsampled = unsampled.expect("at least one unsampled thread"); + assert!(is_thread_sampled(sampled)); + assert!(is_thread_sampled(sampled)); + assert!(!is_thread_sampled(unsampled)); + assert!(!is_thread_sampled(unsampled)); +} + +#[test] +fn mixed_batch_reports_exact_policy_counts_and_bytes() { + let kept = retained_message("hello"); + let dropped = RolloutItem::ResponseItem(ResponseItem::Other); + let items = vec![kept.clone(), dropped.clone()]; + + let (persisted, measurement) = measure_and_filter_rollout_items(&items); + let kept_bytes = serde_json::to_vec(&kept) + .expect("serialize kept item") + .len() as u64; + let dropped_bytes = serde_json::to_vec(&dropped) + .expect("serialize dropped item") + .len() as u64; + + assert_eq!( + serde_json::to_value(persisted).expect("serialize persisted items"), + serde_json::to_value([kept]).expect("serialize expected items") + ); + assert_eq!(measurement.pre_filter.items, 2); + assert_eq!( + measurement.pre_filter.payload_bytes, + kept_bytes + dropped_bytes + ); + assert_eq!(measurement.post_filter.items, 1); + assert_eq!(measurement.post_filter.payload_bytes, kept_bytes); + assert_eq!(measurement.items[0].payload_bytes, Some(kept_bytes)); + assert_eq!(measurement.items[1].payload_bytes, Some(dropped_bytes)); + assert_eq!(measurement.items[0].rollout_item_type, "response.message"); + assert_eq!(measurement.items[1].rollout_item_type, "response.other"); +} + +#[test] +fn retained_items_are_byte_identical() { + let item = retained_message("a moderately sized payload"); + let (persisted, measurement) = measure_and_filter_rollout_items(std::slice::from_ref(&item)); + + assert_eq!( + serde_json::to_vec(&persisted[0]).expect("serialize persisted item"), + serde_json::to_vec(&item).expect("serialize candidate item") + ); + assert_eq!( + measurement.post_filter.payload_bytes, + measurement.items[0].payload_bytes.expect("payload bytes") + ); +} + +#[test] +fn turn_measurements_span_batches_and_include_items_before_start() { + let first_turn = vec![ + retained_message("first prompt"), + turn_started("turn-1"), + retained_message("first response"), + RolloutItem::ResponseItem(ResponseItem::Other), + turn_complete("turn-1"), + ]; + let second_turn = vec![ + retained_message("second prompt"), + turn_started("turn-2"), + retained_message("second response"), + turn_aborted("turn-2"), + ]; + let (_, first_expected) = measure_and_filter_rollout_items(&first_turn); + let (_, second_expected) = measure_and_filter_rollout_items(&second_turn); + let batches = [ + first_turn[..1].to_vec(), + first_turn[1..3].to_vec(), + vec![ + first_turn[3].clone(), + first_turn[4].clone(), + second_turn[0].clone(), + ], + second_turn[1..].to_vec(), + ]; + + let mut state = TurnMeasurementState::default(); + let mut completed = Vec::new(); + let mut boundary_errors = Vec::new(); + for batch in batches { + let update = update_for_batch(&mut state, &batch); + completed.extend(update.completed); + boundary_errors.extend(update.boundary_errors); + } + + assert_eq!( + completed, + vec![ + CompletedTurnMeasurement { + totals: TurnSizeTotals { + pre_filter: first_expected.pre_filter, + post_filter: first_expected.post_filter, + }, + outcome: TurnOutcome::Completed, + }, + CompletedTurnMeasurement { + totals: TurnSizeTotals { + pre_filter: second_expected.pre_filter, + post_filter: second_expected.post_filter, + }, + outcome: TurnOutcome::Aborted, + }, + ] + ); + assert_eq!(boundary_errors, Vec::<&str>::new()); + assert_eq!(state, TurnMeasurementState::default()); +} + +#[test] +fn invalid_turn_boundaries_reset_partial_measurements() { + let mut state = TurnMeasurementState::default(); + let unmatched_completion = vec![retained_message("orphan"), turn_complete("turn-1")]; + let update = update_for_batch(&mut state, &unmatched_completion); + + assert_eq!(update.completed, Vec::new()); + assert_eq!(update.boundary_errors, vec!["event.turn_complete"]); + assert_eq!(state, TurnMeasurementState::default()); + + let replacement = vec![ + turn_started("turn-1"), + retained_message("discarded partial turn"), + turn_started("turn-2"), + retained_message("retained turn"), + turn_complete("turn-2"), + ]; + let (_, expected) = measure_and_filter_rollout_items(&replacement[2..]); + let update = update_for_batch(&mut state, &replacement); + + assert_eq!( + update.completed, + vec![CompletedTurnMeasurement { + totals: TurnSizeTotals { + pre_filter: expected.pre_filter, + post_filter: expected.post_filter, + }, + outcome: TurnOutcome::Completed, + }] + ); + assert_eq!(update.boundary_errors, vec!["event.turn_started"]); + assert_eq!(state, TurnMeasurementState::default()); +} + +#[test] +fn filtered_item_completion_includes_its_nested_item_type() { + let item = RolloutItem::EventMsg(EventMsg::ItemCompleted(ItemCompletedEvent { + thread_id: ThreadId::default(), + turn_id: "turn".to_string(), + item: TurnItem::UserMessage(UserMessageItem { + id: "item".to_string(), + client_id: None, + content: Vec::new(), + }), + completed_at_ms: 0, + })); + + let (_, measurement) = measure_and_filter_rollout_items(&[item]); + + assert_eq!( + measurement.items[0].rollout_item_type, + "event.item_completed.user_message" + ); + assert_eq!( + measurement.items[0].decision, + super::PersistenceDecision::Dropped + ); +} diff --git a/codex-rs/rollout/src/policy.rs b/codex-rs/rollout/src/policy.rs index b342d699b7..4db26576b0 100644 --- a/codex-rs/rollout/src/policy.rs +++ b/codex-rs/rollout/src/policy.rs @@ -44,8 +44,9 @@ pub fn should_persist_response_item(item: &ResponseItem) -> bool { | ResponseItem::ImageGenerationCall { .. } | ResponseItem::Compaction { .. } | ResponseItem::ContextCompaction { .. } => true, - ResponseItem::CompactionTrigger { .. } => false, - ResponseItem::Other => false, + ResponseItem::AdditionalTools { .. } + | ResponseItem::CompactionTrigger { .. } + | ResponseItem::Other => false, } } @@ -62,7 +63,8 @@ pub fn should_persist_response_item_for_memories(item: &ResponseItem) -> bool { | ResponseItem::CustomToolCall { .. } | ResponseItem::CustomToolCallOutput { .. } | ResponseItem::WebSearchCall { .. } => true, - ResponseItem::AgentMessage { .. } + ResponseItem::AdditionalTools { .. } + | ResponseItem::AgentMessage { .. } | ResponseItem::Reasoning { .. } | ResponseItem::ImageGenerationCall { .. } | ResponseItem::Compaction { .. } diff --git a/codex-rs/rollout/src/recorder.rs b/codex-rs/rollout/src/recorder.rs index 084acb0d73..3229f5450a 100644 --- a/codex-rs/rollout/src/recorder.rs +++ b/codex-rs/rollout/src/recorder.rs @@ -947,7 +947,7 @@ impl RolloutRecorder { info!("Resumed rollout successfully from {path:?}"); Ok(InitialHistory::Resumed(ResumedHistory { conversation_id, - history: items, + history: Arc::new(items), rollout_path: Some(compression::plain_rollout_path(path)), })) } diff --git a/codex-rs/sandboxing/src/lib.rs b/codex-rs/sandboxing/src/lib.rs index 0688d0f920..c9109146bd 100644 --- a/codex-rs/sandboxing/src/lib.rs +++ b/codex-rs/sandboxing/src/lib.rs @@ -12,6 +12,7 @@ mod windows; pub use bwrap::find_system_bwrap_in_path; #[cfg(target_os = "linux")] pub use bwrap::system_bwrap_warning; +pub use codex_windows_sandbox::WindowsSandboxProxySettingsMode; pub use denial::is_likely_sandbox_denied; pub use manager::SandboxCommand; pub use manager::SandboxDirectSpawnTransformRequest; diff --git a/codex-rs/sandboxing/src/manager.rs b/codex-rs/sandboxing/src/manager.rs index 29b1177b11..51d2d6c98e 100644 --- a/codex-rs/sandboxing/src/manager.rs +++ b/codex-rs/sandboxing/src/manager.rs @@ -13,6 +13,7 @@ use crate::resolve_windows_elevated_filesystem_overrides; use crate::resolve_windows_restricted_token_filesystem_overrides; #[cfg(target_os = "windows")] use crate::windows_sandbox_uses_elevated_backend; +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_network_proxy::NetworkProxy; use codex_protocol::config_types::WindowsSandboxLevel; use codex_protocol::models::AdditionalPermissionProfile; @@ -99,6 +100,7 @@ pub struct SandboxCommand { pub args: Vec, pub cwd: PathUri, pub env: HashMap, + pub managed_network: Option, pub additional_permissions: Option, } @@ -150,6 +152,7 @@ pub struct SandboxTransformRequest<'a> { pub struct SandboxDirectSpawnTransformRequest<'a> { pub transform: SandboxTransformRequest<'a>, pub workspace_roots: &'a [AbsolutePathBuf], + pub windows_sandbox_proxy_settings_mode: codex_windows_sandbox::WindowsSandboxProxySettingsMode, } // TODO(anp): Revisit this preparation type once this module's PathUri migration is complete. @@ -332,6 +335,8 @@ impl SandboxManager { windows_sandbox_level, windows_sandbox_private_desktop, } = request; + #[cfg(target_os = "macos")] + let managed_network = command.managed_network.as_ref(); let additional_permissions = command.additional_permissions.take(); let managed_mitm_ca_trust_bundle_path = network.and_then(NetworkProxy::managed_mitm_ca_trust_bundle_path); @@ -364,6 +369,7 @@ impl SandboxManager { network_sandbox_policy: pending.effective_network_policy, sandbox_policy_cwd: pending.native_sandbox_policy_cwd.as_path(), enforce_managed_network, + managed_network, environment_id, network, extra_allow_unix_sockets: &[], @@ -479,12 +485,14 @@ impl SandboxManager { codex_home: &Path, ) -> Result { let workspace_roots = request.workspace_roots; + let proxy_settings_mode = request.windows_sandbox_proxy_settings_mode; let mut request = self.transform(request.transform)?; if request.sandbox == SandboxType::WindowsRestrictedToken { wrap_windows_sandbox_exec_request_for_direct_spawn( &mut request, workspace_roots, codex_home, + proxy_settings_mode, )?; } Ok(request) @@ -496,6 +504,7 @@ fn wrap_windows_sandbox_exec_request_for_direct_spawn( request: &mut SandboxExecRequest, workspace_roots: &[AbsolutePathBuf], codex_home: &Path, + proxy_settings_mode: codex_windows_sandbox::WindowsSandboxProxySettingsMode, ) -> Result<(), SandboxTransformError> { // TODO(anp): Keep PathUri through the Windows sandbox wrapper boundary. let native_cwd = @@ -567,6 +576,7 @@ fn wrap_windows_sandbox_exec_request_for_direct_spawn( request.windows_sandbox_level, request.windows_sandbox_private_desktop, proxy_enforced, + proxy_settings_mode, read_roots_override, read_roots_include_platform_defaults, write_roots_override, diff --git a/codex-rs/sandboxing/src/manager_tests.rs b/codex-rs/sandboxing/src/manager_tests.rs index 64fc87b6e4..c1a52182d7 100644 --- a/codex-rs/sandboxing/src/manager_tests.rs +++ b/codex-rs/sandboxing/src/manager_tests.rs @@ -92,6 +92,7 @@ fn unsandboxed_transform_preserves_foreign_cwd_and_unrestricted_file_system_poli args: Vec::new(), cwd: cwd_uri.clone(), env: HashMap::new(), + managed_network: None, additional_permissions: None, }, permissions: &permissions, @@ -139,6 +140,7 @@ fn transform_additional_permissions_enable_network_for_external_sandbox() { args: Vec::new(), cwd: cwd_uri.clone(), env: HashMap::new(), + managed_network: None, additional_permissions: Some(AdditionalPermissionProfile { network: Some(NetworkPermissions { enabled: Some(true), @@ -211,6 +213,7 @@ fn transform_additional_permissions_preserves_denied_entries() { args: Vec::new(), cwd: cwd_uri.clone(), env: HashMap::new(), + managed_network: None, additional_permissions: Some(AdditionalPermissionProfile { file_system: Some(FileSystemPermissions::from_read_write_roots( /*read*/ None, @@ -314,6 +317,7 @@ fn transform_linux_seccomp_request( args: Vec::new(), cwd: cwd_uri.clone(), env: HashMap::new(), + managed_network: None, additional_permissions: None, }, permissions: &permissions, @@ -495,6 +499,8 @@ fn transform_for_direct_spawn_windows_materializes_inner_helper() { .transform_for_direct_spawn_with_codex_home( SandboxDirectSpawnTransformRequest { workspace_roots: workspace_roots.as_slice(), + windows_sandbox_proxy_settings_mode: + codex_windows_sandbox::WindowsSandboxProxySettingsMode::Preserve, transform: SandboxTransformRequest { command: SandboxCommand { program: configured_helper.as_os_str().to_owned(), @@ -504,6 +510,7 @@ fn transform_for_direct_spawn_windows_materializes_inner_helper() { "Path".to_string(), r"C:\Windows\System32".to_string(), )]), + managed_network: None, additional_permissions: None, }, permissions: &permissions, @@ -539,6 +546,12 @@ fn transform_for_direct_spawn_windows_materializes_inner_helper() { .iter() .any(|arg| arg == "--run-as-windows-sandbox") ); + assert!( + exec_request + .command + .iter() + .any(|arg| arg == "--preserve-proxy-settings") + ); assert!( exec_request .command diff --git a/codex-rs/sandboxing/src/seatbelt.rs b/codex-rs/sandboxing/src/seatbelt.rs index d3233e705b..f53569de07 100644 --- a/codex-rs/sandboxing/src/seatbelt.rs +++ b/codex-rs/sandboxing/src/seatbelt.rs @@ -1,3 +1,4 @@ +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_network_proxy::NetworkProxy; use codex_network_proxy::PROXY_URL_ENV_KEYS; use codex_network_proxy::has_proxy_url_env_vars; @@ -103,6 +104,7 @@ struct UnixSocketPathParam { } fn proxy_policy_inputs( + managed_network: Option<&ManagedNetworkSandboxContext>, network: Option<&NetworkProxy>, environment_id: Option<&str>, extra_allow_unix_sockets: &[AbsolutePathBuf], @@ -112,33 +114,47 @@ fn proxy_policy_inputs( .filter_map(|socket_path| normalize_path_for_sandbox(socket_path.as_path())) .collect::>(); + let unix_domain_socket_policy = match network { + Some(network) if network.dangerously_allow_all_unix_sockets() => { + UnixDomainSocketPolicy::AllowAll + } + Some(network) => { + let mut allowed = network + .allow_unix_sockets() + .iter() + .filter_map(|socket_path| { + match normalize_path_for_sandbox(Path::new(socket_path)) { + Some(path) => Some(path), + None => { + warn!( + "ignoring network.allow_unix_sockets entry because it could not be normalized: {socket_path}" + ); + None + } + } + }) + .collect::>(); + allowed.extend(extra_allowed); + UnixDomainSocketPolicy::Restricted { allowed } + } + None => UnixDomainSocketPolicy::Restricted { + allowed: extra_allowed, + }, + }; + if let Some(managed_network) = managed_network { + return Ok(ProxyPolicyInputs { + ports: managed_network.loopback_ports.clone(), + has_proxy_config: true, + allow_local_binding: managed_network.allow_local_binding, + unix_domain_socket_policy, + }); + } match network { Some(network) => { let mut env = HashMap::new(); network .apply_to_env_for_optional_environment(&mut env, environment_id) .map_err(|err| err.to_string())?; - let unix_domain_socket_policy = if network.dangerously_allow_all_unix_sockets() { - UnixDomainSocketPolicy::AllowAll - } else { - let mut allowed = network - .allow_unix_sockets() - .iter() - .filter_map(|socket_path| { - match normalize_path_for_sandbox(Path::new(socket_path)) { - Some(path) => Some(path), - None => { - warn!( - "ignoring network.allow_unix_sockets entry because it could not be normalized: {socket_path}" - ); - None - } - } - }) - .collect::>(); - allowed.extend(extra_allowed); - UnixDomainSocketPolicy::Restricted { allowed } - }; Ok(ProxyPolicyInputs { ports: proxy_loopback_ports_from_env(&env), has_proxy_config: has_proxy_url_env_vars(&env), @@ -147,9 +163,7 @@ fn proxy_policy_inputs( }) } None => Ok(ProxyPolicyInputs { - unix_domain_socket_policy: UnixDomainSocketPolicy::Restricted { - allowed: extra_allowed, - }, + unix_domain_socket_policy, ..Default::default() }), } @@ -586,6 +600,7 @@ fn create_seatbelt_command_args_for_legacy_policy( network_sandbox_policy: NetworkSandboxPolicy::from(sandbox_policy), sandbox_policy_cwd, enforce_managed_network, + managed_network: None, environment_id: None, network, extra_allow_unix_sockets: &[], @@ -599,6 +614,7 @@ pub struct CreateSeatbeltCommandArgsParams<'a> { pub network_sandbox_policy: NetworkSandboxPolicy, pub sandbox_policy_cwd: &'a Path, pub enforce_managed_network: bool, + pub managed_network: Option<&'a ManagedNetworkSandboxContext>, pub environment_id: Option<&'a str>, pub network: Option<&'a NetworkProxy>, pub extra_allow_unix_sockets: &'a [AbsolutePathBuf], @@ -613,6 +629,7 @@ pub fn create_seatbelt_command_args( network_sandbox_policy, sandbox_policy_cwd, enforce_managed_network, + managed_network, environment_id, network, extra_allow_unix_sockets, @@ -709,7 +726,12 @@ pub fn create_seatbelt_command_args( } }; - let proxy = proxy_policy_inputs(network, environment_id, extra_allow_unix_sockets)?; + let proxy = proxy_policy_inputs( + managed_network, + network, + environment_id, + extra_allow_unix_sockets, + )?; let network_policy = dynamic_network_policy_for_network(network_sandbox_policy, enforce_managed_network, &proxy); diff --git a/codex-rs/sandboxing/src/seatbelt_tests.rs b/codex-rs/sandboxing/src/seatbelt_tests.rs index e0ff0e6652..b15019a8cb 100644 --- a/codex-rs/sandboxing/src/seatbelt_tests.rs +++ b/codex-rs/sandboxing/src/seatbelt_tests.rs @@ -14,6 +14,7 @@ use super::unix_socket_policy; use codex_network_proxy::ConfigReloader; use codex_network_proxy::ConfigReloaderFuture; use codex_network_proxy::ConfigState; +use codex_network_proxy::ManagedNetworkSandboxContext; use codex_network_proxy::NetworkMode; use codex_network_proxy::NetworkProxy; use codex_network_proxy::NetworkProxyConfig; @@ -205,6 +206,7 @@ fn explicit_unreadable_paths_are_excluded_from_full_disk_read_and_write_access() network_sandbox_policy: NetworkSandboxPolicy::Restricted, sandbox_policy_cwd: Path::new("/"), enforce_managed_network: false, + managed_network: None, environment_id: None, network: None, extra_allow_unix_sockets: &[], @@ -258,6 +260,37 @@ fn explicit_unreadable_paths_are_excluded_from_full_disk_read_and_write_access() ); } +#[test] +fn prepared_managed_network_context_allows_only_its_proxy_ports() { + let file_system_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd( + &SandboxPolicy::new_read_only_policy(), + Path::new("/"), + ); + let managed_network = ManagedNetworkSandboxContext { + loopback_ports: vec![43123, 48081], + allow_local_binding: false, + }; + let args = create_seatbelt_command_args(CreateSeatbeltCommandArgsParams { + command: vec!["/bin/true".to_string()], + file_system_sandbox_policy: &file_system_policy, + network_sandbox_policy: NetworkSandboxPolicy::Restricted, + sandbox_policy_cwd: Path::new("/"), + enforce_managed_network: true, + managed_network: Some(&managed_network), + environment_id: None, + network: None, + extra_allow_unix_sockets: &[], + }) + .unwrap(); + + let policy = seatbelt_policy_arg(&args); + assert!(policy.contains("(allow network-outbound (remote ip \"localhost:43123\"))")); + assert!(policy.contains("(allow network-outbound (remote ip \"localhost:48081\"))")); + assert!(!policy.contains("(allow network-outbound (remote ip \"localhost:9999\"))")); + assert!(!policy.contains("(allow network-bind (local ip \"*:*\"))")); + assert!(!policy.contains("(allow network-outbound)\n")); +} + #[test] fn explicit_unreadable_paths_are_excluded_from_readable_roots() { let root = absolute_path("/tmp/codex-readable"); @@ -279,6 +312,7 @@ fn explicit_unreadable_paths_are_excluded_from_readable_roots() { network_sandbox_policy: NetworkSandboxPolicy::Restricted, sandbox_policy_cwd: Path::new("/"), enforce_managed_network: false, + managed_network: None, environment_id: None, network: None, extra_allow_unix_sockets: &[], @@ -585,6 +619,7 @@ fn create_seatbelt_args_allowlists_explicit_unix_socket_paths_without_proxy() { network_sandbox_policy: NetworkSandboxPolicy::Restricted, sandbox_policy_cwd: cwd.path(), enforce_managed_network: false, + managed_network: None, environment_id: None, network: None, extra_allow_unix_sockets: &extra_allow_unix_sockets, @@ -645,6 +680,7 @@ async fn create_seatbelt_args_merges_proxy_and_explicit_unix_socket_paths() -> a network_sandbox_policy: NetworkSandboxPolicy::Restricted, sandbox_policy_cwd: cwd.path(), enforce_managed_network: false, + managed_network: None, environment_id: None, network: Some(&network_proxy), extra_allow_unix_sockets: &extra_allow_unix_sockets, @@ -688,6 +724,7 @@ fn create_seatbelt_args_preserves_full_network_with_explicit_unix_socket_paths() network_sandbox_policy: NetworkSandboxPolicy::Enabled, sandbox_policy_cwd: cwd.path(), enforce_managed_network: false, + managed_network: None, environment_id: None, network: None, extra_allow_unix_sockets: &extra_allow_unix_sockets, diff --git a/codex-rs/state/src/log_db.rs b/codex-rs/state/src/log_db.rs index 55de2a3077..2cf0f5d9af 100644 --- a/codex-rs/state/src/log_db.rs +++ b/codex-rs/state/src/log_db.rs @@ -199,6 +199,13 @@ where fn on_event(&self, event: &Event<'_>, ctx: tracing_subscriber::layer::Context<'_, S>) { let metadata = event.metadata(); + // `tracing-log` checks filters with the original log target before + // dispatching an event whose tracing target is `log`, so the outer + // target filter cannot reliably reject these bridged events. + if metadata.target() == "log" { + return; + } + // The SDK emits DEBUG timer meta-events every second per process; these // were over 30% of retained logs in measured high-fanout Codex environments. if metadata.target() == "opentelemetry_sdk" diff --git a/codex-rs/thread-store/Cargo.toml b/codex-rs/thread-store/Cargo.toml index 7c59cf72f3..35b3919c60 100644 --- a/codex-rs/thread-store/Cargo.toml +++ b/codex-rs/thread-store/Cargo.toml @@ -16,6 +16,7 @@ workspace = true chrono = { workspace = true, features = ["serde"] } codex-git-utils = { workspace = true } codex-install-context = { workspace = true } +codex-otel = { workspace = true } codex-protocol = { workspace = true } codex-rollout = { workspace = true } codex-state = { workspace = true } diff --git a/codex-rs/thread-store/src/in_memory.rs b/codex-rs/thread-store/src/in_memory.rs index a93e3644c0..84e0484f78 100644 --- a/codex-rs/thread-store/src/in_memory.rs +++ b/codex-rs/thread-store/src/in_memory.rs @@ -266,7 +266,9 @@ impl InMemoryThreadStore { let mut state = self.state.lock().await; state.calls.resume_thread += 1; if let Some(history) = params.history { - state.histories.insert(params.thread_id, history); + state + .histories + .insert(params.thread_id, Arc::unwrap_or_clone(history)); } else { state.histories.entry(params.thread_id).or_default(); } diff --git a/codex-rs/thread-store/src/live_thread.rs b/codex-rs/thread-store/src/live_thread.rs index 6b94807511..793bbf9965 100644 --- a/codex-rs/thread-store/src/live_thread.rs +++ b/codex-rs/thread-store/src/live_thread.rs @@ -4,6 +4,8 @@ use std::sync::Arc; use codex_protocol::ThreadId; use codex_protocol::protocol::RolloutItem; use codex_protocol::protocol::ThreadMemoryMode; +use codex_rollout::RolloutPersistenceTelemetry; +use codex_rollout::measure_and_filter_rollout_items; use codex_rollout::persisted_rollout_items; use tokio::sync::Mutex; use tracing::warn; @@ -32,6 +34,7 @@ pub struct LiveThread { thread_id: ThreadId, thread_store: Arc, metadata_sync: Arc>, + persistence_telemetry: RolloutPersistenceTelemetry, } /// Owns a live thread while session initialization is still fallible. @@ -95,17 +98,19 @@ impl LiveThread { thread_id, thread_store, metadata_sync: Arc::new(Mutex::new(metadata_sync)), + persistence_telemetry: RolloutPersistenceTelemetry::new(thread_id), }) } pub async fn resume( thread_store: Arc, - mut params: ResumeThreadParams, + params: ResumeThreadParams, ) -> ThreadStoreResult { let thread_id = params.thread_id; let should_load_history = params.history.is_none(); let include_archived = params.include_archived; - thread_store.resume_thread(params.clone()).await?; + let mut metadata_sync = ThreadMetadataSync::for_resume(¶ms); + thread_store.resume_thread(params).await?; if should_load_history { match thread_store .load_history(LoadThreadHistoryParams { @@ -114,7 +119,7 @@ impl LiveThread { }) .await { - Ok(history) => params.history = Some(history.items), + Ok(history) => metadata_sync.record_resume_history(&history.items), Err(err) => { if let Err(discard_err) = thread_store.discard_thread(thread_id).await { warn!( @@ -125,11 +130,11 @@ impl LiveThread { } } } - let metadata_sync = ThreadMetadataSync::for_resume(¶ms); Ok(Self { thread_id, thread_store, metadata_sync: Arc::new(Mutex::new(metadata_sync)), + persistence_telemetry: RolloutPersistenceTelemetry::new(thread_id), }) } @@ -139,16 +144,25 @@ impl LiveThread { fields(item_count = items.len()) )] pub async fn append_items(&self, items: &[RolloutItem]) -> ThreadStoreResult<()> { - let canonical_items = persisted_rollout_items(items); + // Empty appends are intentionally ignored rather than represented as zero-sized batches. if items.is_empty() { return Ok(()); } + let (canonical_items, measurement) = if self.persistence_telemetry.is_enabled() { + let (canonical_items, measurement) = measure_and_filter_rollout_items(items); + (canonical_items, Some(measurement)) + } else { + (persisted_rollout_items(items), None) + }; self.thread_store .append_items(AppendThreadItemsParams { thread_id: self.thread_id, items: items.to_vec(), }) .await?; + if let Some(measurement) = measurement.as_ref() { + self.persistence_telemetry.record_batch(items, measurement); + } if canonical_items.is_empty() { return Ok(()); } diff --git a/codex-rs/thread-store/src/local/live_writer.rs b/codex-rs/thread-store/src/local/live_writer.rs index 24c31869f1..3e7541b36b 100644 --- a/codex-rs/thread-store/src/local/live_writer.rs +++ b/codex-rs/thread-store/src/local/live_writer.rs @@ -17,6 +17,8 @@ use crate::ResumeThreadParams; use crate::ThreadStoreError; use crate::ThreadStoreResult; +const ROLLOUT_SIZE_BYTES_METRIC: &str = "codex.rollout.size_bytes"; + pub(super) async fn create_thread( store: &LocalThreadStore, params: CreateThreadParams, @@ -128,8 +130,15 @@ pub(super) async fn shutdown_thread( thread_id: ThreadId, ) -> ThreadStoreResult<()> { let recorder = store.live_recorder(thread_id).await?; + let rollout_path = recorder.rollout_path().to_path_buf(); recorder.shutdown().await.map_err(thread_store_io_error)?; sync_materialized_rollout_path(store, thread_id).await?; + if let Some(metrics) = codex_otel::global() + && let Ok(metadata) = tokio::fs::metadata(rollout_path).await + { + let size_bytes = i64::try_from(metadata.len()).unwrap_or(i64::MAX); + let _ = metrics.histogram(ROLLOUT_SIZE_BYTES_METRIC, size_bytes, &[]); + } store.live_recorders.lock().await.remove(&thread_id); Ok(()) } diff --git a/codex-rs/thread-store/src/thread_metadata_sync.rs b/codex-rs/thread-store/src/thread_metadata_sync.rs index 7940f1c80f..852f679126 100644 --- a/codex-rs/thread-store/src/thread_metadata_sync.rs +++ b/codex-rs/thread-store/src/thread_metadata_sync.rs @@ -1,3 +1,5 @@ +#[cfg(test)] +use std::sync::Arc; use std::time::Duration; use std::time::Instant; @@ -108,13 +110,17 @@ impl ThreadMetadataSync { defer_resume_update_until_append: false, }; if let Some(history) = params.history.as_deref() { - let update = sync.observe_resume_history(history); - sync.merge_pending_update(update); - sync.defer_resume_update_until_append = sync.pending_update.is_some(); + sync.record_resume_history(history); } sync } + pub(crate) fn record_resume_history(&mut self, history: &[RolloutItem]) { + let update = self.observe_resume_history(history); + self.merge_pending_update(update); + self.defer_resume_update_until_append = self.pending_update.is_some(); + } + pub(crate) fn take_pending_update(&self) -> Option { self.pending_update .clone() @@ -555,7 +561,7 @@ mod tests { ResumeThreadParams { thread_id, rollout_path: None, - history: Some(history), + history: Some(Arc::new(history)), include_archived: false, metadata: ThreadPersistenceMetadata { cwd: None, diff --git a/codex-rs/thread-store/src/types.rs b/codex-rs/thread-store/src/types.rs index 74412bb9cd..2a82e42511 100644 --- a/codex-rs/thread-store/src/types.rs +++ b/codex-rs/thread-store/src/types.rs @@ -1,4 +1,5 @@ use std::path::PathBuf; +use std::sync::Arc; use chrono::DateTime; use chrono::Utc; @@ -96,7 +97,7 @@ pub struct ResumeThreadParams { /// Known local rollout path when the caller resumed from a specific file. pub rollout_path: Option, /// Known replay history for the resumed thread, if already loaded by the caller. - pub history: Option>, + pub history: Option>>, /// Whether archived threads may be reopened. pub include_archived: bool, /// Metadata for future writes appended to the resumed live thread. diff --git a/codex-rs/tui/src/app/loaded_threads.rs b/codex-rs/tui/src/app/loaded_threads.rs index 6bd260c0b6..8e790170e6 100644 --- a/codex-rs/tui/src/app/loaded_threads.rs +++ b/codex-rs/tui/src/app/loaded_threads.rs @@ -128,6 +128,7 @@ mod tests { fn test_thread(thread_id: ThreadId, source: SessionSource) -> Thread { Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/tui/src/app/tests.rs b/codex-rs/tui/src/app/tests.rs index 6c55accab6..21aca66bcd 100644 --- a/codex-rs/tui/src/app/tests.rs +++ b/codex-rs/tui/src/app/tests.rs @@ -2874,6 +2874,7 @@ async fn inactive_thread_started_notification_initializes_replay_session() -> Re ServerNotification::ThreadStarted(ThreadStartedNotification { thread: Thread { id: agent_thread_id.to_string(), + extra: None, session_id: agent_thread_id.to_string(), forked_from_id: None, parent_thread_id: None, @@ -2967,6 +2968,7 @@ async fn inactive_thread_started_notification_preserves_primary_model_when_path_ ServerNotification::ThreadStarted(ThreadStartedNotification { thread: Thread { id: agent_thread_id.to_string(), + extra: None, session_id: agent_thread_id.to_string(), forked_from_id: None, parent_thread_id: None, @@ -3027,6 +3029,7 @@ async fn thread_read_session_state_does_not_reuse_primary_permission_profile() { let thread = Thread { id: read_thread_id.to_string(), + extra: None, session_id: read_thread_id.to_string(), forked_from_id: None, parent_thread_id: None, @@ -5640,6 +5643,7 @@ async fn thread_rollback_response_discards_queued_active_thread_events() { &ThreadRollbackResponse { thread: Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/tui/src/app/thread_session_state.rs b/codex-rs/tui/src/app/thread_session_state.rs index ceafb71db9..58412bff08 100644 --- a/codex-rs/tui/src/app/thread_session_state.rs +++ b/codex-rs/tui/src/app/thread_session_state.rs @@ -409,6 +409,7 @@ mod tests { }; let read_thread = Thread { id: read_thread_id.to_string(), + extra: None, session_id: read_thread_id.to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/tui/src/app_server_session.rs b/codex-rs/tui/src/app_server_session.rs index 527cde57ed..7181d1a560 100644 --- a/codex-rs/tui/src/app_server_session.rs +++ b/codex-rs/tui/src/app_server_session.rs @@ -2320,6 +2320,7 @@ mod tests { let response = ThreadResumeResponse { thread: codex_app_server_protocol::Thread { id: thread_id.to_string(), + extra: None, session_id: ThreadId::new().to_string(), forked_from_id: Some(forked_from_id.to_string()), parent_thread_id: None, diff --git a/codex-rs/tui/src/resume_picker.rs b/codex-rs/tui/src/resume_picker.rs index 08191eaf2b..888cc5b27a 100644 --- a/codex-rs/tui/src/resume_picker.rs +++ b/codex-rs/tui/src/resume_picker.rs @@ -5720,6 +5720,7 @@ session_picker_view = "dense" let thread_id = ThreadId::new(); let thread = Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, @@ -5756,6 +5757,7 @@ session_picker_view = "dense" let thread_id = ThreadId::new(); let thread = Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, @@ -5826,6 +5828,7 @@ session_picker_view = "dense" let thread_id = ThreadId::new(); let thread = Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, @@ -5885,6 +5888,7 @@ session_picker_view = "dense" let thread_id = ThreadId::new(); let thread = Thread { id: thread_id.to_string(), + extra: None, session_id: thread_id.to_string(), forked_from_id: None, parent_thread_id: None, diff --git a/codex-rs/utils/cli/src/approval_mode_cli_arg.rs b/codex-rs/utils/cli/src/approval_mode_cli_arg.rs index ee4ecabcb6..255ff6ea59 100644 --- a/codex-rs/utils/cli/src/approval_mode_cli_arg.rs +++ b/codex-rs/utils/cli/src/approval_mode_cli_arg.rs @@ -12,12 +12,6 @@ pub enum ApprovalModeCliArg { /// is not in the "trusted" set. Untrusted, - /// DEPRECATED: Run all commands without asking for user approval. - /// Only asks for approval if a command fails to execute, in which case it - /// will escalate to the user to ask for un-sandboxed execution. - /// Prefer `on-request` for interactive runs or `never` for non-interactive runs. - OnFailure, - /// The model decides when to ask the user for approval. OnRequest, @@ -30,7 +24,6 @@ impl From for AskForApproval { fn from(value: ApprovalModeCliArg) -> Self { match value { ApprovalModeCliArg::Untrusted => AskForApproval::UnlessTrusted, - ApprovalModeCliArg::OnFailure => AskForApproval::OnFailure, ApprovalModeCliArg::OnRequest => AskForApproval::OnRequest, ApprovalModeCliArg::Never => AskForApproval::Never, } diff --git a/codex-rs/utils/path-uri/src/lib.rs b/codex-rs/utils/path-uri/src/lib.rs index 6c92c5e1df..9794e7c709 100644 --- a/codex-rs/utils/path-uri/src/lib.rs +++ b/codex-rs/utils/path-uri/src/lib.rs @@ -247,6 +247,33 @@ impl PathUri { std::iter::successors(Some(self.clone()), Self::parent) } + /// Returns true when this URI is lexically equal to or below `base`. + /// + /// Containment is computed using URI authority and path-segment boundaries, + /// without consulting the host filesystem. Percent-encoded path separators + /// fail closed because native path conversion may interpret them as segment + /// boundaries. Opaque fallback URIs created by [`Self::from_abs_path`] only + /// contain themselves. + pub fn starts_with(&self, base: &Self) -> bool { + if self == base { + return true; + } + if decode_bad_path_uri(&self.0).is_some() || decode_bad_path_uri(&base.0).is_some() { + return false; + } + if self.0.host_str() != base.0.host_str() { + return false; + } + + let Some(path_segments) = containment_path_segments(&self.0) else { + return false; + }; + let Some(base_segments) = containment_path_segments(&base.0) else { + return false; + }; + path_segments.starts_with(&base_segments) + } + /// Lexically resolves native absolute or relative path text against this URI. /// /// Path text is interpreted using the POSIX or Windows convention inferred @@ -542,6 +569,19 @@ fn is_windows_drive_uri_segment(segment: &str) -> bool { matches!(segment.as_bytes(), [drive, b':'] if drive.is_ascii_alphabetic()) } +fn containment_path_segments(url: &Url) -> Option> { + let segments = url + .path_segments()? + .filter(|segment| !segment.is_empty()) + .collect::>(); + (!segments.iter().any(|segment| { + urlencoding::decode_binary(segment.as_bytes()) + .iter() + .any(|byte| matches!(*byte, b'/' | b'\\')) + })) + .then_some(segments) +} + fn infer_opaque_path_convention(path_bytes: &[u8]) -> Option { if path_bytes.starts_with(b"/") { return Some(PathConvention::Posix); diff --git a/codex-rs/utils/path-uri/src/tests.rs b/codex-rs/utils/path-uri/src/tests.rs index 0e45baaa12..c52c3f9e6a 100644 --- a/codex-rs/utils/path-uri/src/tests.rs +++ b/codex-rs/utils/path-uri/src/tests.rs @@ -283,9 +283,16 @@ fn structurally_valid_bad_path_uri_with_invalid_native_payload_fails_conversion( fn bad_path_uris_are_opaque_to_lexical_operations() { let uri = PathUri::parse("file:///%00/bad/path/YQ") .expect("canonical base64 fallback URI should parse"); + let other = PathUri::parse("file:///%00/bad/path/Yg") + .expect("canonical base64 fallback URI should parse"); + let root = PathUri::parse("file:///").expect("valid root URI"); assert_eq!(uri.basename(), None); assert_eq!(uri.parent(), None); + assert!(uri.starts_with(&uri)); + assert!(!uri.starts_with(&root)); + assert!(!uri.starts_with(&other)); + assert!(!other.starts_with(&uri)); assert_eq!(uri.join(""), Ok(uri.clone())); assert_eq!( uri.join("child"), @@ -698,6 +705,58 @@ fn join_uses_the_base_uri_path_convention() { } } +#[test] +fn starts_with_uses_uri_segment_boundaries() { + for (path, base, expected) in [ + ("file:///workspace/plugin", "file:///", true), + ("file:///workspace/plugin", "file:///workspace/plugin", true), + ( + "file:///workspace/plugin/assets/icon.svg", + "file:///workspace/plugin", + true, + ), + ( + "file:///workspace/plugin-other/icon.svg", + "file:///workspace/plugin", + false, + ), + ( + "file:///C:/plugins/foo/assets/icon.svg", + "file:///C:/plugins/foo", + true, + ), + ( + "file:///C:/plugins/foo2/assets/icon.svg", + "file:///C:/plugins/foo", + false, + ), + ( + "file://server/share/plugins/foo/icon.svg", + "file://server/share/plugins/foo", + true, + ), + ( + "file://other/share/plugins/foo/icon.svg", + "file://server/share/plugins/foo", + false, + ), + ( + "file:///workspace/plugin/%2F..%2Foutside", + "file:///workspace/plugin", + false, + ), + ( + "file:///workspace/plugin/%5C..%5Coutside", + "file:///workspace/plugin", + false, + ), + ] { + let path = PathUri::parse(path).expect("valid path URI"); + let base = PathUri::parse(base).expect("valid base URI"); + assert_eq!(path.starts_with(&base), expected); + } +} + #[test] fn to_url_returns_the_validated_url() { let uri = PathUri::parse("file://localhost/workspace/a%20file.rs").expect("valid file URI"); diff --git a/codex-rs/windows-sandbox-rs/src/elevated_impl.rs b/codex-rs/windows-sandbox-rs/src/elevated_impl.rs index 5b8bb3769a..1da6f32947 100644 --- a/codex-rs/windows-sandbox-rs/src/elevated_impl.rs +++ b/codex-rs/windows-sandbox-rs/src/elevated_impl.rs @@ -150,6 +150,7 @@ mod windows_impl { &deny_read_paths_override, &deny_write_paths_override, proxy_enforced, + crate::WindowsSandboxProxySettingsMode::Reconcile, )?; // Build capability SID for ACL grants. let caps = load_or_create_cap_sids(codex_home)?; @@ -214,6 +215,7 @@ mod windows_impl { &deny_read_paths_override, &deny_write_paths_override, proxy_enforced, + crate::WindowsSandboxProxySettingsMode::Reconcile, )?; spawn_runner_transport( codex_home, diff --git a/codex-rs/windows-sandbox-rs/src/identity.rs b/codex-rs/windows-sandbox-rs/src/identity.rs index fcba538cea..9ac3402be1 100644 --- a/codex-rs/windows-sandbox-rs/src/identity.rs +++ b/codex-rs/windows-sandbox-rs/src/identity.rs @@ -8,8 +8,8 @@ use crate::setup::SetupMarker; use crate::setup::gather_read_roots; use crate::setup::gather_write_roots_for_permissions; use crate::setup::offline_proxy_settings_from_env; -use crate::setup::run_elevated_setup; -use crate::setup::run_setup_refresh_with_overrides; +use crate::setup::run_elevated_setup_with_proxy_settings; +use crate::setup::run_setup_refresh_with_overrides_and_proxy_settings; use crate::setup::sandbox_users_path; use crate::setup::setup_marker_path; use anyhow::Context; @@ -154,6 +154,7 @@ pub fn require_logon_sandbox_creds( deny_read_paths_override: &[PathBuf], deny_write_paths_override: &[PathBuf], proxy_enforced: bool, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, ) -> Result { let sandbox_dir = crate::setup::sandbox_dir(codex_home); let needed_read = read_roots_override @@ -163,13 +164,19 @@ pub fn require_logon_sandbox_creds( .map(<[PathBuf]>::to_vec) .unwrap_or_else(|| gather_write_roots_for_permissions(permissions, command_cwd, env_map)); let network_identity = SandboxNetworkIdentity::from_permissions(permissions, proxy_enforced); - let desired_offline_proxy_settings = offline_proxy_settings_from_env(env_map, network_identity); + let marker = load_marker(codex_home)?; + let desired_offline_proxy_settings = desired_offline_proxy_settings( + marker.as_ref(), + proxy_settings_mode, + env_map, + network_identity, + ); // NOTE: Do not add CODEX_HOME/.sandbox to `needed_write`; it must remain non-writable by the // restricted capability token. The setup helper's `lock_sandbox_dir` is responsible for // granting the sandbox group access to this directory without granting the capability SID. let mut setup_reason: Option = None; - let mut identity = match load_marker(codex_home)? { + let mut identity = match marker { Some(marker) if marker.version_matches() => { if let Some(reason) = marker.request_mismatch_reason(network_identity, &desired_offline_proxy_settings) @@ -201,7 +208,7 @@ pub fn require_logon_sandbox_creds( } else { crate::logging::log_note("sandbox setup required", Some(&sandbox_dir)); } - run_elevated_setup( + run_elevated_setup_with_proxy_settings( crate::setup::SandboxSetupRequest { permissions, command_cwd, @@ -216,11 +223,12 @@ pub fn require_logon_sandbox_creds( deny_read_paths: Some(deny_read_paths_override.to_vec()), deny_write_paths: Some(deny_write_paths_override.to_vec()), }, + &desired_offline_proxy_settings, )?; identity = select_identity(network_identity, codex_home)?; } // Always refresh ACLs (non-elevated) for current roots via the setup binary. - run_setup_refresh_with_overrides( + run_setup_refresh_with_overrides_and_proxy_settings( crate::setup::SandboxSetupRequest { permissions, command_cwd, @@ -235,6 +243,7 @@ pub fn require_logon_sandbox_creds( deny_read_paths: Some(deny_read_paths_override.to_vec()), deny_write_paths: Some(deny_write_paths_override.to_vec()), }, + &desired_offline_proxy_settings, )?; let identity = identity.ok_or_else(|| { anyhow!( @@ -247,6 +256,22 @@ pub fn require_logon_sandbox_creds( }) } +fn desired_offline_proxy_settings( + marker: Option<&SetupMarker>, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, + env_map: &HashMap, + network_identity: SandboxNetworkIdentity, +) -> crate::setup::OfflineProxySettings { + match (marker, proxy_settings_mode) { + (Some(marker), crate::WindowsSandboxProxySettingsMode::Preserve) + if marker.version_matches() => + { + marker.offline_proxy_settings() + } + _ => offline_proxy_settings_from_env(env_map, network_identity), + } +} + #[allow(clippy::too_many_arguments)] pub(crate) fn refresh_logon_sandbox_creds( permissions: &ResolvedWindowsSandboxPermissions, @@ -259,6 +284,7 @@ pub(crate) fn refresh_logon_sandbox_creds( deny_read_paths_override: &[PathBuf], deny_write_paths_override: &[PathBuf], proxy_enforced: bool, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, ) -> Result { remove_sandbox_users_file(codex_home, "sandbox user login failed")?; require_logon_sandbox_creds( @@ -272,13 +298,20 @@ pub(crate) fn refresh_logon_sandbox_creds( deny_read_paths_override, deny_write_paths_override, proxy_enforced, + proxy_settings_mode, ) } #[cfg(test)] mod tests { + use super::desired_offline_proxy_settings; use super::remove_sandbox_users_file; + use crate::WindowsSandboxProxySettingsMode; + use crate::setup::SandboxNetworkIdentity; + use crate::setup::SetupMarker; use crate::setup::sandbox_users_path; + use pretty_assertions::assert_eq; + use std::collections::HashMap; use std::fs; use tempfile::TempDir; @@ -302,4 +335,40 @@ mod tests { remove_sandbox_users_file(codex_home.path(), "stale creds").expect("remove users"); assert!(!users_path.exists()); } + + #[test] + fn preserving_proxy_settings_uses_the_existing_marker() { + let marker = SetupMarker { + version: crate::setup::SETUP_VERSION, + offline_username: "offline".to_string(), + online_username: "online".to_string(), + created_at: None, + proxy_ports: vec![7890], + allow_local_binding: true, + }; + let env_map = HashMap::from([( + "HTTP_PROXY".to_string(), + "http://127.0.0.1:8080".to_string(), + )]); + + assert_eq!( + desired_offline_proxy_settings( + Some(&marker), + WindowsSandboxProxySettingsMode::Preserve, + &env_map, + SandboxNetworkIdentity::Offline, + ), + marker.offline_proxy_settings() + ); + assert_eq!( + desired_offline_proxy_settings( + Some(&marker), + WindowsSandboxProxySettingsMode::Reconcile, + &env_map, + SandboxNetworkIdentity::Offline, + ) + .proxy_ports, + vec![8080] + ); + } } diff --git a/codex-rs/windows-sandbox-rs/src/lib.rs b/codex-rs/windows-sandbox-rs/src/lib.rs index a7f3df6e2a..766faf1a05 100644 --- a/codex-rs/windows-sandbox-rs/src/lib.rs +++ b/codex-rs/windows-sandbox-rs/src/lib.rs @@ -35,6 +35,15 @@ impl fmt::Debug for WindowsSandboxCancellationToken { } } +/// Controls whether a Windows sandbox launch reconciles persistent proxy +/// firewall settings or preserves the settings established by another launch. +#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)] +pub enum WindowsSandboxProxySettingsMode { + #[default] + Reconcile, + Preserve, +} + #[cfg(target_os = "windows")] mod acl; #[cfg(target_os = "windows")] diff --git a/codex-rs/windows-sandbox-rs/src/setup.rs b/codex-rs/windows-sandbox-rs/src/setup.rs index 428b5ff6a1..1995c33365 100644 --- a/codex-rs/windows-sandbox-rs/src/setup.rs +++ b/codex-rs/windows-sandbox-rs/src/setup.rs @@ -130,14 +130,16 @@ pub fn run_setup_refresh( proxy_enforced, }, SetupRootOverrides::default(), + /*offline_proxy_settings_override*/ None, ) } -pub fn run_setup_refresh_with_overrides( +pub(crate) fn run_setup_refresh_with_overrides_and_proxy_settings( request: SandboxSetupRequest<'_>, overrides: SetupRootOverrides, + offline_proxy_settings: &OfflineProxySettings, ) -> Result<()> { - run_setup_refresh_inner(request, overrides) + run_setup_refresh_inner(request, overrides, Some(offline_proxy_settings)) } pub fn run_setup_refresh_with_extra_read_roots( @@ -174,12 +176,14 @@ pub fn run_setup_refresh_with_extra_read_roots( deny_read_paths: None, deny_write_paths: None, }, + /*offline_proxy_settings_override*/ None, ) } fn run_setup_refresh_inner( request: SandboxSetupRequest<'_>, overrides: SetupRootOverrides, + offline_proxy_settings_override: Option<&OfflineProxySettings>, ) -> Result<()> { if !request.permissions.is_enforceable_by_windows_sandbox() { anyhow::bail!("unsupported filesystem permissions for Windows sandbox setup"); @@ -187,9 +191,8 @@ fn run_setup_refresh_inner( let (read_roots, write_roots) = build_payload_roots(&request, &overrides); let deny_read_paths = build_payload_deny_read_paths(overrides.deny_read_paths); let deny_write_paths = build_payload_deny_write_paths(&request, overrides.deny_write_paths); - let network_identity = - SandboxNetworkIdentity::from_permissions(request.permissions, request.proxy_enforced); - let offline_proxy_settings = offline_proxy_settings_from_env(request.env_map, network_identity); + let offline_proxy_settings = + offline_proxy_settings_for_request(&request, offline_proxy_settings_override); let payload = ElevationPayload { version: SETUP_VERSION, offline_username: OFFLINE_USERNAME.to_string(), @@ -283,6 +286,13 @@ impl SetupMarker { self.version == SETUP_VERSION } + pub(crate) fn offline_proxy_settings(&self) -> OfflineProxySettings { + OfflineProxySettings { + proxy_ports: self.proxy_ports.clone(), + allow_local_binding: self.allow_local_binding, + } + } + pub(crate) fn request_mismatch_reason( &self, network_identity: SandboxNetworkIdentity, @@ -593,6 +603,17 @@ pub(crate) fn offline_proxy_settings_from_env( } } +fn offline_proxy_settings_for_request( + request: &SandboxSetupRequest<'_>, + offline_proxy_settings_override: Option<&OfflineProxySettings>, +) -> OfflineProxySettings { + offline_proxy_settings_override.cloned().unwrap_or_else(|| { + let network_identity = + SandboxNetworkIdentity::from_permissions(request.permissions, request.proxy_enforced); + offline_proxy_settings_from_env(request.env_map, network_identity) + }) +} + pub(crate) fn proxy_ports_from_env(env_map: &HashMap) -> Vec { let mut ports = BTreeSet::new(); for key in PROXY_ENV_KEYS { @@ -821,6 +842,24 @@ fn run_setup_exe( pub fn run_elevated_setup( request: SandboxSetupRequest<'_>, overrides: SetupRootOverrides, +) -> Result<()> { + run_elevated_setup_inner( + request, overrides, /*offline_proxy_settings_override*/ None, + ) +} + +pub(crate) fn run_elevated_setup_with_proxy_settings( + request: SandboxSetupRequest<'_>, + overrides: SetupRootOverrides, + offline_proxy_settings: &OfflineProxySettings, +) -> Result<()> { + run_elevated_setup_inner(request, overrides, Some(offline_proxy_settings)) +} + +fn run_elevated_setup_inner( + request: SandboxSetupRequest<'_>, + overrides: SetupRootOverrides, + offline_proxy_settings_override: Option<&OfflineProxySettings>, ) -> Result<()> { if !request.permissions.is_enforceable_by_windows_sandbox() { anyhow::bail!("unsupported filesystem permissions for Windows sandbox setup"); @@ -836,9 +875,8 @@ pub fn run_elevated_setup( let (read_roots, write_roots) = build_payload_roots(&request, &overrides); let deny_read_paths = build_payload_deny_read_paths(overrides.deny_read_paths); let deny_write_paths = build_payload_deny_write_paths(&request, overrides.deny_write_paths); - let network_identity = - SandboxNetworkIdentity::from_permissions(request.permissions, request.proxy_enforced); - let offline_proxy_settings = offline_proxy_settings_from_env(request.env_map, network_identity); + let offline_proxy_settings = + offline_proxy_settings_for_request(&request, offline_proxy_settings_override); let payload = ElevationPayload { version: SETUP_VERSION, offline_username: OFFLINE_USERNAME.to_string(), @@ -1170,6 +1208,37 @@ mod tests { ) } + #[test] + fn setup_request_prefers_explicit_proxy_settings() { + let tmp = TempDir::new().expect("tempdir"); + let command_cwd = tmp.path().join("workspace"); + fs::create_dir_all(&command_cwd).expect("create workspace"); + let permissions = permissions_for( + &PermissionProfile::read_only(), + workspace_roots_for(&command_cwd).as_slice(), + ); + let env_map = HashMap::from([( + "HTTP_PROXY".to_string(), + "http://127.0.0.1:8080".to_string(), + )]); + let explicit = super::OfflineProxySettings { + proxy_ports: vec![7890], + allow_local_binding: true, + }; + let request = super::SandboxSetupRequest { + permissions: &permissions, + command_cwd: &command_cwd, + env_map: &env_map, + codex_home: tmp.path(), + proxy_enforced: false, + }; + + assert_eq!( + super::offline_proxy_settings_for_request(&request, Some(&explicit)), + explicit + ); + } + #[test] fn report_helper_failure_uses_setup_error_report_when_clear_succeeded() { let tmp = TempDir::new().expect("tempdir"); diff --git a/codex-rs/windows-sandbox-rs/src/spawn_prep.rs b/codex-rs/windows-sandbox-rs/src/spawn_prep.rs index 9668edb1ab..382a6a4531 100644 --- a/codex-rs/windows-sandbox-rs/src/spawn_prep.rs +++ b/codex-rs/windows-sandbox-rs/src/spawn_prep.rs @@ -357,6 +357,7 @@ pub(crate) fn prepare_elevated_spawn_context_for_permissions( deny_read_paths_override: &[PathBuf], deny_write_paths_override: &[PathBuf], proxy_enforced: bool, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, ) -> Result { normalize_null_device_env(env_map); ensure_non_interactive_pager(env_map); @@ -412,6 +413,7 @@ pub(crate) fn prepare_elevated_spawn_context_for_permissions( deny_write_paths_override }, proxy_enforced, + proxy_settings_mode, )?; let caps = load_or_create_cap_sids(codex_home)?; let (psid_to_use, cap_sids) = if uses_write_capabilities { diff --git a/codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs b/codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs index 2e7437ad33..efe4a3f428 100644 --- a/codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs +++ b/codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs @@ -56,6 +56,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil cwd: &Path, mut env_map: HashMap, proxy_enforced: bool, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, timeout_ms: Option, read_roots_override: Option<&[PathBuf]>, read_roots_include_platform_defaults: bool, @@ -91,6 +92,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil &deny_read_paths_override, &deny_write_paths_override, proxy_enforced, + proxy_settings_mode, )?; let spawn_request = SpawnRequest { @@ -133,6 +135,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil &deny_read_paths_override, &deny_write_paths_override, /*proxy_enforced*/ false, + proxy_settings_mode, )?; spawn_runner_transport_task( codex_home, diff --git a/codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs b/codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs index 02792d6cb7..84ccd0d8cc 100644 --- a/codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs +++ b/codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs @@ -31,6 +31,7 @@ pub struct WindowsSandboxSessionRequest<'a> { pub env_map: HashMap, pub windows_sandbox_level: WindowsSandboxLevel, pub proxy_enforced: bool, + pub proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, pub timeout_ms: Option, pub read_roots_override: Option<&'a [PathBuf]>, pub read_roots_include_platform_defaults: bool, @@ -48,7 +49,7 @@ pub async fn spawn_windows_sandbox_session_for_level( if request.proxy_enforced || matches!(request.windows_sandbox_level, WindowsSandboxLevel::Elevated) { - spawn_windows_sandbox_session_elevated_for_permission_profile( + backends::elevated::spawn_windows_sandbox_session_elevated_for_permission_profile( request.permission_profile, request.workspace_roots, request.codex_home, @@ -56,6 +57,7 @@ pub async fn spawn_windows_sandbox_session_for_level( request.cwd, request.env_map, request.proxy_enforced, + request.proxy_settings_mode, request.timeout_ms, request.read_roots_override, request.read_roots_include_platform_defaults, @@ -145,6 +147,7 @@ pub async fn spawn_windows_sandbox_session_elevated_for_permission_profile( cwd, env_map, proxy_enforced, + crate::WindowsSandboxProxySettingsMode::Reconcile, timeout_ms, read_roots_override, read_roots_include_platform_defaults, diff --git a/codex-rs/windows-sandbox-rs/src/wrapper.rs b/codex-rs/windows-sandbox-rs/src/wrapper.rs index 375fb07cf5..f02af26133 100644 --- a/codex-rs/windows-sandbox-rs/src/wrapper.rs +++ b/codex-rs/windows-sandbox-rs/src/wrapper.rs @@ -26,6 +26,7 @@ const DENY_WRITE_PATHS_JSON_FLAG: &str = "--deny-write-paths-json"; const ENV_JSON_FLAG: &str = "--env-json"; const PERMISSION_PROFILE_FLAG: &str = "--permission-profile"; const PRIVATE_DESKTOP_FLAG: &str = "--windows-sandbox-private-desktop"; +const PRESERVE_PROXY_SETTINGS_FLAG: &str = "--preserve-proxy-settings"; const PROXY_ENFORCED_FLAG: &str = "--proxy-enforced"; const READ_ROOTS_INCLUDE_PLATFORM_DEFAULTS_FLAG: &str = "--read-roots-include-platform-defaults"; const READ_ROOTS_JSON_FLAG: &str = "--read-roots-json"; @@ -43,6 +44,7 @@ pub fn create_windows_sandbox_command_args_for_permission_profile( windows_sandbox_level: WindowsSandboxLevel, windows_sandbox_private_desktop: bool, proxy_enforced: bool, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, read_roots_override: Option<&[PathBuf]>, read_roots_include_platform_defaults: bool, write_roots_override: Option<&[PathBuf]>, @@ -82,6 +84,9 @@ pub fn create_windows_sandbox_command_args_for_permission_profile( if proxy_enforced { args.push(PROXY_ENFORCED_FLAG.to_string()); } + if proxy_settings_mode == crate::WindowsSandboxProxySettingsMode::Preserve { + args.push(PRESERVE_PROXY_SETTINGS_FLAG.to_string()); + } if let Some(read_roots_override) = read_roots_override { push_json_arg(&mut args, READ_ROOTS_JSON_FLAG, &read_roots_override); } @@ -154,6 +159,7 @@ struct WindowsSandboxWrapperRequest { windows_sandbox_level: WindowsSandboxLevel, windows_sandbox_private_desktop: bool, proxy_enforced: bool, + proxy_settings_mode: crate::WindowsSandboxProxySettingsMode, read_roots_override: Option>, read_roots_include_platform_defaults: bool, write_roots_override: Option>, @@ -176,6 +182,7 @@ async fn run_windows_sandbox_wrapper_request(request: WindowsSandboxWrapperReque env_map: request.env_map, windows_sandbox_level: request.windows_sandbox_level, proxy_enforced: request.proxy_enforced, + proxy_settings_mode: request.proxy_settings_mode, timeout_ms: None, read_roots_override: request.read_roots_override.as_deref(), read_roots_include_platform_defaults: request.read_roots_include_platform_defaults, @@ -201,6 +208,7 @@ fn parse_windows_sandbox_wrapper_args(args: Vec) -> Result) -> Result windows_sandbox_private_desktop = true, + PRESERVE_PROXY_SETTINGS_FLAG => { + proxy_settings_mode = crate::WindowsSandboxProxySettingsMode::Preserve; + } PROXY_ENFORCED_FLAG => proxy_enforced = true, READ_ROOTS_INCLUDE_PLATFORM_DEFAULTS_FLAG => { read_roots_include_platform_defaults = true; @@ -282,6 +293,7 @@ fn parse_windows_sandbox_wrapper_args(args: Vec) -> Result=18.14.1'} peerDependencies: - hono: ^4 + hono: 4.12.25 '@humanfs/core@0.19.1': resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} @@ -1341,8 +1343,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.0: - resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==} + fast-uri@3.1.1: + resolution: {integrity: sha512-h2r7rcm6Ee/J8o0LD5djLuFVcfbZxhvho4vvsbeV0aMvXjUgqv4YpxpkEx0d68l6+IleVfLAdVEfhR7QNMkGHQ==} fastq@1.19.1: resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==} @@ -1484,8 +1486,8 @@ packages: resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==} engines: {node: '>= 0.4'} - hono@4.12.12: - resolution: {integrity: sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==} + hono@4.12.25: + resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==} engines: {node: '>=16.9.0'} html-escaper@2.0.2: @@ -2873,9 +2875,9 @@ snapshots: '@eslint/core': 0.15.2 levn: 0.4.1 - '@hono/node-server@1.19.13(hono@4.12.12)': + '@hono/node-server@1.19.13(hono@4.12.25)': dependencies: - hono: 4.12.12 + hono: 4.12.25 '@humanfs/core@0.19.1': {} @@ -3095,7 +3097,7 @@ snapshots: '@modelcontextprotocol/sdk@1.26.0(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.13(hono@4.12.12) + '@hono/node-server': 1.19.13(hono@4.12.25) ajv: 8.17.1 ajv-formats: 3.0.1(ajv@8.17.1) content-type: 1.0.5 @@ -3105,7 +3107,7 @@ snapshots: eventsource-parser: 3.0.6 express: 5.2.1 express-rate-limit: 8.3.2(express@5.2.1) - hono: 4.12.12 + hono: 4.12.25 jose: 6.1.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.0 @@ -3401,7 +3403,7 @@ snapshots: ajv@8.17.1: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.0 + fast-uri: 3.1.1 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -3905,7 +3907,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.0: {} + fast-uri@3.1.1: {} fastq@1.19.1: dependencies: @@ -4054,7 +4056,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.12.12: {} + hono@4.12.25: {} html-escaper@2.0.2: {}