support plugin/list.

plugin: support local-based marketplace.json + install endpoint. (#13422 )
Support marketplace.json that points to a local file, with ``` "source": { "source": "local", "path": "./plugin-1" }, ``` Add a new plugin/install endpoint which add the plugin to the cache folder and enable it in config.toml.
2026-03-05 06:03:20 +00:00 · 2026-03-04 23:56:02 -05:00 · 2026-03-04 19:08:18 -05:00 · 2026-03-04 15:37:31 -08:00 · 2026-03-04 14:10:54 -08:00 · 2026-03-04 15:08:57 -07:00
384 changed files with 35789 additions and 33524 deletions
--- a/.bazelrc
+++ b/.bazelrc
@@ -18,7 +18,7 @@ common --enable_platform_specific_config
 common:linux --host_platform=//:local_linux
 common:windows --host_platform=//:local_windows
 common --@rules_cc//cc/toolchains/args/archiver_flags:use_libtool_on_macos=False
-common --@toolchains_llvm_bootstrapped//config:experimental_stub_libgcc_s
+common --@llvm//config:experimental_stub_libgcc_s

 # We need to use the sh toolchain on windows so we don't send host bash paths to the linux executor.
 common:windows --@rules_rust//rust/settings:experimental_use_sh_toolchain_for_bootstrap_process_wrapper
--- a/.github/workflows/issue-deduplicator.yml
+++ b/.github/workflows/issue-deduplicator.yml
@@ -335,7 +335,7 @@ jobs:
  comment-on-issue:
    name: Comment with potential duplicates
    needs: select-final
-    if: ${{ needs.select-final.result != 'skipped' }}
+    if: ${{ always() && needs.select-final.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -57,7 +57,9 @@ jobs:
      run:
        working-directory: codex-rs
    env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
+      # 2026-03-04: temporarily change releases to use thin LTO because
+      # Ubuntu ARM is timing out at 60 minutes.
+      CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'thin' }}

    strategy:
      fail-fast: false
@@ -211,6 +213,7 @@ jobs:
      - name: Cargo build
        shell: bash
        run: |
+          echo "CARGO_PROFILE_RELEASE_LTO: ${CARGO_PROFILE_RELEASE_LTO}"
          cargo build --target ${{ matrix.target }} --release --timings --bin codex --bin codex-responses-api-proxy

      - name: Upload Cargo timings
@@ -494,9 +497,10 @@ jobs:
            --package codex-responses-api-proxy \
            --package codex-sdk

-      - name: Stage macOS and Linux installer script
+      - name: Stage installer scripts
        run: |
          cp scripts/install/install.sh dist/install.sh
+          cp scripts/install/install.ps1 dist/install.ps1

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,7 +1,7 @@
 {
    "rust-analyzer.checkOnSave": true,
    "rust-analyzer.check.command": "clippy",
-    "rust-analyzer.check.extraArgs": ["--all-features", "--tests"],
+    "rust-analyzer.check.extraArgs": ["--tests"],
    "rust-analyzer.rustfmt.extraArgs": ["--config", "imports_granularity=Item"],
    "rust-analyzer.cargo.targetDir": "${workspaceFolder}/codex-rs/target/rust-analyzer",
    "[rust]": {
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -1,11 +1,4 @@
 load("@apple_support//xcode:xcode_config.bzl", "xcode_config")
-load("@rules_cc//cc:defs.bzl", "cc_shared_library")
-
-cc_shared_library(
-    name = "clang",
-    deps = ["@llvm-project//clang:libclang"],
-    visibility = ["//visibility:public"],
-)

 xcode_config(name = "disable_xcode")

@@ -16,7 +9,7 @@ platform(
    name = "local_linux",
    constraint_values = [
        # We mark the local platform as glibc-compatible because musl-built rust cannot dlopen proc macros.
-        "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
+        "@llvm//constraints/libc:gnu.2.28",
    ],
    parents = ["@platforms//host"],
 )
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,18 +1,18 @@
 module(name = "codex")

 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "toolchains_llvm_bootstrapped", version = "0.5.6")
+bazel_dep(name = "llvm", version = "0.6.1")
 single_version_override(
-    module_name = "toolchains_llvm_bootstrapped",
+    module_name = "llvm",
    patch_strip = 1,
    patches = [
        "//patches:toolchains_llvm_bootstrapped_resource_dir.patch",
    ],
 )

-register_toolchains("@toolchains_llvm_bootstrapped//toolchain:all")
+register_toolchains("@llvm//toolchain:all")

-osx = use_extension("@toolchains_llvm_bootstrapped//extensions:osx.bzl", "osx")
+osx = use_extension("@llvm//extensions:osx.bzl", "osx")
 osx.framework(name = "ApplicationServices")
 osx.framework(name = "AppKit")
 osx.framework(name = "ColorSync")
@@ -33,21 +33,13 @@ osx.framework(name = "Kernel")
 osx.framework(name = "OSLog")
 osx.framework(name = "Security")
 osx.framework(name = "SystemConfiguration")
-use_repo(osx, "macosx15.4.sdk")
+use_repo(osx, "macos_sdk")

 # Needed to disable xcode...
 bazel_dep(name = "apple_support", version = "2.1.0")
 bazel_dep(name = "rules_cc", version = "0.2.16")
 bazel_dep(name = "rules_platform", version = "0.1.0")
-bazel_dep(name = "rules_rs", version = "0.0.23")
-
-# Special toolchains branch
-archive_override(
-    module_name = "rules_rs",
-    integrity = "sha256-O34UF4H7b1Qacu3vlu2Od4ILGVApzg5j1zl952SFL3w=",
-    strip_prefix = "rules_rs-097123c2aa72672e371e69e7035869f5a45c7b2b",
-    url = "https://github.com/dzbarsky/rules_rs/archive/097123c2aa72672e371e69e7035869f5a45c7b2b.tar.gz",
-)
+bazel_dep(name = "rules_rs", version = "0.0.40")

 rules_rust = use_extension("@rules_rs//rs/experimental:rules_rust.bzl", "rules_rust")
 use_repo(rules_rust, "rules_rust")
@@ -57,13 +49,9 @@ toolchains.toolchain(
    edition = "2024",
    version = "1.93.0",
 )
-use_repo(
-    toolchains,
-    "experimental_rust_toolchains_1_93_0",
-    "rust_toolchain_artifacts_macos_aarch64_1_93_0",
-)
+use_repo(toolchains, "default_rust_toolchains")

-register_toolchains("@experimental_rust_toolchains_1_93_0//:all")
+register_toolchains("@default_rust_toolchains//:all")

 crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
 crate.from_cargo(
@@ -79,6 +67,7 @@ crate.from_cargo(
        "x86_64-apple-darwin",
        "x86_64-pc-windows-gnullvm",
    ],
+    use_experimental_platforms = True,
 )

 bazel_dep(name = "zstd", version = "1.5.7")
@@ -139,11 +128,9 @@ crate.annotation(
        "OPENSSL_NO_VENDOR": "1",
        "OPENSSL_STATIC": "1",
    },
-    crate_features = [
-        "dep:openssl-src",
-    ],
    crate = "openssl-sys",
    data = ["@openssl//:gen_dir"],
+    gen_build_script = "on",
 )

 inject_repo(crate, "openssl")
@@ -153,27 +140,28 @@ crate.annotation(
    workspace_cargo_toml = "rust/runfiles/Cargo.toml",
 )

-llvm = use_extension("@toolchains_llvm_bootstrapped//extensions:llvm.bzl", "llvm")
+llvm = use_extension("@llvm//extensions:llvm.bzl", "llvm")
 use_repo(llvm, "llvm-project")

 crate.annotation(
    # Provide the hermetic SDK path so the build script doesn't try to invoke an unhermetic `xcrun --show-sdk-path`.
    build_script_data = [
-        "@macosx15.4.sdk//sysroot",
+        "@macos_sdk//sysroot",
    ],
    build_script_env = {
-        "BINDGEN_EXTRA_CLANG_ARGS": "-isystem $(location @toolchains_llvm_bootstrapped//:builtin_headers)",
-        "COREAUDIO_SDK_PATH": "$(location @macosx15.4.sdk//sysroot)",
-        "LIBCLANG_PATH": "$(location @codex//:clang)",
+        "BINDGEN_EXTRA_CLANG_ARGS": "-isystem $(location @llvm//:builtin_headers)",
+        "COREAUDIO_SDK_PATH": "$(location @macos_sdk//sysroot)",
+        "LIBCLANG_PATH": "$(location @llvm-project//clang:libclang_interface_output)",
    },
    build_script_tools = [
-        "@codex//:clang",
-        "@toolchains_llvm_bootstrapped//:builtin_headers",
+        "@llvm-project//clang:libclang_interface_output",
+        "@llvm//:builtin_headers",
    ],
    crate = "coreaudio-sys",
+    gen_build_script = "on",
 )

-inject_repo(crate, "codex", "toolchains_llvm_bootstrapped", "macosx15.4.sdk")
+inject_repo(crate, "llvm", "llvm-project", "macos_sdk")

 # Fix readme inclusions
 crate.annotation(
@@ -184,28 +172,6 @@ crate.annotation(
    ],
 )

-WINDOWS_IMPORT_LIB = """
-load("@rules_cc//cc:defs.bzl", "cc_import")
-
-cc_import(
-    name = "windows_import_lib",
-    static_library = glob(["lib/*.a"])[0],
-)
-"""
-
-crate.annotation(
-    additive_build_file_content = WINDOWS_IMPORT_LIB,
-    crate = "windows_x86_64_gnullvm",
-    gen_build_script = "off",
-    deps = [":windows_import_lib"],
-)
-crate.annotation(
-    additive_build_file_content = WINDOWS_IMPORT_LIB,
-    crate = "windows_aarch64_gnullvm",
-    gen_build_script = "off",
-    deps = [":windows_import_lib"],
-)
-
 bazel_dep(name = "alsa_lib", version = "1.2.9.bcr.4")

 crate.annotation(
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -33,8 +33,6 @@ members = [
    "mcp-server",
    "network-proxy",
    "ollama",
-    "artifact-presentation",
-    "artifact-spreadsheet",
    "process-hardening",
    "protocol",
    "rmcp-client",
@@ -66,6 +64,8 @@ members = [
    "state",
    "codex-experimental-api-macros",
    "test-macros",
+    "package-manager",
+    "artifacts",
 ]
 resolver = "2"

@@ -83,6 +83,8 @@ license = "Apache-2.0"
 app_test_support = { path = "app-server/tests/common" }
 codex-ansi-escape = { path = "ansi-escape" }
 codex-api = { path = "codex-api" }
+codex-artifacts = { path = "artifacts" }
+codex-package-manager = { path = "package-manager" }
 codex-app-server = { path = "app-server" }
 codex-app-server-protocol = { path = "app-server-protocol" }
 codex-app-server-test-client = { path = "app-server-test-client" }
@@ -111,8 +113,6 @@ codex-mcp-server = { path = "mcp-server" }
 codex-network-proxy = { path = "network-proxy" }
 codex-ollama = { path = "ollama" }
 codex-otel = { path = "otel" }
-codex-artifact-presentation = { path = "artifact-presentation" }
-codex-artifact-spreadsheet = { path = "artifact-spreadsheet" }
 codex-process-hardening = { path = "process-hardening" }
 codex-protocol = { path = "protocol" }
 codex-responses-api-proxy = { path = "responses-api-proxy" }
@@ -181,6 +181,7 @@ encoding_rs = "0.8.35"
 env-flags = "0.1.1"
 env_logger = "0.11.9"
 eventsource-stream = "0.2.3"
+flate2 = "1.1.4"
 futures = { version = "0.3", default-features = false }
 gethostname = "1.1.0"
 globset = "0.4"
@@ -219,7 +220,6 @@ owo-colors = "4.3.0"
 path-absolutize = "3.1.1"
 pathdiff = "0.2"
 portable-pty = "0.9.0"
-ppt-rs = "0.2.6"
 predicates = "3"
 pretty_assertions = "1.4.1"
 pulldown-cmark = "0.10"
@@ -267,6 +267,7 @@ supports-color = "3.0.2"
 syntect = "5"
 sys-locale = "0.3.2"
 tempfile = "3.23.0"
+tar = "0.4.44"
 test-log = "0.2.19"
 textwrap = "0.16.2"
 thiserror = "2.0.17"
@@ -353,8 +354,7 @@ ignored = [
    "icu_provider",
    "openssl-sys",
    "codex-utils-readiness",
-    "codex-secrets",
-    "codex-artifact-spreadsheet"
+    "codex-secrets"
 ]

 [profile.release]
--- a/codex-rs/README.md
+++ b/codex-rs/README.md
@@ -88,6 +88,7 @@ codex --sandbox danger-full-access
 ```

 The same setting can be persisted in `~/.codex/config.toml` via the top-level `sandbox_mode = "MODE"` key, e.g. `sandbox_mode = "workspace-write"`.
+In `workspace-write`, Codex also includes `~/.codex/memories` in its writable roots so memory maintenance does not require an extra approval.

 ## Code Organization

--- a/codex-rs/app-server-protocol/schema/json/ClientRequest.json
+++ b/codex-rs/app-server-protocol/schema/json/ClientRequest.json
@@ -514,6 +514,16 @@
        },
        {
          "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
            "image_url": {
              "type": "string"
            },
@@ -627,6 +637,15 @@
      ],
      "type": "string"
    },
+    "ImageDetail": {
+      "enum": [
+        "auto",
+        "low",
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
    "InitializeCapabilities": {
      "description": "Client-declared capabilities negotiated during initialize.",
      "properties": {
@@ -932,6 +951,36 @@
      ],
      "type": "string"
    },
+    "PluginInstallParams": {
+      "properties": {
+        "marketplacePath": {
+          "$ref": "#/definitions/AbsolutePathBuf"
+        },
+        "pluginName": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "marketplacePath",
+        "pluginName"
+      ],
+      "type": "object"
+    },
+    "PluginListParams": {
+      "properties": {
+        "additionalRoots": {
+          "description": "Additional roots to use when discovering repo-scoped marketplaces. Home-scoped marketplaces are always considered.",
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
    "ProductSurface": {
      "enum": [
        "chatgpt",
@@ -1397,6 +1446,40 @@
          "title": "WebSearchCallResponseItem",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "result": {
+              "type": "string"
+            },
+            "revised_prompt": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "status": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "image_generation_call"
+              ],
+              "title": "ImageGenerationCallResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "id",
+            "result",
+            "status",
+            "type"
+          ],
+          "title": "ImageGenerationCallResponseItem",
+          "type": "object"
+        },
        {
          "properties": {
            "ghost_commit": {
@@ -1618,6 +1701,10 @@
                "type": "fullAccess"
              }
            },
+            "networkAccess": {
+              "default": false,
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "readOnly"
@@ -1705,7 +1792,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
@@ -2059,6 +2147,54 @@
      },
      "type": "object"
    },
+    "ThreadMetadataGitInfoUpdateParams": {
+      "properties": {
+        "branch": {
+          "description": "Omit to leave the stored branch unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "originUrl": {
+          "description": "Omit to leave the stored origin URL unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "sha": {
+          "description": "Omit to leave the stored commit unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "ThreadMetadataUpdateParams": {
+      "properties": {
+        "gitInfo": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ThreadMetadataGitInfoUpdateParams"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Patch the stored Git metadata for this thread. Omit a field to leave it unchanged, set it to `null` to clear it, or provide a string to replace the stored value."
+        },
+        "threadId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "threadId"
+      ],
+      "type": "object"
+    },
    "ThreadReadParams": {
      "properties": {
        "includeTurns": {
@@ -2758,6 +2894,12 @@
    },
    "WindowsSandboxSetupStartParams": {
      "properties": {
+        "cwd": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
        "mode": {
          "$ref": "#/definitions/WindowsSandboxSetupMode"
        }
@@ -2939,6 +3081,30 @@
      "title": "Thread/name/setRequest",
      "type": "object"
    },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "thread/metadata/update"
+          ],
+          "title": "Thread/metadata/updateRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/ThreadMetadataUpdateParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "Thread/metadata/updateRequest",
+      "type": "object"
+    },
    {
      "properties": {
        "id": {
@@ -3107,6 +3273,30 @@
      "title": "Skills/listRequest",
      "type": "object"
    },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "plugin/list"
+          ],
+          "title": "Plugin/listRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/PluginListParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "Plugin/listRequest",
+      "type": "object"
+    },
    {
      "properties": {
        "id": {
@@ -3203,6 +3393,30 @@
      "title": "Skills/config/writeRequest",
      "type": "object"
    },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "plugin/install"
+          ],
+          "title": "Plugin/installRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/PluginInstallParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "Plugin/installRequest",
+      "type": "object"
+    },
    {
      "properties": {
        "id": {
--- a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json
+++ b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json
@@ -65,6 +65,17 @@
      },
      "type": "object"
    },
+    "AdditionalNetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
    "AdditionalPermissionProfile": {
      "properties": {
        "fileSystem": {
@@ -88,9 +99,13 @@
          ]
        },
        "network": {
-          "type": [
-            "boolean",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalNetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
          ]
        }
      },
--- a/codex-rs/app-server-protocol/schema/json/EventMsg.json
+++ b/codex-rs/app-server-protocol/schema/json/EventMsg.json
@@ -3478,6 +3478,16 @@
        },
        {
          "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
            "image_url": {
              "type": "string"
            },
@@ -3569,6 +3579,15 @@
      ],
      "type": "object"
    },
+    "ImageDetail": {
+      "enum": [
+        "auto",
+        "low",
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
    "LocalShellAction": {
      "oneOf": [
        {
@@ -3869,6 +3888,17 @@
      ],
      "type": "string"
    },
+    "NetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
    "NetworkPolicyAmendment": {
      "properties": {
        "action": {
@@ -4033,9 +4063,13 @@
          ]
        },
        "network": {
-          "type": [
-            "boolean",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/NetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
          ]
        }
      },
@@ -4949,6 +4983,40 @@
          "title": "WebSearchCallResponseItem",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "result": {
+              "type": "string"
+            },
+            "revised_prompt": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "status": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "image_generation_call"
+              ],
+              "title": "ImageGenerationCallResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "id",
+            "result",
+            "status",
+            "type"
+          ],
+          "title": "ImageGenerationCallResponseItem",
+          "type": "object"
+        },
        {
          "properties": {
            "ghost_commit": {
@@ -5331,6 +5399,10 @@
              ],
              "description": "Read access granted while running under this policy."
            },
+            "network_access": {
+              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "read-only"
@@ -5422,7 +5494,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/ServerNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/ServerNotification.json
@@ -1485,6 +1485,10 @@
        }
      ]
    },
+    "SkillsChangedNotification": {
+      "description": "Notification emitted when watched local skill files change.\n\nTreat this as an invalidation signal and re-run `skills/list` with the client's current parameters when refreshed skill metadata is needed.",
+      "type": "object"
+    },
    "SubAgentSource": {
      "oneOf": [
        {
@@ -3202,6 +3206,26 @@
      "title": "Thread/closedNotification",
      "type": "object"
    },
+    {
+      "properties": {
+        "method": {
+          "enum": [
+            "skills/changed"
+          ],
+          "title": "Skills/changedNotificationMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/SkillsChangedNotification"
+        }
+      },
+      "required": [
+        "method",
+        "params"
+      ],
+      "title": "Skills/changedNotification",
+      "type": "object"
+    },
    {
      "properties": {
        "method": {
--- a/codex-rs/app-server-protocol/schema/json/ServerRequest.json
+++ b/codex-rs/app-server-protocol/schema/json/ServerRequest.json
@@ -65,6 +65,17 @@
      },
      "type": "object"
    },
+    "AdditionalNetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
    "AdditionalPermissionProfile": {
      "properties": {
        "fileSystem": {
@@ -88,9 +99,13 @@
          ]
        },
        "network": {
-          "type": [
-            "boolean",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalNetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
          ]
        }
      },
--- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
@@ -5,7 +5,7 @@
      "properties": {
        "read": {
          "items": {
-            "$ref": "#/definitions/AbsolutePathBuf"
+            "$ref": "#/definitions/v2/AbsolutePathBuf"
          },
          "type": [
            "array",
@@ -14,7 +14,7 @@
        },
        "write": {
          "items": {
-            "$ref": "#/definitions/AbsolutePathBuf"
+            "$ref": "#/definitions/v2/AbsolutePathBuf"
          },
          "type": [
            "array",
@@ -61,6 +61,17 @@
      },
      "type": "object"
    },
+    "AdditionalNetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
    "AdditionalPermissionProfile": {
      "properties": {
        "fileSystem": {
@@ -84,9 +95,13 @@
          ]
        },
        "network": {
-          "type": [
-            "boolean",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalNetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
          ]
        }
      },
@@ -523,6 +538,30 @@
          "title": "Thread/name/setRequest",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "thread/metadata/update"
+              ],
+              "title": "Thread/metadata/updateRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/ThreadMetadataUpdateParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Thread/metadata/updateRequest",
+          "type": "object"
+        },
        {
          "properties": {
            "id": {
@@ -691,6 +730,30 @@
          "title": "Skills/listRequest",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "plugin/list"
+              ],
+              "title": "Plugin/listRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/PluginListParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Plugin/listRequest",
+          "type": "object"
+        },
        {
          "properties": {
            "id": {
@@ -787,6 +850,30 @@
          "title": "Skills/config/writeRequest",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "plugin/install"
+              ],
+              "title": "Plugin/installRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/PluginInstallParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Plugin/installRequest",
+          "type": "object"
+        },
        {
          "properties": {
            "id": {
@@ -1382,7 +1469,7 @@
        "thread_id": {
          "allOf": [
            {
-              "$ref": "#/definitions/ThreadId"
+              "$ref": "#/definitions/v2/ThreadId"
            }
          ],
          "description": "Thread ID of the receiver/new agent."
@@ -1420,7 +1507,7 @@
        "thread_id": {
          "allOf": [
            {
-              "$ref": "#/definitions/ThreadId"
+              "$ref": "#/definitions/v2/ThreadId"
            }
          ],
          "description": "Thread ID of the receiver/new agent."
@@ -4732,7 +4819,7 @@
      "properties": {
        "read": {
          "items": {
-            "$ref": "#/definitions/AbsolutePathBuf"
+            "$ref": "#/definitions/v2/AbsolutePathBuf"
          },
          "type": [
            "array",
@@ -4741,7 +4828,7 @@
        },
        "write": {
          "items": {
-            "$ref": "#/definitions/AbsolutePathBuf"
+            "$ref": "#/definitions/v2/AbsolutePathBuf"
          },
          "type": [
            "array",
@@ -5248,6 +5335,17 @@
      ],
      "type": "string"
    },
+    "NetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
    "NetworkPolicyAmendment": {
      "properties": {
        "action": {
@@ -5404,9 +5502,13 @@
          ]
        },
        "network": {
-          "type": [
-            "boolean",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/NetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
          ]
        }
      },
@@ -6015,6 +6117,26 @@
          "title": "Thread/closedNotification",
          "type": "object"
        },
+        {
+          "properties": {
+            "method": {
+              "enum": [
+                "skills/changed"
+              ],
+              "title": "Skills/changedNotificationMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/SkillsChangedNotification"
+            }
+          },
+          "required": [
+            "method",
+            "params"
+          ],
+          "title": "Skills/changedNotification",
+          "type": "object"
+        },
        {
          "properties": {
            "method": {
@@ -7131,7 +7253,7 @@
          "properties": {
            "content": {
              "items": {
-                "$ref": "#/definitions/UserInput"
+                "$ref": "#/definitions/v2/UserInput"
              },
              "type": "array"
            },
@@ -7169,7 +7291,7 @@
            "phase": {
              "anyOf": [
                {
-                  "$ref": "#/definitions/MessagePhase"
+                  "$ref": "#/definitions/v2/MessagePhase"
                },
                {
                  "type": "null"
@@ -7254,7 +7376,7 @@
        {
          "properties": {
            "action": {
-              "$ref": "#/definitions/WebSearchAction"
+              "$ref": "#/definitions/v2/WebSearchAction"
            },
            "id": {
              "type": "string"
@@ -8963,6 +9085,15 @@
                "type": "null"
              }
            ]
+          },
+          "featureRequirements": {
+            "additionalProperties": {
+              "type": "boolean"
+            },
+            "type": [
+              "object",
+              "null"
+            ]
          }
        },
        "type": "object"
@@ -9676,6 +9807,16 @@
          },
          {
            "properties": {
+              "detail": {
+                "anyOf": [
+                  {
+                    "$ref": "#/definitions/v2/ImageDetail"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
              "image_url": {
                "type": "string"
              },
@@ -9841,6 +9982,15 @@
        ],
        "type": "string"
      },
+      "ImageDetail": {
+        "enum": [
+          "auto",
+          "low",
+          "high",
+          "original"
+        ],
+        "type": "string"
+      },
      "InputModality": {
        "description": "Canonical user-input modality tags advertised by a model.",
        "oneOf": [
@@ -10795,6 +10945,126 @@
        ],
        "type": "string"
      },
+      "PluginInstallParams": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "marketplacePath": {
+            "$ref": "#/definitions/v2/AbsolutePathBuf"
+          },
+          "pluginName": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "marketplacePath",
+          "pluginName"
+        ],
+        "title": "PluginInstallParams",
+        "type": "object"
+      },
+      "PluginInstallResponse": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "title": "PluginInstallResponse",
+        "type": "object"
+      },
+      "PluginListParams": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "additionalRoots": {
+            "description": "Additional roots to use when discovering repo-scoped marketplaces. Home-scoped marketplaces are always considered.",
+            "items": {
+              "$ref": "#/definitions/v2/AbsolutePathBuf"
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          }
+        },
+        "title": "PluginListParams",
+        "type": "object"
+      },
+      "PluginListResponse": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "data": {
+            "items": {
+              "$ref": "#/definitions/v2/PluginMarketplaceEntry"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "title": "PluginListResponse",
+        "type": "object"
+      },
+      "PluginMarketplaceEntry": {
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "plugins": {
+            "items": {
+              "$ref": "#/definitions/v2/PluginSummary"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "name",
+          "path",
+          "plugins"
+        ],
+        "type": "object"
+      },
+      "PluginSource": {
+        "oneOf": [
+          {
+            "properties": {
+              "path": {
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "local"
+                ],
+                "title": "LocalPluginSourceType",
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type"
+            ],
+            "title": "LocalPluginSource",
+            "type": "object"
+          }
+        ]
+      },
+      "PluginSummary": {
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "name": {
+            "type": "string"
+          },
+          "source": {
+            "$ref": "#/definitions/v2/PluginSource"
+          }
+        },
+        "required": [
+          "enabled",
+          "name",
+          "source"
+        ],
+        "type": "object"
+      },
      "ProductSurface": {
        "enum": [
          "chatgpt",
@@ -11659,6 +11929,40 @@
            "title": "WebSearchCallResponseItem",
            "type": "object"
          },
+          {
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "result": {
+                "type": "string"
+              },
+              "revised_prompt": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "status": {
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "image_generation_call"
+                ],
+                "title": "ImageGenerationCallResponseItemType",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "result",
+              "status",
+              "type"
+            ],
+            "title": "ImageGenerationCallResponseItem",
+            "type": "object"
+          },
          {
            "properties": {
              "ghost_commit": {
@@ -11900,6 +12204,10 @@
                  "type": "fullAccess"
                }
              },
+              "networkAccess": {
+                "default": false,
+                "type": "boolean"
+              },
              "type": {
                "enum": [
                  "readOnly"
@@ -12028,7 +12336,8 @@
      },
      "ServiceTier": {
        "enum": [
-          "fast"
+          "fast",
+          "flex"
        ],
        "type": "string"
      },
@@ -12259,6 +12568,12 @@
        ],
        "type": "object"
      },
+      "SkillsChangedNotification": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "description": "Notification emitted when watched local skill files change.\n\nTreat this as an invalidation signal and re-run `skills/list` with the client's current parameters when refreshed skill metadata is needed.",
+        "title": "SkillsChangedNotification",
+        "type": "object"
+      },
      "SkillsConfigWriteParams": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
@@ -13611,6 +13926,69 @@
        "title": "ThreadLoadedListResponse",
        "type": "object"
      },
+      "ThreadMetadataGitInfoUpdateParams": {
+        "properties": {
+          "branch": {
+            "description": "Omit to leave the stored branch unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "originUrl": {
+            "description": "Omit to leave the stored origin URL unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "sha": {
+            "description": "Omit to leave the stored commit unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "ThreadMetadataUpdateParams": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "gitInfo": {
+            "anyOf": [
+              {
+                "$ref": "#/definitions/v2/ThreadMetadataGitInfoUpdateParams"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Patch the stored Git metadata for this thread. Omit a field to leave it unchanged, set it to `null` to clear it, or provide a string to replace the stored value."
+          },
+          "threadId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "threadId"
+        ],
+        "title": "ThreadMetadataUpdateParams",
+        "type": "object"
+      },
+      "ThreadMetadataUpdateResponse": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "thread": {
+            "$ref": "#/definitions/v2/Thread"
+          }
+        },
+        "required": [
+          "thread"
+        ],
+        "title": "ThreadMetadataUpdateResponse",
+        "type": "object"
+      },
      "ThreadNameUpdatedNotification": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
@@ -15115,6 +15493,12 @@
      "WindowsSandboxSetupStartParams": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
+          "cwd": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
          "mode": {
            "$ref": "#/definitions/v2/WindowsSandboxSetupMode"
          }
--- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
+++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
--- a/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
@@ -89,6 +89,10 @@
                "type": "fullAccess"
              }
            },
+            "networkAccess": {
+              "default": false,
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "readOnly"
--- a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
@@ -707,7 +707,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
@@ -81,6 +81,15 @@
              "type": "null"
            }
          ]
+        },
+        "featureRequirements": {
+          "additionalProperties": {
+            "type": "boolean"
+          },
+          "type": [
+            "object",
+            "null"
+          ]
        }
      },
      "type": "object"
--- a/codex-rs/app-server-protocol/schema/json/v2/PluginInstallParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginInstallParams.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbsolutePathBuf": {
+      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
+      "type": "string"
+    }
+  },
+  "properties": {
+    "marketplacePath": {
+      "$ref": "#/definitions/AbsolutePathBuf"
+    },
+    "pluginName": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "marketplacePath",
+    "pluginName"
+  ],
+  "title": "PluginInstallParams",
+  "type": "object"
+}
--- a/codex-rs/app-server-protocol/schema/json/v2/PluginInstallResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginInstallResponse.json
@@ -0,0 +1,5 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "PluginInstallResponse",
+  "type": "object"
+}
--- a/codex-rs/app-server-protocol/schema/json/v2/PluginListParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginListParams.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbsolutePathBuf": {
+      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
+      "type": "string"
+    }
+  },
+  "properties": {
+    "additionalRoots": {
+      "description": "Additional roots to use when discovering repo-scoped marketplaces. Home-scoped marketplaces are always considered.",
+      "items": {
+        "$ref": "#/definitions/AbsolutePathBuf"
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    }
+  },
+  "title": "PluginListParams",
+  "type": "object"
+}
--- a/codex-rs/app-server-protocol/schema/json/v2/PluginListResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginListResponse.json
@@ -0,0 +1,83 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "PluginMarketplaceEntry": {
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "path": {
+          "type": "string"
+        },
+        "plugins": {
+          "items": {
+            "$ref": "#/definitions/PluginSummary"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "name",
+        "path",
+        "plugins"
+      ],
+      "type": "object"
+    },
+    "PluginSource": {
+      "oneOf": [
+        {
+          "properties": {
+            "path": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "local"
+              ],
+              "title": "LocalPluginSourceType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "path",
+            "type"
+          ],
+          "title": "LocalPluginSource",
+          "type": "object"
+        }
+      ]
+    },
+    "PluginSummary": {
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "name": {
+          "type": "string"
+        },
+        "source": {
+          "$ref": "#/definitions/PluginSource"
+        }
+      },
+      "required": [
+        "enabled",
+        "name",
+        "source"
+      ],
+      "type": "object"
+    }
+  },
+  "properties": {
+    "data": {
+      "items": {
+        "$ref": "#/definitions/PluginMarketplaceEntry"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "data"
+  ],
+  "title": "PluginListResponse",
+  "type": "object"
+}
--- a/codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json
@@ -103,6 +103,16 @@
        },
        {
          "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
            "image_url": {
              "type": "string"
            },
@@ -173,6 +183,15 @@
      ],
      "type": "object"
    },
+    "ImageDetail": {
+      "enum": [
+        "auto",
+        "low",
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
    "LocalShellAction": {
      "oneOf": [
        {
@@ -622,6 +641,40 @@
          "title": "WebSearchCallResponseItem",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "result": {
+              "type": "string"
+            },
+            "revised_prompt": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "status": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "image_generation_call"
+              ],
+              "title": "ImageGenerationCallResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "id",
+            "result",
+            "status",
+            "type"
+          ],
+          "title": "ImageGenerationCallResponseItem",
+          "type": "object"
+        },
        {
          "properties": {
            "ghost_commit": {
--- a/codex-rs/app-server-protocol/schema/json/v2/SkillsChangedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/SkillsChangedNotification.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "description": "Notification emitted when watched local skill files change.\n\nTreat this as an invalidation signal and re-run `skills/list` with the client's current parameters when refreshed skill metadata is needed.",
+  "title": "SkillsChangedNotification",
+  "type": "object"
+}
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
@@ -53,7 +53,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    }
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
@@ -653,6 +653,10 @@
                "type": "fullAccess"
              }
            },
+            "networkAccess": {
+              "default": false,
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "readOnly"
@@ -740,7 +744,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateParams.json
@@ -0,0 +1,52 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "ThreadMetadataGitInfoUpdateParams": {
+      "properties": {
+        "branch": {
+          "description": "Omit to leave the stored branch unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "originUrl": {
+          "description": "Omit to leave the stored origin URL unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "sha": {
+          "description": "Omit to leave the stored commit unchanged, set to `null` to clear it, or provide a non-empty string to replace it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    }
+  },
+  "properties": {
+    "gitInfo": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/ThreadMetadataGitInfoUpdateParams"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Patch the stored Git metadata for this thread. Omit a field to leave it unchanged, set it to `null` to clear it, or provide a string to replace the stored value."
+    },
+    "threadId": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "threadId"
+  ],
+  "title": "ThreadMetadataUpdateParams",
+  "type": "object"
+}
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
@@ -145,6 +145,16 @@
        },
        {
          "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
            "image_url": {
              "type": "string"
            },
@@ -215,6 +225,15 @@
      ],
      "type": "object"
    },
+    "ImageDetail": {
+      "enum": [
+        "auto",
+        "low",
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
    "LocalShellAction": {
      "oneOf": [
        {
@@ -672,6 +691,40 @@
          "title": "WebSearchCallResponseItem",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "result": {
+              "type": "string"
+            },
+            "revised_prompt": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "status": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "image_generation_call"
+              ],
+              "title": "ImageGenerationCallResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "id",
+            "result",
+            "status",
+            "type"
+          ],
+          "title": "ImageGenerationCallResponseItem",
+          "type": "object"
+        },
        {
          "properties": {
            "ghost_commit": {
@@ -740,7 +793,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
@@ -653,6 +653,10 @@
                "type": "fullAccess"
              }
            },
+            "networkAccess": {
+              "default": false,
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "readOnly"
@@ -740,7 +744,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
@@ -78,7 +78,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    }
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
@@ -653,6 +653,10 @@
                "type": "fullAccess"
              }
            },
+            "networkAccess": {
+              "default": false,
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "readOnly"
@@ -740,7 +744,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
@@ -214,6 +214,10 @@
                "type": "fullAccess"
              }
            },
+            "networkAccess": {
+              "default": false,
+              "type": "boolean"
+            },
            "type": {
              "enum": [
                "readOnly"
@@ -301,7 +305,8 @@
    },
    "ServiceTier": {
      "enum": [
-        "fast"
+        "fast",
+        "flex"
      ],
      "type": "string"
    },
--- a/codex-rs/app-server-protocol/schema/json/v2/WindowsSandboxSetupStartParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/WindowsSandboxSetupStartParams.json
@@ -10,6 +10,12 @@
    }
  },
  "properties": {
+    "cwd": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
    "mode": {
      "$ref": "#/definitions/WindowsSandboxSetupMode"
    }
--- a/codex-rs/app-server-protocol/schema/typescript/AuthStatusChangeNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/AuthStatusChangeNotification.ts
@@ -1,9 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AuthMode } from "./AuthMode";
-
-/**
- * Deprecated notification. Use AccountUpdatedNotification instead.
- */
-export type AuthStatusChangeNotification = { authMethod: AuthMode | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts
--- a/codex-rs/app-server-protocol/schema/typescript/ExecOneOffCommandParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ExecOneOffCommandParams.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { SandboxPolicy } from "./SandboxPolicy";
-
-export type ExecOneOffCommandParams = { command: Array<string>, timeoutMs: bigint | null, cwd: string | null, sandboxPolicy: SandboxPolicy | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ExecOneOffCommandResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ExecOneOffCommandResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ExecOneOffCommandResponse = { exitCode: number, stdout: string, stderr: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/ForkConversationParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ForkConversationParams.ts
@@ -1,7 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { NewConversationParams } from "./NewConversationParams";
-import type { ThreadId } from "./ThreadId";
-
-export type ForkConversationParams = { path: string | null, conversationId: ThreadId | null, overrides: NewConversationParams | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ForkConversationResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ForkConversationResponse.ts
@@ -1,7 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { EventMsg } from "./EventMsg";
-import type { ThreadId } from "./ThreadId";
-
-export type ForkConversationResponse = { conversationId: ThreadId, model: string, initialMessages: Array<EventMsg> | null, rolloutPath: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/FunctionCallOutputContentItem.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/FunctionCallOutputContentItem.ts
@@ -1,9 +1,10 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ImageDetail } from "./ImageDetail";

 /**
 * Responses API compatible content items that can be returned by a tool call.
 * This is a subset of ContentItem with the types we support as function call outputs.
 */
-export type FunctionCallOutputContentItem = { "type": "input_text", text: string, } | { "type": "input_image", image_url: string, };
+export type FunctionCallOutputContentItem = { "type": "input_text", text: string, } | { "type": "input_image", image_url: string, detail?: ImageDetail, };
--- a/codex-rs/app-server-protocol/schema/typescript/GetUserSavedConfigResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/GetUserSavedConfigResponse.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { UserSavedConfig } from "./UserSavedConfig";
-
-export type GetUserSavedConfigResponse = { config: UserSavedConfig, };
--- a/codex-rs/app-server-protocol/schema/typescript/CancelLoginChatGptResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/CancelLoginChatGptResponse.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type CancelLoginChatGptResponse = Record<string, never>;
+export type ImageDetail = "auto" | "low" | "high" | "original";
--- a/codex-rs/app-server-protocol/schema/typescript/InputItem.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/InputItem.ts
@@ -1,10 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { TextElement } from "./TextElement";
-
-export type InputItem = { "type": "text", "data": { text: string, 
-/**
- * UI-defined spans within `text` used to render or persist special elements.
- */
-text_elements: Array<TextElement>, } } | { "type": "image", "data": { image_url: string, } } | { "type": "localImage", "data": { path: string, } };
--- a/codex-rs/app-server-protocol/schema/typescript/InterruptConversationParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/InterruptConversationParams.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ThreadId } from "./ThreadId";
-
-export type InterruptConversationParams = { conversationId: ThreadId, };
--- a/codex-rs/app-server-protocol/schema/typescript/InterruptConversationResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/InterruptConversationResponse.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { TurnAbortReason } from "./TurnAbortReason";
-
-export type InterruptConversationResponse = { abortReason: TurnAbortReason, };
--- a/codex-rs/app-server-protocol/schema/typescript/ListConversationsParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ListConversationsParams.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ListConversationsParams = { pageSize: number | null, cursor: string | null, modelProviders: Array<string> | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ListConversationsResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ListConversationsResponse.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ConversationSummary } from "./ConversationSummary";
-
-export type ListConversationsResponse = { items: Array<ConversationSummary>, nextCursor: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/LoginApiKeyParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/LoginApiKeyParams.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type LoginApiKeyParams = { apiKey: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/LoginApiKeyResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/LoginApiKeyResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type LoginApiKeyResponse = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/LoginChatGptCompleteNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/LoginChatGptCompleteNotification.ts
@@ -1,8 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-/**
- * Deprecated in favor of AccountLoginCompletedNotification.
- */
-export type LoginChatGptCompleteNotification = { loginId: string, success: boolean, error: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/LoginChatGptResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/LoginChatGptResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type LoginChatGptResponse = { loginId: string, authUrl: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/CancelLoginChatGptParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/CancelLoginChatGptParams.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type CancelLoginChatGptParams = { loginId: string, };
+export type NetworkPermissions = { enabled: boolean | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/NewConversationParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/NewConversationParams.ts
@@ -1,8 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AskForApproval } from "./AskForApproval";
-import type { SandboxMode } from "./SandboxMode";
-import type { JsonValue } from "./serde_json/JsonValue";
-
-export type NewConversationParams = { model: string | null, modelProvider: string | null, profile: string | null, cwd: string | null, approvalPolicy: AskForApproval | null, sandbox: SandboxMode | null, config: { [key in string]?: JsonValue } | null, baseInstructions: string | null, developerInstructions: string | null, compactPrompt: string | null, includeApplyPatchTool: boolean | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/NewConversationResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/NewConversationResponse.ts
@@ -1,7 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ReasoningEffort } from "./ReasoningEffort";
-import type { ThreadId } from "./ThreadId";
-
-export type NewConversationResponse = { conversationId: ThreadId, model: string, reasoningEffort: ReasoningEffort | null, rolloutPath: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/PermissionProfile.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/PermissionProfile.ts
@@ -3,5 +3,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { FileSystemPermissions } from "./FileSystemPermissions";
 import type { MacOsPermissions } from "./MacOsPermissions";
+import type { NetworkPermissions } from "./NetworkPermissions";

-export type PermissionProfile = { network: boolean | null, file_system: FileSystemPermissions | null, macos: MacOsPermissions | null, };
+export type PermissionProfile = { network: NetworkPermissions | null, file_system: FileSystemPermissions | null, macos: MacOsPermissions | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/Profile.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/Profile.ts
@@ -1,9 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AskForApproval } from "./AskForApproval";
-import type { ReasoningEffort } from "./ReasoningEffort";
-import type { ReasoningSummary } from "./ReasoningSummary";
-import type { Verbosity } from "./Verbosity";
-
-export type Profile = { model: string | null, modelProvider: string | null, approvalPolicy: AskForApproval | null, modelReasoningEffort: ReasoningEffort | null, modelReasoningSummary: ReasoningSummary | null, modelVerbosity: Verbosity | null, chatgptBaseUrl: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/RemoveConversationListenerParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/RemoveConversationListenerParams.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type RemoveConversationListenerParams = { subscriptionId: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/RemoveConversationSubscriptionResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/RemoveConversationSubscriptionResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type RemoveConversationSubscriptionResponse = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
@@ -15,4 +15,4 @@ export type ResponseItem = { "type": "message", role: string, content: Array<Con
 /**
 * Set when using the Responses API.
 */
-call_id: string | null, status: LocalShellStatus, action: LocalShellAction, } | { "type": "function_call", name: string, arguments: string, call_id: string, } | { "type": "function_call_output", call_id: string, output: FunctionCallOutputPayload, } | { "type": "custom_tool_call", status?: string, call_id: string, name: string, input: string, } | { "type": "custom_tool_call_output", call_id: string, output: FunctionCallOutputPayload, } | { "type": "web_search_call", status?: string, action?: WebSearchAction, } | { "type": "ghost_snapshot", ghost_commit: GhostCommit, } | { "type": "compaction", encrypted_content: string, } | { "type": "other" };
+call_id: string | null, status: LocalShellStatus, action: LocalShellAction, } | { "type": "function_call", name: string, arguments: string, call_id: string, } | { "type": "function_call_output", call_id: string, output: FunctionCallOutputPayload, } | { "type": "custom_tool_call", status?: string, call_id: string, name: string, input: string, } | { "type": "custom_tool_call_output", call_id: string, output: FunctionCallOutputPayload, } | { "type": "web_search_call", status?: string, action?: WebSearchAction, } | { "type": "image_generation_call", id: string, status: string, revised_prompt?: string, result: string, } | { "type": "ghost_snapshot", ghost_commit: GhostCommit, } | { "type": "compaction", encrypted_content: string, } | { "type": "other" };
--- a/codex-rs/app-server-protocol/schema/typescript/ResumeConversationParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ResumeConversationParams.ts
@@ -1,8 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { NewConversationParams } from "./NewConversationParams";
-import type { ResponseItem } from "./ResponseItem";
-import type { ThreadId } from "./ThreadId";
-
-export type ResumeConversationParams = { path: string | null, conversationId: ThreadId | null, history: Array<ResponseItem> | null, overrides: NewConversationParams | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ResumeConversationResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ResumeConversationResponse.ts
@@ -1,7 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { EventMsg } from "./EventMsg";
-import type { ThreadId } from "./ThreadId";
-
-export type ResumeConversationResponse = { conversationId: ThreadId, model: string, initialMessages: Array<EventMsg> | null, rolloutPath: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/SandboxMode.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SandboxMode.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type SandboxMode = "read-only" | "workspace-write" | "danger-full-access";
--- a/codex-rs/app-server-protocol/schema/typescript/SandboxPolicy.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SandboxPolicy.ts
@@ -12,7 +12,12 @@ export type SandboxPolicy = { "type": "danger-full-access" } | { "type": "read-o
 /**
 * Read access granted while running under this policy.
 */
-access?: ReadOnlyAccess, } | { "type": "external-sandbox", 
+access?: ReadOnlyAccess, 
+/**
+ * When set to `true`, outbound network access is allowed. `false` by
+ * default.
+ */
+network_access?: boolean, } | { "type": "external-sandbox", 
 /**
 * Whether the external sandbox permits outbound network traffic.
 */
--- a/codex-rs/app-server-protocol/schema/typescript/SandboxSettings.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SandboxSettings.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AbsolutePathBuf } from "./AbsolutePathBuf";
-
-export type SandboxSettings = { writableRoots: Array<AbsolutePathBuf>, networkAccess: boolean | null, excludeTmpdirEnvVar: boolean | null, excludeSlashTmp: boolean | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/SendUserMessageParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SendUserMessageParams.ts
@@ -1,7 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { InputItem } from "./InputItem";
-import type { ThreadId } from "./ThreadId";
-
-export type SendUserMessageParams = { conversationId: ThreadId, items: Array<InputItem>, };
--- a/codex-rs/app-server-protocol/schema/typescript/SendUserMessageResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SendUserMessageResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type SendUserMessageResponse = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/SendUserTurnParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SendUserTurnParams.ts
@@ -1,17 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AskForApproval } from "./AskForApproval";
-import type { InputItem } from "./InputItem";
-import type { ReasoningEffort } from "./ReasoningEffort";
-import type { ReasoningSummary } from "./ReasoningSummary";
-import type { SandboxPolicy } from "./SandboxPolicy";
-import type { ServiceTier } from "./ServiceTier";
-import type { ThreadId } from "./ThreadId";
-import type { JsonValue } from "./serde_json/JsonValue";
-
-export type SendUserTurnParams = { conversationId: ThreadId, items: Array<InputItem>, cwd: string, approvalPolicy: AskForApproval, sandboxPolicy: SandboxPolicy, model: string, serviceTier?: ServiceTier | null | null, effort: ReasoningEffort | null, summary: ReasoningSummary, 
-/**
- * Optional JSON Schema used to constrain the final assistant message for this turn.
- */
-outputSchema: JsonValue | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/SendUserTurnResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SendUserTurnResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type SendUserTurnResponse = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts
@@ -1,11 +1,8 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AuthStatusChangeNotification } from "./AuthStatusChangeNotification";
 import type { FuzzyFileSearchSessionCompletedNotification } from "./FuzzyFileSearchSessionCompletedNotification";
 import type { FuzzyFileSearchSessionUpdatedNotification } from "./FuzzyFileSearchSessionUpdatedNotification";
-import type { LoginChatGptCompleteNotification } from "./LoginChatGptCompleteNotification";
-import type { SessionConfiguredNotification } from "./SessionConfiguredNotification";
 import type { AccountLoginCompletedNotification } from "./v2/AccountLoginCompletedNotification";
 import type { AccountRateLimitsUpdatedNotification } from "./v2/AccountRateLimitsUpdatedNotification";
 import type { AccountUpdatedNotification } from "./v2/AccountUpdatedNotification";
@@ -28,6 +25,7 @@ import type { ReasoningSummaryPartAddedNotification } from "./v2/ReasoningSummar
 import type { ReasoningSummaryTextDeltaNotification } from "./v2/ReasoningSummaryTextDeltaNotification";
 import type { ReasoningTextDeltaNotification } from "./v2/ReasoningTextDeltaNotification";
 import type { ServerRequestResolvedNotification } from "./v2/ServerRequestResolvedNotification";
+import type { SkillsChangedNotification } from "./v2/SkillsChangedNotification";
 import type { TerminalInteractionNotification } from "./v2/TerminalInteractionNotification";
 import type { ThreadArchivedNotification } from "./v2/ThreadArchivedNotification";
 import type { ThreadClosedNotification } from "./v2/ThreadClosedNotification";
@@ -51,4 +49,4 @@ import type { WindowsWorldWritableWarningNotification } from "./v2/WindowsWorldW
 /**
 * Notification sent from the server to the client.
 */
-export type ServerNotification = { "method": "error", "params": ErrorNotification } | { "method": "thread/started", "params": ThreadStartedNotification } | { "method": "thread/status/changed", "params": ThreadStatusChangedNotification } | { "method": "thread/archived", "params": ThreadArchivedNotification } | { "method": "thread/unarchived", "params": ThreadUnarchivedNotification } | { "method": "thread/closed", "params": ThreadClosedNotification } | { "method": "thread/name/updated", "params": ThreadNameUpdatedNotification } | { "method": "thread/tokenUsage/updated", "params": ThreadTokenUsageUpdatedNotification } | { "method": "turn/started", "params": TurnStartedNotification } | { "method": "turn/completed", "params": TurnCompletedNotification } | { "method": "turn/diff/updated", "params": TurnDiffUpdatedNotification } | { "method": "turn/plan/updated", "params": TurnPlanUpdatedNotification } | { "method": "item/started", "params": ItemStartedNotification } | { "method": "item/completed", "params": ItemCompletedNotification } | { "method": "rawResponseItem/completed", "params": RawResponseItemCompletedNotification } | { "method": "item/agentMessage/delta", "params": AgentMessageDeltaNotification } | { "method": "item/plan/delta", "params": PlanDeltaNotification } | { "method": "item/commandExecution/outputDelta", "params": CommandExecutionOutputDeltaNotification } | { "method": "item/commandExecution/terminalInteraction", "params": TerminalInteractionNotification } | { "method": "item/fileChange/outputDelta", "params": FileChangeOutputDeltaNotification } | { "method": "serverRequest/resolved", "params": ServerRequestResolvedNotification } | { "method": "item/mcpToolCall/progress", "params": McpToolCallProgressNotification } | { "method": "mcpServer/oauthLogin/completed", "params": McpServerOauthLoginCompletedNotification } | { "method": "account/updated", "params": AccountUpdatedNotification } | { "method": "account/rateLimits/updated", "params": AccountRateLimitsUpdatedNotification } | { "method": "app/list/updated", "params": AppListUpdatedNotification } | { "method": "item/reasoning/summaryTextDelta", "params": ReasoningSummaryTextDeltaNotification } | { "method": "item/reasoning/summaryPartAdded", "params": ReasoningSummaryPartAddedNotification } | { "method": "item/reasoning/textDelta", "params": ReasoningTextDeltaNotification } | { "method": "thread/compacted", "params": ContextCompactedNotification } | { "method": "model/rerouted", "params": ModelReroutedNotification } | { "method": "deprecationNotice", "params": DeprecationNoticeNotification } | { "method": "configWarning", "params": ConfigWarningNotification } | { "method": "fuzzyFileSearch/sessionUpdated", "params": FuzzyFileSearchSessionUpdatedNotification } | { "method": "fuzzyFileSearch/sessionCompleted", "params": FuzzyFileSearchSessionCompletedNotification } | { "method": "thread/realtime/started", "params": ThreadRealtimeStartedNotification } | { "method": "thread/realtime/itemAdded", "params": ThreadRealtimeItemAddedNotification } | { "method": "thread/realtime/outputAudio/delta", "params": ThreadRealtimeOutputAudioDeltaNotification } | { "method": "thread/realtime/error", "params": ThreadRealtimeErrorNotification } | { "method": "thread/realtime/closed", "params": ThreadRealtimeClosedNotification } | { "method": "windows/worldWritableWarning", "params": WindowsWorldWritableWarningNotification } | { "method": "windowsSandbox/setupCompleted", "params": WindowsSandboxSetupCompletedNotification } | { "method": "account/login/completed", "params": AccountLoginCompletedNotification } | { "method": "authStatusChange", "params": AuthStatusChangeNotification } | { "method": "loginChatGptComplete", "params": LoginChatGptCompleteNotification } | { "method": "sessionConfigured", "params": SessionConfiguredNotification };
+export type ServerNotification = { "method": "error", "params": ErrorNotification } | { "method": "thread/started", "params": ThreadStartedNotification } | { "method": "thread/status/changed", "params": ThreadStatusChangedNotification } | { "method": "thread/archived", "params": ThreadArchivedNotification } | { "method": "thread/unarchived", "params": ThreadUnarchivedNotification } | { "method": "thread/closed", "params": ThreadClosedNotification } | { "method": "skills/changed", "params": SkillsChangedNotification } | { "method": "thread/name/updated", "params": ThreadNameUpdatedNotification } | { "method": "thread/tokenUsage/updated", "params": ThreadTokenUsageUpdatedNotification } | { "method": "turn/started", "params": TurnStartedNotification } | { "method": "turn/completed", "params": TurnCompletedNotification } | { "method": "turn/diff/updated", "params": TurnDiffUpdatedNotification } | { "method": "turn/plan/updated", "params": TurnPlanUpdatedNotification } | { "method": "item/started", "params": ItemStartedNotification } | { "method": "item/completed", "params": ItemCompletedNotification } | { "method": "rawResponseItem/completed", "params": RawResponseItemCompletedNotification } | { "method": "item/agentMessage/delta", "params": AgentMessageDeltaNotification } | { "method": "item/plan/delta", "params": PlanDeltaNotification } | { "method": "item/commandExecution/outputDelta", "params": CommandExecutionOutputDeltaNotification } | { "method": "item/commandExecution/terminalInteraction", "params": TerminalInteractionNotification } | { "method": "item/fileChange/outputDelta", "params": FileChangeOutputDeltaNotification } | { "method": "serverRequest/resolved", "params": ServerRequestResolvedNotification } | { "method": "item/mcpToolCall/progress", "params": McpToolCallProgressNotification } | { "method": "mcpServer/oauthLogin/completed", "params": McpServerOauthLoginCompletedNotification } | { "method": "account/updated", "params": AccountUpdatedNotification } | { "method": "account/rateLimits/updated", "params": AccountRateLimitsUpdatedNotification } | { "method": "app/list/updated", "params": AppListUpdatedNotification } | { "method": "item/reasoning/summaryTextDelta", "params": ReasoningSummaryTextDeltaNotification } | { "method": "item/reasoning/summaryPartAdded", "params": ReasoningSummaryPartAddedNotification } | { "method": "item/reasoning/textDelta", "params": ReasoningTextDeltaNotification } | { "method": "thread/compacted", "params": ContextCompactedNotification } | { "method": "model/rerouted", "params": ModelReroutedNotification } | { "method": "deprecationNotice", "params": DeprecationNoticeNotification } | { "method": "configWarning", "params": ConfigWarningNotification } | { "method": "fuzzyFileSearch/sessionUpdated", "params": FuzzyFileSearchSessionUpdatedNotification } | { "method": "fuzzyFileSearch/sessionCompleted", "params": FuzzyFileSearchSessionCompletedNotification } | { "method": "thread/realtime/started", "params": ThreadRealtimeStartedNotification } | { "method": "thread/realtime/itemAdded", "params": ThreadRealtimeItemAddedNotification } | { "method": "thread/realtime/outputAudio/delta", "params": ThreadRealtimeOutputAudioDeltaNotification } | { "method": "thread/realtime/error", "params": ThreadRealtimeErrorNotification } | { "method": "thread/realtime/closed", "params": ThreadRealtimeClosedNotification } | { "method": "windows/worldWritableWarning", "params": WindowsWorldWritableWarningNotification } | { "method": "windowsSandbox/setupCompleted", "params": WindowsSandboxSetupCompletedNotification } | { "method": "account/login/completed", "params": AccountLoginCompletedNotification };
--- a/codex-rs/app-server-protocol/schema/typescript/ServiceTier.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ServiceTier.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ServiceTier = "fast";
+export type ServiceTier = "fast" | "flex";
--- a/codex-rs/app-server-protocol/schema/typescript/SessionConfiguredNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SessionConfiguredNotification.ts
@@ -1,9 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { EventMsg } from "./EventMsg";
-import type { ReasoningEffort } from "./ReasoningEffort";
-import type { ServiceTier } from "./ServiceTier";
-import type { ThreadId } from "./ThreadId";
-
-export type SessionConfiguredNotification = { sessionId: ThreadId, model: string, serviceTier: ServiceTier | null, reasoningEffort: ReasoningEffort | null, historyLogId: bigint, historyEntryCount: number, initialMessages: Array<EventMsg> | null, rolloutPath: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/SetDefaultModelParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SetDefaultModelParams.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ReasoningEffort } from "./ReasoningEffort";
-
-export type SetDefaultModelParams = { model: string | null, reasoningEffort: ReasoningEffort | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/SetDefaultModelResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SetDefaultModelResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type SetDefaultModelResponse = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/TextElement.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/TextElement.ts
@@ -7,7 +7,7 @@ export type TextElement = {
 /**
 * Byte range in the parent `text` buffer that this element occupies.
 */
-byteRange: ByteRange, 
+byte_range: ByteRange, 
 /**
 * Optional human-readable placeholder for the element, displayed in the UI.
 */
--- a/codex-rs/app-server-protocol/schema/typescript/Tools.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/Tools.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type Tools = { webSearch: boolean | null, viewImage: boolean | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/UserInfoResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/UserInfoResponse.ts
@@ -1,5 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type UserInfoResponse = { allegedUserEmail: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/UserSavedConfig.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/UserSavedConfig.ts
@@ -1,14 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AskForApproval } from "./AskForApproval";
-import type { ForcedLoginMethod } from "./ForcedLoginMethod";
-import type { Profile } from "./Profile";
-import type { ReasoningEffort } from "./ReasoningEffort";
-import type { ReasoningSummary } from "./ReasoningSummary";
-import type { SandboxMode } from "./SandboxMode";
-import type { SandboxSettings } from "./SandboxSettings";
-import type { Tools } from "./Tools";
-import type { Verbosity } from "./Verbosity";
-
-export type UserSavedConfig = { approvalPolicy: AskForApproval | null, sandboxMode: SandboxMode | null, sandboxSettings: SandboxSettings | null, forcedChatgptWorkspaceId: string | null, forcedLoginMethod: ForcedLoginMethod | null, model: string | null, modelReasoningEffort: ReasoningEffort | null, modelReasoningSummary: ReasoningSummary | null, modelVerbosity: Verbosity | null, tools: Tools | null, profile: string | null, profiles: { [key in string]?: Profile }, };
--- a/codex-rs/app-server-protocol/schema/typescript/index.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/index.ts
@@ -1,8 +1,6 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 export type { AbsolutePathBuf } from "./AbsolutePathBuf";
-export type { AddConversationListenerParams } from "./AddConversationListenerParams";
-export type { AddConversationSubscriptionResponse } from "./AddConversationSubscriptionResponse";
 export type { AgentMessageContent } from "./AgentMessageContent";
 export type { AgentMessageContentDeltaEvent } from "./AgentMessageContentDeltaEvent";
 export type { AgentMessageDeltaEvent } from "./AgentMessageDeltaEvent";
@@ -17,16 +15,11 @@ export type { AgentStatus } from "./AgentStatus";
 export type { ApplyPatchApprovalParams } from "./ApplyPatchApprovalParams";
 export type { ApplyPatchApprovalRequestEvent } from "./ApplyPatchApprovalRequestEvent";
 export type { ApplyPatchApprovalResponse } from "./ApplyPatchApprovalResponse";
-export type { ArchiveConversationParams } from "./ArchiveConversationParams";
-export type { ArchiveConversationResponse } from "./ArchiveConversationResponse";
 export type { AskForApproval } from "./AskForApproval";
 export type { AuthMode } from "./AuthMode";
-export type { AuthStatusChangeNotification } from "./AuthStatusChangeNotification";
 export type { BackgroundEventEvent } from "./BackgroundEventEvent";
 export type { ByteRange } from "./ByteRange";
 export type { CallToolResult } from "./CallToolResult";
-export type { CancelLoginChatGptParams } from "./CancelLoginChatGptParams";
-export type { CancelLoginChatGptResponse } from "./CancelLoginChatGptResponse";
 export type { ClientInfo } from "./ClientInfo";
 export type { ClientNotification } from "./ClientNotification";
 export type { ClientRequest } from "./ClientRequest";
@@ -66,16 +59,12 @@ export type { ExecCommandEndEvent } from "./ExecCommandEndEvent";
 export type { ExecCommandOutputDeltaEvent } from "./ExecCommandOutputDeltaEvent";
 export type { ExecCommandSource } from "./ExecCommandSource";
 export type { ExecCommandStatus } from "./ExecCommandStatus";
-export type { ExecOneOffCommandParams } from "./ExecOneOffCommandParams";
-export type { ExecOneOffCommandResponse } from "./ExecOneOffCommandResponse";
 export type { ExecOutputStream } from "./ExecOutputStream";
 export type { ExecPolicyAmendment } from "./ExecPolicyAmendment";
 export type { ExitedReviewModeEvent } from "./ExitedReviewModeEvent";
 export type { FileChange } from "./FileChange";
 export type { FileSystemPermissions } from "./FileSystemPermissions";
 export type { ForcedLoginMethod } from "./ForcedLoginMethod";
-export type { ForkConversationParams } from "./ForkConversationParams";
-export type { ForkConversationResponse } from "./ForkConversationResponse";
 export type { FunctionCallOutputBody } from "./FunctionCallOutputBody";
 export type { FunctionCallOutputContentItem } from "./FunctionCallOutputContentItem";
 export type { FunctionCallOutputPayload } from "./FunctionCallOutputPayload";
@@ -89,35 +78,24 @@ export type { GetAuthStatusResponse } from "./GetAuthStatusResponse";
 export type { GetConversationSummaryParams } from "./GetConversationSummaryParams";
 export type { GetConversationSummaryResponse } from "./GetConversationSummaryResponse";
 export type { GetHistoryEntryResponseEvent } from "./GetHistoryEntryResponseEvent";
-export type { GetUserAgentResponse } from "./GetUserAgentResponse";
-export type { GetUserSavedConfigResponse } from "./GetUserSavedConfigResponse";
 export type { GhostCommit } from "./GhostCommit";
 export type { GitDiffToRemoteParams } from "./GitDiffToRemoteParams";
 export type { GitDiffToRemoteResponse } from "./GitDiffToRemoteResponse";
 export type { GitSha } from "./GitSha";
 export type { HistoryEntry } from "./HistoryEntry";
+export type { ImageDetail } from "./ImageDetail";
 export type { InitializeCapabilities } from "./InitializeCapabilities";
 export type { InitializeParams } from "./InitializeParams";
 export type { InitializeResponse } from "./InitializeResponse";
-export type { InputItem } from "./InputItem";
 export type { InputModality } from "./InputModality";
-export type { InterruptConversationParams } from "./InterruptConversationParams";
-export type { InterruptConversationResponse } from "./InterruptConversationResponse";
 export type { ItemCompletedEvent } from "./ItemCompletedEvent";
 export type { ItemStartedEvent } from "./ItemStartedEvent";
-export type { ListConversationsParams } from "./ListConversationsParams";
-export type { ListConversationsResponse } from "./ListConversationsResponse";
 export type { ListCustomPromptsResponseEvent } from "./ListCustomPromptsResponseEvent";
 export type { ListRemoteSkillsResponseEvent } from "./ListRemoteSkillsResponseEvent";
 export type { ListSkillsResponseEvent } from "./ListSkillsResponseEvent";
 export type { LocalShellAction } from "./LocalShellAction";
 export type { LocalShellExecAction } from "./LocalShellExecAction";
 export type { LocalShellStatus } from "./LocalShellStatus";
-export type { LoginApiKeyParams } from "./LoginApiKeyParams";
-export type { LoginApiKeyResponse } from "./LoginApiKeyResponse";
-export type { LoginChatGptCompleteNotification } from "./LoginChatGptCompleteNotification";
-export type { LoginChatGptResponse } from "./LoginChatGptResponse";
-export type { LogoutChatGptResponse } from "./LogoutChatGptResponse";
 export type { MacOsAutomationValue } from "./MacOsAutomationValue";
 export type { MacOsPermissions } from "./MacOsPermissions";
 export type { MacOsPreferencesValue } from "./MacOsPreferencesValue";
@@ -137,10 +115,9 @@ export type { ModelRerouteReason } from "./ModelRerouteReason";
 export type { NetworkAccess } from "./NetworkAccess";
 export type { NetworkApprovalContext } from "./NetworkApprovalContext";
 export type { NetworkApprovalProtocol } from "./NetworkApprovalProtocol";
+export type { NetworkPermissions } from "./NetworkPermissions";
 export type { NetworkPolicyAmendment } from "./NetworkPolicyAmendment";
 export type { NetworkPolicyRuleAction } from "./NetworkPolicyRuleAction";
-export type { NewConversationParams } from "./NewConversationParams";
-export type { NewConversationResponse } from "./NewConversationResponse";
 export type { ParsedCommand } from "./ParsedCommand";
 export type { PatchApplyBeginEvent } from "./PatchApplyBeginEvent";
 export type { PatchApplyEndEvent } from "./PatchApplyEndEvent";
@@ -151,7 +128,6 @@ export type { PlanDeltaEvent } from "./PlanDeltaEvent";
 export type { PlanItem } from "./PlanItem";
 export type { PlanItemArg } from "./PlanItemArg";
 export type { PlanType } from "./PlanType";
-export type { Profile } from "./Profile";
 export type { RateLimitSnapshot } from "./RateLimitSnapshot";
 export type { RateLimitWindow } from "./RateLimitWindow";
 export type { RawResponseItemEvent } from "./RawResponseItemEvent";
@@ -173,8 +149,6 @@ export type { ReasoningSummary } from "./ReasoningSummary";
 export type { RejectConfig } from "./RejectConfig";
 export type { RemoteSkillDownloadedEvent } from "./RemoteSkillDownloadedEvent";
 export type { RemoteSkillSummary } from "./RemoteSkillSummary";
-export type { RemoveConversationListenerParams } from "./RemoveConversationListenerParams";
-export type { RemoveConversationSubscriptionResponse } from "./RemoveConversationSubscriptionResponse";
 export type { RequestId } from "./RequestId";
 export type { RequestUserInputEvent } from "./RequestUserInputEvent";
 export type { RequestUserInputQuestion } from "./RequestUserInputQuestion";
@@ -182,8 +156,6 @@ export type { RequestUserInputQuestionOption } from "./RequestUserInputQuestionO
 export type { Resource } from "./Resource";
 export type { ResourceTemplate } from "./ResourceTemplate";
 export type { ResponseItem } from "./ResponseItem";
-export type { ResumeConversationParams } from "./ResumeConversationParams";
-export type { ResumeConversationResponse } from "./ResumeConversationResponse";
 export type { ReviewCodeLocation } from "./ReviewCodeLocation";
 export type { ReviewDecision } from "./ReviewDecision";
 export type { ReviewFinding } from "./ReviewFinding";
@@ -191,22 +163,13 @@ export type { ReviewLineRange } from "./ReviewLineRange";
 export type { ReviewOutputEvent } from "./ReviewOutputEvent";
 export type { ReviewRequest } from "./ReviewRequest";
 export type { ReviewTarget } from "./ReviewTarget";
-export type { SandboxMode } from "./SandboxMode";
 export type { SandboxPolicy } from "./SandboxPolicy";
-export type { SandboxSettings } from "./SandboxSettings";
-export type { SendUserMessageParams } from "./SendUserMessageParams";
-export type { SendUserMessageResponse } from "./SendUserMessageResponse";
-export type { SendUserTurnParams } from "./SendUserTurnParams";
-export type { SendUserTurnResponse } from "./SendUserTurnResponse";
 export type { ServerNotification } from "./ServerNotification";
 export type { ServerRequest } from "./ServerRequest";
 export type { ServiceTier } from "./ServiceTier";
 export type { SessionConfiguredEvent } from "./SessionConfiguredEvent";
-export type { SessionConfiguredNotification } from "./SessionConfiguredNotification";
 export type { SessionNetworkProxyRuntime } from "./SessionNetworkProxyRuntime";
 export type { SessionSource } from "./SessionSource";
-export type { SetDefaultModelParams } from "./SetDefaultModelParams";
-export type { SetDefaultModelResponse } from "./SetDefaultModelResponse";
 export type { Settings } from "./Settings";
 export type { SkillDependencies } from "./SkillDependencies";
 export type { SkillErrorInfo } from "./SkillErrorInfo";
@@ -227,7 +190,6 @@ export type { TokenCountEvent } from "./TokenCountEvent";
 export type { TokenUsage } from "./TokenUsage";
 export type { TokenUsageInfo } from "./TokenUsageInfo";
 export type { Tool } from "./Tool";
-export type { Tools } from "./Tools";
 export type { TurnAbortReason } from "./TurnAbortReason";
 export type { TurnAbortedEvent } from "./TurnAbortedEvent";
 export type { TurnCompleteEvent } from "./TurnCompleteEvent";
@@ -237,11 +199,9 @@ export type { TurnStartedEvent } from "./TurnStartedEvent";
 export type { UndoCompletedEvent } from "./UndoCompletedEvent";
 export type { UndoStartedEvent } from "./UndoStartedEvent";
 export type { UpdatePlanArgs } from "./UpdatePlanArgs";
-export type { UserInfoResponse } from "./UserInfoResponse";
 export type { UserInput } from "./UserInput";
 export type { UserMessageEvent } from "./UserMessageEvent";
 export type { UserMessageItem } from "./UserMessageItem";
-export type { UserSavedConfig } from "./UserSavedConfig";
 export type { Verbosity } from "./Verbosity";
 export type { ViewImageToolCallEvent } from "./ViewImageToolCallEvent";
 export type { WarningEvent } from "./WarningEvent";
--- a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalNetworkPermissions.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalNetworkPermissions.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ArchiveConversationResponse = Record<string, never>;
+export type AdditionalNetworkPermissions = { enabled: boolean | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalPermissionProfile.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalPermissionProfile.ts
@@ -3,5 +3,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AdditionalFileSystemPermissions } from "./AdditionalFileSystemPermissions";
 import type { AdditionalMacOsPermissions } from "./AdditionalMacOsPermissions";
+import type { AdditionalNetworkPermissions } from "./AdditionalNetworkPermissions";

-export type AdditionalPermissionProfile = { network: boolean | null, fileSystem: AdditionalFileSystemPermissions | null, macos: AdditionalMacOsPermissions | null, };
+export type AdditionalPermissionProfile = { network: AdditionalNetworkPermissions | null, fileSystem: AdditionalFileSystemPermissions | null, macos: AdditionalMacOsPermissions | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts
@@ -6,4 +6,4 @@ import type { AskForApproval } from "./AskForApproval";
 import type { ResidencyRequirement } from "./ResidencyRequirement";
 import type { SandboxMode } from "./SandboxMode";

-export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedWebSearchModes: Array<WebSearchMode> | null, enforceResidency: ResidencyRequirement | null};
+export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedWebSearchModes: Array<WebSearchMode> | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null};
--- a/codex-rs/app-server-protocol/schema/typescript/AddConversationListenerParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/AddConversationListenerParams.ts
@@ -1,6 +1,6 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ThreadId } from "./ThreadId";
+import type { AbsolutePathBuf } from "../AbsolutePathBuf";

-export type AddConversationListenerParams = { conversationId: ThreadId, experimentalRawEvents: boolean, };
+export type PluginInstallParams = { marketplacePath: AbsolutePathBuf, pluginName: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstallResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstallResponse.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type LogoutChatGptResponse = Record<string, never>;
+export type PluginInstallResponse = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PluginListParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/PluginListParams.ts
@@ -0,0 +1,11 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AbsolutePathBuf } from "../AbsolutePathBuf";
+
+export type PluginListParams = { 
+/**
+ * Additional roots to use when discovering repo-scoped marketplaces. Home-scoped
+ * marketplaces are always considered.
+ */
+additionalRoots?: Array<AbsolutePathBuf> | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PluginListResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/PluginListResponse.ts
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { PluginMarketplaceEntry } from "./PluginMarketplaceEntry";
+
+export type PluginListResponse = { data: Array<PluginMarketplaceEntry>, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PluginMarketplaceEntry.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/PluginMarketplaceEntry.ts
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { PluginSummary } from "./PluginSummary";
+
+export type PluginMarketplaceEntry = { name: string, path: string, plugins: Array<PluginSummary>, };
--- a/codex-rs/app-server-protocol/schema/typescript/GetUserAgentResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/GetUserAgentResponse.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type GetUserAgentResponse = { userAgent: string, };
+export type PluginSource = { "type": "local", path: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/ArchiveConversationParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ArchiveConversationParams.ts
@@ -1,6 +1,6 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ThreadId } from "./ThreadId";
+import type { PluginSource } from "./PluginSource";

-export type ArchiveConversationParams = { conversationId: ThreadId, rolloutPath: string, };
+export type PluginSummary = { name: string, source: PluginSource, enabled: boolean, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/SandboxPolicy.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/SandboxPolicy.ts
@@ -5,4 +5,4 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 import type { NetworkAccess } from "./NetworkAccess";
 import type { ReadOnlyAccess } from "./ReadOnlyAccess";

-export type SandboxPolicy = { "type": "dangerFullAccess" } | { "type": "readOnly", access: ReadOnlyAccess, } | { "type": "externalSandbox", networkAccess: NetworkAccess, } | { "type": "workspaceWrite", writableRoots: Array<AbsolutePathBuf>, readOnlyAccess: ReadOnlyAccess, networkAccess: boolean, excludeTmpdirEnvVar: boolean, excludeSlashTmp: boolean, };
+export type SandboxPolicy = { "type": "dangerFullAccess" } | { "type": "readOnly", access: ReadOnlyAccess, networkAccess: boolean, } | { "type": "externalSandbox", networkAccess: NetworkAccess, } | { "type": "workspaceWrite", writableRoots: Array<AbsolutePathBuf>, readOnlyAccess: ReadOnlyAccess, networkAccess: boolean, excludeTmpdirEnvVar: boolean, excludeSlashTmp: boolean, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/SkillsChangedNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/SkillsChangedNotification.ts
@@ -0,0 +1,11 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Notification emitted when watched local skill files change.
+ *
+ * Treat this as an invalidation signal and re-run `skills/list` with the
+ * client's current parameters when refreshed skill metadata is needed.
+ */
+export type SkillsChangedNotification = Record<string, never>;
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadMetadataGitInfoUpdateParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadMetadataGitInfoUpdateParams.ts
@@ -0,0 +1,20 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ThreadMetadataGitInfoUpdateParams = { 
+/**
+ * Omit to leave the stored commit unchanged, set to `null` to clear it,
+ * or provide a non-empty string to replace it.
+ */
+sha?: string | null, 
+/**
+ * Omit to leave the stored branch unchanged, set to `null` to clear it,
+ * or provide a non-empty string to replace it.
+ */
+branch?: string | null, 
+/**
+ * Omit to leave the stored origin URL unchanged, set to `null` to clear it,
+ * or provide a non-empty string to replace it.
+ */
+originUrl?: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadMetadataUpdateParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadMetadataUpdateParams.ts
@@ -0,0 +1,12 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ThreadMetadataGitInfoUpdateParams } from "./ThreadMetadataGitInfoUpdateParams";
+
+export type ThreadMetadataUpdateParams = { threadId: string, 
+/**
+ * Patch the stored Git metadata for this thread.
+ * Omit a field to leave it unchanged, set it to `null` to clear it, or
+ * provide a string to replace the stored value.
+ */
+gitInfo?: ThreadMetadataGitInfoUpdateParams | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/AddConversationSubscriptionResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/AddConversationSubscriptionResponse.ts
@@ -1,5 +1,6 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Thread } from "./Thread";

-export type AddConversationSubscriptionResponse = { subscriptionId: string, };
+export type ThreadMetadataUpdateResponse = { thread: Thread, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/WindowsSandboxSetupStartParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/WindowsSandboxSetupStartParams.ts
@@ -3,4 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { WindowsSandboxSetupMode } from "./WindowsSandboxSetupMode";

-export type WindowsSandboxSetupStartParams = { mode: WindowsSandboxSetupMode, };
+export type WindowsSandboxSetupStartParams = { mode: WindowsSandboxSetupMode, cwd?: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts
@@ -6,6 +6,7 @@ export type { AccountRateLimitsUpdatedNotification } from "./AccountRateLimitsUp
 export type { AccountUpdatedNotification } from "./AccountUpdatedNotification";
 export type { AdditionalFileSystemPermissions } from "./AdditionalFileSystemPermissions";
 export type { AdditionalMacOsPermissions } from "./AdditionalMacOsPermissions";
+export type { AdditionalNetworkPermissions } from "./AdditionalNetworkPermissions";
 export type { AdditionalPermissionProfile } from "./AdditionalPermissionProfile";
 export type { AgentMessageDeltaNotification } from "./AgentMessageDeltaNotification";
 export type { AnalyticsConfig } from "./AnalyticsConfig";
@@ -123,6 +124,13 @@ export type { OverriddenMetadata } from "./OverriddenMetadata";
 export type { PatchApplyStatus } from "./PatchApplyStatus";
 export type { PatchChangeKind } from "./PatchChangeKind";
 export type { PlanDeltaNotification } from "./PlanDeltaNotification";
+export type { PluginInstallParams } from "./PluginInstallParams";
+export type { PluginInstallResponse } from "./PluginInstallResponse";
+export type { PluginListParams } from "./PluginListParams";
+export type { PluginListResponse } from "./PluginListResponse";
+export type { PluginMarketplaceEntry } from "./PluginMarketplaceEntry";
+export type { PluginSource } from "./PluginSource";
+export type { PluginSummary } from "./PluginSummary";
 export type { ProductSurface } from "./ProductSurface";
 export type { ProfileV2 } from "./ProfileV2";
 export type { RateLimitSnapshot } from "./RateLimitSnapshot";
@@ -150,6 +158,7 @@ export type { SkillInterface } from "./SkillInterface";
 export type { SkillMetadata } from "./SkillMetadata";
 export type { SkillScope } from "./SkillScope";
 export type { SkillToolDependency } from "./SkillToolDependency";
+export type { SkillsChangedNotification } from "./SkillsChangedNotification";
 export type { SkillsConfigWriteParams } from "./SkillsConfigWriteParams";
 export type { SkillsConfigWriteResponse } from "./SkillsConfigWriteResponse";
 export type { SkillsListEntry } from "./SkillsListEntry";
@@ -179,6 +188,9 @@ export type { ThreadListParams } from "./ThreadListParams";
 export type { ThreadListResponse } from "./ThreadListResponse";
 export type { ThreadLoadedListParams } from "./ThreadLoadedListParams";
 export type { ThreadLoadedListResponse } from "./ThreadLoadedListResponse";
+export type { ThreadMetadataGitInfoUpdateParams } from "./ThreadMetadataGitInfoUpdateParams";
+export type { ThreadMetadataUpdateParams } from "./ThreadMetadataUpdateParams";
+export type { ThreadMetadataUpdateResponse } from "./ThreadMetadataUpdateResponse";
 export type { ThreadNameUpdatedNotification } from "./ThreadNameUpdatedNotification";
 export type { ThreadReadParams } from "./ThreadReadParams";
 export type { ThreadReadResponse } from "./ThreadReadResponse";
--- a/codex-rs/app-server-protocol/src/bin/export.rs
+++ b/codex-rs/app-server-protocol/src/bin/export.rs
@@ -14,9 +14,21 @@ struct Args {
    /// Optional Prettier executable path to format generated TypeScript files
    #[arg(short = 'p', long = "prettier", value_name = "PRETTIER_BIN")]
    prettier: Option<PathBuf>,
+
+    /// Include experimental API methods and fields in generated output.
+    #[arg(long = "experimental")]
+    experimental: bool,
 }

 fn main() -> Result<()> {
    let args = Args::parse();
-    codex_app_server_protocol::generate_types(&args.out_dir, args.prettier.as_deref())
+    codex_app_server_protocol::generate_ts_with_options(
+        &args.out_dir,
+        args.prettier.as_deref(),
+        codex_app_server_protocol::GenerateTsOptions {
+            experimental_api: args.experimental,
+            ..codex_app_server_protocol::GenerateTsOptions::default()
+        },
+    )?;
+    codex_app_server_protocol::generate_json_with_experimental(&args.out_dir, args.experimental)
 }
--- a/codex-rs/app-server-protocol/src/export.rs
+++ b/codex-rs/app-server-protocol/src/export.rs
@@ -37,36 +37,17 @@ use ts_rs::TS;
 const HEADER: &str = "// GENERATED CODE! DO NOT MODIFY BY HAND!\n\n";
 const IGNORED_DEFINITIONS: &[&str] = &["Option<()>"];
 const JSON_V1_ALLOWLIST: &[&str] = &["InitializeParams", "InitializeResponse"];
-const V1_CLIENT_REQUEST_METHODS: &[&str] = &[
-    "newConversation",
-    "getConversationSummary",
-    "listConversations",
-    "resumeConversation",
-    "forkConversation",
-    "archiveConversation",
-    "sendUserMessage",
-    "sendUserTurn",
-    "interruptConversation",
-    "addConversationListener",
-    "removeConversationListener",
-    "gitDiffToRemote",
-    "loginApiKey",
-    "loginChatGpt",
-    "cancelLoginChatGpt",
-    "logoutChatGpt",
-    "getAuthStatus",
-    "getUserSavedConfig",
-    "setDefaultModel",
-    "getUserAgent",
-    "userInfo",
-    "execOneOffCommand",
-];
-const EXCLUDED_SERVER_NOTIFICATION_METHODS_FOR_JSON: &[&str] = &[
-    "authStatusChange",
-    "loginChatGptComplete",
-    "sessionConfigured",
-    "rawResponseItem/completed",
+const SPECIAL_DEFINITIONS: &[&str] = &[
+    "ClientNotification",
+    "ClientRequest",
+    "EventMsg",
+    "ServerNotification",
+    "ServerRequest",
 ];
+const FLAT_V2_SHARED_DEFINITIONS: &[&str] = &["ClientRequest", "EventMsg", "ServerNotification"];
+const V1_CLIENT_REQUEST_METHODS: &[&str] =
+    &["getConversationSummary", "gitDiffToRemote", "getAuthStatus"];
+const EXCLUDED_SERVER_NOTIFICATION_METHODS_FOR_JSON: &[&str] = &["rawResponseItem/completed"];

 #[derive(Clone)]
 pub struct GeneratedSchema {
@@ -136,6 +117,7 @@ pub fn generate_ts_with_options(
    ServerRequest::export_all_to(out_dir)?;
    export_server_responses(out_dir)?;
    ServerNotification::export_all_to(out_dir)?;
+    EventMsg::export_all_to(out_dir)?;

    if !options.experimental_api {
        filter_experimental_ts(out_dir)?;
@@ -223,6 +205,11 @@ pub fn generate_json_with_experimental(out_dir: &Path, experimental_api: bool) -
        out_dir.join("codex_app_server_protocol.schemas.json"),
        &bundle,
    )?;
+    let flat_v2_bundle = build_flat_v2_schema(&bundle)?;
+    write_pretty_json(
+        out_dir.join("codex_app_server_protocol.v2.schemas.json"),
+        &flat_v2_bundle,
+    )?;

    if !experimental_api {
        filter_experimental_json_files(out_dir)?;
@@ -870,14 +857,6 @@ impl Depth {
 }

 fn build_schema_bundle(schemas: Vec<GeneratedSchema>) -> Result<Value> {
-    const SPECIAL_DEFINITIONS: &[&str] = &[
-        "ClientNotification",
-        "ClientRequest",
-        "EventMsg",
-        "ServerNotification",
-        "ServerRequest",
-    ];
-
    let namespaced_types = collect_namespaced_types(&schemas);
    let mut definitions = Map::new();

@@ -895,6 +874,8 @@ fn build_schema_bundle(schemas: Vec<GeneratedSchema>) -> Result<Value> {

        if let Some(ref ns) = namespace {
            rewrite_refs_to_namespace(&mut value, ns);
+        } else {
+            rewrite_refs_to_known_namespaces(&mut value, &namespaced_types);
        }

        let mut forced_namespace_refs: Vec<(String, String)> = Vec::new();
@@ -958,6 +939,210 @@ fn build_schema_bundle(schemas: Vec<GeneratedSchema>) -> Result<Value> {
    Ok(Value::Object(root))
 }

+/// Build a datamodel-code-generator-friendly v2 bundle from the mixed export.
+///
+/// The full bundle keeps v2 schemas nested under `definitions.v2`, plus a few
+/// shared root definitions like `ClientRequest`, `EventMsg`, and
+/// `ServerNotification`. Python codegen only walks one definitions map level, so
+/// a direct feed would treat `v2` itself as a schema and miss unreferenced v2
+/// leaves. This helper flattens all v2 definitions to the root definitions map,
+/// then pulls in the shared root schemas and any non-v2 transitive deps they
+/// still reference. Keep the shared root unions intact here: some valid
+/// request/notification/event variants are inline or only reference shared root
+/// helpers, so filtering them by the presence of a `#/definitions/v2/` ref
+/// would silently drop real API surface from the flat bundle.
+fn build_flat_v2_schema(bundle: &Value) -> Result<Value> {
+    let Value::Object(root) = bundle else {
+        return Err(anyhow!("expected bundle root to be an object"));
+    };
+    let definitions = root
+        .get("definitions")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("expected bundle definitions map"))?;
+    let v2_definitions = definitions
+        .get("v2")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("expected v2 namespace in bundle definitions"))?;
+
+    let mut flat_root = root.clone();
+    let title = root
+        .get("title")
+        .and_then(Value::as_str)
+        .unwrap_or("CodexAppServerProtocol");
+    let mut flat_definitions = v2_definitions.clone();
+    let mut shared_definitions = Map::new();
+    let mut non_v2_refs = HashSet::new();
+
+    for shared in FLAT_V2_SHARED_DEFINITIONS {
+        let Some(shared_schema) = definitions.get(*shared) else {
+            continue;
+        };
+        let shared_schema = shared_schema.clone();
+        non_v2_refs.extend(collect_non_v2_refs(&shared_schema));
+        shared_definitions.insert((*shared).to_string(), shared_schema);
+    }
+
+    for name in collect_definition_dependencies(definitions, non_v2_refs) {
+        if name == "v2" || flat_definitions.contains_key(&name) {
+            continue;
+        }
+        if let Some(schema) = definitions.get(&name) {
+            flat_definitions.insert(name, schema.clone());
+        }
+    }
+
+    flat_definitions.extend(shared_definitions);
+    flat_root.insert("title".to_string(), Value::String(format!("{title}V2")));
+    flat_root.insert("definitions".to_string(), Value::Object(flat_definitions));
+    let mut flat_bundle = Value::Object(flat_root);
+    rewrite_ref_prefix(&mut flat_bundle, "#/definitions/v2/", "#/definitions/");
+    ensure_no_ref_prefix(&flat_bundle, "#/definitions/v2/", "flat v2")?;
+    ensure_referenced_definitions_present(&flat_bundle, "flat v2")?;
+    Ok(flat_bundle)
+}
+
+fn collect_non_v2_refs(value: &Value) -> HashSet<String> {
+    let mut refs = HashSet::new();
+    collect_non_v2_refs_inner(value, &mut refs);
+    refs
+}
+
+fn collect_non_v2_refs_inner(value: &Value, refs: &mut HashSet<String>) {
+    match value {
+        Value::Object(obj) => {
+            if let Some(Value::String(reference)) = obj.get("$ref")
+                && let Some(name) = reference.strip_prefix("#/definitions/")
+                && !reference.starts_with("#/definitions/v2/")
+            {
+                refs.insert(name.to_string());
+            }
+            for child in obj.values() {
+                collect_non_v2_refs_inner(child, refs);
+            }
+        }
+        Value::Array(items) => {
+            for child in items {
+                collect_non_v2_refs_inner(child, refs);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn collect_definition_dependencies(
+    definitions: &Map<String, Value>,
+    names: HashSet<String>,
+) -> HashSet<String> {
+    let mut seen = HashSet::new();
+    let mut to_process: Vec<String> = names.into_iter().collect();
+    while let Some(name) = to_process.pop() {
+        if !seen.insert(name.clone()) {
+            continue;
+        }
+        let Some(schema) = definitions.get(&name) else {
+            continue;
+        };
+        for dep in collect_non_v2_refs(schema) {
+            if !seen.contains(&dep) {
+                to_process.push(dep);
+            }
+        }
+    }
+    seen
+}
+
+fn rewrite_ref_prefix(value: &mut Value, prefix: &str, replacement: &str) {
+    match value {
+        Value::Object(obj) => {
+            if let Some(Value::String(reference)) = obj.get_mut("$ref") {
+                *reference = reference.replace(prefix, replacement);
+            }
+            for child in obj.values_mut() {
+                rewrite_ref_prefix(child, prefix, replacement);
+            }
+        }
+        Value::Array(items) => {
+            for child in items {
+                rewrite_ref_prefix(child, prefix, replacement);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn ensure_no_ref_prefix(value: &Value, prefix: &str, label: &str) -> Result<()> {
+    if let Some(reference) = first_ref_with_prefix(value, prefix) {
+        return Err(anyhow!(
+            "{label} schema still references namespaced definitions; found {reference}"
+        ));
+    }
+    Ok(())
+}
+
+fn first_ref_with_prefix(value: &Value, prefix: &str) -> Option<String> {
+    match value {
+        Value::Object(obj) => {
+            if let Some(Value::String(reference)) = obj.get("$ref")
+                && reference.starts_with(prefix)
+            {
+                return Some(reference.clone());
+            }
+            obj.values()
+                .find_map(|child| first_ref_with_prefix(child, prefix))
+        }
+        Value::Array(items) => items
+            .iter()
+            .find_map(|child| first_ref_with_prefix(child, prefix)),
+        _ => None,
+    }
+}
+
+fn ensure_referenced_definitions_present(schema: &Value, label: &str) -> Result<()> {
+    let definitions = schema
+        .get("definitions")
+        .and_then(Value::as_object)
+        .ok_or_else(|| anyhow!("expected definitions map in {label} schema"))?;
+    let mut missing = HashSet::new();
+    collect_missing_definitions(schema, definitions, &mut missing);
+    if missing.is_empty() {
+        return Ok(());
+    }
+    let mut missing_names: Vec<String> = missing.into_iter().collect();
+    missing_names.sort();
+    Err(anyhow!(
+        "{label} schema missing definitions: {}",
+        missing_names.join(", ")
+    ))
+}
+
+fn collect_missing_definitions(
+    value: &Value,
+    definitions: &Map<String, Value>,
+    missing: &mut HashSet<String>,
+) {
+    match value {
+        Value::Object(obj) => {
+            if let Some(Value::String(reference)) = obj.get("$ref")
+                && let Some(name) = reference.strip_prefix("#/definitions/")
+            {
+                let name = name.split('/').next().unwrap_or(name);
+                if !definitions.contains_key(name) {
+                    missing.insert(name.to_string());
+                }
+            }
+            for child in obj.values() {
+                collect_missing_definitions(child, definitions, missing);
+            }
+        }
+        Value::Array(items) => {
+            for child in items {
+                collect_missing_definitions(child, definitions, missing);
+            }
+        }
+        _ => {}
+    }
+}
+
 fn insert_into_namespace(
    definitions: &mut Map<String, Value>,
    namespace: &str,
@@ -1230,6 +1415,43 @@ fn rewrite_refs_to_namespace(value: &mut Value, ns: &str) {
    }
 }

+/// Recursively rewrite bare root definition refs to the namespace that owns the
+/// referenced type in the bundle.
+///
+/// The mixed export contains shared root helper schemas that are intentionally
+/// left outside the `v2` namespace, but some of their extracted child
+/// definitions still contain refs like `#/definitions/ThreadId`. When the real
+/// schema only exists under `#/definitions/v2/ThreadId`, those refs become
+/// dangling and downstream codegen falls back to placeholder `Any` models. This
+/// rewrite keeps the shared helpers at the root while retargeting their refs to
+/// the namespaced definitions that actually exist.
+fn rewrite_refs_to_known_namespaces(value: &mut Value, types: &HashMap<String, String>) {
+    match value {
+        Value::Object(obj) => {
+            if let Some(Value::String(reference)) = obj.get_mut("$ref")
+                && let Some(suffix) = reference.strip_prefix("#/definitions/")
+            {
+                let (name, tail) = suffix
+                    .split_once('/')
+                    .map_or((suffix, None), |(name, tail)| (name, Some(tail)));
+                if let Some(ns) = namespace_for_definition(name, types) {
+                    let tail = tail.map_or(String::new(), |rest| format!("/{rest}"));
+                    *reference = format!("#/definitions/{ns}/{name}{tail}");
+                }
+            }
+            for v in obj.values_mut() {
+                rewrite_refs_to_known_namespaces(v, types);
+            }
+        }
+        Value::Array(items) => {
+            for v in items.iter_mut() {
+                rewrite_refs_to_known_namespaces(v, types);
+            }
+        }
+        _ => {}
+    }
+}
+
 fn collect_namespaced_types(schemas: &[GeneratedSchema]) -> HashMap<String, String> {
    let mut types = HashMap::new();
    for schema in schemas {
@@ -1689,6 +1911,7 @@ mod tests {
            client_request_ts.contains("MockExperimentalMethodParams"),
            false
        );
+        assert_eq!(output_dir.join("EventMsg.ts").exists(), true);
        let thread_start_ts =
            fs::read_to_string(output_dir.join("v2").join("ThreadStartParams.ts"))?;
        assert_eq!(thread_start_ts.contains("mockExperimentalField"), false);
@@ -1986,6 +2209,284 @@ mod tests {
        Ok(())
    }

+    #[test]
+    fn build_schema_bundle_rewrites_root_helper_refs_to_namespaced_defs() -> Result<()> {
+        let bundle = build_schema_bundle(vec![
+            GeneratedSchema {
+                namespace: None,
+                logical_name: "LegacyEnvelope".to_string(),
+                in_v1_dir: false,
+                value: serde_json::json!({
+                    "title": "LegacyEnvelope",
+                    "type": "object",
+                    "properties": {
+                        "current_thread": { "$ref": "#/definitions/ThreadId" },
+                        "turn_item": { "$ref": "#/definitions/TurnItem" }
+                    },
+                    "definitions": {
+                        "TurnItem": {
+                            "type": "object",
+                            "properties": {
+                                "thread_id": { "$ref": "#/definitions/ThreadId" },
+                                "phase": { "$ref": "#/definitions/MessagePhase" },
+                                "content": {
+                                    "type": "array",
+                                    "items": { "$ref": "#/definitions/UserInput" }
+                                }
+                            }
+                        }
+                    }
+                }),
+            },
+            GeneratedSchema {
+                namespace: Some("v2".to_string()),
+                logical_name: "ThreadId".to_string(),
+                in_v1_dir: false,
+                value: serde_json::json!({
+                    "title": "ThreadId",
+                    "type": "string"
+                }),
+            },
+            GeneratedSchema {
+                namespace: Some("v2".to_string()),
+                logical_name: "MessagePhase".to_string(),
+                in_v1_dir: false,
+                value: serde_json::json!({
+                    "title": "MessagePhase",
+                    "type": "string"
+                }),
+            },
+            GeneratedSchema {
+                namespace: Some("v2".to_string()),
+                logical_name: "UserInput".to_string(),
+                in_v1_dir: false,
+                value: serde_json::json!({
+                    "title": "UserInput",
+                    "type": "string"
+                }),
+            },
+        ])?;
+
+        assert_eq!(
+            bundle["definitions"]["LegacyEnvelope"]["properties"]["current_thread"]["$ref"],
+            serde_json::json!("#/definitions/v2/ThreadId")
+        );
+        assert_eq!(
+            bundle["definitions"]["LegacyEnvelope"]["properties"]["turn_item"]["$ref"],
+            serde_json::json!("#/definitions/TurnItem")
+        );
+        assert_eq!(
+            bundle["definitions"]["TurnItem"]["properties"]["thread_id"]["$ref"],
+            serde_json::json!("#/definitions/v2/ThreadId")
+        );
+        assert_eq!(
+            bundle["definitions"]["TurnItem"]["properties"]["phase"]["$ref"],
+            serde_json::json!("#/definitions/v2/MessagePhase")
+        );
+        assert_eq!(
+            bundle["definitions"]["TurnItem"]["properties"]["content"]["items"]["$ref"],
+            serde_json::json!("#/definitions/v2/UserInput")
+        );
+
+        Ok(())
+    }
+
+    #[test]
+    fn build_flat_v2_schema_keeps_shared_root_schemas_and_dependencies() -> Result<()> {
+        let bundle = serde_json::json!({
+            "$schema": "http://json-schema.org/draft-07/schema#",
+            "title": "CodexAppServerProtocol",
+            "type": "object",
+            "definitions": {
+                "ClientRequest": {
+                    "oneOf": [
+                        {
+                            "title": "StartRequest",
+                            "type": "object",
+                            "properties": {
+                                "params": { "$ref": "#/definitions/v2/ThreadStartParams" },
+                                "shared": { "$ref": "#/definitions/SharedHelper" }
+                            }
+                        },
+                        {
+                            "title": "InitializeRequest",
+                            "type": "object",
+                            "properties": {
+                                "params": { "$ref": "#/definitions/InitializeParams" }
+                            }
+                        },
+                        {
+                            "title": "LogoutRequest",
+                            "type": "object",
+                            "properties": {
+                                "params": { "type": "null" }
+                            }
+                        }
+                    ]
+                },
+                "EventMsg": {
+                    "oneOf": [
+                        { "$ref": "#/definitions/v2/ThreadStartedEventMsg" },
+                        {
+                            "title": "WarningEventMsg",
+                            "type": "object",
+                            "properties": {
+                                "message": { "type": "string" },
+                                "type": {
+                                    "enum": ["warning"],
+                                    "type": "string"
+                                }
+                            },
+                            "required": ["message", "type"]
+                        }
+                    ]
+                },
+                "ServerNotification": {
+                    "oneOf": [
+                        { "$ref": "#/definitions/v2/ThreadStartedNotification" },
+                        {
+                            "title": "ServerRequestResolvedNotification",
+                            "type": "object",
+                            "properties": {
+                                "params": { "$ref": "#/definitions/ServerRequestResolvedNotificationPayload" }
+                            }
+                        }
+                    ]
+                },
+                "SharedHelper": {
+                    "type": "object",
+                    "properties": {
+                        "leaf": { "$ref": "#/definitions/SharedLeaf" }
+                    }
+                },
+                "SharedLeaf": {
+                    "title": "SharedLeaf",
+                    "type": "string"
+                },
+                "InitializeParams": {
+                    "title": "InitializeParams",
+                    "type": "string"
+                },
+                "ServerRequestResolvedNotificationPayload": {
+                    "title": "ServerRequestResolvedNotificationPayload",
+                    "type": "string"
+                },
+                "v2": {
+                    "ThreadStartParams": {
+                        "title": "ThreadStartParams",
+                        "type": "object",
+                        "properties": {
+                            "cwd": { "type": "string" }
+                        }
+                    },
+                    "ThreadStartResponse": {
+                        "title": "ThreadStartResponse",
+                        "type": "object",
+                        "properties": {
+                            "ok": { "type": "boolean" }
+                        }
+                    },
+                    "ThreadStartedEventMsg": {
+                        "title": "ThreadStartedEventMsg",
+                        "type": "object",
+                        "properties": {
+                            "thread_id": { "type": "string" }
+                        }
+                    },
+                    "ThreadStartedNotification": {
+                        "title": "ThreadStartedNotification",
+                        "type": "object",
+                        "properties": {
+                            "thread_id": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        });
+
+        let flat_bundle = build_flat_v2_schema(&bundle)?;
+        let definitions = flat_bundle["definitions"]
+            .as_object()
+            .expect("flat v2 schema should include definitions");
+
+        assert_eq!(
+            flat_bundle["title"],
+            serde_json::json!("CodexAppServerProtocolV2")
+        );
+        assert_eq!(definitions.contains_key("v2"), false);
+        assert_eq!(definitions.contains_key("ThreadStartParams"), true);
+        assert_eq!(definitions.contains_key("ThreadStartResponse"), true);
+        assert_eq!(definitions.contains_key("ThreadStartedEventMsg"), true);
+        assert_eq!(definitions.contains_key("ThreadStartedNotification"), true);
+        assert_eq!(definitions.contains_key("SharedHelper"), true);
+        assert_eq!(definitions.contains_key("SharedLeaf"), true);
+        assert_eq!(definitions.contains_key("InitializeParams"), true);
+        assert_eq!(
+            definitions.contains_key("ServerRequestResolvedNotificationPayload"),
+            true
+        );
+        let client_request_titles: BTreeSet<String> = definitions["ClientRequest"]["oneOf"]
+            .as_array()
+            .expect("ClientRequest should remain a oneOf")
+            .iter()
+            .map(|variant| {
+                variant["title"]
+                    .as_str()
+                    .expect("ClientRequest variant should have a title")
+                    .to_string()
+            })
+            .collect();
+        assert_eq!(
+            client_request_titles,
+            BTreeSet::from([
+                "InitializeRequest".to_string(),
+                "LogoutRequest".to_string(),
+                "StartRequest".to_string(),
+            ])
+        );
+        let event_titles: BTreeSet<String> = definitions["EventMsg"]["oneOf"]
+            .as_array()
+            .expect("EventMsg should remain a oneOf")
+            .iter()
+            .map(|variant| {
+                variant
+                    .get("title")
+                    .and_then(Value::as_str)
+                    .unwrap_or_default()
+                    .to_string()
+            })
+            .collect();
+        assert_eq!(
+            event_titles,
+            BTreeSet::from(["".to_string(), "WarningEventMsg".to_string(),])
+        );
+        let notification_titles: BTreeSet<String> = definitions["ServerNotification"]["oneOf"]
+            .as_array()
+            .expect("ServerNotification should remain a oneOf")
+            .iter()
+            .map(|variant| {
+                variant
+                    .get("title")
+                    .and_then(Value::as_str)
+                    .unwrap_or_default()
+                    .to_string()
+            })
+            .collect();
+        assert_eq!(
+            notification_titles,
+            BTreeSet::from([
+                "".to_string(),
+                "ServerRequestResolvedNotification".to_string(),
+            ])
+        );
+        assert_eq!(
+            first_ref_with_prefix(&flat_bundle, "#/definitions/v2/").is_none(),
+            true
+        );
+
+        Ok(())
+    }
+
    #[test]
    fn experimental_type_fields_ts_filter_handles_interface_shape() -> Result<()> {
        let output_dir = std::env::temp_dir().join(format!("codex_ts_filter_{}", Uuid::now_v7()));
@@ -2114,6 +2615,99 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k
            bundle_json.contains("MockExperimentalMethodResponse"),
            false
        );
+        let flat_v2_bundle_json =
+            fs::read_to_string(output_dir.join("codex_app_server_protocol.v2.schemas.json"))?;
+        assert_eq!(flat_v2_bundle_json.contains("mockExperimentalField"), false);
+        assert_eq!(flat_v2_bundle_json.contains("additionalPermissions"), false);
+        assert_eq!(
+            flat_v2_bundle_json.contains("MockExperimentalMethodParams"),
+            false
+        );
+        assert_eq!(
+            flat_v2_bundle_json.contains("MockExperimentalMethodResponse"),
+            false
+        );
+        assert_eq!(flat_v2_bundle_json.contains("#/definitions/v2/"), false);
+        assert_eq!(
+            flat_v2_bundle_json.contains("\"title\": \"CodexAppServerProtocolV2\""),
+            true
+        );
+        let flat_v2_bundle =
+            read_json_value(&output_dir.join("codex_app_server_protocol.v2.schemas.json"))?;
+        let definitions = flat_v2_bundle["definitions"]
+            .as_object()
+            .expect("flat v2 bundle should include definitions");
+        let client_request_methods: BTreeSet<String> = definitions["ClientRequest"]["oneOf"]
+            .as_array()
+            .expect("flat v2 ClientRequest should remain a oneOf")
+            .iter()
+            .filter_map(|variant| {
+                variant["properties"]["method"]["enum"]
+                    .as_array()
+                    .and_then(|values| values.first())
+                    .and_then(Value::as_str)
+                    .map(str::to_string)
+            })
+            .collect();
+        let missing_client_request_methods: Vec<String> = [
+            "account/logout",
+            "account/rateLimits/read",
+            "config/mcpServer/reload",
+            "configRequirements/read",
+            "fuzzyFileSearch",
+            "initialize",
+        ]
+        .into_iter()
+        .filter(|method| !client_request_methods.contains(*method))
+        .map(str::to_string)
+        .collect();
+        assert_eq!(missing_client_request_methods, Vec::<String>::new());
+        let server_notification_methods: BTreeSet<String> =
+            definitions["ServerNotification"]["oneOf"]
+                .as_array()
+                .expect("flat v2 ServerNotification should remain a oneOf")
+                .iter()
+                .filter_map(|variant| {
+                    variant["properties"]["method"]["enum"]
+                        .as_array()
+                        .and_then(|values| values.first())
+                        .and_then(Value::as_str)
+                        .map(str::to_string)
+                })
+                .collect();
+        let missing_server_notification_methods: Vec<String> = [
+            "fuzzyFileSearch/sessionCompleted",
+            "fuzzyFileSearch/sessionUpdated",
+            "serverRequest/resolved",
+        ]
+        .into_iter()
+        .filter(|method| !server_notification_methods.contains(*method))
+        .map(str::to_string)
+        .collect();
+        assert_eq!(missing_server_notification_methods, Vec::<String>::new());
+        let event_types: BTreeSet<String> = definitions["EventMsg"]["oneOf"]
+            .as_array()
+            .expect("flat v2 EventMsg should remain a oneOf")
+            .iter()
+            .filter_map(|variant| {
+                variant["properties"]["type"]["enum"]
+                    .as_array()
+                    .and_then(|values| values.first())
+                    .and_then(Value::as_str)
+                    .map(str::to_string)
+            })
+            .collect();
+        let missing_event_types: Vec<String> = [
+            "agent_message_delta",
+            "task_complete",
+            "warning",
+            "web_search_begin",
+        ]
+        .into_iter()
+        .filter(|event_type| !event_types.contains(*event_type))
+        .map(str::to_string)
+        .collect();
+        assert_eq!(missing_event_types, Vec::<String>::new());
        assert_eq!(
            output_dir
                .join("v2")
--- a/Show More
+++ b/Show More