mirror of https://github.com/openai/codex.git synced 2026-11-13 21:30:47 +00:00

Files

T

dines-oai 0f26d21ff0 Accept ERS v1 and v2 tunnel JWTs (#61260 )

## What changed

Allow ERS-issued tunnel JWTs with numeric `ver` values of `1` or `2` at startup and during credential renewal. Update the validation error to reflect both supported versions.

## Testing

Add coverage for all v1/v2 startup and renewal combinations, bearer modes accepting both versions, and rejection of unsupported versions, malformed claims, missing or empty signatures, and extra JWT segments.

GitOrigin-RevId: 597089de7cf9511d29095d87f36251eb7319f631

2026-11-13 05:06:18 +00:00

.cargo

Ignore Hickory DNSSEC advisories while DNSSEC is disabled (#61156 )

2026-11-12 17:31:24 +00:00

.config

…

agent-graph-store

Persist subagent relationships before creating child storage (#58129 )

2026-10-29 17:25:51 +00:00

agent-identity

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

agent-message-board-client

Clarify remote message board and clock documentation (#61197 )

2026-11-12 22:41:50 +00:00

agent-message-board-host

Extract channel notification formatting into PostPreview (#59688 )

2026-11-05 16:08:23 +00:00

agent-roles

…

analytics

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

ansi-escape

…

app-server

Update realtime model and honor provider-specific voice defaults (#61259 )

2026-11-13 05:04:45 +00:00

app-server-client

Clean up Rust error handling and OTLP test assertions (#61201 )

2026-11-12 23:08:59 +00:00

app-server-daemon

Honor feature overrides when starting the app-server daemon (#60489 )

2026-11-10 01:31:19 +00:00

app-server-protocol

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

app-server-protocol-noop-macros

…

app-server-test-client

Allow searching persisted attached threads (#60574 )

2026-11-10 11:17:06 +00:00

app-server-transport

Use runtime authentication for Analytics requests (#60101 )

2026-11-07 10:41:36 +00:00

apply-patch

Support direct Guardian review of patches invoked through exec_command (#58931 )

2026-11-02 17:05:56 +00:00

arg0

…

async-utils

…

attachment-store

Use measured durations to budget uploaded audio (#59268 )

2026-11-04 00:19:12 +00:00

aws-auth

…

backend-client

Use runtime authentication for Analytics requests (#60101 )

2026-11-07 10:41:36 +00:00

build-info

…

bwrap

Fix Bazel tool resolution for bubblewrap and voice builds (#61254 )

2026-11-13 04:48:28 +00:00

chatgpt

Use runtime authentication for OpenAI MCP and app requests (#59749 )

2026-11-05 22:03:29 +00:00

cli

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

cloud-client

Support renaming cloud threads (#61182 )

2026-11-12 21:03:47 +00:00

cloud-config

Add ChatGPT token stdin authentication to exec-server (#59569 )

2026-11-05 04:25:19 +00:00

cloud-tasks

Use runtime authentication across backend request paths (#59572 )

2026-11-05 05:09:32 +00:00

cloud-tasks-client

Use runtime authentication across backend request paths (#59572 )

2026-11-05 05:09:32 +00:00

cloud-tasks-mock-client

…

code-mode

Fix code-mode session admission retries for proxy HTTP 503 responses (#61153 )

2026-11-12 16:38:13 +00:00

code-mode-host

Fix code-mode session admission retries for proxy HTTP 503 responses (#61153 )

2026-11-12 16:38:13 +00:00

code-mode-protocol

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

code-mode-runtime

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

codex-api

Update realtime model and honor provider-specific voice defaults (#61259 )

2026-11-13 05:04:45 +00:00

codex-backend-openapi-models

…

codex-client

…

codex-experimental-api-macros

…

codex-home

…

codex-mcp

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

collaboration-mode-templates

…

config

Add local status line provider configuration (#61211 )

2026-11-13 00:28:10 +00:00

config-schema

Use hermetic LLVM for Windows MSVC Bazel builds (#60507 )

2026-11-10 03:02:25 +00:00

connectors

Deduplicate overlapping Apps startup tool listings (#61220 )

2026-11-13 01:08:55 +00:00

context-fragments

Ensure side-chat policy reaches the first model request (#60067 )

2026-11-07 05:59:44 +00:00

core

Update realtime model and honor provider-specific voice defaults (#61259 )

2026-11-13 05:04:45 +00:00

core-api

Add graceful agent-tree suspension and recovery (#61198 )

2026-11-12 22:43:14 +00:00

core-plugin-common

…

core-plugins

Reclaim abandoned trusted Git repositories (#61180 )

2026-11-12 21:02:43 +00:00

diagnostics

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

direct-tool-timing

Report auto-review overhead in turn critical-path analytics (#59260 )

2026-11-03 23:49:01 +00:00

docs

Run Bazel CI locally without BuildBuddy credentials (#59055 )

2026-11-03 04:08:59 +00:00

exec

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

exec-server

Centralize filesystem helper sandbox preparation (#61138 )

2026-11-12 14:47:48 +00:00

exec-server-cli

Add ChatGPT token stdin authentication to exec-server (#59569 )

2026-11-05 04:25:19 +00:00

exec-server-protocol

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

execpolicy

Add opt-in Unicode canonical matching to exec policy rules (#59535 )

2026-11-05 00:55:46 +00:00

ext

Refactor history and notes tools around backend traits (#61251 )

2026-11-13 04:21:43 +00:00

external-agent-migration

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

features

Support model catalog Apps usage instructions (#61213 )

2026-11-13 00:29:24 +00:00

feedback

…

file-search

Deduplicate file search results from overlapping roots (#60845 )

2026-11-11 19:16:19 +00:00

file-system

Remove the legacy sandbox policy constructor (#59772 )

2026-11-06 00:37:27 +00:00

file-watcher

Avoid periodic wakeups in idle Windows file watchers (#60560 )

2026-11-10 08:52:35 +00:00

git-utils

Skip submodule worktree scans when checking repository changes (#60669 )

2026-11-10 21:58:49 +00:00

guardian-context

Defer Guardian context limits to request preparation (#61185 )

2026-11-12 21:40:00 +00:00

history

Preserve thread-local model ID state across replay and compaction (#60942 )

2026-11-12 00:27:01 +00:00

hooks

Use hermetic LLVM for Windows MSVC Bazel builds (#60507 )

2026-11-10 03:02:25 +00:00

http-client

Store rollout trace payloads in compressed shards (#61222 )

2026-11-13 01:22:19 +00:00

http-headers-helper

Extract HTTP headers helper execution into a shared crate (#61018 )

2026-11-12 04:32:34 +00:00

install-context

…

keyring-store

…

linux-sandbox

Block request_key in Linux network sandbox filters (#61256 )

2026-11-13 04:50:31 +00:00

lmstudio

…

Add SPIFFE JWT-SVID support for workload identity authentication (#61207 )

2026-11-12 23:53:50 +00:00

memories

Move rollout trace recording to a background worker (#61253 )

2026-11-13 04:36:03 +00:00

mermaid

…

message-board

Clarify remote message board and clock documentation (#61197 )

2026-11-12 22:41:50 +00:00

message-board-mcp

Add opt-in MCP discovery for in-memory agent message boards (#58973 )

2026-11-02 20:34:35 +00:00

message-history

…

model-provider

Negotiate realtime voice calls in the TUI (#61172 )

2026-11-12 19:43:12 +00:00

model-provider-info

Add device-code authorization for gateway OAuth (#59822 )

2026-11-06 04:24:04 +00:00

models-manager

Enable model catalog discovery with gateway OAuth (#60414 )

2026-11-09 16:37:22 +00:00

mxc-sandbox

Include Win32 error codes in MXC process launch failures (#61227 )

2026-11-13 01:43:44 +00:00

network-proxy

Add policy-checked TCP upstream tunneling for SOCKS (#60523 )

2026-11-10 04:43:24 +00:00

ollama

…

otel

Clean up Rust error handling and OTLP test assertions (#61201 )

2026-11-12 23:08:59 +00:00

otel-trace-websocket

…

plugin

…

plugin-host

Add a bounded V8 runtime for UI plugin processes (#57508 )

2026-10-27 16:36:32 +00:00

process-hardening

…

prompts

Support model catalog Apps usage instructions (#61213 )

2026-11-13 00:29:24 +00:00

protocol

Update realtime model and honor provider-specific voice defaults (#61259 )

2026-11-13 05:04:45 +00:00

realtime-webrtc

…

response-debug-context

Fall back to HTTP immediately for oversized WebSocket requests (#60840 )

2026-11-11 18:58:21 +00:00

responses-api-proxy

…

rmcp-client

Extract HTTP headers helper execution into a shared crate (#61018 )

2026-11-12 04:32:34 +00:00

rollout

Fix pagination for unindexed threads sorted by ascending recency (#61181 )

2026-11-12 21:03:15 +00:00

rollout-trace

Move rollout trace recording to a background worker (#61253 )

2026-11-13 04:36:03 +00:00

runtime-agent-instance

Use runtime authentication for Analytics requests (#60101 )

2026-11-07 10:41:36 +00:00

sandboxing

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

scripts

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

secrets

Populate the local secrets cache after successful saves (#59520 )

2026-11-04 23:46:52 +00:00

shell-command

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

skills

Route broad Codex setup questions through self-knowledge guidance (#59949 )

2026-11-06 17:47:31 +00:00

state

Allow searching persisted attached threads (#60574 )

2026-11-10 11:17:06 +00:00

stdio-to-uds

…

tcp-tunnel

Accept ERS v1 and v2 tunnel JWTs (#61260 )

2026-11-13 05:06:18 +00:00

terminal-detection

Recognize Rex terminals and enable Kitty graphics for pets (#58270 )

2026-10-30 07:11:56 +00:00

test-binary-support

…

thread-manager-sample

Add local status line provider configuration (#61211 )

2026-11-13 00:28:10 +00:00

thread-store

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

tools

Preserve file-backed audio in tool outputs (#60735 )

2026-11-11 06:41:15 +00:00

tui

Update realtime model and honor provider-specific voice defaults (#61259 )

2026-11-13 05:04:45 +00:00

uds

…

user-verification

Report biometric type in user verification responses (#60948 )

2026-11-12 00:44:27 +00:00

utils

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

v8-poc

Test V8 inline typed array storage limits (#58385 )

2026-10-30 16:35:54 +00:00

vendor

…

voice-host

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

websocket-auth

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

websocket-client

Wire shared runtime authentication through threads and API clients (#59177 )

2026-11-03 15:02:57 +00:00

windows-sandbox-rs

Add refreshable headers for OTLP HTTP exporters (#61028 )

2026-11-12 05:21:30 +00:00

windows-sandbox-service

Include AppX event IDs in Windows runtime registration errors (#61224 )

2026-11-13 01:31:24 +00:00

workload-identity

Add SPIFFE JWT-SVID support for workload identity authentication (#61207 )

2026-11-12 23:53:50 +00:00

worktree

…

.gitignore

…

BUILD.bazel

Ship the standalone executor in release packages (#57837 )

2026-10-28 21:09:05 +00:00

Cargo.lock

Store rollout trace payloads in compressed shards (#61222 )

2026-11-13 01:22:19 +00:00

Cargo.toml

Add SPIFFE JWT-SVID support for workload identity authentication (#61207 )

2026-11-12 23:53:50 +00:00

clippy.toml

…

config.md

…

default.nix

…

deny.toml

Ignore Hickory DNSSEC advisories while DNSSEC is disabled (#61156 )

2026-11-12 17:31:24 +00:00

README.md

…

rust-toolchain.toml

Upgrade the Rust toolchain to 1.99.1 (#61205 )

2026-11-12 23:51:52 +00:00

rustfmt.toml

…

README.md

Codex CLI

Codex CLI Documentation