Merge branch 'main' into feature_remote_models

Co-authored-by: Cursor <cursoragent@cursor.com>

.codespellignore

@@ -1,5 +1,3 @@
 iTerm
 iTerm2
-psuedo
-te
-TE
+psuedo

.codespellrc

@@ -1,6 +1,6 @@
 [codespell]
 # Ref: https://github.com/codespell-project/codespell#using-a-config-file
-skip = .git*,vendor,*-lock.yaml,*.lock,.codespellrc,*test.ts,*.jsonl,frame*.txt,*.snap,*.snap.new,*meriyah.umd.min.js
+skip = .git*,vendor,*-lock.yaml,*.lock,.codespellrc,*test.ts,*.jsonl,frame*.txt,*.snap,*.snap.new
 check-hidden = true
 ignore-regex = ^\s*"image/\S+": ".*|\b(afterAll)\b
-ignore-words-list = ratatui,ser,iTerm,iterm2,iterm,te,TE
+ignore-words-list = ratatui,ser,iTerm,iterm2,iterm

.codex/skills/test-tui/SKILL.md

@@ -1,14 +0,0 @@
----
-name: test-tui
-description: Guide for testing Codex TUI interactively
----
-
-You can start and use Codex TUI to verify changes. 
-
-Important notes:
-
-Start interactively.
-Always set RUST_LOG="trace" when starting the process.
-Pass `-c log_dir=<some_temp_dir>` argument to have logs written to a specific directory to help with debugging.
-When sending a test message programmatically, send text first, then send Enter in a separate write (do not send text + Enter in one burst).
-Use `just codex` target to run - `just codex -c ...`

.github/ISSUE_TEMPLATE/1-codex-app.yml

@@ -21,13 +21,6 @@ body:
       label: What subscription do you have?
     validations:
       required: true
-  - type: input
-    id: platform
-    attributes:
-      label: What platform is your computer?
-      description: |
-        For macOS and Linux: copy the output of `uname -mprs`
-        For Windows: copy the output of `"$([Environment]::OSVersion | ForEach-Object VersionString) $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" })"` in the PowerShell console
   - type: textarea
     id: actual
     attributes:

.github/prompts/issue-deduplicator.txt

@@ -0,0 +1,18 @@
+You are an assistant that triages new GitHub issues by identifying potential duplicates.
+
+You will receive the following JSON files located in the current working directory:
+- `codex-current-issue.json`: JSON object describing the newly created issue (fields: number, title, body).
+- `codex-existing-issues.json`: JSON array of recent issues (each element includes number, title, body, createdAt).
+
+Instructions:
+- Load both files as JSON and review their contents carefully. The codex-existing-issues.json file is large, ensure you explore all of it.
+- Compare the current issue against the existing issues to find up to five that appear to describe the same underlying problem or request.
+- Only consider an issue a potential duplicate if there is a clear overlap in symptoms, feature requests, reproduction steps, or error messages.
+- Prioritize newer issues when similarity is comparable.
+- Ignore pull requests and issues whose similarity is tenuous.
+- When unsure, prefer returning fewer matches.
+
+Output requirements:
+- Respond with a JSON array of issue numbers (integers), ordered from most likely duplicate to least.
+- Include at most five numbers.
+- If you find no plausible duplicates, respond with `[]`.

.github/prompts/issue-labeler.txt

@@ -0,0 +1,26 @@
+You are an assistant that reviews GitHub issues for the repository.
+
+Your job is to choose the most appropriate existing labels for the issue described later in this prompt.
+Follow these rules:
+- Only pick labels out of the list below.
+- Prefer a small set of precise labels over many broad ones.
+- If none of the labels fit, respond with an empty JSON array: []
+- Output must be a JSON array of label names (strings) with no additional commentary.
+
+Labels to apply:
+1. bug — Reproducible defects in Codex products (CLI, VS Code extension, web, auth).
+2. enhancement — Feature requests or usability improvements that ask for new capabilities, better ergonomics, or quality-of-life tweaks.
+3. extension — VS Code (or other IDE) extension-specific issues.
+4. windows-os — Bugs or friction specific to Windows environments (PowerShell behavior, path handling, copy/paste, OS-specific auth or tooling failures).
+5. mcp — Topics involving Model Context Protocol servers/clients.
+6. codex-web — Issues targeting the Codex web UI/Cloud experience.
+8. azure — Problems or requests tied to Azure OpenAI deployments.
+9. documentation — Updates or corrections needed in docs/README/config references (broken links, missing examples, outdated keys, clarification requests).
+10. model-behavior — Undesirable LLM behavior: forgetting goals, refusing work, hallucinating environment details, quota misreports, or other reasoning/performance anomalies.
+
+Issue information is available in environment variables:
+
+ISSUE_NUMBER
+ISSUE_TITLE
+ISSUE_BODY
+REPO_FULL_NAME

.github/scripts/install-musl-build-tools.sh

@@ -17,7 +17,7 @@ if [[ -n "${APT_INSTALL_ARGS:-}" ]]; then
 fi
 
 sudo apt-get update "${apt_update_args[@]}"
-sudo apt-get install -y "${apt_install_args[@]}" ca-certificates curl musl-tools pkg-config libcap-dev g++ clang libc++-dev libc++abi-dev lld xz-utils
+sudo apt-get install -y "${apt_install_args[@]}" musl-tools pkg-config g++ clang libc++-dev libc++abi-dev lld
 
 case "${TARGET}" in
   x86_64-unknown-linux-musl)
@@ -32,11 +32,6 @@ case "${TARGET}" in
     ;;
 esac
 
-libcap_version="2.75"
-libcap_sha256="de4e7e064c9ba451d5234dd46e897d7c71c96a9ebf9a0c445bc04f4742d83632"
-libcap_tarball_name="libcap-${libcap_version}.tar.xz"
-libcap_download_url="https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${libcap_tarball_name}"
-
 # Use the musl toolchain as the Rust linker to avoid Zig injecting its own CRT.
 if command -v "${arch}-linux-musl-gcc" >/dev/null; then
   musl_linker="$(command -v "${arch}-linux-musl-gcc")"
@@ -52,43 +47,6 @@ runner_temp="${RUNNER_TEMP:-/tmp}"
 tool_root="${runner_temp}/codex-musl-tools-${TARGET}"
 mkdir -p "${tool_root}"
 
-libcap_root="${tool_root}/libcap-${libcap_version}"
-libcap_src_root="${libcap_root}/src"
-libcap_prefix="${libcap_root}/prefix"
-libcap_pkgconfig_dir="${libcap_prefix}/lib/pkgconfig"
-
-if [[ ! -f "${libcap_prefix}/lib/libcap.a" ]]; then
-  mkdir -p "${libcap_src_root}" "${libcap_prefix}/lib" "${libcap_prefix}/include/sys" "${libcap_prefix}/include/linux" "${libcap_pkgconfig_dir}"
-  libcap_tarball="${libcap_root}/${libcap_tarball_name}"
-
-  curl -fsSL "${libcap_download_url}" -o "${libcap_tarball}"
-  echo "${libcap_sha256}  ${libcap_tarball}" | sha256sum -c -
-
-  tar -xJf "${libcap_tarball}" -C "${libcap_src_root}"
-  libcap_source_dir="${libcap_src_root}/libcap-${libcap_version}"
-  make -C "${libcap_source_dir}/libcap" -j"$(nproc)" \
-    CC="${musl_linker}" \
-    AR=ar \
-    RANLIB=ranlib
-
-  cp "${libcap_source_dir}/libcap/libcap.a" "${libcap_prefix}/lib/libcap.a"
-  cp "${libcap_source_dir}/libcap/include/uapi/linux/capability.h" "${libcap_prefix}/include/linux/capability.h"
-  cp "${libcap_source_dir}/libcap/../libcap/include/sys/capability.h" "${libcap_prefix}/include/sys/capability.h"
-
-  cat > "${libcap_pkgconfig_dir}/libcap.pc" <<EOF
-prefix=${libcap_prefix}
-exec_prefix=\${prefix}
-libdir=\${prefix}/lib
-includedir=\${prefix}/include
-
-Name: libcap
-Description: Linux capabilities
-Version: ${libcap_version}
-Libs: -L\${libdir} -lcap
-Cflags: -I\${includedir}
-EOF
-fi
-
 sysroot=""
 if command -v zig >/dev/null; then
   zig_bin="$(command -v zig)"
@@ -101,19 +59,7 @@ set -euo pipefail
 
 args=()
 skip_next=0
-pending_include=0
 for arg in "\$@"; do
-  if [[ "\${pending_include}" -eq 1 ]]; then
-    pending_include=0
-    if [[ "\${arg}" == /usr/include || "\${arg}" == /usr/include/* ]]; then
-      # Keep host-only headers available, but after the target sysroot headers.
-      args+=("-idirafter" "\${arg}")
-    else
-      args+=("-I" "\${arg}")
-    fi
-    continue
-  fi
-
   if [[ "\${skip_next}" -eq 1 ]]; then
     skip_next=0
     continue
@@ -131,15 +77,6 @@ for arg in "\$@"; do
       fi
       continue
       ;;
-    -I)
-      pending_include=1
-      continue
-      ;;
-    -I/usr/include|-I/usr/include/*)
-      # Avoid making glibc headers win over musl headers.
-      args+=("-idirafter" "\${arg#-I}")
-      continue
-      ;;
     -Wp,-U_FORTIFY_SOURCE)
       # aws-lc-sys emits this GCC preprocessor forwarding form in debug
       # builds, but zig cc expects the define flag directly.
@@ -158,19 +95,7 @@ set -euo pipefail
 
 args=()
 skip_next=0
-pending_include=0
 for arg in "\$@"; do
-  if [[ "\${pending_include}" -eq 1 ]]; then
-    pending_include=0
-    if [[ "\${arg}" == /usr/include || "\${arg}" == /usr/include/* ]]; then
-      # Keep host-only headers available, but after the target sysroot headers.
-      args+=("-idirafter" "\${arg}")
-    else
-      args+=("-I" "\${arg}")
-    fi
-    continue
-  fi
-
   if [[ "\${skip_next}" -eq 1 ]]; then
     skip_next=0
     continue
@@ -188,15 +113,6 @@ for arg in "\$@"; do
       fi
       continue
       ;;
-    -I)
-      pending_include=1
-      continue
-      ;;
-    -I/usr/include|-I/usr/include/*)
-      # Avoid making glibc headers win over musl headers.
-      args+=("-idirafter" "\${arg#-I}")
-      continue
-      ;;
     -Wp,-U_FORTIFY_SOURCE)
       # aws-lc-sys emits this GCC forwarding form in debug builds; zig c++
       # expects the define flag directly.
@@ -259,21 +175,3 @@ echo "${cargo_linker_var}=${musl_linker}" >> "$GITHUB_ENV"
 echo "CMAKE_C_COMPILER=${cc}" >> "$GITHUB_ENV"
 echo "CMAKE_CXX_COMPILER=${cxx}" >> "$GITHUB_ENV"
 echo "CMAKE_ARGS=-DCMAKE_HAVE_THREADS_LIBRARY=1 -DCMAKE_USE_PTHREADS_INIT=1 -DCMAKE_THREAD_LIBS_INIT=-pthread -DTHREADS_PREFER_PTHREAD_FLAG=ON" >> "$GITHUB_ENV"
-
-# Allow pkg-config resolution during cross-compilation.
-echo "PKG_CONFIG_ALLOW_CROSS=1" >> "$GITHUB_ENV"
-pkg_config_path="${libcap_pkgconfig_dir}"
-if [[ -n "${PKG_CONFIG_PATH:-}" ]]; then
-  pkg_config_path="${pkg_config_path}:${PKG_CONFIG_PATH}"
-fi
-echo "PKG_CONFIG_PATH=${pkg_config_path}" >> "$GITHUB_ENV"
-pkg_config_path_var="PKG_CONFIG_PATH_${TARGET}"
-pkg_config_path_var="${pkg_config_path_var//-/_}"
-echo "${pkg_config_path_var}=${libcap_pkgconfig_dir}" >> "$GITHUB_ENV"
-
-if [[ -n "${sysroot}" && "${sysroot}" != "/" ]]; then
-  echo "PKG_CONFIG_SYSROOT_DIR=${sysroot}" >> "$GITHUB_ENV"
-  pkg_config_sysroot_var="PKG_CONFIG_SYSROOT_DIR_${TARGET}"
-  pkg_config_sysroot_var="${pkg_config_sysroot_var//-/_}"
-  echo "${pkg_config_sysroot_var}=${sysroot}" >> "$GITHUB_ENV"
-fi

.github/workflows/bazel.yml

@@ -65,11 +65,6 @@ jobs:
       - name: Set up Bazel
         uses: bazelbuild/setup-bazelisk@v3
 
-      - name: Check MODULE.bazel.lock is up to date
-        if: matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu'
-        shell: bash
-        run: ./scripts/check-module-bazel-lock.sh
-
       # TODO(mbolin): Bring this back once we have caching working. Currently,
       # we never seem to get a cache hit but we still end up paying the cost of
       # uploading at the end of the build, which takes over a minute!
@@ -105,45 +100,12 @@ jobs:
       - name: bazel test //...
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+          CODEX_BWRAP_ENABLE_FFI: ${{ contains(matrix.target, 'unknown-linux') && '1' || '0' }}
         shell: bash
         run: |
-          bazel_args=(
-            test
-            //...
-            --test_verbose_timeout_warnings
-            --build_metadata=REPO_URL=https://github.com/openai/codex.git
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
-            --build_metadata=ROLE=CI
-            --build_metadata=VISIBILITY=PUBLIC
-          )
-
-          if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
-            echo "BuildBuddy API key is available; using remote Bazel configuration."
-            bazel $BAZEL_STARTUP_ARGS \
-              --bazelrc=.github/workflows/ci.bazelrc \
-              "${bazel_args[@]}" \
-              "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          else
-            echo "BuildBuddy API key is not available; using local Bazel configuration."
-            # Keep fork/community PRs on Bazel but disable remote services that are
-            # configured in .bazelrc and require auth.
-            #
-            # Flag docs:
-            # - Command-line reference: https://bazel.build/reference/command-line-reference
-            # - Remote caching overview: https://bazel.build/remote/caching
-            # - Remote execution overview: https://bazel.build/remote/rbe
-            # - Build Event Protocol overview: https://bazel.build/remote/bep
-            #
-            # --noexperimental_remote_repo_contents_cache:
-            #   disable remote repo contents cache enabled in .bazelrc startup options.
-            #   https://bazel.build/reference/command-line-reference#startup_options-flag--experimental_remote_repo_contents_cache
-            # --remote_cache= and --remote_executor=:
-            #   clear remote cache/execution endpoints configured in .bazelrc.
-            #   https://bazel.build/reference/command-line-reference#common_options-flag--remote_cache
-            #   https://bazel.build/reference/command-line-reference#common_options-flag--remote_executor
-            bazel $BAZEL_STARTUP_ARGS \
-              --noexperimental_remote_repo_contents_cache \
-              "${bazel_args[@]}" \
-              --remote_cache= \
-              --remote_executor=
-          fi
+          bazel $BAZEL_STARTUP_ARGS --bazelrc=.github/workflows/ci.bazelrc test //... \
+            --build_metadata=REPO_URL=https://github.com/openai/codex.git \
+            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD) \
+            --build_metadata=ROLE=CI \
+            --build_metadata=VISIBILITY=PUBLIC \
+            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"

.github/workflows/issue-deduplicator.yml

@@ -15,68 +15,34 @@ jobs:
     permissions:
       contents: read
     outputs:
-      codex_output: ${{ steps.select-final.outputs.codex_output }}
+      codex_output: ${{ steps.codex.outputs.final-message }}
     steps:
       - uses: actions/checkout@v6
 
       - name: Prepare Codex inputs
         env:
           GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           set -eo pipefail
 
           CURRENT_ISSUE_FILE=codex-current-issue.json
-          EXISTING_ALL_FILE=codex-existing-issues-all.json
-          EXISTING_OPEN_FILE=codex-existing-issues-open.json
+          EXISTING_ISSUES_FILE=codex-existing-issues.json
 
-          gh issue list --repo "$REPO" \
-            --json number,title,body,createdAt,updatedAt,state,labels \
+          gh issue list --repo "${{ github.repository }}" \
+            --json number,title,body,createdAt \
             --limit 1000 \
             --state all \
             --search "sort:created-desc" \
-            | jq '[.[] | {
-                number,
-                title,
-                body: ((.body // "")[0:4000]),
-                createdAt,
-                updatedAt,
-                state,
-                labels: ((.labels // []) | map(.name))
-              }]' \
-            > "$EXISTING_ALL_FILE"
+            | jq '.' \
+            > "$EXISTING_ISSUES_FILE"
 
-          gh issue list --repo "$REPO" \
-            --json number,title,body,createdAt,updatedAt,state,labels \
-            --limit 1000 \
-            --state open \
-            --search "sort:created-desc" \
-            | jq '[.[] | {
-                number,
-                title,
-                body: ((.body // "")[0:4000]),
-                createdAt,
-                updatedAt,
-                state,
-                labels: ((.labels // []) | map(.name))
-              }]' \
-            > "$EXISTING_OPEN_FILE"
-
-          gh issue view "$ISSUE_NUMBER" \
-            --repo "$REPO" \
+          gh issue view "${{ github.event.issue.number }}" \
+            --repo "${{ github.repository }}" \
             --json number,title,body \
-            | jq '{number, title, body: ((.body // "")[0:4000])}' \
+            | jq '.' \
             > "$CURRENT_ISSUE_FILE"
 
-          echo "Prepared duplicate detection input files."
-          echo "all_issue_count=$(jq 'length' "$EXISTING_ALL_FILE")"
-          echo "open_issue_count=$(jq 'length' "$EXISTING_OPEN_FILE")"
-
-      # Prompt instructions are intentionally inline in this workflow. The old
-      # .github/prompts/issue-deduplicator.txt file is obsolete and removed.
-      - id: codex-all
-        name: Find duplicates (pass 1, all issues)
+      - id: codex
         uses: openai/codex-action@main
         with:
           openai-api-key: ${{ secrets.CODEX_OPENAI_API_KEY }}
@@ -86,17 +52,14 @@ jobs:
 
             You will receive the following JSON files located in the current working directory:
             - `codex-current-issue.json`: JSON object describing the newly created issue (fields: number, title, body).
-            - `codex-existing-issues-all.json`: JSON array of recent issues with states, timestamps, and labels.
+            - `codex-existing-issues.json`: JSON array of recent issues (each element includes number, title, body, createdAt).
 
             Instructions:
             - Compare the current issue against the existing issues to find up to five that appear to describe the same underlying problem or request.
-            - Prioritize concrete overlap in symptoms, reproduction details, error signatures, and user intent.
-            - Prefer active unresolved issues when confidence is similar.
-            - Closed issues can still be valid duplicates if they clearly match.
-            - Return fewer matches rather than speculative ones.
-            - If confidence is low, return an empty list.
-            - Include at most five issue numbers.
-            - After analysis, provide a short reason for your decision.
+            - Focus on the underlying intent and context of each issue—such as reported symptoms, feature requests, reproduction steps, or error messages—rather than relying solely on string similarity or synthetic metrics.
+            - After your analysis, validate your results in 1-2 lines explaining your decision to return the selected matches.
+            - When unsure, prefer returning fewer matches.
+            - Include at most five numbers.
 
           output-schema: |
             {
@@ -114,179 +77,6 @@ jobs:
               "additionalProperties": false
             }
 
-      - id: normalize-all
-        name: Normalize pass 1 output
-        env:
-          CODEX_OUTPUT: ${{ steps.codex-all.outputs.final-message }}
-          CURRENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-        run: |
-          set -eo pipefail
-
-          raw=${CODEX_OUTPUT//$'\r'/}
-          parsed=false
-          issues='[]'
-          reason=''
-
-          if [ -n "$raw" ] && printf '%s' "$raw" | jq -e 'type == "object" and (.issues | type == "array")' >/dev/null 2>&1; then
-            parsed=true
-            issues=$(printf '%s' "$raw" | jq -c '[.issues[] | tostring]')
-            reason=$(printf '%s' "$raw" | jq -r '.reason // ""')
-          else
-            reason='Pass 1 output was empty or invalid JSON.'
-          fi
-
-          filtered=$(jq -cn --argjson issues "$issues" --arg current "$CURRENT_ISSUE_NUMBER" '[
-            $issues[]
-            | tostring
-            | select(. != $current)
-          ] | reduce .[] as $issue ([]; if index($issue) then . else . + [$issue] end) | .[:5]')
-
-          has_matches=false
-          if [ "$(jq 'length' <<< "$filtered")" -gt 0 ]; then
-            has_matches=true
-          fi
-
-          echo "Pass 1 parsed: $parsed"
-          echo "Pass 1 matches after filtering: $(jq 'length' <<< "$filtered")"
-          echo "Pass 1 reason: $reason"
-
-          {
-            echo "issues_json=$filtered"
-            echo "reason<<EOF"
-            echo "$reason"
-            echo "EOF"
-            echo "has_matches=$has_matches"
-          } >> "$GITHUB_OUTPUT"
-
-      - id: codex-open
-        name: Find duplicates (pass 2, open issues)
-        if: ${{ steps.normalize-all.outputs.has_matches != 'true' }}
-        uses: openai/codex-action@main
-        with:
-          openai-api-key: ${{ secrets.CODEX_OPENAI_API_KEY }}
-          allow-users: "*"
-          prompt: |
-            You are an assistant that triages new GitHub issues by identifying potential duplicates.
-
-            This is a fallback pass because a broad search did not find convincing matches.
-
-            You will receive the following JSON files located in the current working directory:
-            - `codex-current-issue.json`: JSON object describing the newly created issue (fields: number, title, body).
-            - `codex-existing-issues-open.json`: JSON array of open issues only.
-
-            Instructions:
-            - Search only these active unresolved issues for duplicates of the current issue.
-            - Prioritize concrete overlap in symptoms, reproduction details, error signatures, and user intent.
-            - Prefer fewer, higher-confidence matches.
-            - If confidence is low, return an empty list.
-            - Include at most five issue numbers.
-            - After analysis, provide a short reason for your decision.
-
-          output-schema: |
-            {
-              "type": "object",
-              "properties": {
-                "issues": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                },
-                "reason": { "type": "string" }
-              },
-              "required": ["issues", "reason"],
-              "additionalProperties": false
-            }
-
-      - id: normalize-open
-        name: Normalize pass 2 output
-        if: ${{ steps.normalize-all.outputs.has_matches != 'true' }}
-        env:
-          CODEX_OUTPUT: ${{ steps.codex-open.outputs.final-message }}
-          CURRENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-        run: |
-          set -eo pipefail
-
-          raw=${CODEX_OUTPUT//$'\r'/}
-          parsed=false
-          issues='[]'
-          reason=''
-
-          if [ -n "$raw" ] && printf '%s' "$raw" | jq -e 'type == "object" and (.issues | type == "array")' >/dev/null 2>&1; then
-            parsed=true
-            issues=$(printf '%s' "$raw" | jq -c '[.issues[] | tostring]')
-            reason=$(printf '%s' "$raw" | jq -r '.reason // ""')
-          else
-            reason='Pass 2 output was empty or invalid JSON.'
-          fi
-
-          filtered=$(jq -cn --argjson issues "$issues" --arg current "$CURRENT_ISSUE_NUMBER" '[
-            $issues[]
-            | tostring
-            | select(. != $current)
-          ] | reduce .[] as $issue ([]; if index($issue) then . else . + [$issue] end) | .[:5]')
-
-          has_matches=false
-          if [ "$(jq 'length' <<< "$filtered")" -gt 0 ]; then
-            has_matches=true
-          fi
-
-          echo "Pass 2 parsed: $parsed"
-          echo "Pass 2 matches after filtering: $(jq 'length' <<< "$filtered")"
-          echo "Pass 2 reason: $reason"
-
-          {
-            echo "issues_json=$filtered"
-            echo "reason<<EOF"
-            echo "$reason"
-            echo "EOF"
-            echo "has_matches=$has_matches"
-          } >> "$GITHUB_OUTPUT"
-
-      - id: select-final
-        name: Select final duplicate set
-        env:
-          PASS1_ISSUES: ${{ steps.normalize-all.outputs.issues_json }}
-          PASS1_REASON: ${{ steps.normalize-all.outputs.reason }}
-          PASS2_ISSUES: ${{ steps.normalize-open.outputs.issues_json }}
-          PASS2_REASON: ${{ steps.normalize-open.outputs.reason }}
-          PASS1_HAS_MATCHES: ${{ steps.normalize-all.outputs.has_matches }}
-          PASS2_HAS_MATCHES: ${{ steps.normalize-open.outputs.has_matches }}
-        run: |
-          set -eo pipefail
-
-          selected_issues='[]'
-          selected_reason='No plausible duplicates found.'
-          selected_pass='none'
-
-          if [ "$PASS1_HAS_MATCHES" = "true" ]; then
-            selected_issues=${PASS1_ISSUES:-'[]'}
-            selected_reason=${PASS1_REASON:-'Pass 1 found duplicates.'}
-            selected_pass='all'
-          fi
-
-          if [ "$PASS2_HAS_MATCHES" = "true" ]; then
-            selected_issues=${PASS2_ISSUES:-'[]'}
-            selected_reason=${PASS2_REASON:-'Pass 2 found duplicates.'}
-            selected_pass='open-fallback'
-          fi
-
-          final_json=$(jq -cn \
-            --argjson issues "$selected_issues" \
-            --arg reason "$selected_reason" \
-            --arg pass "$selected_pass" \
-            '{issues: $issues, reason: $reason, pass: $pass}')
-
-          echo "Final pass used: $selected_pass"
-          echo "Final duplicate count: $(jq '.issues | length' <<< "$final_json")"
-          echo "Final reason: $(jq -r '.reason' <<< "$final_json")"
-
-          {
-            echo "codex_output<<EOF"
-            echo "$final_json"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
   comment-on-issue:
     name: Comment with potential duplicates
     needs: gather-duplicates
@@ -315,17 +105,11 @@ jobs:
 
             const issues = Array.isArray(parsed?.issues) ? parsed.issues : [];
             const currentIssueNumber = String(context.payload.issue.number);
-            const passUsed = typeof parsed?.pass === 'string' ? parsed.pass : 'unknown';
-            const reason = typeof parsed?.reason === 'string' ? parsed.reason : '';
 
             console.log(`Current issue number: ${currentIssueNumber}`);
-            console.log(`Pass used: ${passUsed}`);
-            if (reason) {
-              console.log(`Reason: ${reason}`);
-            }
             console.log(issues);
 
-            const filteredIssues = [...new Set(issues.map((value) => String(value)))].filter((value) => value !== currentIssueNumber).slice(0, 5);
+            const filteredIssues = issues.filter((value) => String(value) !== currentIssueNumber);
 
             if (filteredIssues.length === 0) {
               core.info('Codex reported no potential duplicates.');

.github/workflows/issue-labeler.yml

@@ -50,15 +50,14 @@ jobs:
             4. azure — Problems or requests tied to Azure OpenAI deployments.
             5. model-behavior — Undesirable LLM behavior: forgetting goals, refusing work, hallucinating environment details, quota misreports, or other reasoning/performance anomalies.
             6. code-review — Issues related to the code review feature or functionality.
-            7. safety-check - Issues related to cyber risk detection or trusted access verification.
-            8. auth - Problems related to authentication, login, or access tokens.
-            9. codex-exec - Problems related to the "codex exec" command or functionality.
-            10. context-management - Problems related to compaction, context windows, or available context reporting.
-            11. custom-model - Problems that involve using custom model providers, local models, or OSS models.
-            12. rate-limits - Problems related to token limits, rate limits, or token usage reporting.
-            13. sandbox - Issues related to local sandbox environments or tool call approvals to override sandbox restrictions.
-            14. tool-calls - Problems related to specific tool call invocations including unexpected errors, failures, or hangs.
-            15. TUI - Problems with the terminal user interface (TUI) including keyboard shortcuts, copy & pasting, menus, or screen update issues.
+            7. auth - Problems related to authentication, login, or access tokens.
+            8. codex-exec - Problems related to the "codex exec" command or functionality.
+            9. context-management - Problems related to compaction, context windows, or available context reporting.
+            10. custom-model - Problems that involve using custom model providers, local models, or OSS models.
+            11. rate-limits - Problems related to token limits, rate limits, or token usage reporting.
+            12. sandbox - Issues related to local sandbox environments or tool call approvals to override sandbox restrictions.
+            13. tool-calls - Problems related to specific tool call invocations including unexpected errors, failures, or hangs.
+            14. TUI - Problems with the terminal user interface (TUI) including keyboard shortcuts, copy & pasting, menus, or screen update issues.
 
             Issue number: ${{ github.event.issue.number }}
 

.github/workflows/rust-ci.yml

@@ -59,7 +59,7 @@ jobs:
         working-directory: codex-rs
     steps:
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
         with:
           components: rustfmt
       - name: cargo fmt
@@ -75,7 +75,7 @@ jobs:
         working-directory: codex-rs
     steps:
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
       - uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2
         with:
           tool: cargo-shear
@@ -99,8 +99,9 @@ jobs:
       USE_SCCACHE: ${{ startsWith(matrix.runner, 'windows') && 'false' || 'true' }}
       CARGO_INCREMENTAL: "0"
       SCCACHE_CACHE_SIZE: 10G
-      # In rust-ci, representative release-profile checks use thin LTO for faster feedback.
-      CARGO_PROFILE_RELEASE_LTO: ${{ matrix.profile == 'release' && 'thin' || 'fat' }}
+      # Keep cargo-based CI independent of system bwrap build deps.
+      # The bwrap FFI path is validated in Bazel workflows.
+      CODEX_BWRAP_ENABLE_FFI: "0"
 
     strategy:
       fail-fast: false
@@ -162,12 +163,6 @@ jobs:
             runs_on:
               group: codex-runners
               labels: codex-linux-x64
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            profile: release
-            runs_on:
-              group: codex-runners
-              labels: codex-linux-arm64
           - runner: windows-x64
             target: x86_64-pc-windows-msvc
             profile: release
@@ -183,20 +178,16 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-      - name: Install Linux build dependencies
-        if: ${{ runner.os == 'Linux' }}
+      - name: Install UBSan runtime (musl)
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         shell: bash
         run: |
           set -euo pipefail
           if command -v apt-get >/dev/null 2>&1; then
             sudo apt-get update -y
-            packages=(pkg-config libcap-dev)
-            if [[ "${{ matrix.target }}" == 'x86_64-unknown-linux-musl' || "${{ matrix.target }}" == 'aarch64-unknown-linux-musl' ]]; then
-              packages+=(libubsan1)
-            fi
-            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${packages[@]}"
+            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y libubsan1
           fi
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
         with:
           targets: ${{ matrix.target }}
           components: clippy
@@ -388,15 +379,21 @@ jobs:
           cargo chef cook --recipe-path "$RECIPE" --target ${{ matrix.target }} --release --all-features
 
       - name: cargo clippy
-        run: cargo clippy --target ${{ matrix.target }} --all-features --tests --profile ${{ matrix.profile }} --timings -- -D warnings
+        id: clippy
+        run: cargo clippy --target ${{ matrix.target }} --all-features --tests --profile ${{ matrix.profile }} -- -D warnings
 
-      - name: Upload Cargo timings (clippy)
-        if: always()
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-ci-clippy-${{ matrix.target }}-${{ matrix.profile }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
+      # Running `cargo build` from the workspace root builds the workspace using
+      # the union of all features from third-party crates. This can mask errors
+      # where individual crates have underspecified features. To avoid this, we
+      # run `cargo check` for each crate individually, though because this is
+      # slower, we only do this for the x86_64-unknown-linux-gnu target.
+      - name: cargo check individual crates
+        id: cargo_check_all_crates
+        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && matrix.profile != 'release' }}
+        continue-on-error: true
+        run: |
+          find . -name Cargo.toml -mindepth 2 -maxdepth 2 -print0 \
+            | xargs -0 -n1 -I{} bash -c 'cd "$(dirname "{}")" && cargo check --profile ${{ matrix.profile }}'
 
       # Save caches explicitly; make non-fatal so cache packaging
       # never fails the overall job. Only save when key wasn't hit.
@@ -450,6 +447,15 @@ jobs:
             /var/cache/apt
           key: apt-${{ matrix.runner }}-${{ matrix.target }}-v1
 
+      # Fail the job if any of the previous steps failed.
+      - name: verify all steps passed
+        if: |
+          steps.clippy.outcome == 'failure' ||
+          steps.cargo_check_all_crates.outcome == 'failure'
+        run: |
+          echo "One or more checks failed (clippy or cargo_check_all_crates). See logs for details."
+          exit 1
+
   tests:
     name: Tests — ${{ matrix.runner }} - ${{ matrix.target }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
@@ -464,6 +470,9 @@ jobs:
       USE_SCCACHE: ${{ startsWith(matrix.runner, 'windows') && 'false' || 'true' }}
       CARGO_INCREMENTAL: "0"
       SCCACHE_CACHE_SIZE: 10G
+      # Keep cargo-based CI independent of system bwrap build deps.
+      # The bwrap FFI path is validated in Bazel workflows.
+      CODEX_BWRAP_ENABLE_FFI: "0"
 
     strategy:
       fail-fast: false
@@ -499,21 +508,12 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-      - name: Install Linux build dependencies
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          if command -v apt-get >/dev/null 2>&1; then
-            sudo apt-get update -y
-            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-          fi
       # Some integration tests rely on DotSlash being installed.
       # See https://github.com/openai/codex/pull/7617.
       - name: Install DotSlash
         uses: facebook/install-dotslash@v2
 
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
         with:
           targets: ${{ matrix.target }}
 
@@ -581,32 +581,13 @@ jobs:
           tool: nextest
           version: 0.9.103
 
-      - name: Enable unprivileged user namespaces (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          # Required for bubblewrap to work on Linux CI runners.
-          sudo sysctl -w kernel.unprivileged_userns_clone=1
-          # Ubuntu 24.04+ can additionally gate unprivileged user namespaces
-          # behind AppArmor.
-          if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
-            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          fi
-
       - name: tests
         id: test
-        run: cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test --timings
+        run: cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test
         env:
           RUST_BACKTRACE: 1
           NEXTEST_STATUS_LEVEL: leak
 
-      - name: Upload Cargo timings (nextest)
-        if: always()
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-ci-nextest-${{ matrix.target }}-${{ matrix.profile }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
-
       - name: Save cargo home cache
         if: always() && !cancelled() && steps.cache_cargo_home_restore.outputs.cache-hit != 'true'
         continue-on-error: true

.github/workflows/rust-release-windows.yml

@@ -1,264 +0,0 @@
-name: rust-release-windows
-
-on:
-  workflow_call:
-    inputs:
-      release-lto:
-        required: true
-        type: string
-    secrets:
-      AZURE_TRUSTED_SIGNING_CLIENT_ID:
-        required: true
-      AZURE_TRUSTED_SIGNING_TENANT_ID:
-        required: true
-      AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID:
-        required: true
-      AZURE_TRUSTED_SIGNING_ENDPOINT:
-        required: true
-      AZURE_TRUSTED_SIGNING_ACCOUNT_NAME:
-        required: true
-      AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME:
-        required: true
-
-jobs:
-  build-windows-binaries:
-    name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
-    runs-on: ${{ matrix.runs_on }}
-    timeout-minutes: 60
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: codex-rs
-    env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ inputs.release-lto }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: windows-x64
-            target: x86_64-pc-windows-msvc
-            bundle: primary
-            build_args: --bin codex --bin codex-responses-api-proxy
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
-          - runner: windows-arm64
-            target: aarch64-pc-windows-msvc
-            bundle: primary
-            build_args: --bin codex --bin codex-responses-api-proxy
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-arm64
-          - runner: windows-x64
-            target: x86_64-pc-windows-msvc
-            bundle: helpers
-            build_args: --bin codex-windows-sandbox-setup --bin codex-command-runner
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
-          - runner: windows-arm64
-            target: aarch64-pc-windows-msvc
-            bundle: helpers
-            build_args: --bin codex-windows-sandbox-setup --bin codex-command-runner
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-arm64
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: Print runner specs (Windows)
-        shell: powershell
-        run: |
-          $computer = Get-CimInstance Win32_ComputerSystem
-          $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1
-          $ramGiB = [math]::Round($computer.TotalPhysicalMemory / 1GB, 1)
-          Write-Host "Runner: $env:RUNNER_NAME"
-          Write-Host "OS: $([System.Environment]::OSVersion.VersionString)"
-          Write-Host "CPU: $($cpu.Name)"
-          Write-Host "Logical CPUs: $($computer.NumberOfLogicalProcessors)"
-          Write-Host "Physical CPUs: $($computer.NumberOfProcessors)"
-          Write-Host "Total RAM: $ramGiB GiB"
-          Write-Host "Disk usage:"
-          Get-PSDrive -PSProvider FileSystem | Format-Table -AutoSize Name, @{Name='Size(GB)';Expression={[math]::Round(($_.Used + $_.Free) / 1GB, 1)}}, @{Name='Free(GB)';Expression={[math]::Round($_.Free / 1GB, 1)}}
-      - uses: dtolnay/rust-toolchain@1.93.0
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cargo build (Windows binaries)
-        shell: bash
-        run: |
-          cargo build --target ${{ matrix.target }} --release --timings ${{ matrix.build_args }}
-
-      - name: Upload Cargo timings
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-release-windows-${{ matrix.target }}-${{ matrix.bundle }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
-
-      - name: Stage Windows binaries
-        shell: bash
-        run: |
-          output_dir="target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}"
-          mkdir -p "$output_dir"
-          if [[ "${{ matrix.bundle }}" == "primary" ]]; then
-            cp target/${{ matrix.target }}/release/codex.exe "$output_dir/codex.exe"
-            cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$output_dir/codex-responses-api-proxy.exe"
-          else
-            cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$output_dir/codex-windows-sandbox-setup.exe"
-            cp target/${{ matrix.target }}/release/codex-command-runner.exe "$output_dir/codex-command-runner.exe"
-          fi
-
-      - name: Upload Windows binaries
-        uses: actions/upload-artifact@v6
-        with:
-          name: windows-binaries-${{ matrix.target }}-${{ matrix.bundle }}
-          path: |
-            codex-rs/target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}/*
-
-  build-windows:
-    needs:
-      - build-windows-binaries
-    name: Build - ${{ matrix.runner }} - ${{ matrix.target }}
-    runs-on: ${{ matrix.runs_on }}
-    timeout-minutes: 60
-    permissions:
-      contents: read
-      id-token: write
-    defaults:
-      run:
-        working-directory: codex-rs
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: windows-x64
-            target: x86_64-pc-windows-msvc
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
-          - runner: windows-arm64
-            target: aarch64-pc-windows-msvc
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-arm64
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Download prebuilt Windows primary binaries
-        uses: actions/download-artifact@v7
-        with:
-          name: windows-binaries-${{ matrix.target }}-primary
-          path: codex-rs/target/${{ matrix.target }}/release
-
-      - name: Download prebuilt Windows helper binaries
-        uses: actions/download-artifact@v7
-        with:
-          name: windows-binaries-${{ matrix.target }}-helpers
-          path: codex-rs/target/${{ matrix.target }}/release
-
-      - name: Verify binaries
-        shell: bash
-        run: |
-          set -euo pipefail
-          ls -lh target/${{ matrix.target }}/release/codex.exe
-          ls -lh target/${{ matrix.target }}/release/codex-responses-api-proxy.exe
-          ls -lh target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe
-          ls -lh target/${{ matrix.target }}/release/codex-command-runner.exe
-
-      - name: Sign Windows binaries with Azure Trusted Signing
-        uses: ./.github/actions/windows-code-sign
-        with:
-          target: ${{ matrix.target }}
-          client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
-          endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          certificate-profile-name: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
-
-      - name: Stage artifacts
-        shell: bash
-        run: |
-          dest="dist/${{ matrix.target }}"
-          mkdir -p "$dest"
-
-          cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe"
-          cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe"
-          cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
-          cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe"
-
-      - name: Install DotSlash
-        uses: facebook/install-dotslash@v2
-
-      - name: Compress artifacts
-        shell: bash
-        run: |
-          # Path that contains the uncompressed binaries for the current
-          # ${{ matrix.target }}
-          dest="dist/${{ matrix.target }}"
-          repo_root=$PWD
-
-          # For compatibility with environments that lack the `zstd` tool we
-          # additionally create a `.tar.gz` and `.zip` for every Windows binary.
-          # The end result is:
-          #   codex-<target>.zst
-          #   codex-<target>.tar.gz
-          #   codex-<target>.zip
-          for f in "$dest"/*; do
-            base="$(basename "$f")"
-            # Skip files that are already archives (shouldn't happen, but be
-            # safe).
-            if [[ "$base" == *.tar.gz || "$base" == *.zip || "$base" == *.dmg ]]; then
-              continue
-            fi
-
-            # Don't try to compress signature bundles.
-            if [[ "$base" == *.sigstore ]]; then
-              continue
-            fi
-
-            # Create per-binary tar.gz
-            tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"
-
-            # Create zip archive for Windows binaries.
-            # Must run from inside the dest dir so 7z won't embed the
-            # directory path inside the zip.
-            if [[ "$base" == "codex-${{ matrix.target }}.exe" ]]; then
-              # Bundle the sandbox helper binaries into the main codex zip so
-              # WinGet installs include the required helpers next to codex.exe.
-              # Fall back to the single-binary zip if the helpers are missing
-              # to avoid breaking releases.
-              bundle_dir="$(mktemp -d)"
-              runner_src="$dest/codex-command-runner-${{ matrix.target }}.exe"
-              setup_src="$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
-              if [[ -f "$runner_src" && -f "$setup_src" ]]; then
-                cp "$dest/$base" "$bundle_dir/$base"
-                cp "$runner_src" "$bundle_dir/codex-command-runner.exe"
-                cp "$setup_src" "$bundle_dir/codex-windows-sandbox-setup.exe"
-                # Use an absolute path so bundle zips land in the real dist
-                # dir even when 7z runs from a temp directory.
-                (cd "$bundle_dir" && 7z a "$repo_root/$dest/${base}.zip" .)
-              else
-                echo "warning: missing sandbox binaries; falling back to single-binary zip"
-                echo "warning: expected $runner_src and $setup_src"
-                (cd "$dest" && 7z a "${base}.zip" "$base")
-              fi
-              rm -rf "$bundle_dir"
-            else
-              (cd "$dest" && 7z a "${base}.zip" "$base")
-            fi
-
-            # Keep raw executables and produce .zst alongside them.
-            "${GITHUB_WORKSPACE}/.github/workflows/zstd" -T0 -19 "$dest/$base"
-          done
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: ${{ matrix.target }}
-          path: |
-            codex-rs/dist/${{ matrix.target }}/*

.github/workflows/rust-release.yml

@@ -48,7 +48,7 @@ jobs:
   build:
     needs: tag-check
     name: Build - ${{ matrix.runner }} - ${{ matrix.target }}
-    runs-on: ${{ matrix.runs_on || matrix.runner }}
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     permissions:
       contents: read
@@ -57,7 +57,7 @@ jobs:
       run:
         working-directory: codex-rs
     env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
+      CODEX_BWRAP_ENABLE_FFI: ${{ contains(matrix.target, 'unknown-linux') && '1' || '0' }}
 
     strategy:
       fail-fast: false
@@ -75,38 +75,13 @@ jobs:
             target: aarch64-unknown-linux-musl
           - runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
+          - runner: windows-latest
+            target: x86_64-pc-windows-msvc
+          - runner: windows-11-arm
+            target: aarch64-pc-windows-msvc
 
     steps:
       - uses: actions/checkout@v6
-      - name: Print runner specs (Linux)
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          cpu_model="$(lscpu | awk -F: '/Model name/ {gsub(/^[ \t]+/, "", $2); print $2; exit}')"
-          total_ram="$(awk '/MemTotal/ {printf "%.1f GiB\n", $2 / 1024 / 1024}' /proc/meminfo)"
-          echo "Runner: ${RUNNER_NAME:-unknown}"
-          echo "OS: $(uname -a)"
-          echo "CPU model: ${cpu_model}"
-          echo "Logical CPUs: $(nproc)"
-          echo "Total RAM: ${total_ram}"
-          echo "Disk usage:"
-          df -h .
-      - name: Print runner specs (macOS)
-        if: ${{ runner.os == 'macOS' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          total_ram="$(sysctl -n hw.memsize | awk '{printf "%.1f GiB\n", $1 / 1024 / 1024 / 1024}')"
-          echo "Runner: ${RUNNER_NAME:-unknown}"
-          echo "OS: $(sw_vers -productName) $(sw_vers -productVersion)"
-          echo "Hardware model: $(sysctl -n hw.model)"
-          echo "CPU architecture: $(uname -m)"
-          echo "Logical CPUs: $(sysctl -n hw.logicalcpu)"
-          echo "Physical CPUs: $(sysctl -n hw.physicalcpu)"
-          echo "Total RAM: ${total_ram}"
-          echo "Disk usage:"
-          df -h .
       - name: Install Linux bwrap build dependencies
         if: ${{ runner.os == 'Linux' }}
         shell: bash
@@ -123,7 +98,7 @@ jobs:
             sudo apt-get update -y
             sudo DEBIAN_FRONTEND=noninteractive apt-get install -y libubsan1
           fi
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
         with:
           targets: ${{ matrix.target }}
 
@@ -138,6 +113,20 @@ jobs:
           echo "${cargo_home}/bin" >> "$GITHUB_PATH"
           : > "${cargo_home}/config.toml"
 
+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            ${{ github.workspace }}/.cargo-home/bin/
+            ${{ github.workspace }}/.cargo-home/registry/index/
+            ${{ github.workspace }}/.cargo-home/registry/cache/
+            ${{ github.workspace }}/.cargo-home/git/db/
+            ${{ github.workspace }}/codex-rs/target/
+          key: cargo-${{ matrix.runner }}-${{ matrix.target }}-release-${{ hashFiles('**/Cargo.lock') }}
+
       - if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl'}}
         name: Install Zig
         uses: mlugg/setup-zig@v2
@@ -205,14 +194,11 @@ jobs:
       - name: Cargo build
         shell: bash
         run: |
-          cargo build --target ${{ matrix.target }} --release --timings --bin codex --bin codex-responses-api-proxy
-
-      - name: Upload Cargo timings
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-release-${{ matrix.target }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
+          if [[ "${{ contains(matrix.target, 'windows') }}" == 'true' ]]; then
+            cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy --bin codex-windows-sandbox-setup --bin codex-command-runner
+          else
+            cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy
+          fi
 
       - if: ${{ contains(matrix.target, 'linux') }}
         name: Cosign Linux artifacts
@@ -221,6 +207,18 @@ jobs:
           target: ${{ matrix.target }}
           artifacts-dir: ${{ github.workspace }}/codex-rs/target/${{ matrix.target }}/release
 
+      - if: ${{ contains(matrix.target, 'windows') }}
+        name: Sign Windows binaries with Azure Trusted Signing
+        uses: ./.github/actions/windows-code-sign
+        with:
+          target: ${{ matrix.target }}
+          client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
+          endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
+          account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          certificate-profile-name: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
+
       - if: ${{ runner.os == 'macOS' }}
         name: MacOS code signing (binaries)
         uses: ./.github/actions/macos-code-sign
@@ -299,8 +297,15 @@ jobs:
           dest="dist/${{ matrix.target }}"
           mkdir -p "$dest"
 
-          cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}"
-          cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}"
+          if [[ "${{ matrix.runner }}" == windows* ]]; then
+            cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe"
+            cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe"
+            cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
+            cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe"
+          else
+            cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}"
+            cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}"
+          fi
 
           if [[ "${{ matrix.target }}" == *linux* ]]; then
             cp target/${{ matrix.target }}/release/codex.sigstore "$dest/codex-${{ matrix.target }}.sigstore"
@@ -311,18 +316,34 @@ jobs:
             cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg"
           fi
 
+      - if: ${{ matrix.runner == 'windows-11-arm' }}
+        name: Install zstd
+        shell: powershell
+        run: choco install -y zstandard
+
       - name: Compress artifacts
         shell: bash
         run: |
           # Path that contains the uncompressed binaries for the current
           # ${{ matrix.target }}
           dest="dist/${{ matrix.target }}"
+          repo_root=$PWD
+
+          # We want to ship the raw Windows executables in the GitHub Release
+          # in addition to the compressed archives. Keep the originals for
+          # Windows targets; remove them elsewhere to limit the number of
+          # artifacts that end up in the GitHub Release.
+          keep_originals=false
+          if [[ "${{ matrix.runner }}" == windows* ]]; then
+            keep_originals=true
+          fi
 
           # For compatibility with environments that lack the `zstd` tool we
-          # additionally create a `.tar.gz` alongside every binary we publish.
-          # The end result is:
+          # additionally create a `.tar.gz` for all platforms and `.zip` for
+          # Windows alongside every single binary that we publish. The end result is:
           #   codex-<target>.zst          (existing)
           #   codex-<target>.tar.gz       (new)
+          #   codex-<target>.zip          (only for Windows)
 
           # 1. Produce a .tar.gz for every file in the directory *before* we
           #    run `zstd --rm`, because that flag deletes the original files.
@@ -342,9 +363,43 @@ jobs:
             # Create per-binary tar.gz
             tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"
 
-            # Also create .zst and remove the uncompressed binaries to keep
-            # non-Windows artifact directories small.
-            zstd -T0 -19 --rm "$dest/$base"
+            # Create zip archive for Windows binaries
+            # Must run from inside the dest dir so 7z won't
+            # embed the directory path inside the zip.
+            if [[ "${{ matrix.runner }}" == windows* ]]; then
+              if [[ "$base" == "codex-${{ matrix.target }}.exe" ]]; then
+                # Bundle the sandbox helper binaries into the main codex zip so
+                # WinGet installs include the required helpers next to codex.exe.
+                # Fall back to the single-binary zip if the helpers are missing
+                # to avoid breaking releases.
+                bundle_dir="$(mktemp -d)"
+                runner_src="$dest/codex-command-runner-${{ matrix.target }}.exe"
+                setup_src="$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
+                if [[ -f "$runner_src" && -f "$setup_src" ]]; then
+                  cp "$dest/$base" "$bundle_dir/$base"
+                  cp "$runner_src" "$bundle_dir/codex-command-runner.exe"
+                  cp "$setup_src" "$bundle_dir/codex-windows-sandbox-setup.exe"
+                  # Use an absolute path so bundle zips land in the real dist
+                  # dir even when 7z runs from a temp directory.
+                  (cd "$bundle_dir" && 7z a "$repo_root/$dest/${base}.zip" .)
+                else
+                  echo "warning: missing sandbox binaries; falling back to single-binary zip"
+                  echo "warning: expected $runner_src and $setup_src"
+                  (cd "$dest" && 7z a "${base}.zip" "$base")
+                fi
+                rm -rf "$bundle_dir"
+              else
+                (cd "$dest" && 7z a "${base}.zip" "$base")
+              fi
+            fi
+
+            # Also create .zst (existing behaviour) *and* remove the original
+            # uncompressed binary to keep the directory small.
+            zstd_args=(-T0 -19)
+            if [[ "${keep_originals}" == false ]]; then
+              zstd_args+=(--rm)
+            fi
+            zstd "${zstd_args[@]}" "$dest/$base"
           done
 
       - uses: actions/upload-artifact@v6
@@ -355,13 +410,6 @@ jobs:
           path: |
             codex-rs/dist/${{ matrix.target }}/*
 
-  build-windows:
-    needs: tag-check
-    uses: ./.github/workflows/rust-release-windows.yml
-    with:
-      release-lto: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
-    secrets: inherit
-
   shell-tool-mcp:
     name: shell-tool-mcp
     needs: tag-check
@@ -374,7 +422,6 @@ jobs:
   release:
     needs:
       - build
-      - build-windows
       - shell-tool-mcp
     name: release
     runs-on: ubuntu-latest
@@ -423,12 +470,6 @@ jobs:
       - name: Delete entries from dist/ that should not go in the release
         run: |
           rm -rf dist/shell-tool-mcp*
-          rm -rf dist/windows-binaries*
-          # cargo-timing.html appears under multiple target-specific directories.
-          # If included in files: dist/**, release upload races on duplicate
-          # asset names and can fail with 404s.
-          find dist -type f -name 'cargo-timing.html' -delete
-          find dist -type d -empty -delete
 
           ls -R dist/
 
@@ -552,20 +593,18 @@ jobs:
           version="${{ needs.release.outputs.version }}"
           tag="${{ needs.release.outputs.tag }}"
           mkdir -p dist/npm
-          patterns=(
-            "codex-npm-${version}.tgz"
-            "codex-npm-linux-*-${version}.tgz"
-            "codex-npm-darwin-*-${version}.tgz"
-            "codex-npm-win32-*-${version}.tgz"
-            "codex-responses-api-proxy-npm-${version}.tgz"
-            "codex-sdk-npm-${version}.tgz"
-          )
-          for pattern in "${patterns[@]}"; do
-            gh release download "$tag" \
-              --repo "${GITHUB_REPOSITORY}" \
-              --pattern "$pattern" \
-              --dir dist/npm
-          done
+          gh release download "$tag" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "codex-npm-${version}.tgz" \
+            --dir dist/npm
+          gh release download "$tag" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "codex-responses-api-proxy-npm-${version}.tgz" \
+            --dir dist/npm
+          gh release download "$tag" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "codex-sdk-npm-${version}.tgz" \
+            --dir dist/npm
 
       # No NODE_AUTH_TOKEN needed because we use OIDC.
       - name: Publish to npm
@@ -574,59 +613,19 @@ jobs:
           NPM_TAG: ${{ needs.release.outputs.npm_tag }}
         run: |
           set -euo pipefail
-          prefix=""
+          tag_args=()
           if [[ -n "${NPM_TAG}" ]]; then
-            prefix="${NPM_TAG}-"
+            tag_args+=(--tag "${NPM_TAG}")
           fi
 
-          shopt -s nullglob
-          tarballs=(dist/npm/*-"${VERSION}".tgz)
-          if [[ ${#tarballs[@]} -eq 0 ]]; then
-            echo "No npm tarballs found in dist/npm for version ${VERSION}"
-            exit 1
-          fi
+          tarballs=(
+            "codex-npm-${VERSION}.tgz"
+            "codex-responses-api-proxy-npm-${VERSION}.tgz"
+            "codex-sdk-npm-${VERSION}.tgz"
+          )
 
           for tarball in "${tarballs[@]}"; do
-            filename="$(basename "${tarball}")"
-            tag=""
-
-            case "${filename}" in
-              codex-npm-linux-*-"${VERSION}".tgz|codex-npm-darwin-*-"${VERSION}".tgz|codex-npm-win32-*-"${VERSION}".tgz)
-                platform="${filename#codex-npm-}"
-                platform="${platform%-${VERSION}.tgz}"
-                tag="${prefix}${platform}"
-                ;;
-              codex-npm-"${VERSION}".tgz|codex-responses-api-proxy-npm-"${VERSION}".tgz|codex-sdk-npm-"${VERSION}".tgz)
-                tag="${NPM_TAG}"
-                ;;
-              *)
-                echo "Unexpected npm tarball: ${filename}"
-                exit 1
-                ;;
-            esac
-
-            publish_cmd=(npm publish "${GITHUB_WORKSPACE}/${tarball}")
-            if [[ -n "${tag}" ]]; then
-              publish_cmd+=(--tag "${tag}")
-            fi
-
-            echo "+ ${publish_cmd[*]}"
-            set +e
-            publish_output="$("${publish_cmd[@]}" 2>&1)"
-            publish_status=$?
-            set -e
-
-            echo "${publish_output}"
-            if [[ ${publish_status} -eq 0 ]]; then
-              continue
-            fi
-
-            if grep -qiE "previously published|cannot publish over|version already exists" <<< "${publish_output}"; then
-              echo "Skipping already-published package version for ${filename}"
-              continue
-            fi
-
-            exit "${publish_status}"
+            npm publish "${GITHUB_WORKSPACE}/dist/npm/${tarball}" "${tag_args[@]}"
           done
 
   update-branch:

.github/workflows/sdk.yml

@@ -13,13 +13,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - name: Install Linux bwrap build dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          sudo apt-get update -y
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
@@ -31,7 +24,7 @@ jobs:
           node-version: 22
           cache: pnpm
 
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
 
       - name: build codex
         run: cargo build --bin codex

.github/workflows/shell-tool-mcp.yml

@@ -72,8 +72,6 @@ jobs:
     needs: metadata
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
-    env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ contains(needs.metadata.outputs.version, '-alpha') && 'thin' || 'fat' }}
     defaults:
       run:
         working-directory: codex-rs
@@ -105,7 +103,7 @@ jobs:
             sudo DEBIAN_FRONTEND=noninteractive apt-get install -y libubsan1
           fi
 
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
         with:
           targets: ${{ matrix.target }}
 
@@ -251,11 +249,11 @@ jobs:
           set -euo pipefail
           if command -v apt-get >/dev/null 2>&1; then
             apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential bison autoconf gettext libncursesw5-dev
+            DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential bison autoconf gettext
           elif command -v dnf >/dev/null 2>&1; then
-            dnf install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
+            dnf install -y git gcc gcc-c++ make bison autoconf gettext
           elif command -v yum >/dev/null 2>&1; then
-            yum install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
+            yum install -y git gcc gcc-c++ make bison autoconf gettext
           else
             echo "Unsupported package manager in container"
             exit 1
@@ -329,210 +327,6 @@ jobs:
           path: artifacts/**
           if-no-files-found: error
 
-  zsh-linux:
-    name: Build zsh (Linux) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    container:
-      image: ${{ matrix.image }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: ubuntu:24.04
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: ubuntu-22.04
-            image: ubuntu:22.04
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: debian-12
-            image: debian:12
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: debian-11
-            image: debian:11
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: centos-9
-            image: quay.io/centos/centos:stream9
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: arm64v8/ubuntu:24.04
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-22.04
-            image: arm64v8/ubuntu:22.04
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-20.04
-            image: arm64v8/ubuntu:20.04
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: debian-12
-            image: arm64v8/debian:12
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: debian-11
-            image: arm64v8/debian:11
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: centos-9
-            image: quay.io/centos/centos:stream9
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          if command -v apt-get >/dev/null 2>&1; then
-            apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential bison autoconf gettext libncursesw5-dev
-          elif command -v dnf >/dev/null 2>&1; then
-            dnf install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
-          elif command -v yum >/dev/null 2>&1; then
-            yum install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
-          else
-            echo "Unsupported package manager in container"
-            exit 1
-          fi
-
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Build patched zsh
-        shell: bash
-        run: |
-          set -euo pipefail
-          git clone https://git.code.sf.net/p/zsh/code /tmp/zsh
-          cd /tmp/zsh
-          git checkout 77045ef899e53b9598bebc5a41db93a548a40ca6
-          git apply "${GITHUB_WORKSPACE}/shell-tool-mcp/patches/zsh-exec-wrapper.patch"
-          ./Util/preconfig
-          ./configure
-          cores="$(command -v nproc >/dev/null 2>&1 && nproc || getconf _NPROCESSORS_ONLN)"
-          make -j"${cores}"
-
-          dest="${GITHUB_WORKSPACE}/artifacts/vendor/${{ matrix.target }}/zsh/${{ matrix.variant }}"
-          mkdir -p "$dest"
-          cp Src/zsh "$dest/zsh"
-
-      - name: Smoke test zsh exec wrapper
-        shell: bash
-        run: |
-          set -euo pipefail
-          tmpdir="$(mktemp -d)"
-          cat > "$tmpdir/exec-wrapper" <<'EOF'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          : "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
-          printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
-          file="$1"
-          shift
-          if [[ "$#" -eq 0 ]]; then
-            exec "$file"
-          fi
-          arg0="$1"
-          shift
-          exec -a "$arg0" "$file" "$@"
-          EOF
-          chmod +x "$tmpdir/exec-wrapper"
-
-          CODEX_WRAPPER_LOG="$tmpdir/wrapper.log" \
-          EXEC_WRAPPER="$tmpdir/exec-wrapper" \
-          /tmp/zsh/Src/zsh -fc '/bin/echo smoke-zsh' > "$tmpdir/stdout.txt"
-
-          grep -Fx "smoke-zsh" "$tmpdir/stdout.txt"
-          grep -Fx "/bin/echo" "$tmpdir/wrapper.log"
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: shell-tool-mcp-zsh-${{ matrix.target }}-${{ matrix.variant }}
-          path: artifacts/**
-          if-no-files-found: error
-
-  zsh-darwin:
-    name: Build zsh (macOS) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-15-xlarge
-            target: aarch64-apple-darwin
-            variant: macos-15
-          - runner: macos-14
-            target: aarch64-apple-darwin
-            variant: macos-14
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v autoconf >/dev/null 2>&1; then
-            brew install autoconf
-          fi
-
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Build patched zsh
-        shell: bash
-        run: |
-          set -euo pipefail
-          git clone https://git.code.sf.net/p/zsh/code /tmp/zsh
-          cd /tmp/zsh
-          git checkout 77045ef899e53b9598bebc5a41db93a548a40ca6
-          git apply "${GITHUB_WORKSPACE}/shell-tool-mcp/patches/zsh-exec-wrapper.patch"
-          ./Util/preconfig
-          ./configure
-          cores="$(getconf _NPROCESSORS_ONLN)"
-          make -j"${cores}"
-
-          dest="${GITHUB_WORKSPACE}/artifacts/vendor/${{ matrix.target }}/zsh/${{ matrix.variant }}"
-          mkdir -p "$dest"
-          cp Src/zsh "$dest/zsh"
-
-      - name: Smoke test zsh exec wrapper
-        shell: bash
-        run: |
-          set -euo pipefail
-          tmpdir="$(mktemp -d)"
-          cat > "$tmpdir/exec-wrapper" <<'EOF'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          : "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
-          printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
-          file="$1"
-          shift
-          if [[ "$#" -eq 0 ]]; then
-            exec "$file"
-          fi
-          arg0="$1"
-          shift
-          exec -a "$arg0" "$file" "$@"
-          EOF
-          chmod +x "$tmpdir/exec-wrapper"
-
-          CODEX_WRAPPER_LOG="$tmpdir/wrapper.log" \
-          EXEC_WRAPPER="$tmpdir/exec-wrapper" \
-          /tmp/zsh/Src/zsh -fc '/bin/echo smoke-zsh' > "$tmpdir/stdout.txt"
-
-          grep -Fx "smoke-zsh" "$tmpdir/stdout.txt"
-          grep -Fx "/bin/echo" "$tmpdir/wrapper.log"
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: shell-tool-mcp-zsh-${{ matrix.target }}-${{ matrix.variant }}
-          path: artifacts/**
-          if-no-files-found: error
-
   package:
     name: Package npm module
     needs:
@@ -540,8 +334,6 @@ jobs:
       - rust-binaries
       - bash-linux
       - bash-darwin
-      - zsh-linux
-      - zsh-darwin
     runs-on: ubuntu-latest
     env:
       PACKAGE_VERSION: ${{ needs.metadata.outputs.version }}
@@ -615,8 +407,7 @@ jobs:
           chmod +x \
             "$staging"/vendor/*/codex-exec-mcp-server \
             "$staging"/vendor/*/codex-execve-wrapper \
-            "$staging"/vendor/*/bash/*/bash \
-            "$staging"/vendor/*/zsh/*/zsh
+            "$staging"/vendor/*/bash/*/bash
 
       - name: Create npm tarball
         shell: bash

.github/workflows/zstd

@@ -1,46 +0,0 @@
-#!/usr/bin/env dotslash
-
-// This DotSlash file wraps zstd for Windows runners.
-// The upstream release provides win32/win64 binaries; for windows-aarch64 we
-// use the win64 artifact via Windows x64 emulation.
-{
-  "name": "zstd",
-  "platforms": {
-    "windows-x86_64": {
-      "size": 1747181,
-      "hash": "sha256",
-      "digest": "acb4e8111511749dc7a3ebedca9b04190e37a17afeb73f55d4425dbf0b90fad9",
-      "format": "zip",
-      "path": "zstd-v1.5.7-win64/zstd.exe",
-      "providers": [
-        {
-          "url": "https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-v1.5.7-win64.zip"
-        },
-        {
-          "type": "github-release",
-          "repo": "facebook/zstd",
-          "tag": "v1.5.7",
-          "name": "zstd-v1.5.7-win64.zip"
-        }
-      ]
-    },
-    "windows-aarch64": {
-      "size": 1747181,
-      "hash": "sha256",
-      "digest": "acb4e8111511749dc7a3ebedca9b04190e37a17afeb73f55d4425dbf0b90fad9",
-      "format": "zip",
-      "path": "zstd-v1.5.7-win64/zstd.exe",
-      "providers": [
-        {
-          "url": "https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-v1.5.7-win64.zip"
-        },
-        {
-          "type": "github-release",
-          "repo": "facebook/zstd",
-          "tag": "v1.5.7",
-          "name": "zstd-v1.5.7-win64.zip"
-        }
-      ]
-    }
-  }
-}

AGENTS.md

@@ -15,10 +15,6 @@ In the codex-rs folder where the rust code lives:
 - When writing tests, prefer comparing the equality of entire objects over fields one by one.
 - When making a change that adds or changes an API, ensure that the documentation in the `docs/` folder is up to date if applicable.
 - If you change `ConfigToml` or nested config types, run `just write-config-schema` to update `codex-rs/core/config.schema.json`.
-- If you change Rust dependencies (`Cargo.toml` or `Cargo.lock`), run `just bazel-lock-update` from the
-  repo root to refresh `MODULE.bazel.lock`, and include that lockfile update in the same change.
-- After dependency changes, run `just bazel-lock-check` from the repo root so lockfile drift is caught
-  locally before CI.
 - Do not create small helper methods that are referenced only once.
 
 Run `just fmt` (in `codex-rs` directory) automatically after you have finished making Rust code changes; do not ask for approval to run it. Additionally, run the tests:
@@ -64,14 +60,7 @@ See `codex-rs/tui/styles.md`.
 
 ### Snapshot tests
 
-This repo uses snapshot tests (via `insta`), especially in `codex-rs/tui`, to validate rendered output.
-
-**Requirement:** any change that affects user-visible UI (including adding new UI) must include
-corresponding `insta` snapshot coverage (add a new snapshot test if one doesn't exist yet, or
-update the existing snapshot). Review and accept snapshot updates as part of the PR so UI impact
-is easy to review and future diffs stay visual.
-
-When UI or text output changes intentionally, update the snapshots as follows:
+This repo uses snapshot tests (via `insta`), especially in `codex-rs/tui`, to validate rendered output. When UI or text output changes intentionally, update the snapshots as follows:
 
 - Run tests to generate any updated snapshots:
   - `cargo test -p codex-tui`
@@ -169,5 +158,3 @@ These guidelines apply to app-server protocol work in `codex-rs`, especially:
   `just write-app-server-schema`
   (and `just write-app-server-schema --experimental` when experimental API fixtures are affected).
 - Validate with `cargo test -p codex-app-server-protocol`.
-- Avoid boilerplate tests that only assert experimental field markers for individual
-  request fields in `common.rs`; rely on schema generation/tests and behavioral coverage instead.

MODULE.bazel

@@ -96,7 +96,6 @@ crate.annotation(
 inject_repo(crate, "zstd")
 
 bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
-bazel_dep(name = "libcap", version = "2.27.bcr.1")
 
 crate.annotation(
     crate = "bzip2-sys",

NOTICE

@@ -4,6 +4,3 @@ Copyright 2025 OpenAI
 This project includes code derived from [Ratatui](https://github.com/ratatui/ratatui), licensed under the MIT license.
 Copyright (c) 2016-2022 Florian Dehau
 Copyright (c) 2023-2025 The Ratatui Developers
-
-This project includes Meriyah parser assets from [meriyah](https://github.com/meriyah/meriyah), licensed under the ISC license.
-Copyright (c) 2019 and later, KFlash and others.

README.md

@@ -5,7 +5,6 @@
 </p>
 </br>
 If you want Codex in your code editor (VS Code, Cursor, Windsurf), <a href="https://developers.openai.com/codex/ide">install in your IDE.</a>
-</br>If you want the desktop app experience, run <code>codex app</code> or visit <a href="https://chatgpt.com/codex?app-landing-page=true">the Codex App page</a>.
 </br>If you are looking for the <em>cloud-based agent</em> from OpenAI, <strong>Codex Web</strong>, go to <a href="https://chatgpt.com/codex">chatgpt.com/codex</a>.</p>
 
 ---

SECURITY.md

@@ -1,13 +0,0 @@
-# Security Policy
-
-Thank you for helping us keep Codex secure!
-
-## Reporting Security Issues
-
-The security is essential to OpenAI's mission. We appreciate the work of security researchers acting in good faith to identify and responsibly report potential vulnerabilities, helping us maintain strong privacy and security standards for our users and technology.
-
-Our security program is managed through Bugcrowd, and we ask that any validated vulnerabilities be reported via the [Bugcrowd program](https://bugcrowd.com/engagements/openai).
-
-## Vulnerability Disclosure Program
-
-Our Vulnerability Program Guidelines are defined on our [Bugcrowd program page](https://bugcrowd.com/engagements/openai).

codex-cli/bin/codex.js

@@ -3,23 +3,12 @@
 
 import { spawn } from "node:child_process";
 import { existsSync } from "fs";
-import { createRequire } from "node:module";
 import path from "path";
 import { fileURLToPath } from "url";
 
 // __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const require = createRequire(import.meta.url);
-
-const PLATFORM_PACKAGE_BY_TARGET = {
-  "x86_64-unknown-linux-musl": "@openai/codex-linux-x64",
-  "aarch64-unknown-linux-musl": "@openai/codex-linux-arm64",
-  "x86_64-apple-darwin": "@openai/codex-darwin-x64",
-  "aarch64-apple-darwin": "@openai/codex-darwin-arm64",
-  "x86_64-pc-windows-msvc": "@openai/codex-win32-x64",
-  "aarch64-pc-windows-msvc": "@openai/codex-win32-arm64",
-};
 
 const { platform, arch } = process;
 
@@ -70,51 +59,9 @@ if (!targetTriple) {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 
-const platformPackage = PLATFORM_PACKAGE_BY_TARGET[targetTriple];
-if (!platformPackage) {
-  throw new Error(`Unsupported target triple: ${targetTriple}`);
-}
-
-const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
-const localVendorRoot = path.join(__dirname, "..", "vendor");
-const localBinaryPath = path.join(
-  localVendorRoot,
-  targetTriple,
-  "codex",
-  codexBinaryName,
-);
-
-let vendorRoot;
-try {
-  const packageJsonPath = require.resolve(`${platformPackage}/package.json`);
-  vendorRoot = path.join(path.dirname(packageJsonPath), "vendor");
-} catch {
-  if (existsSync(localBinaryPath)) {
-    vendorRoot = localVendorRoot;
-  } else {
-    const packageManager = detectPackageManager();
-    const updateCommand =
-      packageManager === "bun"
-        ? "bun install -g @openai/codex@latest"
-        : "npm install -g @openai/codex@latest";
-    throw new Error(
-      `Missing optional dependency ${platformPackage}. Reinstall Codex: ${updateCommand}`,
-    );
-  }
-}
-
-if (!vendorRoot) {
-  const packageManager = detectPackageManager();
-  const updateCommand =
-    packageManager === "bun"
-      ? "bun install -g @openai/codex@latest"
-      : "npm install -g @openai/codex@latest";
-  throw new Error(
-    `Missing optional dependency ${platformPackage}. Reinstall Codex: ${updateCommand}`,
-  );
-}
-
+const vendorRoot = path.join(__dirname, "..", "vendor");
 const archRoot = path.join(vendorRoot, targetTriple);
+const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
 const binaryPath = path.join(archRoot, "codex", codexBinaryName);
 
 // Use an asynchronous spawn instead of spawnSync so that Node is able to

codex-cli/bin/rg

@@ -4,74 +4,74 @@
   "name": "rg",
   "platforms": {
     "macos-aarch64": {
-      "size": 1777930,
-      "hash": "sha256",
-      "digest": "378e973289176ca0c6054054ee7f631a065874a352bf43f0fa60ef079b6ba715",
+      "size": 1787248,
+      "hash": "blake3",
+      "digest": "8d9942032585ea8ee805937634238d9aee7b210069f4703c88fbe568e26fb78a",
       "format": "tar.gz",
-      "path": "ripgrep-15.1.0-aarch64-apple-darwin/rg",
+      "path": "ripgrep-14.1.1-aarch64-apple-darwin/rg",
       "providers": [
         {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-aarch64-apple-darwin.tar.gz"
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-apple-darwin.tar.gz"
         }
       ]
     },
     "linux-aarch64": {
-      "size": 1869959,
-      "hash": "sha256",
-      "digest": "2b661c6ef508e902f388e9098d9c4c5aca72c87b55922d94abdba830b4dc885e",
+      "size": 2047405,
+      "hash": "blake3",
+      "digest": "0b670b8fa0a3df2762af2fc82cc4932f684ca4c02dbd1260d4f3133fd4b2a515",
       "format": "tar.gz",
-      "path": "ripgrep-15.1.0-aarch64-unknown-linux-gnu/rg",
+      "path": "ripgrep-14.1.1-aarch64-unknown-linux-gnu/rg",
       "providers": [
         {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-aarch64-unknown-linux-gnu.tar.gz"
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-unknown-linux-gnu.tar.gz"
         }
       ]
     },
     "macos-x86_64": {
-      "size": 1894127,
-      "hash": "sha256",
-      "digest": "64811cb24e77cac3057d6c40b63ac9becf9082eedd54ca411b475b755d334882",
+      "size": 2082672,
+      "hash": "blake3",
+      "digest": "e9b862fc8da3127f92791f0ff6a799504154ca9d36c98bf3e60a81c6b1f7289e",
       "format": "tar.gz",
-      "path": "ripgrep-15.1.0-x86_64-apple-darwin/rg",
+      "path": "ripgrep-14.1.1-x86_64-apple-darwin/rg",
       "providers": [
         {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-apple-darwin.tar.gz"
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-apple-darwin.tar.gz"
         }
       ]
     },
     "linux-x86_64": {
-      "size": 2263077,
-      "hash": "sha256",
-      "digest": "1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599",
+      "size": 2566310,
+      "hash": "blake3",
+      "digest": "f73cca4e54d78c31f832c7f6e2c0b4db8b04fa3eaa747915727d570893dbee76",
       "format": "tar.gz",
-      "path": "ripgrep-15.1.0-x86_64-unknown-linux-musl/rg",
+      "path": "ripgrep-14.1.1-x86_64-unknown-linux-musl/rg",
       "providers": [
         {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-unknown-linux-musl.tar.gz"
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz"
         }
       ]
     },
     "windows-x86_64": {
-      "size": 1810687,
-      "hash": "sha256",
-      "digest": "124510b94b6baa3380d051fdf4650eaa80a302c876d611e9dba0b2e18d87493a",
+      "size": 2058893,
+      "hash": "blake3",
+      "digest": "a8ce1a6fed4f8093ee997e57f33254e94b2cd18e26358b09db599c89882eadbd",
       "format": "zip",
-      "path": "ripgrep-15.1.0-x86_64-pc-windows-msvc/rg.exe",
+      "path": "ripgrep-14.1.1-x86_64-pc-windows-msvc/rg.exe",
       "providers": [
         {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-pc-windows-msvc.zip"
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-pc-windows-msvc.zip"
         }
       ]
     },
     "windows-aarch64": {
-      "size": 1675460,
-      "hash": "sha256",
-      "digest": "00d931fb5237c9696ca49308818edb76d8eb6fc132761cb2a1bd616b2df02f8e",
+      "size": 1667740,
+      "hash": "blake3",
+      "digest": "47b971a8c4fca1d23a4e7c19bd4d88465ebc395598458133139406d3bf85f3fa",
       "format": "zip",
-      "path": "ripgrep-15.1.0-aarch64-pc-windows-msvc/rg.exe",
+      "path": "rg.exe",
       "providers": [
         {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-aarch64-pc-windows-msvc.zip"
+          "url": "https://github.com/microsoft/ripgrep-prebuilt/releases/download/v13.0.0-13/ripgrep-v13.0.0-13-aarch64-pc-windows-msvc.zip"
         }
       ]
     }

codex-cli/scripts/README.md

@@ -14,10 +14,6 @@ example, to stage the CLI, responses proxy, and SDK packages for version `0.6.0`
 This downloads the native artifacts once, hydrates `vendor/` for each package, and writes
 tarballs to `dist/npm/`.
 
-When `--package codex` is provided, the staging helper builds the lightweight
-`@openai/codex` meta package plus all platform-native `@openai/codex` variants
-that are later published under platform-specific dist-tags.
-
 If you need to invoke `build_npm_package.py` directly, run
 `codex-cli/scripts/install_native_deps.py` first and pass `--vendor-src` pointing to the
 directory that contains the populated `vendor/` tree.

codex-cli/scripts/build_npm_package.py

@@ -14,78 +14,15 @@ CODEX_CLI_ROOT = SCRIPT_DIR.parent
 REPO_ROOT = CODEX_CLI_ROOT.parent
 RESPONSES_API_PROXY_NPM_ROOT = REPO_ROOT / "codex-rs" / "responses-api-proxy" / "npm"
 CODEX_SDK_ROOT = REPO_ROOT / "sdk" / "typescript"
-CODEX_NPM_NAME = "@openai/codex"
-
-# `npm_name` is the local optional-dependency alias consumed by `bin/codex.js`.
-# The underlying package published to npm is always `@openai/codex`.
-CODEX_PLATFORM_PACKAGES: dict[str, dict[str, str]] = {
-    "codex-linux-x64": {
-        "npm_name": "@openai/codex-linux-x64",
-        "npm_tag": "linux-x64",
-        "target_triple": "x86_64-unknown-linux-musl",
-        "os": "linux",
-        "cpu": "x64",
-    },
-    "codex-linux-arm64": {
-        "npm_name": "@openai/codex-linux-arm64",
-        "npm_tag": "linux-arm64",
-        "target_triple": "aarch64-unknown-linux-musl",
-        "os": "linux",
-        "cpu": "arm64",
-    },
-    "codex-darwin-x64": {
-        "npm_name": "@openai/codex-darwin-x64",
-        "npm_tag": "darwin-x64",
-        "target_triple": "x86_64-apple-darwin",
-        "os": "darwin",
-        "cpu": "x64",
-    },
-    "codex-darwin-arm64": {
-        "npm_name": "@openai/codex-darwin-arm64",
-        "npm_tag": "darwin-arm64",
-        "target_triple": "aarch64-apple-darwin",
-        "os": "darwin",
-        "cpu": "arm64",
-    },
-    "codex-win32-x64": {
-        "npm_name": "@openai/codex-win32-x64",
-        "npm_tag": "win32-x64",
-        "target_triple": "x86_64-pc-windows-msvc",
-        "os": "win32",
-        "cpu": "x64",
-    },
-    "codex-win32-arm64": {
-        "npm_name": "@openai/codex-win32-arm64",
-        "npm_tag": "win32-arm64",
-        "target_triple": "aarch64-pc-windows-msvc",
-        "os": "win32",
-        "cpu": "arm64",
-    },
-}
-
-PACKAGE_EXPANSIONS: dict[str, list[str]] = {
-    "codex": ["codex", *CODEX_PLATFORM_PACKAGES],
-}
 
 PACKAGE_NATIVE_COMPONENTS: dict[str, list[str]] = {
-    "codex": [],
-    "codex-linux-x64": ["codex", "rg"],
-    "codex-linux-arm64": ["codex", "rg"],
-    "codex-darwin-x64": ["codex", "rg"],
-    "codex-darwin-arm64": ["codex", "rg"],
-    "codex-win32-x64": ["codex", "rg", "codex-windows-sandbox-setup", "codex-command-runner"],
-    "codex-win32-arm64": ["codex", "rg", "codex-windows-sandbox-setup", "codex-command-runner"],
+    "codex": ["codex", "rg"],
     "codex-responses-api-proxy": ["codex-responses-api-proxy"],
-    "codex-sdk": [],
+    "codex-sdk": ["codex"],
 }
-
-PACKAGE_TARGET_FILTERS: dict[str, str] = {
-    package_name: package_config["target_triple"]
-    for package_name, package_config in CODEX_PLATFORM_PACKAGES.items()
+WINDOWS_ONLY_COMPONENTS: dict[str, list[str]] = {
+    "codex": ["codex-windows-sandbox-setup", "codex-command-runner"],
 }
-
-PACKAGE_CHOICES = tuple(PACKAGE_NATIVE_COMPONENTS)
-
 COMPONENT_DEST_DIR: dict[str, str] = {
     "codex": "codex",
     "codex-responses-api-proxy": "codex-responses-api-proxy",
@@ -99,7 +36,7 @@ def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="Build or stage the Codex CLI npm package.")
     parser.add_argument(
         "--package",
-        choices=PACKAGE_CHOICES,
+        choices=("codex", "codex-responses-api-proxy", "codex-sdk"),
         default="codex",
         help="Which npm package to stage (default: codex).",
     )
@@ -161,7 +98,6 @@ def main() -> int:
 
         vendor_src = args.vendor_src.resolve() if args.vendor_src else None
         native_components = PACKAGE_NATIVE_COMPONENTS.get(package, [])
-        target_filter = PACKAGE_TARGET_FILTERS.get(package)
 
         if native_components:
             if vendor_src is None:
@@ -172,12 +108,7 @@ def main() -> int:
                     "pointing to a directory containing pre-installed binaries."
                 )
 
-            copy_native_binaries(
-                vendor_src,
-                staging_dir,
-                native_components,
-                target_filter={target_filter} if target_filter else None,
-            )
+            copy_native_binaries(vendor_src, staging_dir, package, native_components)
 
         if release_version:
             staging_dir_str = str(staging_dir)
@@ -194,17 +125,12 @@ def main() -> int:
                     "Verify the responses API proxy:\n"
                     f"    node {staging_dir_str}/bin/codex-responses-api-proxy.js --help\n\n"
                 )
-            elif package in CODEX_PLATFORM_PACKAGES:
-                print(
-                    f"Staged version {version} for release in {staging_dir_str}\n\n"
-                    "Verify native payload contents:\n"
-                    f"    ls {staging_dir_str}/vendor\n\n"
-                )
             else:
                 print(
                     f"Staged version {version} for release in {staging_dir_str}\n\n"
                     "Verify the SDK contents:\n"
                     f"    ls {staging_dir_str}/dist\n"
+                    f"    ls {staging_dir_str}/vendor\n"
                     "    node -e \"import('./dist/index.js').then(() => console.log('ok'))\"\n\n"
                 )
         else:
@@ -234,9 +160,6 @@ def prepare_staging_dir(staging_dir: Path | None) -> tuple[Path, bool]:
 
 
 def stage_sources(staging_dir: Path, version: str, package: str) -> None:
-    package_json: dict
-    package_json_path: Path | None = None
-
     if package == "codex":
         bin_dir = staging_dir / "bin"
         bin_dir.mkdir(parents=True, exist_ok=True)
@@ -250,35 +173,6 @@ def stage_sources(staging_dir: Path, version: str, package: str) -> None:
             shutil.copy2(readme_src, staging_dir / "README.md")
 
         package_json_path = CODEX_CLI_ROOT / "package.json"
-    elif package in CODEX_PLATFORM_PACKAGES:
-        platform_package = CODEX_PLATFORM_PACKAGES[package]
-        platform_npm_tag = platform_package["npm_tag"]
-        platform_version = compute_platform_package_version(version, platform_npm_tag)
-
-        readme_src = REPO_ROOT / "README.md"
-        if readme_src.exists():
-            shutil.copy2(readme_src, staging_dir / "README.md")
-
-        with open(CODEX_CLI_ROOT / "package.json", "r", encoding="utf-8") as fh:
-            codex_package_json = json.load(fh)
-
-        package_json = {
-            "name": CODEX_NPM_NAME,
-            "version": platform_version,
-            "license": codex_package_json.get("license", "Apache-2.0"),
-            "os": [platform_package["os"]],
-            "cpu": [platform_package["cpu"]],
-            "files": ["vendor"],
-            "repository": codex_package_json.get("repository"),
-        }
-
-        engines = codex_package_json.get("engines")
-        if isinstance(engines, dict):
-            package_json["engines"] = engines
-
-        package_manager = codex_package_json.get("packageManager")
-        if isinstance(package_manager, str):
-            package_json["packageManager"] = package_manager
     elif package == "codex-responses-api-proxy":
         bin_dir = staging_dir / "bin"
         bin_dir.mkdir(parents=True, exist_ok=True)
@@ -296,44 +190,27 @@ def stage_sources(staging_dir: Path, version: str, package: str) -> None:
     else:
         raise RuntimeError(f"Unknown package '{package}'.")
 
-    if package_json_path is not None:
-        with open(package_json_path, "r", encoding="utf-8") as fh:
-            package_json = json.load(fh)
-        package_json["version"] = version
+    with open(package_json_path, "r", encoding="utf-8") as fh:
+        package_json = json.load(fh)
+    package_json["version"] = version
 
-    if package == "codex":
-        package_json["files"] = ["bin"]
-        package_json["optionalDependencies"] = {
-            CODEX_PLATFORM_PACKAGES[platform_package]["npm_name"]: (
-                f"npm:{CODEX_NPM_NAME}@"
-                f"{compute_platform_package_version(version, CODEX_PLATFORM_PACKAGES[platform_package]['npm_tag'])}"
-            )
-            for platform_package in PACKAGE_EXPANSIONS["codex"]
-            if platform_package != "codex"
-        }
-
-    elif package == "codex-sdk":
+    if package == "codex-sdk":
         scripts = package_json.get("scripts")
         if isinstance(scripts, dict):
             scripts.pop("prepare", None)
 
-        dependencies = package_json.get("dependencies")
-        if not isinstance(dependencies, dict):
-            dependencies = {}
-        dependencies[CODEX_NPM_NAME] = version
-        package_json["dependencies"] = dependencies
+        files = package_json.get("files")
+        if isinstance(files, list):
+            if "vendor" not in files:
+                files.append("vendor")
+        else:
+            package_json["files"] = ["dist", "vendor"]
 
     with open(staging_dir / "package.json", "w", encoding="utf-8") as out:
         json.dump(package_json, out, indent=2)
         out.write("\n")
 
 
-def compute_platform_package_version(version: str, platform_tag: str) -> str:
-    # npm forbids republishing the same package name/version, so each
-    # platform-specific tarball needs a unique version string.
-    return f"{version}-{platform_tag}"
-
-
 def run_command(cmd: list[str], cwd: Path | None = None) -> None:
     print("+", " ".join(cmd))
     subprocess.run(cmd, cwd=cwd, check=True)
@@ -363,8 +240,8 @@ def stage_codex_sdk_sources(staging_dir: Path) -> None:
 def copy_native_binaries(
     vendor_src: Path,
     staging_dir: Path,
+    package: str,
     components: list[str],
-    target_filter: set[str] | None = None,
 ) -> None:
     vendor_src = vendor_src.resolve()
     if not vendor_src.exists():
@@ -379,18 +256,15 @@ def copy_native_binaries(
         shutil.rmtree(vendor_dest)
     vendor_dest.mkdir(parents=True, exist_ok=True)
 
-    copied_targets: set[str] = set()
-
     for target_dir in vendor_src.iterdir():
         if not target_dir.is_dir():
             continue
 
-        if target_filter is not None and target_dir.name not in target_filter:
-            continue
+        if "windows" in target_dir.name:
+            components_set.update(WINDOWS_ONLY_COMPONENTS.get(package, []))
 
         dest_target_dir = vendor_dest / target_dir.name
         dest_target_dir.mkdir(parents=True, exist_ok=True)
-        copied_targets.add(target_dir.name)
 
         for component in components_set:
             dest_dir_name = COMPONENT_DEST_DIR.get(component)
@@ -408,12 +282,6 @@ def copy_native_binaries(
                 shutil.rmtree(dest_component_dir)
             shutil.copytree(src_component_dir, dest_component_dir)
 
-    if target_filter is not None:
-        missing_targets = sorted(target_filter - copied_targets)
-        if missing_targets:
-            missing_list = ", ".join(missing_targets)
-            raise RuntimeError(f"Missing target directories in vendor source: {missing_list}")
-
 
 def run_npm_pack(staging_dir: Path, output_path: Path) -> Path:
     output_path = output_path.resolve()

codex-rs/BUILD.bazel

@@ -1,3 +1 @@
-exports_files([
-    "node-version.txt",
-])
+

codex-rs/Cargo.lock

@@ -374,9 +374,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "app_test_support"
@@ -423,16 +423,16 @@ dependencies = [
  "objc2-foundation",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
  "wl-clipboard-rs",
  "x11rb",
 ]
 
 [[package]]
 name = "arc-swap"
-version = "1.8.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f3647c145568cec02c42054e07bdf9a5a698e15b466fb2341bfc393cd24aa5"
+checksum = "51d03449bb8ca2cc2ef70869af31463d1ae5ccc8fa3e334b307203fbf815207e"
 dependencies = [
  "rustversion",
 ]
@@ -458,58 +458,6 @@ dependencies = [
  "term",
 ]
 
-[[package]]
-name = "askama"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08e1676b346cadfec169374f949d7490fd80a24193d37d2afce0c047cf695e57"
-dependencies = [
- "askama_macros",
- "itoa",
- "percent-encoding",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "askama_derive"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7661ff56517787343f376f75db037426facd7c8d3049cef8911f1e75016f3a37"
-dependencies = [
- "askama_parser",
- "basic-toml",
- "memchr",
- "proc-macro2",
- "quote",
- "rustc-hash 2.1.1",
- "serde",
- "serde_derive",
- "syn 2.0.114",
-]
-
-[[package]]
-name = "askama_macros"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "713ee4dbfd1eb719c2dab859465b01fa1d21cb566684614a713a6b7a99a4e47b"
-dependencies = [
- "askama_derive",
-]
-
-[[package]]
-name = "askama_parser"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d62d674238a526418b30c0def480d5beadb9d8964e7f38d635b03bf639c704c"
-dependencies = [
- "rustc-hash 2.1.1",
- "serde",
- "serde_derive",
- "unicode-ident",
- "winnow",
-]
-
 [[package]]
 name = "asn1-rs"
 version = "0.7.1"
@@ -1227,9 +1175,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.58"
+version = "4.5.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63be97961acde393029492ce0be7a1af7e323e6bae9511ebfac33751be5e6806"
+checksum = "a75ca66430e33a14957acc24c5077b503e7d374151b2b4b3a10c83b4ceb4be0e"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -1237,9 +1185,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.58"
+version = "4.5.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f13174bda5dfd69d7e947827e5af4b0f2f94a4a3ee92912fba07a66150f21e2"
+checksum = "793207c7fa6300a0608d1080b858e5fdbe713cdc1c8db9fb17777d8a13e63df0"
 dependencies = [
  "anstream",
  "anstyle",
@@ -1271,9 +1219,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "1.0.0"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"
 
 [[package]]
 name = "clipboard-win"
@@ -1318,13 +1266,13 @@ dependencies = [
  "bytes",
  "codex-client",
  "codex-protocol",
- "codex-utils-rustls-provider",
  "eventsource-stream",
  "futures",
  "http 1.4.0",
  "pretty_assertions",
  "regex-lite",
  "reqwest",
+ "rustls",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -1354,6 +1302,7 @@ dependencies = [
  "codex-backend-client",
  "codex-chatgpt",
  "codex-cloud-requirements",
+ "codex-common",
  "codex-core",
  "codex-execpolicy",
  "codex-feedback",
@@ -1363,7 +1312,6 @@ dependencies = [
  "codex-rmcp-client",
  "codex-utils-absolute-path",
  "codex-utils-cargo-bin",
- "codex-utils-cli",
  "codex-utils-json-to-toml",
  "core_test_support",
  "futures",
@@ -1401,7 +1349,6 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "shlex",
  "similar",
  "strum_macros 0.27.2",
  "tempfile",
@@ -1420,8 +1367,6 @@ dependencies = [
  "codex-protocol",
  "serde",
  "serde_json",
- "tungstenite",
- "url",
  "uuid",
 ]
 
@@ -1493,10 +1438,10 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "clap",
+ "codex-common",
  "codex-core",
  "codex-git",
  "codex-utils-cargo-bin",
- "codex-utils-cli",
  "pretty_assertions",
  "serde",
  "serde_json",
@@ -1520,6 +1465,7 @@ dependencies = [
  "codex-arg0",
  "codex-chatgpt",
  "codex-cloud-tasks",
+ "codex-common",
  "codex-core",
  "codex-exec",
  "codex-execpolicy",
@@ -1531,7 +1477,6 @@ dependencies = [
  "codex-stdio-to-uds",
  "codex-tui",
  "codex-utils-cargo-bin",
- "codex-utils-cli",
  "codex-windows-sandbox",
  "libc",
  "owo-colors",
@@ -1575,18 +1520,13 @@ version = "0.0.0"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
- "chrono",
  "codex-backend-client",
  "codex-core",
  "codex-otel",
  "codex-protocol",
- "hmac",
  "pretty_assertions",
- "serde",
  "serde_json",
- "sha2",
  "tempfile",
- "thiserror 2.0.18",
  "tokio",
  "toml 0.9.11+spec-1.1.0",
  "tracing",
@@ -1602,10 +1542,10 @@ dependencies = [
  "chrono",
  "clap",
  "codex-cloud-tasks-client",
+ "codex-common",
  "codex-core",
  "codex-login",
  "codex-tui",
- "codex-utils-cli",
  "crossterm",
  "owo-colors",
  "pretty_assertions",
@@ -1637,22 +1577,17 @@ dependencies = [
 ]
 
 [[package]]
-name = "codex-config"
+name = "codex-common"
 version = "0.0.0"
 dependencies = [
- "anyhow",
- "codex-app-server-protocol",
- "codex-execpolicy",
+ "clap",
+ "codex-core",
+ "codex-lmstudio",
+ "codex-ollama",
  "codex-protocol",
  "codex-utils-absolute-path",
- "futures",
- "multimap",
  "pretty_assertions",
  "serde",
- "serde_json",
- "sha2",
- "thiserror 2.0.18",
- "tokio",
  "toml 0.9.11+spec-1.1.0",
 ]
 
@@ -1662,7 +1597,6 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "arc-swap",
- "askama",
  "assert_cmd",
  "assert_matches",
  "async-channel",
@@ -1678,24 +1612,21 @@ dependencies = [
  "codex-arg0",
  "codex-async-utils",
  "codex-client",
- "codex-config",
+ "codex-core",
  "codex-execpolicy",
  "codex-file-search",
  "codex-git",
- "codex-hooks",
  "codex-keyring-store",
  "codex-network-proxy",
  "codex-otel",
  "codex-protocol",
  "codex-rmcp-client",
- "codex-shell-command",
  "codex-state",
  "codex-utils-absolute-path",
  "codex-utils-cargo-bin",
  "codex-utils-home-dir",
  "codex-utils-pty",
  "codex-utils-readiness",
- "codex-utils-sanitizer",
  "codex-utils-string",
  "codex-windows-sandbox",
  "core-foundation 0.9.4",
@@ -1712,11 +1643,11 @@ dependencies = [
  "include_dir",
  "indexmap 2.13.0",
  "indoc",
- "insta",
  "keyring",
  "landlock",
  "libc",
  "maplit",
+ "multimap",
  "notify",
  "once_cell",
  "openssl-sys",
@@ -1725,6 +1656,7 @@ dependencies = [
  "predicates",
  "pretty_assertions",
  "rand 0.9.2",
+ "regex",
  "regex-lite",
  "reqwest",
  "rmcp",
@@ -1752,6 +1684,8 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "tracing-test",
+ "tree-sitter",
+ "tree-sitter-bash",
  "url",
  "uuid",
  "walkdir",
@@ -1784,14 +1718,11 @@ dependencies = [
  "clap",
  "codex-arg0",
  "codex-cloud-requirements",
+ "codex-common",
  "codex-core",
  "codex-protocol",
  "codex-utils-absolute-path",
  "codex-utils-cargo-bin",
- "codex-utils-cli",
- "codex-utils-elapsed",
- "codex-utils-oss",
- "codex-utils-sandbox-summary",
  "core_test_support",
  "libc",
  "owo-colors",
@@ -1928,21 +1859,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "codex-hooks"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "chrono",
- "codex-protocol",
- "futures",
- "pretty_assertions",
- "serde",
- "serde_json",
- "tempfile",
- "tokio",
-]
-
 [[package]]
 name = "codex-keyring-store"
 version = "0.0.0"
@@ -2012,9 +1928,9 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "codex-arg0",
+ "codex-common",
  "codex-core",
  "codex-protocol",
- "codex-utils-cli",
  "codex-utils-json-to-toml",
  "core_test_support",
  "mcp_test_support",
@@ -2038,10 +1954,8 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "base64 0.22.1",
  "clap",
  "codex-utils-absolute-path",
- "codex-utils-rustls-provider",
  "globset",
  "pretty_assertions",
  "rama-core",
@@ -2211,26 +2125,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "codex-shell-command"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "base64 0.22.1",
- "codex-protocol",
- "codex-utils-absolute-path",
- "once_cell",
- "pretty_assertions",
- "regex",
- "serde",
- "serde_json",
- "shlex",
- "tree-sitter",
- "tree-sitter-bash",
- "url",
- "which",
-]
-
 [[package]]
 name = "codex-state"
 version = "0.0.0"
@@ -2282,6 +2176,7 @@ dependencies = [
  "codex-chatgpt",
  "codex-cli",
  "codex-cloud-requirements",
+ "codex-common",
  "codex-core",
  "codex-feedback",
  "codex-file-search",
@@ -2290,15 +2185,8 @@ dependencies = [
  "codex-protocol",
  "codex-state",
  "codex-utils-absolute-path",
- "codex-utils-approval-presets",
  "codex-utils-cargo-bin",
- "codex-utils-cli",
- "codex-utils-elapsed",
- "codex-utils-fuzzy-match",
- "codex-utils-oss",
  "codex-utils-pty",
- "codex-utils-sandbox-summary",
- "codex-utils-sleep-inhibitor",
  "codex-windows-sandbox",
  "color-eyre",
  "crossterm",
@@ -2344,7 +2232,6 @@ dependencies = [
  "url",
  "uuid",
  "vt100",
- "webbrowser",
  "which",
  "windows-sys 0.52.0",
  "winsplit",
@@ -2364,13 +2251,6 @@ dependencies = [
  "ts-rs",
 ]
 
-[[package]]
-name = "codex-utils-approval-presets"
-version = "0.0.0"
-dependencies = [
- "codex-core",
-]
-
 [[package]]
 name = "codex-utils-cache"
 version = "0.0.0"
@@ -2389,26 +2269,6 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
-[[package]]
-name = "codex-utils-cli"
-version = "0.0.0"
-dependencies = [
- "clap",
- "codex-core",
- "codex-protocol",
- "pretty_assertions",
- "serde",
- "toml 0.9.11+spec-1.1.0",
-]
-
-[[package]]
-name = "codex-utils-elapsed"
-version = "0.0.0"
-
-[[package]]
-name = "codex-utils-fuzzy-match"
-version = "0.0.0"
-
 [[package]]
 name = "codex-utils-home-dir"
 version = "0.0.0"
@@ -2439,15 +2299,6 @@ dependencies = [
  "toml 0.9.11+spec-1.1.0",
 ]
 
-[[package]]
-name = "codex-utils-oss"
-version = "0.0.0"
-dependencies = [
- "codex-core",
- "codex-lmstudio",
- "codex-ollama",
-]
-
 [[package]]
 name = "codex-utils-pty"
 version = "0.0.0"
@@ -2475,38 +2326,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "codex-utils-rustls-provider"
-version = "0.0.0"
-dependencies = [
- "rustls",
-]
-
-[[package]]
-name = "codex-utils-sandbox-summary"
-version = "0.0.0"
-dependencies = [
- "codex-core",
- "codex-utils-absolute-path",
- "pretty_assertions",
-]
-
-[[package]]
-name = "codex-utils-sanitizer"
-version = "0.0.0"
-dependencies = [
- "regex",
-]
-
-[[package]]
-name = "codex-utils-sleep-inhibitor"
-version = "0.0.0"
-dependencies = [
- "core-foundation 0.9.4",
- "libc",
- "tracing",
-]
-
 [[package]]
 name = "codex-utils-string"
 version = "0.0.0"
@@ -2728,7 +2547,6 @@ dependencies = [
  "codex-protocol",
  "codex-utils-absolute-path",
  "codex-utils-cargo-bin",
- "ctor 0.6.3",
  "futures",
  "notify",
  "pretty_assertions",
@@ -3293,7 +3111,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3489,9 +3307,9 @@ checksum = "dbfd0e7fc632dec5e6c9396a27bc9f9975b4e039720e1fd3e34021d3ce28c415"
 
 [[package]]
 name = "env_filter"
-version = "1.0.0"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+checksum = "1bf3c259d255ca70051b30e2e95b5446cdb8949ac4cd22c0d7fd634d89f568e2"
 dependencies = [
  "log",
  "regex",
@@ -3505,9 +3323,9 @@ checksum = "c7f84e12ccf0a7ddc17a6c41c93326024c42920d7ee630d04950e6926645c0fe"
 
 [[package]]
 name = "env_logger"
-version = "0.11.9"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
 dependencies = [
  "anstream",
  "anstyle",
@@ -3538,7 +3356,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4838,9 +4656,9 @@ dependencies = [
 
 [[package]]
 name = "insta"
-version = "1.46.3"
+version = "1.46.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e82db8c87c7f1ccecb34ce0c24399b8a73081427f3c7c50a5d597925356115e4"
+checksum = "38c91d64f9ad425e80200a50a0e8b8a641680b44e33ce832efe5b8bc65161b07"
 dependencies = [
  "console",
  "once_cell",
@@ -4931,7 +4749,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5639,7 +5457,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6205,7 +6023,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.45.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6766,7 +6584,7 @@ dependencies = [
  "once_cell",
  "socket2 0.6.2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -7307,9 +7125,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -7417,9 +7235,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "0.15.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bef41ebc9ebed2c1b1d90203e9d1756091e8a00bbc3107676151f39868ca0ee"
+checksum = "0a621b37a548ff6ab6292d57841eb25785a7f146d89391a19c9f199414bd13da"
 dependencies = [
  "async-trait",
  "axum",
@@ -7453,9 +7271,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "0.15.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e88ad84b8b6237a934534a62b379a5be6388915663c0cc598ceb9b3292bbbfe"
+checksum = "6b79ed92303f9262db79575aa8c3652581668e9d136be6fd0b9ededa78954c95"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2",
@@ -7592,7 +7410,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8969,7 +8787,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.3",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10329,7 +10147,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]

codex-rs/Cargo.toml

@@ -15,10 +15,8 @@ members = [
     "cloud-tasks",
     "cloud-tasks-client",
     "cli",
-    "config",
-    "shell-command",
+    "common",
     "core",
-    "hooks",
     "secrets",
     "exec",
     "exec-server",
@@ -48,16 +46,7 @@ members = [
     "utils/home-dir",
     "utils/pty",
     "utils/readiness",
-    "utils/rustls-provider",
     "utils/string",
-    "utils/cli",
-    "utils/elapsed",
-    "utils/sandbox-summary",
-    "utils/sanitizer",
-    "utils/sleep-inhibitor",
-    "utils/approval-presets",
-    "utils/oss",
-    "utils/fuzzy-match",
     "codex-client",
     "codex-api",
     "state",
@@ -66,7 +55,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.105.0-alpha.6"
+version = "0.0.0"
 # Track the edition for all workspace crates in one place. Individual
 # crates can still override this value, but keeping it here means new
 # crates created with `cargo new -w ...` automatically inherit the 2024
@@ -86,19 +75,19 @@ codex-apply-patch = { path = "apply-patch" }
 codex-arg0 = { path = "arg0" }
 codex-async-utils = { path = "async-utils" }
 codex-backend-client = { path = "backend-client" }
-codex-chatgpt = { path = "chatgpt" }
-codex-cli = { path = "cli" }
-codex-client = { path = "codex-client" }
 codex-cloud-requirements = { path = "cloud-requirements" }
-codex-config = { path = "config" }
+codex-chatgpt = { path = "chatgpt" }
+codex-cli = { path = "cli"}
+codex-client = { path = "codex-client" }
+codex-common = { path = "common" }
 codex-core = { path = "core" }
+codex-secrets = { path = "secrets" }
 codex-exec = { path = "exec" }
 codex-execpolicy = { path = "execpolicy" }
 codex-experimental-api-macros = { path = "codex-experimental-api-macros" }
 codex-feedback = { path = "feedback" }
 codex-file-search = { path = "file-search" }
 codex-git = { path = "utils/git" }
-codex-hooks = { path = "hooks" }
 codex-keyring-store = { path = "keyring-store" }
 codex-linux-sandbox = { path = "linux-sandbox" }
 codex-lmstudio = { path = "lmstudio" }
@@ -111,28 +100,17 @@ codex-process-hardening = { path = "process-hardening" }
 codex-protocol = { path = "protocol" }
 codex-responses-api-proxy = { path = "responses-api-proxy" }
 codex-rmcp-client = { path = "rmcp-client" }
-codex-secrets = { path = "secrets" }
-codex-shell-command = { path = "shell-command" }
 codex-state = { path = "state" }
 codex-stdio-to-uds = { path = "stdio-to-uds" }
 codex-tui = { path = "tui" }
 codex-utils-absolute-path = { path = "utils/absolute-path" }
-codex-utils-approval-presets = { path = "utils/approval-presets" }
 codex-utils-cache = { path = "utils/cache" }
 codex-utils-cargo-bin = { path = "utils/cargo-bin" }
-codex-utils-cli = { path = "utils/cli" }
-codex-utils-elapsed = { path = "utils/elapsed" }
-codex-utils-fuzzy-match = { path = "utils/fuzzy-match" }
-codex-utils-home-dir = { path = "utils/home-dir" }
 codex-utils-image = { path = "utils/image" }
 codex-utils-json-to-toml = { path = "utils/json-to-toml" }
-codex-utils-oss = { path = "utils/oss" }
+codex-utils-home-dir = { path = "utils/home-dir" }
 codex-utils-pty = { path = "utils/pty" }
 codex-utils-readiness = { path = "utils/readiness" }
-codex-utils-rustls-provider = { path = "utils/rustls-provider" }
-codex-utils-sandbox-summary = { path = "utils/sandbox-summary" }
-codex-utils-sanitizer = { path = "utils/sanitizer" }
-codex-utils-sleep-inhibitor = { path = "utils/sleep-inhibitor" }
 codex-utils-string = { path = "utils/string" }
 codex-windows-sandbox = { path = "windows-sandbox-rs" }
 core_test_support = { path = "core/tests/common" }
@@ -145,7 +123,6 @@ allocative = "0.3.3"
 ansi-to-tui = "7.0.0"
 anyhow = "1"
 arboard = { version = "3", features = ["wayland-data-control"] }
-askama = "0.15.4"
 assert_cmd = "2"
 assert_matches = "1.5.0"
 async-channel = "2.3.1"
@@ -160,8 +137,8 @@ chrono = "0.4.43"
 clap = "4"
 clap_complete = "4"
 color-eyre = "0.6.3"
-crossbeam-channel = "0.5.15"
 crossterm = "0.28.1"
+crossbeam-channel = "0.5.15"
 ctor = "0.6.3"
 derive_more = "2"
 diffy = "0.4.2"
@@ -170,7 +147,7 @@ dotenvy = "0.15.7"
 dunce = "1.0.4"
 encoding_rs = "0.8.35"
 env-flags = "0.1.1"
-env_logger = "0.11.9"
+env_logger = "0.11.5"
 eventsource-stream = "0.2.3"
 futures = { version = "0.3", default-features = false }
 globset = "0.4"
@@ -179,11 +156,11 @@ icu_decimal = "2.1"
 icu_locale_core = "2.1"
 icu_provider = { version = "2.1", features = ["sync"] }
 ignore = "0.4.23"
+indoc = "2.0"
 image = { version = "^0.25.9", default-features = false }
 include_dir = "0.7.4"
 indexmap = "2.12.0"
-indoc = "2.0"
-insta = "1.46.3"
+insta = "1.46.0"
 inventory = "0.3.19"
 itertools = "0.14.0"
 keyring = { version = "3.6", default-features = false }
@@ -204,6 +181,7 @@ opentelemetry-appender-tracing = "0.31.0"
 opentelemetry-otlp = "0.31.0"
 opentelemetry-semantic-conventions = "0.31.0"
 opentelemetry_sdk = "0.31.0"
+tracing-opentelemetry = "0.32.0"
 os_info = "3.12.0"
 owo-colors = "4.2.0"
 path-absolutize = "3.1.1"
@@ -215,18 +193,14 @@ pulldown-cmark = "0.10"
 rand = "0.9"
 ratatui = "0.29.0"
 ratatui-macros = "0.6.0"
-regex = "1.12.3"
+regex = "1.12.2"
 regex-lite = "0.1.8"
 reqwest = "0.12"
-rmcp = { version = "0.15.0", default-features = false }
+rmcp = { version = "0.14.0", default-features = false }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 runfiles = { git = "https://github.com/dzbarsky/rules_rust", rev = "b56cbaa8465e74127f1ea216f813cd377295ad81" }
-rustls = { version = "0.23", default-features = false, features = [
-    "ring",
-    "std",
-] }
 schemars = "0.8.22"
 seccompiler = "0.5.0"
-semver = "1.0"
 sentry = "0.46.0"
 serde = "1"
 serde_json = "1"
@@ -236,19 +210,11 @@ serde_yaml = "0.9"
 serial_test = "3.2.0"
 sha1 = "0.10.6"
 sha2 = "0.10"
+semver = "1.0"
 shlex = "1.3.0"
 similar = "2.7.0"
 socket2 = "0.6.1"
-sqlx = { version = "0.8.6", default-features = false, features = [
-    "chrono",
-    "json",
-    "macros",
-    "migrate",
-    "runtime-tokio-rustls",
-    "sqlite",
-    "time",
-    "uuid",
-] }
+sqlx = { version = "0.8.6", default-features = false, features = ["chrono", "json", "macros", "migrate", "runtime-tokio-rustls", "sqlite", "time", "uuid"] }
 starlark = "0.13.0"
 strum = "0.27.2"
 strum_macros = "0.27.2"
@@ -263,23 +229,20 @@ tiny_http = "0.12"
 tokio = "1"
 tokio-stream = "0.1.18"
 tokio-test = "0.4"
-tokio-tungstenite = { version = "0.28.0", features = [
-    "proxy",
-    "rustls-tls-native-roots",
-] }
+tokio-tungstenite = { version = "0.28.0", features = ["proxy", "rustls-tls-native-roots"] }
+tungstenite = { version = "0.27.0", features = ["deflate", "proxy"] }
 tokio-util = "0.7.18"
 toml = "0.9.5"
 toml_edit = "0.24.0"
 tracing = "0.1.44"
 tracing-appender = "0.2.3"
-tracing-opentelemetry = "0.32.0"
 tracing-subscriber = "0.3.22"
 tracing-test = "0.2.5"
 tree-sitter = "0.25.10"
 tree-sitter-bash = "0.25"
+zstd = "0.13"
 tree-sitter-highlight = "0.25.10"
 ts-rs = "11"
-tungstenite = { version = "0.27.0", features = ["deflate", "proxy"] }
 uds_windows = "1.1.0"
 unicode-segmentation = "1.12.0"
 unicode-width = "0.2"
@@ -292,7 +255,6 @@ webbrowser = "1.0"
 which = "8"
 wildmatch = "2.6.1"
 zip = "2.4.2"
-zstd = "0.13"
 
 wiremock = "0.6"
 zeroize = "1.8.2"
@@ -338,12 +300,7 @@ unwrap_used = "deny"
 # cargo-shear cannot see the platform-specific openssl-sys usage, so we
 # silence the false positive here instead of deleting a real dependency.
 [workspace.metadata.cargo-shear]
-ignored = [
-    "icu_provider",
-    "openssl-sys",
-    "codex-utils-readiness",
-    "codex-secrets",
-]
+ignored = ["icu_provider", "openssl-sys", "codex-utils-readiness", "codex-secrets"]
 
 [profile.release]
 lto = "fat"

codex-rs/README.md

@@ -97,5 +97,3 @@ This folder is the root of a Cargo workspace. It contains quite a bit of experim
 - [`exec/`](./exec) "headless" CLI for use in automation.
 - [`tui/`](./tui) CLI that launches a fullscreen TUI built with [Ratatui](https://ratatui.rs/).
 - [`cli/`](./cli) CLI multitool that provides the aforementioned CLIs via subcommands.
-
-If you want to contribute or inspect behavior in detail, start by reading the module-level `README.md` files under each crate and run the project workspace from the top-level `codex-rs` directory so shared config, features, and build scripts stay aligned.

codex-rs/app-server-protocol/Cargo.toml

@@ -20,7 +20,6 @@ codex-utils-absolute-path = { workspace = true }
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-shlex = { workspace = true }
 strum_macros = { workspace = true }
 thiserror = { workspace = true }
 ts-rs = { workspace = true }

codex-rs/app-server-protocol/schema/json/ChatgptAuthTokensRefreshParams.json

@@ -15,7 +15,7 @@
   },
   "properties": {
     "previousAccountId": {
-      "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior auth state did not include a workspace identifier (`chatgpt_account_id`).",
+      "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior ID token did not include a workspace identifier (`chatgpt_account_id`) or when the token could not be parsed.",
       "type": [
         "string",
         "null"

codex-rs/app-server-protocol/schema/json/ChatgptAuthTokensRefreshResponse.json

@@ -4,19 +4,13 @@
     "accessToken": {
       "type": "string"
     },
-    "chatgptAccountId": {
+    "idToken": {
       "type": "string"
-    },
-    "chatgptPlanType": {
-      "type": [
-        "string",
-        "null"
-      ]
     }
   },
   "required": [
     "accessToken",
-    "chatgptAccountId"
+    "idToken"
   ],
   "title": "ChatgptAuthTokensRefreshResponse",
   "type": "object"

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -42,13 +42,6 @@
             "integer",
             "null"
           ]
-        },
-        "threadId": {
-          "description": "Optional thread id used to evaluate app feature gating from that thread's config.",
-          "type": [
-            "string",
-            "null"
-          ]
         }
       },
       "type": "object"
@@ -69,46 +62,13 @@
       "type": "object"
     },
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "AskForApproval2": {
       "description": "Determines the conditions under which the user is consulted to approve running the command proposed by Codex.",
@@ -121,7 +81,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -134,20 +94,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval2",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -758,15 +704,6 @@
       ],
       "type": "object"
     },
-    "HazelnutScope": {
-      "enum": [
-        "example",
-        "workspace-shared",
-        "all-shared",
-        "personal"
-      ],
-      "type": "string"
-    },
     "InitializeCapabilities": {
       "description": "Client-declared capabilities negotiated during initialize.",
       "properties": {
@@ -774,16 +711,6 @@
           "default": false,
           "description": "Opt into receiving experimental API methods and fields.",
           "type": "boolean"
-        },
-        "optOutNotificationMethods": {
-          "description": "Exact notification method names that should be suppressed for this connection (for example `codex/event/session_configured`).",
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
         }
       },
       "type": "object"
@@ -1071,20 +998,13 @@
           "description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE. The access token must contain the same scopes that Codex-managed ChatGPT auth tokens have.",
           "properties": {
             "accessToken": {
-              "description": "Access token (JWT) supplied by the client. This token is used for backend API requests and email extraction.",
+              "description": "Access token (JWT) supplied by the client. This token is used for backend API requests.",
               "type": "string"
             },
-            "chatgptAccountId": {
-              "description": "Workspace/account identifier supplied by the client.",
+            "idToken": {
+              "description": "ID token (JWT) supplied by the client.\n\nThis token is used for identity and account metadata (email, plan type, workspace id).",
               "type": "string"
             },
-            "chatgptPlanType": {
-              "description": "Optional plan type supplied by the client.\n\nWhen `null`, Codex attempts to derive the plan type from access-token claims. If unavailable, the plan defaults to `unknown`.",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "type": {
               "enum": [
                 "chatgptAuthTokens"
@@ -1095,7 +1015,7 @@
           },
           "required": [
             "accessToken",
-            "chatgptAccountId",
+            "idToken",
             "type"
           ],
           "title": "ChatgptAuthTokensLoginAccountParams",
@@ -1184,13 +1104,6 @@
             "null"
           ]
         },
-        "includeHidden": {
-          "description": "When true, include models that are hidden from the default picker list.",
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
         "limit": {
           "description": "Optional page size; defaults to a reasonable server-side value.",
           "format": "uint32",
@@ -1306,113 +1219,6 @@
       ],
       "type": "string"
     },
-    "ProductSurface": {
-      "enum": [
-        "chatgpt",
-        "codex",
-        "api",
-        "atlas"
-      ],
-      "type": "string"
-    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
-    "ReadOnlyAccess2": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccess2Type",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess2",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccess2Type",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess2",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -1513,28 +1319,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "RemoveConversationListenerParams": {
       "properties": {
         "subscriptionId": {
@@ -2114,16 +1898,6 @@
         },
         {
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "readOnly"
@@ -2176,16 +1950,6 @@
               "default": false,
               "type": "boolean"
             },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "workspaceWrite"
@@ -2230,16 +1994,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess2"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -2298,14 +2054,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess2"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"
@@ -2508,38 +2256,20 @@
       "type": "object"
     },
     "SkillsRemoteReadParams": {
-      "properties": {
-        "enabled": {
-          "default": false,
-          "type": "boolean"
-        },
-        "hazelnutScope": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/HazelnutScope"
-            }
-          ],
-          "default": "example"
-        },
-        "productSurface": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ProductSurface"
-            }
-          ],
-          "default": "codex"
-        }
-      },
       "type": "object"
     },
     "SkillsRemoteWriteParams": {
       "properties": {
         "hazelnutId": {
           "type": "string"
+        },
+        "isPreload": {
+          "type": "boolean"
         }
       },
       "required": [
-        "hazelnutId"
+        "hazelnutId",
+        "isPreload"
       ],
       "type": "object"
     },
@@ -2677,13 +2407,6 @@
             "null"
           ]
         },
-        "cwd": {
-          "description": "Optional cwd filter; when set, only threads whose session cwd exactly matches this path are returned.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "limit": {
           "description": "Optional page size; defaults to a reasonable server-side value.",
           "format": "uint32",
@@ -3380,24 +3103,6 @@
           "type": "object"
         }
       ]
-    },
-    "WindowsSandboxSetupMode": {
-      "enum": [
-        "elevated",
-        "unelevated"
-      ],
-      "type": "string"
-    },
-    "WindowsSandboxSetupStartParams": {
-      "properties": {
-        "mode": {
-          "$ref": "#/definitions/WindowsSandboxSetupMode"
-        }
-      },
-      "required": [
-        "mode"
-      ],
-      "type": "object"
     }
   },
   "description": "Request from the client to the server.",
@@ -3722,9 +3427,9 @@
         },
         "method": {
           "enum": [
-            "skills/remote/list"
+            "skills/remote/read"
           ],
-          "title": "Skills/remote/listRequestMethod",
+          "title": "Skills/remote/readRequestMethod",
           "type": "string"
         },
         "params": {
@@ -3736,7 +3441,7 @@
         "method",
         "params"
       ],
-      "title": "Skills/remote/listRequest",
+      "title": "Skills/remote/readRequest",
       "type": "object"
     },
     {
@@ -3746,9 +3451,9 @@
         },
         "method": {
           "enum": [
-            "skills/remote/export"
+            "skills/remote/write"
           ],
-          "title": "Skills/remote/exportRequestMethod",
+          "title": "Skills/remote/writeRequestMethod",
           "type": "string"
         },
         "params": {
@@ -3760,7 +3465,7 @@
         "method",
         "params"
       ],
-      "title": "Skills/remote/exportRequest",
+      "title": "Skills/remote/writeRequest",
       "type": "object"
     },
     {
@@ -4026,30 +3731,6 @@
       "title": "McpServerStatus/listRequest",
       "type": "object"
     },
-    {
-      "properties": {
-        "id": {
-          "$ref": "#/definitions/RequestId"
-        },
-        "method": {
-          "enum": [
-            "windowsSandbox/setupStart"
-          ],
-          "title": "WindowsSandbox/setupStartRequestMethod",
-          "type": "string"
-        },
-        "params": {
-          "$ref": "#/definitions/WindowsSandboxSetupStartParams"
-        }
-      },
-      "required": [
-        "id",
-        "method",
-        "params"
-      ],
-      "title": "WindowsSandbox/setupStartRequest",
-      "type": "object"
-    },
     {
       "properties": {
         "id": {

codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json

@@ -113,13 +113,6 @@
     }
   },
   "properties": {
-    "approvalId": {
-      "description": "Unique identifier for this specific approval callback.\n\nFor regular shell/unified_exec approvals, this is null.\n\nFor zsh-exec-bridge subcommand approvals, multiple callbacks can belong to one parent `itemId`, so `approvalId` is a distinct opaque callback id (a UUID) used to disambiguate routing.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
     "command": {
       "description": "The command to be executed.",
       "type": [

codex-rs/app-server-protocol/schema/json/EventMsg.json

@@ -104,7 +104,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -117,20 +117,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -189,7 +175,6 @@
           "enum": [
             "context_window_exceeded",
             "usage_limit_exceeded",
-            "server_overloaded",
             "internal_server_error",
             "unauthorized",
             "bad_request",
@@ -199,6 +184,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -487,35 +501,6 @@
           "title": "WarningEventMsg",
           "type": "object"
         },
-        {
-          "description": "Model routing changed from the requested model to a different model.",
-          "properties": {
-            "from_model": {
-              "type": "string"
-            },
-            "reason": {
-              "$ref": "#/definitions/ModelRerouteReason"
-            },
-            "to_model": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "model_reroute"
-              ],
-              "title": "ModelRerouteEventMsgType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "from_model",
-            "reason",
-            "to_model",
-            "type"
-          ],
-          "title": "ModelRerouteEventMsg",
-          "type": "object"
-        },
         {
           "description": "Conversation history was compacted (either automatically or manually).",
           "properties": {
@@ -575,9 +560,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_started"
@@ -587,7 +569,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskStartedEventMsg",
@@ -602,9 +583,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_complete"
@@ -614,7 +592,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskCompleteEventMsg",
@@ -663,17 +640,6 @@
             "message": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "type": {
               "enum": [
                 "agent_message"
@@ -921,17 +887,6 @@
             "model_provider_id": {
               "type": "string"
             },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
             "reasoning_effort": {
               "anyOf": [
                 {
@@ -1403,14 +1358,6 @@
               "default": "agent",
               "description": "Where the command originated. Defaults to Agent for backward compatibility."
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
             "stderr": {
               "description": "Captured stderr",
               "type": "string"
@@ -1439,7 +1386,6 @@
             "exit_code",
             "formatted_output",
             "parsed_cmd",
-            "status",
             "stderr",
             "stdout",
             "turn_id",
@@ -1477,15 +1423,8 @@
         },
         {
           "properties": {
-            "approval_id": {
-              "description": "Identifier for this specific approval callback.\n\nWhen absent, the approval is for the command item itself (`call_id`). This is present for subcommand approvals (via execve intercept).",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "call_id": {
-              "description": "Identifier for the associated command execution item.",
+              "description": "Identifier for the associated exec call, if available.",
               "type": "string"
             },
             "command": {
@@ -1499,17 +1438,6 @@
               "description": "The command's working directory.",
               "type": "string"
             },
-            "network_approval_context": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/NetworkApprovalContext"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Optional network context for a blocked request that can be approved."
-            },
             "parsed_cmd": {
               "items": {
                 "$ref": "#/definitions/ParsedCommand"
@@ -1886,14 +1814,6 @@
               "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
               "type": "object"
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
             "stderr": {
               "description": "Captured stderr (parser errors, IO failures, etc.).",
               "type": "string"
@@ -1921,7 +1841,6 @@
           },
           "required": [
             "call_id",
-            "status",
             "stderr",
             "stdout",
             "success",
@@ -2199,12 +2118,6 @@
             "reason": {
               "$ref": "#/definitions/TurnAbortReason"
             },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "type": {
               "enum": [
                 "turn_aborted"
@@ -2963,14 +2876,6 @@
       ],
       "type": "string"
     },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "ExecOutputStream": {
       "enum": [
         "stdout",
@@ -3379,12 +3284,6 @@
       ],
       "type": "string"
     },
-    "ModelRerouteReason": {
-      "enum": [
-        "high_risk_cyber_activity"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "description": "Represents whether outbound network access is available to the agent.",
       "enum": [
@@ -3393,30 +3292,6 @@
       ],
       "type": "string"
     },
-    "NetworkApprovalContext": {
-      "properties": {
-        "host": {
-          "type": "string"
-        },
-        "protocol": {
-          "$ref": "#/definitions/NetworkApprovalProtocol"
-        }
-      },
-      "required": [
-        "host",
-        "protocol"
-      ],
-      "type": "object"
-    },
-    "NetworkApprovalProtocol": {
-      "enum": [
-        "http",
-        "https",
-        "socks5_tcp",
-        "socks5_udp"
-      ],
-      "type": "string"
-    },
     "ParsedCommand": {
       "oneOf": [
         {
@@ -3528,14 +3403,6 @@
         }
       ]
     },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "PlanItemArg": {
       "additionalProperties": false,
       "properties": {
@@ -3578,18 +3445,6 @@
             }
           ]
         },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "plan_type": {
           "anyOf": [
             {
@@ -3652,57 +3507,6 @@
       ],
       "type": "object"
     },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -3783,28 +3587,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "RemoteSkillSummary": {
       "properties": {
         "description": {
@@ -4562,16 +4344,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -4630,14 +4404,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"
@@ -4661,25 +4427,6 @@
         }
       ]
     },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
     "SkillDependencies": {
       "properties": {
         "tools": {
@@ -5467,35 +5214,6 @@
       "title": "WarningEventMsg",
       "type": "object"
     },
-    {
-      "description": "Model routing changed from the requested model to a different model.",
-      "properties": {
-        "from_model": {
-          "type": "string"
-        },
-        "reason": {
-          "$ref": "#/definitions/ModelRerouteReason"
-        },
-        "to_model": {
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "model_reroute"
-          ],
-          "title": "ModelRerouteEventMsgType",
-          "type": "string"
-        }
-      },
-      "required": [
-        "from_model",
-        "reason",
-        "to_model",
-        "type"
-      ],
-      "title": "ModelRerouteEventMsg",
-      "type": "object"
-    },
     {
       "description": "Conversation history was compacted (either automatically or manually).",
       "properties": {
@@ -5555,9 +5273,6 @@
             "null"
           ]
         },
-        "turn_id": {
-          "type": "string"
-        },
         "type": {
           "enum": [
             "task_started"
@@ -5567,7 +5282,6 @@
         }
       },
       "required": [
-        "turn_id",
         "type"
       ],
       "title": "TaskStartedEventMsg",
@@ -5582,9 +5296,6 @@
             "null"
           ]
         },
-        "turn_id": {
-          "type": "string"
-        },
         "type": {
           "enum": [
             "task_complete"
@@ -5594,7 +5305,6 @@
         }
       },
       "required": [
-        "turn_id",
         "type"
       ],
       "title": "TaskCompleteEventMsg",
@@ -5643,17 +5353,6 @@
         "message": {
           "type": "string"
         },
-        "phase": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/MessagePhase"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null
-        },
         "type": {
           "enum": [
             "agent_message"
@@ -5901,17 +5600,6 @@
         "model_provider_id": {
           "type": "string"
         },
-        "network_proxy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/SessionNetworkProxyRuntime"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-        },
         "reasoning_effort": {
           "anyOf": [
             {
@@ -6383,14 +6071,6 @@
           "default": "agent",
           "description": "Where the command originated. Defaults to Agent for backward compatibility."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ExecCommandStatus"
-            }
-          ],
-          "description": "Completion status for this command execution."
-        },
         "stderr": {
           "description": "Captured stderr",
           "type": "string"
@@ -6419,7 +6099,6 @@
         "exit_code",
         "formatted_output",
         "parsed_cmd",
-        "status",
         "stderr",
         "stdout",
         "turn_id",
@@ -6457,15 +6136,8 @@
     },
     {
       "properties": {
-        "approval_id": {
-          "description": "Identifier for this specific approval callback.\n\nWhen absent, the approval is for the command item itself (`call_id`). This is present for subcommand approvals (via execve intercept).",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "call_id": {
-          "description": "Identifier for the associated command execution item.",
+          "description": "Identifier for the associated exec call, if available.",
           "type": "string"
         },
         "command": {
@@ -6479,17 +6151,6 @@
           "description": "The command's working directory.",
           "type": "string"
         },
-        "network_approval_context": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/NetworkApprovalContext"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "Optional network context for a blocked request that can be approved."
-        },
         "parsed_cmd": {
           "items": {
             "$ref": "#/definitions/ParsedCommand"
@@ -6866,14 +6527,6 @@
           "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
           "type": "object"
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/PatchApplyStatus"
-            }
-          ],
-          "description": "Completion status for this patch application."
-        },
         "stderr": {
           "description": "Captured stderr (parser errors, IO failures, etc.).",
           "type": "string"
@@ -6901,7 +6554,6 @@
       },
       "required": [
         "call_id",
-        "status",
         "stderr",
         "stdout",
         "success",
@@ -7179,12 +6831,6 @@
         "reason": {
           "$ref": "#/definitions/TurnAbortReason"
         },
-        "turn_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "type": {
           "enum": [
             "turn_aborted"
@@ -7934,4 +7580,4 @@
     }
   ],
   "title": "EventMsg"
-}
+}

codex-rs/app-server-protocol/schema/json/ExecCommandApprovalParams.json

@@ -117,13 +117,6 @@
     }
   },
   "properties": {
-    "approvalId": {
-      "description": "Identifier for this specific approval callback.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
     "callId": {
       "description": "Use to correlate this with [codex_core::protocol::ExecCommandBeginEvent] and [codex_core::protocol::ExecCommandEndEvent].",
       "type": "string"

codex-rs/app-server-protocol/schema/json/FuzzyFileSearchSessionCompletedNotification.json

@@ -1,13 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "properties": {
-    "sessionId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "sessionId"
-  ],
-  "title": "FuzzyFileSearchSessionCompletedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/FuzzyFileSearchSessionUpdatedNotification.json

@@ -1,63 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "FuzzyFileSearchResult": {
-      "description": "Superset of [`codex_file_search::FileMatch`]",
-      "properties": {
-        "file_name": {
-          "type": "string"
-        },
-        "indices": {
-          "items": {
-            "format": "uint32",
-            "minimum": 0.0,
-            "type": "integer"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "path": {
-          "type": "string"
-        },
-        "root": {
-          "type": "string"
-        },
-        "score": {
-          "format": "uint32",
-          "minimum": 0.0,
-          "type": "integer"
-        }
-      },
-      "required": [
-        "file_name",
-        "path",
-        "root",
-        "score"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "files": {
-      "items": {
-        "$ref": "#/definitions/FuzzyFileSearchResult"
-      },
-      "type": "array"
-    },
-    "query": {
-      "type": "string"
-    },
-    "sessionId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "files",
-    "query",
-    "sessionId"
-  ],
-  "title": "FuzzyFileSearchSessionUpdatedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/ServerRequest.json

@@ -41,7 +41,7 @@
     "ChatgptAuthTokensRefreshParams": {
       "properties": {
         "previousAccountId": {
-          "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior auth state did not include a workspace identifier (`chatgpt_account_id`).",
+          "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior ID token did not include a workspace identifier (`chatgpt_account_id`) or when the token could not be parsed.",
           "type": [
             "string",
             "null"
@@ -179,13 +179,6 @@
     },
     "CommandExecutionRequestApprovalParams": {
       "properties": {
-        "approvalId": {
-          "description": "Unique identifier for this specific approval callback.\n\nFor regular shell/unified_exec approvals, this is null.\n\nFor zsh-exec-bridge subcommand approvals, multiple callbacks can belong to one parent `itemId`, so `approvalId` is a distinct opaque callback id (a UUID) used to disambiguate routing.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "command": {
           "description": "The command to be executed.",
           "type": [
@@ -271,13 +264,6 @@
     },
     "ExecCommandApprovalParams": {
       "properties": {
-        "approvalId": {
-          "description": "Identifier for this specific approval callback.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "callId": {
           "description": "Use to correlate this with [codex_core::protocol::ExecCommandBeginEvent] and [codex_core::protocol::ExecCommandEndEvent].",
           "type": "string"

codex-rs/app-server-protocol/schema/json/v1/ExecOneOffCommandParams.json

@@ -13,57 +13,6 @@
       ],
       "type": "string"
     },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "SandboxPolicy": {
       "description": "Determines execution restrictions for model shell commands.",
       "oneOf": [
@@ -85,16 +34,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -153,14 +94,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"

codex-rs/app-server-protocol/schema/json/v1/ForkConversationParams.json

@@ -12,7 +12,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -25,20 +25,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -128,28 +114,6 @@
       },
       "type": "object"
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "SandboxMode": {
       "enum": [
         "read-only",

codex-rs/app-server-protocol/schema/json/v1/ForkConversationResponse.json

@@ -104,7 +104,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -117,20 +117,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -189,7 +175,6 @@
           "enum": [
             "context_window_exceeded",
             "usage_limit_exceeded",
-            "server_overloaded",
             "internal_server_error",
             "unauthorized",
             "bad_request",
@@ -199,6 +184,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -487,35 +501,6 @@
           "title": "WarningEventMsg",
           "type": "object"
         },
-        {
-          "description": "Model routing changed from the requested model to a different model.",
-          "properties": {
-            "from_model": {
-              "type": "string"
-            },
-            "reason": {
-              "$ref": "#/definitions/ModelRerouteReason"
-            },
-            "to_model": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "model_reroute"
-              ],
-              "title": "ModelRerouteEventMsgType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "from_model",
-            "reason",
-            "to_model",
-            "type"
-          ],
-          "title": "ModelRerouteEventMsg",
-          "type": "object"
-        },
         {
           "description": "Conversation history was compacted (either automatically or manually).",
           "properties": {
@@ -575,9 +560,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_started"
@@ -587,7 +569,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskStartedEventMsg",
@@ -602,9 +583,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_complete"
@@ -614,7 +592,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskCompleteEventMsg",
@@ -663,17 +640,6 @@
             "message": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "type": {
               "enum": [
                 "agent_message"
@@ -921,17 +887,6 @@
             "model_provider_id": {
               "type": "string"
             },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
             "reasoning_effort": {
               "anyOf": [
                 {
@@ -1403,14 +1358,6 @@
               "default": "agent",
               "description": "Where the command originated. Defaults to Agent for backward compatibility."
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
             "stderr": {
               "description": "Captured stderr",
               "type": "string"
@@ -1439,7 +1386,6 @@
             "exit_code",
             "formatted_output",
             "parsed_cmd",
-            "status",
             "stderr",
             "stdout",
             "turn_id",
@@ -1477,15 +1423,8 @@
         },
         {
           "properties": {
-            "approval_id": {
-              "description": "Identifier for this specific approval callback.\n\nWhen absent, the approval is for the command item itself (`call_id`). This is present for subcommand approvals (via execve intercept).",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "call_id": {
-              "description": "Identifier for the associated command execution item.",
+              "description": "Identifier for the associated exec call, if available.",
               "type": "string"
             },
             "command": {
@@ -1499,17 +1438,6 @@
               "description": "The command's working directory.",
               "type": "string"
             },
-            "network_approval_context": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/NetworkApprovalContext"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Optional network context for a blocked request that can be approved."
-            },
             "parsed_cmd": {
               "items": {
                 "$ref": "#/definitions/ParsedCommand"
@@ -1886,14 +1814,6 @@
               "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
               "type": "object"
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
             "stderr": {
               "description": "Captured stderr (parser errors, IO failures, etc.).",
               "type": "string"
@@ -1921,7 +1841,6 @@
           },
           "required": [
             "call_id",
-            "status",
             "stderr",
             "stdout",
             "success",
@@ -2199,12 +2118,6 @@
             "reason": {
               "$ref": "#/definitions/TurnAbortReason"
             },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "type": {
               "enum": [
                 "turn_aborted"
@@ -2963,14 +2876,6 @@
       ],
       "type": "string"
     },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "ExecOutputStream": {
       "enum": [
         "stdout",
@@ -3379,12 +3284,6 @@
       ],
       "type": "string"
     },
-    "ModelRerouteReason": {
-      "enum": [
-        "high_risk_cyber_activity"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "description": "Represents whether outbound network access is available to the agent.",
       "enum": [
@@ -3393,30 +3292,6 @@
       ],
       "type": "string"
     },
-    "NetworkApprovalContext": {
-      "properties": {
-        "host": {
-          "type": "string"
-        },
-        "protocol": {
-          "$ref": "#/definitions/NetworkApprovalProtocol"
-        }
-      },
-      "required": [
-        "host",
-        "protocol"
-      ],
-      "type": "object"
-    },
-    "NetworkApprovalProtocol": {
-      "enum": [
-        "http",
-        "https",
-        "socks5_tcp",
-        "socks5_udp"
-      ],
-      "type": "string"
-    },
     "ParsedCommand": {
       "oneOf": [
         {
@@ -3528,14 +3403,6 @@
         }
       ]
     },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "PlanItemArg": {
       "additionalProperties": false,
       "properties": {
@@ -3578,18 +3445,6 @@
             }
           ]
         },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "plan_type": {
           "anyOf": [
             {
@@ -3652,57 +3507,6 @@
       ],
       "type": "object"
     },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -3783,28 +3587,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "RemoteSkillSummary": {
       "properties": {
         "description": {
@@ -4562,16 +4344,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -4630,14 +4404,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"
@@ -4661,25 +4427,6 @@
         }
       ]
     },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
     "SkillDependencies": {
       "properties": {
         "tools": {
@@ -5439,4 +5186,4 @@
   ],
   "title": "ForkConversationResponse",
   "type": "object"
-}
+}

codex-rs/app-server-protocol/schema/json/v1/GetConversationSummaryResponse.json

@@ -113,8 +113,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },

codex-rs/app-server-protocol/schema/json/v1/GetUserSavedConfigResponse.json

@@ -16,7 +16,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -29,20 +29,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -154,28 +140,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "SandboxMode": {
       "enum": [
         "read-only",

codex-rs/app-server-protocol/schema/json/v1/InitializeParams.json

@@ -29,16 +29,6 @@
           "default": false,
           "description": "Opt into receiving experimental API methods and fields.",
           "type": "boolean"
-        },
-        "optOutNotificationMethods": {
-          "description": "Exact notification method names that should be suppressed for this connection (for example `codex/event/session_configured`).",
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
         }
       },
       "type": "object"

codex-rs/app-server-protocol/schema/json/v1/ListConversationsResponse.json

@@ -113,8 +113,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },

codex-rs/app-server-protocol/schema/json/v1/NewConversationParams.json

@@ -12,7 +12,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -25,20 +25,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -48,28 +34,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "SandboxMode": {
       "enum": [
         "read-only",

codex-rs/app-server-protocol/schema/json/v1/ResumeConversationParams.json

@@ -12,7 +12,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -25,20 +25,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -451,28 +437,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "ResponseItem": {
       "oneOf": [
         {

codex-rs/app-server-protocol/schema/json/v1/ResumeConversationResponse.json

@@ -104,7 +104,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -117,20 +117,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -189,7 +175,6 @@
           "enum": [
             "context_window_exceeded",
             "usage_limit_exceeded",
-            "server_overloaded",
             "internal_server_error",
             "unauthorized",
             "bad_request",
@@ -199,6 +184,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -487,35 +501,6 @@
           "title": "WarningEventMsg",
           "type": "object"
         },
-        {
-          "description": "Model routing changed from the requested model to a different model.",
-          "properties": {
-            "from_model": {
-              "type": "string"
-            },
-            "reason": {
-              "$ref": "#/definitions/ModelRerouteReason"
-            },
-            "to_model": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "model_reroute"
-              ],
-              "title": "ModelRerouteEventMsgType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "from_model",
-            "reason",
-            "to_model",
-            "type"
-          ],
-          "title": "ModelRerouteEventMsg",
-          "type": "object"
-        },
         {
           "description": "Conversation history was compacted (either automatically or manually).",
           "properties": {
@@ -575,9 +560,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_started"
@@ -587,7 +569,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskStartedEventMsg",
@@ -602,9 +583,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_complete"
@@ -614,7 +592,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskCompleteEventMsg",
@@ -663,17 +640,6 @@
             "message": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "type": {
               "enum": [
                 "agent_message"
@@ -921,17 +887,6 @@
             "model_provider_id": {
               "type": "string"
             },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
             "reasoning_effort": {
               "anyOf": [
                 {
@@ -1403,14 +1358,6 @@
               "default": "agent",
               "description": "Where the command originated. Defaults to Agent for backward compatibility."
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
             "stderr": {
               "description": "Captured stderr",
               "type": "string"
@@ -1439,7 +1386,6 @@
             "exit_code",
             "formatted_output",
             "parsed_cmd",
-            "status",
             "stderr",
             "stdout",
             "turn_id",
@@ -1477,15 +1423,8 @@
         },
         {
           "properties": {
-            "approval_id": {
-              "description": "Identifier for this specific approval callback.\n\nWhen absent, the approval is for the command item itself (`call_id`). This is present for subcommand approvals (via execve intercept).",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "call_id": {
-              "description": "Identifier for the associated command execution item.",
+              "description": "Identifier for the associated exec call, if available.",
               "type": "string"
             },
             "command": {
@@ -1499,17 +1438,6 @@
               "description": "The command's working directory.",
               "type": "string"
             },
-            "network_approval_context": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/NetworkApprovalContext"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Optional network context for a blocked request that can be approved."
-            },
             "parsed_cmd": {
               "items": {
                 "$ref": "#/definitions/ParsedCommand"
@@ -1886,14 +1814,6 @@
               "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
               "type": "object"
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
             "stderr": {
               "description": "Captured stderr (parser errors, IO failures, etc.).",
               "type": "string"
@@ -1921,7 +1841,6 @@
           },
           "required": [
             "call_id",
-            "status",
             "stderr",
             "stdout",
             "success",
@@ -2199,12 +2118,6 @@
             "reason": {
               "$ref": "#/definitions/TurnAbortReason"
             },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "type": {
               "enum": [
                 "turn_aborted"
@@ -2963,14 +2876,6 @@
       ],
       "type": "string"
     },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "ExecOutputStream": {
       "enum": [
         "stdout",
@@ -3379,12 +3284,6 @@
       ],
       "type": "string"
     },
-    "ModelRerouteReason": {
-      "enum": [
-        "high_risk_cyber_activity"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "description": "Represents whether outbound network access is available to the agent.",
       "enum": [
@@ -3393,30 +3292,6 @@
       ],
       "type": "string"
     },
-    "NetworkApprovalContext": {
-      "properties": {
-        "host": {
-          "type": "string"
-        },
-        "protocol": {
-          "$ref": "#/definitions/NetworkApprovalProtocol"
-        }
-      },
-      "required": [
-        "host",
-        "protocol"
-      ],
-      "type": "object"
-    },
-    "NetworkApprovalProtocol": {
-      "enum": [
-        "http",
-        "https",
-        "socks5_tcp",
-        "socks5_udp"
-      ],
-      "type": "string"
-    },
     "ParsedCommand": {
       "oneOf": [
         {
@@ -3528,14 +3403,6 @@
         }
       ]
     },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "PlanItemArg": {
       "additionalProperties": false,
       "properties": {
@@ -3578,18 +3445,6 @@
             }
           ]
         },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "plan_type": {
           "anyOf": [
             {
@@ -3652,57 +3507,6 @@
       ],
       "type": "object"
     },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -3783,28 +3587,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "RemoteSkillSummary": {
       "properties": {
         "description": {
@@ -4562,16 +4344,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -4630,14 +4404,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"
@@ -4661,25 +4427,6 @@
         }
       ]
     },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
     "SkillDependencies": {
       "properties": {
         "tools": {
@@ -5439,4 +5186,4 @@
   ],
   "title": "ResumeConversationResponse",
   "type": "object"
-}
+}

codex-rs/app-server-protocol/schema/json/v1/SendUserTurnParams.json

@@ -16,7 +16,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -29,20 +29,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -156,57 +142,6 @@
       ],
       "type": "string"
     },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -239,28 +174,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "SandboxPolicy": {
       "description": "Determines execution restrictions for model shell commands.",
       "oneOf": [
@@ -282,16 +195,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -350,14 +255,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"

codex-rs/app-server-protocol/schema/json/v1/SessionConfiguredNotification.json

@@ -104,7 +104,7 @@
           "type": "string"
         },
         {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
           "enum": [
             "on-failure"
           ],
@@ -117,20 +117,6 @@
           ],
           "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "description": "Fine-grained rejection controls for approval prompts.\n\nWhen a field is `true`, prompts of that category are automatically rejected instead of shown to the user.",
-          "properties": {
-            "reject": {
-              "$ref": "#/definitions/RejectConfig"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        },
         {
           "description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
           "enum": [
@@ -189,7 +175,6 @@
           "enum": [
             "context_window_exceeded",
             "usage_limit_exceeded",
-            "server_overloaded",
             "internal_server_error",
             "unauthorized",
             "bad_request",
@@ -199,6 +184,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -487,35 +501,6 @@
           "title": "WarningEventMsg",
           "type": "object"
         },
-        {
-          "description": "Model routing changed from the requested model to a different model.",
-          "properties": {
-            "from_model": {
-              "type": "string"
-            },
-            "reason": {
-              "$ref": "#/definitions/ModelRerouteReason"
-            },
-            "to_model": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "model_reroute"
-              ],
-              "title": "ModelRerouteEventMsgType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "from_model",
-            "reason",
-            "to_model",
-            "type"
-          ],
-          "title": "ModelRerouteEventMsg",
-          "type": "object"
-        },
         {
           "description": "Conversation history was compacted (either automatically or manually).",
           "properties": {
@@ -575,9 +560,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_started"
@@ -587,7 +569,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskStartedEventMsg",
@@ -602,9 +583,6 @@
                 "null"
               ]
             },
-            "turn_id": {
-              "type": "string"
-            },
             "type": {
               "enum": [
                 "task_complete"
@@ -614,7 +592,6 @@
             }
           },
           "required": [
-            "turn_id",
             "type"
           ],
           "title": "TaskCompleteEventMsg",
@@ -663,17 +640,6 @@
             "message": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "type": {
               "enum": [
                 "agent_message"
@@ -921,17 +887,6 @@
             "model_provider_id": {
               "type": "string"
             },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
             "reasoning_effort": {
               "anyOf": [
                 {
@@ -1403,14 +1358,6 @@
               "default": "agent",
               "description": "Where the command originated. Defaults to Agent for backward compatibility."
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
             "stderr": {
               "description": "Captured stderr",
               "type": "string"
@@ -1439,7 +1386,6 @@
             "exit_code",
             "formatted_output",
             "parsed_cmd",
-            "status",
             "stderr",
             "stdout",
             "turn_id",
@@ -1477,15 +1423,8 @@
         },
         {
           "properties": {
-            "approval_id": {
-              "description": "Identifier for this specific approval callback.\n\nWhen absent, the approval is for the command item itself (`call_id`). This is present for subcommand approvals (via execve intercept).",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "call_id": {
-              "description": "Identifier for the associated command execution item.",
+              "description": "Identifier for the associated exec call, if available.",
               "type": "string"
             },
             "command": {
@@ -1499,17 +1438,6 @@
               "description": "The command's working directory.",
               "type": "string"
             },
-            "network_approval_context": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/NetworkApprovalContext"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Optional network context for a blocked request that can be approved."
-            },
             "parsed_cmd": {
               "items": {
                 "$ref": "#/definitions/ParsedCommand"
@@ -1886,14 +1814,6 @@
               "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
               "type": "object"
             },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
             "stderr": {
               "description": "Captured stderr (parser errors, IO failures, etc.).",
               "type": "string"
@@ -1921,7 +1841,6 @@
           },
           "required": [
             "call_id",
-            "status",
             "stderr",
             "stdout",
             "success",
@@ -2199,12 +2118,6 @@
             "reason": {
               "$ref": "#/definitions/TurnAbortReason"
             },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
             "type": {
               "enum": [
                 "turn_aborted"
@@ -2963,14 +2876,6 @@
       ],
       "type": "string"
     },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "ExecOutputStream": {
       "enum": [
         "stdout",
@@ -3379,12 +3284,6 @@
       ],
       "type": "string"
     },
-    "ModelRerouteReason": {
-      "enum": [
-        "high_risk_cyber_activity"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "description": "Represents whether outbound network access is available to the agent.",
       "enum": [
@@ -3393,30 +3292,6 @@
       ],
       "type": "string"
     },
-    "NetworkApprovalContext": {
-      "properties": {
-        "host": {
-          "type": "string"
-        },
-        "protocol": {
-          "$ref": "#/definitions/NetworkApprovalProtocol"
-        }
-      },
-      "required": [
-        "host",
-        "protocol"
-      ],
-      "type": "object"
-    },
-    "NetworkApprovalProtocol": {
-      "enum": [
-        "http",
-        "https",
-        "socks5_tcp",
-        "socks5_udp"
-      ],
-      "type": "string"
-    },
     "ParsedCommand": {
       "oneOf": [
         {
@@ -3528,14 +3403,6 @@
         }
       ]
     },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
     "PlanItemArg": {
       "additionalProperties": false,
       "properties": {
@@ -3578,18 +3445,6 @@
             }
           ]
         },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "plan_type": {
           "anyOf": [
             {
@@ -3652,57 +3507,6 @@
       ],
       "type": "object"
     },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -3783,28 +3587,6 @@
         }
       ]
     },
-    "RejectConfig": {
-      "properties": {
-        "mcp_elicitations": {
-          "description": "Reject MCP elicitation prompts.",
-          "type": "boolean"
-        },
-        "rules": {
-          "description": "Reject prompts triggered by execpolicy `prompt` rules.",
-          "type": "boolean"
-        },
-        "sandbox_approval": {
-          "description": "Reject approval prompts related to sandbox escalation.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "mcp_elicitations",
-        "rules",
-        "sandbox_approval"
-      ],
-      "type": "object"
-    },
     "RemoteSkillSummary": {
       "properties": {
         "description": {
@@ -4562,16 +4344,8 @@
           "type": "object"
         },
         {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "read-only"
@@ -4630,14 +4404,6 @@
               "description": "When set to `true`, outbound network access is allowed. `false` by default.",
               "type": "boolean"
             },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
             "type": {
               "enum": [
                 "workspace-write"
@@ -4661,25 +4427,6 @@
         }
       ]
     },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
     "SkillDependencies": {
       "properties": {
         "tools": {
@@ -5461,4 +5208,4 @@
   ],
   "title": "SessionConfiguredNotification",
   "type": "object"
-}
+}

codex-rs/app-server-protocol/schema/json/v2/AccountRateLimitsUpdatedNotification.json

@@ -48,18 +48,6 @@
             }
           ]
         },
-        "limitId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limitName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "planType": {
           "anyOf": [
             {

codex-rs/app-server-protocol/schema/json/v2/AppListUpdatedNotification.json

@@ -1,71 +1,9 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
-    "AppBranding": {
-      "description": "EXPERIMENTAL - app metadata returned by app-list APIs.",
-      "properties": {
-        "category": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "developer": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "isDiscoverableApp": {
-          "type": "boolean"
-        },
-        "privacyPolicy": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "termsOfService": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "website": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      },
-      "required": [
-        "isDiscoverableApp"
-      ],
-      "type": "object"
-    },
     "AppInfo": {
       "description": "EXPERIMENTAL - app metadata returned by app-list APIs.",
       "properties": {
-        "appMetadata": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/AppMetadata"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "branding": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/AppBranding"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
         "description": {
           "type": [
             "string",
@@ -91,20 +29,6 @@
           "default": false,
           "type": "boolean"
         },
-        "isEnabled": {
-          "default": true,
-          "description": "Whether this app is enabled in config.toml. Example: ```toml [apps.bad_app] enabled = false ```",
-          "type": "boolean"
-        },
-        "labels": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": [
-            "object",
-            "null"
-          ]
-        },
         "logoUrl": {
           "type": [
             "string",
@@ -126,130 +50,6 @@
         "name"
       ],
       "type": "object"
-    },
-    "AppMetadata": {
-      "properties": {
-        "categories": {
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "developer": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "firstPartyRequiresInstall": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "firstPartyType": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "review": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/AppReview"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "screenshots": {
-          "items": {
-            "$ref": "#/definitions/AppScreenshot"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "seoDescription": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "showInComposerWhenUnlinked": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "subCategories": {
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "version": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "versionId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "versionNotes": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "AppReview": {
-      "properties": {
-        "status": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "status"
-      ],
-      "type": "object"
-    },
-    "AppScreenshot": {
-      "properties": {
-        "fileId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "url": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "userPrompt": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "userPrompt"
-      ],
-      "type": "object"
     }
   },
   "description": "EXPERIMENTAL - notification emitted when the app list changes.",

codex-rs/app-server-protocol/schema/json/v2/AppsListParams.json

@@ -21,13 +21,6 @@
         "integer",
         "null"
       ]
-    },
-    "threadId": {
-      "description": "Optional thread id used to evaluate app feature gating from that thread's config.",
-      "type": [
-        "string",
-        "null"
-      ]
     }
   },
   "title": "AppsListParams",

codex-rs/app-server-protocol/schema/json/v2/AppsListResponse.json

@@ -1,71 +1,9 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
-    "AppBranding": {
-      "description": "EXPERIMENTAL - app metadata returned by app-list APIs.",
-      "properties": {
-        "category": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "developer": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "isDiscoverableApp": {
-          "type": "boolean"
-        },
-        "privacyPolicy": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "termsOfService": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "website": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      },
-      "required": [
-        "isDiscoverableApp"
-      ],
-      "type": "object"
-    },
     "AppInfo": {
       "description": "EXPERIMENTAL - app metadata returned by app-list APIs.",
       "properties": {
-        "appMetadata": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/AppMetadata"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "branding": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/AppBranding"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
         "description": {
           "type": [
             "string",
@@ -91,20 +29,6 @@
           "default": false,
           "type": "boolean"
         },
-        "isEnabled": {
-          "default": true,
-          "description": "Whether this app is enabled in config.toml. Example: ```toml [apps.bad_app] enabled = false ```",
-          "type": "boolean"
-        },
-        "labels": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": [
-            "object",
-            "null"
-          ]
-        },
         "logoUrl": {
           "type": [
             "string",
@@ -126,130 +50,6 @@
         "name"
       ],
       "type": "object"
-    },
-    "AppMetadata": {
-      "properties": {
-        "categories": {
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "developer": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "firstPartyRequiresInstall": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "firstPartyType": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "review": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/AppReview"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "screenshots": {
-          "items": {
-            "$ref": "#/definitions/AppScreenshot"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "seoDescription": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "showInComposerWhenUnlinked": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "subCategories": {
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "version": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "versionId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "versionNotes": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "AppReview": {
-      "properties": {
-        "status": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "status"
-      ],
-      "type": "object"
-    },
-    "AppScreenshot": {
-      "properties": {
-        "fileId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "url": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "userPrompt": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "userPrompt"
-      ],
-      "type": "object"
     }
   },
   "description": "EXPERIMENTAL - app list response.",

codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json

@@ -12,53 +12,6 @@
       ],
       "type": "string"
     },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "SandboxPolicy": {
       "oneOf": [
         {
@@ -79,16 +32,6 @@
         },
         {
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "readOnly"
@@ -141,16 +84,6 @@
               "default": false,
               "type": "boolean"
             },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "workspaceWrite"

codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json

@@ -47,46 +47,13 @@
       "type": "object"
     },
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "Config": {
       "additionalProperties": true,

codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

@@ -2,46 +2,13 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "ConfigRequirements": {
       "properties": {

codex-rs/app-server-protocol/schema/json/v2/ErrorNotification.json

@@ -8,7 +8,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -18,6 +17,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {

codex-rs/app-server-protocol/schema/json/v2/GetAccountRateLimitsResponse.json

@@ -48,18 +48,6 @@
             }
           ]
         },
-        "limitId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limitName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "planType": {
           "anyOf": [
             {
@@ -122,22 +110,7 @@
   },
   "properties": {
     "rateLimits": {
-      "allOf": [
-        {
-          "$ref": "#/definitions/RateLimitSnapshot"
-        }
-      ],
-      "description": "Backward-compatible single-bucket view; mirrors the historical payload."
-    },
-    "rateLimitsByLimitId": {
-      "additionalProperties": {
-        "$ref": "#/definitions/RateLimitSnapshot"
-      },
-      "description": "Multi-bucket view keyed by metered `limit_id` (for example, `codex`).",
-      "type": [
-        "object",
-        "null"
-      ]
+      "$ref": "#/definitions/RateLimitSnapshot"
     }
   },
   "required": [

codex-rs/app-server-protocol/schema/json/v2/ItemCompletedNotification.json

@@ -236,13 +236,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -367,17 +360,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },

codex-rs/app-server-protocol/schema/json/v2/ItemStartedNotification.json

@@ -236,13 +236,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -367,17 +360,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },

codex-rs/app-server-protocol/schema/json/v2/LoginAccountParams.json

@@ -41,20 +41,13 @@
       "description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE. The access token must contain the same scopes that Codex-managed ChatGPT auth tokens have.",
       "properties": {
         "accessToken": {
-          "description": "Access token (JWT) supplied by the client. This token is used for backend API requests and email extraction.",
+          "description": "Access token (JWT) supplied by the client. This token is used for backend API requests.",
           "type": "string"
         },
-        "chatgptAccountId": {
-          "description": "Workspace/account identifier supplied by the client.",
+        "idToken": {
+          "description": "ID token (JWT) supplied by the client.\n\nThis token is used for identity and account metadata (email, plan type, workspace id).",
           "type": "string"
         },
-        "chatgptPlanType": {
-          "description": "Optional plan type supplied by the client.\n\nWhen `null`, Codex attempts to derive the plan type from access-token claims. If unavailable, the plan defaults to `unknown`.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
         "type": {
           "enum": [
             "chatgptAuthTokens"
@@ -65,7 +58,7 @@
       },
       "required": [
         "accessToken",
-        "chatgptAccountId",
+        "idToken",
         "type"
       ],
       "title": "ChatgptAuthTokensv2::LoginAccountParams",

codex-rs/app-server-protocol/schema/json/v2/ModelListParams.json

@@ -8,13 +8,6 @@
         "null"
       ]
     },
-    "includeHidden": {
-      "description": "When true, include models that are hidden from the default picker list.",
-      "type": [
-        "boolean",
-        "null"
-      ]
-    },
     "limit": {
       "description": "Optional page size; defaults to a reasonable server-side value.",
       "format": "uint32",

codex-rs/app-server-protocol/schema/json/v2/ModelListResponse.json

@@ -31,9 +31,6 @@
         "displayName": {
           "type": "string"
         },
-        "hidden": {
-          "type": "boolean"
-        },
         "id": {
           "type": "string"
         },
@@ -74,7 +71,6 @@
         "defaultReasoningEffort",
         "description",
         "displayName",
-        "hidden",
         "id",
         "isDefault",
         "model",

codex-rs/app-server-protocol/schema/json/v2/ModelReroutedNotification.json

@@ -1,37 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "ModelRerouteReason": {
-      "enum": [
-        "highRiskCyberActivity"
-      ],
-      "type": "string"
-    }
-  },
-  "properties": {
-    "fromModel": {
-      "type": "string"
-    },
-    "reason": {
-      "$ref": "#/definitions/ModelRerouteReason"
-    },
-    "threadId": {
-      "type": "string"
-    },
-    "toModel": {
-      "type": "string"
-    },
-    "turnId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "fromModel",
-    "reason",
-    "threadId",
-    "toModel",
-    "turnId"
-  ],
-  "title": "ModelReroutedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -350,13 +378,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -481,17 +502,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },

codex-rs/app-server-protocol/schema/json/v2/SkillsRemoteReadParams.json

@@ -1,47 +1,5 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "HazelnutScope": {
-      "enum": [
-        "example",
-        "workspace-shared",
-        "all-shared",
-        "personal"
-      ],
-      "type": "string"
-    },
-    "ProductSurface": {
-      "enum": [
-        "chatgpt",
-        "codex",
-        "api",
-        "atlas"
-      ],
-      "type": "string"
-    }
-  },
-  "properties": {
-    "enabled": {
-      "default": false,
-      "type": "boolean"
-    },
-    "hazelnutScope": {
-      "allOf": [
-        {
-          "$ref": "#/definitions/HazelnutScope"
-        }
-      ],
-      "default": "example"
-    },
-    "productSurface": {
-      "allOf": [
-        {
-          "$ref": "#/definitions/ProductSurface"
-        }
-      ],
-      "default": "codex"
-    }
-  },
   "title": "SkillsRemoteReadParams",
   "type": "object"
 }

codex-rs/app-server-protocol/schema/json/v2/SkillsRemoteWriteParams.json

@@ -3,10 +3,14 @@
   "properties": {
     "hazelnutId": {
       "type": "string"
+    },
+    "isPreload": {
+      "type": "boolean"
     }
   },
   "required": [
-    "hazelnutId"
+    "hazelnutId",
+    "isPreload"
   ],
   "title": "SkillsRemoteWriteParams",
   "type": "object"

codex-rs/app-server-protocol/schema/json/v2/SkillsRemoteWriteResponse.json

@@ -4,12 +4,16 @@
     "id": {
       "type": "string"
     },
+    "name": {
+      "type": "string"
+    },
     "path": {
       "type": "string"
     }
   },
   "required": [
     "id",
+    "name",
     "path"
   ],
   "title": "SkillsRemoteWriteResponse",

codex-rs/app-server-protocol/schema/json/v2/ThreadArchivedNotification.json

@@ -1,13 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "properties": {
-    "threadId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "threadId"
-  ],
-  "title": "ThreadArchivedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json

@@ -2,46 +2,13 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "SandboxMode": {
       "enum": [

codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json

@@ -6,46 +6,13 @@
       "type": "string"
     },
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "ByteRange": {
       "properties": {
@@ -73,7 +40,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -83,6 +49,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -419,13 +414,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "enum": [
         "restricted",
@@ -500,53 +488,6 @@
         }
       ]
     },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -579,16 +520,6 @@
         },
         {
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "readOnly"
@@ -641,16 +572,6 @@
               "default": false,
               "type": "boolean"
             },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "workspaceWrite"
@@ -706,8 +627,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -827,14 +747,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -856,19 +768,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -906,17 +810,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1355,81 +1248,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadListParams.json

@@ -39,13 +39,6 @@
         "null"
       ]
     },
-    "cwd": {
-      "description": "Optional cwd filter; when set, only threads whose session cwd exactly matches this path are returned.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
     "limit": {
       "description": "Optional page size; defaults to a reasonable server-side value.",
       "format": "uint32",

codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -373,13 +401,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -479,8 +500,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -600,14 +620,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -629,19 +641,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -679,17 +683,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1128,81 +1121,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -373,13 +401,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -479,8 +500,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -600,14 +620,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -629,19 +641,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -679,17 +683,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1128,81 +1121,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json

@@ -2,46 +2,13 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "ContentItem": {
       "oneOf": [

codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json

@@ -6,46 +6,13 @@
       "type": "string"
     },
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "ByteRange": {
       "properties": {
@@ -73,7 +40,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -83,6 +49,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -419,13 +414,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "enum": [
         "restricted",
@@ -500,53 +488,6 @@
         }
       ]
     },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -579,16 +520,6 @@
         },
         {
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "readOnly"
@@ -641,16 +572,6 @@
               "default": false,
               "type": "boolean"
             },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "workspaceWrite"
@@ -706,8 +627,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -827,14 +747,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -856,19 +768,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -906,17 +810,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1355,81 +1248,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -373,13 +401,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -479,8 +500,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -600,14 +620,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -629,19 +641,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -679,17 +683,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1128,81 +1121,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json

@@ -2,46 +2,13 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "DynamicToolSpec": {
       "properties": {

codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json

@@ -6,46 +6,13 @@
       "type": "string"
     },
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "ByteRange": {
       "properties": {
@@ -73,7 +40,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -83,6 +49,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -419,13 +414,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "NetworkAccess": {
       "enum": [
         "restricted",
@@ -500,53 +488,6 @@
         }
       ]
     },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -579,16 +520,6 @@
         },
         {
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "readOnly"
@@ -641,16 +572,6 @@
               "default": false,
               "type": "boolean"
             },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "workspaceWrite"
@@ -706,8 +627,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -827,14 +747,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -856,19 +768,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -906,17 +810,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1355,81 +1248,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -373,13 +401,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -479,8 +500,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -600,14 +620,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -629,19 +641,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -679,17 +683,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1128,81 +1121,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadStatusChangedNotification.json

@@ -1,101 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    }
-  },
-  "properties": {
-    "status": {
-      "$ref": "#/definitions/ThreadStatus"
-    },
-    "threadId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "status",
-    "threadId"
-  ],
-  "title": "ThreadStatusChangedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -373,13 +401,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -479,8 +500,7 @@
         {
           "enum": [
             "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
           ],
           "type": "string"
         },
@@ -600,14 +620,6 @@
           ],
           "description": "Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.)."
         },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ThreadStatus"
-            }
-          ],
-          "description": "Current runtime status for the thread."
-        },
         "turns": {
           "description": "Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read` (when `includeTurns` is true) responses. For all other responses and notifications returning a Thread, the turns field will be an empty list.",
           "items": {
@@ -629,19 +641,11 @@
         "modelProvider",
         "preview",
         "source",
-        "status",
         "turns",
         "updatedAt"
       ],
       "type": "object"
     },
-    "ThreadActiveFlag": {
-      "enum": [
-        "waitingOnApproval",
-        "waitingOnUserInput"
-      ],
-      "type": "string"
-    },
     "ThreadId": {
       "type": "string"
     },
@@ -679,17 +683,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },
@@ -1128,81 +1121,6 @@
         }
       ]
     },
-    "ThreadStatus": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "notLoaded"
-              ],
-              "title": "NotLoadedThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "NotLoadedThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "idle"
-              ],
-              "title": "IdleThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "IdleThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "systemError"
-              ],
-              "title": "SystemErrorThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "SystemErrorThreadStatus",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "activeFlags": {
-              "items": {
-                "$ref": "#/definitions/ThreadActiveFlag"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "active"
-              ],
-              "title": "ActiveThreadStatusType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "activeFlags",
-            "type"
-          ],
-          "title": "ActiveThreadStatus",
-          "type": "object"
-        }
-      ]
-    },
     "Turn": {
       "properties": {
         "error": {

codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchivedNotification.json

@@ -1,13 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "properties": {
-    "threadId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "threadId"
-  ],
-  "title": "ThreadUnarchivedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -350,13 +378,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -481,17 +502,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },

codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json

@@ -6,46 +6,13 @@
       "type": "string"
     },
     "AskForApproval": {
-      "oneOf": [
-        {
-          "enum": [
-            "untrusted",
-            "on-failure",
-            "on-request",
-            "never"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "reject": {
-              "properties": {
-                "mcp_elicitations": {
-                  "type": "boolean"
-                },
-                "rules": {
-                  "type": "boolean"
-                },
-                "sandbox_approval": {
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "mcp_elicitations",
-                "rules",
-                "sandbox_approval"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "reject"
-          ],
-          "title": "RejectAskForApproval",
-          "type": "object"
-        }
-      ]
+      "enum": [
+        "untrusted",
+        "on-failure",
+        "on-request",
+        "never"
+      ],
+      "type": "string"
     },
     "ByteRange": {
       "properties": {
@@ -105,53 +72,6 @@
       ],
       "type": "string"
     },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -204,16 +124,6 @@
         },
         {
           "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "readOnly"
@@ -266,16 +176,6 @@
               "default": false,
               "type": "boolean"
             },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
             "type": {
               "enum": [
                 "workspaceWrite"

codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -350,13 +378,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -481,17 +502,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },

codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json

@@ -27,7 +27,6 @@
           "enum": [
             "contextWindowExceeded",
             "usageLimitExceeded",
-            "serverOverloaded",
             "internalServerError",
             "unauthorized",
             "badRequest",
@@ -37,6 +36,35 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -350,13 +378,6 @@
       ],
       "type": "string"
     },
-    "MessagePhase": {
-      "enum": [
-        "commentary",
-        "finalAnswer"
-      ],
-      "type": "string"
-    },
     "PatchApplyStatus": {
       "enum": [
         "inProgress",
@@ -481,17 +502,6 @@
             "id": {
               "type": "string"
             },
-            "phase": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/MessagePhase"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "default": null
-            },
             "text": {
               "type": "string"
             },

codex-rs/app-server-protocol/schema/json/v2/WindowsSandboxSetupCompletedNotification.json

@@ -1,32 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "WindowsSandboxSetupMode": {
-      "enum": [
-        "elevated",
-        "unelevated"
-      ],
-      "type": "string"
-    }
-  },
-  "properties": {
-    "error": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "mode": {
-      "$ref": "#/definitions/WindowsSandboxSetupMode"
-    },
-    "success": {
-      "type": "boolean"
-    }
-  },
-  "required": [
-    "mode",
-    "success"
-  ],
-  "title": "WindowsSandboxSetupCompletedNotification",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/v2/WindowsSandboxSetupStartParams.json

@@ -1,22 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "WindowsSandboxSetupMode": {
-      "enum": [
-        "elevated",
-        "unelevated"
-      ],
-      "type": "string"
-    }
-  },
-  "properties": {
-    "mode": {
-      "$ref": "#/definitions/WindowsSandboxSetupMode"
-    }
-  },
-  "required": [
-    "mode"
-  ],
-  "title": "WindowsSandboxSetupStartParams",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/json/v2/WindowsSandboxSetupStartResponse.json

@@ -1,13 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "properties": {
-    "started": {
-      "type": "boolean"
-    }
-  },
-  "required": [
-    "started"
-  ],
-  "title": "WindowsSandboxSetupStartResponse",
-  "type": "object"
-}

codex-rs/app-server-protocol/schema/typescript/AgentMessageEvent.ts

@@ -1,6 +1,5 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { MessagePhase } from "./MessagePhase";
 
-export type AgentMessageEvent = { message: string, phase: MessagePhase | null, };
+export type AgentMessageEvent = { message: string, };

codex-rs/app-server-protocol/schema/typescript/AskForApproval.ts

@@ -1,10 +1,9 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { RejectConfig } from "./RejectConfig";
 
 /**
  * Determines the conditions under which the user is consulted to approve
  * running the command proposed by Codex.
  */
-export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": RejectConfig } | "never";
+export type AskForApproval = "untrusted" | "on-failure" | "on-request" | "never";

codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts

@@ -53,9 +53,8 @@ import type { ThreadUnarchiveParams } from "./v2/ThreadUnarchiveParams";
 import type { TurnInterruptParams } from "./v2/TurnInterruptParams";
 import type { TurnStartParams } from "./v2/TurnStartParams";
 import type { TurnSteerParams } from "./v2/TurnSteerParams";
-import type { WindowsSandboxSetupStartParams } from "./v2/WindowsSandboxSetupStartParams";
 
 /**
  * Request from the client to the server.
  */
-export type ClientRequest ={ "method": "initialize", id: RequestId, params: InitializeParams, } | { "method": "thread/start", id: RequestId, params: ThreadStartParams, } | { "method": "thread/resume", id: RequestId, params: ThreadResumeParams, } | { "method": "thread/fork", id: RequestId, params: ThreadForkParams, } | { "method": "thread/archive", id: RequestId, params: ThreadArchiveParams, } | { "method": "thread/name/set", id: RequestId, params: ThreadSetNameParams, } | { "method": "thread/unarchive", id: RequestId, params: ThreadUnarchiveParams, } | { "method": "thread/compact/start", id: RequestId, params: ThreadCompactStartParams, } | { "method": "thread/rollback", id: RequestId, params: ThreadRollbackParams, } | { "method": "thread/list", id: RequestId, params: ThreadListParams, } | { "method": "thread/loaded/list", id: RequestId, params: ThreadLoadedListParams, } | { "method": "thread/read", id: RequestId, params: ThreadReadParams, } | { "method": "skills/list", id: RequestId, params: SkillsListParams, } | { "method": "skills/remote/list", id: RequestId, params: SkillsRemoteReadParams, } | { "method": "skills/remote/export", id: RequestId, params: SkillsRemoteWriteParams, } | { "method": "app/list", id: RequestId, params: AppsListParams, } | { "method": "skills/config/write", id: RequestId, params: SkillsConfigWriteParams, } | { "method": "turn/start", id: RequestId, params: TurnStartParams, } | { "method": "turn/steer", id: RequestId, params: TurnSteerParams, } | { "method": "turn/interrupt", id: RequestId, params: TurnInterruptParams, } | { "method": "review/start", id: RequestId, params: ReviewStartParams, } | { "method": "model/list", id: RequestId, params: ModelListParams, } | { "method": "experimentalFeature/list", id: RequestId, params: ExperimentalFeatureListParams, } | { "method": "mcpServer/oauth/login", id: RequestId, params: McpServerOauthLoginParams, } | { "method": "config/mcpServer/reload", id: RequestId, params: undefined, } | { "method": "mcpServerStatus/list", id: RequestId, params: ListMcpServerStatusParams, } | { "method": "windowsSandbox/setupStart", id: RequestId, params: WindowsSandboxSetupStartParams, } | { "method": "account/login/start", id: RequestId, params: LoginAccountParams, } | { "method": "account/login/cancel", id: RequestId, params: CancelLoginAccountParams, } | { "method": "account/logout", id: RequestId, params: undefined, } | { "method": "account/rateLimits/read", id: RequestId, params: undefined, } | { "method": "feedback/upload", id: RequestId, params: FeedbackUploadParams, } | { "method": "command/exec", id: RequestId, params: CommandExecParams, } | { "method": "config/read", id: RequestId, params: ConfigReadParams, } | { "method": "config/value/write", id: RequestId, params: ConfigValueWriteParams, } | { "method": "config/batchWrite", id: RequestId, params: ConfigBatchWriteParams, } | { "method": "configRequirements/read", id: RequestId, params: undefined, } | { "method": "account/read", id: RequestId, params: GetAccountParams, } | { "method": "newConversation", id: RequestId, params: NewConversationParams, } | { "method": "getConversationSummary", id: RequestId, params: GetConversationSummaryParams, } | { "method": "listConversations", id: RequestId, params: ListConversationsParams, } | { "method": "resumeConversation", id: RequestId, params: ResumeConversationParams, } | { "method": "forkConversation", id: RequestId, params: ForkConversationParams, } | { "method": "archiveConversation", id: RequestId, params: ArchiveConversationParams, } | { "method": "sendUserMessage", id: RequestId, params: SendUserMessageParams, } | { "method": "sendUserTurn", id: RequestId, params: SendUserTurnParams, } | { "method": "interruptConversation", id: RequestId, params: InterruptConversationParams, } | { "method": "addConversationListener", id: RequestId, params: AddConversationListenerParams, } | { "method": "removeConversationListener", id: RequestId, params: RemoveConversationListenerParams, } | { "method": "gitDiffToRemote", id: RequestId, params: GitDiffToRemoteParams, } | { "method": "loginApiKey", id: RequestId, params: LoginApiKeyParams, } | { "method": "loginChatGpt", id: RequestId, params: undefined, } | { "method": "cancelLoginChatGpt", id: RequestId, params: CancelLoginChatGptParams, } | { "method": "logoutChatGpt", id: RequestId, params: undefined, } | { "method": "getAuthStatus", id: RequestId, params: GetAuthStatusParams, } | { "method": "getUserSavedConfig", id: RequestId, params: undefined, } | { "method": "setDefaultModel", id: RequestId, params: SetDefaultModelParams, } | { "method": "getUserAgent", id: RequestId, params: undefined, } | { "method": "userInfo", id: RequestId, params: undefined, } | { "method": "fuzzyFileSearch", id: RequestId, params: FuzzyFileSearchParams, } | { "method": "execOneOffCommand", id: RequestId, params: ExecOneOffCommandParams, };
+export type ClientRequest ={ "method": "initialize", id: RequestId, params: InitializeParams, } | { "method": "thread/start", id: RequestId, params: ThreadStartParams, } | { "method": "thread/resume", id: RequestId, params: ThreadResumeParams, } | { "method": "thread/fork", id: RequestId, params: ThreadForkParams, } | { "method": "thread/archive", id: RequestId, params: ThreadArchiveParams, } | { "method": "thread/name/set", id: RequestId, params: ThreadSetNameParams, } | { "method": "thread/unarchive", id: RequestId, params: ThreadUnarchiveParams, } | { "method": "thread/compact/start", id: RequestId, params: ThreadCompactStartParams, } | { "method": "thread/rollback", id: RequestId, params: ThreadRollbackParams, } | { "method": "thread/list", id: RequestId, params: ThreadListParams, } | { "method": "thread/loaded/list", id: RequestId, params: ThreadLoadedListParams, } | { "method": "thread/read", id: RequestId, params: ThreadReadParams, } | { "method": "skills/list", id: RequestId, params: SkillsListParams, } | { "method": "skills/remote/read", id: RequestId, params: SkillsRemoteReadParams, } | { "method": "skills/remote/write", id: RequestId, params: SkillsRemoteWriteParams, } | { "method": "app/list", id: RequestId, params: AppsListParams, } | { "method": "skills/config/write", id: RequestId, params: SkillsConfigWriteParams, } | { "method": "turn/start", id: RequestId, params: TurnStartParams, } | { "method": "turn/steer", id: RequestId, params: TurnSteerParams, } | { "method": "turn/interrupt", id: RequestId, params: TurnInterruptParams, } | { "method": "review/start", id: RequestId, params: ReviewStartParams, } | { "method": "model/list", id: RequestId, params: ModelListParams, } | { "method": "experimentalFeature/list", id: RequestId, params: ExperimentalFeatureListParams, } | { "method": "mcpServer/oauth/login", id: RequestId, params: McpServerOauthLoginParams, } | { "method": "config/mcpServer/reload", id: RequestId, params: undefined, } | { "method": "mcpServerStatus/list", id: RequestId, params: ListMcpServerStatusParams, } | { "method": "account/login/start", id: RequestId, params: LoginAccountParams, } | { "method": "account/login/cancel", id: RequestId, params: CancelLoginAccountParams, } | { "method": "account/logout", id: RequestId, params: undefined, } | { "method": "account/rateLimits/read", id: RequestId, params: undefined, } | { "method": "feedback/upload", id: RequestId, params: FeedbackUploadParams, } | { "method": "command/exec", id: RequestId, params: CommandExecParams, } | { "method": "config/read", id: RequestId, params: ConfigReadParams, } | { "method": "config/value/write", id: RequestId, params: ConfigValueWriteParams, } | { "method": "config/batchWrite", id: RequestId, params: ConfigBatchWriteParams, } | { "method": "configRequirements/read", id: RequestId, params: undefined, } | { "method": "account/read", id: RequestId, params: GetAccountParams, } | { "method": "newConversation", id: RequestId, params: NewConversationParams, } | { "method": "getConversationSummary", id: RequestId, params: GetConversationSummaryParams, } | { "method": "listConversations", id: RequestId, params: ListConversationsParams, } | { "method": "resumeConversation", id: RequestId, params: ResumeConversationParams, } | { "method": "forkConversation", id: RequestId, params: ForkConversationParams, } | { "method": "archiveConversation", id: RequestId, params: ArchiveConversationParams, } | { "method": "sendUserMessage", id: RequestId, params: SendUserMessageParams, } | { "method": "sendUserTurn", id: RequestId, params: SendUserTurnParams, } | { "method": "interruptConversation", id: RequestId, params: InterruptConversationParams, } | { "method": "addConversationListener", id: RequestId, params: AddConversationListenerParams, } | { "method": "removeConversationListener", id: RequestId, params: RemoveConversationListenerParams, } | { "method": "gitDiffToRemote", id: RequestId, params: GitDiffToRemoteParams, } | { "method": "loginApiKey", id: RequestId, params: LoginApiKeyParams, } | { "method": "loginChatGpt", id: RequestId, params: undefined, } | { "method": "cancelLoginChatGpt", id: RequestId, params: CancelLoginChatGptParams, } | { "method": "logoutChatGpt", id: RequestId, params: undefined, } | { "method": "getAuthStatus", id: RequestId, params: GetAuthStatusParams, } | { "method": "getUserSavedConfig", id: RequestId, params: undefined, } | { "method": "setDefaultModel", id: RequestId, params: SetDefaultModelParams, } | { "method": "getUserAgent", id: RequestId, params: undefined, } | { "method": "userInfo", id: RequestId, params: undefined, } | { "method": "fuzzyFileSearch", id: RequestId, params: FuzzyFileSearchParams, } | { "method": "execOneOffCommand", id: RequestId, params: ExecOneOffCommandParams, };

codex-rs/app-server-protocol/schema/typescript/CodexErrorInfo.ts

@@ -5,4 +5,4 @@
 /**
  * Codex errors that we expose to clients.
  */
-export type CodexErrorInfo = "context_window_exceeded" | "usage_limit_exceeded" | "server_overloaded" | { "http_connection_failed": { http_status_code: number | null, } } | { "response_stream_connection_failed": { http_status_code: number | null, } } | "internal_server_error" | "unauthorized" | "bad_request" | "sandbox_error" | { "response_stream_disconnected": { http_status_code: number | null, } } | { "response_too_many_failed_attempts": { http_status_code: number | null, } } | "thread_rollback_failed" | "other";
+export type CodexErrorInfo = "context_window_exceeded" | "usage_limit_exceeded" | { "model_cap": { model: string, reset_after_seconds: bigint | null, } } | { "http_connection_failed": { http_status_code: number | null, } } | { "response_stream_connection_failed": { http_status_code: number | null, } } | "internal_server_error" | "unauthorized" | "bad_request" | "sandbox_error" | { "response_stream_disconnected": { http_status_code: number | null, } } | { "response_too_many_failed_attempts": { http_status_code: number | null, } } | "thread_rollback_failed" | "other";

codex-rs/app-server-protocol/schema/typescript/EventMsg.ts

@@ -42,7 +42,6 @@ import type { McpStartupCompleteEvent } from "./McpStartupCompleteEvent";
 import type { McpStartupUpdateEvent } from "./McpStartupUpdateEvent";
 import type { McpToolCallBeginEvent } from "./McpToolCallBeginEvent";
 import type { McpToolCallEndEvent } from "./McpToolCallEndEvent";
-import type { ModelRerouteEvent } from "./ModelRerouteEvent";
 import type { PatchApplyBeginEvent } from "./PatchApplyBeginEvent";
 import type { PatchApplyEndEvent } from "./PatchApplyEndEvent";
 import type { PlanDeltaEvent } from "./PlanDeltaEvent";
@@ -75,4 +74,4 @@ import type { WebSearchEndEvent } from "./WebSearchEndEvent";
  * Response event from the agent
  * NOTE: Make sure none of these values have optional types, as it will mess up the extension code-gen.
  */
-export type EventMsg = { "type": "error" } & ErrorEvent | { "type": "warning" } & WarningEvent | { "type": "model_reroute" } & ModelRerouteEvent | { "type": "context_compacted" } & ContextCompactedEvent | { "type": "thread_rolled_back" } & ThreadRolledBackEvent | { "type": "task_started" } & TurnStartedEvent | { "type": "task_complete" } & TurnCompleteEvent | { "type": "token_count" } & TokenCountEvent | { "type": "agent_message" } & AgentMessageEvent | { "type": "user_message" } & UserMessageEvent | { "type": "agent_message_delta" } & AgentMessageDeltaEvent | { "type": "agent_reasoning" } & AgentReasoningEvent | { "type": "agent_reasoning_delta" } & AgentReasoningDeltaEvent | { "type": "agent_reasoning_raw_content" } & AgentReasoningRawContentEvent | { "type": "agent_reasoning_raw_content_delta" } & AgentReasoningRawContentDeltaEvent | { "type": "agent_reasoning_section_break" } & AgentReasoningSectionBreakEvent | { "type": "session_configured" } & SessionConfiguredEvent | { "type": "thread_name_updated" } & ThreadNameUpdatedEvent | { "type": "mcp_startup_update" } & McpStartupUpdateEvent | { "type": "mcp_startup_complete" } & McpStartupCompleteEvent | { "type": "mcp_tool_call_begin" } & McpToolCallBeginEvent | { "type": "mcp_tool_call_end" } & McpToolCallEndEvent | { "type": "web_search_begin" } & WebSearchBeginEvent | { "type": "web_search_end" } & WebSearchEndEvent | { "type": "exec_command_begin" } & ExecCommandBeginEvent | { "type": "exec_command_output_delta" } & ExecCommandOutputDeltaEvent | { "type": "terminal_interaction" } & TerminalInteractionEvent | { "type": "exec_command_end" } & ExecCommandEndEvent | { "type": "view_image_tool_call" } & ViewImageToolCallEvent | { "type": "exec_approval_request" } & ExecApprovalRequestEvent | { "type": "request_user_input" } & RequestUserInputEvent | { "type": "dynamic_tool_call_request" } & DynamicToolCallRequest | { "type": "elicitation_request" } & ElicitationRequestEvent | { "type": "apply_patch_approval_request" } & ApplyPatchApprovalRequestEvent | { "type": "deprecation_notice" } & DeprecationNoticeEvent | { "type": "background_event" } & BackgroundEventEvent | { "type": "undo_started" } & UndoStartedEvent | { "type": "undo_completed" } & UndoCompletedEvent | { "type": "stream_error" } & StreamErrorEvent | { "type": "patch_apply_begin" } & PatchApplyBeginEvent | { "type": "patch_apply_end" } & PatchApplyEndEvent | { "type": "turn_diff" } & TurnDiffEvent | { "type": "get_history_entry_response" } & GetHistoryEntryResponseEvent | { "type": "mcp_list_tools_response" } & McpListToolsResponseEvent | { "type": "list_custom_prompts_response" } & ListCustomPromptsResponseEvent | { "type": "list_skills_response" } & ListSkillsResponseEvent | { "type": "list_remote_skills_response" } & ListRemoteSkillsResponseEvent | { "type": "remote_skill_downloaded" } & RemoteSkillDownloadedEvent | { "type": "skills_update_available" } | { "type": "plan_update" } & UpdatePlanArgs | { "type": "turn_aborted" } & TurnAbortedEvent | { "type": "shutdown_complete" } | { "type": "entered_review_mode" } & ReviewRequest | { "type": "exited_review_mode" } & ExitedReviewModeEvent | { "type": "raw_response_item" } & RawResponseItemEvent | { "type": "item_started" } & ItemStartedEvent | { "type": "item_completed" } & ItemCompletedEvent | { "type": "agent_message_content_delta" } & AgentMessageContentDeltaEvent | { "type": "plan_delta" } & PlanDeltaEvent | { "type": "reasoning_content_delta" } & ReasoningContentDeltaEvent | { "type": "reasoning_raw_content_delta" } & ReasoningRawContentDeltaEvent | { "type": "collab_agent_spawn_begin" } & CollabAgentSpawnBeginEvent | { "type": "collab_agent_spawn_end" } & CollabAgentSpawnEndEvent | { "type": "collab_agent_interaction_begin" } & CollabAgentInteractionBeginEvent | { "type": "collab_agent_interaction_end" } & CollabAgentInteractionEndEvent | { "type": "collab_waiting_begin" } & CollabWaitingBeginEvent | { "type": "collab_waiting_end" } & CollabWaitingEndEvent | { "type": "collab_close_begin" } & CollabCloseBeginEvent | { "type": "collab_close_end" } & CollabCloseEndEvent | { "type": "collab_resume_begin" } & CollabResumeBeginEvent | { "type": "collab_resume_end" } & CollabResumeEndEvent;
+export type EventMsg = { "type": "error" } & ErrorEvent | { "type": "warning" } & WarningEvent | { "type": "context_compacted" } & ContextCompactedEvent | { "type": "thread_rolled_back" } & ThreadRolledBackEvent | { "type": "task_started" } & TurnStartedEvent | { "type": "task_complete" } & TurnCompleteEvent | { "type": "token_count" } & TokenCountEvent | { "type": "agent_message" } & AgentMessageEvent | { "type": "user_message" } & UserMessageEvent | { "type": "agent_message_delta" } & AgentMessageDeltaEvent | { "type": "agent_reasoning" } & AgentReasoningEvent | { "type": "agent_reasoning_delta" } & AgentReasoningDeltaEvent | { "type": "agent_reasoning_raw_content" } & AgentReasoningRawContentEvent | { "type": "agent_reasoning_raw_content_delta" } & AgentReasoningRawContentDeltaEvent | { "type": "agent_reasoning_section_break" } & AgentReasoningSectionBreakEvent | { "type": "session_configured" } & SessionConfiguredEvent | { "type": "thread_name_updated" } & ThreadNameUpdatedEvent | { "type": "mcp_startup_update" } & McpStartupUpdateEvent | { "type": "mcp_startup_complete" } & McpStartupCompleteEvent | { "type": "mcp_tool_call_begin" } & McpToolCallBeginEvent | { "type": "mcp_tool_call_end" } & McpToolCallEndEvent | { "type": "web_search_begin" } & WebSearchBeginEvent | { "type": "web_search_end" } & WebSearchEndEvent | { "type": "exec_command_begin" } & ExecCommandBeginEvent | { "type": "exec_command_output_delta" } & ExecCommandOutputDeltaEvent | { "type": "terminal_interaction" } & TerminalInteractionEvent | { "type": "exec_command_end" } & ExecCommandEndEvent | { "type": "view_image_tool_call" } & ViewImageToolCallEvent | { "type": "exec_approval_request" } & ExecApprovalRequestEvent | { "type": "request_user_input" } & RequestUserInputEvent | { "type": "dynamic_tool_call_request" } & DynamicToolCallRequest | { "type": "elicitation_request" } & ElicitationRequestEvent | { "type": "apply_patch_approval_request" } & ApplyPatchApprovalRequestEvent | { "type": "deprecation_notice" } & DeprecationNoticeEvent | { "type": "background_event" } & BackgroundEventEvent | { "type": "undo_started" } & UndoStartedEvent | { "type": "undo_completed" } & UndoCompletedEvent | { "type": "stream_error" } & StreamErrorEvent | { "type": "patch_apply_begin" } & PatchApplyBeginEvent | { "type": "patch_apply_end" } & PatchApplyEndEvent | { "type": "turn_diff" } & TurnDiffEvent | { "type": "get_history_entry_response" } & GetHistoryEntryResponseEvent | { "type": "mcp_list_tools_response" } & McpListToolsResponseEvent | { "type": "list_custom_prompts_response" } & ListCustomPromptsResponseEvent | { "type": "list_skills_response" } & ListSkillsResponseEvent | { "type": "list_remote_skills_response" } & ListRemoteSkillsResponseEvent | { "type": "remote_skill_downloaded" } & RemoteSkillDownloadedEvent | { "type": "skills_update_available" } | { "type": "plan_update" } & UpdatePlanArgs | { "type": "turn_aborted" } & TurnAbortedEvent | { "type": "shutdown_complete" } | { "type": "entered_review_mode" } & ReviewRequest | { "type": "exited_review_mode" } & ExitedReviewModeEvent | { "type": "raw_response_item" } & RawResponseItemEvent | { "type": "item_started" } & ItemStartedEvent | { "type": "item_completed" } & ItemCompletedEvent | { "type": "agent_message_content_delta" } & AgentMessageContentDeltaEvent | { "type": "plan_delta" } & PlanDeltaEvent | { "type": "reasoning_content_delta" } & ReasoningContentDeltaEvent | { "type": "reasoning_raw_content_delta" } & ReasoningRawContentDeltaEvent | { "type": "collab_agent_spawn_begin" } & CollabAgentSpawnBeginEvent | { "type": "collab_agent_spawn_end" } & CollabAgentSpawnEndEvent | { "type": "collab_agent_interaction_begin" } & CollabAgentInteractionBeginEvent | { "type": "collab_agent_interaction_end" } & CollabAgentInteractionEndEvent | { "type": "collab_waiting_begin" } & CollabWaitingBeginEvent | { "type": "collab_waiting_end" } & CollabWaitingEndEvent | { "type": "collab_close_begin" } & CollabCloseBeginEvent | { "type": "collab_close_end" } & CollabCloseEndEvent | { "type": "collab_resume_begin" } & CollabResumeBeginEvent | { "type": "collab_resume_end" } & CollabResumeEndEvent;