openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-13 11:47:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
1b83e5cdf99889e72fbf3f92d9848fdf31de652e
codex/codex-rs
History
Drew Hintz 1b83e5cdf9 Restrict login setup redirects to known platform origins (#44670) 
## Why

The login success pages use `platform_url` from the query string to build an organization setup redirect that includes the ID token. An arbitrary destination could receive that token.

## What changed

Require `platform_url` to exactly match `https://platform.openai.com` or `https://platform.api.openai.org` before showing the setup prompt or starting the redirect countdown. Apply the check to both the current and legacy login success pages.

GitOrigin-RevId: 37a08482c23b82483fd519f943a0b4eb6caaa161
2026-09-10 23:15:48 +00:00
..
.cargo
…
.config
Support managed worktrees for interactive sessions and forks (#43069)
2026-09-05 18:06:26 +00:00
agent-graph-store
…
agent-identity
…
agent-roles
…
analytics
Remove repo_url from skill invocation analytics events (#44586)
2026-09-10 17:03:11 +00:00
ansi-escape
…
app-server
Enforce managed model provider selection and definitions (#44650)
2026-09-10 21:41:39 +00:00
app-server-client
Wire app-server user verification RPCs to the native provider (#43568)
2026-09-07 19:34:23 +00:00
app-server-daemon
Record thread recovery candidates on managed daemon shutdown (#44299)
2026-09-09 20:39:33 +00:00
app-server-protocol
Enforce managed model provider selection and definitions (#44650)
2026-09-10 21:41:39 +00:00
app-server-protocol-noop-macros
…
app-server-test-client
Expose thread originators through the app-server API (#42458)
2026-09-03 06:02:25 +00:00
app-server-transport
Bound app-server stdio shutdown and handle Unix SIGTERM gracefully (#44523)
2026-09-10 13:02:57 +00:00
apply-patch
…
arg0
Use the async stack budget for approval reviews (#41840)
2026-08-31 13:44:12 +00:00
async-utils
Use the async stack budget for approval reviews (#41840)
2026-08-31 13:44:12 +00:00
attachment-store
Add an injectable attachment store to ThreadManager (#42634)
2026-09-03 23:20:54 +00:00
aws-auth
Add AWS credential export commands for Amazon Bedrock (#44028)
2026-09-09 03:17:48 +00:00
backend-client
Add Luna Reserve usage fallback to the TUI (#42372)
2026-09-02 21:50:51 +00:00
build-info
Expose a stable executor build identity in environment metadata (#43513)
2026-09-07 16:55:06 +00:00
bwrap
…
chatgpt
…
cli
Preserve missing environment variable diagnostics in Codex Doctor (#44654)
2026-09-10 21:51:08 +00:00
cloud-config
Enforce managed model provider selection and definitions (#44650)
2026-09-10 21:41:39 +00:00
cloud-tasks
Harden embedded composer input handling (#42408)
2026-09-03 01:46:37 +00:00
cloud-tasks-client
Restrict cloud task credentials to trusted origins (#41403)
2026-08-28 19:44:50 +00:00
cloud-tasks-mock-client
…
code-mode
Report code mode host request durations (#41452)
2026-08-29 02:52:58 +00:00
code-mode-host
Extract OTEL trace WebSocket into a reusable crate (#42102)
2026-09-01 17:17:45 +00:00
code-mode-protocol
Improve tracing for nested tool calls and exec processes (#41950)
2026-09-01 01:00:50 +00:00
code-mode-runtime
Allow discarded code mode tool responses to be garbage collected (#44619)
2026-09-10 18:55:57 +00:00
codex-api
Distinguish HTTP quota errors from rate limits (#44492)
2026-09-10 10:31:15 +00:00
codex-backend-openapi-models
…
codex-client
…
codex-experimental-api-macros
…
codex-home
…
codex-mcp
Honor thread-level plugin exclusions across runtime capabilities (#44655)
2026-09-10 21:51:34 +00:00
collaboration-mode-templates
Use static instructions for the Default collaboration mode (#42904)
2026-09-05 01:25:06 +00:00
config
Resolve filesystem denials with explicit path context (#44669)
2026-09-10 23:08:23 +00:00
config-schema
Move the config schema generator into a dedicated crate (#41915)
2026-08-31 21:27:51 +00:00
connectors
Honor thread-level plugin exclusions across runtime capabilities (#44655)
2026-09-10 21:51:34 +00:00
context-fragments
Add TUI building blocks for inline async question editing (#42889)
2026-09-04 23:56:25 +00:00
core
Resolve filesystem denials with explicit path context (#44669)
2026-09-10 23:08:23 +00:00
core-api
Add an injectable attachment store to ThreadManager (#42634)
2026-09-03 23:20:54 +00:00
core-plugins
Avoid executing PATH helpers before workspace trust (#42324)
2026-09-02 18:34:27 +00:00
diagnostics
…
docs
Remove the deprecated codex mcp-server command (#42993)
2026-09-05 12:17:32 +00:00
exec
Set recursion_limit to 256 for app-server, exec, and TUI (#43519)
2026-09-07 17:09:04 +00:00
exec-server
Keep Windows sandbox private desktops alive across helper exits (#44658)
2026-09-10 22:17:03 +00:00
exec-server-protocol
Expose a stable executor build identity in environment metadata (#43513)
2026-09-07 16:55:06 +00:00
execpolicy
…
ext
Invalidate cached Guardian approvals for unscored permission widening (#44617)
2026-09-10 18:47:31 +00:00
external-agent-migration
Preserve root turn attribution in turn-start events (#44611)
2026-09-10 18:24:13 +00:00
features
Add opt-in model discovery for OpenAI API keys (#44392)
2026-09-10 03:18:28 +00:00
feedback
Preserve whole diagnostic attachments and report incomplete uploads (#44606)
2026-09-10 18:10:26 +00:00
file-search
…
file-system
Propagate executor home directories into sandbox contexts (#41204)
2026-08-27 20:44:47 +00:00
file-watcher
…
git-utils
Include linked worktrees in TUI session discovery (#43279)
2026-09-06 20:52:29 +00:00
guardian-context
Preserve Guardian authorization evidence until request budgeting (#44570)
2026-09-10 16:02:36 +00:00
history
Persist disabled plugin IDs in thread settings (#44332)
2026-09-09 23:23:59 +00:00
hooks
Distinguish forked sessions in session-start hooks (#44349)
2026-09-10 00:26:30 +00:00
http-client
Preserve __oailb routing cookies in ChatGPT HTTP clients (#43895)
2026-09-08 19:40:43 +00:00
install-context
Detect Vite+-managed Codex installs (#42071)
2026-09-01 15:12:53 +00:00
keyring-store
…
linux-sandbox
Block WSL interop escapes from restricted filesystem sandboxes (#44286)
2026-09-09 19:43:41 +00:00
lmstudio
…
login
Restrict login setup redirects to known platform origins (#44670)
2026-09-10 23:15:48 +00:00
memories
Set turn triggers for guardian and memory requests (#44298)
2026-09-09 20:32:57 +00:00
message-history
…
model-provider
Add opt-in model discovery for OpenAI API keys (#44392)
2026-09-10 03:18:28 +00:00
model-provider-info
Enforce managed model provider selection and definitions (#44650)
2026-09-10 21:41:39 +00:00
models-manager
Add opt-in model discovery for OpenAI API keys (#44392)
2026-09-10 03:18:28 +00:00
mxc-sandbox
Add bounded environment transport for MXC launch requests (#44626)
2026-09-10 19:29:54 +00:00
network-proxy
Handle credential provider source remapping across config layers (#44241)
2026-09-09 17:45:17 +00:00
ollama
…
otel
Use explicit histogram buckets for Guardian context metrics (#44181)
2026-09-09 15:48:39 +00:00
otel-trace-websocket
Extract OTEL trace WebSocket into a reusable crate (#42102)
2026-09-01 17:17:45 +00:00
plugin
Honor thread-level plugin exclusions across runtime capabilities (#44655)
2026-09-10 21:51:34 +00:00
process-hardening
…
prompts
…
protocol
Preserve root turn attribution in turn-start events (#44611)
2026-09-10 18:24:13 +00:00
realtime-webrtc
Add live WebRTC voice conversations to the TUI (#43581)
2026-09-07 20:25:30 +00:00
response-debug-context
Classify streaming rate-limit errors (#40931)
2026-08-26 17:45:42 +00:00
responses-api-proxy
…
rmcp-client
Recover OAuth metadata discovery from 503 responses via OIDC (#44636)
2026-09-10 20:50:10 +00:00
rollout
Preserve root turn attribution in turn-start events (#44611)
2026-09-10 18:24:13 +00:00
rollout-trace
Surface model provider authentication recovery progress (#41239)
2026-08-28 01:14:02 +00:00
sandboxing
Keep Windows sandbox private desktops alive across helper exits (#44658)
2026-09-10 22:17:03 +00:00
scripts
…
secrets
…
shell-command
Support configured credential providers across shell snapshots (#44072)
2026-09-09 06:04:59 +00:00
shell-escalation
Harden credential handling in shell snapshots and replay (#44040)
2026-09-09 04:00:10 +00:00
skills
Update OpenAI Docs skill guidance for GPT-6 Astra (#42931)
2026-09-05 05:21:42 +00:00
state
Persist disabled plugin IDs in thread settings (#44332)
2026-09-09 23:23:59 +00:00
stdio-to-uds
…
terminal-detection
Avoid executing PATH helpers before workspace trust (#42324)
2026-09-02 18:34:27 +00:00
test-binary-support
…
thread-manager-sample
Make older app-server notices configurable in the TUI (#43698)
2026-09-08 04:35:21 +00:00
thread-store
Preserve root turn attribution in turn-start events (#44611)
2026-09-10 18:24:13 +00:00
tools
Add bounded tool-result metadata support to executed tool calls (#44336)
2026-09-09 23:46:17 +00:00
tui
Honor system reduced-motion preferences in the TUI (#44666)
2026-09-10 22:55:04 +00:00
uds
Harden Windows control socket rendezvous (#42326)
2026-09-02 18:42:06 +00:00
user-verification
Add macOS user verification with Secure Enclave signing (#43624)
2026-09-08 00:13:28 +00:00
utils
Resolve filesystem denials with explicit path context (#44669)
2026-09-10 23:08:23 +00:00
v8-poc
…
vendor
…
voice-host
Disable clock synchronization in the voice audio sink (#43704)
2026-09-08 04:55:29 +00:00
websocket-client
Support trusted headers for remote exec WebSockets (#42606)
2026-09-03 20:01:07 +00:00
windows-sandbox-rs
Keep Windows sandbox private desktops alive across helper exits (#44658)
2026-09-10 22:17:03 +00:00
windows-sandbox-service
Clean up Windows sandbox resources on app uninstall (#42375)
2026-09-02 22:19:51 +00:00
workload-identity
…
worktree
Show worktree owner details and add confirmed deletion (#43942)
2026-09-08 23:37:26 +00:00
.gitignore
Remove the repository devcontainer configurations (#43915)
2026-09-08 21:19:02 +00:00
BUILD.bazel
…
Cargo.lock
Honor system reduced-motion preferences in the TUI (#44666)
2026-09-10 22:55:04 +00:00
Cargo.toml
Bound app-server stdio shutdown and handle Unix SIGTERM gracefully (#44523)
2026-09-10 13:02:57 +00:00
clippy.toml
…
config.md
…
default.nix
…
deny.toml
Add WebRTC negotiation to the voice host (#42676)
2026-09-04 05:07:02 +00:00
README.md
…
rust-toolchain.toml
…
rustfmt.toml
…

README.md

Codex CLI

Codex CLI Documentation

Reference in New Issue View Git Blame Copy Permalink