mirror of
https://github.com/openai/codex.git
synced 2026-09-14 11:57:03 +00:00
81c4928825
- Added a built-in `request_permissions` tool so running turns can request additional permissions at runtime, with new TUI rendering for those approval calls. (#13092, #14004) - Expanded plugin workflows with curated marketplace discovery, richer `plugin/list` metadata, install-time auth checks, and a `plugin/uninstall` endpoint. (#13712, #13540, #13685, #14111) - Upgraded app-server command execution with streaming stdin/stdout/stderr plus TTY/PTY support, and wired `exec` to the new in-process app server path. (#13640, #14005) - Web search settings now support full tool configuration (for example filters and location), not just on/off. (#13675) - Added the new permission-profile config language and split filesystem/network sandbox policy plumbing for more precise policy control. (#13434, #13439, #13440, #13448, #13449, #13453) - Image generation now saves output files into the current working directory. (#13607) ## Bug Fixes - Fixed auth error handling for cloud requirements fetch so 401s trigger the normal auth-recovery messaging instead of a generic workspace-config failure. (#14049) - Fixed trust bootstrap to avoid running `git` commands before project trust is established. (#13804) - Fixed Windows execution edge cases, including incorrect PTY `TerminateProcess` success handling and stricter sandbox startup cwd validation. (#13989, #13833, #13742) - Fixed plugin startup behavior so curated plugins are loaded in TUI sessions as expected. (#14050) - Hardened network proxy policy parsing by rejecting global wildcard (`*`) domains while preserving scoped wildcard support. (#13789) - Fixed approval payload compatibility for macOS automation permissions by accepting both supported input shapes. (#13683) ## Documentation - Clarified `js_repl` guidance for persistent bindings and redeclaration recovery to reduce avoidable REPL errors. (#13803) ## Chores - Reduced log/storage overhead by moving logs to a dedicated SQLite DB, adding timestamps to feedback logs, pruning old data, and tightening retention/row limits. (#13645, #13688, #13734, #13763, #13772, #13781) - Improved Windows distribution automation by publishing CLI releases to winget. (#12943) ## Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.112.0...rust-v0.113.0 - #13626 feat(otel): safe tracing @owenlin0 - #13560 Refine realtime startup context formatting @aibrahim-oai - #13615 Replay thread rollback from rollout history @aibrahim-oai - #13642 fix(tui): clean up pending steer preview wrapping @charley-oai - #13645 Add timestamped SQLite /feedback logs without schema changes @charley-oai - #13654 tui: sort resume picker by last updated time @charley-oai - #13540 support plugin/list. @xl-openai - #13677 chore: remove unused legacy macOS permission types @celia-oai - #13683 fix: accept two macOS automation input shapes for approval payload compatibility @celia-oai - #13687 refactor: remove proxy admin endpoint @viyatb-oai - #13669 copy current exe to CODEX_HOME/.sandbox-bin for apply_patch @iceweasel-oai - #11874 fix(tui) remove config check for trusted setting @dylan-hurd-oai - #13685 check app auth in plugin/install @sayan-oai - #13697 change sound @aibrahim-oai - #13607 Enabling CWD Saving for Image-Gen @won-openai - #13621 [elicitations] Switch to use MCP style elicitation payload for mcp tool approvals. @mzeng-openai - #13619 feat: status line with real data @jif-oai - #13734 feat: prune old memories in DB @jif-oai - #13688 Add timestamps to feedback log lines @etraut-openai - #13742 fix: windows normalization @jif-oai - #13514 [rmcp-client] Recover from streamable HTTP 404 sessions @caseychow-oai - #13750 feat: drop sqlite db feature flag @jif-oai - #13753 feat: drop discrepency metrics @jif-oai - #13763 feat: limit number of rows per log @jif-oai - #13703 Clarify sandbox permission override helper semantics @charley-oai - #13770 fix(app-server): fix turn_start_shell_zsh_fork_executes_command_v2 flake @owenlin0 - #13630 feat(otel, core): record turn TTFT and TTFM metrics in codex-core @owenlin0 - #13674 app-server: Emit `thread/name/updated` event globally @euroelessar - #13772 Move sqlite logs to a dedicated database @charley-oai - #13620 chore: improve DB flushing @jif-oai - #13711 feat: structured plugin parsing @sayan-oai - #13781 Reduce SQLite log retention to 10 days @charley-oai - #13780 fix: move unit tests in codex-rs/core/src/config/mod.rs into their own file @bolinfest - #13783 fix: move unit tests in codex-rs/core/src/codex.rs into their own file @bolinfest - #13787 fix bazel build @bolinfest - #13789 fix: reject global wildcard network proxy domains @viyatb-oai - #12943 Codex/winget auto update @iceweasel-oai - #13800 chore(otel): reorganize codex-otel crate @owenlin0 - #13797 feat: add auth login diagnostics @joshka-oai - #13695 utils/pty: add streaming spawn and terminal sizing primitives @euroelessar - #13803 Clarify js_repl binding reuse guidance @fjord-oai - #13810 docs: remove auth login logging plan @joshka-oai - #13434 config: add initial support for the new permission profile config language in config.toml @bolinfest - #13796 Add realtime startup context override @aibrahim-oai - #13814 fix: include libcap-dev dependency when creating a devcontainer for building Codex @bolinfest - #13808 chore(otel): rename OtelManager to SessionTelemetry @owenlin0 - #13712 feat: Add curated plugin marketplace + Metadata Cleanup. @xl-openai - #13791 fix(core): skip exec approval for permissionless skill scripts @celia-oai - #13675 Allow full web search tool config @rm-openai - #13640 app-server: Add streaming and tty/pty capabilities to `command/exec` @euroelessar - #13819 feat(app-server-protocol): address naming conflicts in json schema exporter @owenlin0 - #13804 fix: avoid invoking git before project trust is established @viyatb-oai - #12752 fix: support managed network allowlist controls @viyatb-oai - #13439 sandboxing: plumb split sandbox policies through runtime @bolinfest - #13440 protocol: derive effective file access from filesystem policies @bolinfest - #13816 fix(core): respect reject policy by approval source for skill scripts @celia-oai - #13833 app-server: require absolute cwd for windowsSandbox/setupStart @iceweasel-oai - #13670 Add Fast mode status-line indicator @etraut-openai - #13445 safety: honor filesystem policy carveouts in apply_patch @bolinfest - #13771 feat: simplify DB further @jif-oai - #13692 Add guardian approval MVP @charley-oai - #13851 tmp: drop artifact skills @jif-oai - #13910 fix(core) rm guardian snapshot test @dylan-hurd-oai - #13911 fix(ci) fix guardian ci @dylan-hurd-oai - #13896 Fix TUI context window display before first TokenCount @etraut-openai - #13448 seatbelt: honor split filesystem sandbox policies @bolinfest - #13921 chore: use @plugin instead of $plugin for plaintext mentions @sayan-oai - #13807 [elicitations] Support always allow option for mcp tool calls. @mzeng-openai - #13449 linux-sandbox: plumb split sandbox policies through helper @bolinfest - #13451 sandboxing: preserve denied paths when widening permissions @bolinfest - #13452 protocol: keep root carveouts sandboxed @bolinfest - #13874 Stabilize abort task follow-up handling @aibrahim-oai - #13453 linux-sandbox: honor split filesystem policies in bwrap @bolinfest - #13989 Fix inverted Windows PTY `TerminateProcess` handling @etraut-openai - #13912 fix(ci): restore guardian coverage and bazel unit tests @charley-oai - #13877 Stabilize shell serialization tests @aibrahim-oai - #13839 [app-server] Support hot-reload user config when batch writing config. @mzeng-openai - #14005 Add in-process app server and wire up exec to use it @etraut-openai - #13929 app-server: include experimental skill metadata in exec approval requests @celia-oai - #14014 fix(core) patch otel test @dylan-hurd-oai - #13841 tui: clarify pending steer follow-ups @charley-oai - #13092 Add request permissions tool @mousseau-oai - #14027 fix(bazel) add missing app-server-client BUILD.bazel @dylan-hurd-oai - #14004 feat(tui) render request_permissions calls @dylan-hurd-oai - #14052 Stabilize app list update ordering test @aibrahim-oai - #13897 guardian initial feedback / tweaks @charley-oai - #13884 Reduce app-server test timeout pressure @aibrahim-oai - #13872 Stabilize zsh fork app-server tests @aibrahim-oai - #13881 Stabilize RMCP pid file cleanup test @aibrahim-oai - #13883 Stabilize PTY Python REPL test @aibrahim-oai - #14058 Stabilize plan item app-server tests @aibrahim-oai - #13943 Order websocket initialize after handshake @aibrahim-oai - #13885 Stabilize thread resume replay tests @aibrahim-oai - #13878 Serialize shell snapshot stdin test @aibrahim-oai - #13876 Stabilize realtime startup context tests @aibrahim-oai - #14050 fix(plugin): Also load curated plugins for TUI. @xl-openai - #14049 fix: properly handle 401 error in clound requirement fetch. @xl-openai - #14101 Stabilize shell approval MCP test @aibrahim-oai - #14102 Stabilize interrupted task approval cleanup @aibrahim-oai - #14103 Stabilize guardian approval coverage @aibrahim-oai - #14060 Stabilize resumed rollout messages @aibrahim-oai - #14114 fix(ci) Faster shell_command::unicode_output test @dylan-hurd-oai - #14111 chore: plugin/uninstall endpoint @sayan-oai - #14117 feat(otel): Centralize OTEL metric names and shared tag builders @owenlin0 - #13880 Stabilize RMCP streamable HTTP readiness tests @aibrahim-oai - #14123 pass on save info to model + ui tweaks @won-openai - #13886 Stabilize protocol schema fixture generation @aibrahim-oai
Codex CLI (Rust Implementation)
We provide Codex CLI as a standalone, native executable to ensure a zero-dependency install.
Installing Codex
Today, the easiest way to install Codex is via npm:
npm i -g @openai/codex
codex
You can also install via Homebrew (brew install --cask codex) or download a platform-specific release directly from our GitHub Releases.
Documentation quickstart
- First run with Codex? Start with
docs/getting-started.md(links to the walkthrough for prompts, keyboard shortcuts, and session management). - Want deeper control? See
docs/config.mdanddocs/install.md.
What's new in the Rust CLI
The Rust implementation is now the maintained Codex CLI and serves as the default experience. It includes a number of features that the legacy TypeScript CLI never supported.
Config
Codex supports a rich set of configuration options. Note that the Rust CLI uses config.toml instead of config.json. See docs/config.md for details.
Model Context Protocol Support
MCP client
Codex CLI functions as an MCP client that allows the Codex CLI and IDE extension to connect to MCP servers on startup. See the configuration documentation for details.
MCP server (experimental)
Codex can be launched as an MCP server by running codex mcp-server. This allows other MCP clients to use Codex as a tool for another agent.
Use the @modelcontextprotocol/inspector to try it out:
npx @modelcontextprotocol/inspector codex mcp-server
Use codex mcp to add/list/get/remove MCP server launchers defined in config.toml, and codex mcp-server to run the MCP server directly.
Notifications
You can enable notifications by configuring a script that is run whenever the agent finishes a turn. The notify documentation includes a detailed example that explains how to get desktop notifications via terminal-notifier on macOS. When Codex detects that it is running under WSL 2 inside Windows Terminal (WT_SESSION is set), the TUI automatically falls back to native Windows toast notifications so approval prompts and completed turns surface even though Windows Terminal does not implement OSC 9.
codex exec to run Codex programmatically/non-interactively
To run Codex non-interactively, run codex exec PROMPT (you can also pass the prompt via stdin) and Codex will work on your task until it decides that it is done and exits. Output is printed to the terminal directly. You can set the RUST_LOG environment variable to see more about what's going on.
Use codex exec --ephemeral ... to run without persisting session rollout files to disk.
Experimenting with the Codex Sandbox
To test to see what happens when a command is run under the sandbox provided by Codex, we provide the following subcommands in Codex CLI:
# macOS
codex sandbox macos [--full-auto] [--log-denials] [COMMAND]...
# Linux
codex sandbox linux [--full-auto] [COMMAND]...
# Windows
codex sandbox windows [--full-auto] [COMMAND]...
# Legacy aliases
codex debug seatbelt [--full-auto] [--log-denials] [COMMAND]...
codex debug landlock [--full-auto] [COMMAND]...
Selecting a sandbox policy via --sandbox
The Rust CLI exposes a dedicated --sandbox (-s) flag that lets you pick the sandbox policy without having to reach for the generic -c/--config option:
# Run Codex with the default, read-only sandbox
codex --sandbox read-only
# Allow the agent to write within the current workspace while still blocking network access
codex --sandbox workspace-write
# Danger! Disable sandboxing entirely (only do this if you are already running in a container or other isolated env)
codex --sandbox danger-full-access
The same setting can be persisted in ~/.codex/config.toml via the top-level sandbox_mode = "MODE" key, e.g. sandbox_mode = "workspace-write".
In workspace-write, Codex also includes ~/.codex/memories in its writable roots so memory maintenance does not require an extra approval.
Code Organization
This folder is the root of a Cargo workspace. It contains quite a bit of experimental code, but here are the key crates:
core/contains the business logic for Codex. Ultimately, we hope this to be a library crate that is generally useful for building other Rust/native applications that use Codex.exec/"headless" CLI for use in automation.tui/CLI that launches a fullscreen TUI built with Ratatui.cli/CLI multitool that provides the aforementioned CLIs via subcommands.
If you want to contribute or inspect behavior in detail, start by reading the module-level README.md files under each crate and run the project workspace from the top-level codex-rs directory so shared config, features, and build scripts stay aligned.