Merge remote-tracking branch 'upstream/main' into dev/friel/tui-collab-foundation

# Conflicts:
#	codex-rs/tui/src/chatwidget/tests.rs

codex-rs/core/Cargo.toml

@@ -38,6 +38,7 @@ codex-core-skills = { workspace = true }
 codex-exec-server = { workspace = true }
 codex-features = { workspace = true }
 codex-login = { workspace = true }
+codex-mcp = { workspace = true }
 codex-shell-command = { workspace = true }
 codex-execpolicy = { workspace = true }
 codex-git-utils = { workspace = true }
@@ -146,9 +147,7 @@ codex-shell-escalation = { workspace = true }
 assert_cmd = { workspace = true }
 assert_matches = { workspace = true }
 codex-arg0 = { workspace = true }
-codex-otel = { workspace = true, features = [
-    "disable-default-metrics-exporter",
-] }
+codex-otel = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
 core_test_support = { workspace = true }
 ctor = { workspace = true }

codex-rs/core/config.schema.json

@@ -392,6 +392,9 @@
             "fast_mode": {
               "type": "boolean"
             },
+            "general_analytics": {
+              "type": "boolean"
+            },
             "guardian_approval": {
               "type": "boolean"
             },
@@ -816,10 +819,62 @@
       },
       "type": "object"
     },
+    "ModelProviderAuthInfo": {
+      "additionalProperties": false,
+      "description": "Configuration for obtaining a provider bearer token from a command.",
+      "properties": {
+        "args": {
+          "default": [],
+          "description": "Command arguments.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "command": {
+          "description": "Command to execute. Bare names are resolved via `PATH`; paths are resolved against `cwd`.",
+          "type": "string"
+        },
+        "cwd": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/AbsolutePathBuf"
+            }
+          ],
+          "description": "Working directory used when running the token command."
+        },
+        "refresh_interval_ms": {
+          "default": 300000,
+          "description": "Maximum age for the cached token before rerunning the command. Set to `0` to disable proactive refresh and only rerun after a 401 retry path.",
+          "format": "uint64",
+          "minimum": 0.0,
+          "type": "integer"
+        },
+        "timeout_ms": {
+          "default": 5000,
+          "description": "Maximum time to wait for the token command to exit successfully.",
+          "format": "uint64",
+          "minimum": 1.0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "command"
+      ],
+      "type": "object"
+    },
     "ModelProviderInfo": {
       "additionalProperties": false,
       "description": "Serializable representation of a provider definition.",
       "properties": {
+        "auth": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ModelProviderAuthInfo"
+            }
+          ],
+          "description": "Command-backed bearer-token configuration for this provider."
+        },
         "base_url": {
           "description": "Base URL for the provider's OpenAI-compatible API.",
           "type": "string"
@@ -1264,6 +1319,7 @@
     },
     "RawMcpServerConfig": {
       "additionalProperties": false,
+      "description": "Raw MCP config shape used for deserialization and JSON Schema generation.\n\nKeep `TryFrom<RawMcpServerConfig> for McpServerConfig` exhaustively destructuring this struct so new TOML fields cannot be added here without updating the validation/mapping logic that produces [`McpServerConfig`].",
       "properties": {
         "args": {
           "default": null,
@@ -2034,6 +2090,9 @@
         "fast_mode": {
           "type": "boolean"
         },
+        "general_analytics": {
+          "type": "boolean"
+        },
         "guardian_approval": {
           "type": "boolean"
         },
@@ -2568,4 +2627,4 @@
   },
   "title": "ConfigToml",
   "type": "object"
-}
+}

codex-rs/core/src/agent/agent_resolver.rs

@@ -28,25 +28,6 @@ pub(crate) async fn resolve_agent_target(
         })
 }
 
-/// Resolves multiple tool-facing agent targets to thread ids.
-pub(crate) async fn resolve_agent_targets(
-    session: &Arc<Session>,
-    turn: &Arc<TurnContext>,
-    targets: Vec<String>,
-) -> Result<Vec<ThreadId>, FunctionCallError> {
-    if targets.is_empty() {
-        return Err(FunctionCallError::RespondToModel(
-            "agent targets must be non-empty".to_string(),
-        ));
-    }
-
-    let mut resolved = Vec::with_capacity(targets.len());
-    for target in &targets {
-        resolved.push(resolve_agent_target(session, turn, target).await?);
-    }
-    Ok(resolved)
-}
-
 fn register_session_root(session: &Arc<Session>, turn: &Arc<TurnContext>) {
     session
         .services

codex-rs/core/src/agent/control.rs

@@ -15,6 +15,7 @@ use crate::session_prefix::format_subagent_notification_message;
 use crate::shell_snapshot::ShellSnapshot;
 use crate::state_db;
 use crate::thread_manager::ThreadManagerState;
+use crate::thread_rollout_truncation::truncate_rollout_to_last_n_fork_turns;
 use codex_features::Feature;
 use codex_protocol::AgentPath;
 use codex_protocol::ThreadId;
@@ -41,9 +42,16 @@ const AGENT_NAMES: &str = include_str!("agent_names.txt");
 const FORKED_SPAWN_AGENT_OUTPUT_MESSAGE: &str = "You are the newly spawned agent. The prior conversation history was forked from your parent agent. Treat the next user message as your new task, and use the forked history only as background context.";
 const ROOT_LAST_TASK_MESSAGE: &str = "Main thread";
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum SpawnAgentForkMode {
+    FullHistory,
+    LastNTurns(usize),
+}
+
 #[derive(Clone, Debug, Default)]
 pub(crate) struct SpawnAgentOptions {
     pub(crate) fork_parent_spawn_call_id: Option<String>,
+    pub(crate) fork_mode: Option<SpawnAgentForkMode>,
 }
 
 #[derive(Clone, Debug)]
@@ -178,83 +186,32 @@ impl AgentControl {
         let notification_source = session_source.clone();
 
         // The same `AgentControl` is sent to spawn the thread.
-        let new_thread = match session_source {
-            Some(session_source) => {
-                if let Some(call_id) = options.fork_parent_spawn_call_id.as_ref() {
-                    let SessionSource::SubAgent(SubAgentSource::ThreadSpawn {
-                        parent_thread_id,
-                        ..
-                    }) = session_source.clone()
-                    else {
-                        return Err(CodexErr::Fatal(
-                            "spawn_agent fork requires a thread-spawn session source".to_string(),
-                        ));
-                    };
-                    let parent_thread = state.get_thread(parent_thread_id).await.ok();
-                    if let Some(parent_thread) = parent_thread.as_ref() {
-                        // `record_conversation_items` only queues rollout writes asynchronously.
-                        // Flush/materialize the live parent before snapshotting JSONL for a fork.
-                        parent_thread
-                            .codex
-                            .session
-                            .ensure_rollout_materialized()
-                            .await;
-                        parent_thread.codex.session.flush_rollout().await;
-                    }
-                    let rollout_path = parent_thread
-                        .as_ref()
-                        .and_then(|parent_thread| parent_thread.rollout_path())
-                        .or(find_thread_path_by_id_str(
-                            config.codex_home.as_path(),
-                            &parent_thread_id.to_string(),
-                        )
-                        .await?)
-                        .ok_or_else(|| {
-                            CodexErr::Fatal(format!(
-                                "parent thread rollout unavailable for fork: {parent_thread_id}"
-                            ))
-                        })?;
-                    let mut forked_rollout_items: Vec<RolloutItem> =
-                        RolloutRecorder::get_rollout_history(&rollout_path)
-                            .await?
-                            .get_rollout_items();
-                    let mut output = FunctionCallOutputPayload::from_text(
-                        FORKED_SPAWN_AGENT_OUTPUT_MESSAGE.to_string(),
-                    );
-                    output.success = Some(true);
-                    forked_rollout_items.push(RolloutItem::ResponseItem(
-                        ResponseItem::FunctionCallOutput {
-                            call_id: call_id.clone(),
-                            output,
-                        },
-                    ));
-                    let initial_history = InitialHistory::Forked(forked_rollout_items);
-                    state
-                        .fork_thread_with_source(
-                            config,
-                            initial_history,
-                            self.clone(),
-                            session_source,
-                            /*persist_extended_history*/ false,
-                            inherited_shell_snapshot,
-                            inherited_exec_policy,
-                        )
-                        .await?
-                } else {
-                    state
-                        .spawn_new_thread_with_source(
-                            config,
-                            self.clone(),
-                            session_source,
-                            /*persist_extended_history*/ false,
-                            /*metrics_service_name*/ None,
-                            inherited_shell_snapshot,
-                            inherited_exec_policy,
-                        )
-                        .await?
-                }
+        let new_thread = match (session_source, options.fork_mode.as_ref()) {
+            (Some(session_source), Some(_)) => {
+                self.spawn_forked_thread(
+                    &state,
+                    config,
+                    session_source,
+                    &options,
+                    inherited_shell_snapshot,
+                    inherited_exec_policy,
+                )
+                .await?
             }
-            None => state.spawn_new_thread(config, self.clone()).await?,
+            (Some(session_source), None) => {
+                state
+                    .spawn_new_thread_with_source(
+                        config,
+                        self.clone(),
+                        session_source,
+                        /*persist_extended_history*/ false,
+                        /*metrics_service_name*/ None,
+                        inherited_shell_snapshot,
+                        inherited_exec_policy,
+                    )
+                    .await?
+            }
+            (None, _) => state.spawn_new_thread(config, self.clone()).await?,
         };
         agent_metadata.agent_id = Some(new_thread.thread_id);
         reservation.commit(agent_metadata.clone());
@@ -273,17 +230,19 @@ impl AgentControl {
 
         self.send_input(new_thread.thread_id, initial_operation)
             .await?;
-        let child_reference = agent_metadata
-            .agent_path
-            .as_ref()
-            .map(ToString::to_string)
-            .unwrap_or_else(|| new_thread.thread_id.to_string());
-        self.maybe_start_completion_watcher(
-            new_thread.thread_id,
-            notification_source,
-            child_reference,
-            agent_metadata.agent_path.clone(),
-        );
+        if !new_thread.thread.enabled(Feature::MultiAgentV2) {
+            let child_reference = agent_metadata
+                .agent_path
+                .as_ref()
+                .map(ToString::to_string)
+                .unwrap_or_else(|| new_thread.thread_id.to_string());
+            self.maybe_start_completion_watcher(
+                new_thread.thread_id,
+                notification_source,
+                child_reference,
+                agent_metadata.agent_path.clone(),
+            );
+        }
 
         Ok(LiveAgent {
             thread_id: new_thread.thread_id,
@@ -292,6 +251,92 @@ impl AgentControl {
         })
     }
 
+    async fn spawn_forked_thread(
+        &self,
+        state: &Arc<ThreadManagerState>,
+        config: crate::config::Config,
+        session_source: SessionSource,
+        options: &SpawnAgentOptions,
+        inherited_shell_snapshot: Option<Arc<ShellSnapshot>>,
+        inherited_exec_policy: Option<Arc<crate::exec_policy::ExecPolicyManager>>,
+    ) -> CodexResult<crate::thread_manager::NewThread> {
+        let Some(call_id) = options.fork_parent_spawn_call_id.as_deref() else {
+            return Err(CodexErr::Fatal(
+                "spawn_agent fork requires a parent spawn call id".to_string(),
+            ));
+        };
+        let Some(fork_mode) = options.fork_mode.as_ref() else {
+            return Err(CodexErr::Fatal(
+                "spawn_agent fork requires a fork mode".to_string(),
+            ));
+        };
+        let SessionSource::SubAgent(SubAgentSource::ThreadSpawn {
+            parent_thread_id, ..
+        }) = &session_source
+        else {
+            return Err(CodexErr::Fatal(
+                "spawn_agent fork requires a thread-spawn session source".to_string(),
+            ));
+        };
+
+        let parent_thread_id = *parent_thread_id;
+        let parent_thread = state.get_thread(parent_thread_id).await.ok();
+        if let Some(parent_thread) = parent_thread.as_ref() {
+            // `record_conversation_items` only queues rollout writes asynchronously.
+            // Flush/materialize the live parent before snapshotting JSONL for a fork.
+            parent_thread
+                .codex
+                .session
+                .ensure_rollout_materialized()
+                .await;
+            parent_thread.codex.session.flush_rollout().await;
+        }
+
+        let rollout_path = parent_thread
+            .as_ref()
+            .and_then(|parent_thread| parent_thread.rollout_path())
+            .or(find_thread_path_by_id_str(
+                config.codex_home.as_path(),
+                &parent_thread_id.to_string(),
+            )
+            .await?)
+            .ok_or_else(|| {
+                CodexErr::Fatal(format!(
+                    "parent thread rollout unavailable for fork: {parent_thread_id}"
+                ))
+            })?;
+
+        let mut forked_rollout_items = RolloutRecorder::get_rollout_history(&rollout_path)
+            .await?
+            .get_rollout_items();
+        if let SpawnAgentForkMode::LastNTurns(last_n_turns) = fork_mode {
+            forked_rollout_items =
+                truncate_rollout_to_last_n_fork_turns(&forked_rollout_items, *last_n_turns);
+        }
+
+        let mut output =
+            FunctionCallOutputPayload::from_text(FORKED_SPAWN_AGENT_OUTPUT_MESSAGE.to_string());
+        output.success = Some(true);
+        forked_rollout_items.push(RolloutItem::ResponseItem(
+            ResponseItem::FunctionCallOutput {
+                call_id: call_id.to_string(),
+                output,
+            },
+        ));
+
+        state
+            .fork_thread_with_source(
+                config,
+                InitialHistory::Forked(forked_rollout_items),
+                self.clone(),
+                session_source,
+                /*persist_extended_history*/ false,
+                inherited_shell_snapshot,
+                inherited_exec_policy,
+            )
+            .await
+    }
+
     /// Resume an existing agent thread from a recorded rollout file.
     pub(crate) async fn resume_agent_from_rollout(
         &self,
@@ -445,17 +490,19 @@ impl AgentControl {
         // Resumed threads are re-registered in-memory and need the same listener
         // attachment path as freshly spawned threads.
         state.notify_thread_created(resumed_thread.thread_id);
-        let child_reference = agent_metadata
-            .agent_path
-            .as_ref()
-            .map(ToString::to_string)
-            .unwrap_or_else(|| resumed_thread.thread_id.to_string());
-        self.maybe_start_completion_watcher(
-            resumed_thread.thread_id,
-            Some(notification_source.clone()),
-            child_reference,
-            agent_metadata.agent_path.clone(),
-        );
+        if !resumed_thread.thread.enabled(Feature::MultiAgentV2) {
+            let child_reference = agent_metadata
+                .agent_path
+                .as_ref()
+                .map(ToString::to_string)
+                .unwrap_or_else(|| resumed_thread.thread_id.to_string());
+            self.maybe_start_completion_watcher(
+                resumed_thread.thread_id,
+                Some(notification_source.clone()),
+                child_reference,
+                agent_metadata.agent_path.clone(),
+            );
+        }
         self.persist_thread_spawn_edge_for_source(
             resumed_thread.thread.as_ref(),
             resumed_thread.thread_id,

codex-rs/core/src/agent/control_tests.rs

@@ -448,12 +448,7 @@ async fn send_inter_agent_communication_without_turn_queues_message_without_trig
 
     timeout(Duration::from_secs(5), async {
         loop {
-            if thread
-                .codex
-                .session
-                .has_queued_response_items_for_next_turn()
-                .await
-            {
+            if thread.codex.session.has_pending_input().await {
                 break;
             }
             sleep(Duration::from_millis(10)).await;
@@ -607,6 +602,7 @@ async fn spawn_agent_can_fork_parent_thread_history() {
             })),
             SpawnAgentOptions {
                 fork_parent_spawn_call_id: Some(parent_spawn_call_id),
+                fork_mode: Some(SpawnAgentForkMode::FullHistory),
             },
         )
         .await
@@ -692,6 +688,7 @@ async fn spawn_agent_fork_injects_output_for_parent_spawn_call() {
             })),
             SpawnAgentOptions {
                 fork_parent_spawn_call_id: Some(parent_spawn_call_id.clone()),
+                fork_mode: Some(SpawnAgentForkMode::FullHistory),
             },
         )
         .await
@@ -764,6 +761,7 @@ async fn spawn_agent_fork_flushes_parent_rollout_before_loading_history() {
             })),
             SpawnAgentOptions {
                 fork_parent_spawn_call_id: Some(parent_spawn_call_id.clone()),
+                fork_mode: Some(SpawnAgentForkMode::FullHistory),
             },
         )
         .await
@@ -810,6 +808,128 @@ async fn spawn_agent_fork_flushes_parent_rollout_before_loading_history() {
         .expect("parent shutdown should submit");
 }
 
+#[tokio::test]
+async fn spawn_agent_fork_last_n_turns_keeps_only_recent_turns() {
+    let harness = AgentControlHarness::new().await;
+    let (parent_thread_id, parent_thread) = harness.start_thread().await;
+
+    parent_thread
+        .inject_user_message_without_turn("old parent context".to_string())
+        .await;
+    let queued_communication = InterAgentCommunication::new(
+        AgentPath::root(),
+        AgentPath::try_from("/root/worker").expect("agent path"),
+        Vec::new(),
+        "queued message".to_string(),
+        /*trigger_turn*/ false,
+    );
+    let queued_turn_context = parent_thread.codex.session.new_default_turn().await;
+    parent_thread
+        .codex
+        .session
+        .record_conversation_items(
+            queued_turn_context.as_ref(),
+            &[queued_communication.to_response_input_item().into()],
+        )
+        .await;
+
+    let triggered_communication = InterAgentCommunication::new(
+        AgentPath::root(),
+        AgentPath::try_from("/root/worker").expect("agent path"),
+        Vec::new(),
+        "triggered context".to_string(),
+        /*trigger_turn*/ true,
+    );
+    let triggered_turn_context = parent_thread.codex.session.new_default_turn().await;
+    parent_thread
+        .codex
+        .session
+        .record_conversation_items(
+            triggered_turn_context.as_ref(),
+            &[triggered_communication.to_response_input_item().into()],
+        )
+        .await;
+
+    parent_thread
+        .inject_user_message_without_turn("current parent task".to_string())
+        .await;
+    let spawn_turn_context = parent_thread.codex.session.new_default_turn().await;
+    let parent_spawn_call_id = "spawn-call-last-n".to_string();
+    let parent_spawn_call = ResponseItem::FunctionCall {
+        id: None,
+        name: "spawn_agent".to_string(),
+        namespace: None,
+        arguments: "{}".to_string(),
+        call_id: parent_spawn_call_id.clone(),
+    };
+    parent_thread
+        .codex
+        .session
+        .record_conversation_items(spawn_turn_context.as_ref(), &[parent_spawn_call])
+        .await;
+    parent_thread
+        .codex
+        .session
+        .ensure_rollout_materialized()
+        .await;
+    parent_thread.codex.session.flush_rollout().await;
+
+    let child_thread_id = harness
+        .control
+        .spawn_agent_with_metadata(
+            harness.config.clone(),
+            text_input("child task"),
+            Some(SessionSource::SubAgent(SubAgentSource::ThreadSpawn {
+                parent_thread_id,
+                depth: 1,
+                agent_path: None,
+                agent_nickname: None,
+                agent_role: None,
+            })),
+            SpawnAgentOptions {
+                fork_parent_spawn_call_id: Some(parent_spawn_call_id),
+                fork_mode: Some(SpawnAgentForkMode::LastNTurns(2)),
+            },
+        )
+        .await
+        .expect("forked spawn should keep only the last two turns")
+        .thread_id;
+
+    let child_thread = harness
+        .manager
+        .get_thread(child_thread_id)
+        .await
+        .expect("child thread should be registered");
+    let history = child_thread.codex.session.clone_history().await;
+
+    assert!(!history_contains_text(
+        history.raw_items(),
+        "old parent context"
+    ));
+    assert!(!history_contains_text(
+        history.raw_items(),
+        "queued message"
+    ));
+    assert!(history_contains_text(
+        history.raw_items(),
+        "triggered context"
+    ));
+    assert!(history_contains_text(
+        history.raw_items(),
+        "current parent task"
+    ));
+
+    let _ = harness
+        .control
+        .shutdown_live_agent(child_thread_id)
+        .await
+        .expect("child shutdown should submit");
+    let _ = parent_thread
+        .submit(Op::Shutdown {})
+        .await
+        .expect("parent shutdown should submit");
+}
+
 #[tokio::test]
 async fn spawn_agent_respects_max_threads_limit() {
     let max_threads = 1usize;

codex-rs/core/src/agent/mailbox.rs

@@ -0,0 +1,161 @@
+use codex_protocol::protocol::InterAgentCommunication;
+use std::collections::VecDeque;
+use std::sync::atomic::AtomicU64;
+use std::sync::atomic::Ordering;
+use tokio::sync::mpsc;
+use tokio::sync::watch;
+
+#[cfg(test)]
+use codex_protocol::AgentPath;
+
+pub(crate) struct Mailbox {
+    tx: mpsc::UnboundedSender<InterAgentCommunication>,
+    next_seq: AtomicU64,
+    seq_tx: watch::Sender<u64>,
+}
+
+pub(crate) struct MailboxReceiver {
+    rx: mpsc::UnboundedReceiver<InterAgentCommunication>,
+    pending_mails: VecDeque<InterAgentCommunication>,
+}
+
+impl Mailbox {
+    pub(crate) fn new() -> (Self, MailboxReceiver) {
+        let (tx, rx) = mpsc::unbounded_channel();
+        let (seq_tx, _) = watch::channel(0);
+        (
+            Self {
+                tx,
+                next_seq: AtomicU64::new(0),
+                seq_tx,
+            },
+            MailboxReceiver {
+                rx,
+                pending_mails: VecDeque::new(),
+            },
+        )
+    }
+
+    pub(crate) fn subscribe(&self) -> watch::Receiver<u64> {
+        self.seq_tx.subscribe()
+    }
+
+    pub(crate) fn send(&self, communication: InterAgentCommunication) -> u64 {
+        let seq = self.next_seq.fetch_add(1, Ordering::Relaxed) + 1;
+        let _ = self.tx.send(communication);
+        self.seq_tx.send_replace(seq);
+        seq
+    }
+}
+
+impl MailboxReceiver {
+    fn sync_pending_mails(&mut self) {
+        while let Ok(mail) = self.rx.try_recv() {
+            self.pending_mails.push_back(mail);
+        }
+    }
+
+    pub(crate) fn has_pending(&mut self) -> bool {
+        self.sync_pending_mails();
+        !self.pending_mails.is_empty()
+    }
+
+    pub(crate) fn has_pending_trigger_turn(&mut self) -> bool {
+        self.sync_pending_mails();
+        self.pending_mails.iter().any(|mail| mail.trigger_turn)
+    }
+
+    pub(crate) fn drain(&mut self) -> Vec<InterAgentCommunication> {
+        self.sync_pending_mails();
+        self.pending_mails.drain(..).collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    fn make_mail(
+        author: AgentPath,
+        recipient: AgentPath,
+        content: &str,
+        trigger_turn: bool,
+    ) -> InterAgentCommunication {
+        InterAgentCommunication::new(
+            author,
+            recipient,
+            Vec::new(),
+            content.to_string(),
+            trigger_turn,
+        )
+    }
+
+    #[tokio::test]
+    async fn mailbox_assigns_monotonic_sequence_numbers() {
+        let (mailbox, _receiver) = Mailbox::new();
+        let mut seq_rx = mailbox.subscribe();
+
+        let seq_a = mailbox.send(make_mail(
+            AgentPath::root(),
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            "one",
+            /*trigger_turn*/ false,
+        ));
+        let seq_b = mailbox.send(make_mail(
+            AgentPath::root(),
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            "two",
+            /*trigger_turn*/ false,
+        ));
+
+        seq_rx.changed().await.expect("first seq update");
+        assert_eq!(*seq_rx.borrow(), seq_b);
+        assert_eq!(seq_a, 1);
+        assert_eq!(seq_b, 2);
+    }
+
+    #[tokio::test]
+    async fn mailbox_drains_in_delivery_order() {
+        let (mailbox, mut receiver) = Mailbox::new();
+        let mail_one = make_mail(
+            AgentPath::root(),
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            "one",
+            /*trigger_turn*/ false,
+        );
+        let mail_two = make_mail(
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            AgentPath::root(),
+            "two",
+            /*trigger_turn*/ false,
+        );
+
+        mailbox.send(mail_one.clone());
+        mailbox.send(mail_two.clone());
+
+        assert_eq!(receiver.drain(), vec![mail_one, mail_two]);
+        assert!(!receiver.has_pending());
+    }
+
+    #[tokio::test]
+    async fn mailbox_tracks_pending_trigger_turn_mail() {
+        let (mailbox, mut receiver) = Mailbox::new();
+
+        mailbox.send(make_mail(
+            AgentPath::root(),
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            "queued",
+            /*trigger_turn*/ false,
+        ));
+        assert!(!receiver.has_pending_trigger_turn());
+
+        mailbox.send(make_mail(
+            AgentPath::root(),
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            "wake",
+            /*trigger_turn*/ true,
+        ));
+        assert!(receiver.has_pending_trigger_turn());
+    }
+}

codex-rs/core/src/agent/mod.rs

@@ -1,11 +1,14 @@
 pub(crate) mod agent_resolver;
 pub(crate) mod control;
+pub(crate) mod mailbox;
 mod registry;
 pub(crate) mod role;
 pub(crate) mod status;
 
 pub(crate) use codex_protocol::protocol::AgentStatus;
 pub(crate) use control::AgentControl;
+pub(crate) use mailbox::Mailbox;
+pub(crate) use mailbox::MailboxReceiver;
 pub(crate) use registry::exceeds_thread_spawn_depth_limit;
 pub(crate) use registry::next_thread_spawn_depth;
 pub(crate) use status::agent_status_from_event;

codex-rs/core/src/auth_env_telemetry.rs

@@ -64,6 +64,7 @@ mod tests {
             env_key: Some("sk-should-not-leak".to_string()),
             env_key_instructions: None,
             experimental_bearer_token: None,
+            auth: None,
             wire_api: crate::model_provider_info::WireApi::Responses,
             query_params: None,
             http_headers: None,

codex-rs/core/src/client.rs

@@ -104,6 +104,7 @@ use crate::error::Result;
 use crate::flags::CODEX_RS_SSE_FIXTURE;
 use crate::model_provider_info::ModelProviderInfo;
 use crate::model_provider_info::WireApi;
+use crate::provider_auth::auth_manager_for_provider;
 use crate::response_debug_context::extract_response_debug_context;
 use crate::response_debug_context::extract_response_debug_context_from_api_error;
 use crate::response_debug_context::telemetry_api_error_message;
@@ -261,6 +262,7 @@ impl ModelClient {
         include_timing_metrics: bool,
         beta_features_header: Option<String>,
     ) -> Self {
+        let auth_manager = auth_manager_for_provider(auth_manager, &provider);
         let codex_api_key_env_enabled = auth_manager
             .as_ref()
             .is_some_and(|manager| manager.codex_api_key_env_enabled());
@@ -294,6 +296,10 @@ impl ModelClient {
         }
     }
 
+    pub(crate) fn auth_manager(&self) -> Option<Arc<AuthManager>> {
+        self.state.auth_manager.clone()
+    }
+
     fn take_cached_websocket_session(&self) -> WebsocketSession {
         let mut cached_websocket_session = self
             .state

codex-rs/core/src/client_common.rs

@@ -156,14 +156,6 @@ fn strip_total_output_header(output: &str) -> Option<(&str, u32)> {
     Some((remainder, total_lines))
 }
 
-pub(crate) mod tools {
-    pub(crate) use codex_tools::FreeformTool;
-    pub(crate) use codex_tools::FreeformToolFormat;
-    pub(crate) use codex_tools::ResponsesApiTool;
-    pub(crate) use codex_tools::ToolSearchOutputTool;
-    pub(crate) use codex_tools::ToolSpec;
-}
-
 pub struct ResponseStream {
     pub(crate) rx_event: mpsc::Receiver<Result<ResponseEvent>>,
 }

codex-rs/core/src/codex.rs

@@ -11,7 +11,10 @@ use crate::CodexAuth;
 use crate::SandboxState;
 use crate::agent::AgentControl;
 use crate::agent::AgentStatus;
+use crate::agent::Mailbox;
+use crate::agent::MailboxReceiver;
 use crate::agent::agent_status_from_event;
+use crate::agent::status::is_final;
 use crate::apps::render_apps_section;
 use crate::auth_env_telemetry::collect_auth_env_telemetry;
 use crate::commit_attribution::commit_message_trailer_instruction;
@@ -37,6 +40,7 @@ use crate::realtime_conversation::handle_start as handle_realtime_conversation_s
 use crate::realtime_conversation::handle_text as handle_realtime_conversation_text;
 use crate::render_skills_section;
 use crate::rollout::session_index;
+use crate::session_prefix::format_subagent_notification_message;
 use crate::skills_load_input_from_config;
 use crate::stream_events_utils::HandleOutputCtx;
 use crate::stream_events_utils::handle_non_tool_response_item;
@@ -97,6 +101,7 @@ use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::FileChange;
 use codex_protocol::protocol::HasLegacyEvent;
+use codex_protocol::protocol::InterAgentCommunication;
 use codex_protocol::protocol::ItemCompletedEvent;
 use codex_protocol::protocol::ItemStartedEvent;
 use codex_protocol::protocol::RawResponseItemEvent;
@@ -118,6 +123,7 @@ use codex_protocol::request_user_input::RequestUserInputResponse;
 use codex_rmcp_client::ElicitationResponse;
 use codex_rmcp_client::OAuthCredentialsStoreMode;
 use codex_terminal_detection::user_agent;
+use codex_tools::filter_tool_suggest_discoverable_tools_for_client;
 use codex_utils_output_truncation::TruncationPolicy;
 use codex_utils_stream_parser::AssistantTextChunk;
 use codex_utils_stream_parser::AssistantTextStreamParser;
@@ -259,11 +265,11 @@ use crate::instructions::UserInstructions;
 use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp::McpManager;
 use crate::mcp::auth::compute_auth_statuses;
-use crate::mcp::maybe_prompt_and_install_mcp_dependencies;
 use crate::mcp::with_codex_apps_mcp;
 use crate::mcp_connection_manager::McpConnectionManager;
 use crate::mcp_connection_manager::codex_apps_tools_cache_key;
 use crate::mcp_connection_manager::filter_non_codex_apps_mcp_tools_only;
+use crate::mcp_skill_dependencies::maybe_prompt_and_install_mcp_dependencies;
 use crate::memories;
 use crate::mentions::build_connector_slug_counts;
 use crate::mentions::build_skill_name_counts;
@@ -341,8 +347,6 @@ use crate::tools::network_approval::build_network_policy_decider;
 use crate::tools::parallel::ToolCallRuntime;
 use crate::tools::router::ToolRouterParams;
 use crate::tools::sandboxing::ApprovalStore;
-use crate::tools::spec::ToolsConfig;
-use crate::tools::spec::ToolsConfigParams;
 use crate::turn_diff_tracker::TurnDiffTracker;
 use crate::turn_timing::TurnTimingState;
 use crate::turn_timing::record_turn_ttfm_metric;
@@ -369,6 +373,8 @@ use codex_protocol::protocol::CodexErrorInfo;
 use codex_protocol::protocol::InitialHistory;
 use codex_protocol::protocol::NonSteerableTurnKind;
 use codex_protocol::user_input::UserInput;
+use codex_tools::ToolsConfig;
+use codex_tools::ToolsConfigParams;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_readiness::Readiness;
 use codex_utils_readiness::ReadinessFlag;
@@ -806,7 +812,9 @@ pub(crate) struct Session {
     pending_mcp_server_refresh_config: Mutex<Option<McpServerRefreshConfig>>,
     pub(crate) conversation: Arc<RealtimeConversationManager>,
     pub(crate) active_turn: Mutex<Option<ActiveTurn>>,
-    idle_pending_input: Mutex<Vec<ResponseInputItem>>,
+    mailbox: Mailbox,
+    mailbox_rx: Mutex<MailboxReceiver>,
+    idle_pending_input: Mutex<Vec<ResponseInputItem>>, // TODO (jif) merge with mailbox!
     pub(crate) guardian_review_session: GuardianReviewSessionManager,
     pub(crate) services: SessionServices,
     js_repl: Arc<JsReplHandle>,
@@ -936,7 +944,9 @@ impl TurnContext {
         .with_unified_exec_shell_mode(self.tools_config.unified_exec_shell_mode.clone())
         .with_web_search_config(self.tools_config.web_search_config.clone())
         .with_allow_login_shell(self.tools_config.allow_login_shell)
-        .with_agent_roles(config.agent_roles.clone());
+        .with_agent_type_description(crate::agent::role::spawn_tool_spec::build(
+            &config.agent_roles,
+        ));
 
         Self {
             sub_id: self.sub_id.clone(),
@@ -1388,13 +1398,15 @@ impl Session {
             windows_sandbox_level: session_configuration.windows_sandbox_level,
         })
         .with_unified_exec_shell_mode_for_session(
-            user_shell,
+            crate::tools::spec::tool_user_shell_type(user_shell),
             shell_zsh_path,
             main_execve_wrapper_exe,
         )
         .with_web_search_config(per_turn_config.web_search_config.clone())
         .with_allow_login_shell(per_turn_config.permissions.allow_login_shell)
-        .with_agent_roles(per_turn_config.agent_roles.clone());
+        .with_agent_type_description(crate::agent::role::spawn_tool_spec::build(
+            &per_turn_config.agent_roles,
+        ));
 
         let cwd = session_configuration.cwd.clone();
 
@@ -1907,6 +1919,7 @@ impl Session {
         let (out_of_band_elicitation_paused, _out_of_band_elicitation_paused_rx) =
             watch::channel(false);
 
+        let (mailbox, mailbox_rx) = Mailbox::new();
         let sess = Arc::new(Session {
             conversation_id,
             tx_event: tx_event.clone(),
@@ -1917,6 +1930,8 @@ impl Session {
             pending_mcp_server_refresh_config: Mutex::new(None),
             conversation: Arc::new(RealtimeConversationManager::new()),
             active_turn: Mutex::new(None),
+            mailbox,
+            mailbox_rx: Mutex::new(mailbox_rx),
             idle_pending_input: Mutex::new(Vec::new()),
             guardian_review_session: GuardianReviewSessionManager::default(),
             services,
@@ -1985,6 +2000,7 @@ impl Session {
             config.mcp_oauth_credentials_store_mode,
             auth_statuses.clone(),
             &session_configuration.approval_policy,
+            INITIAL_SUBMIT_ID.to_owned(),
             tx_event.clone(),
             sandbox_state,
             config.codex_home.clone(),
@@ -2629,6 +2645,8 @@ impl Session {
             msg,
         };
         self.send_event_raw(event).await;
+        self.maybe_notify_parent_of_terminal_turn(turn_context, &legacy_source)
+            .await;
         self.maybe_mirror_event_text_to_realtime(&legacy_source)
             .await;
         self.maybe_clear_realtime_handoff_for_event(&legacy_source)
@@ -2644,6 +2662,73 @@ impl Session {
         }
     }
 
+    /// Forwards terminal turn events from spawned MultiAgentV2 children to their direct parent.
+    async fn maybe_notify_parent_of_terminal_turn(
+        &self,
+        turn_context: &TurnContext,
+        msg: &EventMsg,
+    ) {
+        if !self.enabled(Feature::MultiAgentV2) {
+            return;
+        }
+
+        if !matches!(msg, EventMsg::TurnComplete(_) | EventMsg::TurnAborted(_)) {
+            return;
+        }
+
+        let SessionSource::SubAgent(SubAgentSource::ThreadSpawn {
+            parent_thread_id,
+            agent_path: Some(child_agent_path),
+            ..
+        }) = &turn_context.session_source
+        else {
+            return;
+        };
+
+        let Some(status) = agent_status_from_event(msg) else {
+            return;
+        };
+        if !is_final(&status) {
+            return;
+        }
+
+        self.forward_child_completion_to_parent(*parent_thread_id, child_agent_path, status)
+            .await;
+    }
+
+    /// Sends the standard completion envelope from a spawned MultiAgentV2 child to its parent.
+    async fn forward_child_completion_to_parent(
+        &self,
+        parent_thread_id: ThreadId,
+        child_agent_path: &codex_protocol::AgentPath,
+        status: AgentStatus,
+    ) {
+        let Some(parent_agent_path) = child_agent_path
+            .as_str()
+            .rsplit_once('/')
+            .and_then(|(parent, _)| codex_protocol::AgentPath::try_from(parent).ok())
+        else {
+            return;
+        };
+
+        let message = format_subagent_notification_message(child_agent_path.as_str(), &status);
+        let communication = InterAgentCommunication::new(
+            child_agent_path.clone(),
+            parent_agent_path,
+            Vec::new(),
+            message,
+            /*trigger_turn*/ false,
+        );
+        if let Err(err) = self
+            .services
+            .agent_control
+            .send_inter_agent_communication(parent_thread_id, communication)
+            .await
+        {
+            debug!("failed to notify parent thread {parent_thread_id}: {err}");
+        }
+    }
+
     async fn maybe_mirror_event_text_to_realtime(&self, msg: &EventMsg) {
         let Some(text) = realtime_text_for_event(msg) else {
             return;
@@ -3957,6 +4042,18 @@ impl Session {
         }
     }
 
+    pub(crate) fn subscribe_mailbox_seq(&self) -> watch::Receiver<u64> {
+        self.mailbox.subscribe()
+    }
+
+    pub(crate) fn enqueue_mailbox_communication(&self, communication: InterAgentCommunication) {
+        self.mailbox.send(communication);
+    }
+
+    pub(crate) async fn has_trigger_turn_mailbox_items(&self) -> bool {
+        self.mailbox_rx.lock().await.has_pending_trigger_turn()
+    }
+
     pub async fn prepend_pending_input(&self, input: Vec<ResponseInputItem>) -> Result<(), ()> {
         let mut active = self.active_turn.lock().await;
         match active.as_mut() {
@@ -3970,17 +4067,37 @@ impl Session {
     }
 
     pub async fn get_pending_input(&self) -> Vec<ResponseInputItem> {
-        let mut active = self.active_turn.lock().await;
-        match active.as_mut() {
-            Some(at) => {
-                let mut ts = at.turn_state.lock().await;
-                ts.take_pending_input()
+        let pending_input = {
+            let mut active = self.active_turn.lock().await;
+            match active.as_mut() {
+                Some(at) => {
+                    let mut ts = at.turn_state.lock().await;
+                    ts.take_pending_input()
+                }
+                None => Vec::new(),
             }
-            None => Vec::with_capacity(0),
+        };
+        let mailbox_items = {
+            let mut mailbox_rx = self.mailbox_rx.lock().await;
+            mailbox_rx
+                .drain()
+                .into_iter()
+                .map(|mail| mail.to_response_input_item())
+                .collect::<Vec<_>>()
+        };
+        if pending_input.is_empty() {
+            mailbox_items
+        } else if mailbox_items.is_empty() {
+            pending_input
+        } else {
+            let mut pending_input = pending_input;
+            pending_input.extend(mailbox_items);
+            pending_input
         }
     }
 
     /// Queue response items to be injected into the next active turn created for this session.
+    #[cfg(test)]
     pub(crate) async fn queue_response_items_for_next_turn(&self, items: Vec<ResponseInputItem>) {
         if items.is_empty() {
             return;
@@ -3999,6 +4116,9 @@ impl Session {
     }
 
     pub async fn has_pending_input(&self) -> bool {
+        if self.mailbox_rx.lock().await.has_pending() {
+            return true;
+        }
         let active = self.active_turn.lock().await;
         match active.as_ref() {
             Some(at) => {
@@ -4131,16 +4251,12 @@ impl Session {
     ) {
         let auth = self.services.auth_manager.auth().await;
         let config = self.get_config().await;
+        let mcp_config = config.to_mcp_config(self.services.plugins_manager.as_ref());
         let tool_plugin_provenance = self
             .services
             .mcp_manager
             .tool_plugin_provenance(config.as_ref());
-        let mcp_servers = with_codex_apps_mcp(
-            mcp_servers,
-            self.features.apps_enabled_for_auth(auth.as_ref()),
-            auth.as_ref(),
-            config.as_ref(),
-        );
+        let mcp_servers = with_codex_apps_mcp(mcp_servers, auth.as_ref(), &mcp_config);
         let auth_statuses = compute_auth_statuses(mcp_servers.iter(), store_mode).await;
         let sandbox_state = SandboxState {
             sandbox_policy: turn_context.sandbox_policy.get().clone(),
@@ -4158,6 +4274,7 @@ impl Session {
             store_mode,
             auth_statuses,
             &turn_context.config.permissions.approval_policy,
+            turn_context.sub_id.clone(),
             self.get_tx_event(),
             sandbox_state,
             config.codex_home.clone(),
@@ -4500,8 +4617,6 @@ mod handlers {
     use codex_features::Feature;
     use codex_utils_absolute_path::AbsolutePathBuf;
 
-    use crate::mcp::auth::compute_auth_statuses;
-    use crate::mcp::collect_mcp_snapshot_from_manager;
     use crate::review_prompts::resolve_review_request;
     use crate::rollout::RolloutRecorder;
     use crate::rollout::session_index;
@@ -4510,6 +4625,8 @@ mod handlers {
     use crate::tasks::UserShellCommandMode;
     use crate::tasks::UserShellCommandTask;
     use crate::tasks::execute_user_shell_command;
+    use codex_mcp::mcp::auth::compute_auth_statuses;
+    use codex_mcp::mcp::collect_mcp_snapshot_from_manager;
     use codex_protocol::protocol::CodexErrorInfo;
     use codex_protocol::protocol::ErrorEvent;
     use codex_protocol::protocol::Event;
@@ -4657,25 +4774,17 @@ mod handlers {
         }
     }
 
-    /// Records an inter-agent assistant envelope and, when requested, wakes the recipient by
-    /// starting a regular turn if the session is currently idle.
+    /// Records an inter-agent assistant envelope, then lets the shared pending-work scheduler
+    /// decide whether an idle session should start a regular turn.
     pub async fn inter_agent_communication(
         sess: &Arc<Session>,
         sub_id: String,
         communication: InterAgentCommunication,
     ) {
-        let pending_item = communication.to_response_input_item();
-        if let Ok(()) = sess.inject_response_items(vec![pending_item.clone()]).await {
-            return;
-        }
-
-        sess.queue_response_items_for_next_turn(vec![pending_item])
-            .await;
-        if communication.trigger_turn {
-            let turn_context = sess.new_default_turn_with_sub_id(sub_id).await;
-            sess.maybe_emit_unknown_model_warning_for_turn(turn_context.as_ref())
-                .await;
-            sess.spawn_task(turn_context, Vec::new(), crate::tasks::RegularTask::new())
+        let trigger_turn = communication.trigger_turn;
+        sess.enqueue_mailbox_communication(communication);
+        if trigger_turn {
+            sess.maybe_start_turn_for_pending_work_with_sub_id(sub_id)
                 .await;
         }
     }
@@ -5361,13 +5470,15 @@ async fn spawn_review_thread(
         windows_sandbox_level: parent_turn_context.windows_sandbox_level,
     })
     .with_unified_exec_shell_mode_for_session(
-        sess.services.user_shell.as_ref(),
+        crate::tools::spec::tool_user_shell_type(sess.services.user_shell.as_ref()),
         sess.services.shell_zsh_path.as_ref(),
         sess.services.main_execve_wrapper_exe.as_ref(),
     )
     .with_web_search_config(/*web_search_config*/ None)
     .with_allow_login_shell(config.permissions.allow_login_shell)
-    .with_agent_roles(config.agent_roles.clone());
+    .with_agent_type_description(crate::agent::role::spawn_tool_spec::build(
+        &config.agent_roles,
+    ));
 
     let review_prompt = resolved.prompt.clone();
     let provider = parent_turn_context.provider.clone();
@@ -6511,7 +6622,7 @@ pub(crate) async fn built_tools(
             )
             .await
             .map(|discoverable_tools| {
-                crate::tools::discoverable::filter_tool_suggest_discoverable_tools_for_client(
+                filter_tool_suggest_discoverable_tools_for_client(
                     discoverable_tools,
                     turn_context.app_server_client_name.as_deref(),
                 )

codex-rs/core/src/codex_delegate.rs

@@ -516,7 +516,6 @@ async fn handle_patch_approval(
     } = event;
     let approval_id = call_id.clone();
     let guardian_decision = if routes_approval_to_guardian(parent_ctx) {
-        let change_count = changes.len();
         let maybe_files = changes
             .keys()
             .map(|path| parent_ctx.cwd.join(path).ok())
@@ -557,7 +556,6 @@ async fn handle_patch_approval(
                     id: approval_id.clone(),
                     cwd: parent_ctx.cwd.to_path_buf(),
                     files,
-                    change_count,
                     patch,
                 },
                 reason.clone(),

codex-rs/core/src/codex_delegate_tests.rs

@@ -9,8 +9,10 @@ use codex_protocol::protocol::AgentStatus;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ExecApprovalRequestEvent;
+use codex_protocol::protocol::GuardianAssessmentAction;
 use codex_protocol::protocol::GuardianAssessmentEvent;
 use codex_protocol::protocol::GuardianAssessmentStatus;
+use codex_protocol::protocol::GuardianCommandSource;
 use codex_protocol::protocol::McpInvocation;
 use codex_protocol::protocol::RawResponseItemEvent;
 use codex_protocol::protocol::ReviewDecision;
@@ -23,7 +25,6 @@ use codex_protocol::request_user_input::RequestUserInputAnswer;
 use codex_protocol::request_user_input::RequestUserInputEvent;
 use codex_protocol::request_user_input::RequestUserInputQuestion;
 use pretty_assertions::assert_eq;
-use serde_json::json;
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -317,11 +318,11 @@ async fn handle_exec_approval_uses_call_id_for_guardian_review_and_approval_id_f
             risk_score: None,
             risk_level: None,
             rationale: None,
-            action: Some(json!({
-                "tool": "shell",
-                "command": "rm -rf tmp",
-                "cwd": "/tmp",
-            })),
+            action: GuardianAssessmentAction::Command {
+                source: GuardianCommandSource::Shell,
+                command: "rm -rf tmp".to_string(),
+                cwd: "/tmp".into(),
+            },
         }
     );
 

codex-rs/core/src/codex_tests.rs

@@ -2654,11 +2654,9 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
 
     let skills_watcher = Arc::new(SkillsWatcher::noop());
     let services = SessionServices {
-        mcp_connection_manager: Arc::new(RwLock::new(
-            McpConnectionManager::new_mcp_connection_manager_for_tests(
-                &config.permissions.approval_policy,
-            ),
-        )),
+        mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
+            &config.permissions.approval_policy,
+        ))),
         mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
         unified_exec_manager: UnifiedExecProcessManager::new(
             config.background_terminal_max_timeout,
@@ -2737,6 +2735,7 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         skills_outcome,
     );
 
+    let (mailbox, mailbox_rx) = crate::agent::Mailbox::new();
     let session = Session {
         conversation_id,
         tx_event,
@@ -2747,6 +2746,8 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         pending_mcp_server_refresh_config: Mutex::new(None),
         conversation: Arc::new(RealtimeConversationManager::new()),
         active_turn: Mutex::new(None),
+        mailbox,
+        mailbox_rx: Mutex::new(mailbox_rx),
         idle_pending_input: Mutex::new(Vec::new()),
         guardian_review_session: crate::guardian::GuardianReviewSessionManager::default(),
         services,
@@ -3494,11 +3495,9 @@ pub(crate) async fn make_session_and_context_with_dynamic_tools_and_rx(
 
     let skills_watcher = Arc::new(SkillsWatcher::noop());
     let services = SessionServices {
-        mcp_connection_manager: Arc::new(RwLock::new(
-            McpConnectionManager::new_mcp_connection_manager_for_tests(
-                &config.permissions.approval_policy,
-            ),
-        )),
+        mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
+            &config.permissions.approval_policy,
+        ))),
         mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
         unified_exec_manager: UnifiedExecProcessManager::new(
             config.background_terminal_max_timeout,
@@ -3577,6 +3576,7 @@ pub(crate) async fn make_session_and_context_with_dynamic_tools_and_rx(
         skills_outcome,
     ));
 
+    let (mailbox, mailbox_rx) = crate::agent::Mailbox::new();
     let session = Arc::new(Session {
         conversation_id,
         tx_event,
@@ -3587,6 +3587,8 @@ pub(crate) async fn make_session_and_context_with_dynamic_tools_and_rx(
         pending_mcp_server_refresh_config: Mutex::new(None),
         conversation: Arc::new(RealtimeConversationManager::new()),
         active_turn: Mutex::new(None),
+        mailbox,
+        mailbox_rx: Mutex::new(mailbox_rx),
         idle_pending_input: Mutex::new(Vec::new()),
         guardian_review_session: crate::guardian::GuardianReviewSessionManager::default(),
         services,

codex-rs/core/src/codex_thread.rs

@@ -180,10 +180,7 @@ impl CodexThread {
                 .session
                 .queue_response_items_for_next_turn(items)
                 .await;
-            self.codex
-                .session
-                .ensure_task_for_queued_response_items()
-                .await;
+            self.codex.session.maybe_start_turn_for_pending_work().await;
         }
 
         Ok(submission_id)

codex-rs/core/src/config/config_tests.rs

@@ -15,6 +15,7 @@ use crate::config::types::NotificationMethod;
 use crate::config::types::Notifications;
 use crate::config::types::ToolSuggestDiscoverableType;
 use crate::config_loader::RequirementSource;
+use crate::plugins::PluginsManager;
 use assert_matches::assert_matches;
 use codex_config::CONFIG_TOML_FILE;
 use codex_features::Feature;
@@ -243,6 +244,26 @@ web_search = false
     );
 }
 
+#[test]
+fn rejects_provider_auth_with_env_key() {
+    let err = toml::from_str::<ConfigToml>(
+        r#"
+[model_providers.corp]
+name = "Corp"
+env_key = "CORP_TOKEN"
+
+[model_providers.corp.auth]
+command = "print-token"
+"#,
+    )
+    .unwrap_err();
+
+    assert!(
+        err.to_string()
+            .contains("model_providers.corp: provider auth cannot be combined with env_key")
+    );
+}
+
 #[test]
 fn config_toml_deserializes_model_availability_nux() {
     let toml = r#"
@@ -2047,6 +2068,30 @@ approval_mode = "approve"
     );
 }
 
+#[test]
+fn to_mcp_config_preserves_apps_feature_from_config() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+    let mut config = Config::load_from_base_config_with_overrides(
+        ConfigToml::default(),
+        ConfigOverrides::default(),
+        codex_home.path().to_path_buf(),
+    )?;
+    let plugins_manager = PluginsManager::new(codex_home.path().to_path_buf());
+
+    let mcp_config = config.to_mcp_config(&plugins_manager);
+    assert!(mcp_config.apps_enabled);
+
+    let _ = config.features.disable(Feature::Apps);
+    let mcp_config = config.to_mcp_config(&plugins_manager);
+    assert!(!mcp_config.apps_enabled);
+
+    let _ = config.features.enable(Feature::Apps);
+    let mcp_config = config.to_mcp_config(&plugins_manager);
+    assert!(mcp_config.apps_enabled);
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn load_global_mcp_servers_rejects_inline_bearer_token() -> anyhow::Result<()> {
     let codex_home = TempDir::new()?;
@@ -4315,6 +4360,7 @@ model_verbosity = "high"
         wire_api: crate::WireApi::Responses,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         query_params: None,
         http_headers: None,
         env_http_headers: None,

codex-rs/core/src/config/mod.rs

@@ -66,6 +66,7 @@ use codex_features::FeatureOverrides;
 use codex_features::Features;
 use codex_features::FeaturesToml;
 use codex_git_utils::resolve_root_git_project_for_trust;
+use codex_mcp::mcp::McpConfig;
 use codex_protocol::config_types::AltScreenMode;
 use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::Personality;
@@ -683,6 +684,31 @@ impl ConfigBuilder {
 }
 
 impl Config {
+    pub fn to_mcp_config(&self, plugins_manager: &crate::plugins::PluginsManager) -> McpConfig {
+        let loaded_plugins = plugins_manager.plugins_for_config(self);
+        let mut configured_mcp_servers = self.mcp_servers.get().clone();
+        for (name, plugin_server) in loaded_plugins.effective_mcp_servers() {
+            configured_mcp_servers.entry(name).or_insert(plugin_server);
+        }
+
+        McpConfig {
+            chatgpt_base_url: self.chatgpt_base_url.clone(),
+            codex_home: self.codex_home.clone(),
+            mcp_oauth_credentials_store_mode: self.mcp_oauth_credentials_store_mode,
+            mcp_oauth_callback_port: self.mcp_oauth_callback_port,
+            mcp_oauth_callback_url: self.mcp_oauth_callback_url.clone(),
+            skill_mcp_dependency_install_enabled: self
+                .features
+                .enabled(Feature::SkillMcpDependencyInstall),
+            approval_policy: self.permissions.approval_policy.clone(),
+            codex_linux_sandbox_exe: self.codex_linux_sandbox_exe.clone(),
+            use_legacy_landlock: self.features.use_legacy_landlock(),
+            apps_enabled: self.features.enabled(Feature::Apps),
+            configured_mcp_servers,
+            plugin_capability_summaries: loaded_plugins.capability_summaries().to_vec(),
+        }
+    }
+
     /// This is the preferred way to create an instance of [Config].
     pub async fn load_with_cli_overrides(
         cli_overrides: Vec<(String, TomlValue)>,
@@ -698,6 +724,15 @@ impl Config {
         cli_overrides: Vec<(String, TomlValue)>,
     ) -> std::io::Result<Self> {
         let codex_home = find_codex_home()?;
+        Self::load_default_with_cli_overrides_for_codex_home(codex_home, cli_overrides)
+    }
+
+    /// Load a default configuration for a specific Codex home without reading
+    /// user, project, or system config layers.
+    pub fn load_default_with_cli_overrides_for_codex_home(
+        codex_home: PathBuf,
+        cli_overrides: Vec<(String, TomlValue)>,
+    ) -> std::io::Result<Self> {
         let mut merged = toml::Value::try_from(ConfigToml::default()).map_err(|e| {
             std::io::Error::new(
                 std::io::ErrorKind::InvalidData,
@@ -1837,6 +1872,18 @@ Built-in providers cannot be overridden. Rename your custom provider (for exampl
     }
 }
 
+fn validate_model_providers(
+    model_providers: &HashMap<String, ModelProviderInfo>,
+) -> Result<(), String> {
+    validate_reserved_model_provider_ids(model_providers)?;
+    for (key, provider) in model_providers {
+        provider
+            .validate()
+            .map_err(|message| format!("model_providers.{key}: {message}"))?;
+    }
+    Ok(())
+}
+
 fn deserialize_model_providers<'de, D>(
     deserializer: D,
 ) -> Result<HashMap<String, ModelProviderInfo>, D::Error>
@@ -1844,7 +1891,7 @@ where
     D: serde::Deserializer<'de>,
 {
     let model_providers = HashMap::<String, ModelProviderInfo>::deserialize(deserializer)?;
-    validate_reserved_model_provider_ids(&model_providers).map_err(serde::de::Error::custom)?;
+    validate_model_providers(&model_providers).map_err(serde::de::Error::custom)?;
     Ok(model_providers)
 }
 
@@ -1969,7 +2016,7 @@ impl Config {
         codex_home: PathBuf,
         config_layer_stack: ConfigLayerStack,
     ) -> std::io::Result<Self> {
-        validate_reserved_model_provider_ids(&cfg.model_providers)
+        validate_model_providers(&cfg.model_providers)
             .map_err(|message| std::io::Error::new(std::io::ErrorKind::InvalidInput, message))?;
         // Ensure that every field of ConfigRequirements is applied to the final
         // Config.

codex-rs/core/src/config/types.rs

@@ -3,7 +3,12 @@
 // Note this file should generally be restricted to simple struct/enum
 // definitions that do not contain business logic.
 
-use crate::config_loader::RequirementSource;
+pub use codex_config::AppToolApproval;
+pub use codex_config::McpServerConfig;
+pub use codex_config::McpServerDisabledReason;
+pub use codex_config::McpServerToolConfig;
+pub use codex_config::McpServerTransportConfig;
+pub use codex_config::RawMcpServerConfig;
 pub use codex_protocol::config_types::AltScreenMode;
 pub use codex_protocol::config_types::ApprovalsReviewer;
 pub use codex_protocol::config_types::ModeKind;
@@ -14,15 +19,11 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::fmt;
-use std::path::PathBuf;
-use std::time::Duration;
 use wildmatch::WildMatchPattern;
 
 use schemars::JsonSchema;
 use serde::Deserialize;
-use serde::Deserializer;
 use serde::Serialize;
-use serde::de::Error as SerdeError;
 
 pub const DEFAULT_OTEL_ENVIRONMENT: &str = "dev";
 pub const DEFAULT_MEMORIES_MAX_ROLLOUTS_PER_STARTUP: usize = 16;
@@ -31,6 +32,10 @@ pub const DEFAULT_MEMORIES_MIN_ROLLOUT_IDLE_HOURS: i64 = 6;
 pub const DEFAULT_MEMORIES_MAX_RAW_MEMORIES_FOR_CONSOLIDATION: usize = 256;
 pub const DEFAULT_MEMORIES_MAX_UNUSED_DAYS: i64 = 30;
 
+const fn default_enabled() -> bool {
+    true
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub enum WindowsSandboxModeToml {
@@ -47,272 +52,6 @@ pub struct WindowsToml {
     pub sandbox_private_desktop: Option<bool>,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum McpServerDisabledReason {
-    Unknown,
-    Requirements { source: RequirementSource },
-}
-
-impl fmt::Display for McpServerDisabledReason {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            McpServerDisabledReason::Unknown => write!(f, "unknown"),
-            McpServerDisabledReason::Requirements { source } => {
-                write!(f, "requirements ({source})")
-            }
-        }
-    }
-}
-
-#[derive(Serialize, Debug, Clone, PartialEq)]
-pub struct McpServerConfig {
-    #[serde(flatten)]
-    pub transport: McpServerTransportConfig,
-
-    /// When `false`, Codex skips initializing this MCP server.
-    #[serde(default = "default_enabled")]
-    pub enabled: bool,
-
-    /// When `true`, `codex exec` exits with an error if this MCP server fails to initialize.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub required: bool,
-
-    /// Reason this server was disabled after applying requirements.
-    #[serde(skip)]
-    pub disabled_reason: Option<McpServerDisabledReason>,
-
-    /// Startup timeout in seconds for initializing MCP server & initially listing tools.
-    #[serde(
-        default,
-        with = "option_duration_secs",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub startup_timeout_sec: Option<Duration>,
-
-    /// Default timeout for MCP tool calls initiated via this server.
-    #[serde(default, with = "option_duration_secs")]
-    pub tool_timeout_sec: Option<Duration>,
-
-    /// Explicit allow-list of tools exposed from this server. When set, only these tools will be registered.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub enabled_tools: Option<Vec<String>>,
-
-    /// Explicit deny-list of tools. These tools will be removed after applying `enabled_tools`.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disabled_tools: Option<Vec<String>>,
-
-    /// Optional OAuth scopes to request during MCP login.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub scopes: Option<Vec<String>>,
-
-    /// Optional OAuth resource parameter to include during MCP login (RFC 8707).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub oauth_resource: Option<String>,
-
-    /// Per-tool approval settings keyed by tool name.
-    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
-    pub tools: HashMap<String, McpServerToolConfig>,
-}
-
-// Raw MCP config shape used for deserialization and JSON Schema generation.
-// Keep this in sync with the validation logic in `McpServerConfig`.
-#[derive(Deserialize, Clone, JsonSchema)]
-#[schemars(deny_unknown_fields)]
-pub(crate) struct RawMcpServerConfig {
-    // stdio
-    pub command: Option<String>,
-    #[serde(default)]
-    pub args: Option<Vec<String>>,
-    #[serde(default)]
-    pub env: Option<HashMap<String, String>>,
-    #[serde(default)]
-    pub env_vars: Option<Vec<String>>,
-    #[serde(default)]
-    pub cwd: Option<PathBuf>,
-    pub http_headers: Option<HashMap<String, String>>,
-    #[serde(default)]
-    pub env_http_headers: Option<HashMap<String, String>>,
-
-    // streamable_http
-    pub url: Option<String>,
-    pub bearer_token: Option<String>,
-    pub bearer_token_env_var: Option<String>,
-
-    // shared
-    #[serde(default)]
-    pub startup_timeout_sec: Option<f64>,
-    #[serde(default)]
-    pub startup_timeout_ms: Option<u64>,
-    #[serde(default, with = "option_duration_secs")]
-    #[schemars(with = "Option<f64>")]
-    pub tool_timeout_sec: Option<Duration>,
-    #[serde(default)]
-    pub enabled: Option<bool>,
-    #[serde(default)]
-    pub required: Option<bool>,
-    #[serde(default)]
-    pub enabled_tools: Option<Vec<String>>,
-    #[serde(default)]
-    pub disabled_tools: Option<Vec<String>>,
-    #[serde(default)]
-    pub scopes: Option<Vec<String>>,
-    #[serde(default)]
-    pub oauth_resource: Option<String>,
-    /// Legacy display-name field accepted for backward compatibility.
-    #[serde(default, rename = "name")]
-    pub _name: Option<String>,
-    #[serde(default)]
-    pub tools: Option<HashMap<String, McpServerToolConfig>>,
-}
-
-impl<'de> Deserialize<'de> for McpServerConfig {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let mut raw = RawMcpServerConfig::deserialize(deserializer)?;
-
-        let startup_timeout_sec = match (raw.startup_timeout_sec, raw.startup_timeout_ms) {
-            (Some(sec), _) => {
-                let duration = Duration::try_from_secs_f64(sec).map_err(SerdeError::custom)?;
-                Some(duration)
-            }
-            (None, Some(ms)) => Some(Duration::from_millis(ms)),
-            (None, None) => None,
-        };
-        let tool_timeout_sec = raw.tool_timeout_sec;
-        let enabled = raw.enabled.unwrap_or_else(default_enabled);
-        let required = raw.required.unwrap_or_default();
-        let enabled_tools = raw.enabled_tools.clone();
-        let disabled_tools = raw.disabled_tools.clone();
-        let scopes = raw.scopes.clone();
-        let oauth_resource = raw.oauth_resource.clone();
-        let tools = raw.tools.clone().unwrap_or_default();
-
-        fn throw_if_set<E, T>(transport: &str, field: &str, value: Option<&T>) -> Result<(), E>
-        where
-            E: SerdeError,
-        {
-            if value.is_none() {
-                return Ok(());
-            }
-            Err(E::custom(format!(
-                "{field} is not supported for {transport}",
-            )))
-        }
-
-        let transport = if let Some(command) = raw.command.clone() {
-            throw_if_set("stdio", "url", raw.url.as_ref())?;
-            throw_if_set(
-                "stdio",
-                "bearer_token_env_var",
-                raw.bearer_token_env_var.as_ref(),
-            )?;
-            throw_if_set("stdio", "bearer_token", raw.bearer_token.as_ref())?;
-            throw_if_set("stdio", "http_headers", raw.http_headers.as_ref())?;
-            throw_if_set("stdio", "env_http_headers", raw.env_http_headers.as_ref())?;
-            throw_if_set("stdio", "oauth_resource", raw.oauth_resource.as_ref())?;
-            McpServerTransportConfig::Stdio {
-                command,
-                args: raw.args.clone().unwrap_or_default(),
-                env: raw.env.clone(),
-                env_vars: raw.env_vars.clone().unwrap_or_default(),
-                cwd: raw.cwd.take(),
-            }
-        } else if let Some(url) = raw.url.clone() {
-            throw_if_set("streamable_http", "args", raw.args.as_ref())?;
-            throw_if_set("streamable_http", "env", raw.env.as_ref())?;
-            throw_if_set("streamable_http", "env_vars", raw.env_vars.as_ref())?;
-            throw_if_set("streamable_http", "cwd", raw.cwd.as_ref())?;
-            throw_if_set("streamable_http", "bearer_token", raw.bearer_token.as_ref())?;
-            McpServerTransportConfig::StreamableHttp {
-                url,
-                bearer_token_env_var: raw.bearer_token_env_var.clone(),
-                http_headers: raw.http_headers.clone(),
-                env_http_headers: raw.env_http_headers.take(),
-            }
-        } else {
-            return Err(SerdeError::custom("invalid transport"));
-        };
-
-        Ok(Self {
-            transport,
-            startup_timeout_sec,
-            tool_timeout_sec,
-            enabled,
-            required,
-            disabled_reason: None,
-            enabled_tools,
-            disabled_tools,
-            scopes,
-            oauth_resource,
-            tools,
-        })
-    }
-}
-
-const fn default_enabled() -> bool {
-    true
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema)]
-#[serde(untagged, deny_unknown_fields, rename_all = "snake_case")]
-pub enum McpServerTransportConfig {
-    /// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#stdio
-    Stdio {
-        command: String,
-        #[serde(default)]
-        args: Vec<String>,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        env: Option<HashMap<String, String>>,
-        #[serde(default, skip_serializing_if = "Vec::is_empty")]
-        env_vars: Vec<String>,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        cwd: Option<PathBuf>,
-    },
-    /// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http
-    StreamableHttp {
-        url: String,
-        /// Name of the environment variable to read for an HTTP bearer token.
-        /// When set, requests will include the token via `Authorization: Bearer <token>`.
-        /// The actual secret value must be provided via the environment.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        bearer_token_env_var: Option<String>,
-        /// Additional HTTP headers to include in requests to this server.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        http_headers: Option<HashMap<String, String>>,
-        /// HTTP headers where the value is sourced from an environment variable.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        env_http_headers: Option<HashMap<String, String>>,
-    },
-}
-
-mod option_duration_secs {
-    use serde::Deserialize;
-    use serde::Deserializer;
-    use serde::Serializer;
-    use std::time::Duration;
-
-    pub fn serialize<S>(value: &Option<Duration>, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        match value {
-            Some(duration) => serializer.serialize_some(&duration.as_secs_f64()),
-            None => serializer.serialize_none(),
-        }
-    }
-
-    pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<Duration>, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let secs = Option::<f64>::deserialize(deserializer)?;
-        secs.map(|secs| Duration::try_from_secs_f64(secs).map_err(serde::de::Error::custom))
-            .transpose()
-    }
-}
-
 #[derive(Serialize, Deserialize, Debug, Copy, Clone, PartialEq, JsonSchema)]
 pub enum UriBasedFileOpener {
     #[serde(rename = "vscode")]
@@ -498,24 +237,6 @@ impl From<MemoriesToml> for MemoriesConfig {
     }
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum AppToolApproval {
-    #[default]
-    Auto,
-    Prompt,
-    Approve,
-}
-
-/// Per-tool approval settings for a single MCP server tool.
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Default, JsonSchema)]
-#[schemars(deny_unknown_fields)]
-pub struct McpServerToolConfig {
-    /// Approval mode for this tool.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub approval_mode: Option<AppToolApproval>,
-}
-
 /// Default settings that apply to all apps.
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Default, JsonSchema)]
 #[schemars(deny_unknown_fields)]

codex-rs/core/src/config/types_tests.rs

@@ -1,282 +1,6 @@
 use super::*;
 use pretty_assertions::assert_eq;
 
-#[test]
-fn deserialize_stdio_command_server_config() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-        "#,
-    )
-    .expect("should deserialize command config");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::Stdio {
-            command: "echo".to_string(),
-            args: vec![],
-            env: None,
-            env_vars: Vec::new(),
-            cwd: None,
-        }
-    );
-    assert!(cfg.enabled);
-    assert!(!cfg.required);
-    assert!(cfg.enabled_tools.is_none());
-    assert!(cfg.disabled_tools.is_none());
-}
-
-#[test]
-fn deserialize_stdio_command_server_config_with_args() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            args = ["hello", "world"]
-        "#,
-    )
-    .expect("should deserialize command config");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::Stdio {
-            command: "echo".to_string(),
-            args: vec!["hello".to_string(), "world".to_string()],
-            env: None,
-            env_vars: Vec::new(),
-            cwd: None,
-        }
-    );
-    assert!(cfg.enabled);
-}
-
-#[test]
-fn deserialize_stdio_command_server_config_with_arg_with_args_and_env() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            args = ["hello", "world"]
-            env = { "FOO" = "BAR" }
-        "#,
-    )
-    .expect("should deserialize command config");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::Stdio {
-            command: "echo".to_string(),
-            args: vec!["hello".to_string(), "world".to_string()],
-            env: Some(HashMap::from([("FOO".to_string(), "BAR".to_string())])),
-            env_vars: Vec::new(),
-            cwd: None,
-        }
-    );
-    assert!(cfg.enabled);
-}
-
-#[test]
-fn deserialize_stdio_command_server_config_with_env_vars() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            env_vars = ["FOO", "BAR"]
-        "#,
-    )
-    .expect("should deserialize command config with env_vars");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::Stdio {
-            command: "echo".to_string(),
-            args: vec![],
-            env: None,
-            env_vars: vec!["FOO".to_string(), "BAR".to_string()],
-            cwd: None,
-        }
-    );
-}
-
-#[test]
-fn deserialize_stdio_command_server_config_with_cwd() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            cwd = "/tmp"
-        "#,
-    )
-    .expect("should deserialize command config with cwd");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::Stdio {
-            command: "echo".to_string(),
-            args: vec![],
-            env: None,
-            env_vars: Vec::new(),
-            cwd: Some(PathBuf::from("/tmp")),
-        }
-    );
-}
-
-#[test]
-fn deserialize_disabled_server_config() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            enabled = false
-        "#,
-    )
-    .expect("should deserialize disabled server config");
-
-    assert!(!cfg.enabled);
-    assert!(!cfg.required);
-}
-
-#[test]
-fn deserialize_required_server_config() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            required = true
-        "#,
-    )
-    .expect("should deserialize required server config");
-
-    assert!(cfg.required);
-}
-
-#[test]
-fn deserialize_streamable_http_server_config() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            url = "https://example.com/mcp"
-        "#,
-    )
-    .expect("should deserialize http config");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::StreamableHttp {
-            url: "https://example.com/mcp".to_string(),
-            bearer_token_env_var: None,
-            http_headers: None,
-            env_http_headers: None,
-        }
-    );
-    assert!(cfg.enabled);
-}
-
-#[test]
-fn deserialize_streamable_http_server_config_with_env_var() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            url = "https://example.com/mcp"
-            bearer_token_env_var = "GITHUB_TOKEN"
-        "#,
-    )
-    .expect("should deserialize http config");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::StreamableHttp {
-            url: "https://example.com/mcp".to_string(),
-            bearer_token_env_var: Some("GITHUB_TOKEN".to_string()),
-            http_headers: None,
-            env_http_headers: None,
-        }
-    );
-    assert!(cfg.enabled);
-}
-
-#[test]
-fn deserialize_streamable_http_server_config_with_headers() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            url = "https://example.com/mcp"
-            http_headers = { "X-Foo" = "bar" }
-            env_http_headers = { "X-Token" = "TOKEN_ENV" }
-        "#,
-    )
-    .expect("should deserialize http config with headers");
-
-    assert_eq!(
-        cfg.transport,
-        McpServerTransportConfig::StreamableHttp {
-            url: "https://example.com/mcp".to_string(),
-            bearer_token_env_var: None,
-            http_headers: Some(HashMap::from([("X-Foo".to_string(), "bar".to_string())])),
-            env_http_headers: Some(HashMap::from([(
-                "X-Token".to_string(),
-                "TOKEN_ENV".to_string()
-            )])),
-        }
-    );
-}
-
-#[test]
-fn deserialize_streamable_http_server_config_with_oauth_resource() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            url = "https://example.com/mcp"
-            oauth_resource = "https://api.example.com"
-        "#,
-    )
-    .expect("should deserialize http config with oauth_resource");
-
-    assert_eq!(
-        cfg.oauth_resource,
-        Some("https://api.example.com".to_string())
-    );
-}
-
-#[test]
-fn deserialize_server_config_with_tool_filters() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            enabled_tools = ["allowed"]
-            disabled_tools = ["blocked"]
-        "#,
-    )
-    .expect("should deserialize tool filters");
-
-    assert_eq!(cfg.enabled_tools, Some(vec!["allowed".to_string()]));
-    assert_eq!(cfg.disabled_tools, Some(vec!["blocked".to_string()]));
-}
-
-#[test]
-fn deserialize_ignores_unknown_server_fields() {
-    let cfg: McpServerConfig = toml::from_str(
-        r#"
-            command = "echo"
-            trust_level = "trusted"
-        "#,
-    )
-    .expect("should ignore unknown server fields");
-
-    assert_eq!(
-        cfg,
-        McpServerConfig {
-            transport: McpServerTransportConfig::Stdio {
-                command: "echo".to_string(),
-                args: vec![],
-                env: None,
-                env_vars: Vec::new(),
-                cwd: None,
-            },
-            enabled: true,
-            required: false,
-            disabled_reason: None,
-            startup_timeout_sec: None,
-            tool_timeout_sec: None,
-            enabled_tools: None,
-            disabled_tools: None,
-            scopes: None,
-            oauth_resource: None,
-            tools: HashMap::new(),
-        }
-    );
-}
-
 #[test]
 fn deserialize_skill_config_with_name_selector() {
     let cfg: SkillConfig = toml::from_str(
@@ -317,74 +41,3 @@ fn deserialize_skill_config_with_path_selector() {
         }
     );
 }
-
-#[test]
-fn deserialize_rejects_command_and_url() {
-    toml::from_str::<McpServerConfig>(
-        r#"
-            command = "echo"
-            url = "https://example.com"
-        "#,
-    )
-    .expect_err("should reject command+url");
-}
-
-#[test]
-fn deserialize_rejects_env_for_http_transport() {
-    toml::from_str::<McpServerConfig>(
-        r#"
-            url = "https://example.com"
-            env = { "FOO" = "BAR" }
-        "#,
-    )
-    .expect_err("should reject env for http transport");
-}
-
-#[test]
-fn deserialize_rejects_headers_for_stdio() {
-    toml::from_str::<McpServerConfig>(
-        r#"
-            command = "echo"
-            http_headers = { "X-Foo" = "bar" }
-        "#,
-    )
-    .expect_err("should reject http_headers for stdio transport");
-
-    toml::from_str::<McpServerConfig>(
-        r#"
-            command = "echo"
-            env_http_headers = { "X-Foo" = "BAR_ENV" }
-        "#,
-    )
-    .expect_err("should reject env_http_headers for stdio transport");
-
-    let err = toml::from_str::<McpServerConfig>(
-        r#"
-            command = "echo"
-            oauth_resource = "https://api.example.com"
-        "#,
-    )
-    .expect_err("should reject oauth_resource for stdio transport");
-
-    assert!(
-        err.to_string()
-            .contains("oauth_resource is not supported for stdio"),
-        "unexpected error: {err}"
-    );
-}
-
-#[test]
-fn deserialize_rejects_inline_bearer_token_field() {
-    let err = toml::from_str::<McpServerConfig>(
-        r#"
-            url = "https://example.com"
-            bearer_token = "secret"
-        "#,
-    )
-    .expect_err("should reject bearer_token field");
-
-    assert!(
-        err.to_string().contains("bearer_token is not supported"),
-        "unexpected error: {err}"
-    );
-}

codex-rs/core/src/connectors.rs

@@ -18,6 +18,7 @@ use codex_connectors::AllConnectorsCacheKey;
 use codex_connectors::DirectoryListResponse;
 use codex_login::token_data::TokenData;
 use codex_protocol::protocol::SandboxPolicy;
+use codex_tools::DiscoverableTool;
 use rmcp::model::ToolAnnotations;
 use serde::Deserialize;
 use serde::de::DeserializeOwned;
@@ -26,6 +27,7 @@ use tracing::warn;
 use crate::AuthManager;
 use crate::CodexAuth;
 use crate::SandboxState;
+use crate::codex::INITIAL_SUBMIT_ID;
 use crate::config::Config;
 use crate::config::types::AppToolApproval;
 use crate::config::types::AppsConfigToml;
@@ -44,8 +46,6 @@ use crate::mcp_connection_manager::codex_apps_tools_cache_key;
 use crate::plugins::AppConnectorId;
 use crate::plugins::PluginsManager;
 use crate::plugins::list_tool_suggest_discoverable_plugins;
-use crate::tools::discoverable::DiscoverablePluginInfo;
-use crate::tools::discoverable::DiscoverableTool;
 use codex_features::Feature;
 
 pub use codex_connectors::CONNECTORS_CACHE_TTL;
@@ -133,7 +133,6 @@ pub(crate) async fn list_tool_suggest_discoverable_tools_with_auth(
     .map(DiscoverableTool::from);
     let discoverable_plugins = list_tool_suggest_discoverable_plugins(config)?
         .into_iter()
-        .map(DiscoverablePluginInfo::from)
         .map(DiscoverableTool::from);
     Ok(discoverable_connectors
         .chain(discoverable_plugins)
@@ -191,7 +190,8 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
         });
     }
     let cache_key = accessible_connectors_cache_key(config, auth.as_ref());
-    let mcp_manager = McpManager::new(Arc::new(PluginsManager::new(config.codex_home.clone())));
+    let plugins_manager = Arc::new(PluginsManager::new(config.codex_home.clone()));
+    let mcp_manager = McpManager::new(Arc::clone(&plugins_manager));
     let tool_plugin_provenance = mcp_manager.tool_plugin_provenance(config);
     if !force_refetch && let Some(cached_connectors) = read_cached_accessible_connectors(&cache_key)
     {
@@ -203,12 +203,8 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
         });
     }
 
-    let mcp_servers = with_codex_apps_mcp(
-        HashMap::new(),
-        /*connectors_enabled*/ true,
-        auth.as_ref(),
-        config,
-    );
+    let mcp_config = config.to_mcp_config(plugins_manager.as_ref());
+    let mcp_servers = with_codex_apps_mcp(HashMap::new(), auth.as_ref(), &mcp_config);
     if mcp_servers.is_empty() {
         return Ok(AccessibleConnectorsStatus {
             connectors: Vec::new(),
@@ -234,6 +230,7 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
         config.mcp_oauth_credentials_store_mode,
         auth_status_entries,
         &config.permissions.approval_policy,
+        INITIAL_SUBMIT_ID.to_owned(),
         tx_event,
         sandbox_state,
         config.codex_home.clone(),
@@ -719,10 +716,6 @@ pub fn filter_disallowed_connectors(connectors: Vec<AppInfo>) -> Vec<AppInfo> {
     filter_disallowed_connectors_for_originator(connectors, originator().value.as_str())
 }
 
-pub(crate) fn is_connector_id_allowed(connector_id: &str) -> bool {
-    is_connector_id_allowed_for_originator(connector_id, originator().value.as_str())
-}
-
 fn filter_disallowed_connectors_for_originator(
     connectors: Vec<AppInfo>,
     originator_value: &str,

codex-rs/core/src/exec.rs

@@ -314,7 +314,6 @@ pub fn build_exec_request(
 
 pub(crate) async fn execute_exec_request(
     exec_request: ExecRequest,
-    sandbox_policy: &SandboxPolicy,
     stdout_stream: Option<StdoutStream>,
     after_spawn: Option<Box<dyn FnOnce() + Send>>,
 ) -> Result<ExecToolCallOutput> {
@@ -328,13 +327,12 @@ pub(crate) async fn execute_exec_request(
         sandbox,
         windows_sandbox_level,
         windows_sandbox_private_desktop,
-        sandbox_policy: _sandbox_policy_from_env,
+        sandbox_policy,
         file_system_sandbox_policy,
         network_sandbox_policy,
         windows_restricted_token_filesystem_overlay,
         arg0,
     } = exec_request;
-    let _ = _sandbox_policy_from_env;
 
     let params = ExecParams {
         command,
@@ -354,7 +352,7 @@ pub(crate) async fn execute_exec_request(
     let raw_output_result = exec(
         params,
         sandbox,
-        sandbox_policy,
+        &sandbox_policy,
         &file_system_sandbox_policy,
         windows_restricted_token_filesystem_overlay.as_ref(),
         network_sandbox_policy,

codex-rs/core/src/guardian/approval_request.rs

@@ -1,5 +1,8 @@
+use std::path::Path;
 use std::path::PathBuf;
 
+use codex_protocol::approvals::GuardianAssessmentAction;
+use codex_protocol::approvals::GuardianCommandSource;
 use codex_protocol::approvals::NetworkApprovalProtocol;
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -31,7 +34,7 @@ pub(crate) enum GuardianApprovalRequest {
     #[cfg(unix)]
     Execve {
         id: String,
-        tool_name: String,
+        source: GuardianCommandSource,
         program: String,
         argv: Vec<String>,
         cwd: PathBuf,
@@ -41,7 +44,6 @@ pub(crate) enum GuardianApprovalRequest {
         id: String,
         cwd: PathBuf,
         files: Vec<AbsolutePathBuf>,
-        change_count: usize,
         patch: String,
     },
     NetworkAccess {
@@ -80,7 +82,7 @@ pub(crate) struct GuardianMcpAnnotations {
 struct CommandApprovalAction<'a> {
     tool: &'a str,
     command: &'a [String],
-    cwd: &'a PathBuf,
+    cwd: &'a Path,
     sandbox_permissions: crate::sandboxing::SandboxPermissions,
     #[serde(skip_serializing_if = "Option::is_none")]
     additional_permissions: Option<&'a PermissionProfile>,
@@ -96,7 +98,7 @@ struct ExecveApprovalAction<'a> {
     tool: &'a str,
     program: &'a str,
     argv: &'a [String],
-    cwd: &'a PathBuf,
+    cwd: &'a Path,
     #[serde(skip_serializing_if = "Option::is_none")]
     additional_permissions: Option<&'a PermissionProfile>,
 }
@@ -129,7 +131,7 @@ fn serialize_guardian_action(value: impl Serialize) -> serde_json::Result<Value>
 fn serialize_command_guardian_action(
     tool: &'static str,
     command: &[String],
-    cwd: &PathBuf,
+    cwd: &Path,
     sandbox_permissions: crate::sandboxing::SandboxPermissions,
     additional_permissions: Option<&PermissionProfile>,
     justification: Option<&String>,
@@ -146,12 +148,24 @@ fn serialize_command_guardian_action(
     })
 }
 
-fn command_assessment_action_value(tool: &'static str, command: &[String], cwd: &PathBuf) -> Value {
-    serde_json::json!({
-        "tool": tool,
-        "command": codex_shell_command::parse_command::shlex_join(command),
-        "cwd": cwd,
-    })
+fn command_assessment_action(
+    source: GuardianCommandSource,
+    command: &[String],
+    cwd: &Path,
+) -> GuardianAssessmentAction {
+    GuardianAssessmentAction::Command {
+        source,
+        command: codex_shell_command::parse_command::shlex_join(command),
+        cwd: cwd.to_path_buf(),
+    }
+}
+
+#[cfg(unix)]
+fn guardian_command_source_tool_name(source: GuardianCommandSource) -> &'static str {
+    match source {
+        GuardianCommandSource::Shell => "shell",
+        GuardianCommandSource::UnifiedExec => "exec_command",
+    }
 }
 
 fn truncate_guardian_action_value(value: Value) -> Value {
@@ -220,13 +234,13 @@ pub(crate) fn guardian_approval_request_to_json(
         #[cfg(unix)]
         GuardianApprovalRequest::Execve {
             id: _,
-            tool_name,
+            source,
             program,
             argv,
             cwd,
             additional_permissions,
         } => serialize_guardian_action(ExecveApprovalAction {
-            tool: tool_name,
+            tool: guardian_command_source_tool_name(*source),
             program,
             argv,
             cwd,
@@ -236,13 +250,11 @@ pub(crate) fn guardian_approval_request_to_json(
             id: _,
             cwd,
             files,
-            change_count,
             patch,
         } => Ok(serde_json::json!({
             "tool": "apply_patch",
             "cwd": cwd,
             "files": files,
-            "change_count": change_count,
             "patch": patch,
         })),
         GuardianApprovalRequest::NetworkAccess {
@@ -285,38 +297,38 @@ pub(crate) fn guardian_approval_request_to_json(
     }
 }
 
-pub(crate) fn guardian_assessment_action_value(action: &GuardianApprovalRequest) -> Value {
+pub(crate) fn guardian_assessment_action(
+    action: &GuardianApprovalRequest,
+) -> GuardianAssessmentAction {
     match action {
         GuardianApprovalRequest::Shell { command, cwd, .. } => {
-            command_assessment_action_value("shell", command, cwd)
+            command_assessment_action(GuardianCommandSource::Shell, command, cwd)
         }
         GuardianApprovalRequest::ExecCommand { command, cwd, .. } => {
-            command_assessment_action_value("exec_command", command, cwd)
+            command_assessment_action(GuardianCommandSource::UnifiedExec, command, cwd)
         }
         #[cfg(unix)]
         GuardianApprovalRequest::Execve {
-            tool_name,
+            source,
             program,
             argv,
             cwd,
             ..
-        } => serde_json::json!({
-            "tool": tool_name,
-            "program": program,
-            "argv": argv,
-            "cwd": cwd,
-        }),
-        GuardianApprovalRequest::ApplyPatch {
-            cwd,
-            files,
-            change_count,
-            ..
-        } => serde_json::json!({
-            "tool": "apply_patch",
-            "cwd": cwd,
-            "files": files,
-            "change_count": change_count,
-        }),
+        } => GuardianAssessmentAction::Execve {
+            source: *source,
+            program: program.clone(),
+            argv: argv.clone(),
+            cwd: cwd.clone(),
+        },
+        GuardianApprovalRequest::ApplyPatch { cwd, files, .. } => {
+            GuardianAssessmentAction::ApplyPatch {
+                cwd: cwd.clone(),
+                files: files
+                    .iter()
+                    .map(codex_utils_absolute_path::AbsolutePathBuf::to_path_buf)
+                    .collect(),
+            }
+        }
         GuardianApprovalRequest::NetworkAccess {
             id: _,
             turn_id: _,
@@ -324,20 +336,26 @@ pub(crate) fn guardian_assessment_action_value(action: &GuardianApprovalRequest)
             host,
             protocol,
             port,
-        } => serde_json::json!({
-            "tool": "network_access",
-            "target": target,
-            "host": host,
-            "protocol": protocol,
-            "port": port,
-        }),
+        } => GuardianAssessmentAction::NetworkAccess {
+            target: target.clone(),
+            host: host.clone(),
+            protocol: *protocol,
+            port: *port,
+        },
         GuardianApprovalRequest::McpToolCall {
-            server, tool_name, ..
-        } => serde_json::json!({
-            "tool": "mcp_tool_call",
-            "server": server,
-            "tool_name": tool_name,
-        }),
+            server,
+            tool_name,
+            connector_id,
+            connector_name,
+            tool_title,
+            ..
+        } => GuardianAssessmentAction::McpToolCall {
+            server: server.clone(),
+            tool_name: tool_name.clone(),
+            connector_id: connector_id.clone(),
+            connector_name: connector_name.clone(),
+            tool_title: tool_title.clone(),
+        },
     }
 }
 

codex-rs/core/src/guardian/mod.rs

@@ -62,7 +62,7 @@ pub(crate) struct GuardianAssessment {
 #[cfg(test)]
 use approval_request::format_guardian_action_pretty;
 #[cfg(test)]
-use approval_request::guardian_assessment_action_value;
+use approval_request::guardian_assessment_action;
 #[cfg(test)]
 use approval_request::guardian_request_turn_id;
 #[cfg(test)]

codex-rs/core/src/guardian/review.rs

@@ -18,7 +18,7 @@ use super::GUARDIAN_APPROVAL_RISK_THRESHOLD;
 use super::GUARDIAN_REVIEWER_NAME;
 use super::GuardianApprovalRequest;
 use super::GuardianAssessment;
-use super::approval_request::guardian_assessment_action_value;
+use super::approval_request::guardian_assessment_action;
 use super::approval_request::guardian_request_id;
 use super::approval_request::guardian_request_turn_id;
 use super::prompt::build_guardian_prompt_items;
@@ -81,7 +81,7 @@ async fn run_guardian_review(
 ) -> ReviewDecision {
     let assessment_id = guardian_request_id(&request).to_string();
     let assessment_turn_id = guardian_request_turn_id(&request, &turn.sub_id).to_string();
-    let action_summary = guardian_assessment_action_value(&request);
+    let action_summary = guardian_assessment_action(&request);
     session
         .send_event(
             turn.as_ref(),
@@ -92,7 +92,7 @@ async fn run_guardian_review(
                 risk_score: None,
                 risk_level: None,
                 rationale: None,
-                action: Some(action_summary.clone()),
+                action: action_summary.clone(),
             }),
         )
         .await;
@@ -111,7 +111,7 @@ async fn run_guardian_review(
                     risk_score: None,
                     risk_level: None,
                     rationale: None,
-                    action: Some(action_summary),
+                    action: action_summary,
                 }),
             )
             .await;
@@ -161,7 +161,7 @@ async fn run_guardian_review(
                         risk_score: None,
                         risk_level: None,
                         rationale: None,
-                        action: Some(action_summary),
+                        action: action_summary,
                     }),
                 )
                 .await;
@@ -197,7 +197,7 @@ async fn run_guardian_review(
                 risk_score: Some(assessment.risk_score),
                 risk_level: Some(assessment.risk_level),
                 rationale: Some(assessment.rationale.clone()),
-                action: Some(terminal_action),
+                action: terminal_action,
             }),
         )
         .await;

codex-rs/core/src/guardian/tests.rs

@@ -265,7 +265,6 @@ fn format_guardian_action_pretty_truncates_large_string_fields() -> serde_json::
         id: "patch-1".to_string(),
         cwd: PathBuf::from("/tmp"),
         files: Vec::new(),
-        change_count: 1usize,
         patch: patch.clone(),
     };
 
@@ -318,7 +317,7 @@ fn guardian_approval_request_to_json_renders_mcp_tool_call_shape() -> serde_json
 }
 
 #[test]
-fn guardian_assessment_action_value_redacts_apply_patch_patch_text() {
+fn guardian_assessment_action_redacts_apply_patch_patch_text() {
     let (cwd, file) = if cfg!(windows) {
         (r"C:\tmp", r"C:\tmp\guardian.txt")
     } else {
@@ -330,19 +329,17 @@ fn guardian_assessment_action_value_redacts_apply_patch_patch_text() {
         id: "patch-1".to_string(),
         cwd: cwd.clone(),
         files: vec![file.clone()],
-        change_count: 1usize,
         patch: "*** Begin Patch\n*** Update File: guardian.txt\n@@\n+secret\n*** End Patch"
             .to_string(),
     };
 
     assert_eq!(
-        guardian_assessment_action_value(&action),
+        serde_json::to_value(guardian_assessment_action(&action)).expect("serialize action"),
         serde_json::json!({
-            "tool": "apply_patch",
+            "type": "apply_patch",
             "cwd": cwd,
             "files": [file],
-            "change_count": 1,
-        })
+        }),
     );
 }
 
@@ -360,7 +357,6 @@ fn guardian_request_turn_id_prefers_network_access_owner_turn() {
         id: "patch-1".to_string(),
         cwd: PathBuf::from("/tmp"),
         files: vec![PathBuf::from("/tmp/guardian.txt").abs()],
-        change_count: 1usize,
         patch: "*** Begin Patch\n*** Update File: guardian.txt\n@@\n+hello\n*** End Patch"
             .to_string(),
     };
@@ -388,7 +384,6 @@ async fn cancelled_guardian_review_emits_terminal_abort_without_warning() {
             id: "patch-1".to_string(),
             cwd: PathBuf::from("/tmp"),
             files: vec![PathBuf::from("/tmp/guardian.txt").abs()],
-            change_count: 1usize,
             patch: "*** Begin Patch\n*** Update File: guardian.txt\n@@\n+hello\n*** End Patch"
                 .to_string(),
         },

codex-rs/core/src/lib.rs

@@ -46,15 +46,16 @@ mod hook_runtime;
 pub mod instructions;
 pub mod landlock;
 pub mod mcp;
-mod mcp_connection_manager;
+mod mcp_skill_dependencies;
 mod mcp_tool_approval_templates;
 pub mod models_manager;
 mod network_policy_decision;
 pub mod network_proxy_loader;
 mod original_image_detail;
-pub use mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
-pub use mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
-pub use mcp_connection_manager::SandboxState;
+pub use codex_mcp::mcp_connection_manager;
+pub use codex_mcp::mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
+pub use codex_mcp::mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
+pub use codex_mcp::mcp_connection_manager::SandboxState;
 pub use text_encoding::bytes_to_string_smart;
 mod mcp_tool_call;
 mod memories;
@@ -65,6 +66,7 @@ pub mod utils;
 pub use utils::path_utils;
 pub mod personality_migration;
 pub mod plugins;
+mod provider_auth;
 pub(crate) mod mentions {
     pub(crate) use crate::plugins::build_connector_slug_counts;
     pub(crate) use crate::plugins::build_skill_name_counts;
@@ -93,7 +95,6 @@ pub(crate) use skills::injection;
 pub(crate) use skills::loader;
 pub(crate) use skills::manager;
 pub(crate) use skills::maybe_emit_implicit_skill_invocation;
-pub(crate) use skills::model;
 pub(crate) use skills::render_skills_section;
 pub(crate) use skills::resolve_skill_dependencies_for_turn;
 pub(crate) use skills::skills_load_input_from_config;
@@ -104,6 +105,7 @@ mod text_encoding;
 mod unified_exec;
 pub mod windows_sandbox;
 pub use client::X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER;
+pub use codex_protocol::config_types::ModelProviderAuthInfo;
 pub use model_provider_info::DEFAULT_LMSTUDIO_PORT;
 pub use model_provider_info::DEFAULT_OLLAMA_PORT;
 pub use model_provider_info::LMSTUDIO_OSS_PROVIDER_ID;
@@ -133,6 +135,7 @@ pub type CodexConversation = CodexThread;
 pub use auth::AuthManager;
 pub use auth::CodexAuth;
 pub use codex_analytics::AnalyticsEventsClient;
+pub use codex_analytics::AppServerRpcTransport;
 mod default_client_forwarding;
 
 /// Default Codex HTTP client headers and reqwest construction.

codex-rs/core/src/mcp.rs

@@ -0,0 +1,53 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+
+pub use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
+pub use codex_mcp::mcp::McpConfig;
+pub use codex_mcp::mcp::ToolPluginProvenance;
+pub use codex_mcp::mcp::auth;
+pub use codex_mcp::mcp::canonical_mcp_server_key;
+pub use codex_mcp::mcp::collect_mcp_snapshot;
+pub use codex_mcp::mcp::collect_mcp_snapshot_from_manager;
+pub use codex_mcp::mcp::collect_missing_mcp_dependencies;
+pub use codex_mcp::mcp::configured_mcp_servers;
+pub use codex_mcp::mcp::effective_mcp_servers;
+pub use codex_mcp::mcp::group_tools_by_server;
+pub use codex_mcp::mcp::qualified_mcp_tool_name_prefix;
+pub use codex_mcp::mcp::split_qualified_tool_name;
+pub use codex_mcp::mcp::tool_plugin_provenance as mcp_tool_plugin_provenance;
+pub use codex_mcp::mcp::with_codex_apps_mcp;
+
+use crate::CodexAuth;
+use crate::config::Config;
+use crate::plugins::PluginsManager;
+use codex_config::McpServerConfig;
+
+#[derive(Clone)]
+pub struct McpManager {
+    plugins_manager: Arc<PluginsManager>,
+}
+
+impl McpManager {
+    pub fn new(plugins_manager: Arc<PluginsManager>) -> Self {
+        Self { plugins_manager }
+    }
+
+    pub fn configured_servers(&self, config: &Config) -> HashMap<String, McpServerConfig> {
+        let mcp_config = config.to_mcp_config(self.plugins_manager.as_ref());
+        configured_mcp_servers(&mcp_config)
+    }
+
+    pub fn effective_servers(
+        &self,
+        config: &Config,
+        auth: Option<&CodexAuth>,
+    ) -> HashMap<String, McpServerConfig> {
+        let mcp_config = config.to_mcp_config(self.plugins_manager.as_ref());
+        effective_mcp_servers(&mcp_config, auth)
+    }
+
+    pub fn tool_plugin_provenance(&self, config: &Config) -> ToolPluginProvenance {
+        let mcp_config = config.to_mcp_config(self.plugins_manager.as_ref());
+        mcp_tool_plugin_provenance(&mcp_config)
+    }
+}

codex-rs/core/src/mcp/auth.rs

@@ -1,299 +0,0 @@
-use std::collections::HashMap;
-
-use anyhow::Result;
-use codex_protocol::protocol::McpAuthStatus;
-use codex_rmcp_client::OAuthCredentialsStoreMode;
-use codex_rmcp_client::OAuthProviderError;
-use codex_rmcp_client::determine_streamable_http_auth_status;
-use codex_rmcp_client::discover_streamable_http_oauth;
-use futures::future::join_all;
-use tracing::warn;
-
-use crate::config::types::McpServerConfig;
-use crate::config::types::McpServerTransportConfig;
-
-#[derive(Debug, Clone)]
-pub struct McpOAuthLoginConfig {
-    pub url: String,
-    pub http_headers: Option<HashMap<String, String>>,
-    pub env_http_headers: Option<HashMap<String, String>>,
-    pub discovered_scopes: Option<Vec<String>>,
-}
-
-#[derive(Debug)]
-pub enum McpOAuthLoginSupport {
-    Supported(McpOAuthLoginConfig),
-    Unsupported,
-    Unknown(anyhow::Error),
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum McpOAuthScopesSource {
-    Explicit,
-    Configured,
-    Discovered,
-    Empty,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ResolvedMcpOAuthScopes {
-    pub scopes: Vec<String>,
-    pub source: McpOAuthScopesSource,
-}
-
-pub async fn oauth_login_support(transport: &McpServerTransportConfig) -> McpOAuthLoginSupport {
-    let McpServerTransportConfig::StreamableHttp {
-        url,
-        bearer_token_env_var,
-        http_headers,
-        env_http_headers,
-    } = transport
-    else {
-        return McpOAuthLoginSupport::Unsupported;
-    };
-
-    if bearer_token_env_var.is_some() {
-        return McpOAuthLoginSupport::Unsupported;
-    }
-
-    match discover_streamable_http_oauth(url, http_headers.clone(), env_http_headers.clone()).await
-    {
-        Ok(Some(discovery)) => McpOAuthLoginSupport::Supported(McpOAuthLoginConfig {
-            url: url.clone(),
-            http_headers: http_headers.clone(),
-            env_http_headers: env_http_headers.clone(),
-            discovered_scopes: discovery.scopes_supported,
-        }),
-        Ok(None) => McpOAuthLoginSupport::Unsupported,
-        Err(err) => McpOAuthLoginSupport::Unknown(err),
-    }
-}
-
-pub async fn discover_supported_scopes(
-    transport: &McpServerTransportConfig,
-) -> Option<Vec<String>> {
-    match oauth_login_support(transport).await {
-        McpOAuthLoginSupport::Supported(config) => config.discovered_scopes,
-        McpOAuthLoginSupport::Unsupported | McpOAuthLoginSupport::Unknown(_) => None,
-    }
-}
-
-pub fn resolve_oauth_scopes(
-    explicit_scopes: Option<Vec<String>>,
-    configured_scopes: Option<Vec<String>>,
-    discovered_scopes: Option<Vec<String>>,
-) -> ResolvedMcpOAuthScopes {
-    if let Some(scopes) = explicit_scopes {
-        return ResolvedMcpOAuthScopes {
-            scopes,
-            source: McpOAuthScopesSource::Explicit,
-        };
-    }
-
-    if let Some(scopes) = configured_scopes {
-        return ResolvedMcpOAuthScopes {
-            scopes,
-            source: McpOAuthScopesSource::Configured,
-        };
-    }
-
-    if let Some(scopes) = discovered_scopes
-        && !scopes.is_empty()
-    {
-        return ResolvedMcpOAuthScopes {
-            scopes,
-            source: McpOAuthScopesSource::Discovered,
-        };
-    }
-
-    ResolvedMcpOAuthScopes {
-        scopes: Vec::new(),
-        source: McpOAuthScopesSource::Empty,
-    }
-}
-
-pub fn should_retry_without_scopes(scopes: &ResolvedMcpOAuthScopes, error: &anyhow::Error) -> bool {
-    scopes.source == McpOAuthScopesSource::Discovered
-        && error.downcast_ref::<OAuthProviderError>().is_some()
-}
-
-#[derive(Debug, Clone)]
-pub struct McpAuthStatusEntry {
-    pub config: McpServerConfig,
-    pub auth_status: McpAuthStatus,
-}
-
-pub async fn compute_auth_statuses<'a, I>(
-    servers: I,
-    store_mode: OAuthCredentialsStoreMode,
-) -> HashMap<String, McpAuthStatusEntry>
-where
-    I: IntoIterator<Item = (&'a String, &'a McpServerConfig)>,
-{
-    let futures = servers.into_iter().map(|(name, config)| {
-        let name = name.clone();
-        let config = config.clone();
-        async move {
-            let auth_status = match compute_auth_status(&name, &config, store_mode).await {
-                Ok(status) => status,
-                Err(error) => {
-                    warn!("failed to determine auth status for MCP server `{name}`: {error:?}");
-                    McpAuthStatus::Unsupported
-                }
-            };
-            let entry = McpAuthStatusEntry {
-                config,
-                auth_status,
-            };
-            (name, entry)
-        }
-    });
-
-    join_all(futures).await.into_iter().collect()
-}
-
-async fn compute_auth_status(
-    server_name: &str,
-    config: &McpServerConfig,
-    store_mode: OAuthCredentialsStoreMode,
-) -> Result<McpAuthStatus> {
-    match &config.transport {
-        McpServerTransportConfig::Stdio { .. } => Ok(McpAuthStatus::Unsupported),
-        McpServerTransportConfig::StreamableHttp {
-            url,
-            bearer_token_env_var,
-            http_headers,
-            env_http_headers,
-        } => {
-            determine_streamable_http_auth_status(
-                server_name,
-                url,
-                bearer_token_env_var.as_deref(),
-                http_headers.clone(),
-                env_http_headers.clone(),
-                store_mode,
-            )
-            .await
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use anyhow::anyhow;
-    use pretty_assertions::assert_eq;
-
-    use super::McpOAuthScopesSource;
-    use super::OAuthProviderError;
-    use super::ResolvedMcpOAuthScopes;
-    use super::resolve_oauth_scopes;
-    use super::should_retry_without_scopes;
-
-    #[test]
-    fn resolve_oauth_scopes_prefers_explicit() {
-        let resolved = resolve_oauth_scopes(
-            Some(vec!["explicit".to_string()]),
-            Some(vec!["configured".to_string()]),
-            Some(vec!["discovered".to_string()]),
-        );
-
-        assert_eq!(
-            resolved,
-            ResolvedMcpOAuthScopes {
-                scopes: vec!["explicit".to_string()],
-                source: McpOAuthScopesSource::Explicit,
-            }
-        );
-    }
-
-    #[test]
-    fn resolve_oauth_scopes_prefers_configured_over_discovered() {
-        let resolved = resolve_oauth_scopes(
-            /*explicit_scopes*/ None,
-            Some(vec!["configured".to_string()]),
-            Some(vec!["discovered".to_string()]),
-        );
-
-        assert_eq!(
-            resolved,
-            ResolvedMcpOAuthScopes {
-                scopes: vec!["configured".to_string()],
-                source: McpOAuthScopesSource::Configured,
-            }
-        );
-    }
-
-    #[test]
-    fn resolve_oauth_scopes_uses_discovered_when_needed() {
-        let resolved = resolve_oauth_scopes(
-            /*explicit_scopes*/ None,
-            /*configured_scopes*/ None,
-            Some(vec!["discovered".to_string()]),
-        );
-
-        assert_eq!(
-            resolved,
-            ResolvedMcpOAuthScopes {
-                scopes: vec!["discovered".to_string()],
-                source: McpOAuthScopesSource::Discovered,
-            }
-        );
-    }
-
-    #[test]
-    fn resolve_oauth_scopes_preserves_explicitly_empty_configured_scopes() {
-        let resolved = resolve_oauth_scopes(
-            /*explicit_scopes*/ None,
-            Some(Vec::new()),
-            Some(vec!["ignored".into()]),
-        );
-
-        assert_eq!(
-            resolved,
-            ResolvedMcpOAuthScopes {
-                scopes: Vec::new(),
-                source: McpOAuthScopesSource::Configured,
-            }
-        );
-    }
-
-    #[test]
-    fn resolve_oauth_scopes_falls_back_to_empty() {
-        let resolved = resolve_oauth_scopes(
-            /*explicit_scopes*/ None, /*configured_scopes*/ None,
-            /*discovered_scopes*/ None,
-        );
-
-        assert_eq!(
-            resolved,
-            ResolvedMcpOAuthScopes {
-                scopes: Vec::new(),
-                source: McpOAuthScopesSource::Empty,
-            }
-        );
-    }
-
-    #[test]
-    fn should_retry_without_scopes_only_for_discovered_provider_errors() {
-        let discovered = ResolvedMcpOAuthScopes {
-            scopes: vec!["scope".to_string()],
-            source: McpOAuthScopesSource::Discovered,
-        };
-        let provider_error = anyhow!(OAuthProviderError::new(
-            Some("invalid_scope".to_string()),
-            Some("scope rejected".to_string()),
-        ));
-
-        assert!(should_retry_without_scopes(&discovered, &provider_error));
-
-        let configured = ResolvedMcpOAuthScopes {
-            scopes: vec!["scope".to_string()],
-            source: McpOAuthScopesSource::Configured,
-        };
-        assert!(!should_retry_without_scopes(&configured, &provider_error));
-        assert!(!should_retry_without_scopes(
-            &discovered,
-            &anyhow!("timed out waiting for OAuth callback"),
-        ));
-    }
-}

codex-rs/core/src/mcp/mod.rs

@@ -1,475 +0,0 @@
-pub mod auth;
-mod skill_dependencies;
-pub(crate) use skill_dependencies::maybe_prompt_and_install_mcp_dependencies;
-
-use std::collections::HashMap;
-use std::env;
-use std::path::PathBuf;
-use std::sync::Arc;
-use std::time::Duration;
-
-use async_channel::unbounded;
-use codex_protocol::mcp::Resource;
-use codex_protocol::mcp::ResourceTemplate;
-use codex_protocol::mcp::Tool;
-use codex_protocol::protocol::McpListToolsResponseEvent;
-use codex_protocol::protocol::SandboxPolicy;
-use serde_json::Value;
-
-use crate::AuthManager;
-use crate::CodexAuth;
-use crate::config::Config;
-use crate::config::types::McpServerConfig;
-use crate::config::types::McpServerTransportConfig;
-use crate::mcp::auth::compute_auth_statuses;
-use crate::mcp_connection_manager::McpConnectionManager;
-use crate::mcp_connection_manager::SandboxState;
-use crate::mcp_connection_manager::codex_apps_tools_cache_key;
-use crate::plugins::PluginCapabilitySummary;
-use crate::plugins::PluginsManager;
-
-const MCP_TOOL_NAME_PREFIX: &str = "mcp";
-const MCP_TOOL_NAME_DELIMITER: &str = "__";
-pub(crate) const CODEX_APPS_MCP_SERVER_NAME: &str = "codex_apps";
-const CODEX_CONNECTORS_TOKEN_ENV_VAR: &str = "CODEX_CONNECTORS_TOKEN";
-
-/// The Responses API requires tool names to match `^[a-zA-Z0-9_-]+$`.
-/// MCP server/tool names are user-controlled, so sanitize the fully-qualified
-/// name we expose to the model by replacing any disallowed character with `_`.
-pub(crate) fn sanitize_responses_api_tool_name(name: &str) -> String {
-    let mut sanitized = String::with_capacity(name.len());
-    for c in name.chars() {
-        if c.is_ascii_alphanumeric() || c == '_' {
-            sanitized.push(c);
-        } else {
-            sanitized.push('_');
-        }
-    }
-
-    if sanitized.is_empty() {
-        "_".to_string()
-    } else {
-        sanitized
-    }
-}
-
-pub fn qualified_mcp_tool_name_prefix(server_name: &str) -> String {
-    sanitize_responses_api_tool_name(&format!(
-        "{MCP_TOOL_NAME_PREFIX}{MCP_TOOL_NAME_DELIMITER}{server_name}{MCP_TOOL_NAME_DELIMITER}"
-    ))
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct ToolPluginProvenance {
-    plugin_display_names_by_connector_id: HashMap<String, Vec<String>>,
-    plugin_display_names_by_mcp_server_name: HashMap<String, Vec<String>>,
-}
-
-impl ToolPluginProvenance {
-    pub fn plugin_display_names_for_connector_id(&self, connector_id: &str) -> &[String] {
-        self.plugin_display_names_by_connector_id
-            .get(connector_id)
-            .map(Vec::as_slice)
-            .unwrap_or(&[])
-    }
-
-    pub fn plugin_display_names_for_mcp_server_name(&self, server_name: &str) -> &[String] {
-        self.plugin_display_names_by_mcp_server_name
-            .get(server_name)
-            .map(Vec::as_slice)
-            .unwrap_or(&[])
-    }
-
-    fn from_capability_summaries(capability_summaries: &[PluginCapabilitySummary]) -> Self {
-        let mut tool_plugin_provenance = Self::default();
-        for plugin in capability_summaries {
-            for connector_id in &plugin.app_connector_ids {
-                tool_plugin_provenance
-                    .plugin_display_names_by_connector_id
-                    .entry(connector_id.0.clone())
-                    .or_default()
-                    .push(plugin.display_name.clone());
-            }
-
-            for server_name in &plugin.mcp_server_names {
-                tool_plugin_provenance
-                    .plugin_display_names_by_mcp_server_name
-                    .entry(server_name.clone())
-                    .or_default()
-                    .push(plugin.display_name.clone());
-            }
-        }
-
-        for plugin_names in tool_plugin_provenance
-            .plugin_display_names_by_connector_id
-            .values_mut()
-            .chain(
-                tool_plugin_provenance
-                    .plugin_display_names_by_mcp_server_name
-                    .values_mut(),
-            )
-        {
-            plugin_names.sort_unstable();
-            plugin_names.dedup();
-        }
-
-        tool_plugin_provenance
-    }
-}
-
-fn codex_apps_mcp_bearer_token_env_var() -> Option<String> {
-    match env::var(CODEX_CONNECTORS_TOKEN_ENV_VAR) {
-        Ok(value) if !value.trim().is_empty() => Some(CODEX_CONNECTORS_TOKEN_ENV_VAR.to_string()),
-        Ok(_) => None,
-        Err(env::VarError::NotPresent) => None,
-        Err(env::VarError::NotUnicode(_)) => Some(CODEX_CONNECTORS_TOKEN_ENV_VAR.to_string()),
-    }
-}
-
-fn codex_apps_mcp_bearer_token(auth: Option<&CodexAuth>) -> Option<String> {
-    let token = auth.and_then(|auth| auth.get_token().ok())?;
-    let token = token.trim();
-    if token.is_empty() {
-        None
-    } else {
-        Some(token.to_string())
-    }
-}
-
-fn codex_apps_mcp_http_headers(auth: Option<&CodexAuth>) -> Option<HashMap<String, String>> {
-    let mut headers = HashMap::new();
-    if let Some(token) = codex_apps_mcp_bearer_token(auth) {
-        headers.insert("Authorization".to_string(), format!("Bearer {token}"));
-    }
-    if let Some(account_id) = auth.and_then(CodexAuth::get_account_id) {
-        headers.insert("ChatGPT-Account-ID".to_string(), account_id);
-    }
-    if headers.is_empty() {
-        None
-    } else {
-        Some(headers)
-    }
-}
-
-fn normalize_codex_apps_base_url(base_url: &str) -> String {
-    let mut base_url = base_url.trim_end_matches('/').to_string();
-    if (base_url.starts_with("https://chatgpt.com")
-        || base_url.starts_with("https://chat.openai.com"))
-        && !base_url.contains("/backend-api")
-    {
-        base_url = format!("{base_url}/backend-api");
-    }
-    base_url
-}
-
-fn codex_apps_mcp_url_for_base_url(base_url: &str) -> String {
-    let base_url = normalize_codex_apps_base_url(base_url);
-    if base_url.contains("/backend-api") {
-        format!("{base_url}/wham/apps")
-    } else if base_url.contains("/api/codex") {
-        format!("{base_url}/apps")
-    } else {
-        format!("{base_url}/api/codex/apps")
-    }
-}
-
-pub(crate) fn codex_apps_mcp_url(config: &Config) -> String {
-    codex_apps_mcp_url_for_base_url(&config.chatgpt_base_url)
-}
-
-fn codex_apps_mcp_server_config(config: &Config, auth: Option<&CodexAuth>) -> McpServerConfig {
-    let bearer_token_env_var = codex_apps_mcp_bearer_token_env_var();
-    let http_headers = if bearer_token_env_var.is_some() {
-        None
-    } else {
-        codex_apps_mcp_http_headers(auth)
-    };
-    let url = codex_apps_mcp_url(config);
-
-    McpServerConfig {
-        transport: McpServerTransportConfig::StreamableHttp {
-            url,
-            bearer_token_env_var,
-            http_headers,
-            env_http_headers: None,
-        },
-        enabled: true,
-        required: false,
-        disabled_reason: None,
-        startup_timeout_sec: Some(Duration::from_secs(30)),
-        tool_timeout_sec: None,
-        enabled_tools: None,
-        disabled_tools: None,
-        scopes: None,
-        oauth_resource: None,
-        tools: HashMap::new(),
-    }
-}
-
-pub(crate) fn with_codex_apps_mcp(
-    mut servers: HashMap<String, McpServerConfig>,
-    connectors_enabled: bool,
-    auth: Option<&CodexAuth>,
-    config: &Config,
-) -> HashMap<String, McpServerConfig> {
-    if connectors_enabled {
-        servers.insert(
-            CODEX_APPS_MCP_SERVER_NAME.to_string(),
-            codex_apps_mcp_server_config(config, auth),
-        );
-    } else {
-        servers.remove(CODEX_APPS_MCP_SERVER_NAME);
-    }
-    servers
-}
-
-pub struct McpManager {
-    plugins_manager: Arc<PluginsManager>,
-}
-
-impl McpManager {
-    pub fn new(plugins_manager: Arc<PluginsManager>) -> Self {
-        Self { plugins_manager }
-    }
-
-    pub fn configured_servers(&self, config: &Config) -> HashMap<String, McpServerConfig> {
-        configured_mcp_servers(config, self.plugins_manager.as_ref())
-    }
-
-    pub fn effective_servers(
-        &self,
-        config: &Config,
-        auth: Option<&CodexAuth>,
-    ) -> HashMap<String, McpServerConfig> {
-        effective_mcp_servers(config, auth, self.plugins_manager.as_ref())
-    }
-
-    pub fn tool_plugin_provenance(&self, config: &Config) -> ToolPluginProvenance {
-        let loaded_plugins = self.plugins_manager.plugins_for_config(config);
-        ToolPluginProvenance::from_capability_summaries(loaded_plugins.capability_summaries())
-    }
-}
-
-fn configured_mcp_servers(
-    config: &Config,
-    plugins_manager: &PluginsManager,
-) -> HashMap<String, McpServerConfig> {
-    let loaded_plugins = plugins_manager.plugins_for_config(config);
-    let mut servers = config.mcp_servers.get().clone();
-    for (name, plugin_server) in loaded_plugins.effective_mcp_servers() {
-        servers.entry(name).or_insert(plugin_server);
-    }
-    servers
-}
-
-fn effective_mcp_servers(
-    config: &Config,
-    auth: Option<&CodexAuth>,
-    plugins_manager: &PluginsManager,
-) -> HashMap<String, McpServerConfig> {
-    let servers = configured_mcp_servers(config, plugins_manager);
-    with_codex_apps_mcp(
-        servers,
-        config.features.apps_enabled_for_auth(auth),
-        auth,
-        config,
-    )
-}
-
-pub async fn collect_mcp_snapshot(config: &Config) -> McpListToolsResponseEvent {
-    let auth_manager = AuthManager::shared(
-        config.codex_home.clone(),
-        /*enable_codex_api_key_env*/ false,
-        config.cli_auth_credentials_store_mode,
-    );
-    let auth = auth_manager.auth().await;
-    let mcp_manager = McpManager::new(Arc::new(PluginsManager::new(config.codex_home.clone())));
-    let mcp_servers = mcp_manager.effective_servers(config, auth.as_ref());
-    let tool_plugin_provenance = mcp_manager.tool_plugin_provenance(config);
-    if mcp_servers.is_empty() {
-        return McpListToolsResponseEvent {
-            tools: HashMap::new(),
-            resources: HashMap::new(),
-            resource_templates: HashMap::new(),
-            auth_statuses: HashMap::new(),
-        };
-    }
-
-    let auth_status_entries =
-        compute_auth_statuses(mcp_servers.iter(), config.mcp_oauth_credentials_store_mode).await;
-
-    let (tx_event, rx_event) = unbounded();
-    drop(rx_event);
-
-    // Use ReadOnly sandbox policy for MCP snapshot collection (safest default)
-    let sandbox_state = SandboxState {
-        sandbox_policy: SandboxPolicy::new_read_only_policy(),
-        codex_linux_sandbox_exe: config.codex_linux_sandbox_exe.clone(),
-        sandbox_cwd: env::current_dir().unwrap_or_else(|_| PathBuf::from("/")),
-        use_legacy_landlock: config.features.use_legacy_landlock(),
-    };
-
-    let (mcp_connection_manager, cancel_token) = McpConnectionManager::new(
-        &mcp_servers,
-        config.mcp_oauth_credentials_store_mode,
-        auth_status_entries.clone(),
-        &config.permissions.approval_policy,
-        tx_event,
-        sandbox_state,
-        config.codex_home.clone(),
-        codex_apps_tools_cache_key(auth.as_ref()),
-        tool_plugin_provenance,
-    )
-    .await;
-
-    let snapshot =
-        collect_mcp_snapshot_from_manager(&mcp_connection_manager, auth_status_entries).await;
-
-    cancel_token.cancel();
-
-    snapshot
-}
-
-pub fn split_qualified_tool_name(qualified_name: &str) -> Option<(String, String)> {
-    let mut parts = qualified_name.split(MCP_TOOL_NAME_DELIMITER);
-    let prefix = parts.next()?;
-    if prefix != MCP_TOOL_NAME_PREFIX {
-        return None;
-    }
-    let server_name = parts.next()?;
-    let tool_name: String = parts.collect::<Vec<_>>().join(MCP_TOOL_NAME_DELIMITER);
-    if tool_name.is_empty() {
-        return None;
-    }
-    Some((server_name.to_string(), tool_name))
-}
-
-pub fn group_tools_by_server(
-    tools: &HashMap<String, Tool>,
-) -> HashMap<String, HashMap<String, Tool>> {
-    let mut grouped = HashMap::new();
-    for (qualified_name, tool) in tools {
-        if let Some((server_name, tool_name)) = split_qualified_tool_name(qualified_name) {
-            grouped
-                .entry(server_name)
-                .or_insert_with(HashMap::new)
-                .insert(tool_name, tool.clone());
-        }
-    }
-    grouped
-}
-
-pub(crate) async fn collect_mcp_snapshot_from_manager(
-    mcp_connection_manager: &McpConnectionManager,
-    auth_status_entries: HashMap<String, crate::mcp::auth::McpAuthStatusEntry>,
-) -> McpListToolsResponseEvent {
-    let (tools, resources, resource_templates) = tokio::join!(
-        mcp_connection_manager.list_all_tools(),
-        mcp_connection_manager.list_all_resources(),
-        mcp_connection_manager.list_all_resource_templates(),
-    );
-
-    let auth_statuses = auth_status_entries
-        .iter()
-        .map(|(name, entry)| (name.clone(), entry.auth_status))
-        .collect();
-
-    let tools = tools
-        .into_iter()
-        .filter_map(|(name, tool)| match serde_json::to_value(tool.tool) {
-            Ok(value) => match Tool::from_mcp_value(value) {
-                Ok(tool) => Some((name, tool)),
-                Err(err) => {
-                    tracing::warn!("Failed to convert MCP tool '{name}': {err}");
-                    None
-                }
-            },
-            Err(err) => {
-                tracing::warn!("Failed to serialize MCP tool '{name}': {err}");
-                None
-            }
-        })
-        .collect();
-
-    let resources = resources
-        .into_iter()
-        .map(|(name, resources)| {
-            let resources = resources
-                .into_iter()
-                .filter_map(|resource| match serde_json::to_value(resource) {
-                    Ok(value) => match Resource::from_mcp_value(value.clone()) {
-                        Ok(resource) => Some(resource),
-                        Err(err) => {
-                            let (uri, resource_name) = match value {
-                                Value::Object(obj) => (
-                                    obj.get("uri")
-                                        .and_then(|v| v.as_str().map(ToString::to_string)),
-                                    obj.get("name")
-                                        .and_then(|v| v.as_str().map(ToString::to_string)),
-                                ),
-                                _ => (None, None),
-                            };
-
-                            tracing::warn!(
-                                "Failed to convert MCP resource (uri={uri:?}, name={resource_name:?}): {err}"
-                            );
-                            None
-                        }
-                    },
-                    Err(err) => {
-                        tracing::warn!("Failed to serialize MCP resource: {err}");
-                        None
-                    }
-                })
-                .collect::<Vec<_>>();
-            (name, resources)
-        })
-        .collect();
-
-    let resource_templates = resource_templates
-        .into_iter()
-        .map(|(name, templates)| {
-            let templates = templates
-                .into_iter()
-                .filter_map(|template| match serde_json::to_value(template) {
-                    Ok(value) => match ResourceTemplate::from_mcp_value(value.clone()) {
-                        Ok(template) => Some(template),
-                        Err(err) => {
-                            let (uri_template, template_name) = match value {
-                                Value::Object(obj) => (
-                                    obj.get("uriTemplate")
-                                        .or_else(|| obj.get("uri_template"))
-                                        .and_then(|v| v.as_str().map(ToString::to_string)),
-                                    obj.get("name")
-                                        .and_then(|v| v.as_str().map(ToString::to_string)),
-                                ),
-                                _ => (None, None),
-                            };
-
-                            tracing::warn!(
-                                "Failed to convert MCP resource template (uri_template={uri_template:?}, name={template_name:?}): {err}"
-                            );
-                            None
-                        }
-                    },
-                    Err(err) => {
-                        tracing::warn!("Failed to serialize MCP resource template: {err}");
-                        None
-                    }
-                })
-                .collect::<Vec<_>>();
-            (name, templates)
-        })
-        .collect();
-
-    McpListToolsResponseEvent {
-        tools,
-        resources,
-        resource_templates,
-        auth_statuses,
-    }
-}
-
-#[cfg(test)]
-#[path = "mod_tests.rs"]
-mod tests;

codex-rs/core/src/mcp/mod_tests.rs

@@ -1,279 +0,0 @@
-use super::*;
-use crate::config::CONFIG_TOML_FILE;
-use crate::config::ConfigBuilder;
-use crate::plugins::AppConnectorId;
-use crate::plugins::PluginCapabilitySummary;
-use codex_features::Feature;
-use pretty_assertions::assert_eq;
-use std::fs;
-use std::path::Path;
-use toml::Value;
-
-fn write_file(path: &Path, contents: &str) {
-    fs::create_dir_all(path.parent().expect("file should have a parent")).unwrap();
-    fs::write(path, contents).unwrap();
-}
-
-fn plugin_config_toml() -> String {
-    let mut root = toml::map::Map::new();
-
-    let mut features = toml::map::Map::new();
-    features.insert("plugins".to_string(), Value::Boolean(true));
-    root.insert("features".to_string(), Value::Table(features));
-
-    let mut plugin = toml::map::Map::new();
-    plugin.insert("enabled".to_string(), Value::Boolean(true));
-
-    let mut plugins = toml::map::Map::new();
-    plugins.insert("sample@test".to_string(), Value::Table(plugin));
-    root.insert("plugins".to_string(), Value::Table(plugins));
-
-    toml::to_string(&Value::Table(root)).expect("plugin test config should serialize")
-}
-
-fn make_tool(name: &str) -> Tool {
-    Tool {
-        name: name.to_string(),
-        title: None,
-        description: None,
-        input_schema: serde_json::json!({"type": "object", "properties": {}}),
-        output_schema: None,
-        annotations: None,
-        icons: None,
-        meta: None,
-    }
-}
-
-#[test]
-fn split_qualified_tool_name_returns_server_and_tool() {
-    assert_eq!(
-        split_qualified_tool_name("mcp__alpha__do_thing"),
-        Some(("alpha".to_string(), "do_thing".to_string()))
-    );
-}
-
-#[test]
-fn qualified_mcp_tool_name_prefix_sanitizes_server_names_without_lowercasing() {
-    assert_eq!(
-        qualified_mcp_tool_name_prefix("Some-Server"),
-        "mcp__Some_Server__".to_string()
-    );
-}
-
-#[test]
-fn split_qualified_tool_name_rejects_invalid_names() {
-    assert_eq!(split_qualified_tool_name("other__alpha__do_thing"), None);
-    assert_eq!(split_qualified_tool_name("mcp__alpha__"), None);
-}
-
-#[test]
-fn group_tools_by_server_strips_prefix_and_groups() {
-    let mut tools = HashMap::new();
-    tools.insert("mcp__alpha__do_thing".to_string(), make_tool("do_thing"));
-    tools.insert(
-        "mcp__alpha__nested__op".to_string(),
-        make_tool("nested__op"),
-    );
-    tools.insert("mcp__beta__do_other".to_string(), make_tool("do_other"));
-
-    let mut expected_alpha = HashMap::new();
-    expected_alpha.insert("do_thing".to_string(), make_tool("do_thing"));
-    expected_alpha.insert("nested__op".to_string(), make_tool("nested__op"));
-
-    let mut expected_beta = HashMap::new();
-    expected_beta.insert("do_other".to_string(), make_tool("do_other"));
-
-    let mut expected = HashMap::new();
-    expected.insert("alpha".to_string(), expected_alpha);
-    expected.insert("beta".to_string(), expected_beta);
-
-    assert_eq!(group_tools_by_server(&tools), expected);
-}
-
-#[test]
-fn tool_plugin_provenance_collects_app_and_mcp_sources() {
-    let provenance = ToolPluginProvenance::from_capability_summaries(&[
-        PluginCapabilitySummary {
-            display_name: "alpha-plugin".to_string(),
-            app_connector_ids: vec![AppConnectorId("connector_example".to_string())],
-            mcp_server_names: vec!["alpha".to_string()],
-            ..PluginCapabilitySummary::default()
-        },
-        PluginCapabilitySummary {
-            display_name: "beta-plugin".to_string(),
-            app_connector_ids: vec![
-                AppConnectorId("connector_example".to_string()),
-                AppConnectorId("connector_gmail".to_string()),
-            ],
-            mcp_server_names: vec!["beta".to_string()],
-            ..PluginCapabilitySummary::default()
-        },
-    ]);
-
-    assert_eq!(
-        provenance,
-        ToolPluginProvenance {
-            plugin_display_names_by_connector_id: HashMap::from([
-                (
-                    "connector_example".to_string(),
-                    vec!["alpha-plugin".to_string(), "beta-plugin".to_string()],
-                ),
-                (
-                    "connector_gmail".to_string(),
-                    vec!["beta-plugin".to_string()],
-                ),
-            ]),
-            plugin_display_names_by_mcp_server_name: HashMap::from([
-                ("alpha".to_string(), vec!["alpha-plugin".to_string()]),
-                ("beta".to_string(), vec!["beta-plugin".to_string()]),
-            ]),
-        }
-    );
-}
-
-#[test]
-fn codex_apps_mcp_url_for_base_url_keeps_existing_paths() {
-    assert_eq!(
-        codex_apps_mcp_url_for_base_url("https://chatgpt.com/backend-api"),
-        "https://chatgpt.com/backend-api/wham/apps"
-    );
-    assert_eq!(
-        codex_apps_mcp_url_for_base_url("https://chat.openai.com"),
-        "https://chat.openai.com/backend-api/wham/apps"
-    );
-    assert_eq!(
-        codex_apps_mcp_url_for_base_url("http://localhost:8080/api/codex"),
-        "http://localhost:8080/api/codex/apps"
-    );
-    assert_eq!(
-        codex_apps_mcp_url_for_base_url("http://localhost:8080"),
-        "http://localhost:8080/api/codex/apps"
-    );
-}
-
-#[test]
-fn codex_apps_mcp_url_uses_legacy_codex_apps_path() {
-    let mut config = crate::config::test_config();
-    config.chatgpt_base_url = "https://chatgpt.com".to_string();
-
-    assert_eq!(
-        codex_apps_mcp_url(&config),
-        "https://chatgpt.com/backend-api/wham/apps"
-    );
-}
-
-#[test]
-fn codex_apps_server_config_uses_legacy_codex_apps_path() {
-    let mut config = crate::config::test_config();
-    config.chatgpt_base_url = "https://chatgpt.com".to_string();
-
-    let mut servers = with_codex_apps_mcp(
-        HashMap::new(),
-        /*connectors_enabled*/ false,
-        /*auth*/ None,
-        &config,
-    );
-    assert!(!servers.contains_key(CODEX_APPS_MCP_SERVER_NAME));
-
-    config
-        .features
-        .enable(Feature::Apps)
-        .expect("test config should allow apps");
-
-    servers = with_codex_apps_mcp(
-        servers, /*connectors_enabled*/ true, /*auth*/ None, &config,
-    );
-    let server = servers
-        .get(CODEX_APPS_MCP_SERVER_NAME)
-        .expect("codex apps should be present when apps is enabled");
-    let url = match &server.transport {
-        McpServerTransportConfig::StreamableHttp { url, .. } => url,
-        _ => panic!("expected streamable http transport for codex apps"),
-    };
-
-    assert_eq!(url, "https://chatgpt.com/backend-api/wham/apps");
-}
-
-#[tokio::test]
-async fn effective_mcp_servers_include_plugins_without_overriding_user_config() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let plugin_root = codex_home
-        .path()
-        .join("plugins/cache")
-        .join("test/sample/local");
-    write_file(
-        &plugin_root.join(".codex-plugin/plugin.json"),
-        r#"{"name":"sample"}"#,
-    );
-    write_file(
-        &plugin_root.join(".mcp.json"),
-        r#"{
-  "mcpServers": {
-    "sample": {
-      "type": "http",
-      "url": "https://plugin.example/mcp"
-    },
-    "docs": {
-      "type": "http",
-      "url": "https://docs.example/mcp"
-    }
-  }
-}"#,
-    );
-    write_file(
-        &codex_home.path().join(CONFIG_TOML_FILE),
-        &plugin_config_toml(),
-    );
-
-    let mut config = ConfigBuilder::default()
-        .codex_home(codex_home.path().to_path_buf())
-        .build()
-        .await
-        .expect("config should load");
-
-    let mut configured_servers = config.mcp_servers.get().clone();
-    configured_servers.insert(
-        "sample".to_string(),
-        McpServerConfig {
-            transport: McpServerTransportConfig::StreamableHttp {
-                url: "https://user.example/mcp".to_string(),
-                bearer_token_env_var: None,
-                http_headers: None,
-                env_http_headers: None,
-            },
-            enabled: true,
-            required: false,
-            disabled_reason: None,
-            startup_timeout_sec: None,
-            tool_timeout_sec: None,
-            enabled_tools: None,
-            disabled_tools: None,
-            scopes: None,
-            oauth_resource: None,
-            tools: HashMap::new(),
-        },
-    );
-    config
-        .mcp_servers
-        .set(configured_servers)
-        .expect("test config should accept MCP servers");
-
-    let mcp_manager = McpManager::new(Arc::new(PluginsManager::new(config.codex_home.clone())));
-    let effective = mcp_manager.effective_servers(&config, /*auth*/ None);
-
-    let sample = effective.get("sample").expect("user server should exist");
-    let docs = effective.get("docs").expect("plugin server should exist");
-
-    match &sample.transport {
-        McpServerTransportConfig::StreamableHttp { url, .. } => {
-            assert_eq!(url, "https://user.example/mcp");
-        }
-        other => panic!("expected streamable http transport, got {other:?}"),
-    }
-    match &docs.transport {
-        McpServerTransportConfig::StreamableHttp { url, .. } => {
-            assert_eq!(url, "https://docs.example/mcp");
-        }
-        other => panic!("expected streamable http transport, got {other:?}"),
-    }
-}

codex-rs/core/src/mcp/skill_dependencies_tests.rs

@@ -1,107 +0,0 @@
-use super::*;
-use crate::model::SkillDependencies;
-use codex_protocol::protocol::SkillScope;
-use pretty_assertions::assert_eq;
-use std::path::PathBuf;
-
-fn skill_with_tools(tools: Vec<SkillToolDependency>) -> SkillMetadata {
-    SkillMetadata {
-        name: "skill".to_string(),
-        description: "skill".to_string(),
-        short_description: None,
-        interface: None,
-        dependencies: Some(SkillDependencies { tools }),
-        policy: None,
-        path_to_skills_md: PathBuf::from("skill"),
-        scope: SkillScope::User,
-    }
-}
-
-#[test]
-fn collect_missing_respects_canonical_installed_key() {
-    let url = "https://example.com/mcp".to_string();
-    let skills = vec![skill_with_tools(vec![SkillToolDependency {
-        r#type: "mcp".to_string(),
-        value: "github".to_string(),
-        description: None,
-        transport: Some("streamable_http".to_string()),
-        command: None,
-        url: Some(url.clone()),
-    }])];
-    let installed = HashMap::from([(
-        "alias".to_string(),
-        McpServerConfig {
-            transport: McpServerTransportConfig::StreamableHttp {
-                url,
-                bearer_token_env_var: None,
-                http_headers: None,
-                env_http_headers: None,
-            },
-            enabled: true,
-            required: false,
-            disabled_reason: None,
-            startup_timeout_sec: None,
-            tool_timeout_sec: None,
-            enabled_tools: None,
-            disabled_tools: None,
-            scopes: None,
-            oauth_resource: None,
-            tools: HashMap::new(),
-        },
-    )]);
-
-    assert_eq!(
-        collect_missing_mcp_dependencies(&skills, &installed),
-        HashMap::new()
-    );
-}
-
-#[test]
-fn collect_missing_dedupes_by_canonical_key_but_preserves_original_name() {
-    let url = "https://example.com/one".to_string();
-    let skills = vec![skill_with_tools(vec![
-        SkillToolDependency {
-            r#type: "mcp".to_string(),
-            value: "alias-one".to_string(),
-            description: None,
-            transport: Some("streamable_http".to_string()),
-            command: None,
-            url: Some(url.clone()),
-        },
-        SkillToolDependency {
-            r#type: "mcp".to_string(),
-            value: "alias-two".to_string(),
-            description: None,
-            transport: Some("streamable_http".to_string()),
-            command: None,
-            url: Some(url.clone()),
-        },
-    ])];
-
-    let expected = HashMap::from([(
-        "alias-one".to_string(),
-        McpServerConfig {
-            transport: McpServerTransportConfig::StreamableHttp {
-                url,
-                bearer_token_env_var: None,
-                http_headers: None,
-                env_http_headers: None,
-            },
-            enabled: true,
-            required: false,
-            disabled_reason: None,
-            startup_timeout_sec: None,
-            tool_timeout_sec: None,
-            enabled_tools: None,
-            disabled_tools: None,
-            scopes: None,
-            oauth_resource: None,
-            tools: HashMap::new(),
-        },
-    )]);
-
-    assert_eq!(
-        collect_missing_mcp_dependencies(&skills, &HashMap::new()),
-        expected
-    );
-}

codex-rs/core/src/mcp_connection_manager_tests.rs

@@ -1,646 +0,0 @@
-use super::*;
-use codex_protocol::protocol::GranularApprovalConfig;
-use codex_protocol::protocol::McpAuthStatus;
-use rmcp::model::JsonObject;
-use std::collections::HashSet;
-use std::sync::Arc;
-use tempfile::tempdir;
-
-fn create_test_tool(server_name: &str, tool_name: &str) -> ToolInfo {
-    ToolInfo {
-        server_name: server_name.to_string(),
-        tool_name: tool_name.to_string(),
-        tool_namespace: if server_name == CODEX_APPS_MCP_SERVER_NAME {
-            format!("mcp__{server_name}__")
-        } else {
-            server_name.to_string()
-        },
-        tool: Tool {
-            name: tool_name.to_string().into(),
-            title: None,
-            description: Some(format!("Test tool: {tool_name}").into()),
-            input_schema: Arc::new(JsonObject::default()),
-            output_schema: None,
-            annotations: None,
-            execution: None,
-            icons: None,
-            meta: None,
-        },
-        connector_id: None,
-        connector_name: None,
-        plugin_display_names: Vec::new(),
-        connector_description: None,
-    }
-}
-
-fn create_test_tool_with_connector(
-    server_name: &str,
-    tool_name: &str,
-    connector_id: &str,
-    connector_name: Option<&str>,
-) -> ToolInfo {
-    let mut tool = create_test_tool(server_name, tool_name);
-    tool.connector_id = Some(connector_id.to_string());
-    tool.connector_name = connector_name.map(ToOwned::to_owned);
-    tool
-}
-
-fn create_codex_apps_tools_cache_context(
-    codex_home: PathBuf,
-    account_id: Option<&str>,
-    chatgpt_user_id: Option<&str>,
-) -> CodexAppsToolsCacheContext {
-    CodexAppsToolsCacheContext {
-        codex_home,
-        user_key: CodexAppsToolsCacheKey {
-            account_id: account_id.map(ToOwned::to_owned),
-            chatgpt_user_id: chatgpt_user_id.map(ToOwned::to_owned),
-            is_workspace_account: false,
-        },
-    }
-}
-
-#[test]
-fn elicitation_granular_policy_defaults_to_prompting() {
-    assert!(!elicitation_is_rejected_by_policy(
-        AskForApproval::OnFailure
-    ));
-    assert!(!elicitation_is_rejected_by_policy(
-        AskForApproval::OnRequest
-    ));
-    assert!(!elicitation_is_rejected_by_policy(
-        AskForApproval::UnlessTrusted
-    ));
-    assert!(elicitation_is_rejected_by_policy(AskForApproval::Granular(
-        GranularApprovalConfig {
-            sandbox_approval: true,
-            rules: true,
-            skill_approval: true,
-            request_permissions: true,
-            mcp_elicitations: false,
-        }
-    )));
-}
-
-#[test]
-fn elicitation_granular_policy_respects_never_and_config() {
-    assert!(elicitation_is_rejected_by_policy(AskForApproval::Never));
-    assert!(elicitation_is_rejected_by_policy(AskForApproval::Granular(
-        GranularApprovalConfig {
-            sandbox_approval: true,
-            rules: true,
-            skill_approval: true,
-            request_permissions: true,
-            mcp_elicitations: false,
-        }
-    )));
-}
-
-#[test]
-fn test_qualify_tools_short_non_duplicated_names() {
-    let tools = vec![
-        create_test_tool("server1", "tool1"),
-        create_test_tool("server1", "tool2"),
-    ];
-
-    let qualified_tools = qualify_tools(tools);
-
-    assert_eq!(qualified_tools.len(), 2);
-    assert!(qualified_tools.contains_key("mcp__server1__tool1"));
-    assert!(qualified_tools.contains_key("mcp__server1__tool2"));
-}
-
-#[test]
-fn test_qualify_tools_duplicated_names_skipped() {
-    let tools = vec![
-        create_test_tool("server1", "duplicate_tool"),
-        create_test_tool("server1", "duplicate_tool"),
-    ];
-
-    let qualified_tools = qualify_tools(tools);
-
-    // Only the first tool should remain, the second is skipped
-    assert_eq!(qualified_tools.len(), 1);
-    assert!(qualified_tools.contains_key("mcp__server1__duplicate_tool"));
-}
-
-#[test]
-fn test_qualify_tools_long_names_same_server() {
-    let server_name = "my_server";
-
-    let tools = vec![
-        create_test_tool(
-            server_name,
-            "extremely_lengthy_function_name_that_absolutely_surpasses_all_reasonable_limits",
-        ),
-        create_test_tool(
-            server_name,
-            "yet_another_extremely_lengthy_function_name_that_absolutely_surpasses_all_reasonable_limits",
-        ),
-    ];
-
-    let qualified_tools = qualify_tools(tools);
-
-    assert_eq!(qualified_tools.len(), 2);
-
-    let mut keys: Vec<_> = qualified_tools.keys().cloned().collect();
-    keys.sort();
-
-    assert_eq!(keys[0].len(), 64);
-    assert_eq!(
-        keys[0],
-        "mcp__my_server__extremel119a2b97664e41363932dc84de21e2ff1b93b3e9"
-    );
-
-    assert_eq!(keys[1].len(), 64);
-    assert_eq!(
-        keys[1],
-        "mcp__my_server__yet_anot419a82a89325c1b477274a41f8c65ea5f3a7f341"
-    );
-}
-
-#[test]
-fn test_qualify_tools_sanitizes_invalid_characters() {
-    let tools = vec![create_test_tool("server.one", "tool.two-three")];
-
-    let qualified_tools = qualify_tools(tools);
-
-    assert_eq!(qualified_tools.len(), 1);
-    let (qualified_name, tool) = qualified_tools.into_iter().next().expect("one tool");
-    assert_eq!(qualified_name, "mcp__server_one__tool_two_three");
-
-    // The key is sanitized for OpenAI, but we keep original parts for the actual MCP call.
-    assert_eq!(tool.server_name, "server.one");
-    assert_eq!(tool.tool_name, "tool.two-three");
-
-    assert!(
-        qualified_name
-            .chars()
-            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-'),
-        "qualified name must be Responses API compatible: {qualified_name:?}"
-    );
-}
-
-#[test]
-fn tool_filter_allows_by_default() {
-    let filter = ToolFilter::default();
-
-    assert!(filter.allows("any"));
-}
-
-#[test]
-fn tool_filter_applies_enabled_list() {
-    let filter = ToolFilter {
-        enabled: Some(HashSet::from(["allowed".to_string()])),
-        disabled: HashSet::new(),
-    };
-
-    assert!(filter.allows("allowed"));
-    assert!(!filter.allows("denied"));
-}
-
-#[test]
-fn tool_filter_applies_disabled_list() {
-    let filter = ToolFilter {
-        enabled: None,
-        disabled: HashSet::from(["blocked".to_string()]),
-    };
-
-    assert!(!filter.allows("blocked"));
-    assert!(filter.allows("open"));
-}
-
-#[test]
-fn tool_filter_applies_enabled_then_disabled() {
-    let filter = ToolFilter {
-        enabled: Some(HashSet::from(["keep".to_string(), "remove".to_string()])),
-        disabled: HashSet::from(["remove".to_string()]),
-    };
-
-    assert!(filter.allows("keep"));
-    assert!(!filter.allows("remove"));
-    assert!(!filter.allows("unknown"));
-}
-
-#[test]
-fn filter_tools_applies_per_server_filters() {
-    let server1_tools = vec![
-        create_test_tool("server1", "tool_a"),
-        create_test_tool("server1", "tool_b"),
-    ];
-    let server2_tools = vec![create_test_tool("server2", "tool_a")];
-    let server1_filter = ToolFilter {
-        enabled: Some(HashSet::from(["tool_a".to_string(), "tool_b".to_string()])),
-        disabled: HashSet::from(["tool_b".to_string()]),
-    };
-    let server2_filter = ToolFilter {
-        enabled: None,
-        disabled: HashSet::from(["tool_a".to_string()]),
-    };
-
-    let filtered: Vec<_> = filter_tools(server1_tools, &server1_filter)
-        .into_iter()
-        .chain(filter_tools(server2_tools, &server2_filter))
-        .collect();
-
-    assert_eq!(filtered.len(), 1);
-    assert_eq!(filtered[0].server_name, "server1");
-    assert_eq!(filtered[0].tool_name, "tool_a");
-}
-
-#[test]
-fn codex_apps_tools_cache_is_overwritten_by_last_write() {
-    let codex_home = tempdir().expect("tempdir");
-    let cache_context = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-one"),
-        Some("user-one"),
-    );
-    let tools_gateway_1 = vec![create_test_tool(CODEX_APPS_MCP_SERVER_NAME, "one")];
-    let tools_gateway_2 = vec![create_test_tool(CODEX_APPS_MCP_SERVER_NAME, "two")];
-
-    write_cached_codex_apps_tools(&cache_context, &tools_gateway_1);
-    let cached_gateway_1 =
-        read_cached_codex_apps_tools(&cache_context).expect("cache entry exists for first write");
-    assert_eq!(cached_gateway_1[0].tool_name, "one");
-
-    write_cached_codex_apps_tools(&cache_context, &tools_gateway_2);
-    let cached_gateway_2 =
-        read_cached_codex_apps_tools(&cache_context).expect("cache entry exists for second write");
-    assert_eq!(cached_gateway_2[0].tool_name, "two");
-}
-
-#[test]
-fn codex_apps_tools_cache_is_scoped_per_user() {
-    let codex_home = tempdir().expect("tempdir");
-    let cache_context_user_1 = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-one"),
-        Some("user-one"),
-    );
-    let cache_context_user_2 = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-two"),
-        Some("user-two"),
-    );
-    let tools_user_1 = vec![create_test_tool(CODEX_APPS_MCP_SERVER_NAME, "one")];
-    let tools_user_2 = vec![create_test_tool(CODEX_APPS_MCP_SERVER_NAME, "two")];
-
-    write_cached_codex_apps_tools(&cache_context_user_1, &tools_user_1);
-    write_cached_codex_apps_tools(&cache_context_user_2, &tools_user_2);
-
-    let read_user_1 =
-        read_cached_codex_apps_tools(&cache_context_user_1).expect("cache entry for user one");
-    let read_user_2 =
-        read_cached_codex_apps_tools(&cache_context_user_2).expect("cache entry for user two");
-
-    assert_eq!(read_user_1[0].tool_name, "one");
-    assert_eq!(read_user_2[0].tool_name, "two");
-    assert_ne!(
-        cache_context_user_1.cache_path(),
-        cache_context_user_2.cache_path(),
-        "each user should get an isolated cache file"
-    );
-}
-
-#[test]
-fn codex_apps_tools_cache_filters_disallowed_connectors() {
-    let codex_home = tempdir().expect("tempdir");
-    let cache_context = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-one"),
-        Some("user-one"),
-    );
-    let tools = vec![
-        create_test_tool_with_connector(
-            CODEX_APPS_MCP_SERVER_NAME,
-            "blocked_tool",
-            "connector_openai_hidden",
-            Some("Hidden"),
-        ),
-        create_test_tool_with_connector(
-            CODEX_APPS_MCP_SERVER_NAME,
-            "allowed_tool",
-            "calendar",
-            Some("Calendar"),
-        ),
-    ];
-
-    write_cached_codex_apps_tools(&cache_context, &tools);
-    let cached = read_cached_codex_apps_tools(&cache_context).expect("cache entry exists for user");
-
-    assert_eq!(cached.len(), 1);
-    assert_eq!(cached[0].tool_name, "allowed_tool");
-    assert_eq!(cached[0].connector_id.as_deref(), Some("calendar"));
-}
-
-#[test]
-fn codex_apps_tools_cache_is_ignored_when_schema_version_mismatches() {
-    let codex_home = tempdir().expect("tempdir");
-    let cache_context = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-one"),
-        Some("user-one"),
-    );
-    let cache_path = cache_context.cache_path();
-    if let Some(parent) = cache_path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    let bytes = serde_json::to_vec_pretty(&serde_json::json!({
-        "schema_version": CODEX_APPS_TOOLS_CACHE_SCHEMA_VERSION + 1,
-        "tools": [create_test_tool(CODEX_APPS_MCP_SERVER_NAME, "one")],
-    }))
-    .expect("serialize");
-    std::fs::write(cache_path, bytes).expect("write");
-
-    assert!(read_cached_codex_apps_tools(&cache_context).is_none());
-}
-
-#[test]
-fn codex_apps_tools_cache_is_ignored_when_json_is_invalid() {
-    let codex_home = tempdir().expect("tempdir");
-    let cache_context = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-one"),
-        Some("user-one"),
-    );
-    let cache_path = cache_context.cache_path();
-    if let Some(parent) = cache_path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(cache_path, b"{not json").expect("write");
-
-    assert!(read_cached_codex_apps_tools(&cache_context).is_none());
-}
-
-#[test]
-fn startup_cached_codex_apps_tools_loads_from_disk_cache() {
-    let codex_home = tempdir().expect("tempdir");
-    let cache_context = create_codex_apps_tools_cache_context(
-        codex_home.path().to_path_buf(),
-        Some("account-one"),
-        Some("user-one"),
-    );
-    let cached_tools = vec![create_test_tool(
-        CODEX_APPS_MCP_SERVER_NAME,
-        "calendar_search",
-    )];
-    write_cached_codex_apps_tools(&cache_context, &cached_tools);
-
-    let startup_snapshot = load_startup_cached_codex_apps_tools_snapshot(
-        CODEX_APPS_MCP_SERVER_NAME,
-        Some(&cache_context),
-    );
-    let startup_tools = startup_snapshot.expect("expected startup snapshot to load from cache");
-
-    assert_eq!(startup_tools.len(), 1);
-    assert_eq!(startup_tools[0].server_name, CODEX_APPS_MCP_SERVER_NAME);
-    assert_eq!(startup_tools[0].tool_name, "calendar_search");
-}
-
-#[tokio::test]
-async fn list_all_tools_uses_startup_snapshot_while_client_is_pending() {
-    let startup_tools = vec![create_test_tool(
-        CODEX_APPS_MCP_SERVER_NAME,
-        "calendar_create_event",
-    )];
-    let pending_client = futures::future::pending::<Result<ManagedClient, StartupOutcomeError>>()
-        .boxed()
-        .shared();
-    let approval_policy = Constrained::allow_any(AskForApproval::OnFailure);
-    let mut manager = McpConnectionManager::new_uninitialized(&approval_policy);
-    manager.clients.insert(
-        CODEX_APPS_MCP_SERVER_NAME.to_string(),
-        AsyncManagedClient {
-            client: pending_client,
-            startup_snapshot: Some(startup_tools),
-            startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)),
-            tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()),
-        },
-    );
-
-    let tools = manager.list_all_tools().await;
-    let tool = tools
-        .get("mcp__codex_apps__calendar_create_event")
-        .expect("tool from startup cache");
-    assert_eq!(tool.server_name, CODEX_APPS_MCP_SERVER_NAME);
-    assert_eq!(tool.tool_name, "calendar_create_event");
-}
-
-#[tokio::test]
-async fn list_all_tools_blocks_while_client_is_pending_without_startup_snapshot() {
-    let pending_client = futures::future::pending::<Result<ManagedClient, StartupOutcomeError>>()
-        .boxed()
-        .shared();
-    let approval_policy = Constrained::allow_any(AskForApproval::OnFailure);
-    let mut manager = McpConnectionManager::new_uninitialized(&approval_policy);
-    manager.clients.insert(
-        CODEX_APPS_MCP_SERVER_NAME.to_string(),
-        AsyncManagedClient {
-            client: pending_client,
-            startup_snapshot: None,
-            startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)),
-            tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()),
-        },
-    );
-
-    let timeout_result =
-        tokio::time::timeout(Duration::from_millis(10), manager.list_all_tools()).await;
-    assert!(timeout_result.is_err());
-}
-
-#[tokio::test]
-async fn list_all_tools_does_not_block_when_startup_snapshot_cache_hit_is_empty() {
-    let pending_client = futures::future::pending::<Result<ManagedClient, StartupOutcomeError>>()
-        .boxed()
-        .shared();
-    let approval_policy = Constrained::allow_any(AskForApproval::OnFailure);
-    let mut manager = McpConnectionManager::new_uninitialized(&approval_policy);
-    manager.clients.insert(
-        CODEX_APPS_MCP_SERVER_NAME.to_string(),
-        AsyncManagedClient {
-            client: pending_client,
-            startup_snapshot: Some(Vec::new()),
-            startup_complete: Arc::new(std::sync::atomic::AtomicBool::new(false)),
-            tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()),
-        },
-    );
-
-    let timeout_result =
-        tokio::time::timeout(Duration::from_millis(10), manager.list_all_tools()).await;
-    let tools = timeout_result.expect("cache-hit startup snapshot should not block");
-    assert!(tools.is_empty());
-}
-
-#[tokio::test]
-async fn list_all_tools_uses_startup_snapshot_when_client_startup_fails() {
-    let startup_tools = vec![create_test_tool(
-        CODEX_APPS_MCP_SERVER_NAME,
-        "calendar_create_event",
-    )];
-    let failed_client = futures::future::ready::<Result<ManagedClient, StartupOutcomeError>>(Err(
-        StartupOutcomeError::Failed {
-            error: "startup failed".to_string(),
-        },
-    ))
-    .boxed()
-    .shared();
-    let approval_policy = Constrained::allow_any(AskForApproval::OnFailure);
-    let mut manager = McpConnectionManager::new_uninitialized(&approval_policy);
-    let startup_complete = Arc::new(std::sync::atomic::AtomicBool::new(true));
-    manager.clients.insert(
-        CODEX_APPS_MCP_SERVER_NAME.to_string(),
-        AsyncManagedClient {
-            client: failed_client,
-            startup_snapshot: Some(startup_tools),
-            startup_complete,
-            tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()),
-        },
-    );
-
-    let tools = manager.list_all_tools().await;
-    let tool = tools
-        .get("mcp__codex_apps__calendar_create_event")
-        .expect("tool from startup cache");
-    assert_eq!(tool.server_name, CODEX_APPS_MCP_SERVER_NAME);
-    assert_eq!(tool.tool_name, "calendar_create_event");
-}
-
-#[test]
-fn elicitation_capability_enabled_only_for_codex_apps() {
-    let codex_apps_capability = elicitation_capability_for_server(CODEX_APPS_MCP_SERVER_NAME);
-    assert!(matches!(
-        codex_apps_capability,
-        Some(ElicitationCapability {
-            form: Some(FormElicitationCapability {
-                schema_validation: None
-            }),
-            url: None,
-        })
-    ));
-
-    assert!(elicitation_capability_for_server("custom_mcp").is_none());
-}
-
-#[test]
-fn mcp_init_error_display_prompts_for_github_pat() {
-    let server_name = "github";
-    let entry = McpAuthStatusEntry {
-        config: McpServerConfig {
-            transport: McpServerTransportConfig::StreamableHttp {
-                url: "https://api.githubcopilot.com/mcp/".to_string(),
-                bearer_token_env_var: None,
-                http_headers: None,
-                env_http_headers: None,
-            },
-            enabled: true,
-            required: false,
-            disabled_reason: None,
-            startup_timeout_sec: None,
-            tool_timeout_sec: None,
-            enabled_tools: None,
-            disabled_tools: None,
-            scopes: None,
-            oauth_resource: None,
-            tools: HashMap::new(),
-        },
-        auth_status: McpAuthStatus::Unsupported,
-    };
-    let err: StartupOutcomeError = anyhow::anyhow!("OAuth is unsupported").into();
-
-    let display = mcp_init_error_display(server_name, Some(&entry), &err);
-
-    let expected = format!(
-        "GitHub MCP does not support OAuth. Log in by adding a personal access token (https://github.com/settings/personal-access-tokens) to your environment and config.toml:\n[mcp_servers.{server_name}]\nbearer_token_env_var = CODEX_GITHUB_PERSONAL_ACCESS_TOKEN"
-    );
-
-    assert_eq!(expected, display);
-}
-
-#[test]
-fn mcp_init_error_display_prompts_for_login_when_auth_required() {
-    let server_name = "example";
-    let err: StartupOutcomeError = anyhow::anyhow!("Auth required for server").into();
-
-    let display = mcp_init_error_display(server_name, /*entry*/ None, &err);
-
-    let expected = format!(
-        "The {server_name} MCP server is not logged in. Run `codex mcp login {server_name}`."
-    );
-
-    assert_eq!(expected, display);
-}
-
-#[test]
-fn mcp_init_error_display_reports_generic_errors() {
-    let server_name = "custom";
-    let entry = McpAuthStatusEntry {
-        config: McpServerConfig {
-            transport: McpServerTransportConfig::StreamableHttp {
-                url: "https://example.com".to_string(),
-                bearer_token_env_var: Some("TOKEN".to_string()),
-                http_headers: None,
-                env_http_headers: None,
-            },
-            enabled: true,
-            required: false,
-            disabled_reason: None,
-            startup_timeout_sec: None,
-            tool_timeout_sec: None,
-            enabled_tools: None,
-            disabled_tools: None,
-            scopes: None,
-            oauth_resource: None,
-            tools: HashMap::new(),
-        },
-        auth_status: McpAuthStatus::Unsupported,
-    };
-    let err: StartupOutcomeError = anyhow::anyhow!("boom").into();
-
-    let display = mcp_init_error_display(server_name, Some(&entry), &err);
-
-    let expected = format!("MCP client for `{server_name}` failed to start: {err:#}");
-
-    assert_eq!(expected, display);
-}
-
-#[test]
-fn mcp_init_error_display_includes_startup_timeout_hint() {
-    let server_name = "slow";
-    let err: StartupOutcomeError = anyhow::anyhow!("request timed out").into();
-
-    let display = mcp_init_error_display(server_name, /*entry*/ None, &err);
-
-    assert_eq!(
-        "MCP client for `slow` timed out after 10 seconds. Add or adjust `startup_timeout_sec` in your config.toml:\n[mcp_servers.slow]\nstartup_timeout_sec = XX",
-        display
-    );
-}
-
-#[test]
-fn transport_origin_extracts_http_origin() {
-    let transport = McpServerTransportConfig::StreamableHttp {
-        url: "https://example.com:8443/path?query=1".to_string(),
-        bearer_token_env_var: None,
-        http_headers: None,
-        env_http_headers: None,
-    };
-
-    assert_eq!(
-        transport_origin(&transport),
-        Some("https://example.com:8443".to_string())
-    );
-}
-
-#[test]
-fn transport_origin_is_stdio_for_stdio_transport() {
-    let transport = McpServerTransportConfig::Stdio {
-        command: "server".to_string(),
-        args: Vec::new(),
-        env: None,
-        env_vars: Vec::new(),
-        cwd: None,
-    };
-
-    assert_eq!(transport_origin(&transport), Some("stdio".to_string()));
-}

codex-rs/core/src/mcp_skill_dependencies.rs

@@ -1,6 +1,12 @@
 use std::collections::HashMap;
 use std::collections::HashSet;
 
+use codex_config::ConfigEditsBuilder;
+use codex_config::McpServerConfig;
+use codex_config::McpServerTransportConfig;
+use codex_config::load_global_mcp_servers;
+use codex_login::default_client::is_first_party_originator;
+use codex_login::default_client::originator;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::request_user_input::RequestUserInputArgs;
@@ -11,128 +17,19 @@ use codex_rmcp_client::perform_oauth_login;
 use tokio_util::sync::CancellationToken;
 use tracing::warn;
 
-use super::auth::McpOAuthLoginSupport;
-use super::auth::oauth_login_support;
-use super::auth::resolve_oauth_scopes;
-use super::auth::should_retry_without_scopes;
 use crate::SkillMetadata;
 use crate::codex::Session;
 use crate::codex::TurnContext;
-use crate::config::Config;
-use crate::config::edit::ConfigEditsBuilder;
-use crate::config::load_global_mcp_servers;
-use crate::config::types::McpServerConfig;
-use crate::config::types::McpServerTransportConfig;
-use crate::default_client::is_first_party_originator;
-use crate::default_client::originator;
-use crate::model::SkillToolDependency;
-use codex_features::Feature;
+use crate::mcp::auth::McpOAuthLoginSupport;
+use crate::mcp::auth::oauth_login_support;
+use crate::mcp::auth::resolve_oauth_scopes;
+use crate::mcp::auth::should_retry_without_scopes;
+use crate::skills::model::SkillToolDependency;
 
 const SKILL_MCP_DEPENDENCY_PROMPT_ID: &str = "skill_mcp_dependency_install";
 const MCP_DEPENDENCY_OPTION_INSTALL: &str = "Install";
 const MCP_DEPENDENCY_OPTION_SKIP: &str = "Continue anyway";
 
-fn is_full_access_mode(turn_context: &TurnContext) -> bool {
-    matches!(turn_context.approval_policy.value(), AskForApproval::Never)
-        && matches!(
-            turn_context.sandbox_policy.get(),
-            SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
-        )
-}
-
-fn format_missing_mcp_dependencies(missing: &HashMap<String, McpServerConfig>) -> String {
-    let mut names = missing.keys().cloned().collect::<Vec<_>>();
-    names.sort();
-    names.join(", ")
-}
-
-async fn filter_prompted_mcp_dependencies(
-    sess: &Session,
-    missing: &HashMap<String, McpServerConfig>,
-) -> HashMap<String, McpServerConfig> {
-    let prompted = sess.mcp_dependency_prompted().await;
-    if prompted.is_empty() {
-        return missing.clone();
-    }
-
-    missing
-        .iter()
-        .filter(|(name, config)| !prompted.contains(&canonical_mcp_server_key(name, config)))
-        .map(|(name, config)| (name.clone(), config.clone()))
-        .collect()
-}
-
-async fn should_install_mcp_dependencies(
-    sess: &Session,
-    turn_context: &TurnContext,
-    missing: &HashMap<String, McpServerConfig>,
-    cancellation_token: &CancellationToken,
-) -> bool {
-    if is_full_access_mode(turn_context) {
-        return true;
-    }
-
-    let server_list = format_missing_mcp_dependencies(missing);
-    let question = RequestUserInputQuestion {
-        id: SKILL_MCP_DEPENDENCY_PROMPT_ID.to_string(),
-        header: "Install MCP servers?".to_string(),
-        question: format!(
-            "The following MCP servers are required by the selected skills but are not installed yet: {server_list}. Install them now?"
-        ),
-        is_other: false,
-        is_secret: false,
-        options: Some(vec![
-            RequestUserInputQuestionOption {
-                label: MCP_DEPENDENCY_OPTION_INSTALL.to_string(),
-                description:
-                    "Install and enable the missing MCP servers in your global config."
-                        .to_string(),
-            },
-            RequestUserInputQuestionOption {
-                label: MCP_DEPENDENCY_OPTION_SKIP.to_string(),
-                description: "Skip installation for now and do not show again for these MCP servers in this session."
-                    .to_string(),
-            },
-        ]),
-    };
-    let args = RequestUserInputArgs {
-        questions: vec![question],
-    };
-    let sub_id = &turn_context.sub_id;
-    let call_id = format!("mcp-deps-{sub_id}");
-    let response_fut = sess.request_user_input(turn_context, call_id, args);
-    let response = tokio::select! {
-        biased;
-        _ = cancellation_token.cancelled() => {
-            let empty = RequestUserInputResponse {
-                answers: HashMap::new(),
-            };
-            sess.notify_user_input_response(sub_id, empty.clone()).await;
-            empty
-        }
-        response = response_fut => response.unwrap_or_else(|| RequestUserInputResponse {
-            answers: HashMap::new(),
-        }),
-    };
-
-    let install = response
-        .answers
-        .get(SKILL_MCP_DEPENDENCY_PROMPT_ID)
-        .is_some_and(|answer| {
-            answer
-                .answers
-                .iter()
-                .any(|entry| entry == MCP_DEPENDENCY_OPTION_INSTALL)
-        });
-
-    let prompted_keys = missing
-        .iter()
-        .map(|(name, config)| canonical_mcp_server_key(name, config));
-    sess.record_mcp_dependency_prompted(prompted_keys).await;
-
-    install
-}
-
 pub(crate) async fn maybe_prompt_and_install_mcp_dependencies(
     sess: &Session,
     turn_context: &TurnContext,
@@ -146,7 +43,11 @@ pub(crate) async fn maybe_prompt_and_install_mcp_dependencies(
     }
 
     let config = turn_context.config.clone();
-    if mentioned_skills.is_empty() || !config.features.enabled(Feature::SkillMcpDependencyInstall) {
+    if mentioned_skills.is_empty()
+        || !config
+            .features
+            .enabled(codex_features::Feature::SkillMcpDependencyInstall)
+    {
         return;
     }
 
@@ -174,10 +75,14 @@ pub(crate) async fn maybe_prompt_and_install_mcp_dependencies(
 pub(crate) async fn maybe_install_mcp_dependencies(
     sess: &Session,
     turn_context: &TurnContext,
-    config: &Config,
+    config: &crate::config::Config,
     mentioned_skills: &[SkillMetadata],
 ) {
-    if mentioned_skills.is_empty() || !config.features.enabled(Feature::SkillMcpDependencyInstall) {
+    if mentioned_skills.is_empty()
+        || !config
+            .features
+            .enabled(codex_features::Feature::SkillMcpDependencyInstall)
+    {
         return;
     }
 
@@ -307,6 +212,107 @@ pub(crate) async fn maybe_install_mcp_dependencies(
     .await;
 }
 
+async fn should_install_mcp_dependencies(
+    sess: &Session,
+    turn_context: &TurnContext,
+    missing: &HashMap<String, McpServerConfig>,
+    cancellation_token: &CancellationToken,
+) -> bool {
+    if is_full_access_mode(turn_context) {
+        return true;
+    }
+
+    let server_list = format_missing_mcp_dependencies(missing);
+    let question = RequestUserInputQuestion {
+        id: SKILL_MCP_DEPENDENCY_PROMPT_ID.to_string(),
+        header: "Install MCP servers?".to_string(),
+        question: format!(
+            "The following MCP servers are required by the selected skills but are not installed yet: {server_list}. Install them now?"
+        ),
+        is_other: false,
+        is_secret: false,
+        options: Some(vec![
+            RequestUserInputQuestionOption {
+                label: MCP_DEPENDENCY_OPTION_INSTALL.to_string(),
+                description:
+                    "Install and enable the missing MCP servers in your global config."
+                        .to_string(),
+            },
+            RequestUserInputQuestionOption {
+                label: MCP_DEPENDENCY_OPTION_SKIP.to_string(),
+                description: "Skip installation for now and do not show again for these MCP servers in this session."
+                    .to_string(),
+            },
+        ]),
+    };
+    let args = RequestUserInputArgs {
+        questions: vec![question],
+    };
+    let sub_id = &turn_context.sub_id;
+    let call_id = format!("mcp-deps-{sub_id}");
+    let response_fut = sess.request_user_input(turn_context, call_id, args);
+    let response = tokio::select! {
+        biased;
+        _ = cancellation_token.cancelled() => {
+            let empty = RequestUserInputResponse {
+                answers: HashMap::new(),
+            };
+            sess.notify_user_input_response(sub_id, empty.clone()).await;
+            empty
+        }
+        response = response_fut => response.unwrap_or_else(|| RequestUserInputResponse {
+            answers: HashMap::new(),
+        }),
+    };
+
+    let install = response
+        .answers
+        .get(SKILL_MCP_DEPENDENCY_PROMPT_ID)
+        .is_some_and(|answer| {
+            answer
+                .answers
+                .iter()
+                .any(|entry| entry == MCP_DEPENDENCY_OPTION_INSTALL)
+        });
+
+    let prompted_keys = missing
+        .iter()
+        .map(|(name, config)| canonical_mcp_server_key(name, config));
+    sess.record_mcp_dependency_prompted(prompted_keys).await;
+
+    install
+}
+
+async fn filter_prompted_mcp_dependencies(
+    sess: &Session,
+    missing: &HashMap<String, McpServerConfig>,
+) -> HashMap<String, McpServerConfig> {
+    let prompted = sess.mcp_dependency_prompted().await;
+    if prompted.is_empty() {
+        return missing.clone();
+    }
+
+    missing
+        .iter()
+        .filter(|(name, config)| !prompted.contains(&canonical_mcp_server_key(name, config)))
+        .map(|(name, config)| (name.clone(), config.clone()))
+        .collect()
+}
+
+fn format_missing_mcp_dependencies(missing: &HashMap<String, McpServerConfig>) -> String {
+    let mut names = missing.keys().cloned().collect::<Vec<_>>();
+    names.sort();
+    names.join(", ")
+}
+
+fn is_full_access_mode(turn_context: &TurnContext) -> bool {
+    matches!(turn_context.approval_policy.value(), AskForApproval::Never)
+        && matches!(
+            turn_context.sandbox_policy.get(),
+            SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
+        )
+}
+
 fn canonical_mcp_key(transport: &str, identifier: &str, fallback: &str) -> String {
     let identifier = identifier.trim();
     if identifier.is_empty() {
@@ -346,63 +352,6 @@ fn canonical_mcp_dependency_key(dependency: &SkillToolDependency) -> Result<Stri
     Err(format!("unsupported transport {transport}"))
 }
 
-pub(crate) fn collect_missing_mcp_dependencies(
-    mentioned_skills: &[SkillMetadata],
-    installed: &HashMap<String, McpServerConfig>,
-) -> HashMap<String, McpServerConfig> {
-    let mut missing = HashMap::new();
-    let installed_keys: HashSet<String> = installed
-        .iter()
-        .map(|(name, config)| canonical_mcp_server_key(name, config))
-        .collect();
-    let mut seen_canonical_keys = HashSet::new();
-
-    for skill in mentioned_skills {
-        let Some(dependencies) = skill.dependencies.as_ref() else {
-            continue;
-        };
-
-        for tool in &dependencies.tools {
-            if !tool.r#type.eq_ignore_ascii_case("mcp") {
-                continue;
-            }
-            let dependency_key = match canonical_mcp_dependency_key(tool) {
-                Ok(key) => key,
-                Err(err) => {
-                    let dependency = tool.value.as_str();
-                    let skill_name = skill.name.as_str();
-                    warn!(
-                        "unable to auto-install MCP dependency {dependency} for skill {skill_name}: {err}",
-                    );
-                    continue;
-                }
-            };
-            if installed_keys.contains(&dependency_key)
-                || seen_canonical_keys.contains(&dependency_key)
-            {
-                continue;
-            }
-
-            let config = match mcp_dependency_to_server_config(tool) {
-                Ok(config) => config,
-                Err(err) => {
-                    let dependency = dependency_key.as_str();
-                    let skill_name = skill.name.as_str();
-                    warn!(
-                        "unable to auto-install MCP dependency {dependency} for skill {skill_name}: {err}",
-                    );
-                    continue;
-                }
-            };
-
-            missing.insert(tool.value.clone(), config);
-            seen_canonical_keys.insert(dependency_key);
-        }
-    }
-
-    missing
-}
-
 fn mcp_dependency_to_server_config(
     dependency: &SkillToolDependency,
 ) -> Result<McpServerConfig, String> {
@@ -461,6 +410,59 @@ fn mcp_dependency_to_server_config(
     Err(format!("unsupported transport {transport}"))
 }
 
-#[cfg(test)]
-#[path = "skill_dependencies_tests.rs"]
-mod tests;
+fn collect_missing_mcp_dependencies(
+    mentioned_skills: &[SkillMetadata],
+    installed: &HashMap<String, McpServerConfig>,
+) -> HashMap<String, McpServerConfig> {
+    let mut missing = HashMap::new();
+    let installed_keys: HashSet<String> = installed
+        .iter()
+        .map(|(name, config)| canonical_mcp_server_key(name, config))
+        .collect();
+    let mut seen_canonical_keys = HashSet::new();
+
+    for skill in mentioned_skills {
+        let Some(dependencies) = skill.dependencies.as_ref() else {
+            continue;
+        };
+
+        for tool in &dependencies.tools {
+            if !tool.r#type.eq_ignore_ascii_case("mcp") {
+                continue;
+            }
+            let dependency_key = match canonical_mcp_dependency_key(tool) {
+                Ok(key) => key,
+                Err(err) => {
+                    let dependency = tool.value.as_str();
+                    let skill_name = skill.name.as_str();
+                    warn!(
+                        "unable to auto-install MCP dependency {dependency} for skill {skill_name}: {err}",
+                    );
+                    continue;
+                }
+            };
+            if installed_keys.contains(&dependency_key)
+                || seen_canonical_keys.contains(&dependency_key)
+            {
+                continue;
+            }
+
+            let config = match mcp_dependency_to_server_config(tool) {
+                Ok(config) => config,
+                Err(err) => {
+                    let dependency = dependency_key.as_str();
+                    let skill_name = skill.name.as_str();
+                    warn!(
+                        "unable to auto-install MCP dependency {dependency} for skill {skill_name}: {err}",
+                    );
+                    continue;
+                }
+            };
+
+            missing.insert(tool.value.clone(), config);
+            seen_canonical_keys.insert(dependency_key);
+        }
+    }
+
+    missing
+}

codex-rs/core/src/model_provider_info.rs

@@ -9,6 +9,7 @@ use crate::auth::AuthMode;
 use crate::error::EnvVarError;
 use codex_api::Provider as ApiProvider;
 use codex_api::provider::RetryConfig as ApiRetryConfig;
+use codex_protocol::config_types::ModelProviderAuthInfo;
 use http::HeaderMap;
 use http::header::HeaderName;
 use http::header::HeaderValue;
@@ -86,6 +87,9 @@ pub struct ModelProviderInfo {
     /// this may be necessary when using this programmatically.
     pub experimental_bearer_token: Option<String>,
 
+    /// Command-backed bearer-token configuration for this provider.
+    pub auth: Option<ModelProviderAuthInfo>,
+
     /// Which wire protocol this provider expects.
     #[serde(default)]
     pub wire_api: WireApi,
@@ -130,6 +134,36 @@ pub struct ModelProviderInfo {
 }
 
 impl ModelProviderInfo {
+    pub(crate) fn validate(&self) -> std::result::Result<(), String> {
+        let Some(auth) = self.auth.as_ref() else {
+            return Ok(());
+        };
+
+        if auth.command.trim().is_empty() {
+            return Err("provider auth.command must not be empty".to_string());
+        }
+
+        let mut conflicts = Vec::new();
+        if self.env_key.is_some() {
+            conflicts.push("env_key");
+        }
+        if self.experimental_bearer_token.is_some() {
+            conflicts.push("experimental_bearer_token");
+        }
+        if self.requires_openai_auth {
+            conflicts.push("requires_openai_auth");
+        }
+
+        if conflicts.is_empty() {
+            Ok(())
+        } else {
+            Err(format!(
+                "provider auth cannot be combined with {}",
+                conflicts.join(", ")
+            ))
+        }
+    }
+
     fn build_header_map(&self) -> crate::error::Result<HeaderMap> {
         let capacity = self.http_headers.as_ref().map_or(0, HashMap::len)
             + self.env_http_headers.as_ref().map_or(0, HashMap::len);
@@ -246,6 +280,7 @@ impl ModelProviderInfo {
             env_key: None,
             env_key_instructions: None,
             experimental_bearer_token: None,
+            auth: None,
             wire_api: WireApi::Responses,
             query_params: None,
             http_headers: Some(
@@ -277,6 +312,10 @@ impl ModelProviderInfo {
     pub fn is_openai(&self) -> bool {
         self.name == OPENAI_PROVIDER_NAME
     }
+
+    pub(crate) fn has_command_auth(&self) -> bool {
+        self.auth.is_some()
+    }
 }
 
 pub const DEFAULT_LMSTUDIO_PORT: u16 = 1234;
@@ -338,6 +377,7 @@ pub fn create_oss_provider_with_base_url(base_url: &str, wire_api: WireApi) -> M
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api,
         query_params: None,
         http_headers: None,

codex-rs/core/src/model_provider_info_tests.rs

@@ -1,5 +1,9 @@
 use super::*;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_absolute_path::AbsolutePathBufGuard;
 use pretty_assertions::assert_eq;
+use std::num::NonZeroU64;
+use tempfile::tempdir;
 
 #[test]
 fn test_deserialize_ollama_model_provider_toml() {
@@ -13,6 +17,7 @@ base_url = "http://localhost:11434/v1"
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,
@@ -43,6 +48,7 @@ query_params = { api-version = "2025-04-01-preview" }
         env_key: Some("AZURE_OPENAI_API_KEY".into()),
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: Some(maplit::hashmap! {
             "api-version".to_string() => "2025-04-01-preview".to_string(),
@@ -76,6 +82,7 @@ env_http_headers = { "X-Example-Env-Header" = "EXAMPLE_ENV_VAR" }
         env_key: Some("API_KEY".into()),
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: Some(maplit::hashmap! {
@@ -121,3 +128,52 @@ supports_websockets = true
     let provider: ModelProviderInfo = toml::from_str(provider_toml).unwrap();
     assert_eq!(provider.websocket_connect_timeout_ms, Some(15_000));
 }
+
+#[test]
+fn test_deserialize_provider_auth_config_defaults() {
+    let base_dir = tempdir().unwrap();
+    let provider_toml = r#"
+name = "Corp"
+
+[auth]
+command = "./scripts/print-token"
+args = ["--format=text"]
+        "#;
+
+    let provider: ModelProviderInfo = {
+        let _guard = AbsolutePathBufGuard::new(base_dir.path());
+        toml::from_str(provider_toml).unwrap()
+    };
+
+    assert_eq!(
+        provider.auth,
+        Some(ModelProviderAuthInfo {
+            command: "./scripts/print-token".to_string(),
+            args: vec!["--format=text".to_string()],
+            timeout_ms: NonZeroU64::new(5_000).unwrap(),
+            refresh_interval_ms: 300_000,
+            cwd: AbsolutePathBuf::resolve_path_against_base(".", base_dir.path()).unwrap(),
+        })
+    );
+}
+
+#[test]
+fn test_deserialize_provider_auth_config_allows_zero_refresh_interval() {
+    let base_dir = tempdir().unwrap();
+    let provider_toml = r#"
+name = "Corp"
+
+[auth]
+command = "./scripts/print-token"
+refresh_interval_ms = 0
+        "#;
+
+    let provider: ModelProviderInfo = {
+        let _guard = AbsolutePathBufGuard::new(base_dir.path());
+        toml::from_str(provider_toml).unwrap()
+    };
+
+    let auth = provider.auth.expect("auth config should deserialize");
+    assert_eq!(auth.refresh_interval_ms, 0);
+    assert_eq!(auth.refresh_interval(), None);
+}

codex-rs/core/src/models_manager/manager.rs

@@ -14,6 +14,7 @@ use crate::model_provider_info::ModelProviderInfo;
 use crate::models_manager::collaboration_mode_presets::CollaborationModesConfig;
 use crate::models_manager::collaboration_mode_presets::builtin_collaboration_mode_presets;
 use crate::models_manager::model_info;
+use crate::provider_auth::required_auth_manager_for_provider;
 use crate::response_debug_context::extract_response_debug_context;
 use crate::response_debug_context::telemetry_transport_error_message;
 use crate::util::FeedbackRequestTags;
@@ -212,6 +213,7 @@ impl ModelsManager {
         collaboration_modes_config: CollaborationModesConfig,
         provider: ModelProviderInfo,
     ) -> Self {
+        let auth_manager = required_auth_manager_for_provider(auth_manager, &provider);
         let cache_path = codex_home.join(MODEL_CACHE_FILE);
         let cache_manager = ModelsCacheManager::new(cache_path, DEFAULT_MODEL_CACHE_TTL);
         let catalog_mode = if model_catalog.is_some() {
@@ -396,7 +398,9 @@ impl ModelsManager {
             return Ok(());
         }
 
-        if self.auth_manager.auth_mode() != Some(AuthMode::Chatgpt) {
+        if self.auth_manager.auth_mode() != Some(AuthMode::Chatgpt)
+            && !self.provider.has_command_auth()
+        {
             if matches!(
                 refresh_strategy,
                 RefreshStrategy::Offline | RefreshStrategy::OnlineIfUncached

codex-rs/core/src/models_manager/manager_tests.rs

@@ -1,5 +1,7 @@
 use super::*;
+use crate::AuthManager;
 use crate::CodexAuth;
+use crate::ModelProviderAuthInfo;
 use crate::auth::AuthCredentialsStoreMode;
 use crate::config::ConfigBuilder;
 use crate::model_provider_info::WireApi;
@@ -13,8 +15,10 @@ use http::StatusCode;
 use pretty_assertions::assert_eq;
 use serde_json::json;
 use std::collections::BTreeMap;
+use std::num::NonZeroU64;
 use std::sync::Arc;
 use std::sync::Mutex;
+use tempfile::TempDir;
 use tempfile::tempdir;
 use tracing::Event;
 use tracing::Subscriber;
@@ -24,7 +28,12 @@ use tracing_subscriber::layer::Context;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::registry::LookupSpan;
 use tracing_subscriber::util::SubscriberInitExt;
+use wiremock::Mock;
 use wiremock::MockServer;
+use wiremock::ResponseTemplate;
+use wiremock::matchers::header_regex;
+use wiremock::matchers::method;
+use wiremock::matchers::path;
 
 fn remote_model(slug: &str, display: &str, priority: i32) -> ModelInfo {
     remote_model_with_visibility(slug, display, priority, "list")
@@ -79,6 +88,7 @@ fn provider_for(base_url: String) -> ModelProviderInfo {
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,
@@ -92,6 +102,88 @@ fn provider_for(base_url: String) -> ModelProviderInfo {
     }
 }
 
+struct ProviderAuthScript {
+    tempdir: TempDir,
+    command: String,
+    args: Vec<String>,
+}
+
+impl ProviderAuthScript {
+    fn new(tokens: &[&str]) -> std::io::Result<Self> {
+        let tempdir = tempfile::tempdir()?;
+        let tokens_file = tempdir.path().join("tokens.txt");
+        let mut token_file_contents = String::new();
+        for token in tokens {
+            token_file_contents.push_str(token);
+            token_file_contents.push('\n');
+        }
+        std::fs::write(&tokens_file, token_file_contents)?;
+
+        #[cfg(unix)]
+        let (command, args) = {
+            let script_path = tempdir.path().join("print-token.sh");
+            std::fs::write(
+                &script_path,
+                r#"#!/bin/sh
+first_line=$(sed -n '1p' tokens.txt)
+printf '%s\n' "$first_line"
+tail -n +2 tokens.txt > tokens.next
+mv tokens.next tokens.txt
+"#,
+            )?;
+            let mut permissions = std::fs::metadata(&script_path)?.permissions();
+            {
+                use std::os::unix::fs::PermissionsExt;
+                permissions.set_mode(0o755);
+            }
+            std::fs::set_permissions(&script_path, permissions)?;
+            ("./print-token.sh".to_string(), Vec::new())
+        };
+
+        #[cfg(windows)]
+        let (command, args) = {
+            let script_path = tempdir.path().join("print-token.ps1");
+            std::fs::write(
+                &script_path,
+                r#"$lines = @(Get-Content -Path tokens.txt)
+if ($lines.Count -eq 0) { exit 1 }
+Write-Output $lines[0]
+$lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt
+"#,
+            )?;
+            (
+                "powershell".to_string(),
+                vec![
+                    "-NoProfile".to_string(),
+                    "-ExecutionPolicy".to_string(),
+                    "Bypass".to_string(),
+                    "-File".to_string(),
+                    ".\\print-token.ps1".to_string(),
+                ],
+            )
+        };
+
+        Ok(Self {
+            tempdir,
+            command,
+            args,
+        })
+    }
+
+    fn auth_config(&self) -> ModelProviderAuthInfo {
+        ModelProviderAuthInfo {
+            command: self.command.clone(),
+            args: self.args.clone(),
+            timeout_ms: NonZeroU64::new(/*value*/ 1_000).unwrap(),
+            refresh_interval_ms: 60_000,
+            cwd: match codex_utils_absolute_path::AbsolutePathBuf::try_from(self.tempdir.path()) {
+                Ok(cwd) => cwd,
+                Err(err) => panic!("tempdir should be absolute: {err}"),
+            },
+        }
+    }
+}
+
 #[derive(Default)]
 struct TagCollectorVisitor {
     tags: BTreeMap<String, String>,
@@ -310,6 +402,50 @@ async fn refresh_available_models_sorts_by_priority() {
     );
 }
 
+#[tokio::test]
+async fn refresh_available_models_uses_provider_auth_token() {
+    let server = MockServer::start().await;
+    let auth_script = ProviderAuthScript::new(&["provider-token"]).unwrap();
+    let remote_models = vec![remote_model(
+        "provider-model",
+        "Provider",
+        /*priority*/ 0,
+    )];
+
+    Mock::given(method("GET"))
+        .and(path("/models"))
+        .and(header_regex("Authorization", "Bearer provider-token"))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "application/json")
+                .set_body_json(ModelsResponse {
+                    models: remote_models.clone(),
+                }),
+        )
+        .expect(1)
+        .mount(&server)
+        .await;
+
+    let codex_home = tempdir().expect("temp dir");
+    let auth_manager = AuthManager::from_auth_for_testing(CodexAuth::from_api_key("unused"));
+    let provider = ModelProviderInfo {
+        auth: Some(auth_script.auth_config()),
+        ..provider_for(server.uri())
+    };
+    let manager = ModelsManager::with_provider_for_tests(
+        codex_home.path().to_path_buf(),
+        auth_manager,
+        provider,
+    );
+
+    manager
+        .refresh_available_models(RefreshStrategy::Online)
+        .await
+        .expect("refresh succeeds");
+
+    assert_models_contain(&manager.get_remote_models().await, &remote_models);
+}
+
 #[tokio::test]
 async fn refresh_available_models_uses_cache_when_fresh() {
     let server = MockServer::start().await;

codex-rs/core/src/original_image_detail.rs

@@ -1,28 +1,2 @@
-use codex_features::Feature;
-use codex_features::Features;
-use codex_protocol::models::ImageDetail;
-use codex_protocol::openai_models::ModelInfo;
-
-pub(crate) fn can_request_original_image_detail(
-    features: &Features,
-    model_info: &ModelInfo,
-) -> bool {
-    model_info.supports_image_detail_original && features.enabled(Feature::ImageDetailOriginal)
-}
-
-pub(crate) fn normalize_output_image_detail(
-    features: &Features,
-    model_info: &ModelInfo,
-    detail: Option<ImageDetail>,
-) -> Option<ImageDetail> {
-    match detail {
-        Some(ImageDetail::Original) if can_request_original_image_detail(features, model_info) => {
-            Some(ImageDetail::Original)
-        }
-        Some(ImageDetail::Original) | Some(_) | None => None,
-    }
-}
-
-#[cfg(test)]
-#[path = "original_image_detail_tests.rs"]
-mod tests;
+pub(crate) use codex_tools::can_request_original_image_detail;
+pub(crate) use codex_tools::normalize_output_image_detail;

codex-rs/core/src/original_image_detail_tests.rs

@@ -1,63 +0,0 @@
-use super::*;
-
-use crate::config::test_config;
-use crate::models_manager::manager::ModelsManager;
-use codex_features::Features;
-use pretty_assertions::assert_eq;
-
-#[test]
-fn image_detail_original_feature_enables_explicit_original_without_force() {
-    let config = test_config();
-    let mut model_info =
-        ModelsManager::construct_model_info_offline_for_tests("gpt-5-codex", &config);
-    model_info.supports_image_detail_original = true;
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ImageDetailOriginal);
-
-    assert!(can_request_original_image_detail(&features, &model_info));
-    assert_eq!(
-        normalize_output_image_detail(&features, &model_info, Some(ImageDetail::Original)),
-        Some(ImageDetail::Original)
-    );
-    assert_eq!(
-        normalize_output_image_detail(&features, &model_info, /*detail*/ None),
-        None
-    );
-}
-
-#[test]
-fn explicit_original_is_dropped_without_feature_or_model_support() {
-    let config = test_config();
-    let mut model_info =
-        ModelsManager::construct_model_info_offline_for_tests("gpt-5-codex", &config);
-    model_info.supports_image_detail_original = true;
-    let features = Features::with_defaults();
-
-    assert_eq!(
-        normalize_output_image_detail(&features, &model_info, Some(ImageDetail::Original)),
-        None
-    );
-
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ImageDetailOriginal);
-    model_info.supports_image_detail_original = false;
-    assert_eq!(
-        normalize_output_image_detail(&features, &model_info, Some(ImageDetail::Original)),
-        None
-    );
-}
-
-#[test]
-fn unsupported_non_original_detail_is_dropped() {
-    let config = test_config();
-    let mut model_info =
-        ModelsManager::construct_model_info_offline_for_tests("gpt-5-codex", &config);
-    model_info.supports_image_detail_original = true;
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ImageDetailOriginal);
-
-    assert_eq!(
-        normalize_output_image_detail(&features, &model_info, Some(ImageDetail::Low)),
-        None
-    );
-}

codex-rs/core/src/plugins/discoverable.rs

@@ -9,6 +9,7 @@ use super::PluginsManager;
 use crate::config::Config;
 use crate::config::types::ToolSuggestDiscoverableType;
 use codex_features::Feature;
+use codex_tools::DiscoverablePluginInfo;
 
 const TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST: &[&str] = &[
     "github@openai-curated",
@@ -23,7 +24,7 @@ const TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST: &[&str] = &[
 
 pub(crate) fn list_tool_suggest_discoverable_plugins(
     config: &Config,
-) -> anyhow::Result<Vec<PluginCapabilitySummary>> {
+) -> anyhow::Result<Vec<DiscoverablePluginInfo>> {
     if !config.features.enabled(Feature::Plugins) {
         return Ok(Vec::new());
     }
@@ -47,7 +48,7 @@ pub(crate) fn list_tool_suggest_discoverable_plugins(
         return Ok(Vec::new());
     };
 
-    let mut discoverable_plugins = Vec::<PluginCapabilitySummary>::new();
+    let mut discoverable_plugins = Vec::<DiscoverablePluginInfo>::new();
     for plugin in curated_marketplace.plugins {
         if plugin.installed
             || (!TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST.contains(&plugin.id.as_str())
@@ -66,14 +67,28 @@ pub(crate) fn list_tool_suggest_discoverable_plugins(
                 marketplace_path: curated_marketplace.path.clone(),
             },
         ) {
-            Ok(plugin) => discoverable_plugins.push(plugin.plugin.into()),
+            Ok(plugin) => {
+                let plugin: PluginCapabilitySummary = plugin.plugin.into();
+                discoverable_plugins.push(DiscoverablePluginInfo {
+                    id: plugin.config_name,
+                    name: plugin.display_name,
+                    description: plugin.description,
+                    has_skills: plugin.has_skills,
+                    mcp_server_names: plugin.mcp_server_names,
+                    app_connector_ids: plugin
+                        .app_connector_ids
+                        .into_iter()
+                        .map(|connector_id| connector_id.0)
+                        .collect(),
+                });
+            }
             Err(err) => warn!("failed to load discoverable plugin suggestion {plugin_id}: {err:#}"),
         }
     }
     discoverable_plugins.sort_by(|left, right| {
-        left.display_name
-            .cmp(&right.display_name)
-            .then_with(|| left.config_name.cmp(&right.config_name))
+        left.name
+            .cmp(&right.name)
+            .then_with(|| left.id.cmp(&right.id))
     });
     Ok(discoverable_plugins)
 }

codex-rs/core/src/plugins/discoverable_tests.rs

@@ -5,7 +5,7 @@ use crate::plugins::test_support::write_curated_plugin_sha;
 use crate::plugins::test_support::write_file;
 use crate::plugins::test_support::write_openai_curated_marketplace;
 use crate::plugins::test_support::write_plugins_feature_config;
-use crate::tools::discoverable::DiscoverablePluginInfo;
+use codex_tools::DiscoverablePluginInfo;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use tempfile::tempdir;
@@ -18,11 +18,7 @@ async fn list_tool_suggest_discoverable_plugins_returns_uninstalled_curated_plug
     write_plugins_feature_config(codex_home.path());
 
     let config = load_plugins_config(codex_home.path()).await;
-    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config)
-        .unwrap()
-        .into_iter()
-        .map(DiscoverablePluginInfo::from)
-        .collect::<Vec<_>>();
+    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config).unwrap();
 
     assert_eq!(
         discoverable_plugins,
@@ -52,11 +48,7 @@ plugins = false
     );
 
     let config = load_plugins_config(codex_home.path()).await;
-    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config)
-        .unwrap()
-        .into_iter()
-        .map(DiscoverablePluginInfo::from)
-        .collect::<Vec<_>>();
+    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config).unwrap();
 
     assert_eq!(discoverable_plugins, Vec::<DiscoverablePluginInfo>::new());
 }
@@ -76,11 +68,7 @@ async fn list_tool_suggest_discoverable_plugins_normalizes_description() {
     );
 
     let config = load_plugins_config(codex_home.path()).await;
-    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config)
-        .unwrap()
-        .into_iter()
-        .map(DiscoverablePluginInfo::from)
-        .collect::<Vec<_>>();
+    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config).unwrap();
 
     assert_eq!(
         discoverable_plugins,
@@ -115,11 +103,7 @@ async fn list_tool_suggest_discoverable_plugins_omits_installed_curated_plugins(
         .expect("plugin should install");
 
     let refreshed_config = load_plugins_config(codex_home.path()).await;
-    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&refreshed_config)
-        .unwrap()
-        .into_iter()
-        .map(DiscoverablePluginInfo::from)
-        .collect::<Vec<_>>();
+    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&refreshed_config).unwrap();
 
     assert_eq!(discoverable_plugins, Vec::<DiscoverablePluginInfo>::new());
 }
@@ -140,11 +124,7 @@ discoverables = [{ type = "plugin", id = "sample@openai-curated" }]
     );
 
     let config = load_plugins_config(codex_home.path()).await;
-    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config)
-        .unwrap()
-        .into_iter()
-        .map(DiscoverablePluginInfo::from)
-        .collect::<Vec<_>>();
+    let discoverable_plugins = list_tool_suggest_discoverable_plugins(&config).unwrap();
 
     assert_eq!(
         discoverable_plugins,

codex-rs/core/src/provider_auth.rs

@@ -0,0 +1,31 @@
+use std::sync::Arc;
+
+use crate::AuthManager;
+use crate::model_provider_info::ModelProviderInfo;
+
+/// Returns the provider-scoped auth manager when this provider uses command-backed auth.
+///
+/// Providers without custom auth continue using the caller-supplied base manager.
+pub(crate) fn auth_manager_for_provider(
+    auth_manager: Option<Arc<AuthManager>>,
+    provider: &ModelProviderInfo,
+) -> Option<Arc<AuthManager>> {
+    match provider.auth.clone() {
+        Some(config) => Some(AuthManager::external_bearer_only(config)),
+        None => auth_manager,
+    }
+}
+
+/// Returns an auth manager for request paths that always require authentication.
+///
+/// Providers with command-backed auth get a bearer-only manager; otherwise the caller's manager
+/// is reused unchanged.
+pub(crate) fn required_auth_manager_for_provider(
+    auth_manager: Arc<AuthManager>,
+    provider: &ModelProviderInfo,
+) -> Arc<AuthManager> {
+    match provider.auth.clone() {
+        Some(config) => AuthManager::external_bearer_only(config),
+        None => auth_manager,
+    }
+}

codex-rs/core/src/realtime_conversation.rs

@@ -452,7 +452,12 @@ async fn prepare_realtime_start(
     params: ConversationStartParams,
 ) -> CodexResult<PreparedRealtimeConversationStart> {
     let provider = sess.provider().await;
-    let auth = sess.services.auth_manager.auth().await;
+    let auth_manager = sess
+        .services
+        .model_client
+        .auth_manager()
+        .unwrap_or_else(|| Arc::clone(&sess.services.auth_manager));
+    let auth = auth_manager.auth().await;
     let realtime_api_key = realtime_api_key(auth.as_ref(), &provider)?;
     let mut api_provider = provider.to_api_provider(Some(crate::auth::AuthMode::ApiKey))?;
     let config = sess.get_config().await;

codex-rs/core/src/sandboxing/mod.rs

@@ -141,14 +141,7 @@ pub async fn execute_env(
     exec_request: ExecRequest,
     stdout_stream: Option<StdoutStream>,
 ) -> crate::error::Result<ExecToolCallOutput> {
-    let effective_policy = exec_request.sandbox_policy.clone();
-    execute_exec_request(
-        exec_request,
-        &effective_policy,
-        stdout_stream,
-        /*after_spawn*/ None,
-    )
-    .await
+    execute_exec_request(exec_request, stdout_stream, /*after_spawn*/ None).await
 }
 
 pub async fn execute_exec_request_with_after_spawn(
@@ -156,6 +149,5 @@ pub async fn execute_exec_request_with_after_spawn(
     stdout_stream: Option<StdoutStream>,
     after_spawn: Option<Box<dyn FnOnce() + Send>>,
 ) -> crate::error::Result<ExecToolCallOutput> {
-    let effective_policy = exec_request.sandbox_policy.clone();
-    execute_exec_request(exec_request, &effective_policy, stdout_stream, after_spawn).await
+    execute_exec_request(exec_request, stdout_stream, after_spawn).await
 }

codex-rs/core/src/shell_snapshot_tests.rs

@@ -313,9 +313,15 @@ async fn timed_out_snapshot_shell_is_terminated() -> Result<()> {
         shell_snapshot: crate::shell::empty_shell_snapshot_receiver(),
     };
 
-    let err = run_script_with_timeout(&shell, &script, Duration::from_secs(1), true, dir.path())
-        .await
-        .expect_err("snapshot shell should time out");
+    let err = run_script_with_timeout(
+        &shell,
+        &script,
+        Duration::from_secs(1),
+        /*use_login_shell*/ true,
+        dir.path(),
+    )
+    .await
+    .expect_err("snapshot shell should time out");
     assert!(
         err.to_string().contains("timed out"),
         "expected timeout error, got {err:?}"

codex-rs/core/src/tasks/mod.rs

@@ -58,7 +58,7 @@ pub(crate) use user_shell::UserShellCommandTask;
 pub(crate) use user_shell::execute_user_shell_command;
 
 const GRACEFULL_INTERRUPTION_TIMEOUT_MS: u64 = 100;
-const TURN_ABORTED_INTERRUPTED_GUIDANCE: &str = "The user interrupted the previous turn on purpose. Any running unified exec processes may still be running in the background. If any tools/commands were aborted, they may have partially executed; verify current state before retrying.";
+const TURN_ABORTED_INTERRUPTED_GUIDANCE: &str = "The user interrupted the previous turn on purpose. Any running unified exec processes may still be running in the background. If any tools/commands were aborted, they may have partially executed.";
 
 /// Shared model-visible marker used by both the real interrupt path and
 /// interrupted fork snapshots.
@@ -191,60 +191,68 @@ impl Session {
         let cancellation_token = CancellationToken::new();
         let done = Arc::new(Notify::new());
 
-        let done_clone = Arc::clone(&done);
-        let handle = {
-            let session_ctx = Arc::new(SessionTaskContext::new(Arc::clone(self)));
-            let ctx = Arc::clone(&turn_context);
-            let task_for_run = Arc::clone(&task);
-            let task_cancellation_token = cancellation_token.child_token();
-            // Task-owned turn spans keep a core-owned span open for the
-            // full task lifecycle after the submission dispatch span ends.
-            let task_span = info_span!(
-                "turn",
-                otel.name = span_name,
-                thread.id = %self.conversation_id,
-                turn.id = %turn_context.sub_id,
-                model = %turn_context.model_info.slug,
-            );
-            tokio::spawn(
-                async move {
-                    let ctx_for_finish = Arc::clone(&ctx);
-                    let last_agent_message = task_for_run
-                        .run(
-                            Arc::clone(&session_ctx),
-                            ctx,
-                            input,
-                            task_cancellation_token.child_token(),
-                        )
-                        .await;
-                    let sess = session_ctx.clone_session();
-                    sess.flush_rollout().await;
-                    if !task_cancellation_token.is_cancelled() {
-                        // Emit completion uniformly from spawn site so all tasks share the same lifecycle.
-                        sess.on_task_finished(Arc::clone(&ctx_for_finish), last_agent_message)
-                            .await;
-                    }
-                    done_clone.notify_waiters();
-                }
-                .instrument(task_span),
-            )
-        };
-
         let queued_response_items = self.take_queued_response_items_for_next_turn().await;
-        let mut active = self.active_turn.lock().await;
-        let mut turn = ActiveTurn::default();
-        let mut turn_state = turn.turn_state.lock().await;
-        turn_state.token_usage_at_turn_start = token_usage_at_turn_start;
-        for item in queued_response_items {
-            turn_state.push_pending_input(item);
+        let mailbox_items = self.get_pending_input().await;
+        let turn_state = {
+            let mut active = self.active_turn.lock().await;
+            let turn = active.get_or_insert_with(ActiveTurn::default);
+            debug_assert!(turn.tasks.is_empty());
+            Arc::clone(&turn.turn_state)
+        };
+        {
+            let mut turn_state = turn_state.lock().await;
+            turn_state.token_usage_at_turn_start = token_usage_at_turn_start;
+            for item in queued_response_items {
+                turn_state.push_pending_input(item);
+            }
+            for item in mailbox_items {
+                turn_state.push_pending_input(item);
+            }
         }
-        drop(turn_state);
 
+        let mut active = self.active_turn.lock().await;
+        let turn = active.get_or_insert_with(ActiveTurn::default);
+        debug_assert!(turn.tasks.is_empty());
+        let done_clone = Arc::clone(&done);
+        let session_ctx = Arc::new(SessionTaskContext::new(Arc::clone(self)));
+        let ctx = Arc::clone(&turn_context);
+        let task_for_run = Arc::clone(&task);
+        let task_cancellation_token = cancellation_token.child_token();
+        // Task-owned turn spans keep a core-owned span open for the
+        // full task lifecycle after the submission dispatch span ends.
+        let task_span = info_span!(
+            "turn",
+            otel.name = span_name,
+            thread.id = %self.conversation_id,
+            turn.id = %turn_context.sub_id,
+            model = %turn_context.model_info.slug,
+        );
+        let handle = tokio::spawn(
+            async move {
+                let ctx_for_finish = Arc::clone(&ctx);
+                let last_agent_message = task_for_run
+                    .run(
+                        Arc::clone(&session_ctx),
+                        ctx,
+                        input,
+                        task_cancellation_token.child_token(),
+                    )
+                    .await;
+                let sess = session_ctx.clone_session();
+                sess.flush_rollout().await;
+                if !task_cancellation_token.is_cancelled() {
+                    // Emit completion uniformly from spawn site so all tasks share the same lifecycle.
+                    sess.on_task_finished(Arc::clone(&ctx_for_finish), last_agent_message)
+                        .await;
+                }
+                done_clone.notify_waiters();
+            }
+            .instrument(task_span),
+        );
         let timer = turn_context
             .session_telemetry
             .start_timer(TURN_E2E_DURATION_METRIC, &[])
             .ok();
-
         let running_task = RunningTask {
             done,
             handle: Arc::new(AbortOnDropHandle::new(handle)),
@@ -255,19 +263,44 @@ impl Session {
             _timer: timer,
         };
         turn.add_task(running_task);
-        *active = Some(turn);
     }
 
-    pub(crate) async fn ensure_task_for_queued_response_items(self: &Arc<Self>) {
-        if !self.has_queued_response_items_for_next_turn().await {
+    /// Starts a regular turn when the session is idle and pending work is waiting.
+    ///
+    /// Pending work currently includes queued next-turn items and mailbox mail marked with
+    /// `trigger_turn`.
+    ///
+    /// This helper generates a fresh sub-id for the synthetic turn before delegating to the
+    /// explicit-sub-id variant.
+    pub(crate) async fn maybe_start_turn_for_pending_work(self: &Arc<Self>) {
+        self.maybe_start_turn_for_pending_work_with_sub_id(uuid::Uuid::new_v4().to_string())
+            .await;
+    }
+
+    /// Starts a regular turn with the provided sub-id when pending work should wake an idle
+    /// session.
+    ///
+    /// The turn is created only when there are queued next-turn items or mailbox mail marked with
+    /// `trigger_turn`, and only if the session is currently idle.
+    pub(crate) async fn maybe_start_turn_for_pending_work_with_sub_id(
+        self: &Arc<Self>,
+        sub_id: String,
+    ) {
+        if !self.has_queued_response_items_for_next_turn().await
+            && !self.has_trigger_turn_mailbox_items().await
+        {
             return;
         }
 
-        if self.active_turn.lock().await.is_some() {
-            return;
+        {
+            let mut active_turn = self.active_turn.lock().await;
+            if active_turn.is_some() {
+                return;
+            }
+            *active_turn = Some(ActiveTurn::default());
         }
 
-        let turn_context = self.new_default_turn().await;
+        let turn_context = self.new_default_turn_with_sub_id(sub_id).await;
         self.maybe_emit_unknown_model_warning_for_turn(turn_context.as_ref())
             .await;
         self.start_task(turn_context, Vec::new(), RegularTask::new())
@@ -284,7 +317,7 @@ impl Session {
             active_turn.clear_pending().await;
         }
         if reason == TurnAbortReason::Interrupted {
-            self.ensure_task_for_queued_response_items().await;
+            self.maybe_start_turn_for_pending_work().await;
         }
     }
 
@@ -297,24 +330,31 @@ impl Session {
             .turn_metadata_state
             .cancel_git_enrichment_task();
 
-        let mut active = self.active_turn.lock().await;
         let mut pending_input = Vec::<ResponseInputItem>::new();
         let mut should_clear_active_turn = false;
         let mut token_usage_at_turn_start = None;
         let mut turn_tool_calls = 0_u64;
-        if let Some(at) = active.as_mut()
-            && at.remove_task(&turn_context.sub_id)
-        {
-            let mut ts = at.turn_state.lock().await;
+        let turn_state = {
+            let mut active = self.active_turn.lock().await;
+            if let Some(at) = active.as_mut()
+                && at.remove_task(&turn_context.sub_id)
+            {
+                should_clear_active_turn = true;
+                let turn_state = Arc::clone(&at.turn_state);
+                if should_clear_active_turn {
+                    *active = None;
+                }
+                Some(turn_state)
+            } else {
+                None
+            }
+        };
+        if let Some(turn_state) = turn_state {
+            let mut ts = turn_state.lock().await;
             pending_input = ts.take_pending_input();
             turn_tool_calls = ts.tool_calls;
             token_usage_at_turn_start = Some(ts.token_usage_at_turn_start.clone());
-            should_clear_active_turn = true;
         }
-        if should_clear_active_turn {
-            *active = None;
-        }
-        drop(active);
         if !pending_input.is_empty() {
             for pending_input_item in pending_input {
                 match inspect_pending_input(self, &turn_context, pending_input_item).await {
@@ -413,6 +453,15 @@ impl Session {
             last_agent_message,
         });
         self.send_event(turn_context.as_ref(), event).await;
+
+        if should_clear_active_turn {
+            let session = Arc::clone(self);
+            let _scheduler = tokio::task::spawn_blocking(move || {
+                tokio::runtime::Handle::current().block_on(async move {
+                    session.maybe_start_turn_for_pending_work().await;
+                });
+            });
+        }
     }
 
     async fn take_active_turn(&self) -> Option<ActiveTurn> {

codex-rs/core/src/tasks/user_shell.rs

@@ -185,14 +185,9 @@ pub(crate) async fn execute_user_shell_command(
         tx_event: session.get_tx_event(),
     });
 
-    let exec_result = execute_exec_request(
-        exec_env,
-        &sandbox_policy,
-        stdout_stream,
-        /*after_spawn*/ None,
-    )
-    .or_cancel(&cancellation_token)
-    .await;
+    let exec_result = execute_exec_request(exec_env, stdout_stream, /*after_spawn*/ None)
+        .or_cancel(&cancellation_token)
+        .await;
 
     match exec_result {
         Err(CancelErr::Cancelled) => {

codex-rs/core/src/thread_rollout_truncation.rs

@@ -3,10 +3,12 @@
 //! In core, "user turns" are detected by scanning `ResponseItem::Message` items and
 //! interpreting them via `event_mapping::parse_turn_item(...)`.
 
+use crate::context_manager::is_user_turn_boundary;
 use crate::event_mapping;
 use codex_protocol::items::TurnItem;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::EventMsg;
+use codex_protocol::protocol::InterAgentCommunication;
 use codex_protocol::protocol::RolloutItem;
 
 /// Return the indices of user message boundaries in a rollout.
@@ -40,6 +42,52 @@ pub(crate) fn user_message_positions_in_rollout(items: &[RolloutItem]) -> Vec<us
     user_positions
 }
 
+/// Return the indices of fork-turn boundaries in a rollout.
+///
+/// A fork-turn boundary is either:
+/// - a real user message boundary, or
+/// - an assistant inter-agent envelope whose parsed `trigger_turn` is `true`.
+///
+/// Like `user_message_positions_in_rollout`, this applies `ThreadRolledBack` markers so indexing
+/// reflects the effective post-rollback history. Rollback counts instruction turns, so a rollback
+/// removes the stale suffix starting at the earliest rolled-back instruction-turn boundary instead
+/// of simply truncating the mixed fork-boundary list.
+pub(crate) fn fork_turn_positions_in_rollout(items: &[RolloutItem]) -> Vec<usize> {
+    let mut rollback_turn_positions = Vec::new();
+    let mut fork_turn_positions = Vec::new();
+    for (idx, item) in items.iter().enumerate() {
+        match item {
+            RolloutItem::ResponseItem(item) => {
+                if is_user_turn_boundary(item) {
+                    rollback_turn_positions.push(idx);
+                }
+                if is_real_user_message_boundary(item) || is_trigger_turn_boundary(item) {
+                    fork_turn_positions.push(idx);
+                }
+            }
+            RolloutItem::EventMsg(EventMsg::ThreadRolledBack(rollback)) => {
+                let num_turns = usize::try_from(rollback.num_turns).unwrap_or(usize::MAX);
+                if num_turns == 0 {
+                    continue;
+                }
+                let Some(rollback_start_idx) = rollback_turn_positions
+                    .len()
+                    .checked_sub(num_turns)
+                    .map(|rollback_start| rollback_turn_positions[rollback_start])
+                    .or_else(|| rollback_turn_positions.first().copied())
+                else {
+                    continue;
+                };
+                let new_rollback_len = rollback_turn_positions.len().saturating_sub(num_turns);
+                rollback_turn_positions.truncate(new_rollback_len);
+                fork_turn_positions.retain(|position| *position < rollback_start_idx);
+            }
+            _ => {}
+        }
+    }
+    fork_turn_positions
+}
+
 /// Return a prefix of `items` obtained by cutting strictly before the nth user message.
 ///
 /// The boundary index is 0-based from the start of `items` (so `n_from_start = 0` returns
@@ -68,6 +116,43 @@ pub(crate) fn truncate_rollout_before_nth_user_message_from_start(
     items[..cut_idx].to_vec()
 }
 
+/// Return a suffix of `items` that keeps the last `n_from_end` fork turns.
+///
+/// If fewer than or equal to `n_from_end` fork turns exist, this returns the full rollout.
+pub(crate) fn truncate_rollout_to_last_n_fork_turns(
+    items: &[RolloutItem],
+    n_from_end: usize,
+) -> Vec<RolloutItem> {
+    if n_from_end == 0 {
+        return Vec::new();
+    }
+
+    let fork_turn_positions = fork_turn_positions_in_rollout(items);
+    if fork_turn_positions.len() <= n_from_end {
+        return items.to_vec();
+    }
+
+    let keep_idx = fork_turn_positions[fork_turn_positions.len() - n_from_end];
+    items[keep_idx..].to_vec()
+}
+
+fn is_real_user_message_boundary(item: &ResponseItem) -> bool {
+    matches!(
+        event_mapping::parse_turn_item(item),
+        Some(TurnItem::UserMessage(_))
+    )
+}
+
+fn is_trigger_turn_boundary(item: &ResponseItem) -> bool {
+    let ResponseItem::Message { role, content, .. } = item else {
+        return false;
+    };
+
+    role == "assistant"
+        && InterAgentCommunication::from_message_content(content)
+            .is_some_and(|communication| communication.trigger_turn)
+}
+
 #[cfg(test)]
 #[path = "thread_rollout_truncation_tests.rs"]
 mod tests;

codex-rs/core/src/thread_rollout_truncation_tests.rs

@@ -1,7 +1,9 @@
 use super::*;
 use crate::codex::make_session_and_context;
+use codex_protocol::AgentPath;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::ReasoningItemReasoningSummary;
+use codex_protocol::protocol::InterAgentCommunication;
 use codex_protocol::protocol::ThreadRolledBackEvent;
 use pretty_assertions::assert_eq;
 
@@ -29,6 +31,17 @@ fn assistant_msg(text: &str) -> ResponseItem {
     }
 }
 
+fn inter_agent_msg(text: &str, trigger_turn: bool) -> ResponseItem {
+    let communication = InterAgentCommunication::new(
+        AgentPath::root(),
+        AgentPath::try_from("/root/worker").expect("agent path"),
+        Vec::new(),
+        text.to_string(),
+        trigger_turn,
+    );
+    communication.to_response_input_item().into()
+}
+
 #[test]
 fn truncates_rollout_from_start_before_nth_user_only() {
     let items = [
@@ -157,3 +170,149 @@ async fn ignores_session_prefix_messages_when_truncating_rollout_from_start() {
         serde_json::to_value(&expected).unwrap()
     );
 }
+
+#[test]
+fn truncates_rollout_to_last_n_fork_turns_counts_trigger_turn_messages() {
+    let rollout = vec![
+        RolloutItem::ResponseItem(user_msg("u1")),
+        RolloutItem::ResponseItem(assistant_msg("a1")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "queued message",
+            /*trigger_turn*/ false,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a2")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a3")),
+        RolloutItem::ResponseItem(user_msg("u2")),
+        RolloutItem::ResponseItem(assistant_msg("a4")),
+    ];
+
+    let truncated = truncate_rollout_to_last_n_fork_turns(&rollout, /*n_from_end*/ 2);
+    let expected = rollout[4..].to_vec();
+
+    assert_eq!(
+        serde_json::to_value(&truncated).unwrap(),
+        serde_json::to_value(&expected).unwrap()
+    );
+}
+
+#[test]
+fn truncates_rollout_to_last_n_fork_turns_applies_thread_rollback_markers() {
+    let rollout = vec![
+        RolloutItem::ResponseItem(user_msg("u1")),
+        RolloutItem::ResponseItem(assistant_msg("a1")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a2")),
+        RolloutItem::EventMsg(EventMsg::ThreadRolledBack(ThreadRolledBackEvent {
+            num_turns: 1,
+        })),
+        RolloutItem::ResponseItem(user_msg("u2")),
+        RolloutItem::ResponseItem(assistant_msg("a3")),
+    ];
+
+    let truncated = truncate_rollout_to_last_n_fork_turns(&rollout, /*n_from_end*/ 2);
+
+    assert_eq!(
+        serde_json::to_value(&truncated).unwrap(),
+        serde_json::to_value(&rollout).unwrap()
+    );
+}
+
+#[test]
+fn fork_turn_positions_ignore_zero_turn_rollback_markers() {
+    let rollout = vec![
+        RolloutItem::ResponseItem(user_msg("u1")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::EventMsg(EventMsg::ThreadRolledBack(ThreadRolledBackEvent {
+            num_turns: 0,
+        })),
+        RolloutItem::ResponseItem(user_msg("u2")),
+    ];
+
+    assert_eq!(fork_turn_positions_in_rollout(&rollout), vec![0, 1, 3]);
+}
+
+#[test]
+fn truncates_rollout_to_last_n_fork_turns_discards_trigger_boundaries_in_rolled_back_suffix() {
+    let rollout = vec![
+        RolloutItem::ResponseItem(user_msg("u1")),
+        RolloutItem::ResponseItem(user_msg("u2")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a1")),
+        RolloutItem::EventMsg(EventMsg::ThreadRolledBack(ThreadRolledBackEvent {
+            num_turns: 1,
+        })),
+        RolloutItem::ResponseItem(user_msg("u3")),
+        RolloutItem::ResponseItem(assistant_msg("a2")),
+    ];
+
+    let truncated = truncate_rollout_to_last_n_fork_turns(&rollout, /*n_from_end*/ 2);
+
+    let expected = rollout[1..].to_vec();
+
+    assert_eq!(
+        serde_json::to_value(&truncated).unwrap(),
+        serde_json::to_value(&expected).unwrap()
+    );
+}
+
+#[test]
+fn truncates_rollout_to_last_n_fork_turns_discards_rolled_back_assistant_instruction_turns() {
+    let rollout = vec![
+        RolloutItem::ResponseItem(user_msg("u1")),
+        RolloutItem::ResponseItem(assistant_msg("a1")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task 1",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a2")),
+        RolloutItem::EventMsg(EventMsg::ThreadRolledBack(ThreadRolledBackEvent {
+            num_turns: 1,
+        })),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task 2",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a3")),
+    ];
+
+    let truncated = truncate_rollout_to_last_n_fork_turns(&rollout, /*n_from_end*/ 1);
+    let expected = rollout[5..].to_vec();
+
+    assert_eq!(
+        serde_json::to_value(&truncated).unwrap(),
+        serde_json::to_value(&expected).unwrap()
+    );
+}
+
+#[test]
+fn truncates_rollout_to_last_n_fork_turns_keeps_full_rollout_when_n_is_large() {
+    let rollout = vec![
+        RolloutItem::ResponseItem(user_msg("u1")),
+        RolloutItem::ResponseItem(assistant_msg("a1")),
+        RolloutItem::ResponseItem(inter_agent_msg(
+            "triggered task",
+            /*trigger_turn*/ true,
+        )),
+        RolloutItem::ResponseItem(assistant_msg("a2")),
+    ];
+
+    let truncated = truncate_rollout_to_last_n_fork_turns(&rollout, /*n_from_end*/ 10);
+
+    assert_eq!(
+        serde_json::to_value(&truncated).unwrap(),
+        serde_json::to_value(&rollout).unwrap()
+    );
+}

codex-rs/core/src/tools/code_mode/mod.rs

@@ -14,7 +14,6 @@ use codex_protocol::models::ResponseInputItem;
 use serde_json::Value as JsonValue;
 use tokio_util::sync::CancellationToken;
 
-use crate::client_common::tools::ToolSpec;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::function_tool::FunctionCallError;
@@ -28,6 +27,7 @@ use crate::tools::router::ToolCallSource;
 use crate::tools::router::ToolRouterParams;
 use crate::unified_exec::resolve_max_tokens;
 use codex_features::Feature;
+use codex_tools::ToolSpec;
 use codex_tools::tool_spec_to_code_mode_tool_definition;
 use codex_utils_output_truncation::TruncationPolicy;
 use codex_utils_output_truncation::formatted_truncate_text_content_items_with_policy;

codex-rs/core/src/tools/context.rs

@@ -1,4 +1,3 @@
-use crate::client_common::tools::ToolSearchOutputTool;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::tools::TELEMETRY_PREVIEW_MAX_BYTES;
@@ -14,6 +13,7 @@ use codex_protocol::models::ResponseInputItem;
 use codex_protocol::models::SearchToolCallParams;
 use codex_protocol::models::ShellToolCallParams;
 use codex_protocol::models::function_call_output_content_items_to_text;
+use codex_tools::ToolSearchOutputTool;
 use codex_utils_output_truncation::TruncationPolicy;
 use codex_utils_output_truncation::formatted_truncate_text;
 use codex_utils_string::take_bytes_at_char_boundary;

codex-rs/core/src/tools/context_tests.rs

@@ -142,12 +142,12 @@ fn tool_search_payloads_roundtrip_as_tool_search_outputs() {
     };
     let response = ToolSearchOutput {
         tools: vec![ToolSearchOutputTool::Function(
-            crate::client_common::tools::ResponsesApiTool {
+            codex_tools::ResponsesApiTool {
                 name: "create_event".to_string(),
                 description: String::new(),
                 strict: false,
                 defer_loading: Some(true),
-                parameters: crate::tools::spec::JsonSchema::Object {
+                parameters: codex_tools::JsonSchema::Object {
                     properties: Default::default(),
                     required: None,
                     additional_properties: None,

codex-rs/core/src/tools/discoverable.rs

@@ -1,134 +0,0 @@
-use crate::plugins::PluginCapabilitySummary;
-use codex_app_server_protocol::AppInfo;
-use serde::Deserialize;
-use serde::Serialize;
-
-const TUI_CLIENT_NAME: &str = "codex-tui";
-
-#[derive(Clone, Copy, Debug, Deserialize, Serialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub(crate) enum DiscoverableToolType {
-    Connector,
-    Plugin,
-}
-
-impl DiscoverableToolType {
-    pub(crate) fn as_str(self) -> &'static str {
-        match self {
-            Self::Connector => "connector",
-            Self::Plugin => "plugin",
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Deserialize, Serialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub(crate) enum DiscoverableToolAction {
-    Install,
-    Enable,
-}
-
-impl DiscoverableToolAction {
-    pub(crate) fn as_str(self) -> &'static str {
-        match self {
-            Self::Install => "install",
-            Self::Enable => "enable",
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub(crate) enum DiscoverableTool {
-    Connector(Box<AppInfo>),
-    Plugin(Box<DiscoverablePluginInfo>),
-}
-
-impl DiscoverableTool {
-    pub(crate) fn tool_type(&self) -> DiscoverableToolType {
-        match self {
-            Self::Connector(_) => DiscoverableToolType::Connector,
-            Self::Plugin(_) => DiscoverableToolType::Plugin,
-        }
-    }
-
-    pub(crate) fn id(&self) -> &str {
-        match self {
-            Self::Connector(connector) => connector.id.as_str(),
-            Self::Plugin(plugin) => plugin.id.as_str(),
-        }
-    }
-
-    pub(crate) fn name(&self) -> &str {
-        match self {
-            Self::Connector(connector) => connector.name.as_str(),
-            Self::Plugin(plugin) => plugin.name.as_str(),
-        }
-    }
-
-    pub(crate) fn description(&self) -> Option<&str> {
-        match self {
-            Self::Connector(connector) => connector.description.as_deref(),
-            Self::Plugin(plugin) => plugin.description.as_deref(),
-        }
-    }
-
-    pub(crate) fn install_url(&self) -> Option<&str> {
-        match self {
-            Self::Connector(connector) => connector.install_url.as_deref(),
-            Self::Plugin(_) => None,
-        }
-    }
-}
-
-impl From<AppInfo> for DiscoverableTool {
-    fn from(value: AppInfo) -> Self {
-        Self::Connector(Box::new(value))
-    }
-}
-
-impl From<DiscoverablePluginInfo> for DiscoverableTool {
-    fn from(value: DiscoverablePluginInfo) -> Self {
-        Self::Plugin(Box::new(value))
-    }
-}
-
-pub(crate) fn filter_tool_suggest_discoverable_tools_for_client(
-    discoverable_tools: Vec<DiscoverableTool>,
-    app_server_client_name: Option<&str>,
-) -> Vec<DiscoverableTool> {
-    if app_server_client_name != Some(TUI_CLIENT_NAME) {
-        return discoverable_tools;
-    }
-
-    discoverable_tools
-        .into_iter()
-        .filter(|tool| !matches!(tool, DiscoverableTool::Plugin(_)))
-        .collect()
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub(crate) struct DiscoverablePluginInfo {
-    pub(crate) id: String,
-    pub(crate) name: String,
-    pub(crate) description: Option<String>,
-    pub(crate) has_skills: bool,
-    pub(crate) mcp_server_names: Vec<String>,
-    pub(crate) app_connector_ids: Vec<String>,
-}
-
-impl From<PluginCapabilitySummary> for DiscoverablePluginInfo {
-    fn from(value: PluginCapabilitySummary) -> Self {
-        Self {
-            id: value.config_name,
-            name: value.display_name,
-            description: value.description,
-            has_skills: value.has_skills,
-            mcp_server_names: value.mcp_server_names,
-            app_connector_ids: value
-                .app_connector_ids
-                .into_iter()
-                .map(|connector_id| connector_id.0)
-                .collect(),
-        }
-    }
-}

codex-rs/core/src/tools/handlers/apply_patch.rs

@@ -1,13 +1,8 @@
-use std::collections::BTreeMap;
 use std::path::Path;
 
 use crate::apply_patch;
 use crate::apply_patch::InternalApplyPatchInvocation;
 use crate::apply_patch::convert_apply_patch_to_protocol;
-use crate::client_common::tools::FreeformTool;
-use crate::client_common::tools::FreeformToolFormat;
-use crate::client_common::tools::ResponsesApiTool;
-use crate::client_common::tools::ToolSpec;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::function_tool::FunctionCallError;
@@ -26,8 +21,6 @@ use crate::tools::registry::ToolKind;
 use crate::tools::runtimes::apply_patch::ApplyPatchRequest;
 use crate::tools::runtimes::apply_patch::ApplyPatchRuntime;
 use crate::tools::sandboxing::ToolCtx;
-use crate::tools::spec::ApplyPatchToolArgs;
-use crate::tools::spec::JsonSchema;
 use async_trait::async_trait;
 use codex_apply_patch::ApplyPatchAction;
 use codex_apply_patch::ApplyPatchFileChange;
@@ -36,14 +29,13 @@ use codex_protocol::models::PermissionProfile;
 use codex_sandboxing::policy_transforms::effective_file_system_sandbox_policy;
 use codex_sandboxing::policy_transforms::merge_permission_profiles;
 use codex_sandboxing::policy_transforms::normalize_additional_permissions;
+use codex_tools::ApplyPatchToolArgs;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use std::collections::BTreeSet;
 use std::sync::Arc;
 
 pub struct ApplyPatchHandler;
 
-const APPLY_PATCH_LARK_GRAMMAR: &str = include_str!("tool_apply_patch.lark");
-
 fn file_paths_for_action(action: &ApplyPatchAction) -> Vec<AbsolutePathBuf> {
     let mut keys = Vec::new();
     let cwd = action.cwd.as_path();
@@ -356,112 +348,6 @@ pub(crate) async fn intercept_apply_patch(
     }
 }
 
-/// Returns a custom tool that can be used to edit files. Well-suited for GPT-5 models
-/// https://platform.openai.com/docs/guides/function-calling#custom-tools
-pub(crate) fn create_apply_patch_freeform_tool() -> ToolSpec {
-    ToolSpec::Freeform(FreeformTool {
-        name: "apply_patch".to_string(),
-        description: "Use the `apply_patch` tool to edit files. This is a FREEFORM tool, so do not wrap the patch in JSON.".to_string(),
-        format: FreeformToolFormat {
-            r#type: "grammar".to_string(),
-            syntax: "lark".to_string(),
-            definition: APPLY_PATCH_LARK_GRAMMAR.to_string(),
-        },
-    })
-}
-
-/// Returns a json tool that can be used to edit files. Should only be used with gpt-oss models
-pub(crate) fn create_apply_patch_json_tool() -> ToolSpec {
-    let mut properties = BTreeMap::new();
-    properties.insert(
-        "input".to_string(),
-        JsonSchema::String {
-            description: Some(r#"The entire contents of the apply_patch command"#.to_string()),
-        },
-    );
-
-    ToolSpec::Function(ResponsesApiTool {
-        name: "apply_patch".to_string(),
-        description: r#"Use the `apply_patch` tool to edit files.
-Your patch language is a stripped‑down, file‑oriented diff format designed to be easy to parse and safe to apply. You can think of it as a high‑level envelope:
-
-*** Begin Patch
-[ one or more file sections ]
-*** End Patch
-
-Within that envelope, you get a sequence of file operations.
-You MUST include a header to specify the action you are taking.
-Each operation starts with one of three headers:
-
-*** Add File: <path> - create a new file. Every following line is a + line (the initial contents).
-*** Delete File: <path> - remove an existing file. Nothing follows.
-*** Update File: <path> - patch an existing file in place (optionally with a rename).
-
-May be immediately followed by *** Move to: <new path> if you want to rename the file.
-Then one or more “hunks”, each introduced by @@ (optionally followed by a hunk header).
-Within a hunk each line starts with:
-
-For instructions on [context_before] and [context_after]:
-- By default, show 3 lines of code immediately above and 3 lines immediately below each change. If a change is within 3 lines of a previous change, do NOT duplicate the first change’s [context_after] lines in the second change’s [context_before] lines.
-- If 3 lines of context is insufficient to uniquely identify the snippet of code within the file, use the @@ operator to indicate the class or function to which the snippet belongs. For instance, we might have:
-@@ class BaseClass
-[3 lines of pre-context]
-- [old_code]
-+ [new_code]
-[3 lines of post-context]
-
-- If a code block is repeated so many times in a class or function such that even a single `@@` statement and 3 lines of context cannot uniquely identify the snippet of code, you can use multiple `@@` statements to jump to the right context. For instance:
-
-@@ class BaseClass
-@@ 	 def method():
-[3 lines of pre-context]
-- [old_code]
-+ [new_code]
-[3 lines of post-context]
-
-The full grammar definition is below:
-Patch := Begin { FileOp } End
-Begin := "*** Begin Patch" NEWLINE
-End := "*** End Patch" NEWLINE
-FileOp := AddFile | DeleteFile | UpdateFile
-AddFile := "*** Add File: " path NEWLINE { "+" line NEWLINE }
-DeleteFile := "*** Delete File: " path NEWLINE
-UpdateFile := "*** Update File: " path NEWLINE [ MoveTo ] { Hunk }
-MoveTo := "*** Move to: " newPath NEWLINE
-Hunk := "@@" [ header ] NEWLINE { HunkLine } [ "*** End of File" NEWLINE ]
-HunkLine := (" " | "-" | "+") text NEWLINE
-
-A full patch can combine several operations:
-
-*** Begin Patch
-*** Add File: hello.txt
-+Hello world
-*** Update File: src/app.py
-*** Move to: src/main.py
-@@ def greet():
--print("Hi")
-+print("Hello, world!")
-*** Delete File: obsolete.txt
-*** End Patch
-
-It is important to remember:
-
-- You must include a header with your intended action (Add/Delete/Update)
-- You must prefix new lines with `+` even when creating a new file
-- File references can only be relative, NEVER ABSOLUTE.
-"#
-        .to_string(),
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::Object {
-            properties,
-            required: Some(vec!["input".to_string()]),
-            additional_properties: Some(false.into()),
-        },
-        output_schema: None,
-    })
-}
-
 #[cfg(test)]
 #[path = "apply_patch_tests.rs"]
 mod tests;

codex-rs/core/src/tools/handlers/mod.rs

@@ -22,7 +22,6 @@ use codex_sandboxing::policy_transforms::intersect_permission_profiles;
 use codex_sandboxing::policy_transforms::merge_permission_profiles;
 use codex_sandboxing::policy_transforms::normalize_additional_permissions;
 use codex_utils_absolute_path::AbsolutePathBufGuard;
-pub use plan::PLAN_TOOL;
 use serde::Deserialize;
 use serde_json::Value;
 use std::path::Path;
@@ -44,16 +43,11 @@ pub use mcp::McpHandler;
 pub use mcp_resource::McpResourceHandler;
 pub use plan::PlanHandler;
 pub use request_permissions::RequestPermissionsHandler;
-pub(crate) use request_permissions::request_permissions_tool_description;
 pub use request_user_input::RequestUserInputHandler;
-pub(crate) use request_user_input::request_user_input_tool_description;
 pub use shell::ShellCommandHandler;
 pub use shell::ShellHandler;
 pub use test_sync::TestSyncHandler;
-pub(crate) use tool_search::DEFAULT_LIMIT as TOOL_SEARCH_DEFAULT_LIMIT;
-pub(crate) use tool_search::TOOL_SEARCH_TOOL_NAME;
 pub use tool_search::ToolSearchHandler;
-pub(crate) use tool_suggest::TOOL_SUGGEST_TOOL_NAME;
 pub use tool_suggest::ToolSuggestHandler;
 pub use unified_exec::UnifiedExecHandler;
 pub use view_image::ViewImageHandler;

codex-rs/core/src/tools/handlers/multi_agents/spawn.rs

@@ -1,4 +1,5 @@
 use super::*;
+use crate::agent::control::SpawnAgentForkMode;
 use crate::agent::control::SpawnAgentOptions;
 use crate::agent::control::render_input_preview;
 use crate::agent::role::DEFAULT_ROLE_NAME;
@@ -90,6 +91,7 @@ impl ToolHandler for Handler {
                 )?),
                 SpawnAgentOptions {
                     fork_parent_spawn_call_id: args.fork_context.then(|| call_id.clone()),
+                    fork_mode: args.fork_context.then_some(SpawnAgentForkMode::FullHistory),
                 },
             )
             .await

codex-rs/core/src/tools/handlers/multi_agents_v2.rs

@@ -2,9 +2,7 @@
 
 use crate::agent::AgentStatus;
 use crate::agent::agent_resolver::resolve_agent_target;
-use crate::agent::agent_resolver::resolve_agent_targets;
 use crate::agent::exceeds_thread_spawn_depth_limit;
-use crate::codex::Session;
 use crate::function_tool::FunctionCallError;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
@@ -15,12 +13,10 @@ use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use async_trait::async_trait;
 use codex_protocol::AgentPath;
-use codex_protocol::ThreadId;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::openai_models::ReasoningEffort;
 use codex_protocol::protocol::CollabAgentInteractionBeginEvent;
 use codex_protocol::protocol::CollabAgentInteractionEndEvent;
-use codex_protocol::protocol::CollabAgentRef;
 use codex_protocol::protocol::CollabAgentSpawnBeginEvent;
 use codex_protocol::protocol::CollabAgentSpawnEndEvent;
 use codex_protocol::protocol::CollabCloseBeginEvent;

codex-rs/core/src/tools/handlers/multi_agents_v2/assign_task.rs

@@ -1,6 +1,7 @@
+use super::message_tool::AssignTaskArgs;
 use super::message_tool::MessageDeliveryMode;
 use super::message_tool::MessageToolResult;
-use super::message_tool::handle_message_tool;
+use super::message_tool::handle_message_string_tool;
 use super::*;
 
 pub(crate) struct Handler;
@@ -18,6 +19,15 @@ impl ToolHandler for Handler {
     }
 
     async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        handle_message_tool(invocation, MessageDeliveryMode::TriggerTurn).await
+        let arguments = function_arguments(invocation.payload.clone())?;
+        let args: AssignTaskArgs = parse_arguments(&arguments)?;
+        handle_message_string_tool(
+            invocation,
+            MessageDeliveryMode::TriggerTurn,
+            args.target,
+            args.message,
+            args.interrupt,
+        )
+        .await
     }
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/close_agent.rs

@@ -106,6 +106,7 @@ impl ToolHandler for Handler {
 }
 
 #[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
 struct CloseAgentArgs {
     target: String,
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/list_agents.rs

@@ -40,6 +40,7 @@ impl ToolHandler for Handler {
 }
 
 #[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
 struct ListAgentsArgs {
     path_prefix: Option<String>,
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/message_tool.rs

@@ -1,27 +1,18 @@
 //! Shared argument parsing and dispatch for the v2 text-only agent messaging tools.
 //!
-//! `send_message` and `assign_task` intentionally expose the same input shape and differ only in
-//! whether the resulting `InterAgentCommunication` should wake the target immediately.
+//! `send_message` and `assign_task` share the same submission path and differ only in whether the
+//! resulting `InterAgentCommunication` should wake the target immediately.
 
 use super::*;
-use crate::agent::control::render_input_preview;
 use codex_protocol::protocol::InterAgentCommunication;
 
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, PartialEq, Eq)]
 pub(crate) enum MessageDeliveryMode {
     QueueOnly,
     TriggerTurn,
 }
 
 impl MessageDeliveryMode {
-    /// Returns the model-visible error message for non-text inputs.
-    fn unsupported_items_error(self) -> &'static str {
-        match self {
-            Self::QueueOnly => "send_message only supports text content in MultiAgentV2 for now",
-            Self::TriggerTurn => "assign_task only supports text content in MultiAgentV2 for now",
-        }
-    }
-
     /// Returns whether the produced communication should start a turn immediately.
     fn apply(self, communication: InterAgentCommunication) -> InterAgentCommunication {
         match self {
@@ -38,10 +29,19 @@ impl MessageDeliveryMode {
 }
 
 #[derive(Debug, Deserialize)]
-/// Input shared by the MultiAgentV2 `send_message` and `assign_task` tools.
-pub(crate) struct MessageToolArgs {
+#[serde(deny_unknown_fields)]
+/// Input for the MultiAgentV2 `send_message` tool.
+pub(crate) struct SendMessageArgs {
     pub(crate) target: String,
-    pub(crate) items: Vec<UserInput>,
+    pub(crate) message: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+/// Input for the MultiAgentV2 `assign_task` tool.
+pub(crate) struct AssignTaskArgs {
+    pub(crate) target: String,
+    pub(crate) message: String,
     #[serde(default)]
     pub(crate) interrupt: bool,
 }
@@ -70,31 +70,39 @@ impl ToolOutput for MessageToolResult {
     }
 }
 
-/// Validates that the tool input is non-empty text-only content and returns its preview string.
-fn text_content(
-    items: &[UserInput],
-    mode: MessageDeliveryMode,
-) -> Result<String, FunctionCallError> {
-    if items.is_empty() {
+fn message_content(message: String) -> Result<String, FunctionCallError> {
+    if message.trim().is_empty() {
         return Err(FunctionCallError::RespondToModel(
-            "Items can't be empty".to_string(),
+            "Empty message can't be sent to an agent".to_string(),
         ));
     }
-    if items
-        .iter()
-        .all(|item| matches!(item, UserInput::Text { .. }))
-    {
-        return Ok(render_input_preview(&(items.to_vec().into())));
-    }
-    Err(FunctionCallError::RespondToModel(
-        mode.unsupported_items_error().to_string(),
-    ))
+    Ok(message)
 }
 
-/// Handles the shared MultiAgentV2 text-message flow for both `send_message` and `assign_task`.
-pub(crate) async fn handle_message_tool(
+/// Handles the shared MultiAgentV2 plain-text message flow for both `send_message` and `assign_task`.
+pub(crate) async fn handle_message_string_tool(
     invocation: ToolInvocation,
     mode: MessageDeliveryMode,
+    target: String,
+    message: String,
+    interrupt: bool,
+) -> Result<MessageToolResult, FunctionCallError> {
+    handle_message_submission(
+        invocation,
+        mode,
+        target,
+        message_content(message)?,
+        interrupt,
+    )
+    .await
+}
+
+async fn handle_message_submission(
+    invocation: ToolInvocation,
+    mode: MessageDeliveryMode,
+    target: String,
+    prompt: String,
+    interrupt: bool,
 ) -> Result<MessageToolResult, FunctionCallError> {
     let ToolInvocation {
         session,
@@ -103,16 +111,24 @@ pub(crate) async fn handle_message_tool(
         call_id,
         ..
     } = invocation;
-    let arguments = function_arguments(payload)?;
-    let args: MessageToolArgs = parse_arguments(&arguments)?;
-    let receiver_thread_id = resolve_agent_target(&session, &turn, &args.target).await?;
-    let prompt = text_content(&args.items, mode)?;
+    let _ = payload;
+    let receiver_thread_id = resolve_agent_target(&session, &turn, &target).await?;
     let receiver_agent = session
         .services
         .agent_control
         .get_agent_metadata(receiver_thread_id)
         .unwrap_or_default();
-    if args.interrupt {
+    if mode == MessageDeliveryMode::TriggerTurn
+        && receiver_agent
+            .agent_path
+            .as_ref()
+            .is_some_and(AgentPath::is_root)
+    {
+        return Err(FunctionCallError::RespondToModel(
+            "Tasks can't be assigned to the root agent".to_string(),
+        ));
+    }
+    if interrupt {
         session
             .services
             .agent_control

codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs

@@ -1,6 +1,7 @@
 use super::message_tool::MessageDeliveryMode;
 use super::message_tool::MessageToolResult;
-use super::message_tool::handle_message_tool;
+use super::message_tool::SendMessageArgs;
+use super::message_tool::handle_message_string_tool;
 use super::*;
 
 pub(crate) struct Handler;
@@ -18,6 +19,15 @@ impl ToolHandler for Handler {
     }
 
     async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        handle_message_tool(invocation, MessageDeliveryMode::QueueOnly).await
+        let arguments = function_arguments(invocation.payload.clone())?;
+        let args: SendMessageArgs = parse_arguments(&arguments)?;
+        handle_message_string_tool(
+            invocation,
+            MessageDeliveryMode::QueueOnly,
+            args.target,
+            args.message,
+            /*interrupt*/ false,
+        )
+        .await
     }
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs

@@ -1,4 +1,5 @@
 use super::*;
+use crate::agent::control::SpawnAgentForkMode;
 use crate::agent::control::SpawnAgentOptions;
 use crate::agent::control::render_input_preview;
 use crate::agent::next_thread_spawn_depth;
@@ -33,13 +34,14 @@ impl ToolHandler for Handler {
         } = invocation;
         let arguments = function_arguments(payload)?;
         let args: SpawnAgentArgs = parse_arguments(&arguments)?;
+        let fork_mode = args.fork_mode()?;
         let role_name = args
             .agent_type
             .as_deref()
             .map(str::trim)
             .filter(|role| !role.is_empty());
 
-        let initial_operation = parse_collab_input(args.message, args.items)?;
+        let initial_operation = parse_collab_input(Some(args.message), /*items*/ None)?;
         let prompt = render_input_preview(&initial_operation);
 
         let session_source = turn.session_source.clone();
@@ -113,7 +115,8 @@ impl ToolHandler for Handler {
                 },
                 Some(spawn_source),
                 SpawnAgentOptions {
-                    fork_parent_spawn_call_id: args.fork_context.then(|| call_id.clone()),
+                    fork_parent_spawn_call_id: fork_mode.as_ref().map(|_| call_id.clone()),
+                    fork_mode,
                 },
             )
             .await
@@ -199,15 +202,54 @@ impl ToolHandler for Handler {
 }
 
 #[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
 struct SpawnAgentArgs {
-    message: Option<String>,
-    items: Option<Vec<UserInput>>,
+    message: String,
     task_name: String,
     agent_type: Option<String>,
     model: Option<String>,
     reasoning_effort: Option<ReasoningEffort>,
-    #[serde(default)]
-    fork_context: bool,
+    fork_turns: Option<String>,
+    fork_context: Option<bool>,
+}
+
+impl SpawnAgentArgs {
+    fn fork_mode(&self) -> Result<Option<SpawnAgentForkMode>, FunctionCallError> {
+        if self.fork_context.is_some() {
+            return Err(FunctionCallError::RespondToModel(
+                "fork_context is not supported in MultiAgentV2; use fork_turns instead".to_string(),
+            ));
+        }
+
+        let Some(fork_turns) = self
+            .fork_turns
+            .as_deref()
+            .map(str::trim)
+            .filter(|fork_turns| !fork_turns.is_empty())
+        else {
+            return Ok(None);
+        };
+
+        if fork_turns.eq_ignore_ascii_case("none") {
+            return Ok(None);
+        }
+        if fork_turns.eq_ignore_ascii_case("all") {
+            return Ok(Some(SpawnAgentForkMode::FullHistory));
+        }
+
+        let last_n_turns = fork_turns.parse::<usize>().map_err(|_| {
+            FunctionCallError::RespondToModel(
+                "fork_turns must be `none`, `all`, or a positive integer string".to_string(),
+            )
+        })?;
+        if last_n_turns == 0 {
+            return Err(FunctionCallError::RespondToModel(
+                "fork_turns must be `none`, `all`, or a positive integer string".to_string(),
+            ));
+        }
+
+        Ok(Some(SpawnAgentForkMode::LastNTurns(last_n_turns)))
+    }
 }
 
 #[derive(Debug, Serialize)]

codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs

@@ -1,11 +1,6 @@
 use super::*;
-use crate::agent::status::is_final;
-use futures::FutureExt;
-use futures::StreamExt;
-use futures::stream::FuturesUnordered;
 use std::collections::HashMap;
 use std::time::Duration;
-use tokio::sync::watch::Receiver;
 use tokio::time::Instant;
 use tokio::time::timeout_at;
 
@@ -33,21 +28,6 @@ impl ToolHandler for Handler {
         } = invocation;
         let arguments = function_arguments(payload)?;
         let args: WaitArgs = parse_arguments(&arguments)?;
-        let receiver_thread_ids = resolve_agent_targets(&session, &turn, args.targets).await?;
-        let mut receiver_agents = Vec::with_capacity(receiver_thread_ids.len());
-        for receiver_thread_id in &receiver_thread_ids {
-            let agent_metadata = session
-                .services
-                .agent_control
-                .get_agent_metadata(*receiver_thread_id)
-                .unwrap_or_default();
-            receiver_agents.push(CollabAgentRef {
-                thread_id: *receiver_thread_id,
-                agent_nickname: agent_metadata.agent_nickname,
-                agent_role: agent_metadata.agent_role,
-            });
-        }
-
         let timeout_ms = args.timeout_ms.unwrap_or(DEFAULT_WAIT_TIMEOUT_MS);
         let timeout_ms = match timeout_ms {
             ms if ms <= 0 => {
@@ -58,91 +38,23 @@ impl ToolHandler for Handler {
             ms => ms.clamp(MIN_WAIT_TIMEOUT_MS, MAX_WAIT_TIMEOUT_MS),
         };
 
+        let mut mailbox_seq_rx = session.subscribe_mailbox_seq();
+
         session
             .send_event(
                 &turn,
                 CollabWaitingBeginEvent {
                     sender_thread_id: session.conversation_id,
-                    receiver_thread_ids: receiver_thread_ids.clone(),
-                    receiver_agents: receiver_agents.clone(),
+                    receiver_thread_ids: Vec::new(),
+                    receiver_agents: Vec::new(),
                     call_id: call_id.clone(),
                 }
                 .into(),
             )
             .await;
 
-        let mut status_rxs = Vec::with_capacity(receiver_thread_ids.len());
-        let mut initial_final_statuses = Vec::new();
-        for id in &receiver_thread_ids {
-            match session.services.agent_control.subscribe_status(*id).await {
-                Ok(rx) => {
-                    let status = rx.borrow().clone();
-                    if is_final(&status) {
-                        initial_final_statuses.push((*id, status));
-                    }
-                    status_rxs.push((*id, rx));
-                }
-                Err(crate::error::CodexErr::ThreadNotFound(_)) => {
-                    initial_final_statuses.push((*id, AgentStatus::NotFound));
-                }
-                Err(err) => {
-                    let mut statuses = HashMap::with_capacity(1);
-                    statuses.insert(*id, session.services.agent_control.get_status(*id).await);
-                    session
-                        .send_event(
-                            &turn,
-                            CollabWaitingEndEvent {
-                                sender_thread_id: session.conversation_id,
-                                call_id: call_id.clone(),
-                                agent_statuses: build_wait_agent_statuses(
-                                    &statuses,
-                                    &receiver_agents,
-                                ),
-                                statuses,
-                            }
-                            .into(),
-                        )
-                        .await;
-                    return Err(collab_agent_error(*id, err));
-                }
-            }
-        }
-
-        let statuses = if !initial_final_statuses.is_empty() {
-            initial_final_statuses
-        } else {
-            let mut futures = FuturesUnordered::new();
-            for (id, rx) in status_rxs {
-                let session = session.clone();
-                futures.push(wait_for_final_status(session, id, rx));
-            }
-            let mut results = Vec::new();
-            let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
-            loop {
-                match timeout_at(deadline, futures.next()).await {
-                    Ok(Some(Some(result))) => {
-                        results.push(result);
-                        break;
-                    }
-                    Ok(Some(None)) => continue,
-                    Ok(None) | Err(_) => break,
-                }
-            }
-            if !results.is_empty() {
-                loop {
-                    match futures.next().now_or_never() {
-                        Some(Some(Some(result))) => results.push(result),
-                        Some(Some(None)) => continue,
-                        Some(None) | None => break,
-                    }
-                }
-            }
-            results
-        };
-
-        let timed_out = statuses.is_empty();
-        let statuses_by_id = statuses.clone().into_iter().collect::<HashMap<_, _>>();
-        let agent_statuses = build_wait_agent_statuses(&statuses_by_id, &receiver_agents);
+        let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
+        let timed_out = !wait_for_mailbox_change(&mut mailbox_seq_rx, deadline).await;
         let result = WaitAgentResult::from_timed_out(timed_out);
 
         session
@@ -151,8 +63,8 @@ impl ToolHandler for Handler {
                 CollabWaitingEndEvent {
                     sender_thread_id: session.conversation_id,
                     call_id,
-                    agent_statuses,
-                    statuses: statuses_by_id,
+                    agent_statuses: Vec::new(),
+                    statuses: HashMap::new(),
                 }
                 .into(),
             )
@@ -163,9 +75,8 @@ impl ToolHandler for Handler {
 }
 
 #[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
 struct WaitArgs {
-    #[serde(default)]
-    targets: Vec<String>,
     timeout_ms: Option<i64>,
 }
 
@@ -207,24 +118,12 @@ impl ToolOutput for WaitAgentResult {
     }
 }
 
-async fn wait_for_final_status(
-    session: std::sync::Arc<Session>,
-    thread_id: ThreadId,
-    mut status_rx: Receiver<AgentStatus>,
-) -> Option<(ThreadId, AgentStatus)> {
-    let mut status = status_rx.borrow().clone();
-    if is_final(&status) {
-        return Some((thread_id, status));
-    }
-
-    loop {
-        if status_rx.changed().await.is_err() {
-            let latest = session.services.agent_control.get_status(thread_id).await;
-            return is_final(&latest).then_some((thread_id, latest));
-        }
-        status = status_rx.borrow().clone();
-        if is_final(&status) {
-            return Some((thread_id, status));
-        }
+async fn wait_for_mailbox_change(
+    mailbox_seq_rx: &mut tokio::sync::watch::Receiver<u64>,
+    deadline: Instant,
+) -> bool {
+    match timeout_at(deadline, mailbox_seq_rx.changed()).await {
+        Ok(Ok(())) => true,
+        Ok(Err(_)) | Err(_) => false,
     }
 }

codex-rs/core/src/tools/handlers/plan.rs

@@ -1,5 +1,3 @@
-use crate::client_common::tools::ResponsesApiTool;
-use crate::client_common::tools::ToolSpec;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::function_tool::FunctionCallError;
@@ -8,7 +6,6 @@ use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
-use crate::tools::spec::JsonSchema;
 use async_trait::async_trait;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::models::FunctionCallOutputPayload;
@@ -16,8 +13,6 @@ use codex_protocol::models::ResponseInputItem;
 use codex_protocol::plan_tool::UpdatePlanArgs;
 use codex_protocol::protocol::EventMsg;
 use serde_json::Value as JsonValue;
-use std::collections::BTreeMap;
-use std::sync::LazyLock;
 
 pub struct PlanHandler;
 
@@ -49,50 +44,6 @@ impl ToolOutput for PlanToolOutput {
     }
 }
 
-pub static PLAN_TOOL: LazyLock<ToolSpec> = LazyLock::new(|| {
-    let mut plan_item_props = BTreeMap::new();
-    plan_item_props.insert("step".to_string(), JsonSchema::String { description: None });
-    plan_item_props.insert(
-        "status".to_string(),
-        JsonSchema::String {
-            description: Some("One of: pending, in_progress, completed".to_string()),
-        },
-    );
-
-    let plan_items_schema = JsonSchema::Array {
-        description: Some("The list of steps".to_string()),
-        items: Box::new(JsonSchema::Object {
-            properties: plan_item_props,
-            required: Some(vec!["step".to_string(), "status".to_string()]),
-            additional_properties: Some(false.into()),
-        }),
-    };
-
-    let mut properties = BTreeMap::new();
-    properties.insert(
-        "explanation".to_string(),
-        JsonSchema::String { description: None },
-    );
-    properties.insert("plan".to_string(), plan_items_schema);
-
-    ToolSpec::Function(ResponsesApiTool {
-        name: "update_plan".to_string(),
-        description: r#"Updates the task plan.
-Provide an optional explanation and a list of plan items, each with a step and status.
-At most one step can be in_progress at a time.
-"#
-        .to_string(),
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::Object {
-            properties,
-            required: Some(vec!["plan".to_string()]),
-            additional_properties: Some(false.into()),
-        },
-        output_schema: None,
-    })
-});
-
 #[async_trait]
 impl ToolHandler for PlanHandler {
     type Output = PlanToolOutput;

codex-rs/core/src/tools/handlers/request_permissions.rs

@@ -10,11 +10,6 @@ use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
-pub(crate) fn request_permissions_tool_description() -> String {
-    "Request additional filesystem or network permissions from the user and wait for the client to grant a subset of the requested permission profile. Granted permissions apply automatically to later shell-like commands in the current turn, or for the rest of the session if the client approves them at session scope."
-        .to_string()
-}
-
 pub struct RequestPermissionsHandler;
 
 #[async_trait]

codex-rs/core/src/tools/handlers/request_user_input.rs

@@ -6,50 +6,10 @@ use crate::tools::handlers::parse_arguments;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use async_trait::async_trait;
-use codex_protocol::config_types::ModeKind;
-use codex_protocol::config_types::TUI_VISIBLE_COLLABORATION_MODES;
 use codex_protocol::request_user_input::RequestUserInputArgs;
-
-fn request_user_input_is_available(mode: ModeKind, default_mode_request_user_input: bool) -> bool {
-    mode.allows_request_user_input()
-        || (default_mode_request_user_input && mode == ModeKind::Default)
-}
-
-fn format_allowed_modes(default_mode_request_user_input: bool) -> String {
-    let mode_names: Vec<&str> = TUI_VISIBLE_COLLABORATION_MODES
-        .into_iter()
-        .filter(|mode| request_user_input_is_available(*mode, default_mode_request_user_input))
-        .map(ModeKind::display_name)
-        .collect();
-
-    match mode_names.as_slice() {
-        [] => "no modes".to_string(),
-        [mode] => format!("{mode} mode"),
-        [first, second] => format!("{first} or {second} mode"),
-        [..] => format!("modes: {}", mode_names.join(",")),
-    }
-}
-
-pub(crate) fn request_user_input_unavailable_message(
-    mode: ModeKind,
-    default_mode_request_user_input: bool,
-) -> Option<String> {
-    if request_user_input_is_available(mode, default_mode_request_user_input) {
-        None
-    } else {
-        let mode_name = mode.display_name();
-        Some(format!(
-            "request_user_input is unavailable in {mode_name} mode"
-        ))
-    }
-}
-
-pub(crate) fn request_user_input_tool_description(default_mode_request_user_input: bool) -> String {
-    let allowed_modes = format_allowed_modes(default_mode_request_user_input);
-    format!(
-        "Request user input for one to three short questions and wait for the response. This tool is only available in {allowed_modes}."
-    )
-}
+use codex_tools::REQUEST_USER_INPUT_TOOL_NAME;
+use codex_tools::normalize_request_user_input_args;
+use codex_tools::request_user_input_unavailable_message;
 
 pub struct RequestUserInputHandler {
     pub default_mode_request_user_input: bool,
@@ -75,9 +35,9 @@ impl ToolHandler for RequestUserInputHandler {
         let arguments = match payload {
             ToolPayload::Function { arguments } => arguments,
             _ => {
-                return Err(FunctionCallError::RespondToModel(
-                    "request_user_input handler received unsupported payload".to_string(),
-                ));
+                return Err(FunctionCallError::RespondToModel(format!(
+                    "{REQUEST_USER_INPUT_TOOL_NAME} handler received unsupported payload"
+                )));
             }
         };
 
@@ -88,38 +48,24 @@ impl ToolHandler for RequestUserInputHandler {
             return Err(FunctionCallError::RespondToModel(message));
         }
 
-        let mut args: RequestUserInputArgs = parse_arguments(&arguments)?;
-        let missing_options = args
-            .questions
-            .iter()
-            .any(|question| question.options.as_ref().is_none_or(Vec::is_empty));
-        if missing_options {
-            return Err(FunctionCallError::RespondToModel(
-                "request_user_input requires non-empty options for every question".to_string(),
-            ));
-        }
-        for question in &mut args.questions {
-            question.is_other = true;
-        }
+        let args: RequestUserInputArgs = parse_arguments(&arguments)?;
+        let args =
+            normalize_request_user_input_args(args).map_err(FunctionCallError::RespondToModel)?;
         let response = session
             .request_user_input(turn.as_ref(), call_id, args)
             .await
             .ok_or_else(|| {
-                FunctionCallError::RespondToModel(
-                    "request_user_input was cancelled before receiving a response".to_string(),
-                )
+                FunctionCallError::RespondToModel(format!(
+                    "{REQUEST_USER_INPUT_TOOL_NAME} was cancelled before receiving a response"
+                ))
             })?;
 
         let content = serde_json::to_string(&response).map_err(|err| {
             FunctionCallError::Fatal(format!(
-                "failed to serialize request_user_input response: {err}"
+                "failed to serialize {REQUEST_USER_INPUT_TOOL_NAME} response: {err}"
             ))
         })?;
 
         Ok(FunctionToolOutput::from_text(content, Some(true)))
     }
 }
-
-#[cfg(test)]
-#[path = "request_user_input_tests.rs"]
-mod tests;

codex-rs/core/src/tools/handlers/request_user_input_tests.rs

@@ -1,61 +0,0 @@
-use super::*;
-use pretty_assertions::assert_eq;
-
-#[test]
-fn request_user_input_mode_availability_defaults_to_plan_only() {
-    assert!(ModeKind::Plan.allows_request_user_input());
-    assert!(!ModeKind::Default.allows_request_user_input());
-    assert!(!ModeKind::Execute.allows_request_user_input());
-    assert!(!ModeKind::PairProgramming.allows_request_user_input());
-}
-
-#[test]
-fn request_user_input_unavailable_messages_respect_default_mode_feature_flag() {
-    assert_eq!(
-        request_user_input_unavailable_message(
-            ModeKind::Plan,
-            /*default_mode_request_user_input*/ false
-        ),
-        None
-    );
-    assert_eq!(
-        request_user_input_unavailable_message(
-            ModeKind::Default,
-            /*default_mode_request_user_input*/ false
-        ),
-        Some("request_user_input is unavailable in Default mode".to_string())
-    );
-    assert_eq!(
-        request_user_input_unavailable_message(
-            ModeKind::Default,
-            /*default_mode_request_user_input*/ true
-        ),
-        None
-    );
-    assert_eq!(
-        request_user_input_unavailable_message(
-            ModeKind::Execute,
-            /*default_mode_request_user_input*/ false
-        ),
-        Some("request_user_input is unavailable in Execute mode".to_string())
-    );
-    assert_eq!(
-        request_user_input_unavailable_message(
-            ModeKind::PairProgramming,
-            /*default_mode_request_user_input*/ false
-        ),
-        Some("request_user_input is unavailable in Pair Programming mode".to_string())
-    );
-}
-
-#[test]
-fn request_user_input_tool_description_mentions_available_modes() {
-    assert_eq!(
-            request_user_input_tool_description(/*default_mode_request_user_input*/ false),
-            "Request user input for one to three short questions and wait for the response. This tool is only available in Plan mode.".to_string()
-        );
-    assert_eq!(
-            request_user_input_tool_description(/*default_mode_request_user_input*/ true),
-            "Request user input for one to three short questions and wait for the response. This tool is only available in Default or Plan mode.".to_string()
-        );
-}

codex-rs/core/src/tools/handlers/shell.rs

@@ -37,9 +37,9 @@ use crate::tools::runtimes::shell::ShellRequest;
 use crate::tools::runtimes::shell::ShellRuntime;
 use crate::tools::runtimes::shell::ShellRuntimeBackend;
 use crate::tools::sandboxing::ToolCtx;
-use crate::tools::spec::ShellCommandBackendConfig;
 use codex_features::Feature;
 use codex_protocol::models::PermissionProfile;
+use codex_tools::ShellCommandBackendConfig;
 
 pub struct ShellHandler;
 

codex-rs/core/src/tools/handlers/tool_apply_patch.lark

@@ -1,19 +0,0 @@
-start: begin_patch hunk+ end_patch
-begin_patch: "*** Begin Patch" LF
-end_patch: "*** End Patch" LF?
-
-hunk: add_hunk | delete_hunk | update_hunk
-add_hunk: "*** Add File: " filename LF add_line+
-delete_hunk: "*** Delete File: " filename LF
-update_hunk: "*** Update File: " filename LF change_move? change?
-
-filename: /(.+)/
-add_line: "+" /(.*)/ LF -> line
-
-change_move: "*** Move to: " filename LF
-change: (change_context | change_line)+ eof_line?
-change_context: ("@@" | "@@ " /(.+)/) LF
-change_line: ("+" | "-" | " ") /(.*)/ LF
-eof_line: "*** End of File" LF
-
-%import common.LF

codex-rs/core/src/tools/handlers/tool_search.rs

@@ -9,20 +9,16 @@ use async_trait::async_trait;
 use bm25::Document;
 use bm25::Language;
 use bm25::SearchEngineBuilder;
-use codex_tools::ResponsesApiNamespace;
-use codex_tools::ResponsesApiNamespaceTool;
-use codex_tools::ToolSearchOutputTool;
-use codex_tools::mcp_tool_to_deferred_responses_api_tool;
-use std::collections::BTreeMap;
+use codex_tools::TOOL_SEARCH_DEFAULT_LIMIT;
+use codex_tools::TOOL_SEARCH_TOOL_NAME;
+use codex_tools::ToolSearchResultSource;
+use codex_tools::collect_tool_search_output_tools;
 use std::collections::HashMap;
 
 pub struct ToolSearchHandler {
     tools: HashMap<String, ToolInfo>,
 }
 
-pub(crate) const TOOL_SEARCH_TOOL_NAME: &str = "tool_search";
-pub(crate) const DEFAULT_LIMIT: usize = 8;
-
 impl ToolSearchHandler {
     pub fn new(tools: HashMap<String, ToolInfo>) -> Self {
         Self { tools }
@@ -58,7 +54,7 @@ impl ToolHandler for ToolSearchHandler {
                 "query must not be empty".to_string(),
             ));
         }
-        let limit = args.limit.unwrap_or(DEFAULT_LIMIT);
+        let limit = args.limit.unwrap_or(TOOL_SEARCH_DEFAULT_LIMIT);
 
         if limit == 0 {
             return Err(FunctionCallError::RespondToModel(
@@ -82,65 +78,28 @@ impl ToolHandler for ToolSearchHandler {
             SearchEngineBuilder::<usize>::with_documents(Language::English, documents).build();
         let results = search_engine.search(query, limit);
 
-        let matched_entries = results
-            .into_iter()
-            .filter_map(|result| entries.get(result.document.id))
-            .collect::<Vec<_>>();
-        let tools = serialize_tool_search_output_tools(&matched_entries).map_err(|err| {
-            FunctionCallError::Fatal(format!("failed to encode tool_search output: {err}"))
+        let tools = collect_tool_search_output_tools(
+            results
+                .into_iter()
+                .filter_map(|result| entries.get(result.document.id))
+                .map(|(_name, tool)| ToolSearchResultSource {
+                    tool_namespace: tool.tool_namespace.as_str(),
+                    tool_name: tool.tool_name.as_str(),
+                    tool: &tool.tool,
+                    connector_name: tool.connector_name.as_deref(),
+                    connector_description: tool.connector_description.as_deref(),
+                }),
+        )
+        .map_err(|err| {
+            FunctionCallError::Fatal(format!(
+                "failed to encode {TOOL_SEARCH_TOOL_NAME} output: {err}"
+            ))
         })?;
 
         Ok(ToolSearchOutput { tools })
     }
 }
 
-fn serialize_tool_search_output_tools(
-    matched_entries: &[&(String, ToolInfo)],
-) -> Result<Vec<ToolSearchOutputTool>, serde_json::Error> {
-    let grouped: BTreeMap<String, Vec<ToolInfo>> =
-        matched_entries
-            .iter()
-            .fold(BTreeMap::new(), |mut acc, (_name, tool)| {
-                acc.entry(tool.tool_namespace.clone())
-                    .or_default()
-                    .push(tool.clone());
-
-                acc
-            });
-
-    let mut results = Vec::with_capacity(grouped.len());
-    for (namespace, tools) in grouped {
-        let Some(first_tool) = tools.first() else {
-            continue;
-        };
-
-        let description = first_tool.connector_description.clone().or_else(|| {
-            first_tool
-                .connector_name
-                .as_deref()
-                .map(str::trim)
-                .filter(|connector_name| !connector_name.is_empty())
-                .map(|connector_name| format!("Tools for working with {connector_name}."))
-        });
-
-        let tools = tools
-            .iter()
-            .map(|tool| {
-                mcp_tool_to_deferred_responses_api_tool(tool.tool_name.clone(), &tool.tool)
-                    .map(ResponsesApiNamespaceTool::Function)
-            })
-            .collect::<Result<Vec<_>, _>>()?;
-
-        results.push(ToolSearchOutputTool::Namespace(ResponsesApiNamespace {
-            name: namespace,
-            description: description.unwrap_or_default(),
-            tools,
-        }));
-    }
-
-    Ok(results)
-}
-
 fn build_search_text(name: &str, info: &ToolInfo) -> String {
     let mut parts = vec![
         name.to_string(),
@@ -183,7 +142,3 @@ fn build_search_text(name: &str, info: &ToolInfo) -> String {
 
     parts.join(" ")
 }
-
-#[cfg(test)]
-#[path = "tool_search_tests.rs"]
-mod tests;

codex-rs/core/src/tools/handlers/tool_search_tests.rs

@@ -1,199 +0,0 @@
-use super::*;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
-use codex_tools::ResponsesApiTool;
-use pretty_assertions::assert_eq;
-use rmcp::model::JsonObject;
-use rmcp::model::Tool;
-use serde_json::json;
-use std::sync::Arc;
-
-#[test]
-fn serialize_tool_search_output_tools_groups_results_by_namespace() {
-    let entries = [
-        (
-            "mcp__codex_apps__calendar_create_event".to_string(),
-            ToolInfo {
-                server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-                tool_name: "_create_event".to_string(),
-                tool_namespace: "mcp__codex_apps__calendar".to_string(),
-                tool: Tool {
-                    name: "calendar-create-event".to_string().into(),
-                    title: None,
-                    description: Some("Create a calendar event.".into()),
-                    input_schema: Arc::new(JsonObject::from_iter([(
-                        "type".to_string(),
-                        json!("object"),
-                    )])),
-                    output_schema: None,
-                    annotations: None,
-                    execution: None,
-                    icons: None,
-                    meta: None,
-                },
-                connector_id: Some("calendar".to_string()),
-                connector_name: Some("Calendar".to_string()),
-                plugin_display_names: Vec::new(),
-                connector_description: Some("Plan events".to_string()),
-            },
-        ),
-        (
-            "mcp__codex_apps__gmail_read_email".to_string(),
-            ToolInfo {
-                server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-                tool_name: "_read_email".to_string(),
-                tool_namespace: "mcp__codex_apps__gmail".to_string(),
-                tool: Tool {
-                    name: "gmail-read-email".to_string().into(),
-                    title: None,
-                    description: Some("Read an email.".into()),
-                    input_schema: Arc::new(JsonObject::from_iter([(
-                        "type".to_string(),
-                        json!("object"),
-                    )])),
-                    output_schema: None,
-                    annotations: None,
-                    execution: None,
-                    icons: None,
-                    meta: None,
-                },
-                connector_id: Some("gmail".to_string()),
-                connector_name: Some("Gmail".to_string()),
-                plugin_display_names: Vec::new(),
-                connector_description: Some("Read mail".to_string()),
-            },
-        ),
-        (
-            "mcp__codex_apps__calendar_list_events".to_string(),
-            ToolInfo {
-                server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-                tool_name: "_list_events".to_string(),
-                tool_namespace: "mcp__codex_apps__calendar".to_string(),
-                tool: Tool {
-                    name: "calendar-list-events".to_string().into(),
-                    title: None,
-                    description: Some("List calendar events.".into()),
-                    input_schema: Arc::new(JsonObject::from_iter([(
-                        "type".to_string(),
-                        json!("object"),
-                    )])),
-                    output_schema: None,
-                    annotations: None,
-                    execution: None,
-                    icons: None,
-                    meta: None,
-                },
-                connector_id: Some("calendar".to_string()),
-                connector_name: Some("Calendar".to_string()),
-                plugin_display_names: Vec::new(),
-                connector_description: Some("Plan events".to_string()),
-            },
-        ),
-    ];
-
-    let tools = serialize_tool_search_output_tools(&[&entries[0], &entries[1], &entries[2]])
-        .expect("serialize tool search output");
-
-    assert_eq!(
-        tools,
-        vec![
-            ToolSearchOutputTool::Namespace(ResponsesApiNamespace {
-                name: "mcp__codex_apps__calendar".to_string(),
-                description: "Plan events".to_string(),
-                tools: vec![
-                    ResponsesApiNamespaceTool::Function(ResponsesApiTool {
-                        name: "_create_event".to_string(),
-                        description: "Create a calendar event.".to_string(),
-                        strict: false,
-                        defer_loading: Some(true),
-                        parameters: crate::tools::spec::JsonSchema::Object {
-                            properties: Default::default(),
-                            required: None,
-                            additional_properties: None,
-                        },
-                        output_schema: None,
-                    }),
-                    ResponsesApiNamespaceTool::Function(ResponsesApiTool {
-                        name: "_list_events".to_string(),
-                        description: "List calendar events.".to_string(),
-                        strict: false,
-                        defer_loading: Some(true),
-                        parameters: crate::tools::spec::JsonSchema::Object {
-                            properties: Default::default(),
-                            required: None,
-                            additional_properties: None,
-                        },
-                        output_schema: None,
-                    }),
-                ],
-            }),
-            ToolSearchOutputTool::Namespace(ResponsesApiNamespace {
-                name: "mcp__codex_apps__gmail".to_string(),
-                description: "Read mail".to_string(),
-                tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
-                    name: "_read_email".to_string(),
-                    description: "Read an email.".to_string(),
-                    strict: false,
-                    defer_loading: Some(true),
-                    parameters: crate::tools::spec::JsonSchema::Object {
-                        properties: Default::default(),
-                        required: None,
-                        additional_properties: None,
-                    },
-                    output_schema: None,
-                })],
-            })
-        ]
-    );
-}
-
-#[test]
-fn serialize_tool_search_output_tools_falls_back_to_connector_name_description() {
-    let entries = [(
-        "mcp__codex_apps__gmail_batch_read_email".to_string(),
-        ToolInfo {
-            server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-            tool_name: "_batch_read_email".to_string(),
-            tool_namespace: "mcp__codex_apps__gmail".to_string(),
-            tool: Tool {
-                name: "gmail-batch-read-email".to_string().into(),
-                title: None,
-                description: Some("Read multiple emails.".into()),
-                input_schema: Arc::new(JsonObject::from_iter([(
-                    "type".to_string(),
-                    json!("object"),
-                )])),
-                output_schema: None,
-                annotations: None,
-                execution: None,
-                icons: None,
-                meta: None,
-            },
-            connector_id: Some("connector_gmail_456".to_string()),
-            connector_name: Some("Gmail".to_string()),
-            plugin_display_names: Vec::new(),
-            connector_description: None,
-        },
-    )];
-
-    let tools = serialize_tool_search_output_tools(&[&entries[0]]).expect("serialize");
-
-    assert_eq!(
-        tools,
-        vec![ToolSearchOutputTool::Namespace(ResponsesApiNamespace {
-            name: "mcp__codex_apps__gmail".to_string(),
-            description: "Tools for working with Gmail.".to_string(),
-            tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
-                name: "_batch_read_email".to_string(),
-                description: "Read multiple emails.".to_string(),
-                strict: false,
-                defer_loading: Some(true),
-                parameters: crate::tools::spec::JsonSchema::Object {
-                    properties: Default::default(),
-                    required: None,
-                    additional_properties: None,
-                },
-                output_schema: None,
-            })],
-        })]
-    );
-}

codex-rs/core/src/tools/handlers/tool_suggest.rs

@@ -1,17 +1,19 @@
-use std::collections::BTreeMap;
 use std::collections::HashSet;
 
 use async_trait::async_trait;
 use codex_app_server_protocol::AppInfo;
-use codex_app_server_protocol::McpElicitationObjectType;
-use codex_app_server_protocol::McpElicitationSchema;
-use codex_app_server_protocol::McpServerElicitationRequest;
-use codex_app_server_protocol::McpServerElicitationRequestParams;
 use codex_rmcp_client::ElicitationAction;
+use codex_tools::DiscoverableTool;
+use codex_tools::DiscoverableToolAction;
+use codex_tools::DiscoverableToolType;
+use codex_tools::TOOL_SUGGEST_TOOL_NAME;
+use codex_tools::ToolSuggestArgs;
+use codex_tools::ToolSuggestResult;
+use codex_tools::all_suggested_connectors_picked_up;
+use codex_tools::build_tool_suggestion_elicitation_request;
+use codex_tools::filter_tool_suggest_discoverable_tools_for_client;
+use codex_tools::verified_connector_suggestion_completed;
 use rmcp::model::RequestId;
-use serde::Deserialize;
-use serde::Serialize;
-use serde_json::json;
 use tracing::warn;
 
 use crate::connectors;
@@ -20,50 +22,12 @@ use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::discoverable::DiscoverableTool;
-use crate::tools::discoverable::DiscoverableToolAction;
-use crate::tools::discoverable::DiscoverableToolType;
-use crate::tools::discoverable::filter_tool_suggest_discoverable_tools_for_client;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
 pub struct ToolSuggestHandler;
 
-pub(crate) const TOOL_SUGGEST_TOOL_NAME: &str = "tool_suggest";
-const TOOL_SUGGEST_APPROVAL_KIND_VALUE: &str = "tool_suggestion";
-
-#[derive(Debug, Deserialize)]
-struct ToolSuggestArgs {
-    tool_type: DiscoverableToolType,
-    action_type: DiscoverableToolAction,
-    tool_id: String,
-    suggest_reason: String,
-}
-
-#[derive(Debug, Serialize, PartialEq, Eq)]
-struct ToolSuggestResult {
-    completed: bool,
-    user_confirmed: bool,
-    tool_type: DiscoverableToolType,
-    action_type: DiscoverableToolAction,
-    tool_id: String,
-    tool_name: String,
-    suggest_reason: String,
-}
-
-#[derive(Debug, Serialize, PartialEq, Eq)]
-struct ToolSuggestMeta<'a> {
-    codex_approval_kind: &'static str,
-    tool_type: DiscoverableToolType,
-    suggest_type: DiscoverableToolAction,
-    suggest_reason: &'a str,
-    tool_id: &'a str,
-    tool_name: &'a str,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    install_url: Option<&'a str>,
-}
-
 #[async_trait]
 impl ToolHandler for ToolSuggestHandler {
     type Output = FunctionToolOutput;
@@ -147,6 +111,7 @@ impl ToolHandler for ToolSuggestHandler {
 
         let request_id = RequestId::String(format!("tool_suggestion_{call_id}").into());
         let params = build_tool_suggestion_elicitation_request(
+            CODEX_APPS_MCP_SERVER_NAME,
             session.conversation_id.to_string(),
             turn.sub_id.clone(),
             &args,
@@ -191,60 +156,6 @@ impl ToolHandler for ToolSuggestHandler {
     }
 }
 
-fn build_tool_suggestion_elicitation_request(
-    thread_id: String,
-    turn_id: String,
-    args: &ToolSuggestArgs,
-    suggest_reason: &str,
-    tool: &DiscoverableTool,
-) -> McpServerElicitationRequestParams {
-    let tool_name = tool.name().to_string();
-    let install_url = tool.install_url().map(ToString::to_string);
-    let message = suggest_reason.to_string();
-
-    McpServerElicitationRequestParams {
-        thread_id,
-        turn_id: Some(turn_id),
-        server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-        request: McpServerElicitationRequest::Form {
-            meta: Some(json!(build_tool_suggestion_meta(
-                args.tool_type,
-                args.action_type,
-                suggest_reason,
-                tool.id(),
-                tool_name.as_str(),
-                install_url.as_deref(),
-            ))),
-            message,
-            requested_schema: McpElicitationSchema {
-                schema_uri: None,
-                type_: McpElicitationObjectType::Object,
-                properties: BTreeMap::new(),
-                required: None,
-            },
-        },
-    }
-}
-
-fn build_tool_suggestion_meta<'a>(
-    tool_type: DiscoverableToolType,
-    action_type: DiscoverableToolAction,
-    suggest_reason: &'a str,
-    tool_id: &'a str,
-    tool_name: &'a str,
-    install_url: Option<&'a str>,
-) -> ToolSuggestMeta<'a> {
-    ToolSuggestMeta {
-        codex_approval_kind: TOOL_SUGGEST_APPROVAL_KIND_VALUE,
-        tool_type,
-        suggest_type: action_type,
-        suggest_reason,
-        tool_id,
-        tool_name,
-        install_url,
-    }
-}
-
 async fn verify_tool_suggestion_completed(
     session: &crate::codex::Session,
     turn: &crate::codex::TurnContext,
@@ -327,25 +238,6 @@ async fn refresh_missing_suggested_connectors(
     }
 }
 
-fn all_suggested_connectors_picked_up(
-    expected_connector_ids: &[String],
-    accessible_connectors: &[AppInfo],
-) -> bool {
-    expected_connector_ids.iter().all(|connector_id| {
-        verified_connector_suggestion_completed(connector_id, accessible_connectors)
-    })
-}
-
-fn verified_connector_suggestion_completed(
-    tool_id: &str,
-    accessible_connectors: &[AppInfo],
-) -> bool {
-    accessible_connectors
-        .iter()
-        .find(|connector| connector.id == tool_id)
-        .is_some_and(|connector| connector.is_accessible)
-}
-
 fn verified_plugin_suggestion_completed(
     tool_id: &str,
     config: &crate::config::Config,

codex-rs/core/src/tools/handlers/tool_suggest_tests.rs

@@ -5,264 +5,9 @@ use crate::plugins::test_support::load_plugins_config;
 use crate::plugins::test_support::write_curated_plugin_sha;
 use crate::plugins::test_support::write_openai_curated_marketplace;
 use crate::plugins::test_support::write_plugins_feature_config;
-use crate::tools::discoverable::DiscoverablePluginInfo;
-use crate::tools::discoverable::filter_tool_suggest_discoverable_tools_for_client;
-use codex_app_server_protocol::AppInfo;
 use codex_utils_absolute_path::AbsolutePathBuf;
-use pretty_assertions::assert_eq;
-use serde_json::json;
-use std::collections::BTreeMap;
 use tempfile::tempdir;
 
-#[test]
-fn build_tool_suggestion_elicitation_request_uses_expected_shape() {
-    let args = ToolSuggestArgs {
-        tool_type: DiscoverableToolType::Connector,
-        action_type: DiscoverableToolAction::Install,
-        tool_id: "connector_2128aebfecb84f64a069897515042a44".to_string(),
-        suggest_reason: "Plan and reference events from your calendar".to_string(),
-    };
-    let connector = DiscoverableTool::Connector(Box::new(AppInfo {
-        id: "connector_2128aebfecb84f64a069897515042a44".to_string(),
-        name: "Google Calendar".to_string(),
-        description: Some("Plan events and schedules.".to_string()),
-        logo_url: None,
-        logo_url_dark: None,
-        distribution_channel: None,
-        branding: None,
-        app_metadata: None,
-        labels: None,
-        install_url: Some(
-            "https://chatgpt.com/apps/google-calendar/connector_2128aebfecb84f64a069897515042a44"
-                .to_string(),
-        ),
-        is_accessible: false,
-        is_enabled: true,
-        plugin_display_names: Vec::new(),
-    }));
-
-    let request = build_tool_suggestion_elicitation_request(
-        "thread-1".to_string(),
-        "turn-1".to_string(),
-        &args,
-        "Plan and reference events from your calendar",
-        &connector,
-    );
-
-    assert_eq!(
-        request,
-        McpServerElicitationRequestParams {
-            thread_id: "thread-1".to_string(),
-            turn_id: Some("turn-1".to_string()),
-            server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-            request: McpServerElicitationRequest::Form {
-                meta: Some(json!(ToolSuggestMeta {
-                    codex_approval_kind: TOOL_SUGGEST_APPROVAL_KIND_VALUE,
-                    tool_type: DiscoverableToolType::Connector,
-                    suggest_type: DiscoverableToolAction::Install,
-                    suggest_reason: "Plan and reference events from your calendar",
-                    tool_id: "connector_2128aebfecb84f64a069897515042a44",
-                    tool_name: "Google Calendar",
-                    install_url: Some(
-                        "https://chatgpt.com/apps/google-calendar/connector_2128aebfecb84f64a069897515042a44"
-                    ),
-                })),
-                message: "Plan and reference events from your calendar".to_string(),
-                requested_schema: McpElicitationSchema {
-                    schema_uri: None,
-                    type_: McpElicitationObjectType::Object,
-                    properties: BTreeMap::new(),
-                    required: None,
-                },
-            },
-        }
-    );
-}
-
-#[test]
-fn build_tool_suggestion_elicitation_request_for_plugin_omits_install_url() {
-    let args = ToolSuggestArgs {
-        tool_type: DiscoverableToolType::Plugin,
-        action_type: DiscoverableToolAction::Install,
-        tool_id: "sample@openai-curated".to_string(),
-        suggest_reason: "Use the sample plugin's skills and MCP server".to_string(),
-    };
-    let plugin = DiscoverableTool::Plugin(Box::new(DiscoverablePluginInfo {
-        id: "sample@openai-curated".to_string(),
-        name: "Sample Plugin".to_string(),
-        description: Some("Includes skills, MCP servers, and apps.".to_string()),
-        has_skills: true,
-        mcp_server_names: vec!["sample-docs".to_string()],
-        app_connector_ids: vec!["connector_calendar".to_string()],
-    }));
-
-    let request = build_tool_suggestion_elicitation_request(
-        "thread-1".to_string(),
-        "turn-1".to_string(),
-        &args,
-        "Use the sample plugin's skills and MCP server",
-        &plugin,
-    );
-
-    assert_eq!(
-        request,
-        McpServerElicitationRequestParams {
-            thread_id: "thread-1".to_string(),
-            turn_id: Some("turn-1".to_string()),
-            server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-            request: McpServerElicitationRequest::Form {
-                meta: Some(json!(ToolSuggestMeta {
-                    codex_approval_kind: TOOL_SUGGEST_APPROVAL_KIND_VALUE,
-                    tool_type: DiscoverableToolType::Plugin,
-                    suggest_type: DiscoverableToolAction::Install,
-                    suggest_reason: "Use the sample plugin's skills and MCP server",
-                    tool_id: "sample@openai-curated",
-                    tool_name: "Sample Plugin",
-                    install_url: None,
-                })),
-                message: "Use the sample plugin's skills and MCP server".to_string(),
-                requested_schema: McpElicitationSchema {
-                    schema_uri: None,
-                    type_: McpElicitationObjectType::Object,
-                    properties: BTreeMap::new(),
-                    required: None,
-                },
-            },
-        }
-    );
-}
-
-#[test]
-fn build_tool_suggestion_meta_uses_expected_shape() {
-    let meta = build_tool_suggestion_meta(
-        DiscoverableToolType::Connector,
-        DiscoverableToolAction::Install,
-        "Find and reference emails from your inbox",
-        "connector_68df038e0ba48191908c8434991bbac2",
-        "Gmail",
-        Some("https://chatgpt.com/apps/gmail/connector_68df038e0ba48191908c8434991bbac2"),
-    );
-
-    assert_eq!(
-        meta,
-        ToolSuggestMeta {
-            codex_approval_kind: TOOL_SUGGEST_APPROVAL_KIND_VALUE,
-            tool_type: DiscoverableToolType::Connector,
-            suggest_type: DiscoverableToolAction::Install,
-            suggest_reason: "Find and reference emails from your inbox",
-            tool_id: "connector_68df038e0ba48191908c8434991bbac2",
-            tool_name: "Gmail",
-            install_url: Some(
-                "https://chatgpt.com/apps/gmail/connector_68df038e0ba48191908c8434991bbac2"
-            ),
-        }
-    );
-}
-
-#[test]
-fn filter_tool_suggest_discoverable_tools_for_codex_tui_omits_plugins() {
-    let discoverable_tools = vec![
-        DiscoverableTool::Connector(Box::new(AppInfo {
-            id: "connector_google_calendar".to_string(),
-            name: "Google Calendar".to_string(),
-            description: Some("Plan events and schedules.".to_string()),
-            logo_url: None,
-            logo_url_dark: None,
-            distribution_channel: None,
-            branding: None,
-            app_metadata: None,
-            labels: None,
-            install_url: Some("https://example.test/google-calendar".to_string()),
-            is_accessible: false,
-            is_enabled: true,
-            plugin_display_names: Vec::new(),
-        })),
-        DiscoverableTool::Plugin(Box::new(DiscoverablePluginInfo {
-            id: "slack@openai-curated".to_string(),
-            name: "Slack".to_string(),
-            description: Some("Search Slack messages".to_string()),
-            has_skills: true,
-            mcp_server_names: vec!["slack".to_string()],
-            app_connector_ids: vec!["connector_slack".to_string()],
-        })),
-    ];
-
-    assert_eq!(
-        filter_tool_suggest_discoverable_tools_for_client(discoverable_tools, Some("codex-tui"),),
-        vec![DiscoverableTool::Connector(Box::new(AppInfo {
-            id: "connector_google_calendar".to_string(),
-            name: "Google Calendar".to_string(),
-            description: Some("Plan events and schedules.".to_string()),
-            logo_url: None,
-            logo_url_dark: None,
-            distribution_channel: None,
-            branding: None,
-            app_metadata: None,
-            labels: None,
-            install_url: Some("https://example.test/google-calendar".to_string()),
-            is_accessible: false,
-            is_enabled: true,
-            plugin_display_names: Vec::new(),
-        }))]
-    );
-}
-
-#[test]
-fn verified_connector_suggestion_completed_requires_accessible_connector() {
-    let accessible_connectors = vec![AppInfo {
-        id: "calendar".to_string(),
-        name: "Google Calendar".to_string(),
-        description: None,
-        logo_url: None,
-        logo_url_dark: None,
-        distribution_channel: None,
-        branding: None,
-        app_metadata: None,
-        labels: None,
-        install_url: None,
-        is_accessible: true,
-        is_enabled: false,
-        plugin_display_names: Vec::new(),
-    }];
-
-    assert!(verified_connector_suggestion_completed(
-        "calendar",
-        &accessible_connectors,
-    ));
-    assert!(!verified_connector_suggestion_completed(
-        "gmail",
-        &accessible_connectors,
-    ));
-}
-
-#[test]
-fn all_suggested_connectors_picked_up_requires_every_expected_connector() {
-    let accessible_connectors = vec![AppInfo {
-        id: "calendar".to_string(),
-        name: "Google Calendar".to_string(),
-        description: None,
-        logo_url: None,
-        logo_url_dark: None,
-        distribution_channel: None,
-        branding: None,
-        app_metadata: None,
-        labels: None,
-        install_url: None,
-        is_accessible: true,
-        is_enabled: false,
-        plugin_display_names: Vec::new(),
-    }];
-
-    assert!(all_suggested_connectors_picked_up(
-        &["calendar".to_string()],
-        &accessible_connectors,
-    ));
-    assert!(!all_suggested_connectors_picked_up(
-        &["calendar".to_string(), "gmail".to_string()],
-        &accessible_connectors,
-    ));
-}
-
 #[tokio::test]
 async fn verified_plugin_suggestion_completed_requires_installed_plugin() {
     let codex_home = tempdir().expect("tempdir should succeed");

codex-rs/core/src/tools/handlers/unified_exec.rs

@@ -21,7 +21,6 @@ use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
-use crate::tools::spec::UnifiedExecShellMode;
 use crate::unified_exec::ExecCommandRequest;
 use crate::unified_exec::UnifiedExecContext;
 use crate::unified_exec::UnifiedExecProcessManager;
@@ -31,6 +30,7 @@ use codex_features::Feature;
 use codex_otel::SessionTelemetry;
 use codex_otel::metrics::names::TOOL_CALL_UNIFIED_EXEC_METRIC;
 use codex_protocol::models::PermissionProfile;
+use codex_tools::UnifiedExecShellMode;
 use serde::Deserialize;
 use std::path::PathBuf;
 use std::sync::Arc;

codex-rs/core/src/tools/handlers/unified_exec_tests.rs

@@ -2,9 +2,10 @@ use super::*;
 use crate::shell::default_user_shell;
 use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::handlers::resolve_workdir_base_path;
-use crate::tools::spec::ZshForkConfig;
 use codex_protocol::models::FileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
+use codex_tools::UnifiedExecShellMode;
+use codex_tools::ZshForkConfig;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use std::fs;

codex-rs/core/src/tools/js_repl/mod.rs

@@ -31,7 +31,6 @@ use tracing::trace;
 use tracing::warn;
 use uuid::Uuid;
 
-use crate::client_common::tools::ToolSpec;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::exec::ExecCapturePolicy;
@@ -46,6 +45,7 @@ use codex_sandboxing::SandboxCommand;
 use codex_sandboxing::SandboxManager;
 use codex_sandboxing::SandboxTransformRequest;
 use codex_sandboxing::SandboxablePreference;
+use codex_tools::ToolSpec;
 use codex_utils_output_truncation::TruncationPolicy;
 use codex_utils_output_truncation::truncate_text;
 

codex-rs/core/src/tools/mod.rs

@@ -1,6 +1,5 @@
 pub mod code_mode;
 pub mod context;
-pub(crate) mod discoverable;
 pub mod events;
 pub(crate) mod handlers;
 pub mod js_repl;

codex-rs/core/src/tools/parallel.rs

@@ -9,7 +9,6 @@ use tracing::Instrument;
 use tracing::instrument;
 use tracing::trace_span;
 
-use crate::client_common::tools::ToolSpec;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::error::CodexErr;
@@ -22,6 +21,7 @@ use crate::tools::router::ToolCall;
 use crate::tools::router::ToolCallSource;
 use crate::tools::router::ToolRouter;
 use codex_protocol::models::ResponseInputItem;
+use codex_tools::ToolSpec;
 
 #[derive(Clone)]
 pub(crate) struct ToolCallRuntime {

codex-rs/core/src/tools/registry.rs

@@ -3,7 +3,6 @@ use std::sync::Arc;
 use std::time::Duration;
 use std::time::Instant;
 
-use crate::client_common::tools::ToolSpec;
 use crate::function_tool::FunctionCallError;
 use crate::hook_runtime::record_additional_contexts;
 use crate::hook_runtime::run_post_tool_use_hooks;
@@ -25,6 +24,7 @@ use codex_hooks::HookToolInputLocalShell;
 use codex_hooks::HookToolKind;
 use codex_protocol::models::ResponseInputItem;
 use codex_tools::ConfiguredToolSpec;
+use codex_tools::ToolSpec;
 use codex_utils_readiness::Readiness;
 use serde_json::Value;
 use tracing::warn;

codex-rs/core/src/tools/router.rs

@@ -1,4 +1,3 @@
-use crate::client_common::tools::ToolSpec;
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::function_tool::FunctionCallError;
@@ -7,10 +6,8 @@ use crate::sandboxing::SandboxPermissions;
 use crate::tools::context::SharedTurnDiffTracker;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::discoverable::DiscoverableTool;
 use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolRegistry;
-use crate::tools::spec::ToolsConfig;
 use crate::tools::spec::build_specs_with_discoverable_tools;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
 use codex_protocol::models::LocalShellAction;
@@ -18,6 +15,9 @@ use codex_protocol::models::ResponseItem;
 use codex_protocol::models::SearchToolCallParams;
 use codex_protocol::models::ShellToolCallParams;
 use codex_tools::ConfiguredToolSpec;
+use codex_tools::DiscoverableTool;
+use codex_tools::ToolSpec;
+use codex_tools::ToolsConfig;
 use rmcp::model::Tool;
 use std::collections::HashMap;
 use std::sync::Arc;

codex-rs/core/src/tools/runtimes/apply_patch.rs

@@ -60,7 +60,6 @@ impl ApplyPatchRuntime {
             id: call_id.to_string(),
             cwd: req.action.cwd.clone(),
             files: req.file_paths.clone(),
-            change_count: req.changes.len(),
             patch: req.action.patch.clone(),
         }
     }

codex-rs/core/src/tools/runtimes/apply_patch_tests.rs

@@ -63,7 +63,6 @@ fn guardian_review_request_includes_patch_context() {
             id: "call-1".to_string(),
             cwd: expected_cwd,
             files: request.file_paths,
-            change_count: 1usize,
             patch: expected_patch,
         }
     );

codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs

@@ -27,6 +27,7 @@ use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
+use codex_protocol::protocol::GuardianCommandSource;
 use codex_protocol::protocol::NetworkPolicyRuleAction;
 use codex_protocol::protocol::ReviewDecision;
 use codex_protocol::protocol::SandboxPolicy;
@@ -187,7 +188,7 @@ pub(super) async fn try_run_zsh_fork(
         session: Arc::clone(&ctx.session),
         turn: Arc::clone(&ctx.turn),
         call_id: ctx.call_id.clone(),
-        tool_name: "shell",
+        tool_name: GuardianCommandSource::Shell,
         approval_policy: ctx.turn.approval_policy.value(),
         sandbox_policy: command_executor.sandbox_policy.clone(),
         file_system_sandbox_policy: command_executor.file_system_sandbox_policy.clone(),
@@ -259,7 +260,7 @@ pub(crate) async fn prepare_unified_exec_zsh_fork(
         session: Arc::clone(&ctx.session),
         turn: Arc::clone(&ctx.turn),
         call_id: ctx.call_id.clone(),
-        tool_name: "exec_command",
+        tool_name: GuardianCommandSource::UnifiedExec,
         approval_policy: ctx.turn.approval_policy.value(),
         sandbox_policy: exec_request.sandbox_policy.clone(),
         file_system_sandbox_policy: exec_request.file_system_sandbox_policy.clone(),
@@ -294,7 +295,7 @@ struct CoreShellActionProvider {
     session: Arc<crate::codex::Session>,
     turn: Arc<crate::codex::TurnContext>,
     call_id: String,
-    tool_name: &'static str,
+    tool_name: GuardianCommandSource,
     approval_policy: AskForApproval,
     sandbox_policy: SandboxPolicy,
     file_system_sandbox_policy: FileSystemSandboxPolicy,
@@ -380,7 +381,7 @@ impl CoreShellActionProvider {
         let turn = self.turn.clone();
         let call_id = self.call_id.clone();
         let approval_id = Some(Uuid::new_v4().to_string());
-        let tool_name = self.tool_name;
+        let source = self.tool_name;
         Ok(stopwatch
             .pause_for(async move {
                 if routes_approval_to_guardian(&turn) {
@@ -389,7 +390,7 @@ impl CoreShellActionProvider {
                         &turn,
                         GuardianApprovalRequest::Execve {
                             id: call_id.clone(),
-                            tool_name: tool_name.to_string(),
+                            source,
                             program: program.to_string_lossy().into_owned(),
                             argv: argv.to_vec(),
                             cwd: workdir,

codex-rs/core/src/tools/runtimes/shell/zsh_fork_backend.rs

@@ -5,8 +5,8 @@ use crate::tools::runtimes::unified_exec::UnifiedExecRequest;
 use crate::tools::sandboxing::SandboxAttempt;
 use crate::tools::sandboxing::ToolCtx;
 use crate::tools::sandboxing::ToolError;
-use crate::tools::spec::ZshForkConfig;
 use crate::unified_exec::SpawnLifecycleHandle;
+use codex_tools::ZshForkConfig;
 
 pub(crate) struct PreparedUnifiedExecSpawn {
     pub(crate) exec_request: ExecRequest,

codex-rs/core/src/tools/runtimes/unified_exec.rs

@@ -32,7 +32,6 @@ use crate::tools::sandboxing::ToolError;
 use crate::tools::sandboxing::ToolRuntime;
 use crate::tools::sandboxing::sandbox_override_for_first_attempt;
 use crate::tools::sandboxing::with_cached_approval;
-use crate::tools::spec::UnifiedExecShellMode;
 use crate::unified_exec::NoopSpawnLifecycle;
 use crate::unified_exec::UnifiedExecError;
 use crate::unified_exec::UnifiedExecProcess;
@@ -41,6 +40,7 @@ use codex_network_proxy::NetworkProxy;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::ReviewDecision;
 use codex_sandboxing::SandboxablePreference;
+use codex_tools::UnifiedExecShellMode;
 use futures::future::BoxFuture;
 use std::collections::HashMap;
 use std::path::PathBuf;

codex-rs/core/src/tools/spec_tests.rs

@@ -6,24 +6,60 @@ use crate::shell::ShellType;
 use crate::tools::ToolRouter;
 use crate::tools::router::ToolRouterParams;
 use codex_app_server_protocol::AppInfo;
+use codex_features::Feature;
+use codex_features::Features;
+use codex_protocol::config_types::WebSearchConfig;
+use codex_protocol::config_types::WebSearchMode;
+use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::VIEW_IMAGE_TOOL_NAME;
 use codex_protocol::openai_models::InputModality;
 use codex_protocol::openai_models::ModelInfo;
 use codex_protocol::openai_models::ModelsResponse;
+use codex_protocol::openai_models::WebSearchToolType;
+use codex_protocol::protocol::SandboxPolicy;
+use codex_protocol::protocol::SessionSource;
+use codex_protocol::protocol::SubAgentSource;
 use codex_tools::AdditionalProperties;
 use codex_tools::CommandToolOptions;
 use codex_tools::ConfiguredToolSpec;
+use codex_tools::DiscoverablePluginInfo;
+use codex_tools::DiscoverableTool;
 use codex_tools::FreeformTool;
+use codex_tools::JsonSchema;
+use codex_tools::ResponsesApiTool;
 use codex_tools::ResponsesApiWebSearchFilters;
 use codex_tools::ResponsesApiWebSearchUserLocation;
+use codex_tools::ShellCommandBackendConfig;
+use codex_tools::SpawnAgentToolOptions;
+use codex_tools::ToolsConfig;
+use codex_tools::ToolsConfigParams;
+use codex_tools::UnifiedExecShellMode;
 use codex_tools::ViewImageToolOptions;
+use codex_tools::WaitAgentTimeoutOptions;
+use codex_tools::ZshForkConfig;
+use codex_tools::create_apply_patch_freeform_tool;
+use codex_tools::create_close_agent_tool_v1;
+use codex_tools::create_close_agent_tool_v2;
 use codex_tools::create_exec_command_tool;
 use codex_tools::create_request_permissions_tool;
+use codex_tools::create_request_user_input_tool;
+use codex_tools::create_resume_agent_tool;
+use codex_tools::create_send_input_tool_v1;
+use codex_tools::create_send_message_tool;
+use codex_tools::create_spawn_agent_tool_v1;
+use codex_tools::create_spawn_agent_tool_v2;
+use codex_tools::create_update_plan_tool;
 use codex_tools::create_view_image_tool;
+use codex_tools::create_wait_agent_tool_v1;
+use codex_tools::create_wait_agent_tool_v2;
 use codex_tools::create_write_stdin_tool;
 use codex_tools::mcp_tool_to_deferred_responses_api_tool;
+use codex_tools::request_permissions_tool_description;
+use codex_tools::request_user_input_tool_description;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
+use serde_json::json;
+use std::collections::BTreeMap;
 use std::path::PathBuf;
 
 use super::*;
@@ -153,6 +189,27 @@ fn shell_tool_name(config: &ToolsConfig) -> Option<&'static str> {
     }
 }
 
+fn request_user_input_tool_spec(default_mode_request_user_input: bool) -> ToolSpec {
+    create_request_user_input_tool(request_user_input_tool_description(
+        default_mode_request_user_input,
+    ))
+}
+
+fn spawn_agent_tool_options(config: &ToolsConfig) -> SpawnAgentToolOptions<'_> {
+    SpawnAgentToolOptions {
+        available_models: &config.available_models,
+        agent_type_description: agent_type_description(config),
+    }
+}
+
+fn wait_agent_timeout_options() -> WaitAgentTimeoutOptions {
+    WaitAgentTimeoutOptions {
+        default_timeout_ms: DEFAULT_WAIT_TIMEOUT_MS,
+        min_timeout_ms: MIN_WAIT_TIMEOUT_MS,
+        max_timeout_ms: MAX_WAIT_TIMEOUT_MS,
+    }
+}
+
 fn find_tool<'a>(tools: &'a [ConfiguredToolSpec], expected_name: &str) -> &'a ConfiguredToolSpec {
     tools
         .iter()
@@ -211,30 +268,6 @@ fn model_info_from_models_json(slug: &str) -> ModelInfo {
     with_config_overrides(model, &config)
 }
 
-#[test]
-fn unified_exec_is_blocked_for_windows_sandboxed_policies_only() {
-    assert!(!unified_exec_allowed_in_environment(
-        /*is_windows*/ true,
-        &SandboxPolicy::new_read_only_policy(),
-        WindowsSandboxLevel::RestrictedToken,
-    ));
-    assert!(!unified_exec_allowed_in_environment(
-        /*is_windows*/ true,
-        &SandboxPolicy::new_workspace_write_policy(),
-        WindowsSandboxLevel::RestrictedToken,
-    ));
-    assert!(unified_exec_allowed_in_environment(
-        /*is_windows*/ true,
-        &SandboxPolicy::DangerFullAccess,
-        WindowsSandboxLevel::RestrictedToken,
-    ));
-    assert!(unified_exec_allowed_in_environment(
-        /*is_windows*/ true,
-        &SandboxPolicy::DangerFullAccess,
-        WindowsSandboxLevel::Disabled,
-    ));
-}
-
 #[test]
 fn model_provided_unified_exec_is_blocked_for_windows_sandboxed_policies() {
     let mut model_info = model_info_from_models_json("gpt-5-codex");
@@ -306,8 +339,8 @@ fn test_full_toolset_specs_for_gpt5_codex_unified_exec_web_search() {
             exec_permission_approvals_enabled: false,
         }),
         create_write_stdin_tool(),
-        PLAN_TOOL.clone(),
-        create_request_user_input_tool(CollaborationModesConfig::default()),
+        create_update_plan_tool(),
+        request_user_input_tool_spec(/*default_mode_request_user_input*/ false),
         create_apply_patch_freeform_tool(),
         ToolSpec::WebSearch {
             external_web_access: Some(true),
@@ -324,16 +357,16 @@ fn test_full_toolset_specs_for_gpt5_codex_unified_exec_web_search() {
     }
     let collab_specs = if config.multi_agent_v2 {
         vec![
-            create_spawn_agent_tool_v2(&config),
+            create_spawn_agent_tool_v2(spawn_agent_tool_options(&config)),
             create_send_message_tool(),
-            create_wait_agent_tool_v2(),
+            create_wait_agent_tool_v2(wait_agent_timeout_options()),
             create_close_agent_tool_v2(),
         ]
     } else {
         vec![
-            create_spawn_agent_tool_v1(&config),
+            create_spawn_agent_tool_v1(spawn_agent_tool_options(&config)),
             create_send_input_tool_v1(),
-            create_wait_agent_tool_v1(),
+            create_wait_agent_tool_v1(wait_agent_timeout_options()),
             create_close_agent_tool_v1(),
         ]
     };
@@ -394,6 +427,16 @@ fn test_build_specs_collab_tools_enabled() {
     );
     assert_lacks_tool_name(&tools, "spawn_agents_on_csv");
     assert_lacks_tool_name(&tools, "list_agents");
+
+    let spawn_agent = find_tool(&tools, "spawn_agent");
+    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = &spawn_agent.spec else {
+        panic!("spawn_agent should be a function tool");
+    };
+    let JsonSchema::Object { properties, .. } = parameters else {
+        panic!("spawn_agent should use object params");
+    };
+    assert!(properties.contains_key("fork_context"));
+    assert!(!properties.contains_key("fork_turns"));
 }
 
 #[test]
@@ -450,7 +493,14 @@ fn test_build_specs_multi_agent_v2_uses_task_names_and_hides_resume() {
         panic!("spawn_agent should use object params");
     };
     assert!(properties.contains_key("task_name"));
-    assert_eq!(required.as_ref(), Some(&vec!["task_name".to_string()]));
+    assert!(properties.contains_key("message"));
+    assert!(properties.contains_key("fork_turns"));
+    assert!(!properties.contains_key("items"));
+    assert!(!properties.contains_key("fork_context"));
+    assert_eq!(
+        required.as_ref(),
+        Some(&vec!["task_name".to_string(), "message".to_string()])
+    );
     let output_schema = output_schema
         .as_ref()
         .expect("spawn_agent should define output schema");
@@ -472,10 +522,12 @@ fn test_build_specs_multi_agent_v2_uses_task_names_and_hides_resume() {
         panic!("send_message should use object params");
     };
     assert!(properties.contains_key("target"));
-    assert!(!properties.contains_key("message"));
+    assert!(!properties.contains_key("interrupt"));
+    assert!(properties.contains_key("message"));
+    assert!(!properties.contains_key("items"));
     assert_eq!(
         required.as_ref(),
-        Some(&vec!["target".to_string(), "items".to_string()])
+        Some(&vec!["target".to_string(), "message".to_string()])
     );
 
     let assign_task = find_tool(&tools, "assign_task");
@@ -491,10 +543,11 @@ fn test_build_specs_multi_agent_v2_uses_task_names_and_hides_resume() {
         panic!("assign_task should use object params");
     };
     assert!(properties.contains_key("target"));
-    assert!(!properties.contains_key("message"));
+    assert!(properties.contains_key("message"));
+    assert!(!properties.contains_key("items"));
     assert_eq!(
         required.as_ref(),
-        Some(&vec!["target".to_string(), "items".to_string()])
+        Some(&vec!["target".to_string(), "message".to_string()])
     );
 
     let wait_agent = find_tool(&tools, "wait_agent");
@@ -514,8 +567,9 @@ fn test_build_specs_multi_agent_v2_uses_task_names_and_hides_resume() {
     else {
         panic!("wait_agent should use object params");
     };
-    assert!(properties.contains_key("targets"));
-    assert_eq!(required.as_ref(), Some(&vec!["targets".to_string()]));
+    assert!(!properties.contains_key("targets"));
+    assert!(properties.contains_key("timeout_ms"));
+    assert_eq!(required, &None);
     let output_schema = output_schema
         .as_ref()
         .expect("wait_agent should define output schema");
@@ -734,7 +788,7 @@ fn request_user_input_description_reflects_default_mode_feature_flag() {
     let request_user_input_tool = find_tool(&tools, "request_user_input");
     assert_eq!(
         request_user_input_tool.spec,
-        create_request_user_input_tool(CollaborationModesConfig::default())
+        request_user_input_tool_spec(/*default_mode_request_user_input*/ false)
     );
 
     features.enable(Feature::DefaultModeRequestUserInput);
@@ -758,9 +812,7 @@ fn request_user_input_description_reflects_default_mode_feature_flag() {
     let request_user_input_tool = find_tool(&tools, "request_user_input");
     assert_eq!(
         request_user_input_tool.spec,
-        create_request_user_input_tool(CollaborationModesConfig {
-            default_mode_request_user_input: true,
-        })
+        request_user_input_tool_spec(/*default_mode_request_user_input*/ true)
     );
 }
 
@@ -1017,21 +1069,6 @@ fn image_generation_tools_require_feature_and_supported_model() {
     );
 }
 
-#[test]
-fn js_repl_freeform_grammar_blocks_common_non_js_prefixes() {
-    let ToolSpec::Freeform(FreeformTool { format, .. }) = create_js_repl_tool() else {
-        panic!("js_repl should use a freeform tool spec");
-    };
-
-    assert_eq!(format.syntax, "lark");
-    assert!(format.definition.contains("PRAGMA_LINE"));
-    assert!(format.definition.contains("`[^`]"));
-    assert!(format.definition.contains("``[^`]"));
-    assert!(format.definition.contains("PLAIN_JS_SOURCE"));
-    assert!(format.definition.contains("codex-js-repl:"));
-    assert!(!format.definition.contains("(?!"));
-}
-
 fn assert_model_tools(
     model_slug: &str,
     features: &Features,
@@ -1246,12 +1283,7 @@ fn web_search_tool_type_text_and_image_sets_search_content_types() {
             filters: None,
             user_location: None,
             search_context_size: None,
-            search_content_types: Some(
-                WEB_SEARCH_CONTENT_TYPES
-                    .into_iter()
-                    .map(str::to_string)
-                    .collect()
-            ),
+            search_content_types: Some(vec!["text".to_string(), "image".to_string()]),
         }
     );
 }
@@ -1601,7 +1633,7 @@ fn shell_zsh_fork_prefers_shell_command_over_unified_exec() {
     assert_eq!(
         tools_config
             .with_unified_exec_shell_mode_for_session(
-                &user_shell,
+                tool_user_shell_type(&user_shell),
                 Some(&PathBuf::from(if cfg!(windows) {
                     r"C:\opt\codex\zsh"
                 } else {

codex-rs/core/tests/common/Cargo.toml

@@ -7,6 +7,9 @@ license.workspace = true
 [lib]
 path = "lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 assert_cmd = { workspace = true }

codex-rs/core/tests/common/lib.rs

@@ -287,7 +287,7 @@ where
     F: Fn(&codex_protocol::protocol::EventMsg) -> Option<T>,
 {
     let ev = wait_for_event(codex, |ev| matcher(ev).is_some()).await;
-    matcher(&ev).unwrap()
+    matcher(&ev).expect("EventMsg should match matcher predicate")
 }
 
 pub async fn wait_for_event_with_timeout<F>(
@@ -417,7 +417,7 @@ pub mod fs_wait {
         let deadline = Instant::now() + timeout;
         loop {
             if path.exists() {
-                return Ok(path.clone());
+                return Ok(path);
             }
             let now = Instant::now();
             if now >= deadline {
@@ -427,7 +427,7 @@ pub mod fs_wait {
             match rx.recv_timeout(remaining) {
                 Ok(Ok(_event)) => {
                     if path.exists() {
-                        return Ok(path.clone());
+                        return Ok(path);
                     }
                 }
                 Ok(Err(err)) => return Err(err.into()),

codex-rs/core/tests/common/responses.rs

@@ -1,3 +1,5 @@
+#![allow(clippy::unwrap_used)]
+
 use std::collections::VecDeque;
 use std::sync::Arc;
 use std::sync::Mutex;

codex-rs/core/tests/common/test_codex.rs

@@ -270,7 +270,7 @@ fn docker_command_success<const N: usize>(args: [&str; N]) -> Result<()> {
     let output = Command::new("docker")
         .args(args)
         .output()
-        .with_context(|| format!("run docker {:?}", args))?;
+        .with_context(|| format!("run docker {args:?}"))?;
     if !output.status.success() {
         return Err(anyhow!(
             "docker {:?} failed: stdout={} stderr={}",
@@ -286,7 +286,7 @@ fn docker_command_capture_stdout<const N: usize>(args: [&str; N]) -> Result<Stri
     let output = Command::new("docker")
         .args(args)
         .output()
-        .with_context(|| format!("run docker {:?}", args))?;
+        .with_context(|| format!("run docker {args:?}"))?;
     if !output.status.success() {
         return Err(anyhow!(
             "docker {:?} failed: stdout={} stderr={}",
@@ -346,7 +346,7 @@ impl TestCodexBuilder {
     pub fn with_model(self, model: &str) -> Self {
         let new_model = model.to_string();
         self.with_config(move |config| {
-            config.model = Some(new_model.clone());
+            config.model = Some(new_model);
         })
     }
 

codex-rs/core/tests/responses_headers.rs

@@ -46,6 +46,7 @@ async fn responses_stream_includes_subagent_header_on_review() {
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,
@@ -158,6 +159,7 @@ async fn responses_stream_includes_subagent_header_on_other() {
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,
@@ -265,6 +267,7 @@ async fn responses_respects_model_info_overrides_from_config() {
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,

codex-rs/core/tests/suite/client.rs

@@ -1,5 +1,7 @@
+use codex_core::AuthManager;
 use codex_core::CodexAuth;
 use codex_core::ModelClient;
+use codex_core::ModelProviderAuthInfo;
 use codex_core::ModelProviderInfo;
 use codex_core::NewThread;
 use codex_core::Prompt;
@@ -64,6 +66,7 @@ use futures::StreamExt;
 use pretty_assertions::assert_eq;
 use serde_json::json;
 use std::io::Write;
+use std::num::NonZeroU64;
 use std::sync::Arc;
 use tempfile::TempDir;
 use uuid::Uuid;
@@ -71,6 +74,7 @@ use wiremock::Mock;
 use wiremock::MockServer;
 use wiremock::ResponseTemplate;
 use wiremock::matchers::body_string_contains;
+use wiremock::matchers::header;
 use wiremock::matchers::header_regex;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
@@ -143,6 +147,95 @@ fn write_auth_json(
     fake_jwt
 }
 
+struct ProviderAuthCommandFixture {
+    tempdir: TempDir,
+    command: String,
+    args: Vec<String>,
+}
+
+impl ProviderAuthCommandFixture {
+    fn new(tokens: &[&str]) -> std::io::Result<Self> {
+        let tempdir = tempfile::tempdir()?;
+        let tokens_file = tempdir.path().join("tokens.txt");
+        let mut token_file_contents = String::new();
+        for token in tokens {
+            token_file_contents.push_str(token);
+            token_file_contents.push('\n');
+        }
+        std::fs::write(&tokens_file, token_file_contents)?;
+
+        #[cfg(unix)]
+        let (command, args) = {
+            let script_path = tempdir.path().join("print-token.sh");
+            std::fs::write(
+                &script_path,
+                r#"#!/bin/sh
+first_line=$(sed -n '1p' tokens.txt)
+printf '%s\n' "$first_line"
+tail -n +2 tokens.txt > tokens.next
+mv tokens.next tokens.txt
+"#,
+            )?;
+            let mut permissions = std::fs::metadata(&script_path)?.permissions();
+            {
+                use std::os::unix::fs::PermissionsExt;
+                permissions.set_mode(0o755);
+            }
+            std::fs::set_permissions(&script_path, permissions)?;
+            ("./print-token.sh".to_string(), Vec::new())
+        };
+
+        #[cfg(windows)]
+        let (command, args) = {
+            let script_path = tempdir.path().join("print-token.ps1");
+            std::fs::write(
+                &script_path,
+                r#"$lines = @(Get-Content -Path tokens.txt)
+if ($lines.Count -eq 0) { exit 1 }
+Write-Output $lines[0]
+$lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt
+"#,
+            )?;
+            (
+                "powershell".to_string(),
+                vec![
+                    "-NoProfile".to_string(),
+                    "-ExecutionPolicy".to_string(),
+                    "Bypass".to_string(),
+                    "-File".to_string(),
+                    ".\\print-token.ps1".to_string(),
+                ],
+            )
+        };
+
+        Ok(Self {
+            tempdir,
+            command,
+            args,
+        })
+    }
+
+    fn auth(&self) -> ModelProviderAuthInfo {
+        ModelProviderAuthInfo {
+            command: self.command.clone(),
+            args: self.args.clone(),
+            timeout_ms: non_zero_u64(/*value*/ 1_000),
+            refresh_interval_ms: 60_000,
+            cwd: match codex_utils_absolute_path::AbsolutePathBuf::try_from(self.tempdir.path()) {
+                Ok(cwd) => cwd,
+                Err(err) => panic!("tempdir should be absolute: {err}"),
+            },
+        }
+    }
+}
+
+fn non_zero_u64(value: u64) -> NonZeroU64 {
+    match NonZeroU64::new(value) {
+        Some(value) => value,
+        None => panic!("expected non-zero value: {value}"),
+    }
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn resume_includes_initial_messages_and_sends_prior_items() {
     skip_if_no_network!();
@@ -659,6 +752,147 @@ async fn includes_conversation_id_and_model_headers_in_request() {
     assert_eq!(request_authorization, "Bearer Test API Key");
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn provider_auth_command_supplies_bearer_token() {
+    skip_if_no_network!();
+
+    let server = MockServer::start().await;
+    mount_sse_once_match(
+        &server,
+        header("authorization", "Bearer command-token"),
+        sse(vec![ev_response_created("resp1"), ev_completed("resp1")]),
+    )
+    .await;
+    let auth_fixture = ProviderAuthCommandFixture::new(&["command-token"]).unwrap();
+
+    send_provider_auth_request(&server, auth_fixture.auth()).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn provider_auth_command_refreshes_after_401() {
+    skip_if_no_network!();
+
+    let server = MockServer::start().await;
+    let auth_fixture = ProviderAuthCommandFixture::new(&["first-token", "second-token"]).unwrap();
+
+    Mock::given(method("POST"))
+        .and(path("/v1/responses"))
+        .and(header_regex("Authorization", "Bearer first-token"))
+        .respond_with(ResponseTemplate::new(401).set_body_string("unauthorized"))
+        .expect(1)
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/v1/responses"))
+        .and(header_regex("Authorization", "Bearer second-token"))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "text/event-stream")
+                .set_body_raw(
+                    sse(vec![ev_response_created("resp1"), ev_completed("resp1")]),
+                    "text/event-stream",
+                ),
+        )
+        .expect(1)
+        .mount(&server)
+        .await;
+
+    send_provider_auth_request(&server, auth_fixture.auth()).await;
+}
+
+/// Issues one streamed Responses request through a provider configured with command-backed auth.
+///
+/// The caller owns the server-side assertions, so this helper only validates that the request
+/// reaches `Completed` without surfacing an auth or transport error to the client.
+#[expect(clippy::expect_used, clippy::unwrap_used)]
+async fn send_provider_auth_request(server: &MockServer, auth: ModelProviderAuthInfo) {
+    let provider = ModelProviderInfo {
+        name: "corp".into(),
+        base_url: Some(format!("{}/v1", server.uri())),
+        env_key: None,
+        env_key_instructions: None,
+        experimental_bearer_token: None,
+        auth: Some(auth),
+        wire_api: WireApi::Responses,
+        query_params: None,
+        http_headers: None,
+        env_http_headers: None,
+        request_max_retries: Some(0),
+        stream_max_retries: Some(0),
+        stream_idle_timeout_ms: Some(5_000),
+        websocket_connect_timeout_ms: None,
+        requires_openai_auth: false,
+        supports_websockets: false,
+    };
+
+    let codex_home = TempDir::new().unwrap();
+    let mut config = load_default_config_for_test(&codex_home).await;
+    config.model_provider_id = provider.name.clone();
+    config.model_provider = provider.clone();
+    let effort = config.model_reasoning_effort;
+    let summary = config.model_reasoning_summary;
+    let model = codex_core::test_support::get_model_offline(config.model.as_deref());
+    config.model = Some(model.clone());
+    let config = Arc::new(config);
+    let model_info =
+        codex_core::test_support::construct_model_info_offline(model.as_str(), &config);
+    let conversation_id = ThreadId::new();
+    let session_telemetry = SessionTelemetry::new(
+        conversation_id,
+        model.as_str(),
+        model_info.slug.as_str(),
+        /*account_id*/ None,
+        Some("test@test.com".to_string()),
+        /*auth_mode*/ None,
+        "test_originator".to_string(),
+        /*log_user_prompts*/ false,
+        "test".to_string(),
+        SessionSource::Exec,
+    );
+    let client = ModelClient::new(
+        Some(AuthManager::from_auth_for_testing(CodexAuth::from_api_key(
+            "unused-api-key",
+        ))),
+        conversation_id,
+        provider,
+        SessionSource::Exec,
+        config.model_verbosity,
+        /*enable_request_compression*/ false,
+        /*include_timing_metrics*/ false,
+        /*beta_features_header*/ None,
+    );
+    let mut client_session = client.new_session();
+    let mut prompt = Prompt::default();
+    prompt.input.push(ResponseItem::Message {
+        id: None,
+        role: "user".to_string(),
+        content: vec![ContentItem::InputText {
+            text: "hello".to_string(),
+        }],
+        end_turn: None,
+        phase: None,
+    });
+
+    let mut stream = client_session
+        .stream(
+            &prompt,
+            &model_info,
+            &session_telemetry,
+            effort,
+            summary.unwrap_or(ReasoningSummary::Auto),
+            /*service_tier*/ None,
+            /*turn_metadata_header*/ None,
+        )
+        .await
+        .expect("responses stream to start");
+
+    while let Some(event) = stream.next().await {
+        if let Ok(ResponseEvent::Completed { .. }) = event {
+            break;
+        }
+    }
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn includes_base_instructions_override_in_request() {
     skip_if_no_network!();
@@ -1796,6 +2030,7 @@ async fn azure_responses_request_includes_store_and_reasoning_ids() {
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,
@@ -2396,6 +2631,7 @@ async fn azure_overrides_assign_properties_used_for_responses_url() {
         // Reuse the existing environment variable to avoid using unsafe code
         env_key: Some(existing_env_var_with_random_value.to_string()),
         experimental_bearer_token: None,
+        auth: None,
         query_params: Some(std::collections::HashMap::from([(
             "api-version".to_string(),
             "2025-04-01-preview".to_string(),
@@ -2486,6 +2722,7 @@ async fn env_var_overrides_loaded_auth() {
         )])),
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         http_headers: Some(std::collections::HashMap::from([(
             "Custom-Header".to_string(),

codex-rs/core/tests/suite/client_websockets.rs

@@ -1674,6 +1674,7 @@ fn websocket_provider_with_connect_timeout(
         env_key: None,
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,

codex-rs/core/tests/suite/plugins.rs

@@ -365,13 +365,22 @@ async fn explicit_plugin_mentions_track_plugin_used_analytics() -> Result<()> {
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
     let deadline = Instant::now() + Duration::from_secs(10);
-    let analytics_request = loop {
+    let plugin_event = loop {
         let requests = server.received_requests().await.unwrap_or_default();
-        if let Some(request) = requests
+        if let Some(event) = requests
             .into_iter()
-            .find(|request| request.url.path() == "/codex/analytics-events/events")
+            .filter(|request| request.url.path() == "/codex/analytics-events/events")
+            .find_map(|request| {
+                let payload: serde_json::Value = serde_json::from_slice(&request.body).ok()?;
+                payload["events"].as_array().and_then(|events| {
+                    events
+                        .iter()
+                        .find(|event| event["event_type"] == "codex_plugin_used")
+                        .cloned()
+                })
+            })
         {
-            break request;
+            break event;
         }
         if Instant::now() >= deadline {
             panic!("timed out waiting for plugin analytics request");
@@ -379,10 +388,7 @@ async fn explicit_plugin_mentions_track_plugin_used_analytics() -> Result<()> {
         tokio::time::sleep(Duration::from_millis(50)).await;
     };
 
-    let payload: serde_json::Value =
-        serde_json::from_slice(&analytics_request.body).expect("analytics payload");
-    let event = &payload["events"][0];
-    assert_eq!(event["event_type"], "codex_plugin_used");
+    let event = plugin_event;
     assert_eq!(event["event_params"]["plugin_id"], "sample@test");
     assert_eq!(event["event_params"]["plugin_name"], "sample");
     assert_eq!(event["event_params"]["marketplace_name"], "test");

codex-rs/core/tests/suite/stream_error_allows_next_turn.rs

@@ -69,6 +69,7 @@ async fn continue_after_stream_error() {
         env_key: Some("PATH".into()),
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,

codex-rs/core/tests/suite/stream_no_completed.rs

@@ -53,6 +53,7 @@ async fn retries_on_early_close() {
         env_key: Some("PATH".into()),
         env_key_instructions: None,
         experimental_bearer_token: None,
+        auth: None,
         wire_api: WireApi::Responses,
         query_params: None,
         http_headers: None,