Skip to content

Sync upstream/main into main#12

Merged
manoelcalixto merged 33 commits intomainfrom
sync/upstream-main-2026-04-13-r2
Apr 14, 2026
Merged

Sync upstream/main into main#12
manoelcalixto merged 33 commits intomainfrom
sync/upstream-main-2026-04-13-r2

Conversation

@manoelcalixto
Copy link
Copy Markdown
Collaborator

Summary

  • merge the current upstream/main from openai/codex into Electivus/codex:main
  • resolve fork-specific conflicts around background-process handling, realtime conversation flows, RMCP parallel-call tests, memories/config test paths, and exec-server test harness setup
  • keep the fork aligned with the newer AbsolutePathBuf and realtime/request-shape changes introduced upstream

Test Plan

  • just fmt
  • cargo test -p codex-core conversation_user_text_turn_is_capped_when_mirrored_to_realtime
  • cargo build -p codex-rmcp-client --bin test_stdio_server
  • cargo test -p codex-core stdio_mcp_parallel_tool_calls_default_false_runs_serially
  • cargo test -p codex-core stdio_mcp_parallel_tool_calls_opt_in_runs_concurrently
  • cargo test -p codex-app-server realtime_conversation_stop_emits_closed_notification
  • cargo test -p codex-app-server webrtc_v1_start_posts_offer_returns_sdp_and_joins_sideband
  • cargo test -p codex-exec-server exec_server_accepts_initialize

aibrahim-oai and others added 30 commits April 12, 2026 15:03
- Let typed user messages submit while realtime is active and mirror
accepted text into the realtime text stream.
- Add integration coverage and snapshot for outbound realtime text.
## Problem

The TUI had shell-style Up/Down history recall, but `Ctrl+R` did not
provide the reverse incremental search workflow users expect from
shells. Users needed a way to search older prompts without immediately
replacing the current draft, and the interaction needed to handle async
persistent history, repeated navigation keys, duplicate prompt text,
footer hints, and preview highlighting without making the main composer
file even harder to review.


https://github.com/user-attachments/assets/5165affd-4c9a-46e9-adbd-89088f5f7b6b

<img width="1227" height="722" alt="image"
src="https://github.com/user-attachments/assets/8bc83289-eeca-47c7-b0c3-8975101901af"
/>

## Mental model

`Ctrl+R` opens a temporary search session owned by the composer. The
footer line becomes the search input, the composer body previews the
current match only after the query has text, and `Enter` accepts that
preview as an editable draft while `Esc` restores the draft that existed
before search started. The history layer provides a combined offset
space over persistent and local history, but search navigation exposes
unique prompt text rather than every physical history row.

## Non-goals

This change does not rewrite stored history, change normal Up/Down
browsing semantics, add fuzzy matching, or add persistent metadata for
attachments in cross-session history. Search deduplication is
deliberately scoped to the active Ctrl+R search session and uses exact
prompt text, so case, whitespace, punctuation, and attachment-only
differences are not normalized.

## Tradeoffs

The implementation keeps search state in the existing composer and
history state machines instead of adding a new cross-module controller.
That keeps ownership local and testable, but it means the composer still
coordinates visible search status, draft restoration, footer rendering,
cursor placement, and match highlighting while `ChatComposerHistory`
owns traversal, async fetch continuation, boundary clamping, and
unique-result caching. Unique-result caching stores cloned
`HistoryEntry` values so known matches can be revisited without cache
lookups; this is simple and robust for interactive search sizes, but it
is not a global history index.

## Architecture

`ChatComposer` detects `Ctrl+R`, snapshots the current draft, switches
the footer to `FooterMode::HistorySearch`, and routes search-mode keys
before normal editing. Query edits call `ChatComposerHistory::search`
with `restart = true`, which starts from the newest combined-history
offset. Repeated `Ctrl+R` or Up searches older; Down searches newer
through already discovered unique matches or continues the scan.
Persistent history entries still arrive asynchronously through
`on_entry_response`, where a pending search either accepts the response,
skips a duplicate, or requests the next offset.

The composer-facing pieces now live in
`codex-rs/tui/src/bottom_pane/chat_composer/history_search.rs`, leaving
`chat_composer.rs` responsible for routing and rendering integration
instead of owning every search helper inline.
`codex-rs/tui/src/bottom_pane/chat_composer_history.rs` remains the
owner of stored history, combined offsets, async fetch state, boundary
semantics, and duplicate suppression. Match highlighting is computed
from the current composer text while search is active and disappears
when the match is accepted.

## Observability

There are no new logs or telemetry. The practical debug path is state
inspection: `ChatComposer.history_search` tells whether the footer query
is idle, searching, matched, or unmatched; `ChatComposerHistory.search`
tracks selected raw offsets, pending persistent fetches, exhausted
directions, and unique match cache state. If a user reports skipped or
repeated results, first inspect the exact stored prompt text, the
selected offset, whether an async persistent response is still pending,
and whether a query edit restarted the search session.

## Tests

The change is covered by focused `codex-tui` unit tests for opening
search without previewing the latest entry, accepting and canceling
search, no-match restoration, boundary clamping, footer hints,
case-insensitive highlighting, local duplicate skipping, and persistent
duplicate skipping through async responses. Snapshot coverage captures
the footer-mode visual changes. Local verification used `just fmt`,
`cargo test -p codex-tui history_search`, `cargo test -p codex-tui`, and
`just fix -p codex-tui`.
Addresses openai#17313

Problem: The visual context meter in the status line was confusing and
continued to draw negative feedback, and context reporting should remain
an explicit opt-in rather than part of the default footer.

Solution: Remove the visual meter, restore opt-in context remaining/used
percentage items that explicitly say "Context", keep existing
context-usage configs working as a hidden alias, and update the setup
text and snapshots.
Addresses openai#17498

Problem: The TUI derived /status instruction source paths from the local
client environment, which could show stale <none> output or incorrect
paths when connected to a remote app server.

Solution: Add an app-server v2 instructionSources snapshot to thread
start/resume/fork responses, default it to an empty list when older
servers omit it, and render TUI /status from that server-provided
session data.

Additional context: The app-server field is intentionally named
instructionSources rather than AGENTS.md-specific terminology because
the loaded instruction sources can include global instructions, project
AGENTS.md files, AGENTS.override.md, user-defined instruction files, and
future dynamic sources.
## Summary
Stop counting elicitation time towards mcp tool call time. There are
some tradeoffs here, but in general I don't think time spent waiting for
elicitations should count towards tool call time, or at least not
directly towards timeouts.

Elicitations are not exactly like exec_command escalation requests, but
I would argue it's ~roughly equivalent.

## Testing
- [x] Added unit tests
- [x] Tested locally
Include MCP wall time in the output so the model is aware of how long
it's calls are taking.
## Summary
- run exec-server filesystem RPCs requiring sandboxing through a
`codex-fs` arg0 helper over stdin/stdout
- keep direct local filesystem execution for `DangerFullAccess` and
external sandbox policies
- remove the standalone exec-server binary path in favor of top-level
arg0 dispatch/runtime paths
- add sandbox escape regression coverage for local and remote filesystem
paths

## Validation
- `just fmt`
- `git diff --check`
- remote devbox: `cd codex-rs && bazel test --bes_backend=
--bes_results_url= //codex-rs/exec-server:all` (6/6 passed)

---------

Co-authored-by: Codex <noreply@openai.com>
Problem: After openai#17294 switched exec-server tests to launch the top-level
`codex exec-server` command, parallel remote exec-process cases can
flake while waiting for the child server's listen URL or transport
shutdown.

Solution: Serialize remote exec-server-backed process tests and harden
the harness so spawned servers are killed on drop and shutdown waits for
the child process to exit.
To prevent the spammy: 
<img width="424" height="172" alt="Screenshot 2026-04-09 at 13 36 16"
src="https://github.com/user-attachments/assets/b5ece9e3-c561-422f-87ec-041e7bd6813d"
/>
## Summary
- add an exec-server `envPolicy` field; when present, the server starts
from its own process env and applies the shell environment policy there
- keep `env` as the exact environment for local/embedded starts, but
make it an overlay for remote unified-exec starts
- move the shell-environment-policy builder into `codex-config` so Core
and exec-server share the inherit/filter/set/include behavior
- overlay only runtime/sandbox/network deltas from Core onto the
exec-server-derived env

## Why
Remote unified exec was materializing the shell env inside Core and
forwarding the whole map to exec-server, so remote processes could
inherit the orchestrator machine's `HOME`, `PATH`, etc. This keeps the
base env on the executor while preserving Core-owned runtime additions
like `CODEX_THREAD_ID`, unified-exec defaults, network proxy env, and
sandbox marker env.

## Validation
- `just fmt`
- `git diff --check`
- `cargo test -p codex-exec-server --lib`
- `cargo test -p codex-core --lib unified_exec::process_manager::tests`
- `cargo test -p codex-core --lib exec_env::tests`
- `cargo test -p codex-core --lib exec_env_tests` (compile-only; filter
matched 0 tests)
- `cargo test -p codex-config --lib shell_environment` (compile-only;
filter matched 0 tests)
- `just bazel-lock-update`

## Known local validation issue
- `just bazel-lock-check` is not runnable in this checkout: it invokes
`./scripts/check-module-bazel-lock.sh`, which is missing.

---------

Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: pakrym-oai <pakrym@openai.com>
## Summary

When a `spawn_agent` call does a full-history fork, keep the parent's
effective agent type and model configuration instead of applying child
role/model overrides.

This is the minimal config-inheritance slice of openai#16055. Prompt-cache key
inheritance and MCP tool-surface stability are split into follow-up PRs.

## Design

- Reject `agent_type`, `model`, and `reasoning_effort` for v1
`fork_context` spawns.
- Reject `agent_type`, `model`, and `reasoning_effort` for v2
`fork_turns = "all"` spawns.
- Keep v2 partial-history forks (`fork_turns = "N"`) configurable;
requested model/reasoning overrides and role config still apply there.
- Keep non-forked spawn behavior unchanged.

## Tests

- `cargo +1.93.1 test -p codex-core spawn_agent_fork_context --lib`
- `cargo +1.93.1 test -p codex-core multi_agent_v2_spawn_fork_turns
--lib`
- `cargo +1.93.1 test -p codex-core
multi_agent_v2_spawn_partial_fork_turns_allows_agent_type_override
--lib`
Addresses openai#16255

Problem: Incomplete Responses streams could leave completed custom tool
outputs out of cleanup and retry prompts, making persisted history
inconsistent and retries stale.

Solution: Route stream and output-item errors through shared cleanup,
and rebuild retry prompts from fresh session history after the first
attempt.
Addresses openai#17252

Problem: Plan-mode clarification questionnaires used the generic
user-input notification type, so configs listening for plan-mode-prompt
did not fire when request_user_input waited for an answer.

Solution: Map request_user_input prompts to the plan-mode-prompt
notification and remove the obsolete user-input TUI notification
variant.
Addresses openai#17453

Problem: /status rate-limit reset timestamps can be truncated in narrow
layouts, leaving users with partial times or dates.

Solution: Let narrow rate-limit rows drop the fixed progress bar to
preserve the percent summary, and wrap reset timestamps onto
continuation lines instead of truncating them.
Addresses openai#17514

Problem: PR openai#16966 made the TUI render the deprecated context-compaction
notification, while v2 could also receive legacy unified-exec
interaction items alongside terminal-interaction notifications, causing
duplicate "Context compacted" and "Waited for background terminal"
messages.

Solution: Suppress deprecated context-compaction notifications and
legacy unified-exec interaction command items from the app-server v2
projection, and render canonical context-compaction items through the
existing TUI info-event path.
Problem: PR openai#17601 updated context-compaction replay to call a new
ChatWidget handler, but the handler was never implemented, breaking
codex-tui compilation on main.

Solution: Render context-compaction replay through the existing
info-message path, preserving the intended `Context compacted` UI marker
without adding a one-off handler.
Addresses openai#17593

Problem: A regression introduced in
openai#16492 made thread/start fail when
Codex could not persist trusted project state, which crashes startup for
users with read-only config.toml.

Solution: Treat trusted project persistence as best effort and keep the
current thread's config trusted in memory when writing config.toml
fails.
…7365)

## Summary

This updates the Windows elevated sandbox setup/refresh path to include
the legacy `compute_allow_paths(...).deny` protected children in the
same deny-write payload pipe added for split filesystem carveouts.

Concretely, elevated setup and elevated refresh now both build
deny-write payload paths from:

- explicit split-policy deny-write paths, preserving missing paths so
setup can materialize them before applying ACLs
- legacy `compute_allow_paths(...).deny`, which includes existing
`.git`, `.codex`, and `.agents` children under writable roots

This lets the elevated backend protect `.git` consistently with the
unelevated/restricted-token path, and removes the old janky hard-coded
`.codex` / `.agents` elevated setup helpers in favor of the shared
payload path.

## Root Cause

The landed split-carveout PR threaded a `deny_write_paths` pipe through
elevated setup/refresh, but the legacy workspace-write deny set from
`compute_allow_paths(...).deny` was not included in that payload. As a
result, elevated workspace-write did not apply the intended deny-write
ACLs for existing protected children like `<cwd>/.git`.

## Notes

The legacy protected children still only enter the deny set if they
already exist, because `compute_allow_paths` filters `.git`, `.codex`,
and `.agents` with `exists()`. Missing explicit split-policy deny paths
are preserved separately because setup intentionally materializes those
before applying ACLs.

## Validation

- `cargo fmt --check -p codex-windows-sandbox`
- `cargo test -p codex-windows-sandbox`
- `cargo build -p codex-cli -p codex-windows-sandbox --bins`
- Elevated `codex exec` smoke with `windows.sandbox='elevated'`: fresh
git repo, attempted append to `.git/config`, observed `Access is
denied`, marker not written, Deny ACE present on `.git`
- Unelevated `codex exec` smoke with `windows.sandbox='unelevated'`:
fresh git repo, attempted append to `.git/config`, observed `Access is
denied`, marker not written, Deny ACE present on `.git`
openai#17638)

- stop `list_tool_suggest_discoverable_plugins()` from reloading the
curated marketplace for each discoverable plugin
- reuse a direct plugin-detail loader against the already-resolved
marketplace entry


The trigger was to stop those logs spamming:
```
d=019d81cf-6f69-7230-98aa-74294ff2dc5a}:submission_dispatch{otel.name="op.dispatch.user_input" submission.id="019d86c8-0a8e-7013-b442-109aabbf75c9" codex.op="user_input"}:turn{otel.name="session_task.turn" thread.id=019d81cf-6f69-7230-98aa-74294ff2dc5a turn.id=019d86c8-0a8e-7013-b442-109aabbf75c9 model=gpt-5.4}: ignoring interface.defaultPrompt: prompt must be at most 128 characters path=/Users/jif/.codex/.tmp/plugins/plugins/life-science-research/.codex-plugin/plugin.json
2026-04-13T12:27:30.402Z WARN  [019d81cf-6f69-7230-98aa-74294ff2dc5a] codex_core::plugins::manifest - session_loop{thread_id=019d81cf-6f69-7230-98aa-74294ff2dc5a}:submission_dispatch{otel.name="op.dispatch.user_input" submission.id="019d86c8-0a8e-7013-b442-109aabbf75c9" codex.op="user_input"}:turn{otel.name="session_task.turn" thread.id=019d81cf-6f69-7230-98aa-74294ff2dc5a turn.id=019d86c8-0a8e-7013-b442-109aabbf75c9 model=gpt-5.4}: ignoring interface.defaultPrompt: prompt must be at most 128 characters path=/Users/jif/.codex/.tmp/plugins/plugins/build-ios-apps/.codex-plugin/plugin.json
2026-04-13T12:27:30.402Z WARN  [019d81cf-6f69-7230-98aa-74294ff2dc5a] codex_core::plugins::manifest - session_loop{thread_id=019d81cf-6f69-7230-98aa-74294ff2dc5a}:submission_dispatch{otel.name="op.dispatch.user_input" submission.id="019d86c8-0a8e-7013-b442-109aabbf75c9" codex.op="user_input"}:turn{otel.name="session_task.turn" thread.id=019d81cf-6f69-7230-98aa-74294ff2dc5a turn.id=019d86c8-0a8e-7013-b442-109aabbf75c9 model=gpt-5.4}: ignoring interface.defaultPrompt: prompt must be at most 128 characters path=/Users/jif/.codex/.tmp/plugins/plugins/life-science-research/.codex-plugin/plugin.json
2026-04-13T12:27:30.405Z WARN  [019d81cf-6f69-7230-98aa-74294ff2dc5a] codex_core::plugins::manifest - session_loop{thread_id=019d81cf-6f69-7230-98aa-74294ff2dc5a}:submission_dispatch{otel.name="op.dispatch.user_input" submission.id="019d86c8-0a8e-7013-b442-109aabbf75c9" codex.op="user_input"}:turn{otel.name="session_task.turn" thread.id=019d81cf-6f69-7230-98aa-74294ff2dc5a turn.id=019d86c8-0a8e-7013-b442-109aabbf75c9 model=gpt-5.4}: ignoring interface.defaultPrompt: prompt must be at most 128 characters path=/Users/jif/.codex/.tmp/plugins/plugins/build-ios-apps/.codex-plugin/plugin.json
2026-04-13T12:27:30.406Z WARN  [019d81cf-6f69-7230-98aa-74294ff2dc5a] codex_core::plugins::manifest - session_loop{thread_id=019d81cf-6f69-7230-98aa-74294ff2dc5a}:submission_dispatch{otel.name="op.dispatch.user_input" submission.id="019d86c8-0a8e-7013-b442-109aabbf75c9" codex.op="user_input"}:turn{otel.name="session_task.turn" thread.id=019d81cf-6f69-7230-98aa-74294ff2dc5a turn.id=019d86c8-0a8e-7013-b442-109aabbf75c9 model=gpt-5.4}: ignoring interface.defaultPrompt: prompt must be at most 128 characters path=/Users/jif/.codex/.tmp/plugins/plugins/life-science-research/.codex-plugin/plugin.json
2026-04-13T12:27:30.408Z WARN  [019d81cf-6f69-7230-98aa-74294ff2dc5a] codex_core::plugins::manifest - session_loop{thread_id=019d81cf-6f69-7230-98aa-74294ff2dc5a}:submission_dispatch{otel.name="op.dispatch.user_input" submission.id="019d86c8-0a8e-7013-b442-109aabbf75c9" codex.op="user_input"}:turn{otel.name="session_task.turn" thread.id=019d81cf-6f69-7230-98aa-74294ff2dc5a turn.id=019d86c8-0a8e-7013-b442-109aabbf75c9 model=gpt-5.4}: ignoring interface.defaultPrompt: prompt must be at most 128 characters path=/Users/jif/.codex/.tmp/plugins/plugins/build-ios-apps/.codex-plugin/plugin.json
```
…ai#17398)

Currently app-server may unload actively running threads once the last
connection disconnects, which is not expected.
Instead track when was the last active turn & when there were any
subscribers the last time, also add 30 minute idleness/no subscribers
timer to reduce the churn.
Windows gives an error when you combine `protocol = ANY` with
`SetRemotePorts`
This fixes that
The recent release broke, codex suggested this as the fix

Source failure:
https://github.com/openai/codex/actions/runs/24362949066/job/71147202092

Probably from
openai@ac82443

For why it got in:
```
The relevant setup:

.github/workflows/rust-ci.yml (line 1) runs on PRs, but for codex-rs it only does:

cargo fmt --check
cargo shear
argument-comment lint via Bazel
no cargo check, no cargo clippy over the workspace, no cargo test over codex-tui
.github/workflows/rust-ci-full.yml (line 1) runs on pushes to main and branches matching **full-ci**. That one does compile TUI because:

codex-rs/Cargo.toml includes "tui" as a workspace member
lint_build runs cargo clippy --target ... --tests --profile ...
the matrix includes both dev and release profiles
tests runs cargo nextest run ..., but only dev-profile tests
Release CI also compiles it indirectly. .github/workflows/rust-release.yml (line 235) builds --bin codex, and cli/Cargo.toml (line 46) depends on codex-tui.
```

Codex tested locally with `cargo check -p codex-tui --release` and was
able to repro, and verified that this fixed it
### Motivation
- Switch the default model used for memory Phase 2 (consolidation) to
the newer `gpt-5.4` model.

### Description
- Change the Phase 2 model constant from `"gpt-5.3-codex"` to
`"gpt-5.4"` in `codex-rs/core/src/memories/mod.rs`.

### Testing
- Ran `just fmt`, which completed successfully.
- Attempted `cargo test -p codex-core`, but the build failed in this
environment because the `codex-linux-sandbox` crate requires the system
`libcap` pkg-config entry and the required system packages could not be
installed, so the test run was blocked.

------
[Codex
Task](https://chatgpt.com/codex/cloud/tasks/task_i_69d977693b48832a967e78d73c66dc8e)
# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.
Cap mirrored user text sent to realtime with the existing 300-token turn
budget while preserving the full model turn.

Adds integration coverage for capped realtime mirror payloads.

---------

Co-authored-by: Codex <noreply@openai.com>
aibrahim-oai and others added 3 commits April 13, 2026 14:31
# External (non-OpenAI) Pull Request Requirements

Before opening this Pull Request, please read the dedicated
"Contributing" markdown file or your PR may be closed:
https://github.com/openai/codex/blob/main/docs/contributing.md

If your PR conforms to our contribution guidelines, replace this text
with a detailed and high quality description of your changes.

Include a link to a bug report or enhancement request.
## Why

For more advanced MCP usage, we want the model to be able to emit
parallel MCP tool calls and have Codex execute eligible ones
concurrently, instead of forcing all MCP calls through the serial block.

The main design choice was where to thread the config. I made this
server-level because parallel safety depends on the MCP server
implementation. Codex reads the flag from `mcp_servers`, threads the
opted-in server names into `ToolRouter`, and checks the parsed
`ToolPayload::Mcp { server, .. }` at execution time. That avoids relying
on model-visible tool names, which can be incomplete in
deferred/search-tool paths or ambiguous for similarly named
servers/tools.

## What was added

Added `supports_parallel_tool_calls` for MCP servers.

Before:

```toml
[mcp_servers.docs]
command = "docs-server"
```

After:

```toml
[mcp_servers.docs]
command = "docs-server"
supports_parallel_tool_calls = true
```

MCP calls remain serial by default. Only tools from opted-in servers are
eligible to run in parallel. Docs also now warn to enable this only when
the server’s tools are safe to run concurrently, especially around
shared state or read/write races.

## Testing

Tested with a local stdio MCP server exposing real delay tools. The
model/Responses side was mocked only to deterministically emit two MCP
calls in the same turn.

Each test called `query_with_delay` and `query_with_delay_2` with `{
"seconds": 25 }`.

| Build/config | Observed | Wall time |
| --- | --- | --- |
| main with flag enabled | serial | `58.79s` |
| PR with flag enabled | parallel | `31.73s` |
| PR without flag | serial | `56.70s` |

PR with flag enabled showed both tools start before either completed;
main and PR-without-flag completed the first delay before starting the
second.

Also added an integration test.

Additional checks:

- `cargo test -p codex-tools` passed
- `cargo test -p codex-core
mcp_parallel_support_uses_exact_payload_server` passed
- `git diff --check` passed
# Conflicts:
#	codex-rs/app-server/tests/suite/v2/realtime_conversation.rs
#	codex-rs/core/src/codex.rs
#	codex-rs/core/src/codex_tests.rs
#	codex-rs/core/src/memories/mod.rs
#	codex-rs/core/src/memories/tests.rs
#	codex-rs/core/src/project_doc.rs
#	codex-rs/core/src/unified_exec/process_manager.rs
#	codex-rs/core/tests/suite/realtime_conversation.rs
#	codex-rs/core/tests/suite/rmcp_client.rs
#	codex-rs/exec-server/tests/common/exec_server.rs
Copilot AI review requested due to automatic review settings April 13, 2026 23:28
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Syncs upstream/main into the fork and resolves conflicts by aligning fork-specific behavior with upstream changes (notably AbsolutePathBuf, realtime request shaping, MCP parallel-call support, and app-server thread lifecycle semantics).

Changes:

  • Add supports_parallel_tool_calls to MCP server config and route parallel eligibility via exact MCP payload server name.
  • Migrate many CODEX_HOME / skills paths to AbsolutePathBuf and update related tests + schemas.
  • Update app-server behavior around thread unsubscribe/idle unload and add experimental thread/memoryMode/set.

Reviewed changes

Copilot reviewed 142 out of 144 changed files in this pull request and generated no comments.

Show a summary per file
File Description
docs/config.md Document MCP parallel tool-call opt-in (supports_parallel_tool_calls).
codex-rs/windows-sandbox-rs/src/workspace_acl.rs Remove legacy workspace .codex/.agents ACL helpers; keep is_command_cwd_root.
codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs Merge explicit deny-write paths with computed protected children; add test.
codex-rs/windows-sandbox-rs/src/setup_main_win.rs Treat deny-write carveouts uniformly; remove best-effort .codex/.agents protection step.
codex-rs/windows-sandbox-rs/src/lib.rs Stop re-exporting removed workspace ACL helpers; stop calling them in impl.
codex-rs/windows-sandbox-rs/src/firewall.rs Refactor firewall rule network-scope configuration + add COM acceptance test.
codex-rs/utils/home-dir/src/lib.rs Return AbsolutePathBuf from find_codex_home; adjust tests.
codex-rs/utils/home-dir/Cargo.toml Add dependency on codex-utils-absolute-path.
codex-rs/utils/absolute-path/src/lib.rs Add ordering traits + helpers (from_absolute_path_checked, canonicalize, ancestors, test_path_buf) and tests.
codex-rs/tui/src/updates.rs Adapt CODEX_HOME path join to AbsolutePathBuf conversions.
codex-rs/tui/src/test_support.rs Centralize platform-absolute test paths via test_path_buf.
codex-rs/tui/src/status/tests.rs Normalize status tests to use platform-absolute test paths.
codex-rs/tui/src/status/card.rs Improve narrow-terminal rendering: keep percentage visible and wrap reset timestamp.
codex-rs/tui/src/onboarding/onboarding_screen.rs Convert codex_home handling from clone to to_path_buf().
codex-rs/tui/src/lib.rs Convert codex_home to PathBuf at API boundaries; map find_codex_home output.
codex-rs/tui/src/history_cell.rs Pass codex_home to plugin manager as PathBuf; update tests to platform paths.
codex-rs/tui/src/chatwidget/tests/plan_mode.rs Align notifications tests to new Plan Mode prompt notification shape.
codex-rs/tui/src/chatwidget/tests/permissions.rs Use platform-absolute test paths for workspace-write roots.
codex-rs/tui/src/chatwidget/tests/history_replay.rs Update tests for AbsolutePathBuf codex_home and platform-absolute paths.
codex-rs/tui/src/chatwidget/tests/helpers.rs Set config.codex_home as absolute; fix skill path construction.
codex-rs/tui/src/chatwidget/tests/composer_submission.rs Use AbsolutePathBuf in skill path tests; adjust assertions.
codex-rs/tui/src/chatwidget/tests.rs Re-export test_path_buf for chatwidget tests.
codex-rs/tui/src/chatwidget/skills.rs Represent skill paths as AbsolutePathBuf; remove canonicalization helper.
codex-rs/tui/src/chatwidget.rs Store skill initial state by AbsolutePathBuf; rework user-input notification to PlanModePrompt; suppress deprecated context-compacted event handling for v2.
codex-rs/tui/src/bottom_pane/skills_toggle_view.rs Switch skill toggle items to AbsolutePathBuf; update tests.
codex-rs/tui/src/bottom_pane/mod.rs Update tests to use platform-absolute skill paths.
codex-rs/tui/src/bottom_pane/chat_composer.rs Use platform-absolute skill paths in mention-item tests.
codex-rs/tui/src/app_event.rs Change SetSkillEnabled.path to AbsolutePathBuf.
codex-rs/skills/src/lib.rs Require absolute CODEX_HOME for system skills cache operations.
codex-rs/rmcp-client/src/oauth.rs Use AbsolutePathBuf.join(...).to_path_buf() for fallback file.
codex-rs/rmcp-client/src/bin/test_stdio_server.rs Add sync tool for deterministic concurrency tests (barrier + sleeps).
codex-rs/protocol/src/protocol.rs Add Op::SetThreadMemoryMode and ThreadMemoryMode; skill metadata path becomes AbsolutePathBuf.
codex-rs/plugin/src/load_outcome.rs Represent plugin skill roots/disabled paths as AbsolutePathBuf.
codex-rs/network-proxy/src/certs.rs Convert managed CA paths from AbsolutePathBuf to PathBuf where needed.
codex-rs/exec/src/lib.rs Convert codex_home to PathBuf for auth/cloud requirements APIs.
codex-rs/exec-server/tests/common/exec_server.rs Run exec-server tests with isolated CODEX_HOME tempdir.
codex-rs/core/tests/suite/truncation.rs Update MCP server config fixtures to include supports_parallel_tool_calls.
codex-rs/core/tests/suite/subagent_notifications.rs Adapt role config file fields to PathBuf conversion.
codex-rs/core/tests/suite/sqlite_state.rs Adjust rollout path comparisons for AbsolutePathBuf conversions; add MCP server flag.
codex-rs/core/tests/suite/snapshots/all__suite__realtime_conversation__conversation_user_text_turn_is_capped_when_mirrored_to_realtime.snap New snapshot for capped realtime-mirrored user text.
codex-rs/core/tests/suite/skills.rs Make skills test robust to path canonicalization differences (match by name).
codex-rs/core/tests/suite/search_tool.rs Update MCP server config fixture with supports_parallel_tool_calls.
codex-rs/core/tests/suite/realtime_conversation.rs Add test verifying realtime-mirrored user text is capped while model request preserves full text.
codex-rs/core/tests/suite/code_mode.rs Update MCP server config fixture with supports_parallel_tool_calls.
codex-rs/core/tests/common/test_codex.rs Convert codex_home to PathBuf when building thread manager for tests.
codex-rs/core/src/tools/spec_tests.rs Initialize new ToolRouterParams.parallel_mcp_server_names.
codex-rs/core/src/tools/router_tests.rs Update tests for new tool_supports_parallel(&ToolCall) API and MCP server-name exact match semantics.
codex-rs/core/src/tools/router.rs Track parallel MCP eligibility by exact MCP payload server name; update API accordingly.
codex-rs/core/src/tools/parallel.rs Use new router API when deciding parallel scheduling.
codex-rs/core/src/tools/js_repl/mod.rs Ensure JS REPL nested routing disables parallel scheduling.
codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs Reject model/role overrides for full-history forks; preserve inherited settings.
codex-rs/core/src/tools/handlers/multi_agents_common.rs Apply default reasoning level fallback; add helper to reject full-fork overrides.
codex-rs/core/src/tools/handlers/multi_agents/spawn.rs Enforce no overrides when using fork_context/full-history behavior.
codex-rs/core/src/tools/code_mode/mod.rs Propagate configured parallel MCP servers to nested tool router.
codex-rs/core/src/thread_manager_tests.rs Update tests for AbsolutePathBuf CODEX_HOME and required conversions.
codex-rs/core/src/thread_manager.rs Convert plugin/models managers to accept PathBuf; normalize skills CODEX_HOME to AbsolutePathBuf in tests.
codex-rs/core/src/skills_watcher.rs Convert skill root paths to PathBuf watch paths.
codex-rs/core/src/skills.rs Use AbsolutePathBuf for CWD + effective skill roots; convert skill invocation path to PathBuf at boundary.
codex-rs/core/src/realtime_context.rs Extract realtime turn token budget constant; factor truncation loop into helper.
codex-rs/core/src/prompt_debug.rs Use AbsolutePathBuf for codex_home in tests.
codex-rs/core/src/project_doc_tests.rs Convert codex_home to PathBuf for helper APIs.
codex-rs/core/src/project_doc.rs Simplify project-root resolution using AbsolutePathBuf joins/clones.
codex-rs/core/src/plugins/manager_tests.rs Update plugin skill roots and MCP server config fixtures for new types/flags.
codex-rs/core/src/plugins/discoverable_tests.rs Add regression test ensuring curated marketplace isn’t reloaded per plugin; wire tracing capture.
codex-rs/core/src/plugins/discoverable.rs Switch curated plugin reading API to avoid per-plugin reload; convert codex_home to PathBuf.
codex-rs/core/src/otel_init.rs Convert codex_home to PathBuf for otel settings.
codex-rs/core/src/message_history.rs Build history file path via AbsolutePathBuf.join(...).to_path_buf().
codex-rs/core/src/memories/tests.rs Update tests for AbsolutePathBuf codex_home/cwd and rollout path conversions.
codex-rs/core/src/memories/prompts_tests.rs Remove consolidation prompt tests that no longer match updated prompt behavior.
codex-rs/core/src/mcp_tool_call_tests.rs Convert codex_home to PathBuf when building models manager.
codex-rs/core/src/mcp_tool_call.rs Convert config folder path to PathBuf for config edits builder.
codex-rs/core/src/mcp_skill_dependencies.rs Add supports_parallel_tool_calls to derived MCP server configs.
codex-rs/core/src/guardian/tests.rs Use platform-absolute helper paths; convert codex_home for models manager.
codex-rs/core/src/connectors.rs Convert codex_home to PathBuf at plugin/mcp manager boundaries.
codex-rs/core/src/config/permissions_tests.rs Update signature usage to pass AbsolutePathBuf CODEX_HOME.
codex-rs/core/src/config/mod.rs Make Config.codex_home an AbsolutePathBuf; adjust loaders and API adapters accordingly.
codex-rs/core/src/config/edit_tests.rs Add/round-trip supports_parallel_tool_calls in MCP server serialization tests.
codex-rs/core/src/config/edit.rs Serialize supports_parallel_tool_calls when true.
codex-rs/core/src/codex_thread.rs Add set_thread_memory_mode wrapper method.
codex-rs/core/src/codex_tests_guardian.rs Convert codex_home to PathBuf for models/plugins managers.
codex-rs/core/src/codex_tests.rs Thread manager/router construction updated for new path types and router params.
codex-rs/core/src/agent/role_tests.rs Update SkillsManager construction to accept AbsolutePathBuf.
codex-rs/core/src/agent/control_tests.rs Convert codex_home to PathBuf for thread manager tests.
codex-rs/core/config.schema.json Add supports_parallel_tool_calls to MCP server schema.
codex-rs/core-skills/src/system.rs Require absolute CODEX_HOME for uninstall path computation.
codex-rs/core-skills/src/model.rs Use AbsolutePathBuf for skill paths and disabled sets/indexes.
codex-rs/core-skills/src/mention_counts.rs Use AbsolutePathBuf for disabled-path set.
codex-rs/core-skills/src/manager.rs Use AbsolutePathBuf for cwd, roots, caches; canonicalize via AbsolutePathBuf::canonicalize.
codex-rs/core-skills/src/loader_tests.rs Update tests to use AbsolutePathBuf and platform-absolute test helpers.
codex-rs/core-skills/src/loader.rs Use AbsolutePathBuf throughout root discovery, project-root detection, and parse resolution.
codex-rs/core-skills/src/invocation_utils_tests.rs Update implicit invocation tests to AbsolutePathBuf + platform-absolute helpers.
codex-rs/core-skills/src/invocation_utils.rs Use AbsolutePathBuf for canonicalization/joins and implicit invocation detection.
codex-rs/core-skills/src/injection_tests.rs Update explicit mention tests to AbsolutePathBuf and platform-absolute display.
codex-rs/core-skills/src/injection.rs Track disabled/seen skill paths as AbsolutePathBuf; convert to PathBuf at invocation boundary.
codex-rs/core-skills/src/config_rules.rs Store rule selectors as AbsolutePathBuf; resolve disabled paths accordingly.
codex-rs/config/src/mcp_types_tests.rs Add (de)serialization tests for supports_parallel_tool_calls.
codex-rs/config/src/mcp_types.rs Add supports_parallel_tool_calls to MCP server config and raw config.
codex-rs/config/src/mcp_edit_tests.rs Ensure supports_parallel_tool_calls is serialized in edits output.
codex-rs/config/src/mcp_edit.rs Serialize supports_parallel_tool_calls when true.
codex-rs/codex-mcp/src/mcp_connection_manager_tests.rs Update MCP config fixtures with supports_parallel_tool_calls.
codex-rs/codex-mcp/src/mcp/skill_dependencies_tests.rs Update skill path and MCP config fixtures for new types/flags.
codex-rs/codex-mcp/src/mcp/skill_dependencies.rs Update derived MCP server configs with supports_parallel_tool_calls.
codex-rs/codex-mcp/src/mcp/mod_tests.rs Update effective server fixtures with supports_parallel_tool_calls.
codex-rs/codex-mcp/src/mcp/mod.rs Ensure Codex Apps MCP server sets supports_parallel_tool_calls: false.
codex-rs/codex-mcp/Cargo.toml Add dev-dependency on codex-utils-absolute-path.
codex-rs/codex-api/src/endpoint/realtime_websocket/methods_v2.rs Strengthen background agent tool description to preserve user wording.
codex-rs/cloud-tasks/src/util.rs Convert codex_home to PathBuf for AuthManager creation.
codex-rs/cli/src/mcp_cmd.rs Default new MCP servers to supports_parallel_tool_calls: false; convert codex_home for plugin manager.
codex-rs/cli/src/login.rs Convert codex_home to PathBuf for login flows.
codex-rs/chatgpt/src/connectors.rs Convert codex_home to PathBuf at auth/plugins boundaries.
codex-rs/app-server/tests/suite/v2/thread_unsubscribe.rs Update expectations: unsubscribe does not unload immediately; adjust status behaviors.
codex-rs/app-server/tests/suite/v2/thread_memory_mode_set.rs Add tests for experimental thread memory mode setter (loaded + stored).
codex-rs/app-server/tests/suite/v2/skills_list.rs Add test ensuring relative CWDs are accepted for skills list requests.
codex-rs/app-server/tests/suite/v2/realtime_conversation.rs Update expected background agent tool description in WebRTC start test.
codex-rs/app-server/tests/suite/v2/mod.rs Register new thread memory mode set test module.
codex-rs/app-server/tests/suite/v2/experimental_api.rs Ensure thread/memoryMode/set requires experimental capability.
codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs Update expectation: disconnect does not immediately unload last thread.
codex-rs/app-server/tests/common/mcp_process.rs Add helper to send thread/memoryMode/set request.
codex-rs/app-server/src/thread_status.rs Add per-thread watch subscriptions and watcher updates; add unit test.
codex-rs/app-server/src/thread_state.rs Track “has connections” via watch channel; expose subscription API for unload logic.
codex-rs/app-server/src/message_processor.rs Convert codex_home to PathBuf for config/external-agent APIs; simplify initialize response codex_home handling.
codex-rs/app-server/src/lib.rs Convert codex_home to PathBuf when calling cloud requirements loader.
codex-rs/app-server/src/bespoke_event_handling.rs Suppress deprecated events/items for v2 clients to avoid duplicates; update tests config plumbing.
codex-rs/app-server/README.md Document new thread/memoryMode/set and updated unsubscribe idle-unload behavior.
codex-rs/app-server-protocol/src/protocol/v2.rs Add ThreadMemoryMode types + request/response; change skill paths to AbsolutePathBuf.
codex-rs/app-server-protocol/src/protocol/common.rs Register experimental thread/memoryMode/set request.
codex-rs/app-server-protocol/schema/typescript/v2/SkillSummary.ts Update skill path type to AbsolutePathBuf.
codex-rs/app-server-protocol/schema/typescript/v2/SkillMetadata.ts Update skill path type to AbsolutePathBuf.
codex-rs/app-server-protocol/schema/typescript/index.ts Export ThreadMemoryMode.
codex-rs/app-server-protocol/schema/typescript/ThreadMemoryMode.ts Add generated TS type for thread memory mode.
codex-rs/app-server-protocol/schema/json/v2/SkillsListResponse.json Update skill path schema ref to AbsolutePathBuf.
codex-rs/app-server-protocol/schema/json/v2/PluginReadResponse.json Update skill path schema ref to AbsolutePathBuf.
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json Add ThreadMemoryMode + update skill path schemas to AbsolutePathBuf.
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json Add ThreadMemoryMode + update skill path schemas to AbsolutePathBuf.
codex-rs/app-server-protocol/schema/json/ClientRequest.json Add ThreadMemoryMode schema.
codex-rs/Cargo.lock Add lockfile entries for new absolute-path dependency edges.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@manoelcalixto manoelcalixto merged commit 99353e0 into main Apr 14, 2026
24 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.