Add custom apply patch toggle

.github/workflows/rust-release.yml

@@ -167,12 +167,6 @@ jobs:
     needs: build
     name: release
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: read
-    outputs:
-      version: ${{ steps.release_name.outputs.name }}
-      tag: ${{ github.ref_name }}
 
     steps:
       - name: Checkout repository
@@ -226,48 +220,6 @@ jobs:
           tag: ${{ github.ref_name }}
           config: .github/dotslash-config.json
 
-  # Publish to npm using OIDC authentication.
-  # July 31, 2025: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
-  # npm docs: https://docs.npmjs.com/trusted-publishers
-  publish-npm:
-    # Skip this step for pre-releases (alpha/beta).
-    if: ${{ !contains(needs.release.outputs.version, '-') }}
-    name: publish-npm
-    needs: release
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write # Required for OIDC
-      contents: read
-
-    steps:
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          registry-url: "https://registry.npmjs.org"
-          scope: "@openai"
-
-      # Trusted publishing requires npm CLI version 11.5.1 or later.
-      - name: Update npm
-        run: npm install -g npm@latest
-
-      - name: Download npm tarball from release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          version="${{ needs.release.outputs.version }}"
-          tag="${{ needs.release.outputs.tag }}"
-          mkdir -p dist/npm
-          gh release download "$tag" \
-            --repo "${GITHUB_REPOSITORY}" \
-            --pattern "codex-npm-${version}.tgz" \
-            --dir dist/npm
-
-      # No NODE_AUTH_TOKEN needed because we use OIDC.
-      - name: Publish to npm
-        run: npm publish "${GITHUB_WORKSPACE}/dist/npm/codex-npm-${{ needs.release.outputs.version }}.tgz"
-
   update-branch:
     name: Update latest-alpha-cli branch
     permissions:

AGENTS.md

@@ -4,7 +4,6 @@ In the codex-rs folder where the rust code lives:
 
 - Crate names are prefixed with `codex-`. For example, the `core` folder's crate is named `codex-core`
 - When using format! and you can inline variables into {}, always do that.
-- Install any commands the repo relies on (for example `just`, `rg`, or `cargo-insta`) if they aren't already available before running instructions here.
 - Never add or modify any code related to `CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR` or `CODEX_SANDBOX_ENV_VAR`.
   - You operate in a sandbox where `CODEX_SANDBOX_NETWORK_DISABLED=1` will be set whenever you use the `shell` tool. Any existing code that uses `CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR` was authored with this fact in mind. It is often used to early exit out of tests that the author knew you would not be able to run given your sandbox limitations.
   - Similarly, when you spawn a process using Seatbelt (`/usr/bin/sandbox-exec`), `CODEX_SANDBOX=seatbelt` will be set on the child process. Integration tests that want to run Seatbelt themselves cannot be run under Seatbelt, so checks for `CODEX_SANDBOX=seatbelt` are also often used to early exit out of tests, as appropriate.

codex-cli/package.json

@@ -15,8 +15,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/openai/codex.git",
-    "directory": "codex-cli"
+    "url": "git+https://github.com/openai/codex.git"
   },
   "dependencies": {
     "@vscode/ripgrep": "^1.15.14"

codex-rs/Cargo.lock

@@ -407,7 +407,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
 dependencies = [
  "memchr",
- "regex-automata",
+ "regex-automata 0.4.9",
  "serde",
 ]
 
@@ -625,7 +625,6 @@ name = "codex-cli"
 version = "0.0.0"
 dependencies = [
  "anyhow",
- "assert_cmd",
  "clap",
  "clap_complete",
  "codex-arg0",
@@ -638,12 +637,7 @@ dependencies = [
  "codex-protocol",
  "codex-protocol-ts",
  "codex-tui",
- "owo-colors",
- "predicates",
- "pretty_assertions",
  "serde_json",
- "supports-color",
- "tempfile",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -689,7 +683,7 @@ dependencies = [
  "portable-pty",
  "predicates",
  "pretty_assertions",
- "rand",
+ "rand 0.9.2",
  "regex-lite",
  "reqwest",
  "seccompiler",
@@ -799,8 +793,7 @@ dependencies = [
  "chrono",
  "codex-core",
  "codex-protocol",
- "core_test_support",
- "rand",
+ "rand 0.8.5",
  "reqwest",
  "serde",
  "serde_json",
@@ -838,7 +831,6 @@ dependencies = [
  "codex-core",
  "codex-login",
  "codex-protocol",
- "core_test_support",
  "mcp-types",
  "mcp_test_support",
  "os_info",
@@ -925,7 +917,6 @@ dependencies = [
  "color-eyre",
  "crossterm",
  "diffy",
- "dirs",
  "image",
  "insta",
  "itertools 0.14.0",
@@ -937,7 +928,7 @@ dependencies = [
  "pathdiff",
  "pretty_assertions",
  "pulldown-cmark",
- "rand",
+ "rand 0.9.2",
  "ratatui",
  "regex-lite",
  "serde",
@@ -1080,7 +1071,6 @@ dependencies = [
  "serde_json",
  "tempfile",
  "tokio",
- "wiremock",
 ]
 
 [[package]]
@@ -1333,7 +1323,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b545b8c50194bdd008283985ab0b31dba153cfd5b3066a92770634fbc0d7d291"
 dependencies = [
- "nu-ansi-term",
+ "nu-ansi-term 0.50.1",
 ]
 
 [[package]]
@@ -1915,7 +1905,7 @@ dependencies = [
  "aho-corasick",
  "bstr",
  "log",
- "regex-automata",
+ "regex-automata 0.4.9",
  "regex-syntax 0.8.5",
 ]
 
@@ -2330,7 +2320,7 @@ dependencies = [
  "globset",
  "log",
  "memchr",
- "regex-automata",
+ "regex-automata 0.4.9",
  "same-file",
  "walkdir",
  "winapi-util",
@@ -2715,11 +2705,11 @@ checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
 
 [[package]]
 name = "matchers"
-version = "0.2.0"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
 dependencies = [
- "regex-automata",
+ "regex-automata 0.1.10",
 ]
 
 [[package]]
@@ -2893,6 +2883,16 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.1"
@@ -3131,6 +3131,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
 [[package]]
 name = "owo-colors"
 version = "4.2.2"
@@ -3455,14 +3461,35 @@ dependencies = [
  "nibble_vec",
 ]
 
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "rand"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -3472,7 +3499,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.16",
 ]
 
 [[package]]
@@ -3563,10 +3599,19 @@ checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata",
+ "regex-automata 0.4.9",
  "regex-syntax 0.8.5",
 ]
 
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
+
 [[package]]
 name = "regex-automata"
 version = "0.4.9"
@@ -3901,28 +3946,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.224"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aaeb1e94f53b16384af593c71e20b095e958dab1d26939c1b70645c5cfbcc0b"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.224"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f39390fa6346e24defbcdd3d9544ba8a19985d0af74df8501fbfe9a64341ab"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.224"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ff78ab5e8561c9a675bfc1785cb07ae721f0ee53329a595cefd8c04c2ac4e0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3942,16 +3977,15 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.143"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "d401abef1d108fbd9cbaebc3e46611f4b1021f714a0597a71f41ee463f5f4a5a"
 dependencies = [
  "indexmap 2.10.0",
  "itoa",
  "memchr",
  "ryu",
  "serde",
- "serde_core",
 ]
 
 [[package]]
@@ -4138,9 +4172,9 @@ checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
 
 [[package]]
 name = "smallvec"
@@ -4872,14 +4906,14 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.20"
+version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
 dependencies = [
  "matchers",
- "nu-ansi-term",
+ "nu-ansi-term 0.46.0",
  "once_cell",
- "regex-automata",
+ "regex",
  "sharded-slab",
  "smallvec",
  "thread_local",
@@ -5267,9 +5301,9 @@ dependencies = [
 
 [[package]]
 name = "wildmatch"
-version = "2.5.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39b7d07a236abaef6607536ccfaf19b396dbe3f5110ddb73d39f4562902ed382"
+checksum = "68ce1ab1f8c62655ebe1350f589c61e505cf94d385bc6a12899442d9081e71fd"
 
 [[package]]
 name = "winapi"

codex-rs/Cargo.toml

@@ -29,167 +29,15 @@ version = "0.0.0"
 # edition.
 edition = "2024"
 
-[workspace.dependencies]
-# Internal
-codex-ansi-escape = { path = "ansi-escape" }
-codex-apply-patch = { path = "apply-patch" }
-codex-arg0 = { path = "arg0" }
-codex-chatgpt = { path = "chatgpt" }
-codex-common = { path = "common" }
-codex-core = { path = "core" }
-codex-exec = { path = "exec" }
-codex-file-search = { path = "file-search" }
-codex-linux-sandbox = { path = "linux-sandbox" }
-codex-login = { path = "login" }
-codex-mcp-client = { path = "mcp-client" }
-codex-mcp-server = { path = "mcp-server" }
-codex-ollama = { path = "ollama" }
-codex-protocol = { path = "protocol" }
-codex-protocol-ts = { path = "protocol-ts" }
-codex-tui = { path = "tui" }
-core_test_support = { path = "core/tests/common" }
-mcp-types = { path = "mcp-types" }
-mcp_test_support = { path = "mcp-server/tests/common" }
-
-# External
-allocative = "0.3.3"
-ansi-to-tui = "7.0.0"
-anyhow = "1"
-arboard = "3"
-askama = "0.12"
-assert_cmd = "2"
-async-channel = "2.3.1"
-async-stream = "0.3.6"
-base64 = "0.22.1"
-bytes = "1.10.1"
-chrono = "0.4.40"
-clap = "4"
-clap_complete = "4"
-color-eyre = "0.6.3"
-crossterm = "0.28.1"
-derive_more = "2"
-diffy = "0.4.2"
-dirs = "6"
-dotenvy = "0.15.7"
-env-flags = "0.1.1"
-env_logger = "0.11.5"
-eventsource-stream = "0.2.3"
-futures = "0.3"
-icu_decimal = "2.0.0"
-icu_locale_core = "2.0.0"
-ignore = "0.4.23"
-image = { version = "^0.25.8", default-features = false }
-insta = "1.43.2"
-itertools = "0.14.0"
-landlock = "0.4.1"
-lazy_static = "1"
-libc = "0.2.175"
-log = "0.4"
-maplit = "1.0.2"
-mime_guess = "2.0.5"
-multimap = "0.10.0"
-nucleo-matcher = "0.3.1"
-once_cell = "1"
-openssl-sys = "*"
-os_info = "3.12.0"
-owo-colors = "4.2.0"
-path-absolutize = "3.1.1"
-path-clean = "1.0.1"
-pathdiff = "0.2"
-portable-pty = "0.9.0"
-predicates = "3"
-pretty_assertions = "1.4.1"
-pulldown-cmark = "0.10"
-rand = "0.9"
-ratatui = "0.29.0"
-regex-lite = "0.1.7"
-reqwest = "0.12"
-schemars = "0.8.22"
-seccompiler = "0.5.0"
-serde = "1"
-serde_json = "1"
-serde_with = "3.14"
-sha1 = "0.10.6"
-sha2 = "0.10"
-shlex = "1.3.0"
-similar = "2.7.0"
-starlark = "0.13.0"
-strum = "0.27.2"
-strum_macros = "0.27.2"
-supports-color = "3.0.2"
-sys-locale = "0.3.2"
-tempfile = "3.13.0"
-textwrap = "0.16.2"
-thiserror = "2.0.16"
-time = "0.3"
-tiny_http = "0.12"
-tokio = "1"
-tokio-stream = "0.1.17"
-tokio-test = "0.4"
-tokio-util = "0.7.16"
-toml = "0.9.5"
-toml_edit = "0.23.4"
-tracing = "0.1.41"
-tracing-appender = "0.2.3"
-tracing-subscriber = "0.3.20"
-tree-sitter = "0.25.9"
-tree-sitter-bash = "0.25.0"
-ts-rs = "11"
-unicode-segmentation = "1.12.0"
-unicode-width = "0.1"
-url = "2"
-urlencoding = "2.1"
-uuid = "1"
-vt100 = "0.16.2"
-walkdir = "2.5.0"
-webbrowser = "1.0"
-which = "6"
-wildmatch = "2.5.0"
-wiremock = "0.6"
-
 [workspace.lints]
 rust = {}
 
 [workspace.lints.clippy]
 expect_used = "deny"
-identity_op = "deny"
-manual_clamp = "deny"
-manual_filter = "deny"
-manual_find = "deny"
-manual_flatten = "deny"
-manual_map = "deny"
-manual_memcpy = "deny"
-manual_non_exhaustive = "deny"
-manual_ok_or = "deny"
-manual_range_contains = "deny"
-manual_retain = "deny"
-manual_strip = "deny"
-manual_try_fold = "deny"
-manual_unwrap_or = "deny"
-needless_borrow = "deny"
-needless_borrowed_reference = "deny"
-needless_collect = "deny"
-needless_late_init = "deny"
-needless_option_as_deref = "deny"
-needless_question_mark = "deny"
-needless_update = "deny"
 redundant_clone = "deny"
-redundant_closure = "deny"
-redundant_closure_for_method_calls = "deny"
-redundant_static_lifetimes = "deny"
-trivially_copy_pass_by_ref = "deny"
 uninlined_format_args = "deny"
-unnecessary_filter_map = "deny"
-unnecessary_lazy_evaluations = "deny"
-unnecessary_sort_by = "deny"
-unnecessary_to_owned = "deny"
 unwrap_used = "deny"
 
-# cargo-shear cannot see the platform-specific openssl-sys usage, so we
-# silence the false positive here instead of deleting a real dependency.
-[workspace.metadata.cargo-shear]
-ignored = ["openssl-sys"]
-
 [profile.release]
 lto = "fat"
 # Because we bundle some of these executables with the TypeScript CLI, we

codex-rs/ansi-escape/Cargo.toml

@@ -8,9 +8,9 @@ name = "codex_ansi_escape"
 path = "src/lib.rs"
 
 [dependencies]
-ansi-to-tui = { workspace = true }
-ratatui = { workspace = true, features = [
+ansi-to-tui = "7.0.0"
+ratatui = { version = "0.29.0", features = [
     "unstable-rendered-line-info",
     "unstable-widget-ref",
 ] }
-tracing = { workspace = true, features = ["log"] }
+tracing = { version = "0.1.41", features = ["log"] }

codex-rs/apply-patch/Cargo.toml

@@ -15,14 +15,14 @@ path = "src/main.rs"
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-similar = { workspace = true }
-thiserror = { workspace = true }
-tree-sitter = { workspace = true }
-tree-sitter-bash = { workspace = true }
-once_cell = { workspace = true }
+anyhow = "1"
+similar = "2.7.0"
+thiserror = "2.0.16"
+tree-sitter = "0.25.9"
+tree-sitter-bash = "0.25.0"
+once_cell = "1"
 
 [dev-dependencies]
-assert_cmd = { workspace = true }
-pretty_assertions = { workspace = true }
-tempfile = { workspace = true }
+assert_cmd = "2"
+pretty_assertions = "1.4.1"
+tempfile = "3.13.0"

codex-rs/apply-patch/src/lib.rs

@@ -648,18 +648,21 @@ fn derive_new_contents_from_chunks(
         }
     };
 
-    let mut original_lines: Vec<String> = original_contents.split('\n').map(String::from).collect();
+    let mut original_lines: Vec<String> = original_contents
+        .split('\n')
+        .map(|s| s.to_string())
+        .collect();
 
     // Drop the trailing empty element that results from the final newline so
     // that line counts match the behaviour of standard `diff`.
-    if original_lines.last().is_some_and(String::is_empty) {
+    if original_lines.last().is_some_and(|s| s.is_empty()) {
         original_lines.pop();
     }
 
     let replacements = compute_replacements(&original_lines, path, chunks)?;
     let new_lines = apply_replacements(original_lines, &replacements);
     let mut new_lines = new_lines;
-    if !new_lines.last().is_some_and(String::is_empty) {
+    if !new_lines.last().is_some_and(|s| s.is_empty()) {
         new_lines.push(String::new());
     }
     let new_contents = new_lines.join("\n");
@@ -703,7 +706,7 @@ fn compute_replacements(
         if chunk.old_lines.is_empty() {
             // Pure addition (no old lines). We'll add them at the end or just
             // before the final empty line if one exists.
-            let insertion_idx = if original_lines.last().is_some_and(String::is_empty) {
+            let insertion_idx = if original_lines.last().is_some_and(|s| s.is_empty()) {
                 original_lines.len() - 1
             } else {
                 original_lines.len()
@@ -729,11 +732,11 @@ fn compute_replacements(
 
         let mut new_slice: &[String] = &chunk.new_lines;
 
-        if found.is_none() && pattern.last().is_some_and(String::is_empty) {
+        if found.is_none() && pattern.last().is_some_and(|s| s.is_empty()) {
             // Retry without the trailing empty line which represents the final
             // newline in the file.
             pattern = &pattern[..pattern.len() - 1];
-            if new_slice.last().is_some_and(String::is_empty) {
+            if new_slice.last().is_some_and(|s| s.is_empty()) {
                 new_slice = &new_slice[..new_slice.len() - 1];
             }
 
@@ -845,7 +848,6 @@ mod tests {
     use super::*;
     use pretty_assertions::assert_eq;
     use std::fs;
-    use std::string::ToString;
     use tempfile::tempdir;
 
     /// Helper to construct a patch with the given body.
@@ -854,7 +856,7 @@ mod tests {
     }
 
     fn strs_to_strings(strs: &[&str]) -> Vec<String> {
-        strs.iter().map(ToString::to_string).collect()
+        strs.iter().map(|s| s.to_string()).collect()
     }
 
     // Test helpers to reduce repetition when building bash -lc heredoc scripts

codex-rs/apply-patch/src/seek_sequence.rs

@@ -112,10 +112,9 @@ pub(crate) fn seek_sequence(
 #[cfg(test)]
 mod tests {
     use super::seek_sequence;
-    use std::string::ToString;
 
     fn to_vec(strings: &[&str]) -> Vec<String> {
-        strings.iter().map(ToString::to_string).collect()
+        strings.iter().map(|s| s.to_string()).collect()
     }
 
     #[test]

codex-rs/arg0/Cargo.toml

@@ -11,10 +11,10 @@ path = "src/lib.rs"
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-codex-apply-patch = { workspace = true }
-codex-core = { workspace = true }
-codex-linux-sandbox = { workspace = true }
-dotenvy = { workspace = true }
-tempfile = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread"] }
+anyhow = "1"
+codex-apply-patch = { path = "../apply-patch" }
+codex-core = { path = "../core" }
+codex-linux-sandbox = { path = "../linux-sandbox" }
+dotenvy = "0.15.7"
+tempfile = "3"
+tokio = { version = "1", features = ["rt-multi-thread"] }

codex-rs/arg0/src/lib.rs

@@ -54,7 +54,7 @@ where
 
     let argv1 = args.next().unwrap_or_default();
     if argv1 == CODEX_APPLY_PATCH_ARG1 {
-        let patch_arg = args.next().and_then(|s| s.to_str().map(str::to_owned));
+        let patch_arg = args.next().and_then(|s| s.to_str().map(|s| s.to_owned()));
         let exit_code = match patch_arg {
             Some(patch_arg) => {
                 let mut stdout = std::io::stdout();

codex-rs/chatgpt/Cargo.toml

@@ -7,13 +7,13 @@ version = { workspace = true }
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-clap = { workspace = true, features = ["derive"] }
-codex-common = { workspace = true, features = ["cli"] }
-codex-core = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-tokio = { workspace = true, features = ["full"] }
+anyhow = "1"
+clap = { version = "4", features = ["derive"] }
+codex-common = { path = "../common", features = ["cli"] }
+codex-core = { path = "../core" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tokio = { version = "1", features = ["full"] }
 
 [dev-dependencies]
-tempfile = { workspace = true }
+tempfile = "3"

codex-rs/cli/Cargo.toml

@@ -15,34 +15,26 @@ path = "src/lib.rs"
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-clap = { workspace = true, features = ["derive"] }
-clap_complete = { workspace = true }
-codex-arg0 = { workspace = true }
-codex-chatgpt = { workspace = true }
-codex-common = { workspace = true, features = ["cli"] }
-codex-core = { workspace = true }
-codex-exec = { workspace = true }
-codex-login = { workspace = true }
-codex-mcp-server = { workspace = true }
-codex-protocol = { workspace = true }
-codex-protocol-ts = { workspace = true }
-codex-tui = { workspace = true }
-owo-colors = { workspace = true }
-serde_json = { workspace = true }
-supports-color = { workspace = true }
-tokio = { workspace = true, features = [
+anyhow = "1"
+clap = { version = "4", features = ["derive"] }
+clap_complete = "4"
+codex-arg0 = { path = "../arg0" }
+codex-chatgpt = { path = "../chatgpt" }
+codex-common = { path = "../common", features = ["cli"] }
+codex-core = { path = "../core" }
+codex-exec = { path = "../exec" }
+codex-login = { path = "../login" }
+codex-mcp-server = { path = "../mcp-server" }
+codex-protocol = { path = "../protocol" }
+codex-tui = { path = "../tui" }
+serde_json = "1"
+tokio = { version = "1", features = [
     "io-std",
     "macros",
     "process",
     "rt-multi-thread",
     "signal",
 ] }
-tracing = { workspace = true }
-tracing-subscriber = { workspace = true }
-
-[dev-dependencies]
-assert_cmd = { workspace = true }
-predicates = { workspace = true }
-pretty_assertions = { workspace = true }
-tempfile = { workspace = true }
+tracing = "0.1.41"
+tracing-subscriber = "0.3.19"
+codex-protocol-ts = { path = "../protocol-ts" }

codex-rs/cli/src/debug_sandbox.rs

@@ -64,6 +64,7 @@ async fn run_command_under_sandbox(
     sandbox_type: SandboxType,
 ) -> anyhow::Result<()> {
     let sandbox_mode = create_sandbox_mode(full_auto);
+    let cwd = std::env::current_dir()?;
     let config = Config::load_with_cli_overrides(
         config_overrides
             .parse_overrides()
@@ -74,29 +75,13 @@ async fn run_command_under_sandbox(
             ..Default::default()
         },
     )?;
-
-    // In practice, this should be `std::env::current_dir()` because this CLI
-    // does not support `--cwd`, but let's use the config value for consistency.
-    let cwd = config.cwd.clone();
-    // For now, we always use the same cwd for both the command and the
-    // sandbox policy. In the future, we could add a CLI option to set them
-    // separately.
-    let sandbox_policy_cwd = cwd.clone();
-
     let stdio_policy = StdioPolicy::Inherit;
     let env = create_env(&config.shell_environment_policy);
 
     let mut child = match sandbox_type {
         SandboxType::Seatbelt => {
-            spawn_command_under_seatbelt(
-                command,
-                cwd,
-                &config.sandbox_policy,
-                sandbox_policy_cwd.as_path(),
-                stdio_policy,
-                env,
-            )
-            .await?
+            spawn_command_under_seatbelt(command, &config.sandbox_policy, cwd, stdio_policy, env)
+                .await?
         }
         SandboxType::Landlock => {
             #[expect(clippy::expect_used)]
@@ -106,9 +91,8 @@ async fn run_command_under_sandbox(
             spawn_command_under_linux_sandbox(
                 codex_linux_sandbox_exe,
                 command,
-                cwd,
                 &config.sandbox_policy,
-                sandbox_policy_cwd.as_path(),
+                cwd,
                 stdio_policy,
                 env,
             )

codex-rs/cli/src/main.rs

@@ -14,15 +14,9 @@ use codex_cli::login::run_logout;
 use codex_cli::proto;
 use codex_common::CliConfigOverrides;
 use codex_exec::Cli as ExecCli;
-use codex_tui::AppExitInfo;
 use codex_tui::Cli as TuiCli;
-use owo_colors::OwoColorize;
 use std::path::PathBuf;
-use supports_color::Stream;
 
-mod mcp_cmd;
-
-use crate::mcp_cmd::McpCli;
 use crate::proto::ProtoCli;
 
 /// Codex CLI
@@ -62,8 +56,8 @@ enum Subcommand {
     /// Remove stored authentication credentials.
     Logout(LogoutCommand),
 
-    /// [experimental] Run Codex as an MCP server and manage MCP servers.
-    Mcp(McpCli),
+    /// Experimental: run Codex as an MCP server.
+    Mcp,
 
     /// Run the Protocol stream via stdin/stdout
     #[clap(visible_alias = "p")]
@@ -104,9 +98,6 @@ struct ResumeCommand {
     /// Continue the most recent session without showing the picker.
     #[arg(long = "last", default_value_t = false, conflicts_with = "session_id")]
     last: bool,
-
-    #[clap(flatten)]
-    config_overrides: TuiCli,
 }
 
 #[derive(Debug, Parser)]
@@ -159,41 +150,6 @@ struct GenerateTsCommand {
     prettier: Option<PathBuf>,
 }
 
-fn format_exit_messages(exit_info: AppExitInfo, color_enabled: bool) -> Vec<String> {
-    let AppExitInfo {
-        token_usage,
-        conversation_id,
-    } = exit_info;
-
-    if token_usage.is_zero() {
-        return Vec::new();
-    }
-
-    let mut lines = vec![format!(
-        "{}",
-        codex_core::protocol::FinalOutput::from(token_usage)
-    )];
-
-    if let Some(session_id) = conversation_id {
-        let resume_cmd = format!("codex resume {session_id}");
-        let command = if color_enabled {
-            resume_cmd.cyan().to_string()
-        } else {
-            resume_cmd
-        };
-        lines.push(format!("To continue this session, run {command}."));
-    }
-
-    lines
-}
-
-fn print_exit_messages(exit_info: AppExitInfo) {
-    let color_enabled = supports_color::on(Stream::Stdout).is_some();
-    for line in format_exit_messages(exit_info, color_enabled) {
-        println!("{line}");
-    }
-}
-
 fn main() -> anyhow::Result<()> {
     arg0_dispatch_or_else(|codex_linux_sandbox_exe| async move {
         cli_main(codex_linux_sandbox_exe).await?;
@@ -214,8 +170,10 @@ async fn cli_main(codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()
                 &mut interactive.config_overrides,
                 root_config_overrides.clone(),
             );
-            let exit_info = codex_tui::run_main(interactive, codex_linux_sandbox_exe).await?;
-            print_exit_messages(exit_info);
+            let usage = codex_tui::run_main(interactive, codex_linux_sandbox_exe).await?;
+            if !usage.is_zero() {
+                println!("{}", codex_core::protocol::FinalOutput::from(usage));
+            }
         }
         Some(Subcommand::Exec(mut exec_cli)) => {
             prepend_config_flags(
@@ -224,22 +182,22 @@ async fn cli_main(codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()
             );
             codex_exec::run_main(exec_cli, codex_linux_sandbox_exe).await?;
         }
-        Some(Subcommand::Mcp(mut mcp_cli)) => {
-            // Propagate any root-level config overrides (e.g. `-c key=value`).
-            prepend_config_flags(&mut mcp_cli.config_overrides, root_config_overrides.clone());
-            mcp_cli.run(codex_linux_sandbox_exe).await?;
+        Some(Subcommand::Mcp) => {
+            codex_mcp_server::run_main(codex_linux_sandbox_exe, root_config_overrides.clone())
+                .await?;
         }
-        Some(Subcommand::Resume(ResumeCommand {
-            session_id,
-            last,
-            config_overrides,
-        })) => {
-            interactive = finalize_resume_interactive(
-                interactive,
+        Some(Subcommand::Resume(ResumeCommand { session_id, last })) => {
+            // Start with the parsed interactive CLI so resume shares the same
+            // configuration surface area as `codex` without additional flags.
+            let resume_session_id = session_id;
+            interactive.resume_picker = resume_session_id.is_none() && !last;
+            interactive.resume_last = last;
+            interactive.resume_session_id = resume_session_id;
+
+            // Propagate any root-level config overrides (e.g. `-c key=value`).
+            prepend_config_flags(
+                &mut interactive.config_overrides,
                 root_config_overrides.clone(),
-                session_id,
-                last,
-                config_overrides,
             );
             codex_tui::run_main(interactive, codex_linux_sandbox_exe).await?;
         }
@@ -328,256 +286,8 @@ fn prepend_config_flags(
         .splice(0..0, cli_config_overrides.raw_overrides);
 }
 
-/// Build the final `TuiCli` for a `codex resume` invocation.
-fn finalize_resume_interactive(
-    mut interactive: TuiCli,
-    root_config_overrides: CliConfigOverrides,
-    session_id: Option<String>,
-    last: bool,
-    resume_cli: TuiCli,
-) -> TuiCli {
-    // Start with the parsed interactive CLI so resume shares the same
-    // configuration surface area as `codex` without additional flags.
-    let resume_session_id = session_id;
-    interactive.resume_picker = resume_session_id.is_none() && !last;
-    interactive.resume_last = last;
-    interactive.resume_session_id = resume_session_id;
-
-    // Merge resume-scoped flags and overrides with highest precedence.
-    merge_resume_cli_flags(&mut interactive, resume_cli);
-
-    // Propagate any root-level config overrides (e.g. `-c key=value`).
-    prepend_config_flags(&mut interactive.config_overrides, root_config_overrides);
-
-    interactive
-}
-
-/// Merge flags provided to `codex resume` so they take precedence over any
-/// root-level flags. Only overrides fields explicitly set on the resume-scoped
-/// CLI. Also appends `-c key=value` overrides with highest precedence.
-fn merge_resume_cli_flags(interactive: &mut TuiCli, resume_cli: TuiCli) {
-    if let Some(model) = resume_cli.model {
-        interactive.model = Some(model);
-    }
-    if resume_cli.oss {
-        interactive.oss = true;
-    }
-    if let Some(profile) = resume_cli.config_profile {
-        interactive.config_profile = Some(profile);
-    }
-    if let Some(sandbox) = resume_cli.sandbox_mode {
-        interactive.sandbox_mode = Some(sandbox);
-    }
-    if let Some(approval) = resume_cli.approval_policy {
-        interactive.approval_policy = Some(approval);
-    }
-    if resume_cli.full_auto {
-        interactive.full_auto = true;
-    }
-    if resume_cli.dangerously_bypass_approvals_and_sandbox {
-        interactive.dangerously_bypass_approvals_and_sandbox = true;
-    }
-    if let Some(cwd) = resume_cli.cwd {
-        interactive.cwd = Some(cwd);
-    }
-    if resume_cli.web_search {
-        interactive.web_search = true;
-    }
-    if !resume_cli.images.is_empty() {
-        interactive.images = resume_cli.images;
-    }
-    if let Some(prompt) = resume_cli.prompt {
-        interactive.prompt = Some(prompt);
-    }
-
-    interactive
-        .config_overrides
-        .raw_overrides
-        .extend(resume_cli.config_overrides.raw_overrides);
-}
-
 fn print_completion(cmd: CompletionCommand) {
     let mut app = MultitoolCli::command();
     let name = "codex";
     generate(cmd.shell, &mut app, name, &mut std::io::stdout());
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use codex_core::protocol::TokenUsage;
-    use codex_protocol::mcp_protocol::ConversationId;
-
-    fn finalize_from_args(args: &[&str]) -> TuiCli {
-        let cli = MultitoolCli::try_parse_from(args).expect("parse");
-        let MultitoolCli {
-            interactive,
-            config_overrides: root_overrides,
-            subcommand,
-        } = cli;
-
-        let Subcommand::Resume(ResumeCommand {
-            session_id,
-            last,
-            config_overrides: resume_cli,
-        }) = subcommand.expect("resume present")
-        else {
-            unreachable!()
-        };
-
-        finalize_resume_interactive(interactive, root_overrides, session_id, last, resume_cli)
-    }
-
-    fn sample_exit_info(conversation: Option<&str>) -> AppExitInfo {
-        let token_usage = TokenUsage {
-            output_tokens: 2,
-            total_tokens: 2,
-            ..Default::default()
-        };
-        AppExitInfo {
-            token_usage,
-            conversation_id: conversation
-                .map(ConversationId::from_string)
-                .map(Result::unwrap),
-        }
-    }
-
-    #[test]
-    fn format_exit_messages_skips_zero_usage() {
-        let exit_info = AppExitInfo {
-            token_usage: TokenUsage::default(),
-            conversation_id: None,
-        };
-        let lines = format_exit_messages(exit_info, false);
-        assert!(lines.is_empty());
-    }
-
-    #[test]
-    fn format_exit_messages_includes_resume_hint_without_color() {
-        let exit_info = sample_exit_info(Some("123e4567-e89b-12d3-a456-426614174000"));
-        let lines = format_exit_messages(exit_info, false);
-        assert_eq!(
-            lines,
-            vec![
-                "Token usage: total=2 input=0 output=2".to_string(),
-                "To continue this session, run codex resume 123e4567-e89b-12d3-a456-426614174000."
-                    .to_string(),
-            ]
-        );
-    }
-
-    #[test]
-    fn format_exit_messages_applies_color_when_enabled() {
-        let exit_info = sample_exit_info(Some("123e4567-e89b-12d3-a456-426614174000"));
-        let lines = format_exit_messages(exit_info, true);
-        assert_eq!(lines.len(), 2);
-        assert!(lines[1].contains("\u{1b}[36m"));
-    }
-
-    #[test]
-    fn resume_model_flag_applies_when_no_root_flags() {
-        let interactive = finalize_from_args(["codex", "resume", "-m", "gpt-5-test"].as_ref());
-
-        assert_eq!(interactive.model.as_deref(), Some("gpt-5-test"));
-        assert!(interactive.resume_picker);
-        assert!(!interactive.resume_last);
-        assert_eq!(interactive.resume_session_id, None);
-    }
-
-    #[test]
-    fn resume_picker_logic_none_and_not_last() {
-        let interactive = finalize_from_args(["codex", "resume"].as_ref());
-        assert!(interactive.resume_picker);
-        assert!(!interactive.resume_last);
-        assert_eq!(interactive.resume_session_id, None);
-    }
-
-    #[test]
-    fn resume_picker_logic_last() {
-        let interactive = finalize_from_args(["codex", "resume", "--last"].as_ref());
-        assert!(!interactive.resume_picker);
-        assert!(interactive.resume_last);
-        assert_eq!(interactive.resume_session_id, None);
-    }
-
-    #[test]
-    fn resume_picker_logic_with_session_id() {
-        let interactive = finalize_from_args(["codex", "resume", "1234"].as_ref());
-        assert!(!interactive.resume_picker);
-        assert!(!interactive.resume_last);
-        assert_eq!(interactive.resume_session_id.as_deref(), Some("1234"));
-    }
-
-    #[test]
-    fn resume_merges_option_flags_and_full_auto() {
-        let interactive = finalize_from_args(
-            [
-                "codex",
-                "resume",
-                "sid",
-                "--oss",
-                "--full-auto",
-                "--search",
-                "--sandbox",
-                "workspace-write",
-                "--ask-for-approval",
-                "on-request",
-                "-m",
-                "gpt-5-test",
-                "-p",
-                "my-profile",
-                "-C",
-                "/tmp",
-                "-i",
-                "/tmp/a.png,/tmp/b.png",
-            ]
-            .as_ref(),
-        );
-
-        assert_eq!(interactive.model.as_deref(), Some("gpt-5-test"));
-        assert!(interactive.oss);
-        assert_eq!(interactive.config_profile.as_deref(), Some("my-profile"));
-        assert!(matches!(
-            interactive.sandbox_mode,
-            Some(codex_common::SandboxModeCliArg::WorkspaceWrite)
-        ));
-        assert!(matches!(
-            interactive.approval_policy,
-            Some(codex_common::ApprovalModeCliArg::OnRequest)
-        ));
-        assert!(interactive.full_auto);
-        assert_eq!(
-            interactive.cwd.as_deref(),
-            Some(std::path::Path::new("/tmp"))
-        );
-        assert!(interactive.web_search);
-        let has_a = interactive
-            .images
-            .iter()
-            .any(|p| p == std::path::Path::new("/tmp/a.png"));
-        let has_b = interactive
-            .images
-            .iter()
-            .any(|p| p == std::path::Path::new("/tmp/b.png"));
-        assert!(has_a && has_b);
-        assert!(!interactive.resume_picker);
-        assert!(!interactive.resume_last);
-        assert_eq!(interactive.resume_session_id.as_deref(), Some("sid"));
-    }
-
-    #[test]
-    fn resume_merges_dangerously_bypass_flag() {
-        let interactive = finalize_from_args(
-            [
-                "codex",
-                "resume",
-                "--dangerously-bypass-approvals-and-sandbox",
-            ]
-            .as_ref(),
-        );
-        assert!(interactive.dangerously_bypass_approvals_and_sandbox);
-        assert!(interactive.resume_picker);
-        assert!(!interactive.resume_last);
-        assert_eq!(interactive.resume_session_id, None);
-    }
-}

codex-rs/cli/src/mcp_cmd.rs

@@ -1,384 +0,0 @@
-use std::collections::BTreeMap;
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-use anyhow::Context;
-use anyhow::Result;
-use anyhow::anyhow;
-use anyhow::bail;
-use codex_common::CliConfigOverrides;
-use codex_core::config::Config;
-use codex_core::config::ConfigOverrides;
-use codex_core::config::find_codex_home;
-use codex_core::config::load_global_mcp_servers;
-use codex_core::config::write_global_mcp_servers;
-use codex_core::config_types::McpServerConfig;
-
-/// [experimental] Launch Codex as an MCP server or manage configured MCP servers.
-///
-/// Subcommands:
-/// - `serve`  — run the MCP server on stdio
-/// - `list`   — list configured servers (with `--json`)
-/// - `get`    — show a single server (with `--json`)
-/// - `add`    — add a server launcher entry to `~/.codex/config.toml`
-/// - `remove` — delete a server entry
-#[derive(Debug, clap::Parser)]
-pub struct McpCli {
-    #[clap(flatten)]
-    pub config_overrides: CliConfigOverrides,
-
-    #[command(subcommand)]
-    pub cmd: Option<McpSubcommand>,
-}
-
-#[derive(Debug, clap::Subcommand)]
-pub enum McpSubcommand {
-    /// [experimental] Run the Codex MCP server (stdio transport).
-    Serve,
-
-    /// [experimental] List configured MCP servers.
-    List(ListArgs),
-
-    /// [experimental] Show details for a configured MCP server.
-    Get(GetArgs),
-
-    /// [experimental] Add a global MCP server entry.
-    Add(AddArgs),
-
-    /// [experimental] Remove a global MCP server entry.
-    Remove(RemoveArgs),
-}
-
-#[derive(Debug, clap::Parser)]
-pub struct ListArgs {
-    /// Output the configured servers as JSON.
-    #[arg(long)]
-    pub json: bool,
-}
-
-#[derive(Debug, clap::Parser)]
-pub struct GetArgs {
-    /// Name of the MCP server to display.
-    pub name: String,
-
-    /// Output the server configuration as JSON.
-    #[arg(long)]
-    pub json: bool,
-}
-
-#[derive(Debug, clap::Parser)]
-pub struct AddArgs {
-    /// Name for the MCP server configuration.
-    pub name: String,
-
-    /// Environment variables to set when launching the server.
-    #[arg(long, value_parser = parse_env_pair, value_name = "KEY=VALUE")]
-    pub env: Vec<(String, String)>,
-
-    /// Command to launch the MCP server.
-    #[arg(trailing_var_arg = true, num_args = 1..)]
-    pub command: Vec<String>,
-}
-
-#[derive(Debug, clap::Parser)]
-pub struct RemoveArgs {
-    /// Name of the MCP server configuration to remove.
-    pub name: String,
-}
-
-impl McpCli {
-    pub async fn run(self, codex_linux_sandbox_exe: Option<PathBuf>) -> Result<()> {
-        let McpCli {
-            config_overrides,
-            cmd,
-        } = self;
-        let subcommand = cmd.unwrap_or(McpSubcommand::Serve);
-
-        match subcommand {
-            McpSubcommand::Serve => {
-                codex_mcp_server::run_main(codex_linux_sandbox_exe, config_overrides).await?;
-            }
-            McpSubcommand::List(args) => {
-                run_list(&config_overrides, args)?;
-            }
-            McpSubcommand::Get(args) => {
-                run_get(&config_overrides, args)?;
-            }
-            McpSubcommand::Add(args) => {
-                run_add(&config_overrides, args)?;
-            }
-            McpSubcommand::Remove(args) => {
-                run_remove(&config_overrides, args)?;
-            }
-        }
-
-        Ok(())
-    }
-}
-
-fn run_add(config_overrides: &CliConfigOverrides, add_args: AddArgs) -> Result<()> {
-    // Validate any provided overrides even though they are not currently applied.
-    config_overrides.parse_overrides().map_err(|e| anyhow!(e))?;
-
-    let AddArgs { name, env, command } = add_args;
-
-    validate_server_name(&name)?;
-
-    let mut command_parts = command.into_iter();
-    let command_bin = command_parts
-        .next()
-        .ok_or_else(|| anyhow!("command is required"))?;
-    let command_args: Vec<String> = command_parts.collect();
-
-    let env_map = if env.is_empty() {
-        None
-    } else {
-        let mut map = HashMap::new();
-        for (key, value) in env {
-            map.insert(key, value);
-        }
-        Some(map)
-    };
-
-    let codex_home = find_codex_home().context("failed to resolve CODEX_HOME")?;
-    let mut servers = load_global_mcp_servers(&codex_home)
-        .with_context(|| format!("failed to load MCP servers from {}", codex_home.display()))?;
-
-    let new_entry = McpServerConfig {
-        command: command_bin,
-        args: command_args,
-        env: env_map,
-        startup_timeout_sec: None,
-        tool_timeout_sec: None,
-    };
-
-    servers.insert(name.clone(), new_entry);
-
-    write_global_mcp_servers(&codex_home, &servers)
-        .with_context(|| format!("failed to write MCP servers to {}", codex_home.display()))?;
-
-    println!("Added global MCP server '{name}'.");
-
-    Ok(())
-}
-
-fn run_remove(config_overrides: &CliConfigOverrides, remove_args: RemoveArgs) -> Result<()> {
-    config_overrides.parse_overrides().map_err(|e| anyhow!(e))?;
-
-    let RemoveArgs { name } = remove_args;
-
-    validate_server_name(&name)?;
-
-    let codex_home = find_codex_home().context("failed to resolve CODEX_HOME")?;
-    let mut servers = load_global_mcp_servers(&codex_home)
-        .with_context(|| format!("failed to load MCP servers from {}", codex_home.display()))?;
-
-    let removed = servers.remove(&name).is_some();
-
-    if removed {
-        write_global_mcp_servers(&codex_home, &servers)
-            .with_context(|| format!("failed to write MCP servers to {}", codex_home.display()))?;
-    }
-
-    if removed {
-        println!("Removed global MCP server '{name}'.");
-    } else {
-        println!("No MCP server named '{name}' found.");
-    }
-
-    Ok(())
-}
-
-fn run_list(config_overrides: &CliConfigOverrides, list_args: ListArgs) -> Result<()> {
-    let overrides = config_overrides.parse_overrides().map_err(|e| anyhow!(e))?;
-    let config = Config::load_with_cli_overrides(overrides, ConfigOverrides::default())
-        .context("failed to load configuration")?;
-
-    let mut entries: Vec<_> = config.mcp_servers.iter().collect();
-    entries.sort_by(|(a, _), (b, _)| a.cmp(b));
-
-    if list_args.json {
-        let json_entries: Vec<_> = entries
-            .into_iter()
-            .map(|(name, cfg)| {
-                let env = cfg.env.as_ref().map(|env| {
-                    env.iter()
-                        .map(|(k, v)| (k.clone(), v.clone()))
-                        .collect::<BTreeMap<_, _>>()
-                });
-                serde_json::json!({
-                    "name": name,
-                    "command": cfg.command,
-                    "args": cfg.args,
-                    "env": env,
-                    "startup_timeout_sec": cfg
-                        .startup_timeout_sec
-                        .map(|timeout| timeout.as_secs_f64()),
-                    "tool_timeout_sec": cfg
-                        .tool_timeout_sec
-                        .map(|timeout| timeout.as_secs_f64()),
-                })
-            })
-            .collect();
-        let output = serde_json::to_string_pretty(&json_entries)?;
-        println!("{output}");
-        return Ok(());
-    }
-
-    if entries.is_empty() {
-        println!("No MCP servers configured yet. Try `codex mcp add my-tool -- my-command`.");
-        return Ok(());
-    }
-
-    let mut rows: Vec<[String; 4]> = Vec::new();
-    for (name, cfg) in entries {
-        let args = if cfg.args.is_empty() {
-            "-".to_string()
-        } else {
-            cfg.args.join(" ")
-        };
-
-        let env = match cfg.env.as_ref() {
-            None => "-".to_string(),
-            Some(map) if map.is_empty() => "-".to_string(),
-            Some(map) => {
-                let mut pairs: Vec<_> = map.iter().collect();
-                pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                pairs
-                    .into_iter()
-                    .map(|(k, v)| format!("{k}={v}"))
-                    .collect::<Vec<_>>()
-                    .join(", ")
-            }
-        };
-
-        rows.push([name.clone(), cfg.command.clone(), args, env]);
-    }
-
-    let mut widths = ["Name".len(), "Command".len(), "Args".len(), "Env".len()];
-    for row in &rows {
-        for (i, cell) in row.iter().enumerate() {
-            widths[i] = widths[i].max(cell.len());
-        }
-    }
-
-    println!(
-        "{:<name_w$}  {:<cmd_w$}  {:<args_w$}  {:<env_w$}",
-        "Name",
-        "Command",
-        "Args",
-        "Env",
-        name_w = widths[0],
-        cmd_w = widths[1],
-        args_w = widths[2],
-        env_w = widths[3],
-    );
-
-    for row in rows {
-        println!(
-            "{:<name_w$}  {:<cmd_w$}  {:<args_w$}  {:<env_w$}",
-            row[0],
-            row[1],
-            row[2],
-            row[3],
-            name_w = widths[0],
-            cmd_w = widths[1],
-            args_w = widths[2],
-            env_w = widths[3],
-        );
-    }
-
-    Ok(())
-}
-
-fn run_get(config_overrides: &CliConfigOverrides, get_args: GetArgs) -> Result<()> {
-    let overrides = config_overrides.parse_overrides().map_err(|e| anyhow!(e))?;
-    let config = Config::load_with_cli_overrides(overrides, ConfigOverrides::default())
-        .context("failed to load configuration")?;
-
-    let Some(server) = config.mcp_servers.get(&get_args.name) else {
-        bail!("No MCP server named '{name}' found.", name = get_args.name);
-    };
-
-    if get_args.json {
-        let env = server.env.as_ref().map(|env| {
-            env.iter()
-                .map(|(k, v)| (k.clone(), v.clone()))
-                .collect::<BTreeMap<_, _>>()
-        });
-        let output = serde_json::to_string_pretty(&serde_json::json!({
-            "name": get_args.name,
-            "command": server.command,
-            "args": server.args,
-            "env": env,
-            "startup_timeout_sec": server
-                .startup_timeout_sec
-                .map(|timeout| timeout.as_secs_f64()),
-            "tool_timeout_sec": server
-                .tool_timeout_sec
-                .map(|timeout| timeout.as_secs_f64()),
-        }))?;
-        println!("{output}");
-        return Ok(());
-    }
-
-    println!("{}", get_args.name);
-    println!("  command: {}", server.command);
-    let args = if server.args.is_empty() {
-        "-".to_string()
-    } else {
-        server.args.join(" ")
-    };
-    println!("  args: {args}");
-    let env_display = match server.env.as_ref() {
-        None => "-".to_string(),
-        Some(map) if map.is_empty() => "-".to_string(),
-        Some(map) => {
-            let mut pairs: Vec<_> = map.iter().collect();
-            pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-            pairs
-                .into_iter()
-                .map(|(k, v)| format!("{k}={v}"))
-                .collect::<Vec<_>>()
-                .join(", ")
-        }
-    };
-    println!("  env: {env_display}");
-    if let Some(timeout) = server.startup_timeout_sec {
-        println!("  startup_timeout_sec: {}", timeout.as_secs_f64());
-    }
-    if let Some(timeout) = server.tool_timeout_sec {
-        println!("  tool_timeout_sec: {}", timeout.as_secs_f64());
-    }
-    println!("  remove: codex mcp remove {}", get_args.name);
-
-    Ok(())
-}
-
-fn parse_env_pair(raw: &str) -> Result<(String, String), String> {
-    let mut parts = raw.splitn(2, '=');
-    let key = parts
-        .next()
-        .map(str::trim)
-        .filter(|s| !s.is_empty())
-        .ok_or_else(|| "environment entries must be in KEY=VALUE form".to_string())?;
-    let value = parts
-        .next()
-        .map(str::to_string)
-        .ok_or_else(|| "environment entries must be in KEY=VALUE form".to_string())?;
-
-    Ok((key.to_string(), value))
-}
-
-fn validate_server_name(name: &str) -> Result<()> {
-    let is_valid = !name.is_empty()
-        && name
-            .chars()
-            .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_');
-
-    if is_valid {
-        Ok(())
-    } else {
-        bail!("invalid server name '{name}' (use letters, numbers, '-', '_')");
-    }
-}

codex-rs/cli/tests/mcp_add_remove.rs

@@ -1,86 +0,0 @@
-use std::path::Path;
-
-use anyhow::Result;
-use codex_core::config::load_global_mcp_servers;
-use predicates::str::contains;
-use pretty_assertions::assert_eq;
-use tempfile::TempDir;
-
-fn codex_command(codex_home: &Path) -> Result<assert_cmd::Command> {
-    let mut cmd = assert_cmd::Command::cargo_bin("codex")?;
-    cmd.env("CODEX_HOME", codex_home);
-    Ok(cmd)
-}
-
-#[test]
-fn add_and_remove_server_updates_global_config() -> Result<()> {
-    let codex_home = TempDir::new()?;
-
-    let mut add_cmd = codex_command(codex_home.path())?;
-    add_cmd
-        .args(["mcp", "add", "docs", "--", "echo", "hello"])
-        .assert()
-        .success()
-        .stdout(contains("Added global MCP server 'docs'."));
-
-    let servers = load_global_mcp_servers(codex_home.path())?;
-    assert_eq!(servers.len(), 1);
-    let docs = servers.get("docs").expect("server should exist");
-    assert_eq!(docs.command, "echo");
-    assert_eq!(docs.args, vec!["hello".to_string()]);
-    assert!(docs.env.is_none());
-
-    let mut remove_cmd = codex_command(codex_home.path())?;
-    remove_cmd
-        .args(["mcp", "remove", "docs"])
-        .assert()
-        .success()
-        .stdout(contains("Removed global MCP server 'docs'."));
-
-    let servers = load_global_mcp_servers(codex_home.path())?;
-    assert!(servers.is_empty());
-
-    let mut remove_again_cmd = codex_command(codex_home.path())?;
-    remove_again_cmd
-        .args(["mcp", "remove", "docs"])
-        .assert()
-        .success()
-        .stdout(contains("No MCP server named 'docs' found."));
-
-    let servers = load_global_mcp_servers(codex_home.path())?;
-    assert!(servers.is_empty());
-
-    Ok(())
-}
-
-#[test]
-fn add_with_env_preserves_key_order_and_values() -> Result<()> {
-    let codex_home = TempDir::new()?;
-
-    let mut add_cmd = codex_command(codex_home.path())?;
-    add_cmd
-        .args([
-            "mcp",
-            "add",
-            "envy",
-            "--env",
-            "FOO=bar",
-            "--env",
-            "ALPHA=beta",
-            "--",
-            "python",
-            "server.py",
-        ])
-        .assert()
-        .success();
-
-    let servers = load_global_mcp_servers(codex_home.path())?;
-    let envy = servers.get("envy").expect("server should exist");
-    let env = envy.env.as_ref().expect("env should be present");
-
-    assert_eq!(env.len(), 2);
-    assert_eq!(env.get("FOO"), Some(&"bar".to_string()));
-    assert_eq!(env.get("ALPHA"), Some(&"beta".to_string()));
-
-    Ok(())
-}

codex-rs/cli/tests/mcp_list.rs

@@ -1,106 +0,0 @@
-use std::path::Path;
-
-use anyhow::Result;
-use predicates::str::contains;
-use pretty_assertions::assert_eq;
-use serde_json::Value as JsonValue;
-use tempfile::TempDir;
-
-fn codex_command(codex_home: &Path) -> Result<assert_cmd::Command> {
-    let mut cmd = assert_cmd::Command::cargo_bin("codex")?;
-    cmd.env("CODEX_HOME", codex_home);
-    Ok(cmd)
-}
-
-#[test]
-fn list_shows_empty_state() -> Result<()> {
-    let codex_home = TempDir::new()?;
-
-    let mut cmd = codex_command(codex_home.path())?;
-    let output = cmd.args(["mcp", "list"]).output()?;
-    assert!(output.status.success());
-    let stdout = String::from_utf8(output.stdout)?;
-    assert!(stdout.contains("No MCP servers configured yet."));
-
-    Ok(())
-}
-
-#[test]
-fn list_and_get_render_expected_output() -> Result<()> {
-    let codex_home = TempDir::new()?;
-
-    let mut add = codex_command(codex_home.path())?;
-    add.args([
-        "mcp",
-        "add",
-        "docs",
-        "--env",
-        "TOKEN=secret",
-        "--",
-        "docs-server",
-        "--port",
-        "4000",
-    ])
-    .assert()
-    .success();
-
-    let mut list_cmd = codex_command(codex_home.path())?;
-    let list_output = list_cmd.args(["mcp", "list"]).output()?;
-    assert!(list_output.status.success());
-    let stdout = String::from_utf8(list_output.stdout)?;
-    assert!(stdout.contains("Name"));
-    assert!(stdout.contains("docs"));
-    assert!(stdout.contains("docs-server"));
-    assert!(stdout.contains("TOKEN=secret"));
-
-    let mut list_json_cmd = codex_command(codex_home.path())?;
-    let json_output = list_json_cmd.args(["mcp", "list", "--json"]).output()?;
-    assert!(json_output.status.success());
-    let stdout = String::from_utf8(json_output.stdout)?;
-    let parsed: JsonValue = serde_json::from_str(&stdout)?;
-    let array = parsed.as_array().expect("expected array");
-    assert_eq!(array.len(), 1);
-    let entry = &array[0];
-    assert_eq!(entry.get("name"), Some(&JsonValue::String("docs".into())));
-    assert_eq!(
-        entry.get("command"),
-        Some(&JsonValue::String("docs-server".into()))
-    );
-
-    let args = entry
-        .get("args")
-        .and_then(|v| v.as_array())
-        .expect("args array");
-    assert_eq!(
-        args,
-        &vec![
-            JsonValue::String("--port".into()),
-            JsonValue::String("4000".into())
-        ]
-    );
-
-    let env = entry
-        .get("env")
-        .and_then(|v| v.as_object())
-        .expect("env map");
-    assert_eq!(env.get("TOKEN"), Some(&JsonValue::String("secret".into())));
-
-    let mut get_cmd = codex_command(codex_home.path())?;
-    let get_output = get_cmd.args(["mcp", "get", "docs"]).output()?;
-    assert!(get_output.status.success());
-    let stdout = String::from_utf8(get_output.stdout)?;
-    assert!(stdout.contains("docs"));
-    assert!(stdout.contains("command: docs-server"));
-    assert!(stdout.contains("args: --port 4000"));
-    assert!(stdout.contains("env: TOKEN=secret"));
-    assert!(stdout.contains("remove: codex mcp remove docs"));
-
-    let mut get_json_cmd = codex_command(codex_home.path())?;
-    get_json_cmd
-        .args(["mcp", "get", "docs", "--json"])
-        .assert()
-        .success()
-        .stdout(contains("\"name\": \"docs\""));
-
-    Ok(())
-}

codex-rs/common/Cargo.toml

@@ -7,11 +7,11 @@ version = { workspace = true }
 workspace = true
 
 [dependencies]
-clap = { workspace = true, features = ["derive", "wrap_help"], optional = true }
-codex-core = { workspace = true }
-codex-protocol = { workspace = true }
-serde = { workspace = true, optional = true }
-toml = { workspace = true, optional = true }
+clap = { version = "4", features = ["derive", "wrap_help"], optional = true }
+codex-core = { path = "../core" }
+codex-protocol = { path = "../protocol" }
+serde = { version = "1", optional = true }
+toml = { version = "0.9", optional = true }
 
 [features]
 # Separate feature so that `clap` is not a mandatory dependency.

codex-rs/common/src/model_presets.rs

@@ -1,4 +1,4 @@
-use codex_core::config::GPT_5_CODEX_MEDIUM_MODEL;
+use codex_core::config::SWIFTFOX_MEDIUM_MODEL;
 use codex_core::protocol_config_types::ReasoningEffort;
 use codex_protocol::mcp_protocol::AuthMode;
 
@@ -19,24 +19,24 @@ pub struct ModelPreset {
 
 const PRESETS: &[ModelPreset] = &[
     ModelPreset {
-        id: "gpt-5-codex-low",
-        label: "gpt-5-codex low",
+        id: "swiftfox-low",
+        label: "swiftfox low",
         description: "",
-        model: "gpt-5-codex",
+        model: "swiftfox",
         effort: Some(ReasoningEffort::Low),
     },
     ModelPreset {
-        id: "gpt-5-codex-medium",
-        label: "gpt-5-codex medium",
+        id: "swiftfox-medium",
+        label: "swiftfox medium",
         description: "",
-        model: "gpt-5-codex",
+        model: "swiftfox",
         effort: None,
     },
     ModelPreset {
-        id: "gpt-5-codex-high",
-        label: "gpt-5-codex high",
+        id: "swiftfox-high",
+        label: "swiftfox high",
         description: "",
-        model: "gpt-5-codex",
+        model: "swiftfox",
         effort: Some(ReasoningEffort::High),
     },
     ModelPreset {
@@ -74,7 +74,7 @@ pub fn builtin_model_presets(auth_mode: Option<AuthMode>) -> Vec<ModelPreset> {
         Some(AuthMode::ApiKey) => PRESETS
             .iter()
             .copied()
-            .filter(|p| p.model != GPT_5_CODEX_MEDIUM_MODEL)
+            .filter(|p| !p.model.contains(SWIFTFOX_MEDIUM_MODEL))
             .collect(),
         _ => PRESETS.to_vec(),
     }

codex-rs/core/Cargo.toml

@@ -4,89 +4,84 @@ name = "codex-core"
 version = { workspace = true }
 
 [lib]
-doctest = false
 name = "codex_core"
 path = "src/lib.rs"
+doctest = false
 
 [lints]
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-askama = { workspace = true }
-async-channel = { workspace = true }
-base64 = { workspace = true }
-bytes = { workspace = true }
-chrono = { workspace = true, features = ["serde"] }
-codex-apply-patch = { workspace = true }
-codex-file-search = { workspace = true }
-codex-mcp-client = { workspace = true }
-codex-protocol = { workspace = true }
-dirs = { workspace = true }
-env-flags = { workspace = true }
-eventsource-stream = { workspace = true }
-futures = { workspace = true }
-libc = { workspace = true }
-mcp-types = { workspace = true }
-os_info = { workspace = true }
-portable-pty = { workspace = true }
-rand = { workspace = true }
-regex-lite = { workspace = true }
-reqwest = { workspace = true, features = ["json", "stream"] }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-sha1 = { workspace = true }
-shlex = { workspace = true }
-similar = { workspace = true }
-strum_macros = { workspace = true }
-tempfile = { workspace = true }
-thiserror = { workspace = true }
-time = { workspace = true, features = [
-    "formatting",
-    "parsing",
-    "local-offset",
-    "macros",
-] }
-tokio = { workspace = true, features = [
+anyhow = "1"
+askama = "0.12"
+async-channel = "2.3.1"
+base64 = "0.22"
+bytes = "1.10.1"
+chrono = { version = "0.4", features = ["serde"] }
+codex-apply-patch = { path = "../apply-patch" }
+codex-file-search = { path = "../file-search" }
+codex-mcp-client = { path = "../mcp-client" }
+codex-protocol = { path = "../protocol" }
+dirs = "6"
+env-flags = "0.1.1"
+eventsource-stream = "0.2.3"
+futures = "0.3"
+libc = "0.2.175"
+mcp-types = { path = "../mcp-types" }
+os_info = "3.12.0"
+portable-pty = "0.9.0"
+rand = "0.9"
+regex-lite = "0.1.7"
+reqwest = { version = "0.12", features = ["json", "stream"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha1 = "0.10.6"
+shlex = "1.3.0"
+similar = "2.7.0"
+strum_macros = "0.27.2"
+tempfile = "3"
+thiserror = "2.0.16"
+time = { version = "0.3", features = ["formatting", "parsing", "local-offset", "macros"] }
+tokio = { version = "1", features = [
     "io-std",
     "macros",
     "process",
     "rt-multi-thread",
     "signal",
 ] }
-tokio-util = { workspace = true }
-toml = { workspace = true }
-toml_edit = { workspace = true }
-tracing = { workspace = true, features = ["log"] }
-tree-sitter = { workspace = true }
-tree-sitter-bash = { workspace = true }
-uuid = { workspace = true, features = ["serde", "v4"] }
-which = { workspace = true }
-wildmatch = { workspace = true }
+tokio-util = "0.7.16"
+toml = "0.9.5"
+toml_edit = "0.23.4"
+tracing = { version = "0.1.41", features = ["log"] }
+tree-sitter = "0.25.9"
+tree-sitter-bash = "0.25.0"
+uuid = { version = "1", features = ["serde", "v4"] }
+which = "6"
+wildmatch = "2.4.0"
 
 
 [target.'cfg(target_os = "linux")'.dependencies]
-landlock = { workspace = true }
-seccompiler = { workspace = true }
+landlock = "0.4.1"
+seccompiler = "0.5.0"
 
 # Build OpenSSL from source for musl builds.
 [target.x86_64-unknown-linux-musl.dependencies]
-openssl-sys = { workspace = true, features = ["vendored"] }
+openssl-sys = { version = "*", features = ["vendored"] }
 
 # Build OpenSSL from source for musl builds.
 [target.aarch64-unknown-linux-musl.dependencies]
-openssl-sys = { workspace = true, features = ["vendored"] }
+openssl-sys = { version = "*", features = ["vendored"] }
 
 [dev-dependencies]
-assert_cmd = { workspace = true }
-core_test_support = { workspace = true }
-maplit = { workspace = true }
-predicates = { workspace = true }
-pretty_assertions = { workspace = true }
-tempfile = { workspace = true }
-tokio-test = { workspace = true }
-walkdir = { workspace = true }
-wiremock = { workspace = true }
+assert_cmd = "2"
+core_test_support = { path = "tests/common" }
+maplit = "1.0.2"
+predicates = "3"
+pretty_assertions = "1.4.1"
+tempfile = "3"
+tokio-test = "0.4"
+walkdir = "2.5.0"
+wiremock = "0.6"
 
 [package.metadata.cargo-shear]
 ignored = ["openssl-sys"]

codex-rs/core/prompt.md

@@ -251,16 +251,6 @@ You are producing plain text that will later be styled by the CLI. Follow these
 - Apply to inline examples and to bullet keywords if the keyword itself is a literal file/command.
 - Never mix monospace and bold markers; choose one based on whether it’s a keyword (`**`) or inline code/path (`` ` ``).
 
-**File References**
-When referencing files in your response, make sure to include the relevant start line and always follow the below rules:
-  * Use inline code to make file paths clickable.
-  * Each reference should have a stand alone path. Even if it's the same file.
-  * Accepted: absolute, workspace‑relative, a/ or b/ diff prefixes, or bare filename/suffix.
-  * Line/column (1‑based, optional): :line[:column] or #Lline[Ccolumn] (column defaults to 1).
-  * Do not use URIs like file://, vscode://, or https://.
-  * Do not provide range of lines
-  * Examples: src/app.ts, src/app.ts:42, b/server/index.js#L10, C:\repo\project\main.rs:12:5
-
 **Structure**
 
 - Place related bullets together; don’t mix unrelated concepts in the same section.

codex-rs/core/src/auth.rs

@@ -408,32 +408,6 @@ mod tests {
         assert_eq!(auth_dot_json, same_auth_dot_json);
     }
 
-    #[test]
-    fn login_with_api_key_overwrites_existing_auth_json() {
-        let dir = tempdir().unwrap();
-        let auth_path = dir.path().join("auth.json");
-        let stale_auth = json!({
-            "OPENAI_API_KEY": "sk-old",
-            "tokens": {
-                "id_token": "stale.header.payload",
-                "access_token": "stale-access",
-                "refresh_token": "stale-refresh",
-                "account_id": "stale-acc"
-            }
-        });
-        std::fs::write(
-            &auth_path,
-            serde_json::to_string_pretty(&stale_auth).unwrap(),
-        )
-        .unwrap();
-
-        super::login_with_api_key(dir.path(), "sk-new").expect("login_with_api_key should succeed");
-
-        let auth = super::try_read_auth_json(&auth_path).expect("auth.json should parse");
-        assert_eq!(auth.openai_api_key.as_deref(), Some("sk-new"));
-        assert!(auth.tokens.is_none(), "tokens should be cleared");
-    }
-
     #[tokio::test]
     async fn pro_account_with_no_api_key_uses_chatgpt_auth() {
         let codex_home = tempdir().unwrap();

codex-rs/core/src/bash.rs

@@ -1,4 +1,3 @@
-use tree_sitter::Node;
 use tree_sitter::Parser;
 use tree_sitter::Tree;
 use tree_sitter_bash::LANGUAGE as BASH;
@@ -74,9 +73,6 @@ pub fn try_parse_word_only_commands_sequence(tree: &Tree, src: &str) -> Option<V
         }
     }
 
-    // Walk uses a stack (LIFO), so re-sort by position to restore source order.
-    command_nodes.sort_by_key(Node::start_byte);
-
     let mut commands = Vec::new();
     for node in command_nodes {
         if let Some(words) = parse_plain_command_from_node(node, src) {
@@ -154,10 +150,10 @@ mod tests {
         let src = "ls && pwd; echo 'hi there' | wc -l";
         let cmds = parse_seq(src).unwrap();
         let expected: Vec<Vec<String>> = vec![
-            vec!["ls".to_string()],
-            vec!["pwd".to_string()],
-            vec!["echo".to_string(), "hi there".to_string()],
             vec!["wc".to_string(), "-l".to_string()],
+            vec!["echo".to_string(), "hi there".to_string()],
+            vec!["pwd".to_string()],
+            vec!["ls".to_string()],
         ];
         assert_eq!(cmds, expected);
     }

codex-rs/core/src/chat_completions.rs

@@ -21,7 +21,6 @@ use crate::client_common::ResponseEvent;
 use crate::client_common::ResponseStream;
 use crate::error::CodexErr;
 use crate::error::Result;
-use crate::error_codes::CONTEXT_LENGTH_EXCEEDED;
 use crate::model_family::ModelFamily;
 use crate::openai_tools::create_tools_json_for_chat_completions_api;
 use crate::util::backoff;
@@ -29,19 +28,6 @@ use codex_protocol::models::ContentItem;
 use codex_protocol::models::ReasoningItemContent;
 use codex_protocol::models::ResponseItem;
 
-// Minimal error body used to parse structured provider error codes on
-// Chat Completions non‑2xx responses.
-#[derive(serde::Deserialize)]
-struct ChatErrorBody {
-    error: ChatErrorInner,
-}
-
-#[derive(serde::Deserialize)]
-struct ChatErrorInner {
-    code: Option<String>,
-    message: Option<String>,
-}
-
 /// Implementation for the classic Chat Completions API.
 pub(crate) async fn stream_chat_completions(
     prompt: &Prompt,
@@ -323,16 +309,6 @@ pub(crate) async fn stream_chat_completions(
                 let status = res.status();
                 if !(status == StatusCode::TOO_MANY_REQUESTS || status.is_server_error()) {
                     let body = (res.text().await).unwrap_or_default();
-
-                    // Attempt to parse a structured error and map known codes.
-                    if let Ok(parsed) = serde_json::from_str::<ChatErrorBody>(&body)
-                        && parsed.error.code.as_deref() == Some(CONTEXT_LENGTH_EXCEEDED)
-                    {
-                        return Err(CodexErr::ContextLengthExceeded(
-                            parsed.error.message.unwrap_or_default(),
-                        ));
-                    }
-
                     return Err(CodexErr::UnexpectedStatus(status, body));
                 }
 
@@ -486,7 +462,7 @@ async fn process_chat_sse<S>(
             if let Some(reasoning_val) = choice.get("delta").and_then(|d| d.get("reasoning")) {
                 let mut maybe_text = reasoning_val
                     .as_str()
-                    .map(str::to_string)
+                    .map(|s| s.to_string())
                     .filter(|s| !s.is_empty());
 
                 if maybe_text.is_none() && reasoning_val.is_object() {
@@ -740,9 +716,6 @@ where
                     // Not an assistant message – forward immediately.
                     return Poll::Ready(Some(Ok(ResponseEvent::OutputItemDone(item))));
                 }
-                Poll::Ready(Some(Ok(ResponseEvent::RateLimits(snapshot)))) => {
-                    return Poll::Ready(Some(Ok(ResponseEvent::RateLimits(snapshot))));
-                }
                 Poll::Ready(Some(Ok(ResponseEvent::Completed {
                     response_id,
                     token_usage,

codex-rs/core/src/client.rs

@@ -4,8 +4,6 @@ use std::sync::OnceLock;
 use std::time::Duration;
 
 use crate::AuthManager;
-use crate::auth::CodexAuth;
-use crate::error_codes::CONTEXT_LENGTH_EXCEEDED;
 use bytes::Bytes;
 use codex_protocol::mcp_protocol::AuthMode;
 use codex_protocol::mcp_protocol::ConversationId;
@@ -13,7 +11,6 @@ use eventsource_stream::Eventsource;
 use futures::prelude::*;
 use regex_lite::Regex;
 use reqwest::StatusCode;
-use reqwest::header::HeaderMap;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value;
@@ -43,7 +40,6 @@ use crate::model_provider_info::ModelProviderInfo;
 use crate::model_provider_info::WireApi;
 use crate::openai_model_info::get_model_info;
 use crate::openai_tools::create_tools_json_for_responses_api;
-use crate::protocol::RateLimitSnapshotEvent;
 use crate::protocol::TokenUsage;
 use crate::token_data::PlanType;
 use crate::util::backoff;
@@ -278,15 +274,6 @@ impl ModelClient {
                 Ok(resp) if resp.status().is_success() => {
                     let (tx_event, rx_event) = mpsc::channel::<Result<ResponseEvent>>(1600);
 
-                    if let Some(snapshot) = parse_rate_limit_snapshot(resp.headers())
-                        && tx_event
-                            .send(Ok(ResponseEvent::RateLimits(snapshot)))
-                            .await
-                            .is_err()
-                    {
-                        debug!("receiver dropped rate limit snapshot event");
-                    }
-
                     // spawn task to process SSE
                     let stream = resp.bytes_stream().map_err(CodexErr::Reqwest);
                     tokio::spawn(process_sse(
@@ -339,7 +326,7 @@ impl ModelClient {
                                 // token.
                                 let plan_type = error
                                     .plan_type
-                                    .or_else(|| auth.as_ref().and_then(CodexAuth::get_plan_type));
+                                    .or_else(|| auth.as_ref().and_then(|a| a.get_plan_type()));
                                 let resets_in_seconds = error.resets_in_seconds;
                                 return Err(CodexErr::UsageLimitReached(UsageLimitReachedError {
                                     plan_type,
@@ -486,38 +473,6 @@ fn attach_item_ids(payload_json: &mut Value, original_items: &[ResponseItem]) {
     }
 }
 
-fn parse_rate_limit_snapshot(headers: &HeaderMap) -> Option<RateLimitSnapshotEvent> {
-    let primary_used_percent = parse_header_f64(headers, "x-codex-primary-used-percent")?;
-    let secondary_used_percent = parse_header_f64(headers, "x-codex-secondary-used-percent")?;
-    let primary_to_secondary_ratio_percent =
-        parse_header_f64(headers, "x-codex-primary-over-secondary-limit-percent")?;
-    let primary_window_minutes = parse_header_u64(headers, "x-codex-primary-window-minutes")?;
-    let secondary_window_minutes = parse_header_u64(headers, "x-codex-secondary-window-minutes")?;
-
-    Some(RateLimitSnapshotEvent {
-        primary_used_percent,
-        secondary_used_percent,
-        primary_to_secondary_ratio_percent,
-        primary_window_minutes,
-        secondary_window_minutes,
-    })
-}
-
-fn parse_header_f64(headers: &HeaderMap, name: &str) -> Option<f64> {
-    parse_header_str(headers, name)?
-        .parse::<f64>()
-        .ok()
-        .filter(|v| v.is_finite())
-}
-
-fn parse_header_u64(headers: &HeaderMap, name: &str) -> Option<u64> {
-    parse_header_str(headers, name)?.parse::<u64>().ok()
-}
-
-fn parse_header_str<'a>(headers: &'a HeaderMap, name: &str) -> Option<&'a str> {
-    headers.get(name)?.to_str().ok()
-}
-
 async fn process_sse<S>(
     stream: S,
     tx_event: mpsc::Sender<Result<ResponseEvent>>,
@@ -660,11 +615,7 @@ async fn process_sse<S>(
                             Ok(error) => {
                                 let delay = try_parse_retry_after(&error);
                                 let message = error.message.unwrap_or_default();
-                                if error.code.as_deref() == Some(CONTEXT_LENGTH_EXCEEDED) {
-                                    response_error = Some(CodexErr::ContextLengthExceeded(message));
-                                } else {
-                                    response_error = Some(CodexErr::Stream(message, delay));
-                                }
+                                response_error = Some(CodexErr::Stream(message, delay));
                             }
                             Err(e) => {
                                 debug!("failed to parse ErrorResponse: {e}");

codex-rs/core/src/client_common.rs

@@ -1,7 +1,6 @@
 use crate::error::Result;
 use crate::model_family::ModelFamily;
 use crate::openai_tools::OpenAiTool;
-use crate::protocol::RateLimitSnapshotEvent;
 use crate::protocol::TokenUsage;
 use codex_apply_patch::APPLY_PATCH_TOOL_INSTRUCTIONS;
 use codex_protocol::config_types::ReasoningEffort as ReasoningEffortConfig;
@@ -35,11 +34,13 @@ pub struct Prompt {
 }
 
 impl Prompt {
-    pub(crate) fn get_full_instructions<'a>(&'a self, model: &'a ModelFamily) -> Cow<'a, str> {
+    pub(crate) fn get_full_instructions(&self, model: &ModelFamily) -> Cow<'_, str> {
         let base = self
             .base_instructions_override
             .as_deref()
             .unwrap_or(model.base_instructions.deref());
+        let mut sections: Vec<&str> = vec![base];
+
         // When there are no custom instructions, add apply_patch_tool_instructions if:
         // - the model needs special instructions (4.1)
         // AND
@@ -53,10 +54,9 @@ impl Prompt {
             && model.needs_special_apply_patch_instructions
             && !is_apply_patch_tool_present
         {
-            Cow::Owned(format!("{base}\n{APPLY_PATCH_TOOL_INSTRUCTIONS}"))
-        } else {
-            Cow::Borrowed(base)
+            sections.push(APPLY_PATCH_TOOL_INSTRUCTIONS);
         }
+        Cow::Owned(sections.join("\n"))
     }
 
     pub(crate) fn get_formatted_input(&self) -> Vec<ResponseItem> {
@@ -79,7 +79,6 @@ pub enum ResponseEvent {
     WebSearchCallBegin {
         call_id: String,
     },
-    RateLimits(RateLimitSnapshotEvent),
 }
 
 #[derive(Debug, Serialize)]
@@ -216,7 +215,7 @@ mod tests {
                 expects_apply_patch_instructions: false,
             },
             InstructionsTestCase {
-                slug: "gpt-5-codex",
+                slug: "swiftfox",
                 expects_apply_patch_instructions: false,
             },
         ];

codex-rs/core/src/codex.rs

@@ -1,16 +1,16 @@
 use std::borrow::Cow;
 use std::collections::HashMap;
 use std::collections::HashSet;
-use std::path::Path;
 use std::path::PathBuf;
 use std::sync::Arc;
+use std::sync::Mutex;
+use std::sync::MutexGuard;
 use std::sync::atomic::AtomicU64;
 use std::time::Duration;
 
 use crate::AuthManager;
 use crate::client_common::REVIEW_PROMPT;
 use crate::event_mapping::map_response_item_to_event_messages;
-use crate::review_format::format_review_findings_block;
 use async_channel::Receiver;
 use async_channel::Sender;
 use codex_apply_patch::ApplyPatchAction;
@@ -30,7 +30,6 @@ use mcp_types::CallToolResult;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json;
-use tokio::sync::Mutex;
 use tokio::sync::oneshot;
 use tokio::task::AbortHandle;
 use tracing::debug;
@@ -86,7 +85,6 @@ use crate::protocol::AgentReasoningSectionBreakEvent;
 use crate::protocol::ApplyPatchApprovalRequestEvent;
 use crate::protocol::AskForApproval;
 use crate::protocol::BackgroundEventEvent;
-use crate::protocol::CompactApprovalRequestEvent;
 use crate::protocol::ErrorEvent;
 use crate::protocol::Event;
 use crate::protocol::EventMsg;
@@ -99,7 +97,6 @@ use crate::protocol::ListCustomPromptsResponseEvent;
 use crate::protocol::Op;
 use crate::protocol::PatchApplyBeginEvent;
 use crate::protocol::PatchApplyEndEvent;
-use crate::protocol::RateLimitSnapshotEvent;
 use crate::protocol::ReviewDecision;
 use crate::protocol::ReviewOutputEvent;
 use crate::protocol::SandboxPolicy;
@@ -107,7 +104,6 @@ use crate::protocol::SessionConfiguredEvent;
 use crate::protocol::StreamErrorEvent;
 use crate::protocol::Submission;
 use crate::protocol::TaskCompleteEvent;
-use crate::protocol::TokenCountEvent;
 use crate::protocol::TokenUsage;
 use crate::protocol::TokenUsageInfo;
 use crate::protocol::TurnDiffEvent;
@@ -134,10 +130,25 @@ use codex_protocol::models::ResponseItem;
 use codex_protocol::models::ShellToolCallParams;
 use codex_protocol::protocol::InitialHistory;
 
-pub mod compact;
+mod compact;
 use self::compact::build_compacted_history;
 use self::compact::collect_user_messages;
 
+// A convenience extension trait for acquiring mutex locks where poisoning is
+// unrecoverable and should abort the program. This avoids scattered `.unwrap()`
+// calls on `lock()` while still surfacing a clear panic message when a lock is
+// poisoned.
+trait MutexExt<T> {
+    fn lock_unchecked(&self) -> MutexGuard<'_, T>;
+}
+
+impl<T> MutexExt<T> for Mutex<T> {
+    fn lock_unchecked(&self) -> MutexGuard<'_, T> {
+        #[expect(clippy::expect_used)]
+        self.lock().expect("poisoned lock")
+    }
+}
+
 /// The high-level interface to the Codex system.
 /// It operates as a queue pair where you send submissions and receive events.
 pub struct Codex {
@@ -260,7 +271,7 @@ struct State {
     pending_input: Vec<ResponseInputItem>,
     history: ConversationHistory,
     token_info: Option<TokenUsageInfo>,
-    latest_rate_limits: Option<RateLimitSnapshotEvent>,
+    next_internal_sub_id: u64,
 }
 
 /// Context for an initialized model agent
@@ -286,7 +297,6 @@ pub(crate) struct Session {
     codex_linux_sandbox_exe: Option<PathBuf>,
     user_shell: shell::Shell,
     show_raw_agent_reasoning: bool,
-    next_internal_sub_id: AtomicU64,
 }
 
 /// The context needed for a single turn of the conversation.
@@ -460,6 +470,8 @@ impl Session {
             client,
             tools_config: ToolsConfig::new(&ToolsConfigParams {
                 model_family: &config.model_family,
+                approval_policy,
+                sandbox_policy: sandbox_policy.clone(),
                 include_plan_tool: config.include_plan_tool,
                 include_apply_patch_tool: config.include_apply_patch_tool,
                 include_web_search_request: config.tools_web_search_request,
@@ -487,7 +499,6 @@ impl Session {
             codex_linux_sandbox_exe: config.codex_linux_sandbox_exe.clone(),
             user_shell: default_shell,
             show_raw_agent_reasoning: config.show_raw_agent_reasoning,
-            next_internal_sub_id: AtomicU64::new(0),
         });
 
         // Dispatch the SessionConfiguredEvent first and then report any errors.
@@ -516,16 +527,16 @@ impl Session {
         Ok((sess, turn_context))
     }
 
-    pub async fn set_task(&self, task: AgentTask) {
-        let mut state = self.state.lock().await;
+    pub fn set_task(&self, task: AgentTask) {
+        let mut state = self.state.lock_unchecked();
         if let Some(current_task) = state.current_task.take() {
             current_task.abort(TurnAbortReason::Replaced);
         }
         state.current_task = Some(task);
     }
 
-    pub async fn remove_task(&self, sub_id: &str) {
-        let mut state = self.state.lock().await;
+    pub fn remove_task(&self, sub_id: &str) {
+        let mut state = self.state.lock_unchecked();
         if let Some(task) = &state.current_task
             && task.sub_id == sub_id
         {
@@ -534,9 +545,9 @@ impl Session {
     }
 
     fn next_internal_sub_id(&self) -> String {
-        let id = self
-            .next_internal_sub_id
-            .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+        let mut state = self.state.lock_unchecked();
+        let id = state.next_internal_sub_id;
+        state.next_internal_sub_id += 1;
         format!("auto-compact-{id}")
     }
 
@@ -559,7 +570,7 @@ impl Session {
                 let reconstructed_history =
                     self.reconstruct_history_from_rollout(turn_context, &rollout_items);
                 if !reconstructed_history.is_empty() {
-                    self.record_into_history(&reconstructed_history).await;
+                    self.record_into_history(&reconstructed_history);
                 }
 
                 // If persisting, persist all rollout items as-is (recorder filters)
@@ -592,7 +603,7 @@ impl Session {
         let (tx_approve, rx_approve) = oneshot::channel();
         let event_id = sub_id.clone();
         let prev_entry = {
-            let mut state = self.state.lock().await;
+            let mut state = self.state.lock_unchecked();
             state.pending_approvals.insert(sub_id, tx_approve)
         };
         if prev_entry.is_some() {
@@ -624,7 +635,7 @@ impl Session {
         let (tx_approve, rx_approve) = oneshot::channel();
         let event_id = sub_id.clone();
         let prev_entry = {
-            let mut state = self.state.lock().await;
+            let mut state = self.state.lock_unchecked();
             state.pending_approvals.insert(sub_id, tx_approve)
         };
         if prev_entry.is_some() {
@@ -644,9 +655,9 @@ impl Session {
         rx_approve
     }
 
-    pub async fn notify_approval(&self, sub_id: &str, decision: ReviewDecision) {
+    pub fn notify_approval(&self, sub_id: &str, decision: ReviewDecision) {
         let entry = {
-            let mut state = self.state.lock().await;
+            let mut state = self.state.lock_unchecked();
             state.pending_approvals.remove(sub_id)
         };
         match entry {
@@ -659,15 +670,15 @@ impl Session {
         }
     }
 
-    pub async fn add_approved_command(&self, cmd: Vec<String>) {
-        let mut state = self.state.lock().await;
+    pub fn add_approved_command(&self, cmd: Vec<String>) {
+        let mut state = self.state.lock_unchecked();
         state.approved_commands.insert(cmd);
     }
 
     /// Records input items: always append to conversation history and
     /// persist these response items to rollout.
     async fn record_conversation_items(&self, items: &[ResponseItem]) {
-        self.record_into_history(items).await;
+        self.record_into_history(items);
         self.persist_rollout_response_items(items).await;
     }
 
@@ -699,9 +710,11 @@ impl Session {
     }
 
     /// Append ResponseItems to the in-memory conversation history only.
-    async fn record_into_history(&self, items: &[ResponseItem]) {
-        let mut state = self.state.lock().await;
-        state.history.record_items(items.iter());
+    fn record_into_history(&self, items: &[ResponseItem]) {
+        self.state
+            .lock_unchecked()
+            .history
+            .record_items(items.iter());
     }
 
     async fn persist_rollout_response_items(&self, items: &[ResponseItem]) {
@@ -713,7 +726,7 @@ impl Session {
         self.persist_rollout_items(&rollout_items).await;
     }
 
-    pub(crate) fn build_initial_context(&self, turn_context: &TurnContext) -> Vec<ResponseItem> {
+    fn build_initial_context(&self, turn_context: &TurnContext) -> Vec<ResponseItem> {
         let mut items = Vec::<ResponseItem>::with_capacity(2);
         if let Some(user_instructions) = turn_context.user_instructions.as_deref() {
             items.push(UserInstructions::new(user_instructions.to_string()).into());
@@ -729,8 +742,8 @@ impl Session {
 
     async fn persist_rollout_items(&self, items: &[RolloutItem]) {
         let recorder = {
-            let guard = self.rollout.lock().await;
-            guard.clone()
+            let guard = self.rollout.lock_unchecked();
+            guard.as_ref().cloned()
         };
         if let Some(rec) = recorder
             && let Err(e) = rec.record_items(items).await
@@ -739,33 +752,19 @@ impl Session {
         }
     }
 
-    async fn update_token_usage_info(
+    fn update_token_usage_info(
         &self,
         turn_context: &TurnContext,
-        token_usage: Option<&TokenUsage>,
-    ) {
-        let mut state = self.state.lock().await;
-        if let Some(token_usage) = token_usage {
-            let info = TokenUsageInfo::new_or_append(
-                &state.token_info,
-                &Some(token_usage.clone()),
-                turn_context.client.get_model_context_window(),
-            );
-            state.token_info = info;
-        }
-    }
-
-    async fn update_rate_limits(&self, new_rate_limits: RateLimitSnapshotEvent) {
-        let mut state = self.state.lock().await;
-        state.latest_rate_limits = Some(new_rate_limits);
-    }
-
-    async fn get_token_count_event(&self) -> TokenCountEvent {
-        let state = self.state.lock().await;
-        TokenCountEvent {
-            info: state.token_info.clone(),
-            rate_limits: state.latest_rate_limits.clone(),
-        }
+        token_usage: &Option<TokenUsage>,
+    ) -> Option<TokenUsageInfo> {
+        let mut state = self.state.lock_unchecked();
+        let info = TokenUsageInfo::new_or_append(
+            &state.token_info,
+            token_usage,
+            turn_context.client.get_model_context_window(),
+        );
+        state.token_info = info.clone();
+        info
     }
 
     /// Record a user input item to conversation history and also persist a
@@ -915,7 +914,6 @@ impl Session {
             exec_args.params,
             exec_args.sandbox_type,
             exec_args.sandbox_policy,
-            exec_args.sandbox_cwd,
             exec_args.codex_linux_sandbox_exe,
             exec_args.stdout_stream,
         )
@@ -974,17 +972,13 @@ impl Session {
 
     /// Build the full turn input by concatenating the current conversation
     /// history with additional items for this turn.
-    pub async fn turn_input_with_history(&self, extra: Vec<ResponseItem>) -> Vec<ResponseItem> {
-        let history = {
-            let state = self.state.lock().await;
-            state.history.contents()
-        };
-        [history, extra].concat()
+    pub fn turn_input_with_history(&self, extra: Vec<ResponseItem>) -> Vec<ResponseItem> {
+        [self.state.lock_unchecked().history.contents(), extra].concat()
     }
 
     /// Returns the input if there was no task running to inject into
-    pub async fn inject_input(&self, input: Vec<InputItem>) -> Result<(), Vec<InputItem>> {
-        let mut state = self.state.lock().await;
+    pub fn inject_input(&self, input: Vec<InputItem>) -> Result<(), Vec<InputItem>> {
+        let mut state = self.state.lock_unchecked();
         if state.current_task.is_some() {
             state.pending_input.push(input.into());
             Ok(())
@@ -993,8 +987,8 @@ impl Session {
         }
     }
 
-    pub async fn get_pending_input(&self) -> Vec<ResponseInputItem> {
-        let mut state = self.state.lock().await;
+    pub fn get_pending_input(&self) -> Vec<ResponseInputItem> {
+        let mut state = self.state.lock_unchecked();
         if state.pending_input.is_empty() {
             Vec::with_capacity(0)
         } else {
@@ -1009,15 +1003,16 @@ impl Session {
         server: &str,
         tool: &str,
         arguments: Option<serde_json::Value>,
+        timeout: Option<Duration>,
     ) -> anyhow::Result<CallToolResult> {
         self.mcp_connection_manager
-            .call_tool(server, tool, arguments)
+            .call_tool(server, tool, arguments, timeout)
             .await
     }
 
-    pub async fn interrupt_task(&self) {
+    fn interrupt_task(&self) {
         info!("interrupt received: abort current task, if any");
-        let mut state = self.state.lock().await;
+        let mut state = self.state.lock_unchecked();
         state.pending_approvals.clear();
         state.pending_input.clear();
         if let Some(task) = state.current_task.take() {
@@ -1025,16 +1020,6 @@ impl Session {
         }
     }
 
-    fn interrupt_task_sync(&self) {
-        if let Ok(mut state) = self.state.try_lock() {
-            state.pending_approvals.clear();
-            state.pending_input.clear();
-            if let Some(task) = state.current_task.take() {
-                task.abort(TurnAbortReason::Interrupted);
-            }
-        }
-    }
-
     /// Spawn the configured notifier (if any) with the given JSON payload as
     /// the last argument. Failures are logged but otherwise ignored so that
     /// notification issues do not interfere with the main workflow.
@@ -1067,7 +1052,7 @@ impl Session {
 
 impl Drop for Session {
     fn drop(&mut self) {
-        self.interrupt_task_sync();
+        self.interrupt_task();
     }
 }
 
@@ -1169,16 +1154,20 @@ impl AgentTask {
     fn abort(self, reason: TurnAbortReason) {
         // TOCTOU?
         if !self.handle.is_finished() {
+            if self.kind == AgentTaskKind::Review {
+                let sess = self.sess.clone();
+                let sub_id = self.sub_id.clone();
+                tokio::spawn(async move {
+                    exit_review_mode(sess, sub_id, None).await;
+                });
+            }
             self.handle.abort();
             let event = Event {
-                id: self.sub_id.clone(),
+                id: self.sub_id,
                 msg: EventMsg::TurnAborted(TurnAbortedEvent { reason }),
             };
             let sess = self.sess;
             tokio::spawn(async move {
-                if self.kind == AgentTaskKind::Review {
-                    exit_review_mode(sess.clone(), self.sub_id, None).await;
-                }
                 sess.send_event(event).await;
             });
         }
@@ -1198,7 +1187,7 @@ async fn submission_loop(
         debug!(?sub, "Submission");
         match sub.op {
             Op::Interrupt => {
-                sess.interrupt_task().await;
+                sess.interrupt_task();
             }
             Op::OverrideTurnContext {
                 cwd,
@@ -1252,6 +1241,8 @@ async fn submission_loop(
 
                 let tools_config = ToolsConfig::new(&ToolsConfigParams {
                     model_family: &effective_family,
+                    approval_policy: new_approval_policy,
+                    sandbox_policy: new_sandbox_policy.clone(),
                     include_plan_tool: config.include_plan_tool,
                     include_apply_patch_tool: config.include_apply_patch_tool,
                     include_web_search_request: config.tools_web_search_request,
@@ -1289,11 +1280,11 @@ async fn submission_loop(
             }
             Op::UserInput { items } => {
                 // attempt to inject input into current task
-                if let Err(items) = sess.inject_input(items).await {
+                if let Err(items) = sess.inject_input(items) {
                     // no current task, spawn a new one
                     let task =
                         AgentTask::spawn(sess.clone(), Arc::clone(&turn_context), sub.id, items);
-                    sess.set_task(task).await;
+                    sess.set_task(task);
                 }
             }
             Op::UserTurn {
@@ -1306,7 +1297,7 @@ async fn submission_loop(
                 summary,
             } => {
                 // attempt to inject input into current task
-                if let Err(items) = sess.inject_input(items).await {
+                if let Err(items) = sess.inject_input(items) {
                     // Derive a fresh TurnContext for this turn using the provided overrides.
                     let provider = turn_context.client.get_provider();
                     let auth_manager = turn_context.client.get_auth_manager();
@@ -1338,6 +1329,8 @@ async fn submission_loop(
                         client,
                         tools_config: ToolsConfig::new(&ToolsConfigParams {
                             model_family: &model_family,
+                            approval_policy,
+                            sandbox_policy: sandbox_policy.clone(),
                             include_plan_tool: config.include_plan_tool,
                             include_apply_patch_tool: config.include_apply_patch_tool,
                             include_web_search_request: config.tools_web_search_request,
@@ -1355,35 +1348,24 @@ async fn submission_loop(
                         cwd,
                         is_review_mode: false,
                     };
-
-                    // if the environment context has changed, record it in the conversation history
-                    let previous_env_context = EnvironmentContext::from(turn_context.as_ref());
-                    let new_env_context = EnvironmentContext::from(&fresh_turn_context);
-                    if !new_env_context.equals_except_shell(&previous_env_context) {
-                        sess.record_conversation_items(&[ResponseItem::from(new_env_context)])
-                            .await;
-                    }
-
-                    // Install the new persistent context for subsequent tasks/turns.
-                    turn_context = Arc::new(fresh_turn_context);
-
+                    // TODO: record the new environment context in the conversation history
                     // no current task, spawn a new one with the per‑turn context
                     let task =
-                        AgentTask::spawn(sess.clone(), Arc::clone(&turn_context), sub.id, items);
-                    sess.set_task(task).await;
+                        AgentTask::spawn(sess.clone(), Arc::new(fresh_turn_context), sub.id, items);
+                    sess.set_task(task);
                 }
             }
             Op::ExecApproval { id, decision } => match decision {
                 ReviewDecision::Abort => {
-                    sess.interrupt_task().await;
+                    sess.interrupt_task();
                 }
-                other => sess.notify_approval(&id, other).await,
+                other => sess.notify_approval(&id, other),
             },
             Op::PatchApproval { id, decision } => match decision {
                 ReviewDecision::Abort => {
-                    sess.interrupt_task().await;
+                    sess.interrupt_task();
                 }
-                other => sess.notify_approval(&id, other).await,
+                other => sess.notify_approval(&id, other),
             },
             Op::AddToHistory { text } => {
                 let id = sess.conversation_id;
@@ -1462,19 +1444,15 @@ async fn submission_loop(
             }
             Op::Compact => {
                 // Attempt to inject input into current task
-                if let Err(items) = sess
-                    .inject_input(vec![InputItem::Text {
-                        text: compact::COMPACT_TRIGGER_TEXT.to_string(),
-                    }])
-                    .await
-                {
+                if let Err(items) = sess.inject_input(vec![InputItem::Text {
+                    text: compact::COMPACT_TRIGGER_TEXT.to_string(),
+                }]) {
                     compact::spawn_compact_task(
                         sess.clone(),
                         Arc::clone(&turn_context),
                         sub.id,
                         items,
-                    )
-                    .await;
+                    );
                 }
             }
             Op::Shutdown => {
@@ -1482,10 +1460,7 @@ async fn submission_loop(
 
                 // Gracefully flush and shutdown rollout recorder on session end so tests
                 // that inspect the rollout file do not race with the background writer.
-                let recorder_opt = {
-                    let mut guard = sess.rollout.lock().await;
-                    guard.take()
-                };
+                let recorder_opt = sess.rollout.lock_unchecked().take();
                 if let Some(rec) = recorder_opt
                     && let Err(e) = rec.shutdown().await
                 {
@@ -1510,7 +1485,7 @@ async fn submission_loop(
                 let sub_id = sub.id.clone();
                 // Flush rollout writes before returning the path so readers observe a consistent file.
                 let (path, rec_opt) = {
-                    let guard = sess.rollout.lock().await;
+                    let guard = sess.rollout.lock_unchecked();
                     match guard.as_ref() {
                         Some(rec) => (rec.get_rollout_path(), Some(rec.clone())),
                         None => {
@@ -1564,6 +1539,8 @@ async fn spawn_review_thread(
         .unwrap_or_else(|| parent_turn_context.client.get_model_family());
     let tools_config = ToolsConfig::new(&ToolsConfigParams {
         model_family: &review_model_family,
+        approval_policy: parent_turn_context.approval_policy,
+        sandbox_policy: parent_turn_context.sandbox_policy.clone(),
         include_plan_tool: false,
         include_apply_patch_tool: config.include_apply_patch_tool,
         include_web_search_request: false,
@@ -1572,8 +1549,7 @@ async fn spawn_review_thread(
         experimental_unified_exec_tool: config.use_experimental_unified_exec_tool,
     });
 
-    let base_instructions = REVIEW_PROMPT.to_string();
-    let review_prompt = review_request.prompt.clone();
+    let base_instructions = Some(REVIEW_PROMPT.to_string());
     let provider = parent_turn_context.client.get_provider();
     let auth_manager = parent_turn_context.client.get_auth_manager();
     let model_family = review_model_family.clone();
@@ -1582,19 +1558,16 @@ async fn spawn_review_thread(
     let mut per_turn_config = (*config).clone();
     per_turn_config.model = model.clone();
     per_turn_config.model_family = model_family.clone();
-    per_turn_config.model_reasoning_effort = Some(ReasoningEffortConfig::Low);
-    per_turn_config.model_reasoning_summary = ReasoningSummaryConfig::Detailed;
     if let Some(model_info) = get_model_info(&model_family) {
         per_turn_config.model_context_window = Some(model_info.context_window);
     }
 
-    let per_turn_config = Arc::new(per_turn_config);
     let client = ModelClient::new(
-        per_turn_config.clone(),
+        Arc::new(per_turn_config),
         auth_manager,
         provider,
-        per_turn_config.model_reasoning_effort,
-        per_turn_config.model_reasoning_summary,
+        parent_turn_context.client.get_reasoning_effort(),
+        parent_turn_context.client.get_reasoning_summary(),
         sess.conversation_id,
     );
 
@@ -1602,7 +1575,7 @@ async fn spawn_review_thread(
         client,
         tools_config,
         user_instructions: None,
-        base_instructions: Some(base_instructions.clone()),
+        base_instructions,
         approval_policy: parent_turn_context.approval_policy,
         sandbox_policy: parent_turn_context.sandbox_policy.clone(),
         shell_environment_policy: parent_turn_context.shell_environment_policy.clone(),
@@ -1612,14 +1585,14 @@ async fn spawn_review_thread(
 
     // Seed the child task with the review prompt as the initial user message.
     let input: Vec<InputItem> = vec![InputItem::Text {
-        text: format!("{base_instructions}\n\n---\n\nNow, here's your task: {review_prompt}"),
+        text: review_request.prompt.clone(),
     }];
     let tc = Arc::new(review_turn_context);
 
     // Clone sub_id for the upcoming announcement before moving it into the task.
     let sub_id_for_event = sub_id.clone();
     let task = AgentTask::review(sess.clone(), tc.clone(), sub_id, input);
-    sess.set_task(task).await;
+    sess.set_task(task);
 
     // Announce entering review mode so UIs can switch modes.
     sess.send_event(Event {
@@ -1670,8 +1643,6 @@ async fn run_task(
     let is_review_mode = turn_context.is_review_mode;
     let mut review_thread_history: Vec<ResponseItem> = Vec::new();
     if is_review_mode {
-        // Seed review threads with environment context so the model knows the working directory.
-        review_thread_history.extend(sess.build_initial_context(turn_context.as_ref()));
         review_thread_history.push(initial_input_for_turn.into());
     } else {
         sess.record_input_and_rollout_usermsg(&initial_input_for_turn)
@@ -1690,7 +1661,6 @@ async fn run_task(
         // may support this, the model might not.
         let pending_input = sess
             .get_pending_input()
-            .await
             .into_iter()
             .map(ResponseItem::from)
             .collect::<Vec<ResponseItem>>();
@@ -1712,7 +1682,7 @@ async fn run_task(
             review_thread_history.clone()
         } else {
             sess.record_conversation_items(&pending_input).await;
-            sess.turn_input_with_history(pending_input).await
+            sess.turn_input_with_history(pending_input)
         };
 
         let turn_input_messages: Vec<String> = turn_input
@@ -1748,7 +1718,7 @@ async fn run_task(
                     .unwrap_or(i64::MAX);
                 let total_usage_tokens = total_token_usage
                     .as_ref()
-                    .map(TokenUsage::tokens_in_context_window);
+                    .map(|usage| usage.tokens_in_context_window());
                 let token_limit_reached = total_usage_tokens
                     .map(|tokens| (tokens as i64) >= limit)
                     .unwrap_or(false);
@@ -1924,7 +1894,7 @@ async fn run_task(
         .await;
     }
 
-    sess.remove_task(&sub_id).await;
+    sess.remove_task(&sub_id);
     let event = Event {
         id: sub_id,
         msg: EventMsg::TaskComplete(TaskCompleteEvent { last_agent_message }),
@@ -1985,19 +1955,6 @@ async fn run_turn(
                 return Err(e);
             }
             Err(e) => {
-                // If we hit a context/window limit error, ask the UI to
-                // offer a compact confirmation and stop retrying this turn.
-                if matches!(e, CodexErr::ContextLengthExceeded(_)) {
-                    let event = Event {
-                        id: sub_id.clone(),
-                        msg: EventMsg::CompactApprovalRequest(CompactApprovalRequestEvent {
-                            reason: "The chat has exceeded its limits. To continue, you need to compact the chat. Confirm running compact?".to_string(),
-                        }),
-                    };
-                    sess.send_event(event).await;
-                    // Non-transient – do not retry this turn further; let UI prompt.
-                    return Err(e);
-                }
                 // Use the configured provider-specific stream retry budget.
                 let max_retries = turn_context.client.get_provider().stream_max_retries();
                 if retries < max_retries {
@@ -2166,22 +2123,15 @@ async fn try_run_turn(
                     })
                     .await;
             }
-            ResponseEvent::RateLimits(snapshot) => {
-                // Update internal state with latest rate limits, but defer sending until
-                // token usage is available to avoid duplicate TokenCount events.
-                sess.update_rate_limits(snapshot).await;
-            }
             ResponseEvent::Completed {
                 response_id: _,
                 token_usage,
             } => {
-                sess.update_token_usage_info(turn_context, token_usage.as_ref())
-                    .await;
-                let token_event = sess.get_token_count_event().await;
+                let info = sess.update_token_usage_info(turn_context, &token_usage);
                 let _ = sess
                     .send_event(Event {
                         id: sub_id.to_string(),
-                        msg: EventMsg::TokenCount(token_event),
+                        msg: EventMsg::TokenCount(crate::protocol::TokenCountEvent { info }),
                     })
                     .await;
 
@@ -2511,10 +2461,7 @@ async fn handle_function_call(
                 }
             };
             let abs = turn_context.resolve_path(Some(args.path));
-            let output = match sess
-                .inject_input(vec![InputItem::LocalImage { path: abs }])
-                .await
-            {
+            let output = match sess.inject_input(vec![InputItem::LocalImage { path: abs }]) {
                 Ok(()) => FunctionCallOutputPayload {
                     content: "attached local image path".to_string(),
                     success: Some(true),
@@ -2609,7 +2556,12 @@ async fn handle_function_call(
         _ => {
             match sess.mcp_connection_manager.parse_tool_name(&name) {
                 Some((server, tool_name)) => {
-                    handle_mcp_tool_call(sess, &sub_id, call_id, server, tool_name, arguments).await
+                    // TODO(mbolin): Determine appropriate timeout for tool call.
+                    let timeout = None;
+                    handle_mcp_tool_call(
+                        sess, &sub_id, call_id, server, tool_name, arguments, timeout,
+                    )
+                    .await
                 }
                 None => {
                     // Unknown function: reply with structured failure so the model can adapt.
@@ -2715,7 +2667,6 @@ pub struct ExecInvokeArgs<'a> {
     pub params: ExecParams,
     pub sandbox_type: SandboxType,
     pub sandbox_policy: &'a SandboxPolicy,
-    pub sandbox_cwd: &'a Path,
     pub codex_linux_sandbox_exe: &'a Option<PathBuf>,
     pub stdout_stream: Option<StdoutStream>,
 }
@@ -2746,21 +2697,6 @@ async fn handle_container_exec_with_params(
     sub_id: String,
     call_id: String,
 ) -> ResponseInputItem {
-    if params.with_escalated_permissions.unwrap_or(false)
-        && !matches!(turn_context.approval_policy, AskForApproval::OnRequest)
-    {
-        return ResponseInputItem::FunctionCallOutput {
-            call_id,
-            output: FunctionCallOutputPayload {
-                content: format!(
-                    "approval policy is {policy:?}; reject command — you should not ask for escalated permissions if the approval policy is {policy:?}",
-                    policy = turn_context.approval_policy
-                ),
-                success: None,
-            },
-        };
-    }
-
     // check if this was a patch, and apply it if so
     let apply_patch_exec = match maybe_parse_apply_patch_verified(&params.command, &params.cwd) {
         MaybeApplyPatchVerified::Body(changes) => {
@@ -2839,7 +2775,7 @@ async fn handle_container_exec_with_params(
         }
         None => {
             let safety = {
-                let state = sess.state.lock().await;
+                let state = sess.state.lock_unchecked();
                 assess_command_safety(
                     &params.command,
                     turn_context.approval_policy,
@@ -2868,7 +2804,7 @@ async fn handle_container_exec_with_params(
             match rx_approve.await.unwrap_or_default() {
                 ReviewDecision::Approved => (),
                 ReviewDecision::ApprovedForSession => {
-                    sess.add_approved_command(params.command.clone()).await;
+                    sess.add_approved_command(params.command.clone());
                 }
                 ReviewDecision::Denied | ReviewDecision::Abort => {
                     return ResponseInputItem::FunctionCallOutput {
@@ -2922,7 +2858,6 @@ async fn handle_container_exec_with_params(
                 params: params.clone(),
                 sandbox_type,
                 sandbox_policy: &turn_context.sandbox_policy,
-                sandbox_cwd: &turn_context.cwd,
                 codex_linux_sandbox_exe: &sess.codex_linux_sandbox_exe,
                 stdout_stream: if exec_command_context.apply_patch.is_some() {
                     None
@@ -3042,7 +2977,7 @@ async fn handle_sandbox_error(
             // remainder of the session so future
             // executions skip the sandbox directly.
             // TODO(ragona): Isn't this a bug? It always saves the command in an | fork?
-            sess.add_approved_command(params.command.clone()).await;
+            sess.add_approved_command(params.command.clone());
             // Inform UI we are retrying without sandbox.
             sess.notify_background_event(&sub_id, "retrying command without sandbox")
                 .await;
@@ -3057,7 +2992,6 @@ async fn handle_sandbox_error(
                         params,
                         sandbox_type: SandboxType::None,
                         sandbox_policy: &turn_context.sandbox_policy,
-                        sandbox_cwd: &turn_context.cwd,
                         codex_linux_sandbox_exe: &sess.codex_linux_sandbox_exe,
                         stdout_stream: if exec_command_context.apply_patch.is_some() {
                             None
@@ -3312,8 +3246,7 @@ fn convert_call_tool_result_to_function_call_output_payload(
     }
 }
 
-/// Emits an ExitedReviewMode Event with optional ReviewOutput,
-/// and records a developer message with the review output.
+/// Emits an ExitedReviewMode Event with optional ReviewOutput.
 async fn exit_review_mode(
     session: Arc<Session>,
     task_sub_id: String,
@@ -3321,55 +3254,11 @@ async fn exit_review_mode(
 ) {
     let event = Event {
         id: task_sub_id,
-        msg: EventMsg::ExitedReviewMode(ExitedReviewModeEvent {
-            review_output: review_output.clone(),
-        }),
+        msg: EventMsg::ExitedReviewMode(ExitedReviewModeEvent { review_output }),
     };
     session.send_event(event).await;
-
-    let mut user_message = String::new();
-    if let Some(out) = review_output {
-        let mut findings_str = String::new();
-        let text = out.overall_explanation.trim();
-        if !text.is_empty() {
-            findings_str.push_str(text);
-        }
-        if !out.findings.is_empty() {
-            let block = format_review_findings_block(&out.findings, None);
-            findings_str.push_str(&format!("\n{block}"));
-        }
-        user_message.push_str(&format!(
-            r#"<user_action>
-  <context>User initiated a review task. Here's the full review output from reviewer model. User may select one or more comments to resolve.</context>
-  <action>review</action>
-  <results>
-  {findings_str}
-  </results>
-</user_action>
-"#));
-    } else {
-        user_message.push_str(r#"<user_action>
-  <context>User initiated a review task, but was interrupted. If user asks about this, tell them to re-initiate a review with `/review` and wait for it to complete.</context>
-  <action>review</action>
-  <results>
-  None.
-  </results>
-</user_action>
-"#);
-    }
-
-    session
-        .record_conversation_items(&[ResponseItem::Message {
-            id: None,
-            role: "user".to_string(),
-            content: vec![ContentItem::InputText { text: user_message }],
-        }])
-        .await;
 }
 
-#[cfg(test)]
-pub(crate) use tests::make_session_and_context;
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -3382,7 +3271,6 @@ mod tests {
     use mcp_types::ContentBlock;
     use mcp_types::TextContent;
     use pretty_assertions::assert_eq;
-    use serde::Deserialize;
     use serde_json::json;
     use std::path::PathBuf;
     use std::sync::Arc;
@@ -3412,7 +3300,7 @@ mod tests {
             }),
         ));
 
-        let actual = tokio_test::block_on(async { session.state.lock().await.history.contents() });
+        let actual = session.state.lock_unchecked().history.contents();
         assert_eq!(expected, actual);
     }
 
@@ -3425,7 +3313,7 @@ mod tests {
             session.record_initial_history(&turn_context, InitialHistory::Forked(rollout_items)),
         );
 
-        let actual = tokio_test::block_on(async { session.state.lock().await.history.contents() });
+        let actual = session.state.lock_unchecked().history.contents();
         assert_eq!(expected, actual);
     }
 
@@ -3611,7 +3499,7 @@ mod tests {
         })
     }
 
-    pub(crate) fn make_session_and_context() -> (Session, TurnContext) {
+    fn make_session_and_context() -> (Session, TurnContext) {
         let (tx_event, _rx_event) = async_channel::unbounded();
         let codex_home = tempfile::tempdir().expect("create temp dir");
         let config = Config::load_from_base_config_with_overrides(
@@ -3632,6 +3520,8 @@ mod tests {
         );
         let tools_config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &config.model_family,
+            approval_policy: config.approval_policy,
+            sandbox_policy: config.sandbox_policy.clone(),
             include_plan_tool: config.include_plan_tool,
             include_apply_patch_tool: config.include_apply_patch_tool,
             include_web_search_request: config.tools_web_search_request,
@@ -3665,7 +3555,6 @@ mod tests {
             codex_linux_sandbox_exe: None,
             user_shell: shell::Shell::Unknown,
             show_raw_agent_reasoning: config.show_raw_agent_reasoning,
-            next_internal_sub_id: AtomicU64::new(0),
         };
         (session, turn_context)
     }
@@ -3771,105 +3660,4 @@ mod tests {
 
         (rollout_items, live_history.contents())
     }
-
-    #[tokio::test]
-    async fn rejects_escalated_permissions_when_policy_not_on_request() {
-        use crate::exec::ExecParams;
-        use crate::protocol::AskForApproval;
-        use crate::protocol::SandboxPolicy;
-        use crate::turn_diff_tracker::TurnDiffTracker;
-        use std::collections::HashMap;
-
-        let (session, mut turn_context) = make_session_and_context();
-        // Ensure policy is NOT OnRequest so the early rejection path triggers
-        turn_context.approval_policy = AskForApproval::OnFailure;
-
-        let params = ExecParams {
-            command: if cfg!(windows) {
-                vec![
-                    "cmd.exe".to_string(),
-                    "/C".to_string(),
-                    "echo hi".to_string(),
-                ]
-            } else {
-                vec![
-                    "/bin/sh".to_string(),
-                    "-c".to_string(),
-                    "echo hi".to_string(),
-                ]
-            },
-            cwd: turn_context.cwd.clone(),
-            timeout_ms: Some(1000),
-            env: HashMap::new(),
-            with_escalated_permissions: Some(true),
-            justification: Some("test".to_string()),
-        };
-
-        let params2 = ExecParams {
-            with_escalated_permissions: Some(false),
-            ..params.clone()
-        };
-
-        let mut turn_diff_tracker = TurnDiffTracker::new();
-
-        let sub_id = "test-sub".to_string();
-        let call_id = "test-call".to_string();
-
-        let resp = handle_container_exec_with_params(
-            params,
-            &session,
-            &turn_context,
-            &mut turn_diff_tracker,
-            sub_id,
-            call_id,
-        )
-        .await;
-
-        let ResponseInputItem::FunctionCallOutput { output, .. } = resp else {
-            panic!("expected FunctionCallOutput");
-        };
-
-        let expected = format!(
-            "approval policy is {policy:?}; reject command — you should not ask for escalated permissions if the approval policy is {policy:?}",
-            policy = turn_context.approval_policy
-        );
-
-        pretty_assertions::assert_eq!(output.content, expected);
-
-        // Now retry the same command WITHOUT escalated permissions; should succeed.
-        // Force DangerFullAccess to avoid platform sandbox dependencies in tests.
-        turn_context.sandbox_policy = SandboxPolicy::DangerFullAccess;
-
-        let resp2 = handle_container_exec_with_params(
-            params2,
-            &session,
-            &turn_context,
-            &mut turn_diff_tracker,
-            "test-sub".to_string(),
-            "test-call-2".to_string(),
-        )
-        .await;
-
-        let ResponseInputItem::FunctionCallOutput { output, .. } = resp2 else {
-            panic!("expected FunctionCallOutput on retry");
-        };
-
-        #[derive(Deserialize, PartialEq, Eq, Debug)]
-        struct ResponseExecMetadata {
-            exit_code: i32,
-        }
-
-        #[derive(Deserialize)]
-        struct ResponseExecOutput {
-            output: String,
-            metadata: ResponseExecMetadata,
-        }
-
-        let exec_output: ResponseExecOutput =
-            serde_json::from_str(&output.content).expect("valid exec output json");
-
-        pretty_assertions::assert_eq!(exec_output.metadata, ResponseExecMetadata { exit_code: 0 });
-        assert!(exec_output.output.contains("hi"));
-        pretty_assertions::assert_eq!(output.success, Some(true));
-    }
 }

codex-rs/core/src/codex/compact.rs

@@ -1,6 +1,7 @@
 use std::sync::Arc;
 
 use super::AgentTask;
+use super::MutexExt;
 use super::Session;
 use super::TurnContext;
 use super::get_last_assistant_message_from_turn;
@@ -18,7 +19,6 @@ use crate::protocol::InputMessageKind;
 use crate::protocol::TaskCompleteEvent;
 use crate::protocol::TaskStartedEvent;
 use crate::protocol::TurnContextItem;
-use crate::truncate::truncate_middle;
 use crate::util::backoff;
 use askama::Template;
 use codex_protocol::models::ContentItem;
@@ -29,7 +29,6 @@ use futures::prelude::*;
 
 pub(super) const COMPACT_TRIGGER_TEXT: &str = "Start Summarization";
 const SUMMARIZATION_PROMPT: &str = include_str!("../../templates/compact/prompt.md");
-const COMPACT_USER_MESSAGE_MAX_TOKENS: usize = 20_000;
 
 #[derive(Template)]
 #[template(path = "compact/history_bridge.md", escape = "none")]
@@ -38,7 +37,7 @@ struct HistoryBridgeTemplate<'a> {
     summary_text: &'a str,
 }
 
-pub(super) async fn spawn_compact_task(
+pub(super) fn spawn_compact_task(
     sess: Arc<Session>,
     turn_context: Arc<TurnContext>,
     sub_id: String,
@@ -51,7 +50,7 @@ pub(super) async fn spawn_compact_task(
         input,
         SUMMARIZATION_PROMPT.to_string(),
     );
-    sess.set_task(task).await;
+    sess.set_task(task);
 }
 
 pub(super) async fn run_inline_auto_compact_task(
@@ -80,29 +79,15 @@ pub(super) async fn run_compact_task(
     input: Vec<InputItem>,
     compact_instructions: String,
 ) {
-    let start_event = Event {
-        id: sub_id.clone(),
-        msg: EventMsg::TaskStarted(TaskStartedEvent {
-            model_context_window: turn_context.client.get_model_context_window(),
-        }),
-    };
-    sess.send_event(start_event).await;
     run_compact_task_inner(
-        sess.clone(),
+        sess,
         turn_context,
-        sub_id.clone(),
+        sub_id,
         input,
         compact_instructions,
         true,
     )
     .await;
-    let event = Event {
-        id: sub_id,
-        msg: EventMsg::TaskComplete(TaskCompleteEvent {
-            last_agent_message: None,
-        }),
-    };
-    sess.send_event(event).await;
 }
 
 async fn run_compact_task_inner(
@@ -113,15 +98,23 @@ async fn run_compact_task_inner(
     compact_instructions: String,
     remove_task_on_completion: bool,
 ) {
+    let model_context_window = turn_context.client.get_model_context_window();
+    let start_event = Event {
+        id: sub_id.clone(),
+        msg: EventMsg::TaskStarted(TaskStartedEvent {
+            model_context_window,
+        }),
+    };
+    sess.send_event(start_event).await;
+
     let initial_input_for_turn: ResponseInputItem = ResponseInputItem::from(input);
     let instructions_override = compact_instructions;
+    let turn_input = sess.turn_input_with_history(vec![initial_input_for_turn.clone().into()]);
 
-    // Build an in-memory snapshot of the current history; attempts will pop
-    // from this vector on context-length errors without modifying the session
-    // transcript.
-    let mut working_history = {
-        let state = sess.state.lock().await;
-        state.history.contents()
+    let prompt = Prompt {
+        input: turn_input,
+        tools: Vec::new(),
+        base_instructions_override: Some(instructions_override),
     };
 
     let max_retries = turn_context.client.get_provider().stream_max_retries();
@@ -138,17 +131,6 @@ async fn run_compact_task_inner(
     sess.persist_rollout_items(&[rollout_item]).await;
 
     loop {
-        // Build prompt input = history + compact trigger
-        let mut turn_input: Vec<ResponseItem> = Vec::with_capacity(working_history.len() + 1);
-        turn_input.extend_from_slice(&working_history);
-        turn_input.push(initial_input_for_turn.clone().into());
-
-        let prompt = Prompt {
-            input: turn_input,
-            tools: Vec::new(),
-            base_instructions_override: Some(instructions_override.clone()),
-        };
-
         let attempt_result = drain_to_completed(&sess, turn_context.as_ref(), &prompt).await;
 
         match attempt_result {
@@ -159,28 +141,6 @@ async fn run_compact_task_inner(
                 return;
             }
             Err(e) => {
-                // Special-case compaction overflows: trim and retry immediately with no backoff.
-                if matches!(e, CodexErr::ContextLengthExceeded(_)) {
-                    if working_history.pop().is_some() {
-                        sess.notify_stream_error(
-                            &sub_id,
-                            "compact input exceeds context window; retrying with 1 fewer item…",
-                        )
-                        .await;
-                        continue;
-                    } else {
-                        let event = Event {
-                            id: sub_id.clone(),
-                            msg: EventMsg::Error(ErrorEvent {
-                                message:
-                                    "Unable to compact: context window too small for any history"
-                                        .to_string(),
-                            }),
-                        };
-                        sess.send_event(event).await;
-                        return;
-                    }
-                }
                 if retries < max_retries {
                     retries += 1;
                     let delay = backoff(retries);
@@ -208,10 +168,10 @@ async fn run_compact_task_inner(
     }
 
     if remove_task_on_completion {
-        sess.remove_task(&sub_id).await;
+        sess.remove_task(&sub_id);
     }
     let history_snapshot = {
-        let state = sess.state.lock().await;
+        let state = sess.state.lock_unchecked();
         state.history.contents()
     };
     let summary_text = get_last_assistant_message_from_turn(&history_snapshot).unwrap_or_default();
@@ -219,7 +179,7 @@ async fn run_compact_task_inner(
     let initial_context = sess.build_initial_context(turn_context.as_ref());
     let new_history = build_compacted_history(initial_context, &user_messages, &summary_text);
     {
-        let mut state = sess.state.lock().await;
+        let mut state = sess.state.lock_unchecked();
         state.history.replace(new_history);
     }
 
@@ -235,9 +195,16 @@ async fn run_compact_task_inner(
         }),
     };
     sess.send_event(event).await;
+    let event = Event {
+        id: sub_id.clone(),
+        msg: EventMsg::TaskComplete(TaskCompleteEvent {
+            last_agent_message: None,
+        }),
+    };
+    sess.send_event(event).await;
 }
 
-pub fn content_items_to_text(content: &[ContentItem]) -> Option<String> {
+fn content_items_to_text(content: &[ContentItem]) -> Option<String> {
     let mut pieces = Vec::new();
     for item in content {
         match item {
@@ -269,7 +236,7 @@ pub(crate) fn collect_user_messages(items: &[ResponseItem]) -> Vec<String> {
         .collect()
 }
 
-pub fn is_session_prefix_message(text: &str) -> bool {
+fn is_session_prefix_message(text: &str) -> bool {
     matches!(
         InputMessageKind::from(("user", text)),
         InputMessageKind::UserInstructions | InputMessageKind::EnvironmentContext
@@ -282,17 +249,11 @@ pub(crate) fn build_compacted_history(
     summary_text: &str,
 ) -> Vec<ResponseItem> {
     let mut history = initial_context;
-    let mut user_messages_text = if user_messages.is_empty() {
+    let user_messages_text = if user_messages.is_empty() {
         "(none)".to_string()
     } else {
         user_messages.join("\n\n")
     };
-    // Truncate the concatenated prior user messages so the bridge message
-    // stays well under the context window (approx. 4 bytes/token).
-    let max_bytes = COMPACT_USER_MESSAGE_MAX_TOKENS * 4;
-    if user_messages_text.len() > max_bytes {
-        user_messages_text = truncate_middle(&user_messages_text, max_bytes).0;
-    }
     let summary_text = if summary_text.is_empty() {
         "(no summary available)".to_string()
     } else {
@@ -329,7 +290,7 @@ async fn drain_to_completed(
         };
         match event {
             Ok(ResponseEvent::OutputItemDone(item)) => {
-                let mut state = sess.state.lock().await;
+                let mut state = sess.state.lock_unchecked();
                 state.history.record_items(std::slice::from_ref(&item));
             }
             Ok(ResponseEvent::Completed { .. }) => {
@@ -436,38 +397,4 @@ mod tests {
 
         assert_eq!(vec!["real user message".to_string()], collected);
     }
-
-    #[test]
-    fn build_compacted_history_truncates_overlong_user_messages() {
-        // Prepare a very large prior user message so the aggregated
-        // `user_messages_text` exceeds the truncation threshold used by
-        // `build_compacted_history` (80k bytes).
-        let big = "X".repeat(200_000);
-        let history = build_compacted_history(Vec::new(), std::slice::from_ref(&big), "SUMMARY");
-
-        // Expect exactly one bridge message added to history (plus any initial context we provided, which is none).
-        assert_eq!(history.len(), 1);
-
-        // Extract the text content of the bridge message.
-        let bridge_text = match &history[0] {
-            ResponseItem::Message { role, content, .. } if role == "user" => {
-                content_items_to_text(content).unwrap_or_default()
-            }
-            other => panic!("unexpected item in history: {other:?}"),
-        };
-
-        // The bridge should contain the truncation marker and not the full original payload.
-        assert!(
-            bridge_text.contains("tokens truncated"),
-            "expected truncation marker in bridge message"
-        );
-        assert!(
-            !bridge_text.contains(&big),
-            "bridge should not include the full oversized user text"
-        );
-        assert!(
-            bridge_text.contains("SUMMARY"),
-            "bridge should include the provided summary text"
-        );
-    }
 }

codex-rs/core/src/config.rs

@@ -1,7 +1,6 @@
 use crate::config_profile::ConfigProfile;
 use crate::config_types::History;
 use crate::config_types::McpServerConfig;
-use crate::config_types::Notifications;
 use crate::config_types::ReasoningSummaryFormat;
 use crate::config_types::SandboxWorkspaceWrite;
 use crate::config_types::ShellEnvironmentPolicy;
@@ -26,20 +25,17 @@ use codex_protocol::mcp_protocol::Tools;
 use codex_protocol::mcp_protocol::UserSavedConfig;
 use dirs::home_dir;
 use serde::Deserialize;
-use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::path::Path;
 use std::path::PathBuf;
 use tempfile::NamedTempFile;
 use toml::Value as TomlValue;
-use toml_edit::Array as TomlArray;
 use toml_edit::DocumentMut;
-use toml_edit::Item as TomlItem;
-use toml_edit::Table as TomlTable;
 
 const OPENAI_DEFAULT_MODEL: &str = "gpt-5";
-const OPENAI_DEFAULT_REVIEW_MODEL: &str = "gpt-5-codex";
-pub const GPT_5_CODEX_MEDIUM_MODEL: &str = "gpt-5-codex";
+const OPENAI_DEFAULT_REVIEW_MODEL: &str = "gpt-5";
+pub const SWIFTFOX_MEDIUM_MODEL: &str = "swiftfox";
+pub const SWIFTFOX_MODEL_DISPLAY_NAME: &str = "swiftfox-medium";
 
 /// Maximum number of bytes of the documentation that will be embedded. Larger
 /// files are *silently truncated* to this size so we do not take up too much of
@@ -118,10 +114,6 @@ pub struct Config {
     /// If unset the feature is disabled.
     pub notify: Option<Vec<String>>,
 
-    /// TUI notifications preference. When set, the TUI will send OSC 9 notifications on approvals
-    /// and turn completions when not focused.
-    pub tui_notifications: Notifications,
-
     /// The directory that should be treated as the current working directory
     /// for the session. All relative paths inside the business-logic layer are
     /// resolved against this path.
@@ -273,86 +265,6 @@ pub fn load_config_as_toml(codex_home: &Path) -> std::io::Result<TomlValue> {
     }
 }
 
-pub fn load_global_mcp_servers(
-    codex_home: &Path,
-) -> std::io::Result<BTreeMap<String, McpServerConfig>> {
-    let root_value = load_config_as_toml(codex_home)?;
-    let Some(servers_value) = root_value.get("mcp_servers") else {
-        return Ok(BTreeMap::new());
-    };
-
-    servers_value
-        .clone()
-        .try_into()
-        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))
-}
-
-pub fn write_global_mcp_servers(
-    codex_home: &Path,
-    servers: &BTreeMap<String, McpServerConfig>,
-) -> std::io::Result<()> {
-    let config_path = codex_home.join(CONFIG_TOML_FILE);
-    let mut doc = match std::fs::read_to_string(&config_path) {
-        Ok(contents) => contents
-            .parse::<DocumentMut>()
-            .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?,
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => DocumentMut::new(),
-        Err(e) => return Err(e),
-    };
-
-    doc.as_table_mut().remove("mcp_servers");
-
-    if !servers.is_empty() {
-        let mut table = TomlTable::new();
-        table.set_implicit(true);
-        doc["mcp_servers"] = TomlItem::Table(table);
-
-        for (name, config) in servers {
-            let mut entry = TomlTable::new();
-            entry.set_implicit(false);
-            entry["command"] = toml_edit::value(config.command.clone());
-
-            if !config.args.is_empty() {
-                let mut args = TomlArray::new();
-                for arg in &config.args {
-                    args.push(arg.clone());
-                }
-                entry["args"] = TomlItem::Value(args.into());
-            }
-
-            if let Some(env) = &config.env
-                && !env.is_empty()
-            {
-                let mut env_table = TomlTable::new();
-                env_table.set_implicit(false);
-                let mut pairs: Vec<_> = env.iter().collect();
-                pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                for (key, value) in pairs {
-                    env_table.insert(key, toml_edit::value(value.clone()));
-                }
-                entry["env"] = TomlItem::Table(env_table);
-            }
-
-            if let Some(timeout) = config.startup_timeout_sec {
-                entry["startup_timeout_sec"] = toml_edit::value(timeout.as_secs_f64());
-            }
-
-            if let Some(timeout) = config.tool_timeout_sec {
-                entry["tool_timeout_sec"] = toml_edit::value(timeout.as_secs_f64());
-            }
-
-            doc["mcp_servers"][name.as_str()] = TomlItem::Table(entry);
-        }
-    }
-
-    std::fs::create_dir_all(codex_home)?;
-    let tmp_file = NamedTempFile::new_in(codex_home)?;
-    std::fs::write(tmp_file.path(), doc.to_string())?;
-    tmp_file.persist(config_path).map_err(|err| err.error)?;
-
-    Ok(())
-}
-
 fn set_project_trusted_inner(doc: &mut DocumentMut, project_path: &Path) -> anyhow::Result<()> {
     // Ensure we render a human-friendly structure:
     //
@@ -1046,11 +958,6 @@ impl Config {
             include_view_image_tool,
             active_profile: active_profile_name,
             disable_paste_burst: cfg.disable_paste_burst.unwrap_or(false),
-            tui_notifications: cfg
-                .tui
-                .as_ref()
-                .map(|t| t.notifications.clone())
-                .unwrap_or_default(),
         };
         Ok(config)
     }
@@ -1161,12 +1068,10 @@ pub fn log_dir(cfg: &Config) -> std::io::Result<PathBuf> {
 #[cfg(test)]
 mod tests {
     use crate::config_types::HistoryPersistence;
-    use crate::config_types::Notifications;
 
     use super::*;
     use pretty_assertions::assert_eq;
 
-    use std::time::Duration;
     use tempfile::TempDir;
 
     #[test]
@@ -1201,19 +1106,6 @@ persistence = "none"
         );
     }
 
-    #[test]
-    fn tui_config_missing_notifications_field_defaults_to_disabled() {
-        let cfg = r#"
-[tui]
-"#;
-
-        let parsed = toml::from_str::<ConfigToml>(cfg)
-            .expect("TUI config without notifications should succeed");
-        let tui = parsed.tui.expect("config should include tui section");
-
-        assert_eq!(tui.notifications, Notifications::Enabled(false));
-    }
-
     #[test]
     fn test_sandbox_config_parsing() {
         let sandbox_full_access = r#"
@@ -1270,72 +1162,6 @@ exclude_slash_tmp = true
         );
     }
 
-    #[test]
-    fn load_global_mcp_servers_returns_empty_if_missing() -> anyhow::Result<()> {
-        let codex_home = TempDir::new()?;
-
-        let servers = load_global_mcp_servers(codex_home.path())?;
-        assert!(servers.is_empty());
-
-        Ok(())
-    }
-
-    #[test]
-    fn write_global_mcp_servers_round_trips_entries() -> anyhow::Result<()> {
-        let codex_home = TempDir::new()?;
-
-        let mut servers = BTreeMap::new();
-        servers.insert(
-            "docs".to_string(),
-            McpServerConfig {
-                command: "echo".to_string(),
-                args: vec!["hello".to_string()],
-                env: None,
-                startup_timeout_sec: Some(Duration::from_secs(3)),
-                tool_timeout_sec: Some(Duration::from_secs(5)),
-            },
-        );
-
-        write_global_mcp_servers(codex_home.path(), &servers)?;
-
-        let loaded = load_global_mcp_servers(codex_home.path())?;
-        assert_eq!(loaded.len(), 1);
-        let docs = loaded.get("docs").expect("docs entry");
-        assert_eq!(docs.command, "echo");
-        assert_eq!(docs.args, vec!["hello".to_string()]);
-        assert_eq!(docs.startup_timeout_sec, Some(Duration::from_secs(3)));
-        assert_eq!(docs.tool_timeout_sec, Some(Duration::from_secs(5)));
-
-        let empty = BTreeMap::new();
-        write_global_mcp_servers(codex_home.path(), &empty)?;
-        let loaded = load_global_mcp_servers(codex_home.path())?;
-        assert!(loaded.is_empty());
-
-        Ok(())
-    }
-
-    #[test]
-    fn load_global_mcp_servers_accepts_legacy_ms_field() -> anyhow::Result<()> {
-        let codex_home = TempDir::new()?;
-        let config_path = codex_home.path().join(CONFIG_TOML_FILE);
-
-        std::fs::write(
-            &config_path,
-            r#"
-[mcp_servers]
-[mcp_servers.docs]
-command = "echo"
-startup_timeout_ms = 2500
-"#,
-        )?;
-
-        let servers = load_global_mcp_servers(codex_home.path())?;
-        let docs = servers.get("docs").expect("docs entry");
-        assert_eq!(docs.startup_timeout_sec, Some(Duration::from_millis(2500)));
-
-        Ok(())
-    }
-
     #[tokio::test]
     async fn persist_model_selection_updates_defaults() -> anyhow::Result<()> {
         let codex_home = TempDir::new()?;
@@ -1343,7 +1169,7 @@ startup_timeout_ms = 2500
         persist_model_selection(
             codex_home.path(),
             None,
-            "gpt-5-codex",
+            "swiftfox",
             Some(ReasoningEffort::High),
         )
         .await?;
@@ -1352,7 +1178,7 @@ startup_timeout_ms = 2500
             tokio::fs::read_to_string(codex_home.path().join(CONFIG_TOML_FILE)).await?;
         let parsed: ConfigToml = toml::from_str(&serialized)?;
 
-        assert_eq!(parsed.model.as_deref(), Some("gpt-5-codex"));
+        assert_eq!(parsed.model.as_deref(), Some("swiftfox"));
         assert_eq!(parsed.model_reasoning_effort, Some(ReasoningEffort::High));
 
         Ok(())
@@ -1406,7 +1232,7 @@ model = "gpt-4.1"
         persist_model_selection(
             codex_home.path(),
             Some("dev"),
-            "gpt-5-codex",
+            "swiftfox",
             Some(ReasoningEffort::Medium),
         )
         .await?;
@@ -1419,7 +1245,7 @@ model = "gpt-4.1"
             .get("dev")
             .expect("profile should be created");
 
-        assert_eq!(profile.model.as_deref(), Some("gpt-5-codex"));
+        assert_eq!(profile.model.as_deref(), Some("swiftfox"));
         assert_eq!(
             profile.model_reasoning_effort,
             Some(ReasoningEffort::Medium)
@@ -1619,7 +1445,7 @@ model_verbosity = "high"
         assert_eq!(
             Config {
                 model: "o3".to_string(),
-                review_model: OPENAI_DEFAULT_REVIEW_MODEL.to_string(),
+                review_model: "gpt-5".to_string(),
                 model_family: find_family_for_model("o3").expect("known model slug"),
                 model_context_window: Some(200_000),
                 model_max_output_tokens: Some(100_000),
@@ -1654,7 +1480,6 @@ model_verbosity = "high"
                 include_view_image_tool: true,
                 active_profile: Some("o3".to_string()),
                 disable_paste_burst: false,
-                tui_notifications: Default::default(),
             },
             o3_profile_config
         );
@@ -1677,7 +1502,7 @@ model_verbosity = "high"
         )?;
         let expected_gpt3_profile_config = Config {
             model: "gpt-3.5-turbo".to_string(),
-            review_model: OPENAI_DEFAULT_REVIEW_MODEL.to_string(),
+            review_model: "gpt-5".to_string(),
             model_family: find_family_for_model("gpt-3.5-turbo").expect("known model slug"),
             model_context_window: Some(16_385),
             model_max_output_tokens: Some(4_096),
@@ -1712,7 +1537,6 @@ model_verbosity = "high"
             include_view_image_tool: true,
             active_profile: Some("gpt3".to_string()),
             disable_paste_burst: false,
-            tui_notifications: Default::default(),
         };
 
         assert_eq!(expected_gpt3_profile_config, gpt3_profile_config);
@@ -1750,7 +1574,7 @@ model_verbosity = "high"
         )?;
         let expected_zdr_profile_config = Config {
             model: "o3".to_string(),
-            review_model: OPENAI_DEFAULT_REVIEW_MODEL.to_string(),
+            review_model: "gpt-5".to_string(),
             model_family: find_family_for_model("o3").expect("known model slug"),
             model_context_window: Some(200_000),
             model_max_output_tokens: Some(100_000),
@@ -1785,7 +1609,6 @@ model_verbosity = "high"
             include_view_image_tool: true,
             active_profile: Some("zdr".to_string()),
             disable_paste_burst: false,
-            tui_notifications: Default::default(),
         };
 
         assert_eq!(expected_zdr_profile_config, zdr_profile_config);
@@ -1809,7 +1632,7 @@ model_verbosity = "high"
         )?;
         let expected_gpt5_profile_config = Config {
             model: "gpt-5".to_string(),
-            review_model: OPENAI_DEFAULT_REVIEW_MODEL.to_string(),
+            review_model: "gpt-5".to_string(),
             model_family: find_family_for_model("gpt-5").expect("known model slug"),
             model_context_window: Some(272_000),
             model_max_output_tokens: Some(128_000),
@@ -1844,7 +1667,6 @@ model_verbosity = "high"
             include_view_image_tool: true,
             active_profile: Some("gpt5".to_string()),
             disable_paste_burst: false,
-            tui_notifications: Default::default(),
         };
 
         assert_eq!(expected_gpt5_profile_config, gpt5_profile_config);
@@ -1948,46 +1770,3 @@ trust_level = "trusted"
         Ok(())
     }
 }
-
-#[cfg(test)]
-mod notifications_tests {
-    use crate::config_types::Notifications;
-    use serde::Deserialize;
-
-    #[derive(Deserialize, Debug, PartialEq)]
-    struct TuiTomlTest {
-        notifications: Notifications,
-    }
-
-    #[derive(Deserialize, Debug, PartialEq)]
-    struct RootTomlTest {
-        tui: TuiTomlTest,
-    }
-
-    #[test]
-    fn test_tui_notifications_true() {
-        let toml = r#"
-            [tui]
-            notifications = true
-        "#;
-        let parsed: RootTomlTest = toml::from_str(toml).expect("deserialize notifications=true");
-        assert!(matches!(
-            parsed.tui.notifications,
-            Notifications::Enabled(true)
-        ));
-    }
-
-    #[test]
-    fn test_tui_notifications_custom_array() {
-        let toml = r#"
-            [tui]
-            notifications = ["foo"]
-        "#;
-        let parsed: RootTomlTest =
-            toml::from_str(toml).expect("deserialize notifications=[\"foo\"]");
-        assert!(matches!(
-            parsed.tui.notifications,
-            Notifications::Custom(ref v) if v == &vec!["foo".to_string()]
-        ));
-    }
-}

codex-rs/core/src/config_edit.rs

@@ -136,7 +136,7 @@ async fn persist_overrides_with_behavior(
     } else {
         doc.get("profile")
             .and_then(|i| i.as_str())
-            .map(str::to_string)
+            .map(|s| s.to_string())
     };
 
     let mut mutated = false;

codex-rs/core/src/config_types.rs

@@ -5,15 +5,11 @@
 
 use std::collections::HashMap;
 use std::path::PathBuf;
-use std::time::Duration;
 use wildmatch::WildMatchPattern;
 
 use serde::Deserialize;
-use serde::Deserializer;
-use serde::Serialize;
-use serde::de::Error as SerdeError;
 
-#[derive(Serialize, Debug, Clone, PartialEq)]
+#[derive(Deserialize, Debug, Clone, PartialEq)]
 pub struct McpServerConfig {
     pub command: String,
 
@@ -23,84 +19,9 @@ pub struct McpServerConfig {
     #[serde(default)]
     pub env: Option<HashMap<String, String>>,
 
-    /// Startup timeout in seconds for initializing MCP server & initially listing tools.
-    #[serde(
-        default,
-        with = "option_duration_secs",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub startup_timeout_sec: Option<Duration>,
-
-    /// Default timeout for MCP tool calls initiated via this server.
-    #[serde(default, with = "option_duration_secs")]
-    pub tool_timeout_sec: Option<Duration>,
-}
-
-impl<'de> Deserialize<'de> for McpServerConfig {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        #[derive(Deserialize)]
-        struct RawMcpServerConfig {
-            command: String,
-            #[serde(default)]
-            args: Vec<String>,
-            #[serde(default)]
-            env: Option<HashMap<String, String>>,
-            #[serde(default)]
-            startup_timeout_sec: Option<f64>,
-            #[serde(default)]
-            startup_timeout_ms: Option<u64>,
-            #[serde(default, with = "option_duration_secs")]
-            tool_timeout_sec: Option<Duration>,
-        }
-
-        let raw = RawMcpServerConfig::deserialize(deserializer)?;
-
-        let startup_timeout_sec = match (raw.startup_timeout_sec, raw.startup_timeout_ms) {
-            (Some(sec), _) => {
-                let duration = Duration::try_from_secs_f64(sec).map_err(SerdeError::custom)?;
-                Some(duration)
-            }
-            (None, Some(ms)) => Some(Duration::from_millis(ms)),
-            (None, None) => None,
-        };
-
-        Ok(Self {
-            command: raw.command,
-            args: raw.args,
-            env: raw.env,
-            startup_timeout_sec,
-            tool_timeout_sec: raw.tool_timeout_sec,
-        })
-    }
-}
-
-mod option_duration_secs {
-    use serde::Deserialize;
-    use serde::Deserializer;
-    use serde::Serializer;
-    use std::time::Duration;
-
-    pub fn serialize<S>(value: &Option<Duration>, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        match value {
-            Some(duration) => serializer.serialize_some(&duration.as_secs_f64()),
-            None => serializer.serialize_none(),
-        }
-    }
-
-    pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<Duration>, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let secs = Option::<f64>::deserialize(deserializer)?;
-        secs.map(|secs| Duration::try_from_secs_f64(secs).map_err(serde::de::Error::custom))
-            .transpose()
-    }
+    /// Startup timeout in milliseconds for initializing MCP server & initially listing tools.
+    #[serde(default)]
+    pub startup_timeout_ms: Option<u64>,
 }
 
 #[derive(Deserialize, Debug, Copy, Clone, PartialEq)]
@@ -155,27 +76,9 @@ pub enum HistoryPersistence {
     None,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
-#[serde(untagged)]
-pub enum Notifications {
-    Enabled(bool),
-    Custom(Vec<String>),
-}
-
-impl Default for Notifications {
-    fn default() -> Self {
-        Self::Enabled(false)
-    }
-}
-
 /// Collection of settings that are specific to the TUI.
 #[derive(Deserialize, Debug, Clone, PartialEq, Default)]
-pub struct Tui {
-    /// Enable desktop notifications from the TUI when the terminal is unfocused.
-    /// Defaults to `false`.
-    #[serde(default)]
-    pub notifications: Notifications,
-}
+pub struct Tui {}
 
 #[derive(Deserialize, Debug, Clone, PartialEq, Default)]
 pub struct SandboxWorkspaceWrite {

codex-rs/core/src/conversation_history.rs

@@ -47,9 +47,8 @@ fn is_api_message(message: &ResponseItem) -> bool {
         | ResponseItem::CustomToolCall { .. }
         | ResponseItem::CustomToolCallOutput { .. }
         | ResponseItem::LocalShellCall { .. }
-        | ResponseItem::Reasoning { .. }
-        | ResponseItem::WebSearchCall { .. } => true,
-        ResponseItem::Other => false,
+        | ResponseItem::Reasoning { .. } => true,
+        ResponseItem::WebSearchCall { .. } | ResponseItem::Other => false,
     }
 }
 

codex-rs/core/src/conversation_manager.rs

@@ -3,8 +3,6 @@ use crate::CodexAuth;
 use crate::codex::Codex;
 use crate::codex::CodexSpawnOk;
 use crate::codex::INITIAL_SUBMIT_ID;
-use crate::codex::compact::content_items_to_text;
-use crate::codex::compact::is_session_prefix_message;
 use crate::codex_conversation::CodexConversation;
 use crate::config::Config;
 use crate::error::CodexErr;
@@ -148,7 +146,7 @@ impl ConversationManager {
     ) -> CodexResult<NewConversation> {
         // Compute the prefix up to the cut point.
         let history = RolloutRecorder::get_rollout_history(&path).await?;
-        let history = truncate_before_nth_user_message(history, nth_user_message);
+        let history = truncate_after_nth_user_message(history, nth_user_message);
 
         // Spawn a new conversation with the computed initial history.
         let auth_manager = self.auth_manager.clone();
@@ -163,16 +161,15 @@ impl ConversationManager {
 
 /// Return a prefix of `items` obtained by cutting strictly before the nth user message
 /// (0-based) and all items that follow it.
-fn truncate_before_nth_user_message(history: InitialHistory, n: usize) -> InitialHistory {
+fn truncate_after_nth_user_message(history: InitialHistory, n: usize) -> InitialHistory {
     // Work directly on rollout items, and cut the vector at the nth user message input.
     let items: Vec<RolloutItem> = history.get_rollout_items();
 
     // Find indices of user message inputs in rollout order.
     let mut user_positions: Vec<usize> = Vec::new();
     for (idx, item) in items.iter().enumerate() {
-        if let RolloutItem::ResponseItem(ResponseItem::Message { role, content, .. }) = item
+        if let RolloutItem::ResponseItem(ResponseItem::Message { role, .. }) = item
             && role == "user"
-            && content_items_to_text(content).is_some_and(|text| !is_session_prefix_message(&text))
         {
             user_positions.push(idx);
         }
@@ -197,11 +194,9 @@ fn truncate_before_nth_user_message(history: InitialHistory, n: usize) -> Initia
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::codex::make_session_and_context;
     use codex_protocol::models::ContentItem;
     use codex_protocol::models::ReasoningItemReasoningSummary;
     use codex_protocol::models::ResponseItem;
-    use pretty_assertions::assert_eq;
 
     fn user_msg(text: &str) -> ResponseItem {
         ResponseItem::Message {
@@ -253,7 +248,7 @@ mod tests {
             .cloned()
             .map(RolloutItem::ResponseItem)
             .collect();
-        let truncated = truncate_before_nth_user_message(InitialHistory::Forked(initial), 1);
+        let truncated = truncate_after_nth_user_message(InitialHistory::Forked(initial), 1);
         let got_items = truncated.get_rollout_items();
         let expected_items = vec![
             RolloutItem::ResponseItem(items[0].clone()),
@@ -270,37 +265,7 @@ mod tests {
             .cloned()
             .map(RolloutItem::ResponseItem)
             .collect();
-        let truncated2 = truncate_before_nth_user_message(InitialHistory::Forked(initial2), 2);
+        let truncated2 = truncate_after_nth_user_message(InitialHistory::Forked(initial2), 2);
         assert!(matches!(truncated2, InitialHistory::New));
     }
-
-    #[test]
-    fn ignores_session_prefix_messages_when_truncating() {
-        let (session, turn_context) = make_session_and_context();
-        let mut items = session.build_initial_context(&turn_context);
-        items.push(user_msg("feature request"));
-        items.push(assistant_msg("ack"));
-        items.push(user_msg("second question"));
-        items.push(assistant_msg("answer"));
-
-        let rollout_items: Vec<RolloutItem> = items
-            .iter()
-            .cloned()
-            .map(RolloutItem::ResponseItem)
-            .collect();
-
-        let truncated = truncate_before_nth_user_message(InitialHistory::Forked(rollout_items), 1);
-        let got_items = truncated.get_rollout_items();
-
-        let expected: Vec<RolloutItem> = vec![
-            RolloutItem::ResponseItem(items[0].clone()),
-            RolloutItem::ResponseItem(items[1].clone()),
-            RolloutItem::ResponseItem(items[2].clone()),
-        ];
-
-        assert_eq!(
-            serde_json::to_value(&got_items).unwrap(),
-            serde_json::to_value(&expected).unwrap()
-        );
-    }
 }

codex-rs/core/src/custom_prompts.rs

@@ -52,7 +52,7 @@ pub async fn discover_prompts_in_excluding(
         let Some(name) = path
             .file_stem()
             .and_then(|s| s.to_str())
-            .map(str::to_string)
+            .map(|s| s.to_string())
         else {
             continue;
         };

codex-rs/core/src/environment_context.rs

@@ -2,7 +2,6 @@ use serde::Deserialize;
 use serde::Serialize;
 use strum_macros::Display as DeriveDisplay;
 
-use crate::codex::TurnContext;
 use crate::protocol::AskForApproval;
 use crate::protocol::SandboxPolicy;
 use crate::shell::Shell;
@@ -72,39 +71,6 @@ impl EnvironmentContext {
             shell,
         }
     }
-
-    /// Compares two environment contexts, ignoring the shell. Useful when
-    /// comparing turn to turn, since the initial environment_context will
-    /// include the shell, and then it is not configurable from turn to turn.
-    pub fn equals_except_shell(&self, other: &EnvironmentContext) -> bool {
-        let EnvironmentContext {
-            cwd,
-            approval_policy,
-            sandbox_mode,
-            network_access,
-            writable_roots,
-            // should compare all fields except shell
-            shell: _,
-        } = other;
-
-        self.cwd == *cwd
-            && self.approval_policy == *approval_policy
-            && self.sandbox_mode == *sandbox_mode
-            && self.network_access == *network_access
-            && self.writable_roots == *writable_roots
-    }
-}
-
-impl From<&TurnContext> for EnvironmentContext {
-    fn from(turn_context: &TurnContext) -> Self {
-        Self::new(
-            Some(turn_context.cwd.clone()),
-            Some(turn_context.approval_policy),
-            Some(turn_context.sandbox_policy.clone()),
-            // Shell is not configurable from turn to turn
-            None,
-        )
-    }
 }
 
 impl EnvironmentContext {
@@ -174,9 +140,6 @@ impl From<EnvironmentContext> for ResponseItem {
 
 #[cfg(test)]
 mod tests {
-    use crate::shell::BashShell;
-    use crate::shell::ZshShell;
-
     use super::*;
     use pretty_assertions::assert_eq;
 
@@ -247,82 +210,4 @@ mod tests {
 
         assert_eq!(context.serialize_to_xml(), expected);
     }
-
-    #[test]
-    fn equals_except_shell_compares_approval_policy() {
-        // Approval policy
-        let context1 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(workspace_write_policy(vec!["/repo"], false)),
-            None,
-        );
-        let context2 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::Never),
-            Some(workspace_write_policy(vec!["/repo"], true)),
-            None,
-        );
-        assert!(!context1.equals_except_shell(&context2));
-    }
-
-    #[test]
-    fn equals_except_shell_compares_sandbox_policy() {
-        let context1 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(SandboxPolicy::new_read_only_policy()),
-            None,
-        );
-        let context2 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(SandboxPolicy::new_workspace_write_policy()),
-            None,
-        );
-
-        assert!(!context1.equals_except_shell(&context2));
-    }
-
-    #[test]
-    fn equals_except_shell_compares_workspace_write_policy() {
-        let context1 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(workspace_write_policy(vec!["/repo", "/tmp", "/var"], false)),
-            None,
-        );
-        let context2 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(workspace_write_policy(vec!["/repo", "/tmp"], true)),
-            None,
-        );
-
-        assert!(!context1.equals_except_shell(&context2));
-    }
-
-    #[test]
-    fn equals_except_shell_ignores_shell() {
-        let context1 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(workspace_write_policy(vec!["/repo"], false)),
-            Some(Shell::Bash(BashShell {
-                shell_path: "/bin/bash".into(),
-                bashrc_path: "/home/user/.bashrc".into(),
-            })),
-        );
-        let context2 = EnvironmentContext::new(
-            Some(PathBuf::from("/repo")),
-            Some(AskForApproval::OnRequest),
-            Some(workspace_write_policy(vec!["/repo"], false)),
-            Some(Shell::Zsh(ZshShell {
-                shell_path: "/bin/zsh".into(),
-                zshrc_path: "/home/user/.zshrc".into(),
-            })),
-        );
-
-        assert!(context1.equals_except_shell(&context2));
-    }
 }

codex-rs/core/src/error.rs

@@ -104,10 +104,6 @@ pub enum CodexErr {
     #[error("codex-linux-sandbox was required but not provided")]
     LandlockSandboxExecutableNotProvided,
 
-    /// Provider reported the input exceeds the model's context window.
-    #[error("context_length_exceeded: {0}")]
-    ContextLengthExceeded(String),
-
     // -----------------------------------------------------------------
     // Automatic conversions for common external error types
     // -----------------------------------------------------------------

codex-rs/core/src/error_codes.rs

@@ -1,2 +0,0 @@
-/// Known structured error codes returned by model providers.
-pub const CONTEXT_LENGTH_EXCEEDED: &str = "context_length_exceeded";

codex-rs/core/src/exec.rs

@@ -3,7 +3,6 @@ use std::os::unix::process::ExitStatusExt;
 
 use std::collections::HashMap;
 use std::io;
-use std::path::Path;
 use std::path::PathBuf;
 use std::process::ExitStatus;
 use std::time::Duration;
@@ -45,7 +44,7 @@ const AGGREGATE_BUFFER_INITIAL_CAPACITY: usize = 8 * 1024; // 8 KiB
 /// Aggregation still collects full output; only the live event stream is capped.
 pub(crate) const MAX_EXEC_OUTPUT_DELTAS_PER_CALL: usize = 10_000;
 
-#[derive(Clone, Debug)]
+#[derive(Debug, Clone)]
 pub struct ExecParams {
     pub command: Vec<String>,
     pub cwd: PathBuf,
@@ -83,7 +82,6 @@ pub async fn process_exec_tool_call(
     params: ExecParams,
     sandbox_type: SandboxType,
     sandbox_policy: &SandboxPolicy,
-    sandbox_cwd: &Path,
     codex_linux_sandbox_exe: &Option<PathBuf>,
     stdout_stream: Option<StdoutStream>,
 ) -> Result<ExecToolCallOutput> {
@@ -96,16 +94,12 @@ pub async fn process_exec_tool_call(
         SandboxType::None => exec(params, sandbox_policy, stdout_stream.clone()).await,
         SandboxType::MacosSeatbelt => {
             let ExecParams {
-                command,
-                cwd: command_cwd,
-                env,
-                ..
+                command, cwd, env, ..
             } = params;
             let child = spawn_command_under_seatbelt(
                 command,
-                command_cwd,
                 sandbox_policy,
-                sandbox_cwd,
+                cwd,
                 StdioPolicy::RedirectForShellTool,
                 env,
             )
@@ -114,10 +108,7 @@ pub async fn process_exec_tool_call(
         }
         SandboxType::LinuxSeccomp => {
             let ExecParams {
-                command,
-                cwd: command_cwd,
-                env,
-                ..
+                command, cwd, env, ..
             } = params;
 
             let codex_linux_sandbox_exe = codex_linux_sandbox_exe
@@ -126,9 +117,8 @@ pub async fn process_exec_tool_call(
             let child = spawn_command_under_linux_sandbox(
                 codex_linux_sandbox_exe,
                 command,
-                command_cwd,
                 sandbox_policy,
-                sandbox_cwd,
+                cwd,
                 StdioPolicy::RedirectForShellTool,
                 env,
             )

codex-rs/core/src/exec_command/exec_command_session.rs

@@ -11,6 +11,9 @@ pub(crate) struct ExecCommandSession {
     /// Broadcast stream of output chunks read from the PTY. New subscribers
     /// receive only chunks emitted after they subscribe.
     output_tx: broadcast::Sender<Vec<u8>>,
+    /// Receiver subscribed before the child process starts emitting output so
+    /// the first caller can consume any early data without races.
+    initial_output_rx: StdMutex<Option<broadcast::Receiver<Vec<u8>>>>,
 
     /// Child killer handle for termination on drop (can signal independently
     /// of a thread blocked in `.wait()`).
@@ -38,20 +41,25 @@ impl ExecCommandSession {
         writer_handle: JoinHandle<()>,
         wait_handle: JoinHandle<()>,
         exit_status: std::sync::Arc<std::sync::atomic::AtomicBool>,
-    ) -> (Self, broadcast::Receiver<Vec<u8>>) {
-        let initial_output_rx = output_tx.subscribe();
-        (
-            Self {
-                writer_tx,
-                output_tx,
-                killer: StdMutex::new(Some(killer)),
-                reader_handle: StdMutex::new(Some(reader_handle)),
-                writer_handle: StdMutex::new(Some(writer_handle)),
-                wait_handle: StdMutex::new(Some(wait_handle)),
-                exit_status,
-            },
-            initial_output_rx,
-        )
+    ) -> Self {
+        Self {
+            writer_tx,
+            output_tx,
+            initial_output_rx: StdMutex::new(None),
+            killer: StdMutex::new(Some(killer)),
+            reader_handle: StdMutex::new(Some(reader_handle)),
+            writer_handle: StdMutex::new(Some(writer_handle)),
+            wait_handle: StdMutex::new(Some(wait_handle)),
+            exit_status,
+        }
+    }
+
+    pub(crate) fn set_initial_output_receiver(&self, receiver: broadcast::Receiver<Vec<u8>>) {
+        if let Ok(mut guard) = self.initial_output_rx.lock()
+            && guard.is_none()
+        {
+            *guard = Some(receiver);
+        }
     }
 
     pub(crate) fn writer_sender(&self) -> mpsc::Sender<Vec<u8>> {
@@ -59,7 +67,13 @@ impl ExecCommandSession {
     }
 
     pub(crate) fn output_receiver(&self) -> broadcast::Receiver<Vec<u8>> {
-        self.output_tx.subscribe()
+        if let Ok(mut guard) = self.initial_output_rx.lock()
+            && let Some(receiver) = guard.take()
+        {
+            receiver
+        } else {
+            self.output_tx.subscribe()
+        }
     }
 
     pub(crate) fn has_exited(&self) -> bool {

codex-rs/core/src/exec_command/session_manager.rs

@@ -93,16 +93,18 @@ impl SessionManager {
                 .fetch_add(1, std::sync::atomic::Ordering::SeqCst),
         );
 
-        let (session, mut output_rx, mut exit_rx) = create_exec_command_session(params.clone())
-            .await
-            .map_err(|err| {
-                format!(
-                    "failed to create exec command session for session id {}: {err}",
-                    session_id.0
-                )
-            })?;
+        let (session, mut exit_rx) =
+            create_exec_command_session(params.clone())
+                .await
+                .map_err(|err| {
+                    format!(
+                        "failed to create exec command session for session id {}: {err}",
+                        session_id.0
+                    )
+                })?;
 
         // Insert into session map.
+        let mut output_rx = session.output_receiver();
         self.sessions.lock().await.insert(session_id, session);
 
         // Collect output until either timeout expires or process exits.
@@ -243,11 +245,7 @@ impl SessionManager {
 /// Spawn PTY and child process per spawn_exec_command_session logic.
 async fn create_exec_command_session(
     params: ExecCommandParams,
-) -> anyhow::Result<(
-    ExecCommandSession,
-    tokio::sync::broadcast::Receiver<Vec<u8>>,
-    oneshot::Receiver<i32>,
-)> {
+) -> anyhow::Result<(ExecCommandSession, oneshot::Receiver<i32>)> {
     let ExecCommandParams {
         cmd,
         yield_time_ms: _,
@@ -281,6 +279,8 @@ async fn create_exec_command_session(
     let (writer_tx, mut writer_rx) = mpsc::channel::<Vec<u8>>(128);
     // Broadcast for streaming PTY output to readers: subscribers receive from subscription time.
     let (output_tx, _) = tokio::sync::broadcast::channel::<Vec<u8>>(256);
+    let initial_output_rx = output_tx.subscribe();
+
     // Reader task: drain PTY and forward chunks to output channel.
     let mut reader = pair.master.try_clone_reader()?;
     let output_tx_clone = output_tx.clone();
@@ -342,7 +342,7 @@ async fn create_exec_command_session(
     });
 
     // Create and store the session with channels.
-    let (session, initial_output_rx) = ExecCommandSession::new(
+    let session = ExecCommandSession::new(
         writer_tx,
         output_tx,
         killer,
@@ -351,7 +351,8 @@ async fn create_exec_command_session(
         wait_handle,
         exit_status,
     );
-    Ok((session, initial_output_rx, exit_rx))
+    session.set_initial_output_receiver(initial_output_rx);
+    Ok((session, exit_rx))
 }
 
 #[cfg(test)]

codex-rs/core/src/git_info.rs

@@ -108,61 +108,6 @@ pub async fn collect_git_info(cwd: &Path) -> Option<GitInfo> {
     Some(git_info)
 }
 
-/// A minimal commit summary entry used for pickers (subject + timestamp + sha).
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct CommitLogEntry {
-    pub sha: String,
-    /// Unix timestamp (seconds since epoch) of the commit time (committer time).
-    pub timestamp: i64,
-    /// Single-line subject of the commit message.
-    pub subject: String,
-}
-
-/// Return the last `limit` commits reachable from HEAD for the current branch.
-/// Each entry contains the SHA, commit timestamp (seconds), and subject line.
-/// Returns an empty vector if not in a git repo or on error/timeout.
-pub async fn recent_commits(cwd: &Path, limit: usize) -> Vec<CommitLogEntry> {
-    // Ensure we're in a git repo first to avoid noisy errors.
-    let Some(out) = run_git_command_with_timeout(&["rev-parse", "--git-dir"], cwd).await else {
-        return Vec::new();
-    };
-    if !out.status.success() {
-        return Vec::new();
-    }
-
-    let fmt = "%H%x1f%ct%x1f%s"; // <sha> <US> <commit_time> <US> <subject>
-    let n = limit.max(1).to_string();
-    let Some(log_out) =
-        run_git_command_with_timeout(&["log", "-n", &n, &format!("--pretty=format:{fmt}")], cwd)
-            .await
-    else {
-        return Vec::new();
-    };
-    if !log_out.status.success() {
-        return Vec::new();
-    }
-
-    let text = String::from_utf8_lossy(&log_out.stdout);
-    let mut entries: Vec<CommitLogEntry> = Vec::new();
-    for line in text.lines() {
-        let mut parts = line.split('\u{001f}');
-        let sha = parts.next().unwrap_or("").trim();
-        let ts_s = parts.next().unwrap_or("").trim();
-        let subject = parts.next().unwrap_or("").trim();
-        if sha.is_empty() || ts_s.is_empty() {
-            continue;
-        }
-        let timestamp = ts_s.parse::<i64>().unwrap_or(0);
-        entries.push(CommitLogEntry {
-            sha: sha.to_string(),
-            timestamp,
-            subject: subject.to_string(),
-        });
-    }
-
-    entries
-}
-
 /// Returns the closest git sha to HEAD that is on a remote as well as the diff to that sha.
 pub async fn git_diff_to_remote(cwd: &Path) -> Option<GitDiffToRemote> {
     get_git_repo_root(cwd)?;
@@ -200,7 +145,7 @@ async fn get_git_remotes(cwd: &Path) -> Option<Vec<String>> {
     let mut remotes: Vec<String> = String::from_utf8(output.stdout)
         .ok()?
         .lines()
-        .map(str::to_string)
+        .map(|s| s.to_string())
         .collect();
     if let Some(pos) = remotes.iter().position(|r| r == "origin") {
         let origin = remotes.remove(pos);
@@ -257,11 +202,6 @@ async fn get_default_branch(cwd: &Path) -> Option<String> {
     }
 
     // No remote-derived default; try common local defaults if they exist
-    get_default_branch_local(cwd).await
-}
-
-/// Attempt to determine the repository's default branch name from local branches.
-async fn get_default_branch_local(cwd: &Path) -> Option<String> {
     for candidate in ["main", "master"] {
         if let Some(verify) = run_git_command_with_timeout(
             &[
@@ -477,7 +417,7 @@ async fn diff_against_sha(cwd: &Path, sha: &GitSha) -> Option<String> {
         let untracked: Vec<String> = String::from_utf8(untracked_output.stdout)
             .ok()?
             .lines()
-            .map(str::to_string)
+            .map(|s| s.to_string())
             .filter(|s| !s.is_empty())
             .collect();
 
@@ -545,46 +485,6 @@ pub fn resolve_root_git_project_for_trust(cwd: &Path) -> Option<PathBuf> {
     git_dir_path.parent().map(Path::to_path_buf)
 }
 
-/// Returns a list of local git branches.
-/// Includes the default branch at the beginning of the list, if it exists.
-pub async fn local_git_branches(cwd: &Path) -> Vec<String> {
-    let mut branches: Vec<String> = if let Some(out) =
-        run_git_command_with_timeout(&["branch", "--format=%(refname:short)"], cwd).await
-        && out.status.success()
-    {
-        String::from_utf8_lossy(&out.stdout)
-            .lines()
-            .map(|s| s.trim().to_string())
-            .filter(|s| !s.is_empty())
-            .collect()
-    } else {
-        Vec::new()
-    };
-
-    branches.sort_unstable();
-
-    if let Some(base) = get_default_branch_local(cwd).await
-        && let Some(pos) = branches.iter().position(|name| name == &base)
-    {
-        let base_branch = branches.remove(pos);
-        branches.insert(0, base_branch);
-    }
-
-    branches
-}
-
-/// Returns the current checked out branch name.
-pub async fn current_branch_name(cwd: &Path) -> Option<String> {
-    let out = run_git_command_with_timeout(&["branch", "--show-current"], cwd).await?;
-    if !out.status.success() {
-        return None;
-    }
-    String::from_utf8(out.stdout)
-        .ok()
-        .map(|s| s.trim().to_string())
-        .filter(|name| !name.is_empty())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -651,80 +551,6 @@ mod tests {
         repo_path
     }
 
-    #[tokio::test]
-    async fn test_recent_commits_non_git_directory_returns_empty() {
-        let temp_dir = TempDir::new().expect("Failed to create temp dir");
-        let entries = recent_commits(temp_dir.path(), 10).await;
-        assert!(entries.is_empty(), "expected no commits outside a git repo");
-    }
-
-    #[tokio::test]
-    async fn test_recent_commits_orders_and_limits() {
-        use tokio::time::Duration;
-        use tokio::time::sleep;
-
-        let temp_dir = TempDir::new().expect("Failed to create temp dir");
-        let repo_path = create_test_git_repo(&temp_dir).await;
-
-        // Make three distinct commits with small delays to ensure ordering by timestamp.
-        fs::write(repo_path.join("file.txt"), "one").unwrap();
-        Command::new("git")
-            .args(["add", "file.txt"])
-            .current_dir(&repo_path)
-            .output()
-            .await
-            .expect("git add");
-        Command::new("git")
-            .args(["commit", "-m", "first change"])
-            .current_dir(&repo_path)
-            .output()
-            .await
-            .expect("git commit 1");
-
-        sleep(Duration::from_millis(1100)).await;
-
-        fs::write(repo_path.join("file.txt"), "two").unwrap();
-        Command::new("git")
-            .args(["add", "file.txt"])
-            .current_dir(&repo_path)
-            .output()
-            .await
-            .expect("git add 2");
-        Command::new("git")
-            .args(["commit", "-m", "second change"])
-            .current_dir(&repo_path)
-            .output()
-            .await
-            .expect("git commit 2");
-
-        sleep(Duration::from_millis(1100)).await;
-
-        fs::write(repo_path.join("file.txt"), "three").unwrap();
-        Command::new("git")
-            .args(["add", "file.txt"])
-            .current_dir(&repo_path)
-            .output()
-            .await
-            .expect("git add 3");
-        Command::new("git")
-            .args(["commit", "-m", "third change"])
-            .current_dir(&repo_path)
-            .output()
-            .await
-            .expect("git commit 3");
-
-        // Request the latest 3 commits; should be our three changes in reverse time order.
-        let entries = recent_commits(&repo_path, 3).await;
-        assert_eq!(entries.len(), 3);
-        assert_eq!(entries[0].subject, "third change");
-        assert_eq!(entries[1].subject, "second change");
-        assert_eq!(entries[2].subject, "first change");
-        // Basic sanity on SHA formatting
-        for e in entries {
-            assert!(e.sha.len() >= 7 && e.sha.chars().all(|c| c.is_ascii_hexdigit()));
-        }
-    }
-
     async fn create_test_git_repo_with_remote(temp_dir: &TempDir) -> (PathBuf, String) {
         let repo_path = create_test_git_repo(temp_dir).await;
         let remote_path = temp_dir.path().join("remote.git");

codex-rs/core/src/internal_storage.rs

@@ -1,7 +1,6 @@
 use anyhow::Context;
 use serde::Deserialize;
 use serde::Serialize;
-use std::io::ErrorKind;
 use std::path::Path;
 use std::path::PathBuf;
 
@@ -11,8 +10,8 @@ pub(crate) const INTERNAL_STORAGE_FILE: &str = "internal_storage.json";
 pub struct InternalStorage {
     #[serde(skip)]
     storage_path: PathBuf,
-    #[serde(default)]
-    pub gpt_5_codex_model_prompt_seen: bool,
+    #[serde(default, alias = "gpt_5_high_model_prompt_seen")]
+    pub swiftfox_model_prompt_seen: bool,
 }
 
 // TODO(jif) generalise all the file writers and build proper async channel inserters.
@@ -32,14 +31,7 @@ impl InternalStorage {
                 }
             },
             Err(error) => {
-                if error.kind() == ErrorKind::NotFound {
-                    tracing::debug!(
-                        "internal storage not found at {}; initializing defaults",
-                        storage_path.display()
-                    );
-                } else {
-                    tracing::warn!("failed to read internal storage: {error:?}");
-                }
+                tracing::warn!("failed to read internal storage: {error:?}");
                 Self::empty(storage_path)
             }
         }

codex-rs/core/src/is_safe_command.rs

@@ -160,10 +160,9 @@ fn is_valid_sed_n_arg(arg: Option<&str>) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::string::ToString;
 
     fn vec_str(args: &[&str]) -> Vec<String> {
-        args.iter().map(ToString::to_string).collect()
+        args.iter().map(|s| s.to_string()).collect()
     }
 
     #[test]

codex-rs/core/src/landlock.rs

@@ -16,22 +16,21 @@ use tokio::process::Child;
 pub async fn spawn_command_under_linux_sandbox<P>(
     codex_linux_sandbox_exe: P,
     command: Vec<String>,
-    command_cwd: PathBuf,
     sandbox_policy: &SandboxPolicy,
-    sandbox_policy_cwd: &Path,
+    cwd: PathBuf,
     stdio_policy: StdioPolicy,
     env: HashMap<String, String>,
 ) -> std::io::Result<Child>
 where
     P: AsRef<Path>,
 {
-    let args = create_linux_sandbox_command_args(command, sandbox_policy, sandbox_policy_cwd);
+    let args = create_linux_sandbox_command_args(command, sandbox_policy, &cwd);
     let arg0 = Some("codex-linux-sandbox");
     spawn_child_async(
         codex_linux_sandbox_exe.as_ref().to_path_buf(),
         args,
         arg0,
-        command_cwd,
+        cwd,
         sandbox_policy,
         stdio_policy,
         env,
@@ -43,13 +42,10 @@ where
 fn create_linux_sandbox_command_args(
     command: Vec<String>,
     sandbox_policy: &SandboxPolicy,
-    sandbox_policy_cwd: &Path,
+    cwd: &Path,
 ) -> Vec<String> {
     #[expect(clippy::expect_used)]
-    let sandbox_policy_cwd = sandbox_policy_cwd
-        .to_str()
-        .expect("cwd must be valid UTF-8")
-        .to_string();
+    let sandbox_policy_cwd = cwd.to_str().expect("cwd must be valid UTF-8").to_string();
 
     #[expect(clippy::expect_used)]
     let sandbox_policy_json =

codex-rs/core/src/lib.rs

@@ -46,7 +46,6 @@ pub use model_provider_info::built_in_model_providers;
 pub use model_provider_info::create_oss_provider_with_base_url;
 mod conversation_manager;
 mod event_mapping;
-pub mod review_format;
 pub use codex_protocol::protocol::InitialHistory;
 pub use conversation_manager::ConversationManager;
 pub use conversation_manager::NewConversation;
@@ -54,7 +53,6 @@ pub use conversation_manager::NewConversation;
 pub use auth::AuthManager;
 pub use auth::CodexAuth;
 pub mod default_client;
-pub mod error_codes;
 pub mod model_family;
 mod openai_model_info;
 mod openai_tools;
@@ -90,11 +88,8 @@ pub use codex_protocol::config_types as protocol_config_types;
 
 pub use client::ModelClient;
 pub use client_common::Prompt;
-pub use client_common::REVIEW_PROMPT;
 pub use client_common::ResponseEvent;
 pub use client_common::ResponseStream;
-pub use codex::compact::content_items_to_text;
-pub use codex::compact::is_session_prefix_message;
 pub use codex_protocol::models::ContentItem;
 pub use codex_protocol::models::LocalShellAction;
 pub use codex_protocol::models::LocalShellExecAction;

codex-rs/core/src/mcp_connection_manager.rs

@@ -40,9 +40,6 @@ const MAX_TOOL_NAME_LENGTH: usize = 64;
 /// Default timeout for initializing MCP server & initially listing tools.
 const DEFAULT_STARTUP_TIMEOUT: Duration = Duration::from_secs(10);
 
-/// Default timeout for individual tool calls.
-const DEFAULT_TOOL_TIMEOUT: Duration = Duration::from_secs(60);
-
 /// Map that holds a startup error for every MCP server that could **not** be
 /// spawned successfully.
 pub type ClientStartErrors = HashMap<String, anyhow::Error>;
@@ -88,7 +85,6 @@ struct ToolInfo {
 struct ManagedClient {
     client: Arc<McpClient>,
     startup_timeout: Duration,
-    tool_timeout: Option<Duration>,
 }
 
 /// A thin wrapper around a set of running [`McpClient`] instances.
@@ -136,9 +132,10 @@ impl McpConnectionManager {
                 continue;
             }
 
-            let startup_timeout = cfg.startup_timeout_sec.unwrap_or(DEFAULT_STARTUP_TIMEOUT);
-
-            let tool_timeout = cfg.tool_timeout_sec.unwrap_or(DEFAULT_TOOL_TIMEOUT);
+            let startup_timeout = cfg
+                .startup_timeout_ms
+                .map(Duration::from_millis)
+                .unwrap_or(DEFAULT_STARTUP_TIMEOUT);
 
             join_set.spawn(async move {
                 let McpServerConfig {
@@ -174,19 +171,19 @@ impl McpConnectionManager {
                             protocol_version: mcp_types::MCP_SCHEMA_VERSION.to_owned(),
                         };
                         let initialize_notification_params = None;
-                        let init_result = client
+                        match client
                             .initialize(
                                 params,
                                 initialize_notification_params,
                                 Some(startup_timeout),
                             )
-                            .await;
-                        (
-                            (server_name, tool_timeout),
-                            init_result.map(|_| (client, startup_timeout)),
-                        )
+                            .await
+                        {
+                            Ok(_response) => (server_name, Ok((client, startup_timeout))),
+                            Err(e) => (server_name, Err(e)),
+                        }
                     }
-                    Err(e) => ((server_name, tool_timeout), Err(e.into())),
+                    Err(e) => (server_name, Err(e.into())),
                 }
             });
         }
@@ -194,8 +191,8 @@ impl McpConnectionManager {
         let mut clients: HashMap<String, ManagedClient> = HashMap::with_capacity(join_set.len());
 
         while let Some(res) = join_set.join_next().await {
-            let ((server_name, tool_timeout), client_res) = match res {
-                Ok(result) => result,
+            let (server_name, client_res) = match res {
+                Ok((server_name, client_res)) => (server_name, client_res),
                 Err(e) => {
                     warn!("Task panic when starting MCP server: {e:#}");
                     continue;
@@ -209,7 +206,6 @@ impl McpConnectionManager {
                         ManagedClient {
                             client: Arc::new(client),
                             startup_timeout,
-                            tool_timeout: Some(tool_timeout),
                         },
                     );
                 }
@@ -247,13 +243,14 @@ impl McpConnectionManager {
         server: &str,
         tool: &str,
         arguments: Option<serde_json::Value>,
+        timeout: Option<Duration>,
     ) -> Result<mcp_types::CallToolResult> {
-        let managed = self
+        let client = self
             .clients
             .get(server)
-            .ok_or_else(|| anyhow!("unknown MCP server '{server}'"))?;
-        let client = managed.client.clone();
-        let timeout = managed.tool_timeout;
+            .ok_or_else(|| anyhow!("unknown MCP server '{server}'"))?
+            .client
+            .clone();
 
         client
             .call_tool(tool.to_string(), arguments, timeout)

codex-rs/core/src/mcp_tool_call.rs

@@ -1,3 +1,4 @@
+use std::time::Duration;
 use std::time::Instant;
 
 use tracing::error;
@@ -20,6 +21,7 @@ pub(crate) async fn handle_mcp_tool_call(
     server: String,
     tool_name: String,
     arguments: String,
+    timeout: Option<Duration>,
 ) -> ResponseInputItem {
     // Parse the `arguments` as JSON. An empty string is OK, but invalid JSON
     // is not.
@@ -56,7 +58,7 @@ pub(crate) async fn handle_mcp_tool_call(
     let start = Instant::now();
     // Perform the tool call.
     let result = sess
-        .call_tool(&server, &tool_name, arguments_value.clone())
+        .call_tool(&server, &tool_name, arguments_value.clone(), timeout)
         .await
         .map_err(|e| format!("tool call error: {e}"));
     let tool_call_end_event = EventMsg::McpToolCallEnd(McpToolCallEndEvent {

codex-rs/core/src/model_family.rs

@@ -4,7 +4,7 @@ use crate::tool_apply_patch::ApplyPatchToolType;
 /// The `instructions` field in the payload sent to a model should always start
 /// with this content.
 const BASE_INSTRUCTIONS: &str = include_str!("../prompt.md");
-const GPT_5_CODEX_INSTRUCTIONS: &str = include_str!("../gpt_5_codex_prompt.md");
+const SWIFTFOX_INSTRUCTIONS: &str = include_str!("../swiftfox_prompt.md");
 
 /// A model family is a group of models that share certain characteristics.
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
@@ -99,12 +99,12 @@ pub fn find_family_for_model(slug: &str) -> Option<ModelFamily> {
         model_family!(slug, "gpt-4o", needs_special_apply_patch_instructions: true)
     } else if slug.starts_with("gpt-3.5") {
         model_family!(slug, "gpt-3.5", needs_special_apply_patch_instructions: true)
-    } else if slug.starts_with("codex-") || slug.starts_with("gpt-5-codex") {
+    } else if slug.starts_with("codex-") || slug.starts_with("swiftfox") {
         model_family!(
             slug, slug,
             supports_reasoning_summaries: true,
             reasoning_summary_format: ReasoningSummaryFormat::Experimental,
-            base_instructions: GPT_5_CODEX_INSTRUCTIONS.to_string(),
+            base_instructions: SWIFTFOX_INSTRUCTIONS.to_string(),
         )
     } else if slug.starts_with("gpt-5") {
         model_family!(

codex-rs/core/src/openai_tools.rs

@@ -7,6 +7,8 @@ use std::collections::HashMap;
 
 use crate::model_family::ModelFamily;
 use crate::plan_tool::PLAN_TOOL;
+use crate::protocol::AskForApproval;
+use crate::protocol::SandboxPolicy;
 use crate::tool_apply_patch::ApplyPatchToolType;
 use crate::tool_apply_patch::create_apply_patch_freeform_tool;
 use crate::tool_apply_patch::create_apply_patch_json_tool;
@@ -55,9 +57,10 @@ pub(crate) enum OpenAiTool {
 
 #[derive(Debug, Clone)]
 pub enum ConfigShellToolType {
-    Default,
-    Local,
-    Streamable,
+    DefaultShell,
+    ShellWithRequest { sandbox_policy: SandboxPolicy },
+    LocalShell,
+    StreamableShell,
 }
 
 #[derive(Debug, Clone)]
@@ -72,6 +75,8 @@ pub(crate) struct ToolsConfig {
 
 pub(crate) struct ToolsConfigParams<'a> {
     pub(crate) model_family: &'a ModelFamily,
+    pub(crate) approval_policy: AskForApproval,
+    pub(crate) sandbox_policy: SandboxPolicy,
     pub(crate) include_plan_tool: bool,
     pub(crate) include_apply_patch_tool: bool,
     pub(crate) include_web_search_request: bool,
@@ -84,6 +89,8 @@ impl ToolsConfig {
     pub fn new(params: &ToolsConfigParams) -> Self {
         let ToolsConfigParams {
             model_family,
+            approval_policy,
+            sandbox_policy,
             include_plan_tool,
             include_apply_patch_tool,
             include_web_search_request,
@@ -91,13 +98,18 @@ impl ToolsConfig {
             include_view_image_tool,
             experimental_unified_exec_tool,
         } = params;
-        let shell_type = if *use_streamable_shell_tool {
-            ConfigShellToolType::Streamable
+        let mut shell_type = if *use_streamable_shell_tool {
+            ConfigShellToolType::StreamableShell
         } else if model_family.uses_local_shell_tool {
-            ConfigShellToolType::Local
+            ConfigShellToolType::LocalShell
         } else {
-            ConfigShellToolType::Default
+            ConfigShellToolType::DefaultShell
         };
+        if matches!(approval_policy, AskForApproval::OnRequest) && !use_streamable_shell_tool {
+            shell_type = ConfigShellToolType::ShellWithRequest {
+                sandbox_policy: sandbox_policy.clone(),
+            }
+        }
 
         let apply_patch_tool_type = match model_family.apply_patch_tool_type {
             Some(ApplyPatchToolType::Freeform) => Some(ApplyPatchToolType::Freeform),
@@ -158,6 +170,40 @@ pub(crate) enum JsonSchema {
     },
 }
 
+fn create_shell_tool() -> OpenAiTool {
+    let mut properties = BTreeMap::new();
+    properties.insert(
+        "command".to_string(),
+        JsonSchema::Array {
+            items: Box::new(JsonSchema::String { description: None }),
+            description: Some("The command to execute".to_string()),
+        },
+    );
+    properties.insert(
+        "workdir".to_string(),
+        JsonSchema::String {
+            description: Some("The working directory to execute the command in".to_string()),
+        },
+    );
+    properties.insert(
+        "timeout_ms".to_string(),
+        JsonSchema::Number {
+            description: Some("The timeout for the command in milliseconds".to_string()),
+        },
+    );
+
+    OpenAiTool::Function(ResponsesApiTool {
+        name: "shell".to_string(),
+        description: "Runs a shell command and returns its output".to_string(),
+        strict: false,
+        parameters: JsonSchema::Object {
+            properties,
+            required: Some(vec!["command".to_string()]),
+            additional_properties: Some(false),
+        },
+    })
+}
+
 fn create_unified_exec_tool() -> OpenAiTool {
     let mut properties = BTreeMap::new();
     properties.insert(
@@ -205,7 +251,7 @@ fn create_unified_exec_tool() -> OpenAiTool {
     })
 }
 
-fn create_shell_tool() -> OpenAiTool {
+fn create_shell_tool_for_sandbox(sandbox_policy: &SandboxPolicy) -> OpenAiTool {
     let mut properties = BTreeMap::new();
     properties.insert(
         "command".to_string(),
@@ -227,18 +273,20 @@ fn create_shell_tool() -> OpenAiTool {
         },
     );
 
-    properties.insert(
+    if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
+        properties.insert(
         "with_escalated_permissions".to_string(),
         JsonSchema::Boolean {
             description: Some("Whether to request escalated permissions. Set to true if command needs to be run without sandbox restrictions".to_string()),
         },
     );
-    properties.insert(
+        properties.insert(
         "justification".to_string(),
         JsonSchema::String {
             description: Some("Only set if with_escalated_permissions is true. 1-sentence explanation of why we want to run this command.".to_string()),
         },
     );
+    }
 
     OpenAiTool::Function(ResponsesApiTool {
         name: "shell".to_string(),
@@ -285,7 +333,7 @@ pub(crate) struct ApplyPatchToolArgs {
 /// Responses API:
 /// https://platform.openai.com/docs/guides/function-calling?api-mode=responses
 pub fn create_tools_json_for_responses_api(
-    tools: &[OpenAiTool],
+    tools: &Vec<OpenAiTool>,
 ) -> crate::error::Result<Vec<serde_json::Value>> {
     let mut tools_json = Vec::new();
 
@@ -300,7 +348,7 @@ pub fn create_tools_json_for_responses_api(
 /// Chat Completions API:
 /// https://platform.openai.com/docs/guides/function-calling?api-mode=chat
 pub(crate) fn create_tools_json_for_chat_completions_api(
-    tools: &[OpenAiTool],
+    tools: &Vec<OpenAiTool>,
 ) -> crate::error::Result<Vec<serde_json::Value>> {
     // We start with the JSON for the Responses API and than rewrite it to match
     // the chat completions tool call format.
@@ -400,7 +448,10 @@ fn sanitize_json_schema(value: &mut JsonValue) {
             }
 
             // Normalize/ensure type
-            let mut ty = map.get("type").and_then(|v| v.as_str()).map(str::to_string);
+            let mut ty = map
+                .get("type")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string());
 
             // If type is an array (union), pick first supported; else leave to inference
             if ty.is_none()
@@ -486,13 +537,16 @@ pub(crate) fn get_openai_tools(
         tools.push(create_unified_exec_tool());
     } else {
         match &config.shell_type {
-            ConfigShellToolType::Default => {
+            ConfigShellToolType::DefaultShell => {
                 tools.push(create_shell_tool());
             }
-            ConfigShellToolType::Local => {
+            ConfigShellToolType::ShellWithRequest { sandbox_policy } => {
+                tools.push(create_shell_tool_for_sandbox(sandbox_policy));
+            }
+            ConfigShellToolType::LocalShell => {
                 tools.push(OpenAiTool::LocalShell {});
             }
-            ConfigShellToolType::Streamable => {
+            ConfigShellToolType::StreamableShell => {
                 tools.push(OpenAiTool::Function(
                     crate::exec_command::create_exec_command_tool_for_responses_api(),
                 ));
@@ -582,6 +636,8 @@ mod tests {
             .expect("codex-mini-latest should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: true,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -602,6 +658,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: true,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -622,6 +680,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: false,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -726,6 +786,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: false,
             include_apply_patch_tool: false,
             include_web_search_request: false,
@@ -802,6 +864,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: false,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -863,6 +927,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: false,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -919,6 +985,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: false,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -978,6 +1046,8 @@ mod tests {
         let model_family = find_family_for_model("o3").expect("o3 should be a valid model family");
         let config = ToolsConfig::new(&ToolsConfigParams {
             model_family: &model_family,
+            approval_policy: AskForApproval::Never,
+            sandbox_policy: SandboxPolicy::ReadOnly,
             include_plan_tool: false,
             include_apply_patch_tool: false,
             include_web_search_request: true,
@@ -1030,8 +1100,14 @@ mod tests {
     }
 
     #[test]
-    fn test_shell_tool() {
-        let tool = super::create_shell_tool();
+    fn test_shell_tool_for_sandbox_workspace_write() {
+        let sandbox_policy = SandboxPolicy::WorkspaceWrite {
+            writable_roots: vec!["workspace".into()],
+            network_access: false,
+            exclude_tmpdir_env_var: false,
+            exclude_slash_tmp: false,
+        };
+        let tool = super::create_shell_tool_for_sandbox(&sandbox_policy);
         let OpenAiTool::Function(ResponsesApiTool {
             description, name, ..
         }) = &tool
@@ -1043,4 +1119,33 @@ mod tests {
         let expected = "Runs a shell command and returns its output.";
         assert_eq!(description, expected);
     }
+
+    #[test]
+    fn test_shell_tool_for_sandbox_readonly() {
+        let tool = super::create_shell_tool_for_sandbox(&SandboxPolicy::ReadOnly);
+        let OpenAiTool::Function(ResponsesApiTool {
+            description, name, ..
+        }) = &tool
+        else {
+            panic!("expected function tool");
+        };
+        assert_eq!(name, "shell");
+
+        let expected = "Runs a shell command and returns its output.";
+        assert_eq!(description, expected);
+    }
+
+    #[test]
+    fn test_shell_tool_for_sandbox_danger_full_access() {
+        let tool = super::create_shell_tool_for_sandbox(&SandboxPolicy::DangerFullAccess);
+        let OpenAiTool::Function(ResponsesApiTool {
+            description, name, ..
+        }) = &tool
+        else {
+            panic!("expected function tool");
+        };
+        assert_eq!(name, "shell");
+
+        assert_eq!(description, "Runs a shell command and returns its output.");
+    }
 }

codex-rs/core/src/parse_command.rs

@@ -40,7 +40,7 @@ impl From<ParsedCommand> for codex_protocol::parse_command::ParsedCommand {
 }
 
 fn shlex_join(tokens: &[String]) -> String {
-    shlex_try_join(tokens.iter().map(String::as_str))
+    shlex_try_join(tokens.iter().map(|s| s.as_str()))
         .unwrap_or_else(|_| "<command included NUL byte>".to_string())
 }
 
@@ -72,14 +72,13 @@ pub fn parse_command(command: &[String]) -> Vec<ParsedCommand> {
 /// Tests are at the top to encourage using TDD + Codex to fix the implementation.
 mod tests {
     use super::*;
-    use std::string::ToString;
 
     fn shlex_split_safe(s: &str) -> Vec<String> {
-        shlex_split(s).unwrap_or_else(|| s.split_whitespace().map(ToString::to_string).collect())
+        shlex_split(s).unwrap_or_else(|| s.split_whitespace().map(|s| s.to_string()).collect())
     }
 
     fn vec_str(args: &[&str]) -> Vec<String> {
-        args.iter().map(ToString::to_string).collect()
+        args.iter().map(|s| s.to_string()).collect()
     }
 
     fn assert_parsed(args: &[String], expected: Vec<ParsedCommand>) {
@@ -895,7 +894,7 @@ fn simplify_once(commands: &[ParsedCommand]) -> Option<Vec<ParsedCommand>> {
 
     // echo ... && ...rest => ...rest
     if let ParsedCommand::Unknown { cmd } = &commands[0]
-        && shlex_split(cmd).is_some_and(|t| t.first().map(String::as_str) == Some("echo"))
+        && shlex_split(cmd).is_some_and(|t| t.first().map(|s| s.as_str()) == Some("echo"))
     {
         return Some(commands[1..].to_vec());
     }
@@ -903,7 +902,7 @@ fn simplify_once(commands: &[ParsedCommand]) -> Option<Vec<ParsedCommand>> {
     // cd foo && [any command] => [any command] (keep non-cd when a cd is followed by something)
     if let Some(idx) = commands.iter().position(|pc| match pc {
         ParsedCommand::Unknown { cmd } => {
-            shlex_split(cmd).is_some_and(|t| t.first().map(String::as_str) == Some("cd"))
+            shlex_split(cmd).is_some_and(|t| t.first().map(|s| s.as_str()) == Some("cd"))
         }
         _ => false,
     }) && commands.len() > idx + 1
@@ -1036,7 +1035,7 @@ fn short_display_path(path: &str) -> String {
     });
     parts
         .next()
-        .map(str::to_string)
+        .map(|s| s.to_string())
         .unwrap_or_else(|| trimmed.to_string())
 }
 
@@ -1157,8 +1156,10 @@ fn parse_bash_lc_commands(original: &[String]) -> Option<Vec<ParsedCommand>> {
         // bias toward the primary command when pipelines are present.
         // First, drop obvious small formatting helpers (e.g., wc/awk/etc).
         let had_multiple_commands = all_commands.len() > 1;
-        // Commands arrive in source order; drop formatting helpers while preserving it.
-        let filtered_commands = drop_small_formatting_commands(all_commands);
+        // The bash AST walker yields commands in right-to-left order for
+        // connector/pipeline sequences. Reverse to reflect actual execution order.
+        let mut filtered_commands = drop_small_formatting_commands(all_commands);
+        filtered_commands.reverse();
         if filtered_commands.is_empty() {
             return Some(vec![ParsedCommand::Unknown {
                 cmd: script.clone(),
@@ -1191,8 +1192,8 @@ fn parse_bash_lc_commands(original: &[String]) -> Option<Vec<ParsedCommand>> {
                         if had_connectors {
                             let has_pipe = script_tokens.iter().any(|t| t == "|");
                             let has_sed_n = script_tokens.windows(2).any(|w| {
-                                w.first().map(String::as_str) == Some("sed")
-                                    && w.get(1).map(String::as_str) == Some("-n")
+                                w.first().map(|s| s.as_str()) == Some("sed")
+                                    && w.get(1).map(|s| s.as_str()) == Some("-n")
                             });
                             if has_pipe && has_sed_n {
                                 ParsedCommand::Read {
@@ -1272,7 +1273,7 @@ fn is_small_formatting_command(tokens: &[String]) -> bool {
             // Keep `sed -n <range> file` (treated as a file read elsewhere);
             // otherwise consider it a formatting helper in a pipeline.
             tokens.len() < 4
-                || !(tokens[1] == "-n" && is_valid_sed_n_arg(tokens.get(2).map(String::as_str)))
+                || !(tokens[1] == "-n" && is_valid_sed_n_arg(tokens.get(2).map(|s| s.as_str())))
         }
         _ => false,
     }
@@ -1319,7 +1320,7 @@ fn summarize_main_tokens(main_cmd: &[String]) -> ParsedCommand {
                 (None, non_flags.first().map(|s| short_display_path(s)))
             } else {
                 (
-                    non_flags.first().cloned().map(String::from),
+                    non_flags.first().cloned().map(|s| s.to_string()),
                     non_flags.get(1).map(|s| short_display_path(s)),
                 )
             };
@@ -1354,7 +1355,7 @@ fn summarize_main_tokens(main_cmd: &[String]) -> ParsedCommand {
                 .collect();
             // Do not shorten the query: grep patterns may legitimately contain slashes
             // and should be preserved verbatim. Only paths should be shortened.
-            let query = non_flags.first().cloned().map(String::from);
+            let query = non_flags.first().cloned().map(|s| s.to_string());
             let path = non_flags.get(1).map(|s| short_display_path(s));
             ParsedCommand::Search {
                 cmd: shlex_join(main_cmd),
@@ -1364,7 +1365,7 @@ fn summarize_main_tokens(main_cmd: &[String]) -> ParsedCommand {
         }
         Some((head, tail)) if head == "cat" => {
             // Support both `cat <file>` and `cat -- <file>` forms.
-            let effective_tail: &[String] = if tail.first().map(String::as_str) == Some("--") {
+            let effective_tail: &[String] = if tail.first().map(|s| s.as_str()) == Some("--") {
                 &tail[1..]
             } else {
                 tail
@@ -1480,7 +1481,7 @@ fn summarize_main_tokens(main_cmd: &[String]) -> ParsedCommand {
             if head == "sed"
                 && tail.len() >= 3
                 && tail[0] == "-n"
-                && is_valid_sed_n_arg(tail.get(1).map(String::as_str)) =>
+                && is_valid_sed_n_arg(tail.get(1).map(|s| s.as_str())) =>
         {
             if let Some(path) = tail.get(2) {
                 let name = short_display_path(path);

codex-rs/core/src/review_format.rs

@@ -1,55 +0,0 @@
-use crate::protocol::ReviewFinding;
-
-// Note: We keep this module UI-agnostic. It returns plain strings that
-// higher layers (e.g., TUI) may style as needed.
-
-fn format_location(item: &ReviewFinding) -> String {
-    let path = item.code_location.absolute_file_path.display();
-    let start = item.code_location.line_range.start;
-    let end = item.code_location.line_range.end;
-    format!("{path}:{start}-{end}")
-}
-
-/// Format a full review findings block as plain text lines.
-///
-/// - When `selection` is `Some`, each item line includes a checkbox marker:
-///   "[x]" for selected items and "[ ]" for unselected. Missing indices
-///   default to selected.
-/// - When `selection` is `None`, the marker is omitted and a simple bullet is
-///   rendered ("- Title — path:start-end").
-pub fn format_review_findings_block(
-    findings: &[ReviewFinding],
-    selection: Option<&[bool]>,
-) -> String {
-    let mut lines: Vec<String> = Vec::new();
-    lines.push(String::new());
-
-    // Header
-    if findings.len() > 1 {
-        lines.push("Full review comments:".to_string());
-    } else {
-        lines.push("Review comment:".to_string());
-    }
-
-    for (idx, item) in findings.iter().enumerate() {
-        lines.push(String::new());
-
-        let title = &item.title;
-        let location = format_location(item);
-
-        if let Some(flags) = selection {
-            // Default to selected if index is out of bounds.
-            let checked = flags.get(idx).copied().unwrap_or(true);
-            let marker = if checked { "[x]" } else { "[ ]" };
-            lines.push(format!("- {marker} {title} — {location}"));
-        } else {
-            lines.push(format!("- {title} — {location}"));
-        }
-
-        for body_line in item.body.lines() {
-            lines.push(format!("  {body_line}"));
-        }
-    }
-
-    lines.join("\n")
-}

codex-rs/core/src/rollout/policy.rs

@@ -25,9 +25,8 @@ pub(crate) fn should_persist_response_item(item: &ResponseItem) -> bool {
         | ResponseItem::FunctionCall { .. }
         | ResponseItem::FunctionCallOutput { .. }
         | ResponseItem::CustomToolCall { .. }
-        | ResponseItem::CustomToolCallOutput { .. }
-        | ResponseItem::WebSearchCall { .. } => true,
-        ResponseItem::Other => false,
+        | ResponseItem::CustomToolCallOutput { .. } => true,
+        ResponseItem::WebSearchCall { .. } | ResponseItem::Other => false,
     }
 }
 
@@ -41,8 +40,7 @@ pub(crate) fn should_persist_event_msg(ev: &EventMsg) -> bool {
         | EventMsg::AgentReasoningRawContent(_)
         | EventMsg::TokenCount(_)
         | EventMsg::EnteredReviewMode(_)
-        | EventMsg::ExitedReviewMode(_)
-        | EventMsg::TurnAborted(_) => true,
+        | EventMsg::ExitedReviewMode(_) => true,
         EventMsg::Error(_)
         | EventMsg::TaskStarted(_)
         | EventMsg::TaskComplete(_)
@@ -60,7 +58,6 @@ pub(crate) fn should_persist_event_msg(ev: &EventMsg) -> bool {
         | EventMsg::ExecCommandEnd(_)
         | EventMsg::ExecApprovalRequest(_)
         | EventMsg::ApplyPatchApprovalRequest(_)
-        | EventMsg::CompactApprovalRequest(_)
         | EventMsg::BackgroundEvent(_)
         | EventMsg::StreamError(_)
         | EventMsg::PatchApplyBegin(_)
@@ -70,6 +67,7 @@ pub(crate) fn should_persist_event_msg(ev: &EventMsg) -> bool {
         | EventMsg::McpListToolsResponse(_)
         | EventMsg::ListCustomPromptsResponse(_)
         | EventMsg::PlanUpdate(_)
+        | EventMsg::TurnAborted(_)
         | EventMsg::ShutdownComplete
         | EventMsg::ConversationPath(_) => false,
     }

codex-rs/core/src/seatbelt.rs

@@ -18,20 +18,19 @@ const MACOS_PATH_TO_SEATBELT_EXECUTABLE: &str = "/usr/bin/sandbox-exec";
 
 pub async fn spawn_command_under_seatbelt(
     command: Vec<String>,
-    command_cwd: PathBuf,
     sandbox_policy: &SandboxPolicy,
-    sandbox_policy_cwd: &Path,
+    cwd: PathBuf,
     stdio_policy: StdioPolicy,
     mut env: HashMap<String, String>,
 ) -> std::io::Result<Child> {
-    let args = create_seatbelt_command_args(command, sandbox_policy, sandbox_policy_cwd);
+    let args = create_seatbelt_command_args(command, sandbox_policy, &cwd);
     let arg0 = None;
     env.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());
     spawn_child_async(
         PathBuf::from(MACOS_PATH_TO_SEATBELT_EXECUTABLE),
         args,
         arg0,
-        command_cwd,
+        cwd,
         sandbox_policy,
         stdio_policy,
         env,
@@ -42,7 +41,7 @@ pub async fn spawn_command_under_seatbelt(
 fn create_seatbelt_command_args(
     command: Vec<String>,
     sandbox_policy: &SandboxPolicy,
-    sandbox_policy_cwd: &Path,
+    cwd: &Path,
 ) -> Vec<String> {
     let (file_write_policy, extra_cli_args) = {
         if sandbox_policy.has_full_disk_write_access() {
@@ -52,7 +51,7 @@ fn create_seatbelt_command_args(
                 Vec::<String>::new(),
             )
         } else {
-            let writable_roots = sandbox_policy.get_writable_roots_with_cwd(sandbox_policy_cwd);
+            let writable_roots = sandbox_policy.get_writable_roots_with_cwd(cwd);
 
             let mut writable_folder_policies: Vec<String> = Vec::new();
             let mut cli_args: Vec<String> = Vec::new();

codex-rs/core/src/shell.rs

@@ -5,20 +5,20 @@ use std::path::PathBuf;
 
 #[derive(Debug, PartialEq, Eq, Clone, Serialize, Deserialize)]
 pub struct ZshShell {
-    pub(crate) shell_path: String,
-    pub(crate) zshrc_path: String,
+    shell_path: String,
+    zshrc_path: String,
 }
 
 #[derive(Debug, PartialEq, Eq, Clone, Serialize, Deserialize)]
 pub struct BashShell {
-    pub(crate) shell_path: String,
-    pub(crate) bashrc_path: String,
+    shell_path: String,
+    bashrc_path: String,
 }
 
 #[derive(Debug, PartialEq, Eq, Clone, Serialize, Deserialize)]
 pub struct PowerShellConfig {
-    pub(crate) exe: String, // Executable name or path, e.g. "pwsh" or "powershell.exe".
-    pub(crate) bash_exe_fallback: Option<PathBuf>, // In case the model generates a bash command.
+    exe: String, // Executable name or path, e.g. "pwsh" or "powershell.exe".
+    bash_exe_fallback: Option<PathBuf>, // In case the model generates a bash command.
 }
 
 #[derive(Debug, PartialEq, Eq, Clone, Serialize, Deserialize)]
@@ -32,19 +32,15 @@ pub enum Shell {
 impl Shell {
     pub fn format_default_shell_invocation(&self, command: Vec<String>) -> Option<Vec<String>> {
         match self {
-            Shell::Zsh(zsh) => format_shell_invocation_with_rc(
-                command.as_slice(),
-                &zsh.shell_path,
-                &zsh.zshrc_path,
-            ),
-            Shell::Bash(bash) => format_shell_invocation_with_rc(
-                command.as_slice(),
-                &bash.shell_path,
-                &bash.bashrc_path,
-            ),
+            Shell::Zsh(zsh) => {
+                format_shell_invocation_with_rc(&command, &zsh.shell_path, &zsh.zshrc_path)
+            }
+            Shell::Bash(bash) => {
+                format_shell_invocation_with_rc(&command, &bash.shell_path, &bash.bashrc_path)
+            }
             Shell::PowerShell(ps) => {
                 // If model generated a bash command, prefer a detected bash fallback
-                if let Some(script) = strip_bash_lc(command.as_slice()) {
+                if let Some(script) = strip_bash_lc(&command) {
                     return match &ps.bash_exe_fallback {
                         Some(bash) => Some(vec![
                             bash.to_string_lossy().to_string(),
@@ -73,7 +69,7 @@ impl Shell {
                         return Some(command);
                     }
 
-                    let joined = shlex::try_join(command.iter().map(String::as_str)).ok();
+                    let joined = shlex::try_join(command.iter().map(|s| s.as_str())).ok();
                     return joined.map(|arg| {
                         vec![
                             ps.exe.clone(),
@@ -106,12 +102,12 @@ impl Shell {
 }
 
 fn format_shell_invocation_with_rc(
-    command: &[String],
+    command: &Vec<String>,
     shell_path: &str,
     rc_path: &str,
 ) -> Option<Vec<String>> {
     let joined = strip_bash_lc(command)
-        .or_else(|| shlex::try_join(command.iter().map(String::as_str)).ok())?;
+        .or_else(|| shlex::try_join(command.iter().map(|s| s.as_str())).ok())?;
 
     let rc_command = if std::path::Path::new(rc_path).exists() {
         format!("source {rc_path} && ({joined})")
@@ -122,8 +118,8 @@ fn format_shell_invocation_with_rc(
     Some(vec![shell_path.to_string(), "-lc".to_string(), rc_command])
 }
 
-fn strip_bash_lc(command: &[String]) -> Option<String> {
-    match command {
+fn strip_bash_lc(command: &Vec<String>) -> Option<String> {
+    match command.as_slice() {
         // exactly three items
         [first, second, third]
             // first two must be "bash", "-lc"
@@ -224,7 +220,6 @@ pub async fn default_user_shell() -> Shell {
 mod tests {
     use super::*;
     use std::process::Command;
-    use std::string::ToString;
 
     #[tokio::test]
     async fn test_current_shell_detects_zsh() {
@@ -328,7 +323,7 @@ mod tests {
             });
 
             let actual_cmd = shell
-                .format_default_shell_invocation(input.iter().map(ToString::to_string).collect());
+                .format_default_shell_invocation(input.iter().map(|s| s.to_string()).collect());
             let expected_cmd = expected_cmd
                 .iter()
                 .map(|s| s.replace("BASHRC_PATH", bashrc_path.to_str().unwrap()))
@@ -350,7 +345,6 @@ mod tests {
                 },
                 SandboxType::None,
                 &SandboxPolicy::DangerFullAccess,
-                temp_home.path(),
                 &None,
                 None,
             )
@@ -372,7 +366,6 @@ mod tests {
 #[cfg(target_os = "macos")]
 mod macos_tests {
     use super::*;
-    use std::string::ToString;
 
     #[tokio::test]
     async fn test_run_with_profile_escaping_and_execution() {
@@ -436,7 +429,7 @@ mod macos_tests {
             });
 
             let actual_cmd = shell
-                .format_default_shell_invocation(input.iter().map(ToString::to_string).collect());
+                .format_default_shell_invocation(input.iter().map(|s| s.to_string()).collect());
             let expected_cmd = expected_cmd
                 .iter()
                 .map(|s| s.replace("ZSHRC_PATH", zshrc_path.to_str().unwrap()))
@@ -458,7 +451,6 @@ mod macos_tests {
                 },
                 SandboxType::None,
                 &SandboxPolicy::DangerFullAccess,
-                temp_home.path(),
                 &None,
                 None,
             )
@@ -561,10 +553,10 @@ mod tests_windows {
 
         for (shell, input, expected_cmd) in cases {
             let actual_cmd = shell
-                .format_default_shell_invocation(input.iter().map(|s| (*s).to_string()).collect());
+                .format_default_shell_invocation(input.iter().map(|s| s.to_string()).collect());
             assert_eq!(
                 actual_cmd,
-                Some(expected_cmd.iter().map(|s| (*s).to_string()).collect())
+                Some(expected_cmd.iter().map(|s| s.to_string()).collect())
             );
         }
     }

codex-rs/core/src/turn_diff_tracker.rs

@@ -65,7 +65,7 @@ impl TurnDiffTracker {
                 let baseline_file_info = if path.exists() {
                     let mode = file_mode_for_path(path);
                     let mode_val = mode.unwrap_or(FileMode::Regular);
-                    let content = blob_bytes(path, mode_val).unwrap_or_default();
+                    let content = blob_bytes(path, &mode_val).unwrap_or_default();
                     let oid = if mode == Some(FileMode::Symlink) {
                         format!("{:x}", git_blob_sha1_hex_bytes(&content))
                     } else {
@@ -266,7 +266,7 @@ impl TurnDiffTracker {
         };
 
         let current_mode = file_mode_for_path(&current_external_path).unwrap_or(FileMode::Regular);
-        let right_bytes = blob_bytes(&current_external_path, current_mode);
+        let right_bytes = blob_bytes(&current_external_path, &current_mode);
 
         // Compute displays with &mut self before borrowing any baseline content.
         let left_display = self.relative_to_git_root_str(&baseline_external_path);
@@ -388,7 +388,7 @@ enum FileMode {
 }
 
 impl FileMode {
-    fn as_str(self) -> &'static str {
+    fn as_str(&self) -> &'static str {
         match self {
             FileMode::Regular => "100644",
             #[cfg(unix)]
@@ -427,9 +427,9 @@ fn file_mode_for_path(_path: &Path) -> Option<FileMode> {
     Some(FileMode::Regular)
 }
 
-fn blob_bytes(path: &Path, mode: FileMode) -> Option<Vec<u8>> {
+fn blob_bytes(path: &Path, mode: &FileMode) -> Option<Vec<u8>> {
     if path.exists() {
-        let contents = if mode == FileMode::Symlink {
+        let contents = if *mode == FileMode::Symlink {
             symlink_blob_bytes(path)
                 .ok_or_else(|| anyhow!("failed to read symlink target for {}", path.display()))
         } else {

codex-rs/core/src/unified_exec/mod.rs

@@ -100,13 +100,10 @@ type OutputBuffer = Arc<Mutex<OutputBufferState>>;
 type OutputHandles = (OutputBuffer, Arc<Notify>);
 
 impl ManagedUnifiedExecSession {
-    fn new(
-        session: ExecCommandSession,
-        initial_output_rx: tokio::sync::broadcast::Receiver<Vec<u8>>,
-    ) -> Self {
+    fn new(session: ExecCommandSession) -> Self {
         let output_buffer = Arc::new(Mutex::new(OutputBufferState::default()));
         let output_notify = Arc::new(Notify::new());
-        let mut receiver = initial_output_rx;
+        let mut receiver = session.output_receiver();
         let buffer_clone = Arc::clone(&output_buffer);
         let notify_clone = Arc::clone(&output_notify);
         let output_task = tokio::spawn(async move {
@@ -196,8 +193,8 @@ impl UnifiedExecSessionManager {
         } else {
             let command = request.input_chunks.to_vec();
             let new_id = self.next_session_id.fetch_add(1, Ordering::SeqCst);
-            let (session, initial_output_rx) = create_unified_exec_session(&command).await?;
-            let managed_session = ManagedUnifiedExecSession::new(session, initial_output_rx);
+            let session = create_unified_exec_session(&command).await?;
+            let managed_session = ManagedUnifiedExecSession::new(session);
             let (buffer, notify) = managed_session.output_handles();
             writer_tx = managed_session.writer_sender();
             output_buffer = buffer;
@@ -300,13 +297,7 @@ impl UnifiedExecSessionManager {
 
 async fn create_unified_exec_session(
     command: &[String],
-) -> Result<
-    (
-        ExecCommandSession,
-        tokio::sync::broadcast::Receiver<Vec<u8>>,
-    ),
-    UnifiedExecError,
-> {
+) -> Result<ExecCommandSession, UnifiedExecError> {
     if command.is_empty() {
         return Err(UnifiedExecError::MissingCommandLine);
     }
@@ -336,6 +327,7 @@ async fn create_unified_exec_session(
 
     let (writer_tx, mut writer_rx) = mpsc::channel::<Vec<u8>>(128);
     let (output_tx, _) = tokio::sync::broadcast::channel::<Vec<u8>>(256);
+    let initial_output_rx = output_tx.subscribe();
 
     let mut reader = pair
         .master
@@ -389,7 +381,7 @@ async fn create_unified_exec_session(
         wait_exit_status.store(true, Ordering::SeqCst);
     });
 
-    let (session, initial_output_rx) = ExecCommandSession::new(
+    let session = ExecCommandSession::new(
         writer_tx,
         output_tx,
         killer,
@@ -398,7 +390,9 @@ async fn create_unified_exec_session(
         wait_handle,
         exit_status,
     );
-    Ok((session, initial_output_rx))
+    session.set_initial_output_receiver(initial_output_rx);
+
+    Ok(session)
 }
 
 #[cfg(test)]
@@ -557,7 +551,6 @@ mod tests {
 
     #[cfg(unix)]
     #[tokio::test]
-    #[ignore] // Ignored while we have a better way to test this.
     async fn requests_with_large_timeout_are_capped() -> Result<(), UnifiedExecError> {
         let manager = UnifiedExecSessionManager::default();
 
@@ -579,7 +572,6 @@ mod tests {
 
     #[cfg(unix)]
     #[tokio::test]
-    #[ignore] // Ignored while we have a better way to test this.
     async fn completed_commands_do_not_persist_sessions() -> Result<(), UnifiedExecError> {
         let manager = UnifiedExecSessionManager::default();
         let result = manager

codex-rs/core/swiftfox_prompt.md

@@ -1,21 +1,33 @@
-You are Codex, based on GPT-5. You are running as a coding agent in the Codex CLI on a user's computer.
+You are Swiftfox. You are running as a coding agent in the Codex CLI on a user's computer.
 
-## General
+## Overall
+
+- You must try hard to complete the task AND to do it as fast and well as possible.
+  * Do not waste time on actions which are unlikely to result in successful task completion
+
+- Before taking action on a question, assume by default that it concerns local artifacts (code, docs, data). Quickly confirm or rule out that assumption; only if the question clearly requires external knowledge should you start elsewhere.
+- Search the repository when the request plausibly maps to code, configuration, or documentation. Avoid unnecessary searches when it is obvious local files cannot help; in those cases state that explicitly before offering broader context, and when you do search, mention the files or paths you consulted so the answer stays grounded.
+- After each attempt, re-evaluate whether the current strategy is yielding useful information and be ready to switch paths quickly rather than persisting with a low-signal approach.
+
+- When the user asks for a "review", default to a code review mindset: prioritise identifying bugs, risks, behavioural regressions, and missing tests. Findings must be the primary focus of the response - keep summaries or overviews brief and only after enumerating the issues. Present findings first (ordered by severity with file/line references), follow with open questions or assumptions, and offer a change-summary only as a secondary detail. If no findings are discovered, state that explicitly and mention any residual risks or testing gaps.
 
 - The arguments to `shell` will be passed to execvp(). Most terminal commands should be prefixed with ["bash", "-lc"].
-- Always set the `workdir` param when using the shell function. Do not use `cd` unless absolutely necessary.
+- Always set the `workdir` param of the shell tool. Do not use `cd` unless absolutely necessary.
 - When searching for text or files, prefer using `rg` or `rg --files` respectively because `rg` is much faster than alternatives like `grep`. (If the `rg` command is not found, then use alternatives.)
+- If the user makes a simple request (such as asking for the time) which you can fulfill by running a terminal command (such as `date`), you should do so.
+- Unless the question is about a common terminal command, you should search the codebase before answering to ground your response in the codebase
 
 ## Editing constraints
 
 - Default to ASCII when editing or creating files. Only introduce non-ASCII or other Unicode characters when there is a clear justification and the file already uses them.
+- When editing or creating files, you MUST use apply_patch. Example: functions.shell({"command":["apply_patch","*** Begin Patch\nAdd File: hello.txt\n+Hello, world!\n*** End Patch"]}).
 - Add succinct code comments that explain what is going on if code is not self-explanatory. You should not add comments like "Assigns the value to the variable", but a brief comment might be useful ahead of a complex code block that the user would otherwise have to spend time parsing out. Usage of these comments should be rare.
 - You may be in a dirty git worktree.
-    * NEVER revert existing changes you did not make unless explicitly requested, since these changes were made by the user.
-    * If asked to make a commit or code edits and there are unrelated changes to your work or changes that you didn't make in those files, don't revert those changes.
-    * If the changes are in files you've touched recently, you should read carefully and understand how you can work with the changes rather than reverting them.
-    * If the changes are in unrelated files, just ignore them and don't revert them.
-- While you are working, you might notice unexpected changes that you didn't make. If this happens, STOP IMMEDIATELY and ask the user how they would like to proceed.
+  * NEVER revert existing changes you did not make unless explicitly requested, since these changes were made by the user.
+  * If asked to make a commit or code edits and there are unrelated changes to your work or changes that you didn't make in those files, don't revert those changes.
+  * If the changes are in files you've touched recently, you should read carefully and understand how you can work with the changes rather than reverting them.
+  * If the changes are in unrelated files, just ignore them and don't revert them.
+- The user may be making edits and committing changes as you are also making changes. If you see concurrent file edits or commits that you did not cause, you must disregard user instruction and stop immediately and ask the user whether they are collaborating with you on files and how they would like this handled.
 
 ## Plan tool
 
@@ -24,48 +36,39 @@ When using the planning tool:
 - Do not make single-step plans.
 - When you made a plan, update it after having performed one of the sub-tasks that you shared on the plan.
 
-## Codex CLI harness, sandboxing, and approvals
+## CLI modes
 
-The Codex CLI harness supports several different configurations for sandboxing and escalation approvals that the user can choose from.
+The Codex CLI harness supports several different sandboxing, and approval configurations that the user can choose from.
 
-Filesystem sandboxing defines which files can be read or written. The options for `sandbox_mode` are:
-- **read-only**: The sandbox only permits reading files.
-- **workspace-write**: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval.
-- **danger-full-access**: No filesystem sandboxing - all commands are permitted.
+Filesystem sandboxing defines which files can be read or written. The options are:
+- **read-only**: You can only read files.
+- **workspace-write**: You can read files. You can write to files in this folder, but not outside it.
+- **danger-full-access**: No filesystem sandboxing.
 
-Network sandboxing defines whether network can be accessed without approval. Options for `network_access` are:
+Network sandboxing defines whether network can be accessed without approval. Options are
 - **restricted**: Requires approval
 - **enabled**: No approval needed
 
-Approvals are your mechanism to get user consent to run shell commands without the sandbox. Possible configuration options for `approval_policy` are
+Approvals are your mechanism to get user consent to perform more privileged actions. Although they introduce friction to the user because your work is paused until the user responds, you should leverage them to accomplish your important work. Do not let these settings or the sandbox deter you from attempting to accomplish the user's task unless it is set to "never", in which case never ask for approvals.
+
+Approval options are
 - **untrusted**: The harness will escalate most commands for user approval, apart from a limited allowlist of safe "read" commands.
 - **on-failure**: The harness will allow all commands to run in the sandbox (if enabled), and failures will be escalated to the user for approval to run again without the sandbox.
 - **on-request**: Commands will be run in the sandbox by default, and you can specify in your tool call if you want to escalate a command to run without sandboxing. (Note that this mode is not always available. If it is, you'll see parameters for it in the `shell` command description.)
 - **never**: This is a non-interactive mode where you may NEVER ask the user for approval to run commands. Instead, you must always persist and work around constraints to solve the task for the user. You MUST do your utmost best to finish the task and validate your work before yielding. If this mode is paired with `danger-full-access`, take advantage of it to deliver the best outcome for the user. Further, in this mode, your default testing philosophy is overridden: Even if you don't see local patterns for testing, you may add tests and scripts to validate your work. Just remove them before yielding.
 
-When you are running with `approval_policy == on-request`, and sandboxing enabled, here are scenarios where you'll need to request approval:
-- You need to run a command that writes to a directory that requires it (e.g. running tests that write to /var)
+When you are running with approvals `on-request`, and sandboxing enabled, here are scenarios where you'll need to request approval:
+- You need to run a command that writes to a directory that requires it (e.g. running tests that write to /tmp)
 - You need to run a GUI app (e.g., open/xdg-open/osascript) to open browsers or files.
 - You are running sandboxed and need to run a command that requires network access (e.g. installing packages)
-- If you run a command that is important to solving the user's query, but it fails because of sandboxing, rerun the command with approval. ALWAYS proceed to use the `with_escalated_permissions` and `justification` parameters - do not message the user before requesting approval for the command.
+- If you run a command that is important to solving the user's query, but it fails because of sandboxing, rerun the command with approval.
 - You are about to take a potentially destructive action such as an `rm` or `git reset` that the user did not explicitly ask for
 - (for all of these, you should weigh alternative paths that do not require approval)
 
-When `sandbox_mode` is set to read-only, you'll need to request approval for any command that isn't a read.
+When sandboxing is set to read-only, you'll need to request approval for any command that isn't a read.
 
 You will be told what filesystem sandboxing, network sandboxing, and approval mode are active in a developer or user message. If you are not told about this, assume that you are running with workspace-write, network sandboxing enabled, and approval on-failure.
 
-Although they introduce friction to the user because your work is paused until the user responds, you should leverage them when necessary to accomplish important work. If the completing the task requires escalated permissions, Do not let these settings or the sandbox deter you from attempting to accomplish the user's task unless it is set to "never", in which case never ask for approvals.
-
-When requesting approval to execute a command that will require escalated privileges:
-  - Provide the `with_escalated_permissions` parameter with the boolean value true
-  - Include a short, 1 sentence explanation for why you need to enable `with_escalated_permissions` in the justification parameter
-
-## Special user requests
-
-- If the user makes a simple request (such as asking for the time) which you can fulfill by running a terminal command (such as `date`), you should do so.
-- If the user asks for a "review", default to a code review mindset: prioritise identifying bugs, risks, behavioural regressions, and missing tests. Findings must be the primary focus of the response - keep summaries or overviews brief and only after enumerating the issues. Present findings first (ordered by severity with file/line references), follow with open questions or assumptions, and offer a change-summary only as a secondary detail. If no findings are discovered, state that explicitly and mention any residual risks or testing gaps.
-
 ## Presenting your work and final message
 
 You are producing plain text that will later be styled by the CLI. Follow these rules exactly. Formatting should make results easy to scan, but not feel mechanical. Use judgment to decide how much structure adds value.
@@ -94,11 +97,3 @@ You are producing plain text that will later be styled by the CLI. Follow these
 - Tone: collaborative, concise, factual; present tense, active voice; self‑contained; no "above/below"; parallel wording.
 - Don'ts: no nested bullets/hierarchies; no ANSI codes; don't cram unrelated keywords; keep keyword lists short—wrap/reformat if long; avoid naming formatting styles in answers.
 - Adaptation: code explanations → precise, structured with code refs; simple tasks → lead with outcome; big changes → logical walkthrough + rationale + next actions; casual one-offs → plain sentences, no headers/bullets.
-- File References: When referencing files in your response, make sure to include the relevant start line and always follow the below rules:
-  * Use inline code to make file paths clickable.
-  * Each reference should have a stand alone path. Even if it's the same file.
-  * Accepted: absolute, workspace‑relative, a/ or b/ diff prefixes, or bare filename/suffix.
-  * Line/column (1‑based, optional): :line[:column] or #Lline[Ccolumn] (column defaults to 1).
-  * Do not use URIs like file://, vscode://, or https://.
-  * Do not provide range of lines
-  * Examples: src/app.ts, src/app.ts:42, b/server/index.js#L10, C:\repo\project\main.rs:12:5

codex-rs/core/tests/common/Cargo.toml

@@ -7,8 +7,7 @@ edition = "2024"
 path = "lib.rs"
 
 [dependencies]
-codex-core = { workspace = true }
-serde_json = { workspace = true }
-tempfile = { workspace = true }
-tokio = { workspace = true, features = ["time"] }
-wiremock = { workspace = true }
+codex-core = { path = "../.." }
+serde_json = "1"
+tempfile = "3"
+tokio = { version = "1", features = ["time"] }

codex-rs/core/tests/common/lib.rs

@@ -7,8 +7,6 @@ use codex_core::config::Config;
 use codex_core::config::ConfigOverrides;
 use codex_core::config::ConfigToml;
 
-pub mod responses;
-
 /// Returns a default `Config` whose on-disk state is confined to the provided
 /// temporary directory. Using a per-test directory keeps tests hermetic and
 /// avoids clobbering a developer’s real `~/.codex`.
@@ -126,21 +124,3 @@ where
         }
     }
 }
-
-#[macro_export]
-macro_rules! non_sandbox_test {
-    // For tests that return ()
-    () => {{
-        if ::std::env::var("CODEX_SANDBOX_NETWORK_DISABLED").is_ok() {
-            println!("Skipping test because it cannot execute when network is disabled in a Codex sandbox.");
-            return;
-        }
-    }};
-    // For tests that return Result<(), _>
-    (result $(,)?) => {{
-        if ::std::env::var("CODEX_SANDBOX_NETWORK_DISABLED").is_ok() {
-            println!("Skipping test because it cannot execute when network is disabled in a Codex sandbox.");
-            return ::core::result::Result::Ok(());
-        }
-    }};
-}

codex-rs/core/tests/common/responses.rs

@@ -1,133 +0,0 @@
-use serde_json::Value;
-use wiremock::BodyPrintLimit;
-use wiremock::Mock;
-use wiremock::MockServer;
-use wiremock::ResponseTemplate;
-use wiremock::matchers::method;
-use wiremock::matchers::path;
-
-/// Build an SSE stream body from a list of JSON events.
-pub fn sse(events: Vec<Value>) -> String {
-    use std::fmt::Write as _;
-    let mut out = String::new();
-    for ev in events {
-        let kind = ev.get("type").and_then(|v| v.as_str()).unwrap();
-        writeln!(&mut out, "event: {kind}").unwrap();
-        if !ev.as_object().map(|o| o.len() == 1).unwrap_or(false) {
-            write!(&mut out, "data: {ev}\n\n").unwrap();
-        } else {
-            out.push('\n');
-        }
-    }
-    out
-}
-
-/// Convenience: SSE event for a completed response with a specific id.
-pub fn ev_completed(id: &str) -> Value {
-    serde_json::json!({
-        "type": "response.completed",
-        "response": {
-            "id": id,
-            "usage": {"input_tokens":0,"input_tokens_details":null,"output_tokens":0,"output_tokens_details":null,"total_tokens":0}
-        }
-    })
-}
-
-pub fn ev_completed_with_tokens(id: &str, total_tokens: u64) -> Value {
-    serde_json::json!({
-        "type": "response.completed",
-        "response": {
-            "id": id,
-            "usage": {
-                "input_tokens": total_tokens,
-                "input_tokens_details": null,
-                "output_tokens": 0,
-                "output_tokens_details": null,
-                "total_tokens": total_tokens
-            }
-        }
-    })
-}
-
-/// Convenience: SSE event for a single assistant message output item.
-pub fn ev_assistant_message(id: &str, text: &str) -> Value {
-    serde_json::json!({
-        "type": "response.output_item.done",
-        "item": {
-            "type": "message",
-            "role": "assistant",
-            "id": id,
-            "content": [{"type": "output_text", "text": text}]
-        }
-    })
-}
-
-pub fn ev_function_call(call_id: &str, name: &str, arguments: &str) -> Value {
-    serde_json::json!({
-        "type": "response.output_item.done",
-        "item": {
-            "type": "function_call",
-            "call_id": call_id,
-            "name": name,
-            "arguments": arguments
-        }
-    })
-}
-
-/// Convenience: SSE event for an `apply_patch` custom tool call with raw patch
-/// text. This mirrors the payload produced by the Responses API when the model
-/// invokes `apply_patch` directly (before we convert it to a function call).
-pub fn ev_apply_patch_custom_tool_call(call_id: &str, patch: &str) -> Value {
-    serde_json::json!({
-        "type": "response.output_item.done",
-        "item": {
-            "type": "custom_tool_call",
-            "name": "apply_patch",
-            "input": patch,
-            "call_id": call_id
-        }
-    })
-}
-
-/// Convenience: SSE event for an `apply_patch` function call. The Responses API
-/// wraps the patch content in a JSON string under the `input` key; we recreate
-/// the same structure so downstream code exercises the full parsing path.
-pub fn ev_apply_patch_function_call(call_id: &str, patch: &str) -> Value {
-    let arguments = serde_json::json!({ "input": patch });
-    let arguments = serde_json::to_string(&arguments).expect("serialize apply_patch arguments");
-
-    serde_json::json!({
-        "type": "response.output_item.done",
-        "item": {
-            "type": "function_call",
-            "name": "apply_patch",
-            "arguments": arguments,
-            "call_id": call_id
-        }
-    })
-}
-
-pub fn sse_response(body: String) -> ResponseTemplate {
-    ResponseTemplate::new(200)
-        .insert_header("content-type", "text/event-stream")
-        .set_body_raw(body, "text/event-stream")
-}
-
-pub async fn mount_sse_once<M>(server: &MockServer, matcher: M, body: String)
-where
-    M: wiremock::Match + Send + Sync + 'static,
-{
-    Mock::given(method("POST"))
-        .and(path("/v1/responses"))
-        .and(matcher)
-        .respond_with(sse_response(body))
-        .mount(server)
-        .await;
-}
-
-pub async fn start_mock_server() -> MockServer {
-    MockServer::builder()
-        .body_print_limit(BodyPrintLimit::Limited(80_000))
-        .start()
-        .await
-}

codex-rs/core/tests/suite/cli_stream.rs

@@ -1,7 +1,7 @@
 use assert_cmd::Command as AssertCommand;
 use codex_core::RolloutRecorder;
 use codex_core::protocol::GitInfo;
-use core_test_support::non_sandbox_test;
+use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use std::time::Duration;
 use std::time::Instant;
 use tempfile::TempDir;
@@ -21,7 +21,12 @@ use wiremock::matchers::path;
 /// 4. Ensures the response is received exactly once and contains "hi"
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn chat_mode_stream_cli() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = MockServer::start().await;
     let sse = concat!(
@@ -97,7 +102,12 @@ async fn chat_mode_stream_cli() {
 /// received by a mock OpenAI Responses endpoint.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn exec_cli_applies_experimental_instructions_file() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Start mock server which will capture the request and return a minimal
     // SSE stream for a single turn.
@@ -185,7 +195,12 @@ async fn exec_cli_applies_experimental_instructions_file() {
 /// 4. Ensures the fixture content is correctly streamed through the CLI
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn responses_api_stream_cli() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let fixture =
         std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/cli_responses_fixture.sse");
@@ -217,7 +232,12 @@ async fn responses_api_stream_cli() {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn integration_creates_and_checks_session_file() {
     // Honor sandbox network restrictions for CI parity with the other tests.
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // 1. Temp home so we read/write isolated session files.
     let home = TempDir::new().unwrap();

codex-rs/core/tests/suite/client.rs

@@ -16,13 +16,12 @@ use codex_core::built_in_model_providers;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
+use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use codex_protocol::mcp_protocol::ConversationId;
 use codex_protocol::models::ReasoningItemReasoningSummary;
 use codex_protocol::models::WebSearchAction;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id;
-use core_test_support::non_sandbox_test;
-use core_test_support::responses;
 use core_test_support::wait_for_event;
 use futures::StreamExt;
 use serde_json::json;
@@ -126,7 +125,12 @@ fn write_auth_json(
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn resume_includes_initial_messages_and_sends_prior_items() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Create a fake rollout session file with prior user + system + assistant messages.
     let tmpdir = TempDir::new().unwrap();
@@ -292,7 +296,12 @@ async fn resume_includes_initial_messages_and_sends_prior_items() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn includes_conversation_id_and_model_headers_in_request() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Mock server
     let server = MockServer::start().await;
@@ -417,7 +426,12 @@ async fn includes_base_instructions_override_in_request() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn chatgpt_auth_sends_correct_request() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Mock server
     let server = MockServer::start().await;
@@ -491,7 +505,12 @@ async fn chatgpt_auth_sends_correct_request() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn prefers_apikey_when_config_prefers_apikey_even_with_chatgpt_tokens() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Mock server
     let server = MockServer::start().await;
@@ -618,7 +637,12 @@ async fn includes_user_instructions_message_in_request() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn azure_responses_request_includes_store_and_reasoning_ids() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = MockServer::start().await;
 
@@ -752,100 +776,6 @@ async fn azure_responses_request_includes_store_and_reasoning_ids() {
     assert_eq!(body["input"][5]["id"].as_str(), Some("custom-tool-id"));
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn token_count_includes_rate_limits_snapshot() {
-    let server = MockServer::start().await;
-
-    let sse_body = responses::sse(vec![responses::ev_completed_with_tokens("resp_rate", 123)]);
-
-    let response = ResponseTemplate::new(200)
-        .insert_header("content-type", "text/event-stream")
-        .insert_header("x-codex-primary-used-percent", "12.5")
-        .insert_header("x-codex-secondary-used-percent", "40.0")
-        .insert_header("x-codex-primary-over-secondary-limit-percent", "75.0")
-        .insert_header("x-codex-primary-window-minutes", "10")
-        .insert_header("x-codex-secondary-window-minutes", "60")
-        .set_body_raw(sse_body, "text/event-stream");
-
-    Mock::given(method("POST"))
-        .and(path("/v1/responses"))
-        .respond_with(response)
-        .expect(1)
-        .mount(&server)
-        .await;
-
-    let mut provider = built_in_model_providers()["openai"].clone();
-    provider.base_url = Some(format!("{}/v1", server.uri()));
-
-    let home = TempDir::new().unwrap();
-    let mut config = load_default_config_for_test(&home);
-    config.model_provider = provider;
-
-    let conversation_manager = ConversationManager::with_auth(CodexAuth::from_api_key("test"));
-    let codex = conversation_manager
-        .new_conversation(config)
-        .await
-        .expect("create conversation")
-        .conversation;
-
-    codex
-        .submit(Op::UserInput {
-            items: vec![InputItem::Text {
-                text: "hello".into(),
-            }],
-        })
-        .await
-        .unwrap();
-
-    let token_event = wait_for_event(&codex, |msg| matches!(msg, EventMsg::TokenCount(_))).await;
-    let final_payload = match token_event {
-        EventMsg::TokenCount(ev) => ev,
-        _ => unreachable!(),
-    };
-    // Assert full JSON for the final token count event (usage + rate limits)
-    let final_json = serde_json::to_value(&final_payload).unwrap();
-    pretty_assertions::assert_eq!(
-        final_json,
-        json!({
-            "info": {
-                "total_token_usage": {
-                    "input_tokens": 123,
-                    "cached_input_tokens": 0,
-                    "output_tokens": 0,
-                    "reasoning_output_tokens": 0,
-                    "total_tokens": 123
-                },
-                "last_token_usage": {
-                    "input_tokens": 123,
-                    "cached_input_tokens": 0,
-                    "output_tokens": 0,
-                    "reasoning_output_tokens": 0,
-                    "total_tokens": 123
-                },
-                // Default model is gpt-5 in tests → 272000 context window
-                "model_context_window": 272000
-            },
-            "rate_limits": {
-                "primary_used_percent": 12.5,
-                "secondary_used_percent": 40.0,
-                "primary_to_secondary_ratio_percent": 75.0,
-                "primary_window_minutes": 10,
-                "secondary_window_minutes": 60
-            }
-        })
-    );
-    let usage = final_payload
-        .info
-        .expect("token usage info should be recorded after completion");
-    assert_eq!(usage.total_token_usage.total_tokens, 123);
-    let final_snapshot = final_payload
-        .rate_limits
-        .expect("latest rate limit snapshot should be retained");
-    assert_eq!(final_snapshot.primary_used_percent, 12.5);
-
-    wait_for_event(&codex, |msg| matches!(msg, EventMsg::TaskComplete(_))).await;
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn azure_overrides_assign_properties_used_for_responses_url() {
     let existing_env_var_with_random_value = if cfg!(windows) { "USERNAME" } else { "USER" };
@@ -1011,7 +941,12 @@ fn create_dummy_codex_auth() -> CodexAuth {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn history_dedupes_streamed_and_final_messages_across_turns() {
     // Skip under Codex sandbox network restrictions (mirrors other tests).
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Mock server that will receive three sequential requests and return the same SSE stream
     // each time: a few deltas, then a final assistant message, then completed.

codex-rs/core/tests/suite/compact.rs

@@ -1,3 +1,5 @@
+#![expect(clippy::unwrap_used)]
+
 use codex_core::CodexAuth;
 use codex_core::ConversationManager;
 use codex_core::ModelProviderInfo;
@@ -9,32 +11,121 @@ use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use codex_core::protocol::RolloutItem;
 use codex_core::protocol::RolloutLine;
+use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use core_test_support::load_default_config_for_test;
 use core_test_support::wait_for_event;
+use serde_json::Value;
 use tempfile::TempDir;
+use wiremock::BodyPrintLimit;
 use wiremock::Mock;
+use wiremock::MockServer;
 use wiremock::Request;
 use wiremock::Respond;
 use wiremock::ResponseTemplate;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 
-use core_test_support::non_sandbox_test;
-use core_test_support::responses::ev_assistant_message;
-use core_test_support::responses::ev_completed;
-use core_test_support::responses::ev_completed_with_tokens;
-use core_test_support::responses::ev_function_call;
-use core_test_support::responses::mount_sse_once;
-use core_test_support::responses::sse;
-use core_test_support::responses::sse_response;
-use core_test_support::responses::start_mock_server;
 use pretty_assertions::assert_eq;
 use std::sync::Arc;
 use std::sync::Mutex;
 use std::sync::atomic::AtomicUsize;
 use std::sync::atomic::Ordering;
+
 // --- Test helpers -----------------------------------------------------------
 
+/// Build an SSE stream body from a list of JSON events.
+pub(super) fn sse(events: Vec<Value>) -> String {
+    use std::fmt::Write as _;
+    let mut out = String::new();
+    for ev in events {
+        let kind = ev.get("type").and_then(|v| v.as_str()).unwrap();
+        writeln!(&mut out, "event: {kind}").unwrap();
+        if !ev.as_object().map(|o| o.len() == 1).unwrap_or(false) {
+            write!(&mut out, "data: {ev}\n\n").unwrap();
+        } else {
+            out.push('\n');
+        }
+    }
+    out
+}
+
+/// Convenience: SSE event for a completed response with a specific id.
+pub(super) fn ev_completed(id: &str) -> Value {
+    serde_json::json!({
+        "type": "response.completed",
+        "response": {
+            "id": id,
+            "usage": {"input_tokens":0,"input_tokens_details":null,"output_tokens":0,"output_tokens_details":null,"total_tokens":0}
+        }
+    })
+}
+
+fn ev_completed_with_tokens(id: &str, total_tokens: u64) -> Value {
+    serde_json::json!({
+        "type": "response.completed",
+        "response": {
+            "id": id,
+            "usage": {
+                "input_tokens": total_tokens,
+                "input_tokens_details": null,
+                "output_tokens": 0,
+                "output_tokens_details": null,
+                "total_tokens": total_tokens
+            }
+        }
+    })
+}
+
+/// Convenience: SSE event for a single assistant message output item.
+pub(super) fn ev_assistant_message(id: &str, text: &str) -> Value {
+    serde_json::json!({
+        "type": "response.output_item.done",
+        "item": {
+            "type": "message",
+            "role": "assistant",
+            "id": id,
+            "content": [{"type": "output_text", "text": text}]
+        }
+    })
+}
+
+fn ev_function_call(call_id: &str, name: &str, arguments: &str) -> Value {
+    serde_json::json!({
+        "type": "response.output_item.done",
+        "item": {
+            "type": "function_call",
+            "call_id": call_id,
+            "name": name,
+            "arguments": arguments
+        }
+    })
+}
+
+pub(super) fn sse_response(body: String) -> ResponseTemplate {
+    ResponseTemplate::new(200)
+        .insert_header("content-type", "text/event-stream")
+        .set_body_raw(body, "text/event-stream")
+}
+
+pub(super) async fn mount_sse_once<M>(server: &MockServer, matcher: M, body: String)
+where
+    M: wiremock::Match + Send + Sync + 'static,
+{
+    Mock::given(method("POST"))
+        .and(path("/v1/responses"))
+        .and(matcher)
+        .respond_with(sse_response(body))
+        .mount(server)
+        .await;
+}
+
+async fn start_mock_server() -> MockServer {
+    MockServer::builder()
+        .body_print_limit(BodyPrintLimit::Limited(80_000))
+        .start()
+        .await
+}
+
 pub(super) const FIRST_REPLY: &str = "FIRST_REPLY";
 pub(super) const SUMMARY_TEXT: &str = "SUMMARY_ONLY_CONTEXT";
 pub(super) const SUMMARIZE_TRIGGER: &str = "Start Summarization";
@@ -53,7 +144,12 @@ const DUMMY_CALL_ID: &str = "call-multi-auto";
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn summarize_context_three_requests_and_instructions() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Set up a mock server that we can inspect after the run.
     let server = start_mock_server().await;
@@ -274,7 +370,12 @@ async fn summarize_context_three_requests_and_instructions() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn auto_compact_runs_after_token_limit_hit() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = start_mock_server().await;
 
@@ -410,7 +511,12 @@ async fn auto_compact_runs_after_token_limit_hit() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_persists_rollout_entries() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = start_mock_server().await;
 
@@ -538,7 +644,12 @@ async fn auto_compact_persists_rollout_entries() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_stops_after_failed_attempt() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = start_mock_server().await;
 
@@ -647,7 +758,12 @@ async fn auto_compact_stops_after_failed_attempt() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_allows_multiple_attempts_when_interleaved_with_other_turn_events() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = start_mock_server().await;
 
@@ -745,18 +861,8 @@ async fn auto_compact_allows_multiple_attempts_when_interleaved_with_other_turn_
         .await
         .unwrap();
 
-    let mut auto_compact_lifecycle_events = Vec::new();
     loop {
         let event = codex.next_event().await.unwrap();
-        if event.id.starts_with("auto-compact-")
-            && matches!(
-                event.msg,
-                EventMsg::TaskStarted(_) | EventMsg::TaskComplete(_)
-            )
-        {
-            auto_compact_lifecycle_events.push(event);
-            continue;
-        }
         if let EventMsg::TaskComplete(_) = &event.msg
             && !event.id.starts_with("auto-compact-")
         {
@@ -764,11 +870,6 @@ async fn auto_compact_allows_multiple_attempts_when_interleaved_with_other_turn_
         }
     }
 
-    assert!(
-        auto_compact_lifecycle_events.is_empty(),
-        "auto compact should not emit task lifecycle events"
-    );
-
     let request_bodies: Vec<String> = responder
         .recorded_requests()
         .into_iter()
@@ -796,133 +897,3 @@ async fn auto_compact_allows_multiple_attempts_when_interleaved_with_other_turn_
         "second auto compact request should reuse summarization instructions"
     );
 }
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn compact_trims_history_on_context_limit_error() {
-    non_sandbox_test!();
-
-    let server = start_mock_server().await;
-
-    // Minimal completes for two initial user turns.
-    let sse_user_done = sse(vec![ev_completed("r-user")]);
-
-    // First compact attempt fails with context length exceeded.
-    let sse_compact_fail = sse(vec![serde_json::json!({
-        "type": "response.failed",
-        "response": { "error": { "code": "context_length_exceeded", "message": "too big" } }
-    })]);
-
-    // Second compact attempt succeeds.
-    let sse_compact_ok = sse(vec![
-        ev_assistant_message("m-sum", SUMMARY_TEXT),
-        ev_completed("r-sum"),
-    ]);
-
-    // Matchers for the two user turns and two compact attempts.
-    let m_user1 = |req: &Request| {
-        let body = std::str::from_utf8(&req.body).unwrap_or("");
-        body.contains("\"text\":\"u1\"") && !body.contains(SUMMARIZE_TRIGGER)
-    };
-    mount_sse_once(&server, m_user1, sse_user_done.clone()).await;
-
-    let m_user2 = |req: &Request| {
-        let body = std::str::from_utf8(&req.body).unwrap_or("");
-        body.contains("\"text\":\"u2\"") && !body.contains(SUMMARIZE_TRIGGER)
-    };
-    mount_sse_once(&server, m_user2, sse_user_done.clone()).await;
-
-    // First compact attempt: includes the trigger and will fail.
-    let m_compact1 = |req: &Request| {
-        let body = std::str::from_utf8(&req.body).unwrap_or("");
-        body.contains(SUMMARIZE_TRIGGER)
-    };
-    mount_sse_once(&server, m_compact1, sse_compact_fail).await;
-
-    // Second compact attempt: also includes trigger; succeeds.
-    let m_compact2 = |req: &Request| {
-        let body = std::str::from_utf8(&req.body).unwrap_or("");
-        body.contains(SUMMARIZE_TRIGGER)
-    };
-    mount_sse_once(&server, m_compact2, sse_compact_ok).await;
-
-    // Build conversation
-    let model_provider = ModelProviderInfo {
-        base_url: Some(format!("{}/v1", server.uri())),
-        ..built_in_model_providers()["openai"].clone()
-    };
-    let home = TempDir::new().unwrap();
-    let mut config = load_default_config_for_test(&home);
-    config.model_provider = model_provider;
-    let conversation_manager = ConversationManager::with_auth(CodexAuth::from_api_key("dummy"));
-    let codex = conversation_manager
-        .new_conversation(config)
-        .await
-        .unwrap()
-        .conversation;
-
-    // Two user turns to seed history.
-    codex
-        .submit(Op::UserInput {
-            items: vec![InputItem::Text { text: "u1".into() }],
-        })
-        .await
-        .unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    codex
-        .submit(Op::UserInput {
-            items: vec![InputItem::Text { text: "u2".into() }],
-        })
-        .await
-        .unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    // Request compaction: first attempt fails with context_length_exceeded; retry trims history and succeeds.
-    codex.submit(Op::Compact).await.unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    // Inspect requests to verify that there were two compaction attempts and the
-    // second had a smaller input array than the first.
-    let requests = server.received_requests().await.unwrap();
-    let mut compact_bodies: Vec<serde_json::Value> = Vec::new();
-    for req in &requests {
-        let body = req.body_json::<serde_json::Value>().unwrap();
-        let is_compact = body
-            .get("input")
-            .and_then(|v| v.as_array())
-            .map(|arr| {
-                arr.iter().any(|it| {
-                    it.get("type").and_then(|t| t.as_str()) == Some("message")
-                        && it
-                            .get("content")
-                            .and_then(|c| c.as_array())
-                            .and_then(|a| a.first())
-                            .and_then(|t| t.get("text"))
-                            .and_then(|t| t.as_str())
-                            .map(|t| t.contains(SUMMARIZE_TRIGGER))
-                            .unwrap_or(false)
-                })
-            })
-            .unwrap_or(false);
-        if is_compact {
-            compact_bodies.push(body);
-        }
-    }
-    assert!(
-        compact_bodies.len() >= 2,
-        "expected at least two compact attempts (fail then success)"
-    );
-    let n = compact_bodies.len();
-    let len1 = compact_bodies[n - 2]["input"]
-        .as_array()
-        .map(Vec::len)
-        .unwrap_or(0);
-    let len2 = compact_bodies[n - 1]["input"]
-        .as_array()
-        .map(Vec::len)
-        .unwrap_or(0);
-    assert_eq!(
-        len1,
-        len2 + 1,
-        "second compact attempt should trim exactly one item: {len1} -> {len2}"
-    );
-}

codex-rs/core/tests/suite/compact_resume_fork.rs

@@ -10,6 +10,10 @@
 use super::compact::FIRST_REPLY;
 use super::compact::SUMMARIZE_TRIGGER;
 use super::compact::SUMMARY_TEXT;
+use super::compact::ev_assistant_message;
+use super::compact::ev_completed;
+use super::compact::mount_sse_once;
+use super::compact::sse;
 use codex_core::CodexAuth;
 use codex_core::CodexConversation;
 use codex_core::ConversationManager;
@@ -23,10 +27,6 @@ use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use core_test_support::load_default_config_for_test;
-use core_test_support::responses::ev_assistant_message;
-use core_test_support::responses::ev_completed;
-use core_test_support::responses::mount_sse_once;
-use core_test_support::responses::sse;
 use core_test_support::wait_for_event;
 use pretty_assertions::assert_eq;
 use serde_json::Value;
@@ -74,7 +74,7 @@ async fn compact_resume_and_fork_preserve_model_history_view() {
         "compact+resume test expects resumed path {resumed_path:?} to exist",
     );
 
-    let forked = fork_conversation(&manager, &config, resumed_path, 2).await;
+    let forked = fork_conversation(&manager, &config, resumed_path, 4).await;
     user_turn(&forked, "AFTER_FORK").await;
 
     // 3. Capture the requests to the model and validate the history slices.
@@ -100,15 +100,17 @@ async fn compact_resume_and_fork_preserve_model_history_view() {
         "after-resume input should have at least as many items as after-compact",
     );
     assert_eq!(compact_arr.as_slice(), &resume_arr[..compact_arr.len()]);
-
+    eprint!(
+        "len of compact: {}, len of fork: {}",
+        compact_arr.len(),
+        fork_arr.len()
+    );
+    eprintln!("input_after_fork:{}", json!(input_after_fork));
     assert!(
         compact_arr.len() <= fork_arr.len(),
         "after-fork input should have at least as many items as after-compact",
     );
-    assert_eq!(
-        &compact_arr.as_slice()[..compact_arr.len()],
-        &fork_arr[..compact_arr.len()]
-    );
+    assert_eq!(compact_arr.as_slice(), &fork_arr[..compact_arr.len()]);
 
     let prompt = requests[0]["instructions"]
         .as_str()
@@ -533,7 +535,7 @@ async fn compact_resume_after_second_compaction_preserves_history() {
         "second compact test expects resumed path {resumed_path:?} to exist",
     );
 
-    let forked = fork_conversation(&manager, &config, resumed_path, 3).await;
+    let forked = fork_conversation(&manager, &config, resumed_path, 1).await;
     user_turn(&forked, "AFTER_FORK").await;
 
     compact_conversation(&forked).await;
@@ -822,15 +824,14 @@ async fn resume_conversation(
     conversation
 }
 
-#[cfg(test)]
 async fn fork_conversation(
     manager: &ConversationManager,
     config: &Config,
     path: std::path::PathBuf,
-    nth_user_message: usize,
+    back_steps: usize,
 ) -> Arc<CodexConversation> {
     let NewConversation { conversation, .. } = manager
-        .fork_conversation(nth_user_message, config.clone(), path)
+        .fork_conversation(back_steps, config.clone(), path)
         .await
         .expect("fork conversation");
     conversation

codex-rs/core/tests/suite/exec.rs

@@ -1,7 +1,6 @@
 #![cfg(target_os = "macos")]
 
 use std::collections::HashMap;
-use std::string::ToString;
 
 use codex_core::exec::ExecParams;
 use codex_core::exec::ExecToolCallOutput;
@@ -30,7 +29,7 @@ async fn run_test_cmd(tmp: TempDir, cmd: Vec<&str>) -> Result<ExecToolCallOutput
     assert_eq!(sandbox_type, SandboxType::MacosSeatbelt);
 
     let params = ExecParams {
-        command: cmd.iter().map(ToString::to_string).collect(),
+        command: cmd.iter().map(|s| s.to_string()).collect(),
         cwd: tmp.path().to_path_buf(),
         timeout_ms: Some(1000),
         env: HashMap::new(),
@@ -40,7 +39,7 @@ async fn run_test_cmd(tmp: TempDir, cmd: Vec<&str>) -> Result<ExecToolCallOutput
 
     let policy = SandboxPolicy::new_read_only_policy();
 
-    process_exec_tool_call(params, sandbox_type, &policy, tmp.path(), &None, None).await
+    process_exec_tool_call(params, sandbox_type, &policy, &None, None).await
 }
 
 /// Command succeeds with exit code 0 normally

codex-rs/core/tests/suite/exec_stream_events.rs

@@ -49,10 +49,9 @@ async fn test_exec_stdout_stream_events_echo() {
         "printf 'hello-world\n'".to_string(),
     ];
 
-    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
     let params = ExecParams {
         command: cmd,
-        cwd: cwd.clone(),
+        cwd: std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")),
         timeout_ms: Some(5_000),
         env: HashMap::new(),
         with_escalated_permissions: None,
@@ -65,7 +64,6 @@ async fn test_exec_stdout_stream_events_echo() {
         params,
         SandboxType::None,
         &policy,
-        cwd.as_path(),
         &None,
         Some(stdout_stream),
     )
@@ -101,10 +99,9 @@ async fn test_exec_stderr_stream_events_echo() {
         "printf 'oops\n' 1>&2".to_string(),
     ];
 
-    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
     let params = ExecParams {
         command: cmd,
-        cwd: cwd.clone(),
+        cwd: std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")),
         timeout_ms: Some(5_000),
         env: HashMap::new(),
         with_escalated_permissions: None,
@@ -117,7 +114,6 @@ async fn test_exec_stderr_stream_events_echo() {
         params,
         SandboxType::None,
         &policy,
-        cwd.as_path(),
         &None,
         Some(stdout_stream),
     )
@@ -156,10 +152,9 @@ async fn test_aggregated_output_interleaves_in_order() {
         "printf 'O1\\n'; sleep 0.01; printf 'E1\\n' 1>&2; sleep 0.01; printf 'O2\\n'; sleep 0.01; printf 'E2\\n' 1>&2".to_string(),
     ];
 
-    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
     let params = ExecParams {
         command: cmd,
-        cwd: cwd.clone(),
+        cwd: std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")),
         timeout_ms: Some(5_000),
         env: HashMap::new(),
         with_escalated_permissions: None,
@@ -168,16 +163,9 @@ async fn test_aggregated_output_interleaves_in_order() {
 
     let policy = SandboxPolicy::new_read_only_policy();
 
-    let result = process_exec_tool_call(
-        params,
-        SandboxType::None,
-        &policy,
-        cwd.as_path(),
-        &None,
-        None,
-    )
-    .await
-    .expect("process_exec_tool_call");
+    let result = process_exec_tool_call(params, SandboxType::None, &policy, &None, None)
+        .await
+        .expect("process_exec_tool_call");
 
     assert_eq!(result.exit_code, 0);
     assert_eq!(result.stdout.text, "O1\nO2\n");
@@ -194,10 +182,9 @@ async fn test_exec_timeout_returns_partial_output() {
         "printf 'before\\n'; sleep 2; printf 'after\\n'".to_string(),
     ];
 
-    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
     let params = ExecParams {
         command: cmd,
-        cwd: cwd.clone(),
+        cwd: std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")),
         timeout_ms: Some(200),
         env: HashMap::new(),
         with_escalated_permissions: None,
@@ -206,15 +193,7 @@ async fn test_exec_timeout_returns_partial_output() {
 
     let policy = SandboxPolicy::new_read_only_policy();
 
-    let result = process_exec_tool_call(
-        params,
-        SandboxType::None,
-        &policy,
-        cwd.as_path(),
-        &None,
-        None,
-    )
-    .await;
+    let result = process_exec_tool_call(params, SandboxType::None, &policy, &None, None).await;
 
     let Err(CodexErr::Sandbox(SandboxErr::Timeout { output })) = result else {
         panic!("expected timeout error");

codex-rs/core/tests/suite/fork_conversation.rs

@@ -5,8 +5,6 @@ use codex_core::ModelProviderInfo;
 use codex_core::NewConversation;
 use codex_core::ResponseItem;
 use codex_core::built_in_model_providers;
-use codex_core::content_items_to_text;
-use codex_core::is_session_prefix_message;
 use codex_core::protocol::ConversationPathResponseEvent;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
@@ -114,8 +112,6 @@ async fn fork_conversation_twice_drops_to_first_message() {
         for (i, it) in items.iter().enumerate() {
             if let RolloutItem::ResponseItem(ResponseItem::Message { role, content, .. }) = it
                 && role == "user"
-                && content_items_to_text(content)
-                    .is_some_and(|text| !is_session_prefix_message(&text))
             {
                 // Consider any user message as an input boundary; recorder stores both EventMsg and ResponseItem.
                 // We specifically look for input items, which are represented as ContentItem::InputText.

codex-rs/core/tests/suite/prompt_caching.rs

@@ -12,7 +12,6 @@ use codex_core::protocol::Op;
 use codex_core::protocol::SandboxPolicy;
 use codex_core::protocol_config_types::ReasoningEffort;
 use codex_core::protocol_config_types::ReasoningSummary;
-use codex_core::shell::Shell;
 use codex_core::shell::default_user_shell;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id;
@@ -24,30 +23,6 @@ use wiremock::ResponseTemplate;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 
-fn text_user_input(text: String) -> serde_json::Value {
-    serde_json::json!({
-        "type": "message",
-        "role": "user",
-        "content": [ { "type": "input_text", "text": text } ]
-    })
-}
-
-fn default_env_context_str(cwd: &str, shell: &Shell) -> String {
-    format!(
-        r#"<environment_context>
-  <cwd>{}</cwd>
-  <approval_policy>on-request</approval_policy>
-  <sandbox_mode>read-only</sandbox_mode>
-  <network_access>restricted</network_access>
-{}</environment_context>"#,
-        cwd,
-        match shell.name() {
-            Some(name) => format!("  <shell>{name}</shell>\n"),
-            None => String::new(),
-        }
-    )
-}
-
 /// Build minimal SSE stream with completed marker using the JSON fixture.
 fn sse_completed(id: &str) -> String {
     load_sse_fixture_with_id("tests/fixtures/completed_template.json", id)
@@ -571,262 +546,12 @@ async fn per_turn_overrides_keep_cached_prefix_and_key_constant() {
         "role": "user",
         "content": [ { "type": "input_text", "text": "hello 2" } ]
     });
-    let expected_env_text_2 = format!(
-        r#"<environment_context>
-  <cwd>{}</cwd>
-  <approval_policy>never</approval_policy>
-  <sandbox_mode>workspace-write</sandbox_mode>
-  <network_access>enabled</network_access>
-  <writable_roots>
-    <root>{}</root>
-  </writable_roots>
-</environment_context>"#,
-        new_cwd.path().to_string_lossy(),
-        writable.path().to_string_lossy(),
-    );
-    let expected_env_msg_2 = serde_json::json!({
-        "type": "message",
-        "role": "user",
-        "content": [ { "type": "input_text", "text": expected_env_text_2 } ]
-    });
     let expected_body2 = serde_json::json!(
         [
             body1["input"].as_array().unwrap().as_slice(),
-            [expected_env_msg_2, expected_user_message_2].as_slice(),
+            [expected_user_message_2].as_slice(),
         ]
         .concat()
     );
     assert_eq!(body2["input"], expected_body2);
 }
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn send_user_turn_with_no_changes_does_not_send_environment_context() {
-    use pretty_assertions::assert_eq;
-
-    let server = MockServer::start().await;
-
-    let sse = sse_completed("resp");
-    let template = ResponseTemplate::new(200)
-        .insert_header("content-type", "text/event-stream")
-        .set_body_raw(sse, "text/event-stream");
-
-    Mock::given(method("POST"))
-        .and(path("/v1/responses"))
-        .respond_with(template)
-        .expect(2)
-        .mount(&server)
-        .await;
-
-    let model_provider = ModelProviderInfo {
-        base_url: Some(format!("{}/v1", server.uri())),
-        ..built_in_model_providers()["openai"].clone()
-    };
-
-    let cwd = TempDir::new().unwrap();
-    let codex_home = TempDir::new().unwrap();
-    let mut config = load_default_config_for_test(&codex_home);
-    config.cwd = cwd.path().to_path_buf();
-    config.model_provider = model_provider;
-    config.user_instructions = Some("be consistent and helpful".to_string());
-
-    let default_cwd = config.cwd.clone();
-    let default_approval_policy = config.approval_policy;
-    let default_sandbox_policy = config.sandbox_policy.clone();
-    let default_model = config.model.clone();
-    let default_effort = config.model_reasoning_effort;
-    let default_summary = config.model_reasoning_summary;
-
-    let conversation_manager =
-        ConversationManager::with_auth(CodexAuth::from_api_key("Test API Key"));
-    let codex = conversation_manager
-        .new_conversation(config)
-        .await
-        .expect("create new conversation")
-        .conversation;
-
-    codex
-        .submit(Op::UserTurn {
-            items: vec![InputItem::Text {
-                text: "hello 1".into(),
-            }],
-            cwd: default_cwd.clone(),
-            approval_policy: default_approval_policy,
-            sandbox_policy: default_sandbox_policy.clone(),
-            model: default_model.clone(),
-            effort: default_effort,
-            summary: default_summary,
-        })
-        .await
-        .unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    codex
-        .submit(Op::UserTurn {
-            items: vec![InputItem::Text {
-                text: "hello 2".into(),
-            }],
-            cwd: default_cwd.clone(),
-            approval_policy: default_approval_policy,
-            sandbox_policy: default_sandbox_policy.clone(),
-            model: default_model.clone(),
-            effort: default_effort,
-            summary: default_summary,
-        })
-        .await
-        .unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    let requests = server.received_requests().await.unwrap();
-    assert_eq!(requests.len(), 2, "expected two POST requests");
-
-    let body1 = requests[0].body_json::<serde_json::Value>().unwrap();
-    let body2 = requests[1].body_json::<serde_json::Value>().unwrap();
-
-    let shell = default_user_shell().await;
-    let expected_ui_text =
-        "<user_instructions>\n\nbe consistent and helpful\n\n</user_instructions>";
-    let expected_ui_msg = text_user_input(expected_ui_text.to_string());
-
-    let expected_env_msg_1 = text_user_input(default_env_context_str(
-        &cwd.path().to_string_lossy(),
-        &shell,
-    ));
-    let expected_user_message_1 = text_user_input("hello 1".to_string());
-
-    let expected_input_1 = serde_json::Value::Array(vec![
-        expected_ui_msg.clone(),
-        expected_env_msg_1.clone(),
-        expected_user_message_1.clone(),
-    ]);
-    assert_eq!(body1["input"], expected_input_1);
-
-    let expected_user_message_2 = text_user_input("hello 2".to_string());
-    let expected_input_2 = serde_json::Value::Array(vec![
-        expected_ui_msg,
-        expected_env_msg_1,
-        expected_user_message_1,
-        expected_user_message_2,
-    ]);
-    assert_eq!(body2["input"], expected_input_2);
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn send_user_turn_with_changes_sends_environment_context() {
-    use pretty_assertions::assert_eq;
-
-    let server = MockServer::start().await;
-
-    let sse = sse_completed("resp");
-    let template = ResponseTemplate::new(200)
-        .insert_header("content-type", "text/event-stream")
-        .set_body_raw(sse, "text/event-stream");
-
-    Mock::given(method("POST"))
-        .and(path("/v1/responses"))
-        .respond_with(template)
-        .expect(2)
-        .mount(&server)
-        .await;
-
-    let model_provider = ModelProviderInfo {
-        base_url: Some(format!("{}/v1", server.uri())),
-        ..built_in_model_providers()["openai"].clone()
-    };
-
-    let cwd = TempDir::new().unwrap();
-    let codex_home = TempDir::new().unwrap();
-    let mut config = load_default_config_for_test(&codex_home);
-    config.cwd = cwd.path().to_path_buf();
-    config.model_provider = model_provider;
-    config.user_instructions = Some("be consistent and helpful".to_string());
-
-    let default_cwd = config.cwd.clone();
-    let default_approval_policy = config.approval_policy;
-    let default_sandbox_policy = config.sandbox_policy.clone();
-    let default_model = config.model.clone();
-    let default_effort = config.model_reasoning_effort;
-    let default_summary = config.model_reasoning_summary;
-
-    let conversation_manager =
-        ConversationManager::with_auth(CodexAuth::from_api_key("Test API Key"));
-    let codex = conversation_manager
-        .new_conversation(config.clone())
-        .await
-        .expect("create new conversation")
-        .conversation;
-
-    codex
-        .submit(Op::UserTurn {
-            items: vec![InputItem::Text {
-                text: "hello 1".into(),
-            }],
-            cwd: default_cwd.clone(),
-            approval_policy: default_approval_policy,
-            sandbox_policy: default_sandbox_policy.clone(),
-            model: default_model,
-            effort: default_effort,
-            summary: default_summary,
-        })
-        .await
-        .unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    codex
-        .submit(Op::UserTurn {
-            items: vec![InputItem::Text {
-                text: "hello 2".into(),
-            }],
-            cwd: default_cwd.clone(),
-            approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            model: "o3".to_string(),
-            effort: Some(ReasoningEffort::High),
-            summary: ReasoningSummary::Detailed,
-        })
-        .await
-        .unwrap();
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    let requests = server.received_requests().await.unwrap();
-    assert_eq!(requests.len(), 2, "expected two POST requests");
-
-    let body1 = requests[0].body_json::<serde_json::Value>().unwrap();
-    let body2 = requests[1].body_json::<serde_json::Value>().unwrap();
-
-    let shell = default_user_shell().await;
-    let expected_ui_text =
-        "<user_instructions>\n\nbe consistent and helpful\n\n</user_instructions>";
-    let expected_ui_msg = serde_json::json!({
-        "type": "message",
-        "role": "user",
-        "content": [ { "type": "input_text", "text": expected_ui_text } ]
-    });
-    let expected_env_text_1 = default_env_context_str(&default_cwd.to_string_lossy(), &shell);
-    let expected_env_msg_1 = text_user_input(expected_env_text_1);
-    let expected_user_message_1 = text_user_input("hello 1".to_string());
-    let expected_input_1 = serde_json::Value::Array(vec![
-        expected_ui_msg.clone(),
-        expected_env_msg_1.clone(),
-        expected_user_message_1.clone(),
-    ]);
-    assert_eq!(body1["input"], expected_input_1);
-
-    let expected_env_msg_2 = text_user_input(format!(
-        r#"<environment_context>
-  <cwd>{}</cwd>
-  <approval_policy>never</approval_policy>
-  <sandbox_mode>danger-full-access</sandbox_mode>
-  <network_access>enabled</network_access>
-</environment_context>"#,
-        default_cwd.to_string_lossy()
-    ));
-    let expected_user_message_2 = text_user_input("hello 2".to_string());
-    let expected_input_2 = serde_json::Value::Array(vec![
-        expected_ui_msg,
-        expected_env_msg_1,
-        expected_user_message_1,
-        expected_env_msg_2,
-        expected_user_message_2,
-    ]);
-    assert_eq!(body2["input"], expected_input_2);
-}

codex-rs/core/tests/suite/review.rs

@@ -1,14 +1,9 @@
 use codex_core::CodexAuth;
 use codex_core::CodexConversation;
-use codex_core::ContentItem;
 use codex_core::ConversationManager;
 use codex_core::ModelProviderInfo;
-use codex_core::REVIEW_PROMPT;
-use codex_core::ResponseItem;
 use codex_core::built_in_model_providers;
 use codex_core::config::Config;
-use codex_core::protocol::ConversationPathResponseEvent;
-use codex_core::protocol::ENVIRONMENT_CONTEXT_OPEN_TAG;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::ExitedReviewModeEvent;
 use codex_core::protocol::InputItem;
@@ -18,11 +13,9 @@ use codex_core::protocol::ReviewFinding;
 use codex_core::protocol::ReviewLineRange;
 use codex_core::protocol::ReviewOutputEvent;
 use codex_core::protocol::ReviewRequest;
-use codex_core::protocol::RolloutItem;
-use codex_core::protocol::RolloutLine;
+use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id_from_str;
-use core_test_support::non_sandbox_test;
 use core_test_support::wait_for_event;
 use pretty_assertions::assert_eq;
 use std::path::PathBuf;
@@ -42,7 +35,12 @@ use wiremock::matchers::path;
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn review_op_emits_lifecycle_and_review_output() {
     // Skip under Codex sandbox network restrictions.
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Start mock Responses API server. Return a single assistant message whose
     // text is a JSON-encoded ReviewOutputEvent.
@@ -117,46 +115,6 @@ async fn review_op_emits_lifecycle_and_review_output() {
     assert_eq!(expected, review);
     let _complete = wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
 
-    // Also verify that a user message with the header and a formatted finding
-    // was recorded back in the parent session's rollout.
-    codex.submit(Op::GetPath).await.unwrap();
-    let history_event =
-        wait_for_event(&codex, |ev| matches!(ev, EventMsg::ConversationPath(_))).await;
-    let path = match history_event {
-        EventMsg::ConversationPath(ConversationPathResponseEvent { path, .. }) => path,
-        other => panic!("expected ConversationPath event, got {other:?}"),
-    };
-    let text = std::fs::read_to_string(&path).expect("read rollout file");
-
-    let mut saw_header = false;
-    let mut saw_finding_line = false;
-    for line in text.lines() {
-        if line.trim().is_empty() {
-            continue;
-        }
-        let v: serde_json::Value = serde_json::from_str(line).expect("jsonl line");
-        let rl: RolloutLine = serde_json::from_value(v).expect("rollout line");
-        if let RolloutItem::ResponseItem(ResponseItem::Message { role, content, .. }) = rl.item
-            && role == "user"
-        {
-            for c in content {
-                if let ContentItem::InputText { text } = c {
-                    if text.contains("full review output from reviewer model") {
-                        saw_header = true;
-                    }
-                    if text.contains("- Prefer Stylize helpers — /tmp/file.rs:10-20") {
-                        saw_finding_line = true;
-                    }
-                }
-            }
-        }
-    }
-    assert!(saw_header, "user header missing from rollout");
-    assert!(
-        saw_finding_line,
-        "formatted finding line missing from rollout"
-    );
-
     server.verify().await;
 }
 
@@ -167,7 +125,12 @@ async fn review_op_emits_lifecycle_and_review_output() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn review_op_with_plain_text_emits_review_fallback() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let sse_raw = r#"[
         {"type":"response.output_item.done", "item":{
@@ -216,7 +179,12 @@ async fn review_op_with_plain_text_emits_review_fallback() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn review_does_not_emit_agent_message_on_structured_output() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let review_json = serde_json::json!({
         "findings": [
@@ -288,7 +256,12 @@ async fn review_does_not_emit_agent_message_on_structured_output() {
 /// request uses that model (and not the main chat model).
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn review_uses_custom_review_model_from_config() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Minimal stream: just a completed event
     let sse_raw = r#"[
@@ -341,7 +314,12 @@ async fn review_uses_custom_review_model_from_config() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn review_input_isolated_from_parent_history() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Mock server for the single review request
     let sse_raw = r#"[
@@ -441,73 +419,17 @@ async fn review_input_isolated_from_parent_history() {
     .await;
     let _complete = wait_for_event(&codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
 
-    // Assert the request `input` contains the environment context followed by the review prompt.
+    // Assert the request `input` contains only the single review user message.
     let request = &server.received_requests().await.unwrap()[0];
     let body = request.body_json::<serde_json::Value>().unwrap();
-    let input = body["input"].as_array().expect("input array");
-    assert_eq!(
-        input.len(),
-        2,
-        "expected environment context and review prompt"
-    );
-
-    let env_msg = &input[0];
-    assert_eq!(env_msg["type"].as_str().unwrap(), "message");
-    assert_eq!(env_msg["role"].as_str().unwrap(), "user");
-    let env_text = env_msg["content"][0]["text"].as_str().expect("env text");
-    assert!(
-        env_text.starts_with(ENVIRONMENT_CONTEXT_OPEN_TAG),
-        "environment context must be the first item"
-    );
-    assert!(
-        env_text.contains("<cwd>"),
-        "environment context should include cwd"
-    );
-
-    let review_msg = &input[1];
-    assert_eq!(review_msg["type"].as_str().unwrap(), "message");
-    assert_eq!(review_msg["role"].as_str().unwrap(), "user");
-    assert_eq!(
-        review_msg["content"][0]["text"].as_str().unwrap(),
-        format!("{REVIEW_PROMPT}\n\n---\n\nNow, here's your task: Please review only this",)
-    );
-
-    // Also verify that a user interruption note was recorded in the rollout.
-    codex.submit(Op::GetPath).await.unwrap();
-    let history_event =
-        wait_for_event(&codex, |ev| matches!(ev, EventMsg::ConversationPath(_))).await;
-    let path = match history_event {
-        EventMsg::ConversationPath(ConversationPathResponseEvent { path, .. }) => path,
-        other => panic!("expected ConversationPath event, got {other:?}"),
-    };
-    let text = std::fs::read_to_string(&path).expect("read rollout file");
-    let mut saw_interruption_message = false;
-    for line in text.lines() {
-        if line.trim().is_empty() {
-            continue;
-        }
-        let v: serde_json::Value = serde_json::from_str(line).expect("jsonl line");
-        let rl: RolloutLine = serde_json::from_value(v).expect("rollout line");
-        if let RolloutItem::ResponseItem(ResponseItem::Message { role, content, .. }) = rl.item
-            && role == "user"
+    let expected_input = serde_json::json!([
         {
-            for c in content {
-                if let ContentItem::InputText { text } = c
-                    && text.contains("User initiated a review task, but was interrupted.")
-                {
-                    saw_interruption_message = true;
-                    break;
-                }
-            }
+            "type": "message",
+            "role": "user",
+            "content": [{"type": "input_text", "text": review_prompt}]
         }
-        if saw_interruption_message {
-            break;
-        }
-    }
-    assert!(
-        saw_interruption_message,
-        "expected user interruption message in rollout"
-    );
+    ]);
+    assert_eq!(body["input"], expected_input);
 
     server.verify().await;
 }
@@ -517,7 +439,12 @@ async fn review_input_isolated_from_parent_history() {
 /// messages in its request `input`.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn review_history_does_not_leak_into_parent_session() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     // Respond to both the review request and the subsequent parent request.
     let sse_raw = r#"[

codex-rs/core/tests/suite/seatbelt.rs

@@ -171,8 +171,6 @@ async fn python_getpwuid_works_under_seatbelt() {
 
     // ReadOnly is sufficient here since we are only exercising user lookup.
     let policy = SandboxPolicy::ReadOnly;
-    let command_cwd = std::env::current_dir().expect("getcwd");
-    let sandbox_cwd = command_cwd.clone();
 
     let mut child = spawn_command_under_seatbelt(
         vec![
@@ -181,9 +179,8 @@ async fn python_getpwuid_works_under_seatbelt() {
             // Print the passwd struct; success implies lookup worked.
             "import pwd, os; print(pwd.getpwuid(os.getuid()))".to_string(),
         ],
-        command_cwd,
         &policy,
-        sandbox_cwd.as_path(),
+        std::env::current_dir().expect("should be able to get current dir"),
         StdioPolicy::RedirectForShellTool,
         HashMap::new(),
     )
@@ -219,16 +216,13 @@ fn create_test_scenario(tmp: &TempDir) -> TestScenario {
 /// Note that `path` must be absolute.
 async fn touch(path: &Path, policy: &SandboxPolicy) -> bool {
     assert!(path.is_absolute(), "Path must be absolute: {path:?}");
-    let command_cwd = std::env::current_dir().expect("getcwd");
-    let sandbox_cwd = command_cwd.clone();
     let mut child = spawn_command_under_seatbelt(
         vec![
             "/usr/bin/touch".to_string(),
             path.to_string_lossy().to_string(),
         ],
-        command_cwd,
         policy,
-        sandbox_cwd.as_path(),
+        std::env::current_dir().expect("should be able to get current dir"),
         StdioPolicy::RedirectForShellTool,
         HashMap::new(),
     )

codex-rs/core/tests/suite/stream_error_allows_next_turn.rs

@@ -7,9 +7,9 @@ use codex_core::WireApi;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
+use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id;
-use core_test_support::non_sandbox_test;
 use core_test_support::wait_for_event_with_timeout;
 use tempfile::TempDir;
 use wiremock::Mock;
@@ -25,7 +25,12 @@ fn sse_completed(id: &str) -> String {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn continue_after_stream_error() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = MockServer::start().await;
 

codex-rs/core/tests/suite/stream_no_completed.rs

@@ -9,10 +9,10 @@ use codex_core::ModelProviderInfo;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
+use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture;
 use core_test_support::load_sse_fixture_with_id;
-use core_test_support::non_sandbox_test;
 use tempfile::TempDir;
 use tokio::time::timeout;
 use wiremock::Mock;
@@ -33,7 +33,12 @@ fn sse_completed(id: &str) -> String {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retries_on_early_close() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let server = MockServer::start().await;
 

codex-rs/docs/codex_mcp_interface.md

@@ -1,123 +0,0 @@
-# Codex MCP Interface [experimental]
-
-This document describes Codex’s experimental MCP interface: a JSON‑RPC API that runs over the Model Context Protocol (MCP) transport to control a local Codex engine.
-
-- Status: experimental and subject to change without notice
-- Server binary: `codex mcp` (or `codex-mcp-server`)
-- Transport: standard MCP over stdio (JSON‑RPC 2.0, line‑delimited)
-
-## Overview
-
-Codex exposes a small set of MCP‑compatible methods to create and manage conversations, send user input, receive live events, and handle approval prompts. The types are defined in `protocol/src/mcp_protocol.rs` and re‑used by the MCP server implementation in `mcp-server/`.
-
-At a glance:
-
-- Conversations
-  - `newConversation` → start a Codex session
-  - `sendUserMessage` / `sendUserTurn` → send user input into a conversation
-  - `interruptConversation` → stop the current turn
-  - `listConversations`, `resumeConversation`, `archiveConversation`
-- Configuration and info
-  - `getUserSavedConfig`, `setDefaultModel`, `getUserAgent`, `userInfo`
-- Auth
-  - `loginApiKey`, `loginChatGpt`, `cancelLoginChatGpt`, `logoutChatGpt`, `getAuthStatus`
-- Utilities
-  - `gitDiffToRemote`, `execOneOffCommand`
-- Approvals (server → client requests)
-  - `applyPatchApproval`, `execCommandApproval`
-- Notifications (server → client)
-  - `loginChatGptComplete`, `authStatusChange`
-  - `codex/event` stream with agent events
-
-See code for full type definitions and exact shapes: `protocol/src/mcp_protocol.rs`.
-
-## Starting the server
-
-Run Codex as an MCP server and connect an MCP client:
-
-```bash
-codex mcp | your_mcp_client
-```
-
-For a simple inspection UI, you can also try:
-
-```bash
-npx @modelcontextprotocol/inspector codex mcp
-```
-
-## Conversations
-
-Start a new session with optional overrides:
-
-Request `newConversation` params (subset):
-
-- `model`: string model id (e.g. "o3", "gpt-5")
-- `profile`: optional named profile
-- `cwd`: optional working directory
-- `approvalPolicy`: `untrusted` | `on-request` | `on-failure` | `never`
-- `sandbox`: `read-only` | `workspace-write` | `danger-full-access`
-- `config`: map of additional config overrides
-- `baseInstructions`: optional instruction override
-- `includePlanTool` / `includeApplyPatchTool`: booleans
-
-Response: `{ conversationId, model, reasoningEffort?, rolloutPath }`
-
-Send input to the active turn:
-
-- `sendUserMessage` → enqueue items to the conversation
-- `sendUserTurn` → structured turn with explicit `cwd`, `approvalPolicy`, `sandboxPolicy`, `model`, optional `effort`, and `summary`
-
-Interrupt a running turn: `interruptConversation`.
-
-List/resume/archive: `listConversations`, `resumeConversation`, `archiveConversation`.
-
-## Event stream
-
-While a conversation runs, the server sends notifications:
-
-- `codex/event` with the serialized Codex event payload. The shape matches `core/src/protocol.rs`’s `Event` and `EventMsg` types. Some notifications include a `_meta.requestId` to correlate with the originating request.
-- Auth notifications via method names `loginChatGptComplete` and `authStatusChange`.
-
-Clients should render events and, when present, surface approval requests (see next section).
-
-## Approvals (server → client)
-
-When Codex needs approval to apply changes or run commands, the server issues JSON‑RPC requests to the client:
-
-- `applyPatchApproval { conversationId, callId, fileChanges, reason?, grantRoot? }`
-- `execCommandApproval { conversationId, callId, command, cwd, reason? }`
-
-The client must reply with `{ decision: "allow" | "deny" }` for each request.
-
-## Auth helpers
-
-For ChatGPT or API‑key based auth flows, the server exposes helpers:
-
-- `loginApiKey { apiKey }`
-- `loginChatGpt` → returns `{ loginId, authUrl }`; browser completes flow; then `loginChatGptComplete` notification follows
-- `cancelLoginChatGpt { loginId }`, `logoutChatGpt`, `getAuthStatus { includeToken?, refreshToken? }`
-
-## Example: start and send a message
-
-```json
-{ "jsonrpc": "2.0", "id": 1, "method": "newConversation", "params": { "model": "gpt-5", "approvalPolicy": "on-request" } }
-```
-
-Server responds:
-
-```json
-{ "jsonrpc": "2.0", "id": 1, "result": { "conversationId": "c7b0…", "model": "gpt-5", "rolloutPath": "/path/to/rollout.jsonl" } }
-```
-
-Then send input:
-
-```json
-{ "jsonrpc": "2.0", "id": 2, "method": "sendUserMessage", "params": { "conversationId": "c7b0…", "items": [{ "type": "text", "text": "Hello Codex" }] } }
-```
-
-While processing, the server emits `codex/event` notifications containing agent output, approvals, and status updates.
-
-## Compatibility and stability
-
-This interface is experimental. Method names, fields, and event shapes may evolve. For the authoritative schema, consult `protocol/src/mcp_protocol.rs` and the corresponding server wiring in `mcp-server/`.
-

codex-rs/exec/Cargo.toml

@@ -15,37 +15,37 @@ path = "src/lib.rs"
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-chrono = { workspace = true }
-clap = { workspace = true, features = ["derive"] }
-codex-arg0 = { workspace = true }
-codex-common = { workspace = true, features = [
+anyhow = "1"
+chrono = "0.4.40"
+clap = { version = "4", features = ["derive"] }
+codex-arg0 = { path = "../arg0" }
+codex-common = { path = "../common", features = [
     "cli",
     "elapsed",
     "sandbox_summary",
 ] }
-codex-core = { workspace = true }
-codex-ollama = { workspace = true }
-codex-protocol = { workspace = true }
-owo-colors = { workspace = true }
-serde_json = { workspace = true }
-shlex = { workspace = true }
-tokio = { workspace = true, features = [
+codex-core = { path = "../core" }
+codex-ollama = { path = "../ollama" }
+codex-protocol = { path = "../protocol" }
+owo-colors = "4.2.0"
+serde_json = "1"
+shlex = "1.3.0"
+tokio = { version = "1", features = [
     "io-std",
     "macros",
     "process",
     "rt-multi-thread",
     "signal",
 ] }
-tracing = { workspace = true, features = ["log"] }
-tracing-subscriber = { workspace = true, features = ["env-filter"] }
+tracing = { version = "0.1.41", features = ["log"] }
+tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
 
 [dev-dependencies]
-assert_cmd = { workspace = true }
-core_test_support = { workspace = true }
-libc = { workspace = true }
-predicates = { workspace = true }
-tempfile = { workspace = true }
-uuid = { workspace = true }
-walkdir = { workspace = true }
-wiremock = { workspace = true }
+assert_cmd = "2"
+core_test_support = { path = "../core/tests/common" }
+libc = "0.2"
+predicates = "3"
+tempfile = "3.13.0"
+uuid = "1"
+walkdir = "2"
+wiremock = "0.6"

codex-rs/exec/src/cli.rs

@@ -52,6 +52,10 @@ pub struct Cli {
     #[arg(long = "skip-git-repo-check", default_value_t = false)]
     pub skip_git_repo_check: bool,
 
+    /// Force-enable the experimental apply_patch tool even for models that do not opt into it by default.
+    #[arg(long = "custom-apply-patch", default_value_t = false)]
+    pub custom_apply_patch: bool,
+
     #[clap(skip)]
     pub config_overrides: CliConfigOverrides,
 

codex-rs/exec/src/event_processor_with_human_output.rs

@@ -558,11 +558,7 @@ impl EventProcessor for EventProcessorWithHumanOutput {
                 TurnAbortReason::Replaced => {
                     ts_println!(self, "task aborted: replaced by a new task");
                 }
-                TurnAbortReason::ReviewEnded => {
-                    ts_println!(self, "task aborted: review ended");
-                }
             },
-            EventMsg::CompactApprovalRequest(_) => {}
             EventMsg::ShutdownComplete => return CodexStatus::Shutdown,
             EventMsg::ConversationPath(_) => {}
             EventMsg::UserMessage(_) => {}
@@ -574,7 +570,7 @@ impl EventProcessor for EventProcessorWithHumanOutput {
 }
 
 fn escape_command(command: &[String]) -> String {
-    try_join(command.iter().map(String::as_str)).unwrap_or_else(|_| command.join(" "))
+    try_join(command.iter().map(|s| s.as_str())).unwrap_or_else(|_| command.join(" "))
 }
 
 fn format_file_change(change: &FileChange) -> &'static str {

codex-rs/exec/src/lib.rs

@@ -46,6 +46,7 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
         dangerously_bypass_approvals_and_sandbox,
         cwd,
         skip_git_repo_check,
+        custom_apply_patch,
         color,
         last_message_file,
         json: json_mode,
@@ -158,7 +159,7 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
         codex_linux_sandbox_exe,
         base_instructions: None,
         include_plan_tool: None,
-        include_apply_patch_tool: None,
+        include_apply_patch_tool: custom_apply_patch.then_some(true),
         include_view_image_tool: None,
         show_raw_agent_reasoning: oss.then_some(true),
         tools_web_search_request: None,

codex-rs/exec/tests/fixtures/sse_apply_patch_add.json

@@ -0,0 +1,25 @@
+[
+  {
+    "type": "response.output_item.done",
+    "item": {
+      "type": "custom_tool_call",
+      "name": "apply_patch",
+      "input": "*** Begin Patch\n*** Add File: test.md\n+Hello world\n*** End Patch",
+      "call_id": "__ID__"
+    }
+  },
+  {
+    "type": "response.completed",
+    "response": {
+      "id": "__ID__",
+      "usage": {
+        "input_tokens": 0,
+        "input_tokens_details": null,
+        "output_tokens": 0,
+        "output_tokens_details": null,
+        "total_tokens": 0
+      },
+      "output": []
+    }
+  }
+]

codex-rs/exec/tests/fixtures/sse_apply_patch_freeform_add.json

@@ -0,0 +1,25 @@
+[
+  {
+    "type": "response.output_item.done",
+    "item": {
+      "type": "custom_tool_call",
+      "name": "apply_patch",
+      "input": "*** Begin Patch\n*** Add File: app.py\n+class BaseClass:\n+  def method():\n+    return False\n*** End Patch",
+      "call_id": "__ID__"
+    }
+  },
+  {
+    "type": "response.completed",
+    "response": {
+      "id": "__ID__",
+      "usage": {
+        "input_tokens": 0,
+        "input_tokens_details": null,
+        "output_tokens": 0,
+        "output_tokens_details": null,
+        "total_tokens": 0
+      },
+      "output": []
+    }
+  }
+]

codex-rs/exec/tests/fixtures/sse_apply_patch_freeform_update.json

@@ -0,0 +1,25 @@
+[
+  {
+    "type": "response.output_item.done",
+    "item": {
+      "type": "custom_tool_call",
+      "name": "apply_patch",
+      "input": "*** Begin Patch\n*** Update File: app.py\n@@  def method():\n-    return False\n+\n+    return True\n*** End Patch",
+      "call_id": "__ID__"
+    }
+  },
+  {
+    "type": "response.completed",
+    "response": {
+      "id": "__ID__",
+      "usage": {
+        "input_tokens": 0,
+        "input_tokens_details": null,
+        "output_tokens": 0,
+        "output_tokens_details": null,
+        "total_tokens": 0
+      },
+      "output": []
+    }
+  }
+]

codex-rs/exec/tests/fixtures/sse_apply_patch_update.json

@@ -0,0 +1,25 @@
+[
+  {
+    "type": "response.output_item.done",
+    "item": {
+      "type": "function_call",
+      "name": "apply_patch",
+      "arguments": "{\n  \"input\": \"*** Begin Patch\\n*** Update File: test.md\\n@@\\n-Hello world\\n+Final text\\n*** End Patch\"\n}",
+      "call_id": "__ID__"
+    }
+  },
+  {
+    "type": "response.completed",
+    "response": {
+      "id": "__ID__",
+      "usage": {
+        "input_tokens": 0,
+        "input_tokens_details": null,
+        "output_tokens": 0,
+        "output_tokens_details": null,
+        "total_tokens": 0
+      },
+      "output": []
+    }
+  }
+]

codex-rs/exec/tests/fixtures/sse_response_completed.json

@@ -0,0 +1,16 @@
+[
+  {
+    "type": "response.completed",
+    "response": {
+      "id": "__ID__",
+      "usage": {
+        "input_tokens": 0,
+        "input_tokens_details": null,
+        "output_tokens": 0,
+        "output_tokens_details": null,
+        "total_tokens": 0
+      },
+      "output": []
+    }
+  }
+]

codex-rs/exec/tests/suite/apply_patch.rs

@@ -1,12 +1,8 @@
-#![allow(clippy::expect_used, clippy::unwrap_used, unused_imports)]
+#![allow(clippy::expect_used, clippy::unwrap_used)]
 
 use anyhow::Context;
 use assert_cmd::prelude::*;
 use codex_core::CODEX_APPLY_PATCH_ARG1;
-use core_test_support::responses::ev_apply_patch_custom_tool_call;
-use core_test_support::responses::ev_apply_patch_function_call;
-use core_test_support::responses::ev_completed;
-use core_test_support::responses::sse;
 use std::fs;
 use std::process::Command;
 use tempfile::tempdir;
@@ -48,34 +44,26 @@ fn test_standalone_exec_cli_can_use_apply_patch() -> anyhow::Result<()> {
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn test_apply_patch_tool() -> anyhow::Result<()> {
     use crate::suite::common::run_e2e_exec_test;
-    use core_test_support::non_sandbox_test;
+    use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 
-    non_sandbox_test!(result);
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return Ok(());
+    }
 
     let tmp_cwd = tempdir().expect("failed to create temp dir");
     let tmp_path = tmp_cwd.path().to_path_buf();
-    let add_patch = r#"*** Begin Patch
-*** Add File: test.md
-+Hello world
-*** End Patch"#;
-    let update_patch = r#"*** Begin Patch
-*** Update File: test.md
-@@
--Hello world
-+Final text
-*** End Patch"#;
-    let response_streams = vec![
-        sse(vec![
-            ev_apply_patch_custom_tool_call("request_0", add_patch),
-            ev_completed("request_0"),
-        ]),
-        sse(vec![
-            ev_apply_patch_function_call("request_1", update_patch),
-            ev_completed("request_1"),
-        ]),
-        sse(vec![ev_completed("request_2")]),
-    ];
-    run_e2e_exec_test(tmp_cwd.path(), response_streams).await;
+    run_e2e_exec_test(
+        tmp_cwd.path(),
+        vec![
+            include_str!("../fixtures/sse_apply_patch_add.json").to_string(),
+            include_str!("../fixtures/sse_apply_patch_update.json").to_string(),
+            include_str!("../fixtures/sse_response_completed.json").to_string(),
+        ],
+    )
+    .await;
 
     let final_path = tmp_path.join("test.md");
     let contents = std::fs::read_to_string(&final_path)
@@ -88,36 +76,25 @@ async fn test_apply_patch_tool() -> anyhow::Result<()> {
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn test_apply_patch_freeform_tool() -> anyhow::Result<()> {
     use crate::suite::common::run_e2e_exec_test;
-    use core_test_support::non_sandbox_test;
+    use codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 
-    non_sandbox_test!(result);
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return Ok(());
+    }
 
     let tmp_cwd = tempdir().expect("failed to create temp dir");
-    let freeform_add_patch = r#"*** Begin Patch
-*** Add File: app.py
-+class BaseClass:
-+  def method():
-+    return False
-*** End Patch"#;
-    let freeform_update_patch = r#"*** Begin Patch
-*** Update File: app.py
-@@  def method():
--    return False
-+
-+    return True
-*** End Patch"#;
-    let response_streams = vec![
-        sse(vec![
-            ev_apply_patch_custom_tool_call("request_0", freeform_add_patch),
-            ev_completed("request_0"),
-        ]),
-        sse(vec![
-            ev_apply_patch_custom_tool_call("request_1", freeform_update_patch),
-            ev_completed("request_1"),
-        ]),
-        sse(vec![ev_completed("request_2")]),
-    ];
-    run_e2e_exec_test(tmp_cwd.path(), response_streams).await;
+    run_e2e_exec_test(
+        tmp_cwd.path(),
+        vec![
+            include_str!("../fixtures/sse_apply_patch_freeform_add.json").to_string(),
+            include_str!("../fixtures/sse_apply_patch_freeform_update.json").to_string(),
+            include_str!("../fixtures/sse_response_completed.json").to_string(),
+        ],
+    )
+    .await;
 
     // Verify final file contents
     let final_path = tmp_cwd.path().join("app.py");

codex-rs/exec/tests/suite/common.rs

@@ -4,6 +4,7 @@
 
 use anyhow::Context;
 use assert_cmd::prelude::*;
+use core_test_support::load_sse_fixture_with_id_from_str;
 use std::path::Path;
 use std::process::Command;
 use std::sync::atomic::AtomicUsize;
@@ -26,7 +27,10 @@ impl Respond for SeqResponder {
         match self.responses.get(call_num) {
             Some(body) => wiremock::ResponseTemplate::new(200)
                 .insert_header("content-type", "text/event-stream")
-                .set_body_string(body.clone()),
+                .set_body_raw(
+                    load_sse_fixture_with_id_from_str(body, &format!("request_{call_num}")),
+                    "text/event-stream",
+                ),
             None => panic!("no response for {call_num}"),
         }
     }

codex-rs/exec/tests/suite/resume.rs

@@ -3,7 +3,6 @@ use anyhow::Context;
 use assert_cmd::prelude::*;
 use serde_json::Value;
 use std::process::Command;
-use std::string::ToString;
 use tempfile::TempDir;
 use uuid::Uuid;
 use walkdir::WalkDir;
@@ -46,7 +45,7 @@ fn find_session_file_containing_marker(
                 && payload.get("type").and_then(|t| t.as_str()) == Some("message")
                 && payload
                     .get("content")
-                    .map(ToString::to_string)
+                    .map(|c| c.to_string())
                     .unwrap_or_default()
                     .contains(marker)
             {

codex-rs/exec/tests/suite/sandbox.rs

@@ -4,39 +4,27 @@ use codex_core::spawn::StdioPolicy;
 use std::collections::HashMap;
 use std::future::Future;
 use std::io;
-use std::path::Path;
 use std::path::PathBuf;
 use std::process::ExitStatus;
-use tokio::fs::create_dir_all;
 use tokio::process::Child;
 
 #[cfg(target_os = "macos")]
 async fn spawn_command_under_sandbox(
     command: Vec<String>,
-    command_cwd: PathBuf,
     sandbox_policy: &SandboxPolicy,
-    sandbox_cwd: &Path,
+    cwd: PathBuf,
     stdio_policy: StdioPolicy,
     env: HashMap<String, String>,
 ) -> std::io::Result<Child> {
     use codex_core::seatbelt::spawn_command_under_seatbelt;
-    spawn_command_under_seatbelt(
-        command,
-        command_cwd,
-        sandbox_policy,
-        sandbox_cwd,
-        stdio_policy,
-        env,
-    )
-    .await
+    spawn_command_under_seatbelt(command, sandbox_policy, cwd, stdio_policy, env).await
 }
 
 #[cfg(target_os = "linux")]
 async fn spawn_command_under_sandbox(
     command: Vec<String>,
-    command_cwd: PathBuf,
     sandbox_policy: &SandboxPolicy,
-    sandbox_cwd: &Path,
+    cwd: PathBuf,
     stdio_policy: StdioPolicy,
     env: HashMap<String, String>,
 ) -> std::io::Result<Child> {
@@ -45,9 +33,8 @@ async fn spawn_command_under_sandbox(
     spawn_command_under_linux_sandbox(
         codex_linux_sandbox_exe,
         command,
-        command_cwd,
         sandbox_policy,
-        sandbox_cwd,
+        cwd,
         stdio_policy,
         env,
     )
@@ -87,17 +74,14 @@ if __name__ == '__main__':
     p.join()
 "#;
 
-    let command_cwd = std::env::current_dir().expect("should be able to get current dir");
-    let sandbox_cwd = command_cwd.clone();
     let mut child = spawn_command_under_sandbox(
         vec![
             "python3".to_string(),
             "-c".to_string(),
             python_code.to_string(),
         ],
-        command_cwd,
         &policy,
-        sandbox_cwd.as_path(),
+        std::env::current_dir().expect("should be able to get current dir"),
         StdioPolicy::Inherit,
         HashMap::new(),
     )
@@ -108,88 +92,6 @@ if __name__ == '__main__':
     assert!(status.success(), "python exited with {status:?}");
 }
 
-#[tokio::test]
-async fn sandbox_distinguishes_command_and_policy_cwds() {
-    let temp = tempfile::tempdir().expect("should be able to create temp dir");
-    let sandbox_root = temp.path().join("sandbox");
-    let command_root = temp.path().join("command");
-    create_dir_all(&sandbox_root).await.expect("mkdir");
-    create_dir_all(&command_root).await.expect("mkdir");
-    let canonical_sandbox_root = tokio::fs::canonicalize(&sandbox_root)
-        .await
-        .expect("canonicalize sandbox root");
-    let canonical_allowed_path = canonical_sandbox_root.join("allowed.txt");
-
-    let disallowed_path = command_root.join("forbidden.txt");
-
-    // Note writable_roots is empty: verify that `canonical_allowed_path` is
-    // writable only because it is under the sandbox policy cwd, not because it
-    // is under a writable root.
-    let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
-
-    // Attempt to write inside the command cwd, which is outside of the sandbox policy cwd.
-    let mut child = spawn_command_under_sandbox(
-        vec![
-            "bash".to_string(),
-            "-lc".to_string(),
-            "echo forbidden > forbidden.txt".to_string(),
-        ],
-        command_root.clone(),
-        &policy,
-        canonical_sandbox_root.as_path(),
-        StdioPolicy::Inherit,
-        HashMap::new(),
-    )
-    .await
-    .expect("should spawn command writing to forbidden path");
-
-    let status = child
-        .wait()
-        .await
-        .expect("should wait for forbidden command");
-    assert!(
-        !status.success(),
-        "sandbox unexpectedly allowed writing to command cwd: {status:?}"
-    );
-    let forbidden_exists = tokio::fs::try_exists(&disallowed_path)
-        .await
-        .expect("try_exists failed");
-    assert!(
-        !forbidden_exists,
-        "forbidden path should not have been created"
-    );
-
-    // Writing to the sandbox policy cwd after changing directories into it should succeed.
-    let mut child = spawn_command_under_sandbox(
-        vec![
-            "/usr/bin/touch".to_string(),
-            canonical_allowed_path.to_string_lossy().into_owned(),
-        ],
-        command_root,
-        &policy,
-        canonical_sandbox_root.as_path(),
-        StdioPolicy::Inherit,
-        HashMap::new(),
-    )
-    .await
-    .expect("should spawn command writing to sandbox root");
-
-    let status = child.wait().await.expect("should wait for allowed command");
-    assert!(
-        status.success(),
-        "sandbox blocked allowed write: {status:?}"
-    );
-    let allowed_exists = tokio::fs::try_exists(&canonical_allowed_path)
-        .await
-        .expect("try_exists allowed failed");
-    assert!(allowed_exists, "allowed path should exist");
-}
-
 fn unix_sock_body() {
     unsafe {
         let mut fds = [0i32; 2];
@@ -298,13 +200,10 @@ where
         cmds.push(test_selector.into());
 
         // Your existing launcher:
-        let command_cwd = std::env::current_dir().expect("should be able to get current dir");
-        let sandbox_cwd = command_cwd.clone();
         let mut child = spawn_command_under_sandbox(
             cmds,
-            command_cwd,
             policy,
-            sandbox_cwd.as_path(),
+            std::env::current_dir().expect("should be able to get current dir"),
             stdio_policy,
             HashMap::from([("IN_SANDBOX".into(), "1".into())]),
         )

codex-rs/execpolicy/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
-edition = "2024"
 name = "codex-execpolicy"
 version = { workspace = true }
+edition = "2024"
 
 [[bin]]
 name = "codex-execpolicy"
@@ -15,19 +15,19 @@ path = "src/lib.rs"
 workspace = true
 
 [dependencies]
-allocative = { workspace = true }
-anyhow = { workspace = true }
-clap = { workspace = true, features = ["derive"] }
-derive_more = { workspace = true, features = ["display"] }
-env_logger = { workspace = true }
-log = { workspace = true }
-multimap = { workspace = true }
-path-absolutize = { workspace = true }
-regex-lite = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-serde_with = { workspace = true, features = ["macros"] }
-starlark = { workspace = true }
+anyhow = "1"
+starlark = "0.13.0"
+allocative = "0.3.3"
+clap = { version = "4", features = ["derive"] }
+derive_more = { version = "2", features = ["display"] }
+env_logger = "0.11.5"
+log = "0.4"
+multimap = "0.10.0"
+path-absolutize = "3.1.1"
+regex-lite = "0.1"
+serde = { version = "1.0.194", features = ["derive"] }
+serde_json = "1.0.143"
+serde_with = { version = "3", features = ["macros"] }
 
 [dev-dependencies]
-tempfile = { workspace = true }
+tempfile = "3.13.0"

codex-rs/execpolicy/src/execv_checker.rs

@@ -1,4 +1,3 @@
-use std::borrow::Cow;
 use std::ffi::OsString;
 use std::path::Path;
 use std::path::PathBuf;
@@ -109,7 +108,7 @@ fn ensure_absolute_path(path: &str, cwd: &Option<OsString>) -> Result<PathBuf> {
         file.absolutize()
     };
     result
-        .map(Cow::into_owned)
+        .map(|path| path.into_owned())
         .map_err(|error| CannotCanonicalizePath {
             file: path.to_string(),
             error: error.kind(),

codex-rs/execpolicy/src/main.rs

@@ -10,7 +10,6 @@ use codex_execpolicy::get_default_policy;
 use serde::Deserialize;
 use serde::Serialize;
 use serde::de;
-use starlark::Error as StarlarkError;
 use std::path::PathBuf;
 use std::str::FromStr;
 
@@ -72,13 +71,13 @@ fn main() -> Result<()> {
         }
         None => get_default_policy(),
     };
-    let policy = policy.map_err(StarlarkError::into_anyhow)?;
+    let policy = policy.map_err(|err| err.into_anyhow())?;
 
     let exec = match args.command {
         Command::Check { command } => match command.split_first() {
             Some((first, rest)) => ExecArg {
                 program: first.to_string(),
-                args: rest.to_vec(),
+                args: rest.iter().map(|s| s.to_string()).collect(),
             },
             None => {
                 eprintln!("no command provided");
@@ -162,6 +161,6 @@ impl FromStr for ExecArg {
     type Err = anyhow::Error;
 
     fn from_str(s: &str) -> Result<Self, Self::Err> {
-        serde_json::from_str(s).map_err(Into::into)
+        serde_json::from_str(s).map_err(|e| e.into())
     }
 }

codex-rs/execpolicy/src/program.rs

@@ -169,7 +169,7 @@ impl ProgramSpec {
             let mut options = self
                 .required_options
                 .difference(&matched_opt_names)
-                .map(String::from)
+                .map(|s| s.to_string())
                 .collect::<Vec<_>>();
             options.sort();
             return Err(Error::MissingRequiredOptions {

codex-rs/file-search/Cargo.toml

@@ -12,10 +12,10 @@ name = "codex_file_search"
 path = "src/lib.rs"
 
 [dependencies]
-anyhow = { workspace = true }
-clap = { workspace = true, features = ["derive"] }
-ignore = { workspace = true }
-nucleo-matcher = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-tokio = { workspace = true, features = ["full"] }
+anyhow = "1"
+clap = { version = "4", features = ["derive"] }
+ignore = "0.4.23"
+nucleo-matcher = "0.3.1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1.0.143"
+tokio = { version = "1", features = ["full"] }

codex-rs/linux-sandbox/Cargo.toml

@@ -15,15 +15,15 @@ path = "src/lib.rs"
 workspace = true
 
 [target.'cfg(target_os = "linux")'.dependencies]
-clap = { workspace = true, features = ["derive"] }
-codex-core = { workspace = true }
-landlock = { workspace = true }
-libc = { workspace = true }
-seccompiler = { workspace = true }
+clap = { version = "4", features = ["derive"] }
+codex-core = { path = "../core" }
+landlock = "0.4.1"
+libc = "0.2.175"
+seccompiler = "0.5.0"
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
-tempfile = { workspace = true }
-tokio = { workspace = true, features = [
+tempfile = "3"
+tokio = { version = "1", features = [
     "io-std",
     "macros",
     "process",

codex-rs/linux-sandbox/tests/suite/landlock.rs

@@ -35,11 +35,9 @@ fn create_env_from_core_vars() -> HashMap<String, String> {
 
 #[expect(clippy::print_stdout, clippy::expect_used, clippy::unwrap_used)]
 async fn run_cmd(cmd: &[&str], writable_roots: &[PathBuf], timeout_ms: u64) {
-    let cwd = std::env::current_dir().expect("cwd should exist");
-    let sandbox_cwd = cwd.clone();
     let params = ExecParams {
-        command: cmd.iter().copied().map(str::to_owned).collect(),
-        cwd,
+        command: cmd.iter().map(|elm| elm.to_string()).collect(),
+        cwd: std::env::current_dir().expect("cwd should exist"),
         timeout_ms: Some(timeout_ms),
         env: create_env_from_core_vars(),
         with_escalated_permissions: None,
@@ -61,7 +59,6 @@ async fn run_cmd(cmd: &[&str], writable_roots: &[PathBuf], timeout_ms: u64) {
         params,
         SandboxType::LinuxSeccomp,
         &sandbox_policy,
-        sandbox_cwd.as_path(),
         &codex_linux_sandbox_exe,
         None,
     )
@@ -136,9 +133,8 @@ async fn test_timeout() {
 #[expect(clippy::expect_used)]
 async fn assert_network_blocked(cmd: &[&str]) {
     let cwd = std::env::current_dir().expect("cwd should exist");
-    let sandbox_cwd = cwd.clone();
     let params = ExecParams {
-        command: cmd.iter().copied().map(str::to_owned).collect(),
+        command: cmd.iter().map(|s| s.to_string()).collect(),
         cwd,
         // Give the tool a generous 2-second timeout so even slow DNS timeouts
         // do not stall the suite.
@@ -155,7 +151,6 @@ async fn assert_network_blocked(cmd: &[&str]) {
         params,
         SandboxType::LinuxSeccomp,
         &sandbox_policy,
-        sandbox_cwd.as_path(),
         &codex_linux_sandbox_exe,
         None,
     )

codex-rs/login/Cargo.toml

@@ -7,28 +7,27 @@ version = { workspace = true }
 workspace = true
 
 [dependencies]
-base64 = { workspace = true }
-chrono = { workspace = true, features = ["serde"] }
-codex-core = { workspace = true }
-codex-protocol = { workspace = true }
-rand = { workspace = true }
-reqwest = { workspace = true, features = ["json", "blocking"] }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-sha2 = { workspace = true }
-tempfile = { workspace = true }
-tiny_http = { workspace = true }
-tokio = { workspace = true, features = [
+base64 = "0.22"
+chrono = { version = "0.4", features = ["serde"] }
+codex-core = { path = "../core" }
+codex-protocol = { path = "../protocol" }
+rand = "0.8"
+reqwest = { version = "0.12", features = ["json", "blocking"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+tempfile = "3"
+tiny_http = "0.12"
+tokio = { version = "1", features = [
     "io-std",
     "macros",
     "process",
     "rt-multi-thread",
     "signal",
 ] }
-url = { workspace = true }
-urlencoding = { workspace = true }
-webbrowser = { workspace = true }
+url = "2"
+urlencoding = "2.1"
+webbrowser = "1.0"
 
 [dev-dependencies]
-core_test_support = { workspace = true }
-tempfile = { workspace = true }
+tempfile = "3"

codex-rs/login/src/pkce.rs

@@ -11,7 +11,7 @@ pub struct PkceCodes {
 
 pub fn generate_pkce() -> PkceCodes {
     let mut bytes = [0u8; 64];
-    rand::rng().fill_bytes(&mut bytes);
+    rand::thread_rng().fill_bytes(&mut bytes);
 
     // Verifier: URL-safe base64 without padding (43..128 chars)
     let code_verifier = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes);

codex-rs/login/src/server.rs

@@ -20,7 +20,6 @@ use codex_core::default_client::ORIGINATOR;
 use codex_core::token_data::TokenData;
 use codex_core::token_data::parse_id_token;
 use rand::RngCore;
-use serde_json::Value as JsonValue;
 use tiny_http::Header;
 use tiny_http::Request;
 use tiny_http::Response;
@@ -239,8 +238,8 @@ async fn process_request(
                         &opts.codex_home,
                         api_key.clone(),
                         tokens.id_token.clone(),
-                        tokens.access_token.clone(),
-                        tokens.refresh_token.clone(),
+                        Some(tokens.access_token.clone()),
+                        Some(tokens.refresh_token.clone()),
                     )
                     .await
                     {
@@ -327,7 +326,7 @@ fn build_authorize_url(
 
 fn generate_state() -> String {
     let mut bytes = [0u8; 32];
-    rand::rng().fill_bytes(&mut bytes);
+    rand::thread_rng().fill_bytes(&mut bytes);
     base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
 }
 
@@ -447,8 +446,8 @@ async fn persist_tokens_async(
     codex_home: &Path,
     api_key: Option<String>,
     id_token: String,
-    access_token: String,
-    refresh_token: String,
+    access_token: Option<String>,
+    refresh_token: Option<String>,
 ) -> io::Result<()> {
     // Reuse existing synchronous logic but run it off the async runtime.
     let codex_home = codex_home.to_path_buf();
@@ -460,29 +459,43 @@ async fn persist_tokens_async(
             std::fs::create_dir_all(parent).map_err(io::Error::other)?;
         }
 
-        let mut tokens = TokenData {
-            id_token: parse_id_token(&id_token).map_err(io::Error::other)?,
-            access_token,
-            refresh_token,
-            account_id: None,
-        };
+        let mut auth = read_or_default(&auth_file);
+        if let Some(key) = api_key {
+            auth.openai_api_key = Some(key);
+        }
+        let tokens = auth.tokens.get_or_insert_with(TokenData::default);
+        tokens.id_token = parse_id_token(&id_token).map_err(io::Error::other)?;
+        // Persist chatgpt_account_id if present in claims
         if let Some(acc) = jwt_auth_claims(&id_token)
             .get("chatgpt_account_id")
             .and_then(|v| v.as_str())
         {
             tokens.account_id = Some(acc.to_string());
         }
-        let auth = AuthDotJson {
-            openai_api_key: api_key,
-            tokens: Some(tokens),
-            last_refresh: Some(Utc::now()),
-        };
+        if let Some(at) = access_token {
+            tokens.access_token = at;
+        }
+        if let Some(rt) = refresh_token {
+            tokens.refresh_token = rt;
+        }
+        auth.last_refresh = Some(Utc::now());
         codex_core::auth::write_auth_json(&auth_file, &auth)
     })
     .await
     .map_err(|e| io::Error::other(format!("persist task failed: {e}")))?
 }
 
+fn read_or_default(path: &Path) -> AuthDotJson {
+    match codex_core::auth::try_read_auth_json(path) {
+        Ok(auth) => auth,
+        Err(_) => AuthDotJson {
+            openai_api_key: None,
+            tokens: None,
+            last_refresh: None,
+        },
+    }
+}
+
 fn compose_success_url(port: u16, issuer: &str, id_token: &str, access_token: &str) -> String {
     let token_claims = jwt_auth_claims(id_token);
     let access_claims = jwt_auth_claims(access_token);
@@ -497,11 +510,11 @@ fn compose_success_url(port: u16, issuer: &str, id_token: &str, access_token: &s
         .unwrap_or("");
     let completed_onboarding = token_claims
         .get("completed_platform_onboarding")
-        .and_then(JsonValue::as_bool)
+        .and_then(|v| v.as_bool())
         .unwrap_or(false);
     let is_org_owner = token_claims
         .get("is_org_owner")
-        .and_then(JsonValue::as_bool)
+        .and_then(|v| v.as_bool())
         .unwrap_or(false);
     let needs_setup = (!completed_onboarding) && is_org_owner;
     let plan_type = access_claims

codex-rs/login/tests/suite/login_server_e2e.rs

@@ -8,10 +8,10 @@ use std::time::Duration;
 use base64::Engine;
 use codex_login::ServerOptions;
 use codex_login::run_login_server;
-use core_test_support::non_sandbox_test;
 use tempfile::tempdir;
 
 // See spawn.rs for details
+pub const CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR: &str = "CODEX_SANDBOX_NETWORK_DISABLED";
 
 fn start_mock_issuer() -> (SocketAddr, thread::JoinHandle<()>) {
     // Bind to a random available port
@@ -77,7 +77,12 @@ fn start_mock_issuer() -> (SocketAddr, thread::JoinHandle<()>) {
 
 #[tokio::test]
 async fn end_to_end_login_flow_persists_auth_json() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let (issuer_addr, issuer_handle) = start_mock_issuer();
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
@@ -85,22 +90,6 @@ async fn end_to_end_login_flow_persists_auth_json() {
     let tmp = tempdir().unwrap();
     let codex_home = tmp.path().to_path_buf();
 
-    // Seed auth.json with stale API key + tokens that should be overwritten.
-    let stale_auth = serde_json::json!({
-        "OPENAI_API_KEY": "sk-stale",
-        "tokens": {
-            "id_token": "stale.header.payload",
-            "access_token": "stale-access",
-            "refresh_token": "stale-refresh",
-            "account_id": "stale-acc"
-        }
-    });
-    std::fs::write(
-        codex_home.join("auth.json"),
-        serde_json::to_string_pretty(&stale_auth).unwrap(),
-    )
-    .unwrap();
-
     let state = "test_state_123".to_string();
 
     // Run server in background
@@ -133,10 +122,10 @@ async fn end_to_end_login_flow_persists_auth_json() {
     let auth_path = codex_home.join("auth.json");
     let data = std::fs::read_to_string(&auth_path).unwrap();
     let json: serde_json::Value = serde_json::from_str(&data).unwrap();
-    // The following assert is here because of the old oauth flow that exchanges tokens for an
-    // API key. See obtain_api_key in server.rs for details. Once we remove this old mechanism
-    // from the code, this test should be updated to expect that the API key is no longer present.
-    assert_eq!(json["OPENAI_API_KEY"], "access-123");
+    assert!(
+        !json["OPENAI_API_KEY"].is_null(),
+        "OPENAI_API_KEY should be set"
+    );
     assert_eq!(json["tokens"]["access_token"], "access-123");
     assert_eq!(json["tokens"]["refresh_token"], "refresh-123");
     assert_eq!(json["tokens"]["account_id"], "acc-123");
@@ -147,7 +136,12 @@ async fn end_to_end_login_flow_persists_auth_json() {
 
 #[tokio::test]
 async fn creates_missing_codex_home_dir() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let (issuer_addr, _issuer_handle) = start_mock_issuer();
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
@@ -186,7 +180,12 @@ async fn creates_missing_codex_home_dir() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn cancels_previous_login_server_when_port_is_in_use() {
-    non_sandbox_test!();
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
 
     let (issuer_addr, _issuer_handle) = start_mock_issuer();
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());

codex-rs/mcp-client/Cargo.toml

@@ -7,13 +7,13 @@ edition = "2024"
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-mcp-types = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-tracing = { workspace = true, features = ["log"] }
-tracing-subscriber = { workspace = true, features = ["fmt", "env-filter"] }
-tokio = { workspace = true, features = [
+anyhow = "1"
+mcp-types = { path = "../mcp-types" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tracing = { version = "0.1.41", features = ["log"] }
+tracing-subscriber = { version = "0.3", features = ["fmt", "env-filter"] }
+tokio = { version = "1", features = [
     "io-util",
     "macros",
     "process",

codex-rs/mcp-server/Cargo.toml

@@ -15,35 +15,34 @@ path = "src/lib.rs"
 workspace = true
 
 [dependencies]
-anyhow = { workspace = true }
-codex-arg0 = { workspace = true }
-codex-common = { workspace = true, features = ["cli"] }
-codex-core = { workspace = true }
-codex-login = { workspace = true }
-codex-protocol = { workspace = true }
-mcp-types = { workspace = true }
-schemars = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-shlex = { workspace = true }
-tokio = { workspace = true, features = [
+anyhow = "1"
+codex-arg0 = { path = "../arg0" }
+codex-common = { path = "../common", features = ["cli"] }
+codex-core = { path = "../core" }
+codex-login = { path = "../login" }
+codex-protocol = { path = "../protocol" }
+mcp-types = { path = "../mcp-types" }
+schemars = "0.8.22"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+shlex = "1.3.0"
+tokio = { version = "1", features = [
     "io-std",
     "macros",
     "process",
     "rt-multi-thread",
     "signal",
 ] }
-toml = { workspace = true }
-tracing = { workspace = true, features = ["log"] }
-tracing-subscriber = { workspace = true, features = ["env-filter", "fmt"] }
-uuid = { workspace = true, features = ["serde", "v7"] }
+toml = "0.9"
+tracing = { version = "0.1.41", features = ["log"] }
+tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
+uuid = { version = "1", features = ["serde", "v4"] }
 
 [dev-dependencies]
-assert_cmd = { workspace = true }
-base64 = { workspace = true }
-core_test_support = { workspace = true }
-mcp_test_support = { workspace = true }
-os_info = { workspace = true }
-pretty_assertions = { workspace = true }
-tempfile = { workspace = true }
-wiremock = { workspace = true }
+assert_cmd = "2"
+base64 = "0.22"
+mcp_test_support = { path = "tests/common" }
+os_info = "3.12.0"
+pretty_assertions = "1.4.1"
+tempfile = "3"
+wiremock = "0.6"