mirror of https://github.com/openai/codex.git synced 2026-11-05 20:10:33 +00:00

Files

T

Dmitriy Kovalenko 3f958ac2fe Run Bazel CI locally without BuildBuddy credentials (#59055 )

## What changed

- Remove automatic BuildBuddy configuration and credential forwarding from Bazel CI, release, SDK, and voice builds. Strip remote execution CI configs in the shared wrapper while retaining explicit remote configurations for local use.
- Use native Windows host tools and audio dependencies for Windows Bazel actions, forwarding the required toolchain and environment settings.
- Initialize message-board MCP servers through a per-session `OnceCell` so server startup does not hold the shared registry lock across an await.
- Expose the message-board test helper to the core Bazel package and update the runtime-auth test call for the `reauth` argument.

GitOrigin-RevId: 5d5c1f4d71fa841090dea8eec8006380981fb65b

2026-11-03 04:08:59 +00:00

examples

Add managed enforcement of DELETE journaling on NFS (#57225 )

2026-10-26 20:10:45 +00:00

src

Run Bazel CI locally without BuildBuddy credentials (#59055 )

2026-11-03 04:08:59 +00:00

BUILD.bazel

Add shared agent message-board extension interfaces (#46959 )

2026-09-21 07:52:40 +00:00

Cargo.toml

Move agent message-board backend construction into the extension (#58986 )

2026-11-02 21:22:16 +00:00

README.md

Add explicit local board connections with fixed runtime access (#53400 )

2026-10-12 14:44:22 +00:00

README.md

Load a local board template

Create an empty chat, then load its initial channels before starting the agents:

just agent-board-config ~/.codex <root-session-id> /absolute/path/setup.json

Use the same SQLite home as Codex (sqlite_home, normally $CODEX_HOME or ~/.codex). Example setup.json:

{
  "template": {
    "version": 1,
    "channels": { "policy": { "description": "Shared policies" } }
  }
}

The template and channels are saved atomically. Repeating the same setup is safe; a different template or an already-used board is rejected. The pinned setup survives reopen. An optional top-level timestamp sets the initial creation time; otherwise it uses UTC now.

This loads channels and descriptions only. ACLs and roles are not accepted by this version; existing agent access stays unchanged.

Connect Codex runtimes

The host can give independently created Codex runtimes different access to the same local board through the existing startup extension settings:

let board = LocalBoard::new(sqlite_config, board_id);
guardian_options.thread_extension_init.insert(board.read_only());
writer_options.thread_extension_init.insert(board.read_write());

Both connections carry the same SQLite configuration and board ID. Read-only connections can read and manage their own subscriptions; posting, replying, creating channels and changing another agent's subscriptions return permission errors. Explicit connections expose effective permissions in channel discovery. Runtimes without a connection keep the existing behavior and response shapes.

Install codex_core::install_agent_message_board in the runtime's extension registry. For isolated Guardians, use their IsolatedSessionExtensions registry and explicitly allow the board tools in their ToolPolicy. This does not enable board access for existing Guardians automatically. Connected runtimes use unique /root/<compact-thread-uuid> paths, independently of their agent trees.

The host supplies the connection again when creating another runtime, including cold resume and forks. Connections are not database ACLs or inherited through spawn_agent. Local filesystem writers remain trusted.