Extract ContextDiscoverable history handling

fix
Update app-server protocol schema fixtures for ResponseItem refactor
2026-02-23 09:13:47 +00:00 · 2026-02-08 20:02:58 -08:00 · 2026-02-08 19:02:22 -08:00 · 2026-02-08 18:27:46 -08:00 · 2026-02-08 18:18:51 -08:00
612 changed files with 12320 additions and 42789 deletions
--- a/.codespellignore
+++ b/.codespellignore
@@ -1,5 +1,3 @@
 iTerm
 iTerm2
-psuedo
-te
-TE
+psuedo
--- a/.codespellrc
+++ b/.codespellrc
@@ -1,6 +1,6 @@
 [codespell]
 # Ref: https://github.com/codespell-project/codespell#using-a-config-file
-skip = .git*,vendor,*-lock.yaml,*.lock,.codespellrc,*test.ts,*.jsonl,frame*.txt,*.snap,*.snap.new,*meriyah.umd.min.js
+skip = .git*,vendor,*-lock.yaml,*.lock,.codespellrc,*test.ts,*.jsonl,frame*.txt,*.snap,*.snap.new
 check-hidden = true
 ignore-regex = ^\s*"image/\S+": ".*|\b(afterAll)\b
-ignore-words-list = ratatui,ser,iTerm,iterm2,iterm,te,TE
+ignore-words-list = ratatui,ser,iTerm,iterm2,iterm
--- a/.codex/skills/test-tui/SKILL.md
+++ b/.codex/skills/test-tui/SKILL.md
@@ -1,14 +0,0 @@
---
-name: test-tui
-description: Guide for testing Codex TUI interactively
---
-
-You can start and use Codex TUI to verify changes. 
-
-Important notes:
-
-Start interactively.
-Always set RUST_LOG="trace" when starting the process.
-Pass `-c log_dir=<some_temp_dir>` argument to have logs written to a specific directory to help with debugging.
-When sending a test message programmatically, send text first, then send Enter in a separate write (do not send text + Enter in one burst).
-Use `just codex` target to run - `just codex -c ...`
--- a/.github/scripts/install-musl-build-tools.sh
+++ b/.github/scripts/install-musl-build-tools.sh
@@ -17,7 +17,7 @@ if [[ -n "${APT_INSTALL_ARGS:-}" ]]; then
 fi

 sudo apt-get update "${apt_update_args[@]}"
-sudo apt-get install -y "${apt_install_args[@]}" ca-certificates curl musl-tools pkg-config libcap-dev g++ clang libc++-dev libc++abi-dev lld xz-utils
+sudo apt-get install -y "${apt_install_args[@]}" musl-tools pkg-config g++ clang libc++-dev libc++abi-dev lld

 case "${TARGET}" in
  x86_64-unknown-linux-musl)
@@ -32,11 +32,6 @@ case "${TARGET}" in
    ;;
 esac

-libcap_version="2.75"
-libcap_sha256="de4e7e064c9ba451d5234dd46e897d7c71c96a9ebf9a0c445bc04f4742d83632"
-libcap_tarball_name="libcap-${libcap_version}.tar.xz"
-libcap_download_url="https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${libcap_tarball_name}"
-
 # Use the musl toolchain as the Rust linker to avoid Zig injecting its own CRT.
 if command -v "${arch}-linux-musl-gcc" >/dev/null; then
  musl_linker="$(command -v "${arch}-linux-musl-gcc")"
@@ -52,43 +47,6 @@ runner_temp="${RUNNER_TEMP:-/tmp}"
 tool_root="${runner_temp}/codex-musl-tools-${TARGET}"
 mkdir -p "${tool_root}"

-libcap_root="${tool_root}/libcap-${libcap_version}"
-libcap_src_root="${libcap_root}/src"
-libcap_prefix="${libcap_root}/prefix"
-libcap_pkgconfig_dir="${libcap_prefix}/lib/pkgconfig"
-
-if [[ ! -f "${libcap_prefix}/lib/libcap.a" ]]; then
-  mkdir -p "${libcap_src_root}" "${libcap_prefix}/lib" "${libcap_prefix}/include/sys" "${libcap_prefix}/include/linux" "${libcap_pkgconfig_dir}"
-  libcap_tarball="${libcap_root}/${libcap_tarball_name}"
-
-  curl -fsSL "${libcap_download_url}" -o "${libcap_tarball}"
-  echo "${libcap_sha256}  ${libcap_tarball}" | sha256sum -c -
-
-  tar -xJf "${libcap_tarball}" -C "${libcap_src_root}"
-  libcap_source_dir="${libcap_src_root}/libcap-${libcap_version}"
-  make -C "${libcap_source_dir}/libcap" -j"$(nproc)" \
-    CC="${musl_linker}" \
-    AR=ar \
-    RANLIB=ranlib
-
-  cp "${libcap_source_dir}/libcap/libcap.a" "${libcap_prefix}/lib/libcap.a"
-  cp "${libcap_source_dir}/libcap/include/uapi/linux/capability.h" "${libcap_prefix}/include/linux/capability.h"
-  cp "${libcap_source_dir}/libcap/../libcap/include/sys/capability.h" "${libcap_prefix}/include/sys/capability.h"
-
-  cat > "${libcap_pkgconfig_dir}/libcap.pc" <<EOF
-prefix=${libcap_prefix}
-exec_prefix=\${prefix}
-libdir=\${prefix}/lib
-includedir=\${prefix}/include
-
-Name: libcap
-Description: Linux capabilities
-Version: ${libcap_version}
-Libs: -L\${libdir} -lcap
-Cflags: -I\${includedir}
-EOF
-fi
-
 sysroot=""
 if command -v zig >/dev/null; then
  zig_bin="$(command -v zig)"
@@ -101,19 +59,7 @@ set -euo pipefail

 args=()
 skip_next=0
-pending_include=0
 for arg in "\$@"; do
-  if [[ "\${pending_include}" -eq 1 ]]; then
-    pending_include=0
-    if [[ "\${arg}" == /usr/include || "\${arg}" == /usr/include/* ]]; then
-      # Keep host-only headers available, but after the target sysroot headers.
-      args+=("-idirafter" "\${arg}")
-    else
-      args+=("-I" "\${arg}")
-    fi
-    continue
-  fi
-
  if [[ "\${skip_next}" -eq 1 ]]; then
    skip_next=0
    continue
@@ -131,15 +77,6 @@ for arg in "\$@"; do
      fi
      continue
      ;;
-    -I)
-      pending_include=1
-      continue
-      ;;
-    -I/usr/include|-I/usr/include/*)
-      # Avoid making glibc headers win over musl headers.
-      args+=("-idirafter" "\${arg#-I}")
-      continue
-      ;;
    -Wp,-U_FORTIFY_SOURCE)
      # aws-lc-sys emits this GCC preprocessor forwarding form in debug
      # builds, but zig cc expects the define flag directly.
@@ -158,19 +95,7 @@ set -euo pipefail

 args=()
 skip_next=0
-pending_include=0
 for arg in "\$@"; do
-  if [[ "\${pending_include}" -eq 1 ]]; then
-    pending_include=0
-    if [[ "\${arg}" == /usr/include || "\${arg}" == /usr/include/* ]]; then
-      # Keep host-only headers available, but after the target sysroot headers.
-      args+=("-idirafter" "\${arg}")
-    else
-      args+=("-I" "\${arg}")
-    fi
-    continue
-  fi
-
  if [[ "\${skip_next}" -eq 1 ]]; then
    skip_next=0
    continue
@@ -188,15 +113,6 @@ for arg in "\$@"; do
      fi
      continue
      ;;
-    -I)
-      pending_include=1
-      continue
-      ;;
-    -I/usr/include|-I/usr/include/*)
-      # Avoid making glibc headers win over musl headers.
-      args+=("-idirafter" "\${arg#-I}")
-      continue
-      ;;
    -Wp,-U_FORTIFY_SOURCE)
      # aws-lc-sys emits this GCC forwarding form in debug builds; zig c++
      # expects the define flag directly.
@@ -259,21 +175,3 @@ echo "${cargo_linker_var}=${musl_linker}" >> "$GITHUB_ENV"
 echo "CMAKE_C_COMPILER=${cc}" >> "$GITHUB_ENV"
 echo "CMAKE_CXX_COMPILER=${cxx}" >> "$GITHUB_ENV"
 echo "CMAKE_ARGS=-DCMAKE_HAVE_THREADS_LIBRARY=1 -DCMAKE_USE_PTHREADS_INIT=1 -DCMAKE_THREAD_LIBS_INIT=-pthread -DTHREADS_PREFER_PTHREAD_FLAG=ON" >> "$GITHUB_ENV"
-
-# Allow pkg-config resolution during cross-compilation.
-echo "PKG_CONFIG_ALLOW_CROSS=1" >> "$GITHUB_ENV"
-pkg_config_path="${libcap_pkgconfig_dir}"
-if [[ -n "${PKG_CONFIG_PATH:-}" ]]; then
-  pkg_config_path="${pkg_config_path}:${PKG_CONFIG_PATH}"
-fi
-echo "PKG_CONFIG_PATH=${pkg_config_path}" >> "$GITHUB_ENV"
-pkg_config_path_var="PKG_CONFIG_PATH_${TARGET}"
-pkg_config_path_var="${pkg_config_path_var//-/_}"
-echo "${pkg_config_path_var}=${libcap_pkgconfig_dir}" >> "$GITHUB_ENV"
-
-if [[ -n "${sysroot}" && "${sysroot}" != "/" ]]; then
-  echo "PKG_CONFIG_SYSROOT_DIR=${sysroot}" >> "$GITHUB_ENV"
-  pkg_config_sysroot_var="PKG_CONFIG_SYSROOT_DIR_${TARGET}"
-  pkg_config_sysroot_var="${pkg_config_sysroot_var//-/_}"
-  echo "${pkg_config_sysroot_var}=${sysroot}" >> "$GITHUB_ENV"
-fi
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -100,45 +100,12 @@ jobs:
      - name: bazel test //...
        env:
          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+          CODEX_BWRAP_ENABLE_FFI: ${{ contains(matrix.target, 'unknown-linux') && '1' || '0' }}
        shell: bash
        run: |
-          bazel_args=(
-            test
-            //...
-            --test_verbose_timeout_warnings
-            --build_metadata=REPO_URL=https://github.com/openai/codex.git
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
-            --build_metadata=ROLE=CI
-            --build_metadata=VISIBILITY=PUBLIC
-          )
-
-          if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
-            echo "BuildBuddy API key is available; using remote Bazel configuration."
-            bazel $BAZEL_STARTUP_ARGS \
-              --bazelrc=.github/workflows/ci.bazelrc \
-              "${bazel_args[@]}" \
-              "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          else
-            echo "BuildBuddy API key is not available; using local Bazel configuration."
-            # Keep fork/community PRs on Bazel but disable remote services that are
-            # configured in .bazelrc and require auth.
-            #
-            # Flag docs:
-            # - Command-line reference: https://bazel.build/reference/command-line-reference
-            # - Remote caching overview: https://bazel.build/remote/caching
-            # - Remote execution overview: https://bazel.build/remote/rbe
-            # - Build Event Protocol overview: https://bazel.build/remote/bep
-            #
-            # --noexperimental_remote_repo_contents_cache:
-            #   disable remote repo contents cache enabled in .bazelrc startup options.
-            #   https://bazel.build/reference/command-line-reference#startup_options-flag--experimental_remote_repo_contents_cache
-            # --remote_cache= and --remote_executor=:
-            #   clear remote cache/execution endpoints configured in .bazelrc.
-            #   https://bazel.build/reference/command-line-reference#common_options-flag--remote_cache
-            #   https://bazel.build/reference/command-line-reference#common_options-flag--remote_executor
-            bazel $BAZEL_STARTUP_ARGS \
-              --noexperimental_remote_repo_contents_cache \
-              "${bazel_args[@]}" \
-              --remote_cache= \
-              --remote_executor=
-          fi
+          bazel $BAZEL_STARTUP_ARGS --bazelrc=.github/workflows/ci.bazelrc test //... \
+            --build_metadata=REPO_URL=https://github.com/openai/codex.git \
+            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD) \
+            --build_metadata=ROLE=CI \
+            --build_metadata=VISIBILITY=PUBLIC \
+            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -23,5 +23,5 @@ common:macos --config=remote
 common:macos --strategy=remote
 common:macos --strategy=TestRunner=darwin-sandbox,local

-# On windows we cannot cross-build the tests but run them locally due to what appears to be a Bazel bug
+# On windows we can not cross-build the tests but run them locally due to what appears to be a Bazel bug
 # (windows vs unix path confusion)
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -59,7 +59,7 @@ jobs:
        working-directory: codex-rs
    steps:
      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
        with:
          components: rustfmt
      - name: cargo fmt
@@ -75,7 +75,7 @@ jobs:
        working-directory: codex-rs
    steps:
      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
      - uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2
        with:
          tool: cargo-shear
@@ -99,8 +99,9 @@ jobs:
      USE_SCCACHE: ${{ startsWith(matrix.runner, 'windows') && 'false' || 'true' }}
      CARGO_INCREMENTAL: "0"
      SCCACHE_CACHE_SIZE: 10G
-      # In rust-ci, representative release-profile checks use thin LTO for faster feedback.
-      CARGO_PROFILE_RELEASE_LTO: ${{ matrix.profile == 'release' && 'thin' || 'fat' }}
+      # Keep cargo-based CI independent of system bwrap build deps.
+      # The bwrap FFI path is validated in Bazel workflows.
+      CODEX_BWRAP_ENABLE_FFI: "0"

    strategy:
      fail-fast: false
@@ -162,12 +163,6 @@ jobs:
            runs_on:
              group: codex-runners
              labels: codex-linux-x64
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            profile: release
-            runs_on:
-              group: codex-runners
-              labels: codex-linux-arm64
          - runner: windows-x64
            target: x86_64-pc-windows-msvc
            profile: release
@@ -183,20 +178,16 @@ jobs:

    steps:
      - uses: actions/checkout@v6
-      - name: Install Linux build dependencies
-        if: ${{ runner.os == 'Linux' }}
+      - name: Install UBSan runtime (musl)
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
        shell: bash
        run: |
          set -euo pipefail
          if command -v apt-get >/dev/null 2>&1; then
            sudo apt-get update -y
-            packages=(pkg-config libcap-dev)
-            if [[ "${{ matrix.target }}" == 'x86_64-unknown-linux-musl' || "${{ matrix.target }}" == 'aarch64-unknown-linux-musl' ]]; then
-              packages+=(libubsan1)
-            fi
-            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${packages[@]}"
+            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y libubsan1
          fi
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
        with:
          targets: ${{ matrix.target }}
          components: clippy
@@ -388,15 +379,21 @@ jobs:
          cargo chef cook --recipe-path "$RECIPE" --target ${{ matrix.target }} --release --all-features

      - name: cargo clippy
-        run: cargo clippy --target ${{ matrix.target }} --all-features --tests --profile ${{ matrix.profile }} --timings -- -D warnings
+        id: clippy
+        run: cargo clippy --target ${{ matrix.target }} --all-features --tests --profile ${{ matrix.profile }} -- -D warnings

-      - name: Upload Cargo timings (clippy)
-        if: always()
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-ci-clippy-${{ matrix.target }}-${{ matrix.profile }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
+      # Running `cargo build` from the workspace root builds the workspace using
+      # the union of all features from third-party crates. This can mask errors
+      # where individual crates have underspecified features. To avoid this, we
+      # run `cargo check` for each crate individually, though because this is
+      # slower, we only do this for the x86_64-unknown-linux-gnu target.
+      - name: cargo check individual crates
+        id: cargo_check_all_crates
+        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && matrix.profile != 'release' }}
+        continue-on-error: true
+        run: |
+          find . -name Cargo.toml -mindepth 2 -maxdepth 2 -print0 \
+            | xargs -0 -n1 -I{} bash -c 'cd "$(dirname "{}")" && cargo check --profile ${{ matrix.profile }}'

      # Save caches explicitly; make non-fatal so cache packaging
      # never fails the overall job. Only save when key wasn't hit.
@@ -450,6 +447,15 @@ jobs:
            /var/cache/apt
          key: apt-${{ matrix.runner }}-${{ matrix.target }}-v1

+      # Fail the job if any of the previous steps failed.
+      - name: verify all steps passed
+        if: |
+          steps.clippy.outcome == 'failure' ||
+          steps.cargo_check_all_crates.outcome == 'failure'
+        run: |
+          echo "One or more checks failed (clippy or cargo_check_all_crates). See logs for details."
+          exit 1
+
  tests:
    name: Tests — ${{ matrix.runner }} - ${{ matrix.target }}
    runs-on: ${{ matrix.runs_on || matrix.runner }}
@@ -464,6 +470,9 @@ jobs:
      USE_SCCACHE: ${{ startsWith(matrix.runner, 'windows') && 'false' || 'true' }}
      CARGO_INCREMENTAL: "0"
      SCCACHE_CACHE_SIZE: 10G
+      # Keep cargo-based CI independent of system bwrap build deps.
+      # The bwrap FFI path is validated in Bazel workflows.
+      CODEX_BWRAP_ENABLE_FFI: "0"

    strategy:
      fail-fast: false
@@ -499,21 +508,12 @@ jobs:

    steps:
      - uses: actions/checkout@v6
-      - name: Install Linux build dependencies
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          if command -v apt-get >/dev/null 2>&1; then
-            sudo apt-get update -y
-            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-          fi
      # Some integration tests rely on DotSlash being installed.
      # See https://github.com/openai/codex/pull/7617.
      - name: Install DotSlash
        uses: facebook/install-dotslash@v2

-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
        with:
          targets: ${{ matrix.target }}

@@ -583,19 +583,11 @@ jobs:

      - name: tests
        id: test
-        run: cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test --timings
+        run: cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test
        env:
          RUST_BACKTRACE: 1
          NEXTEST_STATUS_LEVEL: leak

-      - name: Upload Cargo timings (nextest)
-        if: always()
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-ci-nextest-${{ matrix.target }}-${{ matrix.profile }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
-
      - name: Save cargo home cache
        if: always() && !cancelled() && steps.cache_cargo_home_restore.outputs.cache-hit != 'true'
        continue-on-error: true
--- a/.github/workflows/rust-release-windows.yml
+++ b/.github/workflows/rust-release-windows.yml
@@ -1,264 +0,0 @@
-name: rust-release-windows
-
-on:
-  workflow_call:
-    inputs:
-      release-lto:
-        required: true
-        type: string
-    secrets:
-      AZURE_TRUSTED_SIGNING_CLIENT_ID:
-        required: true
-      AZURE_TRUSTED_SIGNING_TENANT_ID:
-        required: true
-      AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID:
-        required: true
-      AZURE_TRUSTED_SIGNING_ENDPOINT:
-        required: true
-      AZURE_TRUSTED_SIGNING_ACCOUNT_NAME:
-        required: true
-      AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME:
-        required: true
-
-jobs:
-  build-windows-binaries:
-    name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
-    runs-on: ${{ matrix.runs_on }}
-    timeout-minutes: 60
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: codex-rs
-    env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ inputs.release-lto }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: windows-x64
-            target: x86_64-pc-windows-msvc
-            bundle: primary
-            build_args: --bin codex --bin codex-responses-api-proxy
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
-          - runner: windows-arm64
-            target: aarch64-pc-windows-msvc
-            bundle: primary
-            build_args: --bin codex --bin codex-responses-api-proxy
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-arm64
-          - runner: windows-x64
-            target: x86_64-pc-windows-msvc
-            bundle: helpers
-            build_args: --bin codex-windows-sandbox-setup --bin codex-command-runner
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
-          - runner: windows-arm64
-            target: aarch64-pc-windows-msvc
-            bundle: helpers
-            build_args: --bin codex-windows-sandbox-setup --bin codex-command-runner
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-arm64
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: Print runner specs (Windows)
-        shell: powershell
-        run: |
-          $computer = Get-CimInstance Win32_ComputerSystem
-          $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1
-          $ramGiB = [math]::Round($computer.TotalPhysicalMemory / 1GB, 1)
-          Write-Host "Runner: $env:RUNNER_NAME"
-          Write-Host "OS: $([System.Environment]::OSVersion.VersionString)"
-          Write-Host "CPU: $($cpu.Name)"
-          Write-Host "Logical CPUs: $($computer.NumberOfLogicalProcessors)"
-          Write-Host "Physical CPUs: $($computer.NumberOfProcessors)"
-          Write-Host "Total RAM: $ramGiB GiB"
-          Write-Host "Disk usage:"
-          Get-PSDrive -PSProvider FileSystem | Format-Table -AutoSize Name, @{Name='Size(GB)';Expression={[math]::Round(($_.Used + $_.Free) / 1GB, 1)}}, @{Name='Free(GB)';Expression={[math]::Round($_.Free / 1GB, 1)}}
-      - uses: dtolnay/rust-toolchain@1.93.0
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cargo build (Windows binaries)
-        shell: bash
-        run: |
-          cargo build --target ${{ matrix.target }} --release --timings ${{ matrix.build_args }}
-
-      - name: Upload Cargo timings
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-release-windows-${{ matrix.target }}-${{ matrix.bundle }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
-
-      - name: Stage Windows binaries
-        shell: bash
-        run: |
-          output_dir="target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}"
-          mkdir -p "$output_dir"
-          if [[ "${{ matrix.bundle }}" == "primary" ]]; then
-            cp target/${{ matrix.target }}/release/codex.exe "$output_dir/codex.exe"
-            cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$output_dir/codex-responses-api-proxy.exe"
-          else
-            cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$output_dir/codex-windows-sandbox-setup.exe"
-            cp target/${{ matrix.target }}/release/codex-command-runner.exe "$output_dir/codex-command-runner.exe"
-          fi
-
-      - name: Upload Windows binaries
-        uses: actions/upload-artifact@v6
-        with:
-          name: windows-binaries-${{ matrix.target }}-${{ matrix.bundle }}
-          path: |
-            codex-rs/target/${{ matrix.target }}/release/staged-${{ matrix.bundle }}/*
-
-  build-windows:
-    needs:
-      - build-windows-binaries
-    name: Build - ${{ matrix.runner }} - ${{ matrix.target }}
-    runs-on: ${{ matrix.runs_on }}
-    timeout-minutes: 60
-    permissions:
-      contents: read
-      id-token: write
-    defaults:
-      run:
-        working-directory: codex-rs
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: windows-x64
-            target: x86_64-pc-windows-msvc
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-x64
-          - runner: windows-arm64
-            target: aarch64-pc-windows-msvc
-            runs_on:
-              group: codex-runners
-              labels: codex-windows-arm64
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Download prebuilt Windows primary binaries
-        uses: actions/download-artifact@v7
-        with:
-          name: windows-binaries-${{ matrix.target }}-primary
-          path: codex-rs/target/${{ matrix.target }}/release
-
-      - name: Download prebuilt Windows helper binaries
-        uses: actions/download-artifact@v7
-        with:
-          name: windows-binaries-${{ matrix.target }}-helpers
-          path: codex-rs/target/${{ matrix.target }}/release
-
-      - name: Verify binaries
-        shell: bash
-        run: |
-          set -euo pipefail
-          ls -lh target/${{ matrix.target }}/release/codex.exe
-          ls -lh target/${{ matrix.target }}/release/codex-responses-api-proxy.exe
-          ls -lh target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe
-          ls -lh target/${{ matrix.target }}/release/codex-command-runner.exe
-
-      - name: Sign Windows binaries with Azure Trusted Signing
-        uses: ./.github/actions/windows-code-sign
-        with:
-          target: ${{ matrix.target }}
-          client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
-          endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          certificate-profile-name: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
-
-      - name: Stage artifacts
-        shell: bash
-        run: |
-          dest="dist/${{ matrix.target }}"
-          mkdir -p "$dest"
-
-          cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe"
-          cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe"
-          cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
-          cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe"
-
-      - name: Install DotSlash
-        uses: facebook/install-dotslash@v2
-
-      - name: Compress artifacts
-        shell: bash
-        run: |
-          # Path that contains the uncompressed binaries for the current
-          # ${{ matrix.target }}
-          dest="dist/${{ matrix.target }}"
-          repo_root=$PWD
-
-          # For compatibility with environments that lack the `zstd` tool we
-          # additionally create a `.tar.gz` and `.zip` for every Windows binary.
-          # The end result is:
-          #   codex-<target>.zst
-          #   codex-<target>.tar.gz
-          #   codex-<target>.zip
-          for f in "$dest"/*; do
-            base="$(basename "$f")"
-            # Skip files that are already archives (shouldn't happen, but be
-            # safe).
-            if [[ "$base" == *.tar.gz || "$base" == *.zip || "$base" == *.dmg ]]; then
-              continue
-            fi
-
-            # Don't try to compress signature bundles.
-            if [[ "$base" == *.sigstore ]]; then
-              continue
-            fi
-
-            # Create per-binary tar.gz
-            tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"
-
-            # Create zip archive for Windows binaries.
-            # Must run from inside the dest dir so 7z won't embed the
-            # directory path inside the zip.
-            if [[ "$base" == "codex-${{ matrix.target }}.exe" ]]; then
-              # Bundle the sandbox helper binaries into the main codex zip so
-              # WinGet installs include the required helpers next to codex.exe.
-              # Fall back to the single-binary zip if the helpers are missing
-              # to avoid breaking releases.
-              bundle_dir="$(mktemp -d)"
-              runner_src="$dest/codex-command-runner-${{ matrix.target }}.exe"
-              setup_src="$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
-              if [[ -f "$runner_src" && -f "$setup_src" ]]; then
-                cp "$dest/$base" "$bundle_dir/$base"
-                cp "$runner_src" "$bundle_dir/codex-command-runner.exe"
-                cp "$setup_src" "$bundle_dir/codex-windows-sandbox-setup.exe"
-                # Use an absolute path so bundle zips land in the real dist
-                # dir even when 7z runs from a temp directory.
-                (cd "$bundle_dir" && 7z a "$repo_root/$dest/${base}.zip" .)
-              else
-                echo "warning: missing sandbox binaries; falling back to single-binary zip"
-                echo "warning: expected $runner_src and $setup_src"
-                (cd "$dest" && 7z a "${base}.zip" "$base")
-              fi
-              rm -rf "$bundle_dir"
-            else
-              (cd "$dest" && 7z a "${base}.zip" "$base")
-            fi
-
-            # Keep raw executables and produce .zst alongside them.
-            "${GITHUB_WORKSPACE}/.github/workflows/zstd" -T0 -19 "$dest/$base"
-          done
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: ${{ matrix.target }}
-          path: |
-            codex-rs/dist/${{ matrix.target }}/*
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -48,7 +48,7 @@ jobs:
  build:
    needs: tag-check
    name: Build - ${{ matrix.runner }} - ${{ matrix.target }}
-    runs-on: ${{ matrix.runs_on || matrix.runner }}
+    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    permissions:
      contents: read
@@ -57,7 +57,7 @@ jobs:
      run:
        working-directory: codex-rs
    env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
+      CODEX_BWRAP_ENABLE_FFI: ${{ contains(matrix.target, 'unknown-linux') && '1' || '0' }}

    strategy:
      fail-fast: false
@@ -75,38 +75,13 @@ jobs:
            target: aarch64-unknown-linux-musl
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
+          - runner: windows-latest
+            target: x86_64-pc-windows-msvc
+          - runner: windows-11-arm
+            target: aarch64-pc-windows-msvc

    steps:
      - uses: actions/checkout@v6
-      - name: Print runner specs (Linux)
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          cpu_model="$(lscpu | awk -F: '/Model name/ {gsub(/^[ \t]+/, "", $2); print $2; exit}')"
-          total_ram="$(awk '/MemTotal/ {printf "%.1f GiB\n", $2 / 1024 / 1024}' /proc/meminfo)"
-          echo "Runner: ${RUNNER_NAME:-unknown}"
-          echo "OS: $(uname -a)"
-          echo "CPU model: ${cpu_model}"
-          echo "Logical CPUs: $(nproc)"
-          echo "Total RAM: ${total_ram}"
-          echo "Disk usage:"
-          df -h .
-      - name: Print runner specs (macOS)
-        if: ${{ runner.os == 'macOS' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          total_ram="$(sysctl -n hw.memsize | awk '{printf "%.1f GiB\n", $1 / 1024 / 1024 / 1024}')"
-          echo "Runner: ${RUNNER_NAME:-unknown}"
-          echo "OS: $(sw_vers -productName) $(sw_vers -productVersion)"
-          echo "Hardware model: $(sysctl -n hw.model)"
-          echo "CPU architecture: $(uname -m)"
-          echo "Logical CPUs: $(sysctl -n hw.logicalcpu)"
-          echo "Physical CPUs: $(sysctl -n hw.physicalcpu)"
-          echo "Total RAM: ${total_ram}"
-          echo "Disk usage:"
-          df -h .
      - name: Install Linux bwrap build dependencies
        if: ${{ runner.os == 'Linux' }}
        shell: bash
@@ -123,7 +98,7 @@ jobs:
            sudo apt-get update -y
            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y libubsan1
          fi
-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
        with:
          targets: ${{ matrix.target }}

@@ -138,6 +113,20 @@ jobs:
          echo "${cargo_home}/bin" >> "$GITHUB_PATH"
          : > "${cargo_home}/config.toml"

+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            ${{ github.workspace }}/.cargo-home/bin/
+            ${{ github.workspace }}/.cargo-home/registry/index/
+            ${{ github.workspace }}/.cargo-home/registry/cache/
+            ${{ github.workspace }}/.cargo-home/git/db/
+            ${{ github.workspace }}/codex-rs/target/
+          key: cargo-${{ matrix.runner }}-${{ matrix.target }}-release-${{ hashFiles('**/Cargo.lock') }}
+
      - if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl'}}
        name: Install Zig
        uses: mlugg/setup-zig@v2
@@ -205,14 +194,11 @@ jobs:
      - name: Cargo build
        shell: bash
        run: |
-          cargo build --target ${{ matrix.target }} --release --timings --bin codex --bin codex-responses-api-proxy
-
-      - name: Upload Cargo timings
-        uses: actions/upload-artifact@v6
-        with:
-          name: cargo-timings-rust-release-${{ matrix.target }}
-          path: codex-rs/target/**/cargo-timings/cargo-timing.html
-          if-no-files-found: warn
+          if [[ "${{ contains(matrix.target, 'windows') }}" == 'true' ]]; then
+            cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy --bin codex-windows-sandbox-setup --bin codex-command-runner
+          else
+            cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy
+          fi

      - if: ${{ contains(matrix.target, 'linux') }}
        name: Cosign Linux artifacts
@@ -221,6 +207,18 @@ jobs:
          target: ${{ matrix.target }}
          artifacts-dir: ${{ github.workspace }}/codex-rs/target/${{ matrix.target }}/release

+      - if: ${{ contains(matrix.target, 'windows') }}
+        name: Sign Windows binaries with Azure Trusted Signing
+        uses: ./.github/actions/windows-code-sign
+        with:
+          target: ${{ matrix.target }}
+          client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
+          endpoint: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
+          account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          certificate-profile-name: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
+
      - if: ${{ runner.os == 'macOS' }}
        name: MacOS code signing (binaries)
        uses: ./.github/actions/macos-code-sign
@@ -299,8 +297,15 @@ jobs:
          dest="dist/${{ matrix.target }}"
          mkdir -p "$dest"

-          cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}"
-          cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}"
+          if [[ "${{ matrix.runner }}" == windows* ]]; then
+            cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe"
+            cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe"
+            cp target/${{ matrix.target }}/release/codex-windows-sandbox-setup.exe "$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
+            cp target/${{ matrix.target }}/release/codex-command-runner.exe "$dest/codex-command-runner-${{ matrix.target }}.exe"
+          else
+            cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}"
+            cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}"
+          fi

          if [[ "${{ matrix.target }}" == *linux* ]]; then
            cp target/${{ matrix.target }}/release/codex.sigstore "$dest/codex-${{ matrix.target }}.sigstore"
@@ -311,18 +316,34 @@ jobs:
            cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg"
          fi

+      - if: ${{ matrix.runner == 'windows-11-arm' }}
+        name: Install zstd
+        shell: powershell
+        run: choco install -y zstandard
+
      - name: Compress artifacts
        shell: bash
        run: |
          # Path that contains the uncompressed binaries for the current
          # ${{ matrix.target }}
          dest="dist/${{ matrix.target }}"
+          repo_root=$PWD
+
+          # We want to ship the raw Windows executables in the GitHub Release
+          # in addition to the compressed archives. Keep the originals for
+          # Windows targets; remove them elsewhere to limit the number of
+          # artifacts that end up in the GitHub Release.
+          keep_originals=false
+          if [[ "${{ matrix.runner }}" == windows* ]]; then
+            keep_originals=true
+          fi

          # For compatibility with environments that lack the `zstd` tool we
-          # additionally create a `.tar.gz` alongside every binary we publish.
-          # The end result is:
+          # additionally create a `.tar.gz` for all platforms and `.zip` for
+          # Windows alongside every single binary that we publish. The end result is:
          #   codex-<target>.zst          (existing)
          #   codex-<target>.tar.gz       (new)
+          #   codex-<target>.zip          (only for Windows)

          # 1. Produce a .tar.gz for every file in the directory *before* we
          #    run `zstd --rm`, because that flag deletes the original files.
@@ -342,9 +363,43 @@ jobs:
            # Create per-binary tar.gz
            tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"

-            # Also create .zst and remove the uncompressed binaries to keep
-            # non-Windows artifact directories small.
-            zstd -T0 -19 --rm "$dest/$base"
+            # Create zip archive for Windows binaries
+            # Must run from inside the dest dir so 7z won't
+            # embed the directory path inside the zip.
+            if [[ "${{ matrix.runner }}" == windows* ]]; then
+              if [[ "$base" == "codex-${{ matrix.target }}.exe" ]]; then
+                # Bundle the sandbox helper binaries into the main codex zip so
+                # WinGet installs include the required helpers next to codex.exe.
+                # Fall back to the single-binary zip if the helpers are missing
+                # to avoid breaking releases.
+                bundle_dir="$(mktemp -d)"
+                runner_src="$dest/codex-command-runner-${{ matrix.target }}.exe"
+                setup_src="$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
+                if [[ -f "$runner_src" && -f "$setup_src" ]]; then
+                  cp "$dest/$base" "$bundle_dir/$base"
+                  cp "$runner_src" "$bundle_dir/codex-command-runner.exe"
+                  cp "$setup_src" "$bundle_dir/codex-windows-sandbox-setup.exe"
+                  # Use an absolute path so bundle zips land in the real dist
+                  # dir even when 7z runs from a temp directory.
+                  (cd "$bundle_dir" && 7z a "$repo_root/$dest/${base}.zip" .)
+                else
+                  echo "warning: missing sandbox binaries; falling back to single-binary zip"
+                  echo "warning: expected $runner_src and $setup_src"
+                  (cd "$dest" && 7z a "${base}.zip" "$base")
+                fi
+                rm -rf "$bundle_dir"
+              else
+                (cd "$dest" && 7z a "${base}.zip" "$base")
+              fi
+            fi
+
+            # Also create .zst (existing behaviour) *and* remove the original
+            # uncompressed binary to keep the directory small.
+            zstd_args=(-T0 -19)
+            if [[ "${keep_originals}" == false ]]; then
+              zstd_args+=(--rm)
+            fi
+            zstd "${zstd_args[@]}" "$dest/$base"
          done

      - uses: actions/upload-artifact@v6
@@ -355,13 +410,6 @@ jobs:
          path: |
            codex-rs/dist/${{ matrix.target }}/*

-  build-windows:
-    needs: tag-check
-    uses: ./.github/workflows/rust-release-windows.yml
-    with:
-      release-lto: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
-    secrets: inherit
-
  shell-tool-mcp:
    name: shell-tool-mcp
    needs: tag-check
@@ -374,7 +422,6 @@ jobs:
  release:
    needs:
      - build
-      - build-windows
      - shell-tool-mcp
    name: release
    runs-on: ubuntu-latest
@@ -423,12 +470,6 @@ jobs:
      - name: Delete entries from dist/ that should not go in the release
        run: |
          rm -rf dist/shell-tool-mcp*
-          rm -rf dist/windows-binaries*
-          # cargo-timing.html appears under multiple target-specific directories.
-          # If included in files: dist/**, release upload races on duplicate
-          # asset names and can fail with 404s.
-          find dist -type f -name 'cargo-timing.html' -delete
-          find dist -type d -empty -delete

          ls -R dist/

@@ -552,20 +593,18 @@ jobs:
          version="${{ needs.release.outputs.version }}"
          tag="${{ needs.release.outputs.tag }}"
          mkdir -p dist/npm
-          patterns=(
-            "codex-npm-${version}.tgz"
-            "codex-npm-linux-*-${version}.tgz"
-            "codex-npm-darwin-*-${version}.tgz"
-            "codex-npm-win32-*-${version}.tgz"
-            "codex-responses-api-proxy-npm-${version}.tgz"
-            "codex-sdk-npm-${version}.tgz"
-          )
-          for pattern in "${patterns[@]}"; do
-            gh release download "$tag" \
-              --repo "${GITHUB_REPOSITORY}" \
-              --pattern "$pattern" \
-              --dir dist/npm
-          done
+          gh release download "$tag" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "codex-npm-${version}.tgz" \
+            --dir dist/npm
+          gh release download "$tag" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "codex-responses-api-proxy-npm-${version}.tgz" \
+            --dir dist/npm
+          gh release download "$tag" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "codex-sdk-npm-${version}.tgz" \
+            --dir dist/npm

      # No NODE_AUTH_TOKEN needed because we use OIDC.
      - name: Publish to npm
@@ -574,44 +613,19 @@ jobs:
          NPM_TAG: ${{ needs.release.outputs.npm_tag }}
        run: |
          set -euo pipefail
-          prefix=""
+          tag_args=()
          if [[ -n "${NPM_TAG}" ]]; then
-            prefix="${NPM_TAG}-"
+            tag_args+=(--tag "${NPM_TAG}")
          fi

-          shopt -s nullglob
-          tarballs=(dist/npm/*-"${VERSION}".tgz)
-          if [[ ${#tarballs[@]} -eq 0 ]]; then
-            echo "No npm tarballs found in dist/npm for version ${VERSION}"
-            exit 1
-          fi
+          tarballs=(
+            "codex-npm-${VERSION}.tgz"
+            "codex-responses-api-proxy-npm-${VERSION}.tgz"
+            "codex-sdk-npm-${VERSION}.tgz"
+          )

          for tarball in "${tarballs[@]}"; do
-            filename="$(basename "${tarball}")"
-            tag=""
-
-            case "${filename}" in
-              codex-npm-linux-*-"${VERSION}".tgz|codex-npm-darwin-*-"${VERSION}".tgz|codex-npm-win32-*-"${VERSION}".tgz)
-                platform="${filename#codex-npm-}"
-                platform="${platform%-${VERSION}.tgz}"
-                tag="${prefix}${platform}"
-                ;;
-              codex-npm-"${VERSION}".tgz|codex-responses-api-proxy-npm-"${VERSION}".tgz|codex-sdk-npm-"${VERSION}".tgz)
-                tag="${NPM_TAG}"
-                ;;
-              *)
-                echo "Unexpected npm tarball: ${filename}"
-                exit 1
-                ;;
-            esac
-
-            publish_cmd=(npm publish "${GITHUB_WORKSPACE}/${tarball}")
-            if [[ -n "${tag}" ]]; then
-              publish_cmd+=(--tag "${tag}")
-            fi
-
-            echo "+ ${publish_cmd[*]}"
-            "${publish_cmd[@]}"
+            npm publish "${GITHUB_WORKSPACE}/dist/npm/${tarball}" "${tag_args[@]}"
          done

  update-branch:
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -13,13 +13,6 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@v6

-      - name: Install Linux bwrap build dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          sudo apt-get update -y
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-
      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
@@ -31,7 +24,7 @@ jobs:
          node-version: 22
          cache: pnpm

-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93

      - name: build codex
        run: cargo build --bin codex
--- a/.github/workflows/shell-tool-mcp.yml
+++ b/.github/workflows/shell-tool-mcp.yml
@@ -72,8 +72,6 @@ jobs:
    needs: metadata
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
-    env:
-      CARGO_PROFILE_RELEASE_LTO: ${{ contains(needs.metadata.outputs.version, '-alpha') && 'thin' || 'fat' }}
    defaults:
      run:
        working-directory: codex-rs
@@ -105,7 +103,7 @@ jobs:
            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y libubsan1
          fi

-      - uses: dtolnay/rust-toolchain@1.93.0
+      - uses: dtolnay/rust-toolchain@1.93
        with:
          targets: ${{ matrix.target }}

@@ -251,11 +249,11 @@ jobs:
          set -euo pipefail
          if command -v apt-get >/dev/null 2>&1; then
            apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential bison autoconf gettext libncursesw5-dev
+            DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential bison autoconf gettext
          elif command -v dnf >/dev/null 2>&1; then
-            dnf install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
+            dnf install -y git gcc gcc-c++ make bison autoconf gettext
          elif command -v yum >/dev/null 2>&1; then
-            yum install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
+            yum install -y git gcc gcc-c++ make bison autoconf gettext
          else
            echo "Unsupported package manager in container"
            exit 1
@@ -329,212 +327,6 @@ jobs:
          path: artifacts/**
          if-no-files-found: error

-  zsh-linux:
-    name: Build zsh (Linux) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    container:
-      image: ${{ matrix.image }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: ubuntu:24.04
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: ubuntu-22.04
-            image: ubuntu:22.04
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: debian-12
-            image: debian:12
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: debian-11
-            image: debian:11
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: centos-9
-            image: quay.io/centos/centos:stream9
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: arm64v8/ubuntu:24.04
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-22.04
-            image: arm64v8/ubuntu:22.04
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-20.04
-            image: arm64v8/ubuntu:20.04
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: debian-12
-            image: arm64v8/debian:12
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: debian-11
-            image: arm64v8/debian:11
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: centos-9
-            image: quay.io/centos/centos:stream9
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          if command -v apt-get >/dev/null 2>&1; then
-            apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential bison autoconf gettext libncursesw5-dev
-          elif command -v dnf >/dev/null 2>&1; then
-            dnf install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
-          elif command -v yum >/dev/null 2>&1; then
-            yum install -y git gcc gcc-c++ make bison autoconf gettext ncurses-devel
-          else
-            echo "Unsupported package manager in container"
-            exit 1
-          fi
-
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Build patched zsh
-        shell: bash
-        run: |
-          set -euo pipefail
-          git clone --depth 1 https://git.code.sf.net/p/zsh/code /tmp/zsh
-          cd /tmp/zsh
-          git fetch --depth 1 origin 77045ef899e53b9598bebc5a41db93a548a40ca6
-          git checkout 77045ef899e53b9598bebc5a41db93a548a40ca6
-          git apply "${GITHUB_WORKSPACE}/shell-tool-mcp/patches/zsh-exec-wrapper.patch"
-          ./Util/preconfig
-          ./configure
-          cores="$(command -v nproc >/dev/null 2>&1 && nproc || getconf _NPROCESSORS_ONLN)"
-          make -j"${cores}"
-
-          dest="${GITHUB_WORKSPACE}/artifacts/vendor/${{ matrix.target }}/zsh/${{ matrix.variant }}"
-          mkdir -p "$dest"
-          cp Src/zsh "$dest/zsh"
-
-      - name: Smoke test zsh exec wrapper
-        shell: bash
-        run: |
-          set -euo pipefail
-          tmpdir="$(mktemp -d)"
-          cat > "$tmpdir/exec-wrapper" <<'EOF'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          : "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
-          printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
-          file="$1"
-          shift
-          if [[ "$#" -eq 0 ]]; then
-            exec "$file"
-          fi
-          arg0="$1"
-          shift
-          exec -a "$arg0" "$file" "$@"
-          EOF
-          chmod +x "$tmpdir/exec-wrapper"
-
-          CODEX_WRAPPER_LOG="$tmpdir/wrapper.log" \
-          EXEC_WRAPPER="$tmpdir/exec-wrapper" \
-          /tmp/zsh/Src/zsh -fc '/bin/echo smoke-zsh' > "$tmpdir/stdout.txt"
-
-          grep -Fx "smoke-zsh" "$tmpdir/stdout.txt"
-          grep -Fx "/bin/echo" "$tmpdir/wrapper.log"
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: shell-tool-mcp-zsh-${{ matrix.target }}-${{ matrix.variant }}
-          path: artifacts/**
-          if-no-files-found: error
-
-  zsh-darwin:
-    name: Build zsh (macOS) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-15-xlarge
-            target: aarch64-apple-darwin
-            variant: macos-15
-          - runner: macos-14
-            target: aarch64-apple-darwin
-            variant: macos-14
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v autoconf >/dev/null 2>&1; then
-            brew install autoconf
-          fi
-
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Build patched zsh
-        shell: bash
-        run: |
-          set -euo pipefail
-          git clone --depth 1 https://git.code.sf.net/p/zsh/code /tmp/zsh
-          cd /tmp/zsh
-          git fetch --depth 1 origin 77045ef899e53b9598bebc5a41db93a548a40ca6
-          git checkout 77045ef899e53b9598bebc5a41db93a548a40ca6
-          git apply "${GITHUB_WORKSPACE}/shell-tool-mcp/patches/zsh-exec-wrapper.patch"
-          ./Util/preconfig
-          ./configure
-          cores="$(getconf _NPROCESSORS_ONLN)"
-          make -j"${cores}"
-
-          dest="${GITHUB_WORKSPACE}/artifacts/vendor/${{ matrix.target }}/zsh/${{ matrix.variant }}"
-          mkdir -p "$dest"
-          cp Src/zsh "$dest/zsh"
-
-      - name: Smoke test zsh exec wrapper
-        shell: bash
-        run: |
-          set -euo pipefail
-          tmpdir="$(mktemp -d)"
-          cat > "$tmpdir/exec-wrapper" <<'EOF'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          : "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
-          printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
-          file="$1"
-          shift
-          if [[ "$#" -eq 0 ]]; then
-            exec "$file"
-          fi
-          arg0="$1"
-          shift
-          exec -a "$arg0" "$file" "$@"
-          EOF
-          chmod +x "$tmpdir/exec-wrapper"
-
-          CODEX_WRAPPER_LOG="$tmpdir/wrapper.log" \
-          EXEC_WRAPPER="$tmpdir/exec-wrapper" \
-          /tmp/zsh/Src/zsh -fc '/bin/echo smoke-zsh' > "$tmpdir/stdout.txt"
-
-          grep -Fx "smoke-zsh" "$tmpdir/stdout.txt"
-          grep -Fx "/bin/echo" "$tmpdir/wrapper.log"
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: shell-tool-mcp-zsh-${{ matrix.target }}-${{ matrix.variant }}
-          path: artifacts/**
-          if-no-files-found: error
-
  package:
    name: Package npm module
    needs:
@@ -542,8 +334,6 @@ jobs:
      - rust-binaries
      - bash-linux
      - bash-darwin
-      - zsh-linux
-      - zsh-darwin
    runs-on: ubuntu-latest
    env:
      PACKAGE_VERSION: ${{ needs.metadata.outputs.version }}
@@ -617,8 +407,7 @@ jobs:
          chmod +x \
            "$staging"/vendor/*/codex-exec-mcp-server \
            "$staging"/vendor/*/codex-execve-wrapper \
-            "$staging"/vendor/*/bash/*/bash \
-            "$staging"/vendor/*/zsh/*/zsh
+            "$staging"/vendor/*/bash/*/bash

      - name: Create npm tarball
        shell: bash
--- a/.github/workflows/zstd
+++ b/.github/workflows/zstd
@@ -1,46 +0,0 @@
-#!/usr/bin/env dotslash
-
-// This DotSlash file wraps zstd for Windows runners.
-// The upstream release provides win32/win64 binaries; for windows-aarch64 we
-// use the win64 artifact via Windows x64 emulation.
-{
-  "name": "zstd",
-  "platforms": {
-    "windows-x86_64": {
-      "size": 1747181,
-      "hash": "sha256",
-      "digest": "acb4e8111511749dc7a3ebedca9b04190e37a17afeb73f55d4425dbf0b90fad9",
-      "format": "zip",
-      "path": "zstd-v1.5.7-win64/zstd.exe",
-      "providers": [
-        {
-          "url": "https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-v1.5.7-win64.zip"
-        },
-        {
-          "type": "github-release",
-          "repo": "facebook/zstd",
-          "tag": "v1.5.7",
-          "name": "zstd-v1.5.7-win64.zip"
-        }
-      ]
-    },
-    "windows-aarch64": {
-      "size": 1747181,
-      "hash": "sha256",
-      "digest": "acb4e8111511749dc7a3ebedca9b04190e37a17afeb73f55d4425dbf0b90fad9",
-      "format": "zip",
-      "path": "zstd-v1.5.7-win64/zstd.exe",
-      "providers": [
-        {
-          "url": "https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-v1.5.7-win64.zip"
-        },
-        {
-          "type": "github-release",
-          "repo": "facebook/zstd",
-          "tag": "v1.5.7",
-          "name": "zstd-v1.5.7-win64.zip"
-        }
-      ]
-    }
-  }
-}
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,14 +15,13 @@ In the codex-rs folder where the rust code lives:
 - When writing tests, prefer comparing the equality of entire objects over fields one by one.
 - When making a change that adds or changes an API, ensure that the documentation in the `docs/` folder is up to date if applicable.
 - If you change `ConfigToml` or nested config types, run `just write-config-schema` to update `codex-rs/core/config.schema.json`.
- Do not create small helper methods that are referenced only once.

 Run `just fmt` (in `codex-rs` directory) automatically after you have finished making Rust code changes; do not ask for approval to run it. Additionally, run the tests:

 1. Run the test for the specific project that was changed. For example, if changes were made in `codex-rs/tui`, run `cargo test -p codex-tui`.
 2. Once those pass, if any changes were made in common, core, or protocol, run the complete test suite with `cargo test --all-features`. project-specific or individual tests can be run without asking the user, but do ask the user before running the complete test suite.

-Before finalizing a large change to `codex-rs`, run `just fix -p <project>` (in `codex-rs` directory) to fix any linter issues in the code. Prefer scoping with `-p` to avoid slow workspace‑wide Clippy builds; only run `just fix` without `-p` if you changed shared crates. Do not re-run tests after running `fix` or `fmt`.
+Before finalizing a large change to `codex-rs`, run `just fix -p <project>` (in `codex-rs` directory) to fix any linter issues in the code. Prefer scoping with `-p` to avoid slow workspace‑wide Clippy builds; only run `just fix` without `-p` if you changed shared crates.

 ## TUI style conventions

@@ -60,14 +59,7 @@ See `codex-rs/tui/styles.md`.

 ### Snapshot tests

-This repo uses snapshot tests (via `insta`), especially in `codex-rs/tui`, to validate rendered output.
-
-**Requirement:** any change that affects user-visible UI (including adding new UI) must include
-corresponding `insta` snapshot coverage (add a new snapshot test if one doesn't exist yet, or
-update the existing snapshot). Review and accept snapshot updates as part of the PR so UI impact
-is easy to review and future diffs stay visual.
-
-When UI or text output changes intentionally, update the snapshots as follows:
+This repo uses snapshot tests (via `insta`), especially in `codex-rs/tui`, to validate rendered output. When UI or text output changes intentionally, update the snapshots as follows:

 - Run tests to generate any updated snapshots:
  - `cargo test -p codex-tui`
@@ -165,5 +157,3 @@ These guidelines apply to app-server protocol work in `codex-rs`, especially:
  `just write-app-server-schema`
  (and `just write-app-server-schema --experimental` when experimental API fixtures are affected).
 - Validate with `cargo test -p codex-app-server-protocol`.
- Avoid boilerplate tests that only assert experimental field markers for individual
-  request fields in `common.rs`; rely on schema generation/tests and behavioral coverage instead.
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,10 +1,11 @@
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "toolchains_llvm_bootstrapped", version = "0.5.3")
+bazel_dep(name = "toolchains_llvm_bootstrapped", version = "0.5.2")
 single_version_override(
    module_name = "toolchains_llvm_bootstrapped",
    patch_strip = 1,
    patches = [
        "//patches:toolchains_llvm_bootstrapped_resource_dir.patch",
+        "//patches:toolchains_llvm_private_frameworks.patch",
    ],
 )

@@ -49,15 +50,16 @@ use_repo(rules_rust, "rules_rust")
 toolchains = use_extension("@rules_rs//rs/experimental/toolchains:module_extension.bzl", "toolchains")
 toolchains.toolchain(
    edition = "2024",
-    version = "1.93.0",
+    # TODO(zbarsky): bump to 1.93 after fixing mingw
+    version = "1.92.0",
 )
 use_repo(
    toolchains,
-    "experimental_rust_toolchains_1_93_0",
-    "rust_toolchain_artifacts_macos_aarch64_1_93_0",
+    "experimental_rust_toolchains_1_92_0",
+    "rust_toolchain_artifacts_macos_aarch64_1_92_0",
 )

-register_toolchains("@experimental_rust_toolchains_1_93_0//:all")
+register_toolchains("@experimental_rust_toolchains_1_92_0//:all")

 crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
 crate.from_cargo(
@@ -96,7 +98,6 @@ crate.annotation(
 inject_repo(crate, "zstd")

 bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
-bazel_dep(name = "libcap", version = "2.27.bcr.1")

 crate.annotation(
    crate = "bzip2-sys",
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
--- a/3
+++ b/3
@@ -4,6 +4,3 @@ Copyright 2025 OpenAI
 This project includes code derived from [Ratatui](https://github.com/ratatui/ratatui), licensed under the MIT license.
 Copyright (c) 2016-2022 Florian Dehau
 Copyright (c) 2023-2025 The Ratatui Developers
-
-This project includes Meriyah parser assets from [meriyah](https://github.com/meriyah/meriyah), licensed under the ISC license.
-Copyright (c) 2019 and later, KFlash and others.
--- a/codex-cli/bin/codex.js
+++ b/codex-cli/bin/codex.js
@@ -3,23 +3,12 @@

 import { spawn } from "node:child_process";
 import { existsSync } from "fs";
-import { createRequire } from "node:module";
 import path from "path";
 import { fileURLToPath } from "url";

 // __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const require = createRequire(import.meta.url);
-
-const PLATFORM_PACKAGE_BY_TARGET = {
-  "x86_64-unknown-linux-musl": "@openai/codex-linux-x64",
-  "aarch64-unknown-linux-musl": "@openai/codex-linux-arm64",
-  "x86_64-apple-darwin": "@openai/codex-darwin-x64",
-  "aarch64-apple-darwin": "@openai/codex-darwin-arm64",
-  "x86_64-pc-windows-msvc": "@openai/codex-win32-x64",
-  "aarch64-pc-windows-msvc": "@openai/codex-win32-arm64",
-};

 const { platform, arch } = process;

@@ -70,51 +59,9 @@ if (!targetTriple) {
  throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }

-const platformPackage = PLATFORM_PACKAGE_BY_TARGET[targetTriple];
-if (!platformPackage) {
-  throw new Error(`Unsupported target triple: ${targetTriple}`);
-}
-
-const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
-const localVendorRoot = path.join(__dirname, "..", "vendor");
-const localBinaryPath = path.join(
-  localVendorRoot,
-  targetTriple,
-  "codex",
-  codexBinaryName,
-);
-
-let vendorRoot;
-try {
-  const packageJsonPath = require.resolve(`${platformPackage}/package.json`);
-  vendorRoot = path.join(path.dirname(packageJsonPath), "vendor");
-} catch {
-  if (existsSync(localBinaryPath)) {
-    vendorRoot = localVendorRoot;
-  } else {
-    const packageManager = detectPackageManager();
-    const updateCommand =
-      packageManager === "bun"
-        ? "bun install -g @openai/codex@latest"
-        : "npm install -g @openai/codex@latest";
-    throw new Error(
-      `Missing optional dependency ${platformPackage}. Reinstall Codex: ${updateCommand}`,
-    );
-  }
-}
-
-if (!vendorRoot) {
-  const packageManager = detectPackageManager();
-  const updateCommand =
-    packageManager === "bun"
-      ? "bun install -g @openai/codex@latest"
-      : "npm install -g @openai/codex@latest";
-  throw new Error(
-    `Missing optional dependency ${platformPackage}. Reinstall Codex: ${updateCommand}`,
-  );
-}
-
+const vendorRoot = path.join(__dirname, "..", "vendor");
 const archRoot = path.join(vendorRoot, targetTriple);
+const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
 const binaryPath = path.join(archRoot, "codex", codexBinaryName);

 // Use an asynchronous spawn instead of spawnSync so that Node is able to
--- a/codex-cli/scripts/README.md
+++ b/codex-cli/scripts/README.md
@@ -14,10 +14,6 @@ example, to stage the CLI, responses proxy, and SDK packages for version `0.6.0`
 This downloads the native artifacts once, hydrates `vendor/` for each package, and writes
 tarballs to `dist/npm/`.

-When `--package codex` is provided, the staging helper builds the lightweight
-`@openai/codex` meta package plus all platform-native `@openai/codex` variants
-that are later published under platform-specific dist-tags.
-
 If you need to invoke `build_npm_package.py` directly, run
 `codex-cli/scripts/install_native_deps.py` first and pass `--vendor-src` pointing to the
 directory that contains the populated `vendor/` tree.
--- a/codex-cli/scripts/build_npm_package.py
+++ b/codex-cli/scripts/build_npm_package.py
@@ -14,78 +14,15 @@ CODEX_CLI_ROOT = SCRIPT_DIR.parent
 REPO_ROOT = CODEX_CLI_ROOT.parent
 RESPONSES_API_PROXY_NPM_ROOT = REPO_ROOT / "codex-rs" / "responses-api-proxy" / "npm"
 CODEX_SDK_ROOT = REPO_ROOT / "sdk" / "typescript"
-CODEX_NPM_NAME = "@openai/codex"
-
-# `npm_name` is the local optional-dependency alias consumed by `bin/codex.js`.
-# The underlying package published to npm is always `@openai/codex`.
-CODEX_PLATFORM_PACKAGES: dict[str, dict[str, str]] = {
-    "codex-linux-x64": {
-        "npm_name": "@openai/codex-linux-x64",
-        "npm_tag": "linux-x64",
-        "target_triple": "x86_64-unknown-linux-musl",
-        "os": "linux",
-        "cpu": "x64",
-    },
-    "codex-linux-arm64": {
-        "npm_name": "@openai/codex-linux-arm64",
-        "npm_tag": "linux-arm64",
-        "target_triple": "aarch64-unknown-linux-musl",
-        "os": "linux",
-        "cpu": "arm64",
-    },
-    "codex-darwin-x64": {
-        "npm_name": "@openai/codex-darwin-x64",
-        "npm_tag": "darwin-x64",
-        "target_triple": "x86_64-apple-darwin",
-        "os": "darwin",
-        "cpu": "x64",
-    },
-    "codex-darwin-arm64": {
-        "npm_name": "@openai/codex-darwin-arm64",
-        "npm_tag": "darwin-arm64",
-        "target_triple": "aarch64-apple-darwin",
-        "os": "darwin",
-        "cpu": "arm64",
-    },
-    "codex-win32-x64": {
-        "npm_name": "@openai/codex-win32-x64",
-        "npm_tag": "win32-x64",
-        "target_triple": "x86_64-pc-windows-msvc",
-        "os": "win32",
-        "cpu": "x64",
-    },
-    "codex-win32-arm64": {
-        "npm_name": "@openai/codex-win32-arm64",
-        "npm_tag": "win32-arm64",
-        "target_triple": "aarch64-pc-windows-msvc",
-        "os": "win32",
-        "cpu": "arm64",
-    },
-}
-
-PACKAGE_EXPANSIONS: dict[str, list[str]] = {
-    "codex": ["codex", *CODEX_PLATFORM_PACKAGES],
-}

 PACKAGE_NATIVE_COMPONENTS: dict[str, list[str]] = {
-    "codex": [],
-    "codex-linux-x64": ["codex", "rg"],
-    "codex-linux-arm64": ["codex", "rg"],
-    "codex-darwin-x64": ["codex", "rg"],
-    "codex-darwin-arm64": ["codex", "rg"],
-    "codex-win32-x64": ["codex", "rg", "codex-windows-sandbox-setup", "codex-command-runner"],
-    "codex-win32-arm64": ["codex", "rg", "codex-windows-sandbox-setup", "codex-command-runner"],
+    "codex": ["codex", "rg"],
    "codex-responses-api-proxy": ["codex-responses-api-proxy"],
-    "codex-sdk": [],
+    "codex-sdk": ["codex"],
 }
-
-PACKAGE_TARGET_FILTERS: dict[str, str] = {
-    package_name: package_config["target_triple"]
-    for package_name, package_config in CODEX_PLATFORM_PACKAGES.items()
+WINDOWS_ONLY_COMPONENTS: dict[str, list[str]] = {
+    "codex": ["codex-windows-sandbox-setup", "codex-command-runner"],
 }
-
-PACKAGE_CHOICES = tuple(PACKAGE_NATIVE_COMPONENTS)
-
 COMPONENT_DEST_DIR: dict[str, str] = {
    "codex": "codex",
    "codex-responses-api-proxy": "codex-responses-api-proxy",
@@ -99,7 +36,7 @@ def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="Build or stage the Codex CLI npm package.")
    parser.add_argument(
        "--package",
-        choices=PACKAGE_CHOICES,
+        choices=("codex", "codex-responses-api-proxy", "codex-sdk"),
        default="codex",
        help="Which npm package to stage (default: codex).",
    )
@@ -161,7 +98,6 @@ def main() -> int:

        vendor_src = args.vendor_src.resolve() if args.vendor_src else None
        native_components = PACKAGE_NATIVE_COMPONENTS.get(package, [])
-        target_filter = PACKAGE_TARGET_FILTERS.get(package)

        if native_components:
            if vendor_src is None:
@@ -172,12 +108,7 @@ def main() -> int:
                    "pointing to a directory containing pre-installed binaries."
                )

-            copy_native_binaries(
-                vendor_src,
-                staging_dir,
-                native_components,
-                target_filter={target_filter} if target_filter else None,
-            )
+            copy_native_binaries(vendor_src, staging_dir, package, native_components)

        if release_version:
            staging_dir_str = str(staging_dir)
@@ -194,17 +125,12 @@ def main() -> int:
                    "Verify the responses API proxy:\n"
                    f"    node {staging_dir_str}/bin/codex-responses-api-proxy.js --help\n\n"
                )
-            elif package in CODEX_PLATFORM_PACKAGES:
-                print(
-                    f"Staged version {version} for release in {staging_dir_str}\n\n"
-                    "Verify native payload contents:\n"
-                    f"    ls {staging_dir_str}/vendor\n\n"
-                )
            else:
                print(
                    f"Staged version {version} for release in {staging_dir_str}\n\n"
                    "Verify the SDK contents:\n"
                    f"    ls {staging_dir_str}/dist\n"
+                    f"    ls {staging_dir_str}/vendor\n"
                    "    node -e \"import('./dist/index.js').then(() => console.log('ok'))\"\n\n"
                )
        else:
@@ -234,9 +160,6 @@ def prepare_staging_dir(staging_dir: Path | None) -> tuple[Path, bool]:


 def stage_sources(staging_dir: Path, version: str, package: str) -> None:
-    package_json: dict
-    package_json_path: Path | None = None
-
    if package == "codex":
        bin_dir = staging_dir / "bin"
        bin_dir.mkdir(parents=True, exist_ok=True)
@@ -250,35 +173,6 @@ def stage_sources(staging_dir: Path, version: str, package: str) -> None:
            shutil.copy2(readme_src, staging_dir / "README.md")

        package_json_path = CODEX_CLI_ROOT / "package.json"
-    elif package in CODEX_PLATFORM_PACKAGES:
-        platform_package = CODEX_PLATFORM_PACKAGES[package]
-        platform_npm_tag = platform_package["npm_tag"]
-        platform_version = compute_platform_package_version(version, platform_npm_tag)
-
-        readme_src = REPO_ROOT / "README.md"
-        if readme_src.exists():
-            shutil.copy2(readme_src, staging_dir / "README.md")
-
-        with open(CODEX_CLI_ROOT / "package.json", "r", encoding="utf-8") as fh:
-            codex_package_json = json.load(fh)
-
-        package_json = {
-            "name": CODEX_NPM_NAME,
-            "version": platform_version,
-            "license": codex_package_json.get("license", "Apache-2.0"),
-            "os": [platform_package["os"]],
-            "cpu": [platform_package["cpu"]],
-            "files": ["vendor"],
-            "repository": codex_package_json.get("repository"),
-        }
-
-        engines = codex_package_json.get("engines")
-        if isinstance(engines, dict):
-            package_json["engines"] = engines
-
-        package_manager = codex_package_json.get("packageManager")
-        if isinstance(package_manager, str):
-            package_json["packageManager"] = package_manager
    elif package == "codex-responses-api-proxy":
        bin_dir = staging_dir / "bin"
        bin_dir.mkdir(parents=True, exist_ok=True)
@@ -296,44 +190,27 @@ def stage_sources(staging_dir: Path, version: str, package: str) -> None:
    else:
        raise RuntimeError(f"Unknown package '{package}'.")

-    if package_json_path is not None:
-        with open(package_json_path, "r", encoding="utf-8") as fh:
-            package_json = json.load(fh)
-        package_json["version"] = version
+    with open(package_json_path, "r", encoding="utf-8") as fh:
+        package_json = json.load(fh)
+    package_json["version"] = version

-    if package == "codex":
-        package_json["files"] = ["bin"]
-        package_json["optionalDependencies"] = {
-            CODEX_PLATFORM_PACKAGES[platform_package]["npm_name"]: (
-                f"npm:{CODEX_NPM_NAME}@"
-                f"{compute_platform_package_version(version, CODEX_PLATFORM_PACKAGES[platform_package]['npm_tag'])}"
-            )
-            for platform_package in PACKAGE_EXPANSIONS["codex"]
-            if platform_package != "codex"
-        }
-
-    elif package == "codex-sdk":
+    if package == "codex-sdk":
        scripts = package_json.get("scripts")
        if isinstance(scripts, dict):
            scripts.pop("prepare", None)

-        dependencies = package_json.get("dependencies")
-        if not isinstance(dependencies, dict):
-            dependencies = {}
-        dependencies[CODEX_NPM_NAME] = version
-        package_json["dependencies"] = dependencies
+        files = package_json.get("files")
+        if isinstance(files, list):
+            if "vendor" not in files:
+                files.append("vendor")
+        else:
+            package_json["files"] = ["dist", "vendor"]

    with open(staging_dir / "package.json", "w", encoding="utf-8") as out:
        json.dump(package_json, out, indent=2)
        out.write("\n")


-def compute_platform_package_version(version: str, platform_tag: str) -> str:
-    # npm forbids republishing the same package name/version, so each
-    # platform-specific tarball needs a unique version string.
-    return f"{version}-{platform_tag}"
-
-
 def run_command(cmd: list[str], cwd: Path | None = None) -> None:
    print("+", " ".join(cmd))
    subprocess.run(cmd, cwd=cwd, check=True)
@@ -363,8 +240,8 @@ def stage_codex_sdk_sources(staging_dir: Path) -> None:
 def copy_native_binaries(
    vendor_src: Path,
    staging_dir: Path,
+    package: str,
    components: list[str],
-    target_filter: set[str] | None = None,
 ) -> None:
    vendor_src = vendor_src.resolve()
    if not vendor_src.exists():
@@ -379,18 +256,15 @@ def copy_native_binaries(
        shutil.rmtree(vendor_dest)
    vendor_dest.mkdir(parents=True, exist_ok=True)

-    copied_targets: set[str] = set()
-
    for target_dir in vendor_src.iterdir():
        if not target_dir.is_dir():
            continue

-        if target_filter is not None and target_dir.name not in target_filter:
-            continue
+        if "windows" in target_dir.name:
+            components_set.update(WINDOWS_ONLY_COMPONENTS.get(package, []))

        dest_target_dir = vendor_dest / target_dir.name
        dest_target_dir.mkdir(parents=True, exist_ok=True)
-        copied_targets.add(target_dir.name)

        for component in components_set:
            dest_dir_name = COMPONENT_DEST_DIR.get(component)
@@ -408,12 +282,6 @@ def copy_native_binaries(
                shutil.rmtree(dest_component_dir)
            shutil.copytree(src_component_dir, dest_component_dir)

-    if target_filter is not None:
-        missing_targets = sorted(target_filter - copied_targets)
-        if missing_targets:
-            missing_list = ", ".join(missing_targets)
-            raise RuntimeError(f"Missing target directories in vendor source: {missing_list}")
-

 def run_npm_pack(staging_dir: Path, output_path: Path) -> Path:
    output_path = output_path.resolve()
--- a/codex-rs/BUILD.bazel
+++ b/codex-rs/BUILD.bazel
@@ -1,3 +1 @@
-exports_files([
-    "node-version.txt",
-])
+
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -374,9 +374,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"

 [[package]]
 name = "app_test_support"
@@ -458,58 +458,6 @@ dependencies = [
 "term",
 ]

-[[package]]
-name = "askama"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08e1676b346cadfec169374f949d7490fd80a24193d37d2afce0c047cf695e57"
-dependencies = [
- "askama_macros",
- "itoa",
- "percent-encoding",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "askama_derive"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7661ff56517787343f376f75db037426facd7c8d3049cef8911f1e75016f3a37"
-dependencies = [
- "askama_parser",
- "basic-toml",
- "memchr",
- "proc-macro2",
- "quote",
- "rustc-hash 2.1.1",
- "serde",
- "serde_derive",
- "syn 2.0.114",
-]
-
-[[package]]
-name = "askama_macros"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "713ee4dbfd1eb719c2dab859465b01fa1d21cb566684614a713a6b7a99a4e47b"
-dependencies = [
- "askama_derive",
-]
-
-[[package]]
-name = "askama_parser"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d62d674238a526418b30c0def480d5beadb9d8964e7f38d635b03bf639c704c"
-dependencies = [
- "rustc-hash 2.1.1",
- "serde",
- "serde_derive",
- "unicode-ident",
- "winnow",
-]
-
 [[package]]
 name = "asn1-rs"
 version = "0.7.1"
@@ -974,20 +922,6 @@ dependencies = [
 "piper",
 ]

-[[package]]
-name = "bm25"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cbd8ffdfb7b4c2ff038726178a780a94f90525ed0ad264c0afaa75dd8c18a64"
-dependencies = [
- "cached",
- "deunicode",
- "fxhash",
- "rust-stemmers",
- "stop-words",
- "unicode-segmentation",
-]
-
 [[package]]
 name = "borsh"
 version = "1.6.0"
@@ -1066,39 +1000,6 @@ dependencies = [
 "pkg-config",
 ]

-[[package]]
-name = "cached"
-version = "0.56.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "801927ee168e17809ab8901d9f01f700cd7d8d6a6527997fee44e4b0327a253c"
-dependencies = [
- "ahash",
- "cached_proc_macro",
- "cached_proc_macro_types",
- "hashbrown 0.15.5",
- "once_cell",
- "thiserror 2.0.18",
- "web-time",
-]
-
-[[package]]
-name = "cached_proc_macro"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9225bdcf4e4a9a4c08bf16607908eb2fbf746828d5e0b5e019726dbf6571f201"
-dependencies = [
- "darling 0.20.11",
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
-[[package]]
-name = "cached_proc_macro_types"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ade8366b8bd5ba243f0a58f036cc0ca8a2f069cff1a2351ef1cac6b083e16fc0"
-
 [[package]]
 name = "cassowary"
 version = "0.3.0"
@@ -1318,13 +1219,13 @@ dependencies = [
 "bytes",
 "codex-client",
 "codex-protocol",
- "codex-utils-rustls-provider",
 "eventsource-stream",
 "futures",
 "http 1.4.0",
 "pretty_assertions",
 "regex-lite",
 "reqwest",
+ "rustls",
 "serde",
 "serde_json",
 "thiserror 2.0.18",
@@ -1354,6 +1255,7 @@ dependencies = [
 "codex-backend-client",
 "codex-chatgpt",
 "codex-cloud-requirements",
+ "codex-common",
 "codex-core",
 "codex-execpolicy",
 "codex-feedback",
@@ -1363,7 +1265,6 @@ dependencies = [
 "codex-rmcp-client",
 "codex-utils-absolute-path",
 "codex-utils-cargo-bin",
- "codex-utils-cli",
 "codex-utils-json-to-toml",
 "core_test_support",
 "futures",
@@ -1401,7 +1302,6 @@ dependencies = [
 "schemars 0.8.22",
 "serde",
 "serde_json",
- "shlex",
 "similar",
 "strum_macros 0.27.2",
 "tempfile",
@@ -1491,10 +1391,10 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "clap",
+ "codex-common",
 "codex-core",
 "codex-git",
 "codex-utils-cargo-bin",
- "codex-utils-cli",
 "pretty_assertions",
 "serde",
 "serde_json",
@@ -1518,6 +1418,7 @@ dependencies = [
 "codex-arg0",
 "codex-chatgpt",
 "codex-cloud-tasks",
+ "codex-common",
 "codex-core",
 "codex-exec",
 "codex-execpolicy",
@@ -1529,7 +1430,6 @@ dependencies = [
 "codex-stdio-to-uds",
 "codex-tui",
 "codex-utils-cargo-bin",
- "codex-utils-cli",
 "codex-windows-sandbox",
 "libc",
 "owo-colors",
@@ -1573,18 +1473,13 @@ version = "0.0.0"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
- "chrono",
 "codex-backend-client",
 "codex-core",
 "codex-otel",
 "codex-protocol",
- "hmac",
 "pretty_assertions",
- "serde",
 "serde_json",
- "sha2",
 "tempfile",
- "thiserror 2.0.18",
 "tokio",
 "toml 0.9.11+spec-1.1.0",
 "tracing",
@@ -1600,10 +1495,10 @@ dependencies = [
 "chrono",
 "clap",
 "codex-cloud-tasks-client",
+ "codex-common",
 "codex-core",
 "codex-login",
 "codex-tui",
- "codex-utils-cli",
 "crossterm",
 "owo-colors",
 "pretty_assertions",
@@ -1635,22 +1530,17 @@ dependencies = [
 ]

 [[package]]
-name = "codex-config"
+name = "codex-common"
 version = "0.0.0"
 dependencies = [
- "anyhow",
- "codex-app-server-protocol",
- "codex-execpolicy",
+ "clap",
+ "codex-core",
+ "codex-lmstudio",
+ "codex-ollama",
 "codex-protocol",
 "codex-utils-absolute-path",
- "futures",
- "multimap",
 "pretty_assertions",
 "serde",
- "serde_json",
- "sha2",
- "thiserror 2.0.18",
- "tokio",
 "toml 0.9.11+spec-1.1.0",
 ]

@@ -1660,13 +1550,11 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "arc-swap",
- "askama",
 "assert_cmd",
 "assert_matches",
 "async-channel",
 "async-trait",
 "base64 0.22.1",
- "bm25",
 "chardetng",
 "chrono",
 "clap",
@@ -1676,24 +1564,20 @@ dependencies = [
 "codex-arg0",
 "codex-async-utils",
 "codex-client",
- "codex-config",
+ "codex-core",
 "codex-execpolicy",
 "codex-file-search",
 "codex-git",
- "codex-hooks",
 "codex-keyring-store",
- "codex-network-proxy",
 "codex-otel",
 "codex-protocol",
 "codex-rmcp-client",
- "codex-shell-command",
 "codex-state",
 "codex-utils-absolute-path",
 "codex-utils-cargo-bin",
 "codex-utils-home-dir",
 "codex-utils-pty",
 "codex-utils-readiness",
- "codex-utils-sanitizer",
 "codex-utils-string",
 "codex-windows-sandbox",
 "core-foundation 0.9.4",
@@ -1714,6 +1598,7 @@ dependencies = [
 "landlock",
 "libc",
 "maplit",
+ "multimap",
 "notify",
 "once_cell",
 "openssl-sys",
@@ -1722,6 +1607,7 @@ dependencies = [
 "predicates",
 "pretty_assertions",
 "rand 0.9.2",
+ "regex",
 "regex-lite",
 "reqwest",
 "rmcp",
@@ -1749,12 +1635,13 @@ dependencies = [
 "tracing",
 "tracing-subscriber",
 "tracing-test",
+ "tree-sitter",
+ "tree-sitter-bash",
 "url",
 "uuid",
 "walkdir",
 "which",
 "wildmatch",
- "windows-sys 0.52.0",
 "wiremock",
 "zip",
 "zstd",
@@ -1781,14 +1668,11 @@ dependencies = [
 "clap",
 "codex-arg0",
 "codex-cloud-requirements",
+ "codex-common",
 "codex-core",
 "codex-protocol",
 "codex-utils-absolute-path",
 "codex-utils-cargo-bin",
- "codex-utils-cli",
- "codex-utils-elapsed",
- "codex-utils-oss",
- "codex-utils-sandbox-summary",
 "core_test_support",
 "libc",
 "owo-colors",
@@ -1925,21 +1809,6 @@ dependencies = [
 "walkdir",
 ]

-[[package]]
-name = "codex-hooks"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "chrono",
- "codex-protocol",
- "futures",
- "pretty_assertions",
- "serde",
- "serde_json",
- "tempfile",
- "tokio",
-]
-
 [[package]]
 name = "codex-keyring-store"
 version = "0.0.0"
@@ -2009,9 +1878,9 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "codex-arg0",
+ "codex-common",
 "codex-core",
 "codex-protocol",
- "codex-utils-cli",
 "codex-utils-json-to-toml",
 "core_test_support",
 "mcp_test_support",
@@ -2035,10 +1904,10 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "async-trait",
- "base64 0.22.1",
 "clap",
+ "codex-app-server-protocol",
+ "codex-core",
 "codex-utils-absolute-path",
- "codex-utils-rustls-provider",
 "globset",
 "pretty_assertions",
 "rama-core",
@@ -2052,10 +1921,10 @@ dependencies = [
 "serde",
 "serde_json",
 "tempfile",
- "thiserror 2.0.18",
 "time",
 "tokio",
 "tracing",
+ "tracing-subscriber",
 "url",
 ]

@@ -2208,26 +2077,6 @@ dependencies = [
 "tracing",
 ]

-[[package]]
-name = "codex-shell-command"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "base64 0.22.1",
- "codex-protocol",
- "codex-utils-absolute-path",
- "once_cell",
- "pretty_assertions",
- "regex",
- "serde",
- "serde_json",
- "shlex",
- "tree-sitter",
- "tree-sitter-bash",
- "url",
- "which",
-]
-
 [[package]]
 name = "codex-state"
 version = "0.0.0"
@@ -2279,6 +2128,7 @@ dependencies = [
 "codex-chatgpt",
 "codex-cli",
 "codex-cloud-requirements",
+ "codex-common",
 "codex-core",
 "codex-feedback",
 "codex-file-search",
@@ -2287,14 +2137,8 @@ dependencies = [
 "codex-protocol",
 "codex-state",
 "codex-utils-absolute-path",
- "codex-utils-approval-presets",
 "codex-utils-cargo-bin",
- "codex-utils-cli",
- "codex-utils-elapsed",
- "codex-utils-fuzzy-match",
- "codex-utils-oss",
 "codex-utils-pty",
- "codex-utils-sandbox-summary",
 "codex-windows-sandbox",
 "color-eyre",
 "crossterm",
@@ -2340,7 +2184,6 @@ dependencies = [
 "url",
 "uuid",
 "vt100",
- "webbrowser",
 "which",
 "windows-sys 0.52.0",
 "winsplit",
@@ -2360,13 +2203,6 @@ dependencies = [
 "ts-rs",
 ]

-[[package]]
-name = "codex-utils-approval-presets"
-version = "0.0.0"
-dependencies = [
- "codex-core",
-]
-
 [[package]]
 name = "codex-utils-cache"
 version = "0.0.0"
@@ -2385,26 +2221,6 @@ dependencies = [
 "thiserror 2.0.18",
 ]

-[[package]]
-name = "codex-utils-cli"
-version = "0.0.0"
-dependencies = [
- "clap",
- "codex-core",
- "codex-protocol",
- "pretty_assertions",
- "serde",
- "toml 0.9.11+spec-1.1.0",
-]
-
-[[package]]
-name = "codex-utils-elapsed"
-version = "0.0.0"
-
-[[package]]
-name = "codex-utils-fuzzy-match"
-version = "0.0.0"
-
 [[package]]
 name = "codex-utils-home-dir"
 version = "0.0.0"
@@ -2435,15 +2251,6 @@ dependencies = [
 "toml 0.9.11+spec-1.1.0",
 ]

-[[package]]
-name = "codex-utils-oss"
-version = "0.0.0"
-dependencies = [
- "codex-core",
- "codex-lmstudio",
- "codex-ollama",
-]
-
 [[package]]
 name = "codex-utils-pty"
 version = "0.0.0"
@@ -2471,29 +2278,6 @@ dependencies = [
 "tokio",
 ]

-[[package]]
-name = "codex-utils-rustls-provider"
-version = "0.0.0"
-dependencies = [
- "rustls",
-]
-
-[[package]]
-name = "codex-utils-sandbox-summary"
-version = "0.0.0"
-dependencies = [
- "codex-core",
- "codex-utils-absolute-path",
- "pretty_assertions",
-]
-
-[[package]]
-name = "codex-utils-sanitizer"
-version = "0.0.0"
-dependencies = [
- "regex",
-]
-
 [[package]]
 name = "codex-utils-string"
 version = "0.0.0"
@@ -2550,12 +2334,6 @@ dependencies = [
 "tracing-error",
 ]

-[[package]]
-name = "color_quant"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
-
 [[package]]
 name = "colorchoice"
 version = "1.0.4"
@@ -2715,7 +2493,6 @@ dependencies = [
 "codex-protocol",
 "codex-utils-absolute-path",
 "codex-utils-cargo-bin",
- "ctor 0.6.3",
 "futures",
 "notify",
 "pretty_assertions",
@@ -2927,16 +2704,6 @@ dependencies = [
 "syn 2.0.114",
 ]

-[[package]]
-name = "darling"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
-dependencies = [
- "darling_core 0.20.11",
- "darling_macro 0.20.11",
-]
-
 [[package]]
 name = "darling"
 version = "0.21.3"
@@ -2957,20 +2724,6 @@ dependencies = [
 "darling_macro 0.23.0",
 ]

-[[package]]
-name = "darling_core"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim 0.11.1",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "darling_core"
 version = "0.21.3"
@@ -2998,17 +2751,6 @@ dependencies = [
 "syn 2.0.114",
 ]

-[[package]]
-name = "darling_macro"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
-dependencies = [
- "darling_core 0.20.11",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.21.3"
@@ -3213,12 +2955,6 @@ dependencies = [
 "unicode-xid",
 ]

-[[package]]
-name = "deunicode"
-version = "1.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abd57806937c9cc163efc8ea3910e00a62e2aeb0b8119f1793a978088f8f6b04"
-
 [[package]]
 name = "diff"
 version = "0.1.13"
@@ -4052,16 +3788,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "gif"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5df2ba84018d80c213569363bdcd0c64e6933c67fe4c1d60ecf822971a3c35e"
-dependencies = [
- "color_quant",
- "weezl",
-]
-
 [[package]]
 name = "gimli"
 version = "0.32.3"
@@ -4709,9 +4435,6 @@ checksum = "e6506c6c10786659413faa717ceebcb8f70731c0a60cbae39795fdf114519c1a"
 dependencies = [
 "bytemuck",
 "byteorder-lite",
- "color_quant",
- "gif",
- "image-webp",
 "moxcms",
 "num-traits",
 "png",
@@ -4720,16 +4443,6 @@ dependencies = [
 "zune-jpeg 0.5.12",
 ]

-[[package]]
-name = "image-webp"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
-dependencies = [
- "byteorder-lite",
- "quick-error",
-]
-
 [[package]]
 name = "impl-more"
 version = "0.1.9"
@@ -4825,9 +4538,9 @@ dependencies = [

 [[package]]
 name = "insta"
-version = "1.46.3"
+version = "1.46.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e82db8c87c7f1ccecb34ce0c24399b8a73081427f3c7c50a5d597925356115e4"
+checksum = "38c91d64f9ad425e80200a50a0e8b8a641680b44e33ce832efe5b8bc65161b07"
 dependencies = [
 "console",
 "once_cell",
@@ -7294,9 +7007,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -7404,9 +7117,9 @@ dependencies = [

 [[package]]
 name = "rmcp"
-version = "0.15.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bef41ebc9ebed2c1b1d90203e9d1756091e8a00bbc3107676151f39868ca0ee"
+checksum = "0a621b37a548ff6ab6292d57841eb25785a7f146d89391a19c9f199414bd13da"
 dependencies = [
 "async-trait",
 "axum",
@@ -7440,9 +7153,9 @@ dependencies = [

 [[package]]
 name = "rmcp-macros"
-version = "0.15.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e88ad84b8b6237a934534a62b379a5be6388915663c0cc598ceb9b3292bbbfe"
+checksum = "6b79ed92303f9262db79575aa8c3652581668e9d136be6fd0b9ededa78954c95"
 dependencies = [
 "darling 0.23.0",
 "proc-macro2",
@@ -7510,16 +7223,6 @@ dependencies = [
 "walkdir",
 ]

-[[package]]
-name = "rust-stemmers"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e46a2036019fdb888131db7a4c847a1063a7493f971ed94ea82c67eada63ca54"
-dependencies = [
- "serde",
- "serde_derive",
-]
-
 [[package]]
 name = "rustc-demangle"
 version = "0.1.27"
@@ -8753,15 +8456,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

-[[package]]
-name = "stop-words"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645a3d441ccf4bf47f2e4b7681461986681a6eeea9937d4c3bc9febd61d17c71"
-dependencies = [
- "serde_json",
-]
-
 [[package]]
 name = "streaming-iterator"
 version = "0.1.9"
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -15,10 +15,8 @@ members = [
    "cloud-tasks",
    "cloud-tasks-client",
    "cli",
-    "config",
-    "shell-command",
+    "common",
    "core",
-    "hooks",
    "secrets",
    "exec",
    "exec-server",
@@ -48,15 +46,7 @@ members = [
    "utils/home-dir",
    "utils/pty",
    "utils/readiness",
-    "utils/rustls-provider",
    "utils/string",
-    "utils/cli",
-    "utils/elapsed",
-    "utils/sandbox-summary",
-    "utils/sanitizer",
-    "utils/approval-presets",
-    "utils/oss",
-    "utils/fuzzy-match",
    "codex-client",
    "codex-api",
    "state",
@@ -85,52 +75,41 @@ codex-apply-patch = { path = "apply-patch" }
 codex-arg0 = { path = "arg0" }
 codex-async-utils = { path = "async-utils" }
 codex-backend-client = { path = "backend-client" }
-codex-chatgpt = { path = "chatgpt" }
-codex-cli = { path = "cli" }
-codex-client = { path = "codex-client" }
 codex-cloud-requirements = { path = "cloud-requirements" }
-codex-config = { path = "config" }
+codex-chatgpt = { path = "chatgpt" }
+codex-cli = { path = "cli"}
+codex-client = { path = "codex-client" }
+codex-common = { path = "common" }
 codex-core = { path = "core" }
+codex-secrets = { path = "secrets" }
 codex-exec = { path = "exec" }
 codex-execpolicy = { path = "execpolicy" }
 codex-experimental-api-macros = { path = "codex-experimental-api-macros" }
 codex-feedback = { path = "feedback" }
 codex-file-search = { path = "file-search" }
 codex-git = { path = "utils/git" }
-codex-hooks = { path = "hooks" }
 codex-keyring-store = { path = "keyring-store" }
 codex-linux-sandbox = { path = "linux-sandbox" }
 codex-lmstudio = { path = "lmstudio" }
 codex-login = { path = "login" }
 codex-mcp-server = { path = "mcp-server" }
-codex-network-proxy = { path = "network-proxy" }
 codex-ollama = { path = "ollama" }
 codex-otel = { path = "otel" }
 codex-process-hardening = { path = "process-hardening" }
 codex-protocol = { path = "protocol" }
 codex-responses-api-proxy = { path = "responses-api-proxy" }
 codex-rmcp-client = { path = "rmcp-client" }
-codex-secrets = { path = "secrets" }
-codex-shell-command = { path = "shell-command" }
 codex-state = { path = "state" }
 codex-stdio-to-uds = { path = "stdio-to-uds" }
 codex-tui = { path = "tui" }
 codex-utils-absolute-path = { path = "utils/absolute-path" }
-codex-utils-approval-presets = { path = "utils/approval-presets" }
 codex-utils-cache = { path = "utils/cache" }
 codex-utils-cargo-bin = { path = "utils/cargo-bin" }
-codex-utils-cli = { path = "utils/cli" }
-codex-utils-elapsed = { path = "utils/elapsed" }
-codex-utils-fuzzy-match = { path = "utils/fuzzy-match" }
-codex-utils-home-dir = { path = "utils/home-dir" }
 codex-utils-image = { path = "utils/image" }
 codex-utils-json-to-toml = { path = "utils/json-to-toml" }
-codex-utils-oss = { path = "utils/oss" }
+codex-utils-home-dir = { path = "utils/home-dir" }
 codex-utils-pty = { path = "utils/pty" }
 codex-utils-readiness = { path = "utils/readiness" }
-codex-utils-rustls-provider = { path = "utils/rustls-provider" }
-codex-utils-sandbox-summary = { path = "utils/sandbox-summary" }
-codex-utils-sanitizer = { path = "utils/sanitizer" }
 codex-utils-string = { path = "utils/string" }
 codex-windows-sandbox = { path = "windows-sandbox-rs" }
 core_test_support = { path = "core/tests/common" }
@@ -143,7 +122,6 @@ allocative = "0.3.3"
 ansi-to-tui = "7.0.0"
 anyhow = "1"
 arboard = { version = "3", features = ["wayland-data-control"] }
-askama = "0.15.4"
 assert_cmd = "2"
 assert_matches = "1.5.0"
 async-channel = "2.3.1"
@@ -151,15 +129,14 @@ async-stream = "0.3.6"
 async-trait = "0.1.89"
 axum = { version = "0.8", default-features = false }
 base64 = "0.22.1"
-bm25 = "2.3.2"
 bytes = "1.10.1"
 chardetng = "0.1.17"
 chrono = "0.4.43"
 clap = "4"
 clap_complete = "4"
 color-eyre = "0.6.3"
-crossbeam-channel = "0.5.15"
 crossterm = "0.28.1"
+crossbeam-channel = "0.5.15"
 ctor = "0.6.3"
 derive_more = "2"
 diffy = "0.4.2"
@@ -177,11 +154,11 @@ icu_decimal = "2.1"
 icu_locale_core = "2.1"
 icu_provider = { version = "2.1", features = ["sync"] }
 ignore = "0.4.23"
+indoc = "2.0"
 image = { version = "^0.25.9", default-features = false }
 include_dir = "0.7.4"
 indexmap = "2.12.0"
-indoc = "2.0"
-insta = "1.46.3"
+insta = "1.46.0"
 inventory = "0.3.19"
 itertools = "0.14.0"
 keyring = { version = "3.6", default-features = false }
@@ -202,6 +179,7 @@ opentelemetry-appender-tracing = "0.31.0"
 opentelemetry-otlp = "0.31.0"
 opentelemetry-semantic-conventions = "0.31.0"
 opentelemetry_sdk = "0.31.0"
+tracing-opentelemetry = "0.32.0"
 os_info = "3.12.0"
 owo-colors = "4.2.0"
 path-absolutize = "3.1.1"
@@ -213,18 +191,14 @@ pulldown-cmark = "0.10"
 rand = "0.9"
 ratatui = "0.29.0"
 ratatui-macros = "0.6.0"
-regex = "1.12.3"
+regex = "1.12.2"
 regex-lite = "0.1.8"
 reqwest = "0.12"
-rmcp = { version = "0.15.0", default-features = false }
+rmcp = { version = "0.14.0", default-features = false }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 runfiles = { git = "https://github.com/dzbarsky/rules_rust", rev = "b56cbaa8465e74127f1ea216f813cd377295ad81" }
-rustls = { version = "0.23", default-features = false, features = [
-    "ring",
-    "std",
-] }
 schemars = "0.8.22"
 seccompiler = "0.5.0"
-semver = "1.0"
 sentry = "0.46.0"
 serde = "1"
 serde_json = "1"
@@ -234,19 +208,11 @@ serde_yaml = "0.9"
 serial_test = "3.2.0"
 sha1 = "0.10.6"
 sha2 = "0.10"
+semver = "1.0"
 shlex = "1.3.0"
 similar = "2.7.0"
 socket2 = "0.6.1"
-sqlx = { version = "0.8.6", default-features = false, features = [
-    "chrono",
-    "json",
-    "macros",
-    "migrate",
-    "runtime-tokio-rustls",
-    "sqlite",
-    "time",
-    "uuid",
-] }
+sqlx = { version = "0.8.6", default-features = false, features = ["chrono", "json", "macros", "migrate", "runtime-tokio-rustls", "sqlite", "time", "uuid"] }
 starlark = "0.13.0"
 strum = "0.27.2"
 strum_macros = "0.27.2"
@@ -261,23 +227,20 @@ tiny_http = "0.12"
 tokio = "1"
 tokio-stream = "0.1.18"
 tokio-test = "0.4"
-tokio-tungstenite = { version = "0.28.0", features = [
-    "proxy",
-    "rustls-tls-native-roots",
-] }
+tokio-tungstenite = { version = "0.28.0", features = ["proxy", "rustls-tls-native-roots"] }
+tungstenite = { version = "0.27.0", features = ["deflate", "proxy"] }
 tokio-util = "0.7.18"
 toml = "0.9.5"
 toml_edit = "0.24.0"
 tracing = "0.1.44"
 tracing-appender = "0.2.3"
-tracing-opentelemetry = "0.32.0"
 tracing-subscriber = "0.3.22"
 tracing-test = "0.2.5"
 tree-sitter = "0.25.10"
 tree-sitter-bash = "0.25"
+zstd = "0.13"
 tree-sitter-highlight = "0.25.10"
 ts-rs = "11"
-tungstenite = { version = "0.27.0", features = ["deflate", "proxy"] }
 uds_windows = "1.1.0"
 unicode-segmentation = "1.12.0"
 unicode-width = "0.2"
@@ -290,7 +253,6 @@ webbrowser = "1.0"
 which = "8"
 wildmatch = "2.6.1"
 zip = "2.4.2"
-zstd = "0.13"

 wiremock = "0.6"
 zeroize = "1.8.2"
@@ -336,12 +298,7 @@ unwrap_used = "deny"
 # cargo-shear cannot see the platform-specific openssl-sys usage, so we
 # silence the false positive here instead of deleting a real dependency.
 [workspace.metadata.cargo-shear]
-ignored = [
-    "icu_provider",
-    "openssl-sys",
-    "codex-utils-readiness",
-    "codex-secrets",
-]
+ignored = ["icu_provider", "openssl-sys", "codex-utils-readiness", "codex-secrets"]

 [profile.release]
 lto = "fat"
--- a/codex-rs/README.md
+++ b/codex-rs/README.md
@@ -97,5 +97,3 @@ This folder is the root of a Cargo workspace. It contains quite a bit of experim
 - [`exec/`](./exec) "headless" CLI for use in automation.
 - [`tui/`](./tui) CLI that launches a fullscreen TUI built with [Ratatui](https://ratatui.rs/).
 - [`cli/`](./cli) CLI multitool that provides the aforementioned CLIs via subcommands.
-
-If you want to contribute or inspect behavior in detail, start by reading the module-level `README.md` files under each crate and run the project workspace from the top-level `codex-rs` directory so shared config, features, and build scripts stay aligned.
--- a/codex-rs/app-server-protocol/Cargo.toml
+++ b/codex-rs/app-server-protocol/Cargo.toml
@@ -20,7 +20,6 @@ codex-utils-absolute-path = { workspace = true }
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-shlex = { workspace = true }
 strum_macros = { workspace = true }
 thiserror = { workspace = true }
 ts-rs = { workspace = true }
--- a/codex-rs/app-server-protocol/schema/json/ChatgptAuthTokensRefreshParams.json
+++ b/codex-rs/app-server-protocol/schema/json/ChatgptAuthTokensRefreshParams.json
@@ -15,7 +15,7 @@
  },
  "properties": {
    "previousAccountId": {
-      "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior auth state did not include a workspace identifier (`chatgpt_account_id`).",
+      "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior ID token did not include a workspace identifier (`chatgpt_account_id`) or when the token could not be parsed.",
      "type": [
        "string",
        "null"
--- a/codex-rs/app-server-protocol/schema/json/ChatgptAuthTokensRefreshResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/ChatgptAuthTokensRefreshResponse.json
@@ -4,19 +4,13 @@
    "accessToken": {
      "type": "string"
    },
-    "chatgptAccountId": {
+    "idToken": {
      "type": "string"
-    },
-    "chatgptPlanType": {
-      "type": [
-        "string",
-        "null"
-      ]
    }
  },
  "required": [
    "accessToken",
-    "chatgptAccountId"
+    "idToken"
  ],
  "title": "ChatgptAuthTokensRefreshResponse",
  "type": "object"
--- a/codex-rs/app-server-protocol/schema/json/ClientRequest.json
+++ b/codex-rs/app-server-protocol/schema/json/ClientRequest.json
@@ -42,13 +42,6 @@
            "integer",
            "null"
          ]
-        },
-        "threadId": {
-          "description": "Optional thread id used to evaluate app feature gating from that thread's config.",
-          "type": [
-            "string",
-            "null"
-          ]
        }
      },
      "type": "object"
@@ -88,7 +81,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -718,16 +711,6 @@
          "default": false,
          "description": "Opt into receiving experimental API methods and fields.",
          "type": "boolean"
-        },
-        "optOutNotificationMethods": {
-          "description": "Exact notification method names that should be suppressed for this connection (for example `codex/event/session_configured`).",
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
        }
      },
      "type": "object"
@@ -1015,20 +998,13 @@
          "description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE. The access token must contain the same scopes that Codex-managed ChatGPT auth tokens have.",
          "properties": {
            "accessToken": {
-              "description": "Access token (JWT) supplied by the client. This token is used for backend API requests and email extraction.",
+              "description": "Access token (JWT) supplied by the client. This token is used for backend API requests.",
              "type": "string"
            },
-            "chatgptAccountId": {
-              "description": "Workspace/account identifier supplied by the client.",
+            "idToken": {
+              "description": "ID token (JWT) supplied by the client.\n\nThis token is used for identity and account metadata (email, plan type, workspace id).",
              "type": "string"
            },
-            "chatgptPlanType": {
-              "description": "Optional plan type supplied by the client.\n\nWhen `null`, Codex attempts to derive the plan type from access-token claims. If unavailable, the plan defaults to `unknown`.",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "chatgptAuthTokens"
@@ -1039,7 +1015,7 @@
          },
          "required": [
            "accessToken",
-            "chatgptAccountId",
+            "idToken",
            "type"
          ],
          "title": "ChatgptAuthTokensLoginAccountParams",
@@ -1243,104 +1219,6 @@
      ],
      "type": "string"
    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
-    "ReadOnlyAccess2": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccess2Type",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess2",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccess2Type",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess2",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -2020,16 +1898,6 @@
        },
        {
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "readOnly"
@@ -2082,16 +1950,6 @@
              "default": false,
              "type": "boolean"
            },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "workspaceWrite"
@@ -2136,16 +1994,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess2"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -2204,14 +2054,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess2"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -2368,24 +2210,6 @@
      ],
      "type": "object"
    },
-    "SkillsListExtraRootsForCwd": {
-      "properties": {
-        "cwd": {
-          "type": "string"
-        },
-        "extraUserRoots": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "cwd",
-        "extraUserRoots"
-      ],
-      "type": "object"
-    },
    "SkillsListParams": {
      "properties": {
        "cwds": {
@@ -2398,17 +2222,6 @@
        "forceReload": {
          "description": "When true, bypass the skills cache and re-scan skills from disk.",
          "type": "boolean"
-        },
-        "perCwdExtraUserRoots": {
-          "default": null,
-          "description": "Optional per-cwd extra roots to scan as user-scoped skills.",
-          "items": {
-            "$ref": "#/definitions/SkillsListExtraRootsForCwd"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
        }
      },
      "type": "object"
@@ -2565,13 +2378,6 @@
            "null"
          ]
        },
-        "cwd": {
-          "description": "Optional cwd filter; when set, only threads whose session cwd exactly matches this path are returned.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "limit": {
          "description": "Optional page size; defaults to a reasonable server-side value.",
          "format": "uint32",
--- a/codex-rs/app-server-protocol/schema/json/EventMsg.json
+++ b/codex-rs/app-server-protocol/schema/json/EventMsg.json
@@ -104,7 +104,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -175,7 +175,6 @@
          "enum": [
            "context_window_exceeded",
            "usage_limit_exceeded",
-            "server_overloaded",
            "internal_server_error",
            "unauthorized",
            "bad_request",
@@ -185,6 +184,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -532,9 +560,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_started"
@@ -544,7 +569,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskStartedEventMsg",
@@ -559,9 +583,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_complete"
@@ -571,7 +592,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskCompleteEventMsg",
@@ -867,17 +887,6 @@
            "model_provider_id": {
              "type": "string"
            },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
            "reasoning_effort": {
              "anyOf": [
                {
@@ -1349,14 +1358,6 @@
              "default": "agent",
              "description": "Where the command originated. Defaults to Agent for backward compatibility."
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
            "stderr": {
              "description": "Captured stderr",
              "type": "string"
@@ -1385,7 +1386,6 @@
            "exit_code",
            "formatted_output",
            "parsed_cmd",
-            "status",
            "stderr",
            "stdout",
            "turn_id",
@@ -1814,14 +1814,6 @@
              "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
              "type": "object"
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
            "stderr": {
              "description": "Captured stderr (parser errors, IO failures, etc.).",
              "type": "string"
@@ -1849,7 +1841,6 @@
          },
          "required": [
            "call_id",
-            "status",
            "stderr",
            "stdout",
            "success",
@@ -2127,12 +2118,6 @@
            "reason": {
              "$ref": "#/definitions/TurnAbortReason"
            },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "turn_aborted"
@@ -2891,14 +2876,6 @@
      ],
      "type": "string"
    },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "ExecOutputStream": {
      "enum": [
        "stdout",
@@ -3426,14 +3403,6 @@
        }
      ]
    },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "PlanItemArg": {
      "additionalProperties": false,
      "properties": {
@@ -3476,18 +3445,6 @@
            }
          ]
        },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "plan_type": {
          "anyOf": [
            {
@@ -3550,57 +3507,6 @@
      ],
      "type": "object"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -4438,16 +4344,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -4506,14 +4404,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -4537,25 +4427,6 @@
        }
      ]
    },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
    "SkillDependencies": {
      "properties": {
        "tools": {
@@ -5402,9 +5273,6 @@
            "null"
          ]
        },
-        "turn_id": {
-          "type": "string"
-        },
        "type": {
          "enum": [
            "task_started"
@@ -5414,7 +5282,6 @@
        }
      },
      "required": [
-        "turn_id",
        "type"
      ],
      "title": "TaskStartedEventMsg",
@@ -5429,9 +5296,6 @@
            "null"
          ]
        },
-        "turn_id": {
-          "type": "string"
-        },
        "type": {
          "enum": [
            "task_complete"
@@ -5441,7 +5305,6 @@
        }
      },
      "required": [
-        "turn_id",
        "type"
      ],
      "title": "TaskCompleteEventMsg",
@@ -5737,17 +5600,6 @@
        "model_provider_id": {
          "type": "string"
        },
-        "network_proxy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/SessionNetworkProxyRuntime"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-        },
        "reasoning_effort": {
          "anyOf": [
            {
@@ -6219,14 +6071,6 @@
          "default": "agent",
          "description": "Where the command originated. Defaults to Agent for backward compatibility."
        },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ExecCommandStatus"
-            }
-          ],
-          "description": "Completion status for this command execution."
-        },
        "stderr": {
          "description": "Captured stderr",
          "type": "string"
@@ -6255,7 +6099,6 @@
        "exit_code",
        "formatted_output",
        "parsed_cmd",
-        "status",
        "stderr",
        "stdout",
        "turn_id",
@@ -6684,14 +6527,6 @@
          "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
          "type": "object"
        },
-        "status": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/PatchApplyStatus"
-            }
-          ],
-          "description": "Completion status for this patch application."
-        },
        "stderr": {
          "description": "Captured stderr (parser errors, IO failures, etc.).",
          "type": "string"
@@ -6719,7 +6554,6 @@
      },
      "required": [
        "call_id",
-        "status",
        "stderr",
        "stdout",
        "success",
@@ -6997,12 +6831,6 @@
        "reason": {
          "$ref": "#/definitions/TurnAbortReason"
        },
-        "turn_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "type": {
          "enum": [
            "turn_aborted"
--- a/codex-rs/app-server-protocol/schema/json/FuzzyFileSearchSessionUpdatedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/FuzzyFileSearchSessionUpdatedNotification.json
@@ -1,63 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "FuzzyFileSearchResult": {
-      "description": "Superset of [`codex_file_search::FileMatch`]",
-      "properties": {
-        "file_name": {
-          "type": "string"
-        },
-        "indices": {
-          "items": {
-            "format": "uint32",
-            "minimum": 0.0,
-            "type": "integer"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "path": {
-          "type": "string"
-        },
-        "root": {
-          "type": "string"
-        },
-        "score": {
-          "format": "uint32",
-          "minimum": 0.0,
-          "type": "integer"
-        }
-      },
-      "required": [
-        "file_name",
-        "path",
-        "root",
-        "score"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "files": {
-      "items": {
-        "$ref": "#/definitions/FuzzyFileSearchResult"
-      },
-      "type": "array"
-    },
-    "query": {
-      "type": "string"
-    },
-    "sessionId": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "files",
-    "query",
-    "sessionId"
-  ],
-  "title": "FuzzyFileSearchSessionUpdatedNotification",
-  "type": "object"
-}
--- a/codex-rs/app-server-protocol/schema/json/ServerNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/ServerNotification.json
@@ -193,11 +193,6 @@
          "default": false,
          "type": "boolean"
        },
-        "isEnabled": {
-          "default": true,
-          "description": "Whether this app is enabled in config.toml. Example: ```toml [apps.bad_app] enabled = false ```",
-          "type": "boolean"
-        },
        "logoUrl": {
          "type": [
            "string",
@@ -246,7 +241,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -378,7 +373,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -388,6 +382,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -492,7 +515,6 @@
          "enum": [
            "context_window_exceeded",
            "usage_limit_exceeded",
-            "server_overloaded",
            "internal_server_error",
            "unauthorized",
            "bad_request",
@@ -502,6 +524,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo2",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -1153,9 +1204,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_started"
@@ -1165,7 +1213,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskStartedEventMsg",
@@ -1180,9 +1227,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_complete"
@@ -1192,7 +1236,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskCompleteEventMsg",
@@ -1488,17 +1531,6 @@
            "model_provider_id": {
              "type": "string"
            },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
            "reasoning_effort": {
              "anyOf": [
                {
@@ -1970,14 +2002,6 @@
              "default": "agent",
              "description": "Where the command originated. Defaults to Agent for backward compatibility."
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
            "stderr": {
              "description": "Captured stderr",
              "type": "string"
@@ -2006,7 +2030,6 @@
            "exit_code",
            "formatted_output",
            "parsed_cmd",
-            "status",
            "stderr",
            "stdout",
            "turn_id",
@@ -2435,14 +2458,6 @@
              "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
              "type": "object"
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus2"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
            "stderr": {
              "description": "Captured stderr (parser errors, IO failures, etc.).",
              "type": "string"
@@ -2470,7 +2485,6 @@
          },
          "required": [
            "call_id",
-            "status",
            "stderr",
            "stdout",
            "success",
@@ -2748,12 +2762,6 @@
            "reason": {
              "$ref": "#/definitions/TurnAbortReason"
            },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "turn_aborted"
@@ -3512,14 +3520,6 @@
      ],
      "type": "string"
    },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "ExecOutputStream": {
      "enum": [
        "stdout",
@@ -3715,65 +3715,6 @@
      ],
      "type": "object"
    },
-    "FuzzyFileSearchResult": {
-      "description": "Superset of [`codex_file_search::FileMatch`]",
-      "properties": {
-        "file_name": {
-          "type": "string"
-        },
-        "indices": {
-          "items": {
-            "format": "uint32",
-            "minimum": 0.0,
-            "type": "integer"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
-        },
-        "path": {
-          "type": "string"
-        },
-        "root": {
-          "type": "string"
-        },
-        "score": {
-          "format": "uint32",
-          "minimum": 0.0,
-          "type": "integer"
-        }
-      },
-      "required": [
-        "file_name",
-        "path",
-        "root",
-        "score"
-      ],
-      "type": "object"
-    },
-    "FuzzyFileSearchSessionUpdatedNotification": {
-      "properties": {
-        "files": {
-          "items": {
-            "$ref": "#/definitions/FuzzyFileSearchResult"
-          },
-          "type": "array"
-        },
-        "query": {
-          "type": "string"
-        },
-        "sessionId": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "files",
-        "query",
-        "sessionId"
-      ],
-      "type": "object"
-    },
    "GhostCommit": {
      "description": "Details of a ghost commit created from a repository state.",
      "properties": {
@@ -4316,14 +4257,6 @@
      ],
      "type": "string"
    },
-    "PatchApplyStatus2": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "PatchChangeKind": {
      "oneOf": [
        {
@@ -4448,18 +4381,6 @@
            }
          ]
        },
-        "limitId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limitName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "planType": {
          "anyOf": [
            {
@@ -4505,18 +4426,6 @@
            }
          ]
        },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "plan_type": {
          "anyOf": [
            {
@@ -4624,57 +4533,6 @@
      ],
      "type": "object"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -5592,16 +5450,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -5660,14 +5510,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -5741,25 +5583,6 @@
      ],
      "type": "object"
    },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
    "SessionSource": {
      "oneOf": [
        {
@@ -5997,8 +5820,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
@@ -8270,26 +8092,6 @@
      "title": "ConfigWarningNotification",
      "type": "object"
    },
-    {
-      "properties": {
-        "method": {
-          "enum": [
-            "fuzzyFileSearch/sessionUpdated"
-          ],
-          "title": "FuzzyFileSearch/sessionUpdatedNotificationMethod",
-          "type": "string"
-        },
-        "params": {
-          "$ref": "#/definitions/FuzzyFileSearchSessionUpdatedNotification"
-        }
-      },
-      "required": [
-        "method",
-        "params"
-      ],
-      "title": "FuzzyFileSearch/sessionUpdatedNotification",
-      "type": "object"
-    },
    {
      "description": "Notifies the user of world-writable directories on Windows, which cannot be protected by the sandbox.",
      "properties": {
--- a/codex-rs/app-server-protocol/schema/json/ServerRequest.json
+++ b/codex-rs/app-server-protocol/schema/json/ServerRequest.json
@@ -41,7 +41,7 @@
    "ChatgptAuthTokensRefreshParams": {
      "properties": {
        "previousAccountId": {
-          "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior auth state did not include a workspace identifier (`chatgpt_account_id`).",
+          "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior ID token did not include a workspace identifier (`chatgpt_account_id`) or when the token could not be parsed.",
          "type": [
            "string",
            "null"
--- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
@@ -208,7 +208,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -338,7 +338,7 @@
      "$schema": "http://json-schema.org/draft-07/schema#",
      "properties": {
        "previousAccountId": {
-          "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior auth state did not include a workspace identifier (`chatgpt_account_id`).",
+          "description": "Workspace/account identifier that Codex was previously using.\n\nClients that manage multiple accounts/workspaces can use this as a hint to refresh the token for the correct workspace.\n\nThis may be `null` when the prior ID token did not include a workspace identifier (`chatgpt_account_id`) or when the token could not be parsed.",
          "type": [
            "string",
            "null"
@@ -371,19 +371,13 @@
        "accessToken": {
          "type": "string"
        },
-        "chatgptAccountId": {
+        "idToken": {
          "type": "string"
-        },
-        "chatgptPlanType": {
-          "type": [
-            "string",
-            "null"
-          ]
        }
      },
      "required": [
        "accessToken",
-        "chatgptAccountId"
+        "idToken"
      ],
      "title": "ChatgptAuthTokensRefreshResponse",
      "type": "object"
@@ -1884,7 +1878,6 @@
          "enum": [
            "context_window_exceeded",
            "usage_limit_exceeded",
-            "server_overloaded",
            "internal_server_error",
            "unauthorized",
            "bad_request",
@@ -1894,6 +1887,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -2545,9 +2567,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_started"
@@ -2557,7 +2576,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskStartedEventMsg",
@@ -2572,9 +2590,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_complete"
@@ -2584,7 +2599,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskCompleteEventMsg",
@@ -2880,17 +2894,6 @@
            "model_provider_id": {
              "type": "string"
            },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
            "reasoning_effort": {
              "anyOf": [
                {
@@ -3362,14 +3365,6 @@
              "default": "agent",
              "description": "Where the command originated. Defaults to Agent for backward compatibility."
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
            "stderr": {
              "description": "Captured stderr",
              "type": "string"
@@ -3398,7 +3393,6 @@
            "exit_code",
            "formatted_output",
            "parsed_cmd",
-            "status",
            "stderr",
            "stdout",
            "turn_id",
@@ -3827,14 +3821,6 @@
              "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
              "type": "object"
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/v2/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
            "stderr": {
              "description": "Captured stderr (parser errors, IO failures, etc.).",
              "type": "string"
@@ -3862,7 +3848,6 @@
          },
          "required": [
            "call_id",
-            "status",
            "stderr",
            "stdout",
            "success",
@@ -4140,12 +4125,6 @@
            "reason": {
              "$ref": "#/definitions/TurnAbortReason"
            },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "turn_aborted"
@@ -4960,14 +4939,6 @@
      ],
      "type": "string"
    },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "ExecOneOffCommandParams": {
      "$schema": "http://json-schema.org/draft-07/schema#",
      "properties": {
@@ -5412,30 +5383,6 @@
      ],
      "type": "object"
    },
-    "FuzzyFileSearchSessionUpdatedNotification": {
-      "$schema": "http://json-schema.org/draft-07/schema#",
-      "properties": {
-        "files": {
-          "items": {
-            "$ref": "#/definitions/FuzzyFileSearchResult"
-          },
-          "type": "array"
-        },
-        "query": {
-          "type": "string"
-        },
-        "sessionId": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "files",
-        "query",
-        "sessionId"
-      ],
-      "title": "FuzzyFileSearchSessionUpdatedNotification",
-      "type": "object"
-    },
    "GetAuthStatusParams": {
      "$schema": "http://json-schema.org/draft-07/schema#",
      "properties": {
@@ -5646,16 +5593,6 @@
          "default": false,
          "description": "Opt into receiving experimental API methods and fields.",
          "type": "boolean"
-        },
-        "optOutNotificationMethods": {
-          "description": "Exact notification method names that should be suppressed for this connection (for example `codex/event/session_configured`).",
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
        }
      },
      "type": "object"
@@ -6472,14 +6409,6 @@
        }
      ]
    },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "PlanItemArg": {
      "additionalProperties": false,
      "properties": {
@@ -6585,18 +6514,6 @@
            }
          ]
        },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "plan_type": {
          "anyOf": [
            {
@@ -6659,57 +6576,6 @@
      ],
      "type": "object"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -7723,16 +7589,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -7791,14 +7649,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -8483,26 +8333,6 @@
          "title": "ConfigWarningNotification",
          "type": "object"
        },
-        {
-          "properties": {
-            "method": {
-              "enum": [
-                "fuzzyFileSearch/sessionUpdated"
-              ],
-              "title": "FuzzyFileSearch/sessionUpdatedNotificationMethod",
-              "type": "string"
-            },
-            "params": {
-              "$ref": "#/definitions/FuzzyFileSearchSessionUpdatedNotification"
-            }
-          },
-          "required": [
-            "method",
-            "params"
-          ],
-          "title": "FuzzyFileSearch/sessionUpdatedNotification",
-          "type": "object"
-        },
        {
          "description": "Notifies the user of world-writable directories on Windows, which cannot be protected by the sandbox.",
          "properties": {
@@ -8842,25 +8672,6 @@
      "title": "SessionConfiguredNotification",
      "type": "object"
    },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
    "SessionSource": {
      "oneOf": [
        {
@@ -9126,8 +8937,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
@@ -10202,11 +10012,6 @@
            "default": false,
            "type": "boolean"
          },
-          "isEnabled": {
-            "default": true,
-            "description": "Whether this app is enabled in config.toml. Example: ```toml [apps.bad_app] enabled = false ```",
-            "type": "boolean"
-          },
          "logoUrl": {
            "type": [
              "string",
@@ -10272,13 +10077,6 @@
              "integer",
              "null"
            ]
-          },
-          "threadId": {
-            "description": "Optional thread id used to evaluate app feature gating from that thread's config.",
-            "type": [
-              "string",
-              "null"
-            ]
          }
        },
        "title": "AppsListParams",
@@ -10402,7 +10200,6 @@
            "enum": [
              "contextWindowExceeded",
              "usageLimitExceeded",
-              "serverOverloaded",
              "internalServerError",
              "unauthorized",
              "badRequest",
@@ -10412,6 +10209,35 @@
            ],
            "type": "string"
          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "modelCap": {
+                "properties": {
+                  "model": {
+                    "type": "string"
+                  },
+                  "reset_after_seconds": {
+                    "format": "uint64",
+                    "minimum": 0.0,
+                    "type": [
+                      "integer",
+                      "null"
+                    ]
+                  }
+                },
+                "required": [
+                  "model"
+                ],
+                "type": "object"
+              }
+            },
+            "required": [
+              "modelCap"
+            ],
+            "title": "ModelCapCodexErrorInfo",
+            "type": "object"
+          },
          {
            "additionalProperties": false,
            "properties": {
@@ -11944,22 +11770,7 @@
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "rateLimits": {
-            "allOf": [
-              {
-                "$ref": "#/definitions/v2/RateLimitSnapshot"
-              }
-            ],
-            "description": "Backward-compatible single-bucket view; mirrors the historical payload."
-          },
-          "rateLimitsByLimitId": {
-            "additionalProperties": {
-              "$ref": "#/definitions/v2/RateLimitSnapshot"
-            },
-            "description": "Multi-bucket view keyed by metered `limit_id` (for example, `codex`).",
-            "type": [
-              "object",
-              "null"
-            ]
+            "$ref": "#/definitions/v2/RateLimitSnapshot"
          }
        },
        "required": [
@@ -12260,20 +12071,13 @@
            "description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE. The access token must contain the same scopes that Codex-managed ChatGPT auth tokens have.",
            "properties": {
              "accessToken": {
-                "description": "Access token (JWT) supplied by the client. This token is used for backend API requests and email extraction.",
+                "description": "Access token (JWT) supplied by the client. This token is used for backend API requests.",
                "type": "string"
              },
-              "chatgptAccountId": {
-                "description": "Workspace/account identifier supplied by the client.",
+              "idToken": {
+                "description": "ID token (JWT) supplied by the client.\n\nThis token is used for identity and account metadata (email, plan type, workspace id).",
                "type": "string"
              },
-              "chatgptPlanType": {
-                "description": "Optional plan type supplied by the client.\n\nWhen `null`, Codex attempts to derive the plan type from access-token claims. If unavailable, the plan defaults to `unknown`.",
-                "type": [
-                  "string",
-                  "null"
-                ]
-              },
              "type": {
                "enum": [
                  "chatgptAuthTokens"
@@ -12284,7 +12088,7 @@
            },
            "required": [
              "accessToken",
-              "chatgptAccountId",
+              "idToken",
              "type"
            ],
            "title": "ChatgptAuthTokensv2::LoginAccountParams",
@@ -12974,18 +12778,6 @@
              }
            ]
          },
-          "limitId": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "limitName": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
          "planType": {
            "anyOf": [
              {
@@ -13066,53 +12858,6 @@
        "title": "RawResponseItemCompletedNotification",
        "type": "object"
      },
-      "ReadOnlyAccess": {
-        "oneOf": [
-          {
-            "properties": {
-              "includePlatformDefaults": {
-                "default": true,
-                "type": "boolean"
-              },
-              "readableRoots": {
-                "default": [],
-                "items": {
-                  "$ref": "#/definitions/v2/AbsolutePathBuf"
-                },
-                "type": "array"
-              },
-              "type": {
-                "enum": [
-                  "restricted"
-                ],
-                "title": "RestrictedReadOnlyAccessType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RestrictedReadOnlyAccess",
-            "type": "object"
-          },
-          {
-            "properties": {
-              "type": {
-                "enum": [
-                  "fullAccess"
-                ],
-                "title": "FullAccessReadOnlyAccessType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "FullAccessReadOnlyAccess",
-            "type": "object"
-          }
-        ]
-      },
      "ReasoningEffort": {
        "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
        "enum": [
@@ -13953,16 +13698,6 @@
          },
          {
            "properties": {
-              "access": {
-                "allOf": [
-                  {
-                    "$ref": "#/definitions/v2/ReadOnlyAccess"
-                  }
-                ],
-                "default": {
-                  "type": "fullAccess"
-                }
-              },
              "type": {
                "enum": [
                  "readOnly"
@@ -14015,16 +13750,6 @@
                "default": false,
                "type": "boolean"
              },
-              "readOnlyAccess": {
-                "allOf": [
-                  {
-                    "$ref": "#/definitions/v2/ReadOnlyAccess"
-                  }
-                ],
-                "default": {
-                  "type": "fullAccess"
-                }
-              },
              "type": {
                "enum": [
                  "workspaceWrite"
@@ -14354,24 +14079,6 @@
        ],
        "type": "object"
      },
-      "SkillsListExtraRootsForCwd": {
-        "properties": {
-          "cwd": {
-            "type": "string"
-          },
-          "extraUserRoots": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "cwd",
-          "extraUserRoots"
-        ],
-        "type": "object"
-      },
      "SkillsListParams": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
@@ -14385,17 +14092,6 @@
          "forceReload": {
            "description": "When true, bypass the skills cache and re-scan skills from disk.",
            "type": "boolean"
-          },
-          "perCwdExtraUserRoots": {
-            "default": null,
-            "description": "Optional per-cwd extra roots to scan as user-scoped skills.",
-            "items": {
-              "$ref": "#/definitions/v2/SkillsListExtraRootsForCwd"
-            },
-            "type": [
-              "array",
-              "null"
-            ]
          }
        },
        "title": "SkillsListParams",
@@ -14481,8 +14177,7 @@
          {
            "enum": [
              "review",
-              "compact",
-              "memory_consolidation"
+              "compact"
            ],
            "type": "string"
          },
@@ -15336,13 +15031,6 @@
              "null"
            ]
          },
-          "cwd": {
-            "description": "Optional cwd filter; when set, only threads whose session cwd exactly matches this path are returned.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
          "limit": {
            "description": "Optional page size; defaults to a reasonable server-side value.",
            "format": "uint32",
--- a/codex-rs/app-server-protocol/schema/json/v1/ExecOneOffCommandParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/ExecOneOffCommandParams.json
@@ -13,57 +13,6 @@
      ],
      "type": "string"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "SandboxPolicy": {
      "description": "Determines execution restrictions for model shell commands.",
      "oneOf": [
@@ -85,16 +34,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -153,14 +94,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
--- a/codex-rs/app-server-protocol/schema/json/v1/ForkConversationParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/ForkConversationParams.json
@@ -12,7 +12,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
--- a/codex-rs/app-server-protocol/schema/json/v1/ForkConversationResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/ForkConversationResponse.json
@@ -104,7 +104,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -175,7 +175,6 @@
          "enum": [
            "context_window_exceeded",
            "usage_limit_exceeded",
-            "server_overloaded",
            "internal_server_error",
            "unauthorized",
            "bad_request",
@@ -185,6 +184,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -532,9 +560,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_started"
@@ -544,7 +569,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskStartedEventMsg",
@@ -559,9 +583,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_complete"
@@ -571,7 +592,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskCompleteEventMsg",
@@ -867,17 +887,6 @@
            "model_provider_id": {
              "type": "string"
            },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
            "reasoning_effort": {
              "anyOf": [
                {
@@ -1349,14 +1358,6 @@
              "default": "agent",
              "description": "Where the command originated. Defaults to Agent for backward compatibility."
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
            "stderr": {
              "description": "Captured stderr",
              "type": "string"
@@ -1385,7 +1386,6 @@
            "exit_code",
            "formatted_output",
            "parsed_cmd",
-            "status",
            "stderr",
            "stdout",
            "turn_id",
@@ -1814,14 +1814,6 @@
              "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
              "type": "object"
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
            "stderr": {
              "description": "Captured stderr (parser errors, IO failures, etc.).",
              "type": "string"
@@ -1849,7 +1841,6 @@
          },
          "required": [
            "call_id",
-            "status",
            "stderr",
            "stdout",
            "success",
@@ -2127,12 +2118,6 @@
            "reason": {
              "$ref": "#/definitions/TurnAbortReason"
            },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "turn_aborted"
@@ -2891,14 +2876,6 @@
      ],
      "type": "string"
    },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "ExecOutputStream": {
      "enum": [
        "stdout",
@@ -3426,14 +3403,6 @@
        }
      ]
    },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "PlanItemArg": {
      "additionalProperties": false,
      "properties": {
@@ -3476,18 +3445,6 @@
            }
          ]
        },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "plan_type": {
          "anyOf": [
            {
@@ -3550,57 +3507,6 @@
      ],
      "type": "object"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -4438,16 +4344,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -4506,14 +4404,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -4537,25 +4427,6 @@
        }
      ]
    },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
    "SkillDependencies": {
      "properties": {
        "tools": {
--- a/codex-rs/app-server-protocol/schema/json/v1/GetConversationSummaryResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/GetConversationSummaryResponse.json
@@ -113,8 +113,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v1/GetUserSavedConfigResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/GetUserSavedConfigResponse.json
@@ -16,7 +16,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
--- a/codex-rs/app-server-protocol/schema/json/v1/InitializeParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/InitializeParams.json
@@ -29,16 +29,6 @@
          "default": false,
          "description": "Opt into receiving experimental API methods and fields.",
          "type": "boolean"
-        },
-        "optOutNotificationMethods": {
-          "description": "Exact notification method names that should be suppressed for this connection (for example `codex/event/session_configured`).",
-          "items": {
-            "type": "string"
-          },
-          "type": [
-            "array",
-            "null"
-          ]
        }
      },
      "type": "object"
--- a/codex-rs/app-server-protocol/schema/json/v1/ListConversationsResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/ListConversationsResponse.json
@@ -113,8 +113,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v1/NewConversationParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/NewConversationParams.json
@@ -12,7 +12,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
--- a/codex-rs/app-server-protocol/schema/json/v1/ResumeConversationParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/ResumeConversationParams.json
@@ -12,7 +12,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
--- a/codex-rs/app-server-protocol/schema/json/v1/ResumeConversationResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/ResumeConversationResponse.json
@@ -104,7 +104,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -175,7 +175,6 @@
          "enum": [
            "context_window_exceeded",
            "usage_limit_exceeded",
-            "server_overloaded",
            "internal_server_error",
            "unauthorized",
            "bad_request",
@@ -185,6 +184,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -532,9 +560,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_started"
@@ -544,7 +569,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskStartedEventMsg",
@@ -559,9 +583,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_complete"
@@ -571,7 +592,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskCompleteEventMsg",
@@ -867,17 +887,6 @@
            "model_provider_id": {
              "type": "string"
            },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
            "reasoning_effort": {
              "anyOf": [
                {
@@ -1349,14 +1358,6 @@
              "default": "agent",
              "description": "Where the command originated. Defaults to Agent for backward compatibility."
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
            "stderr": {
              "description": "Captured stderr",
              "type": "string"
@@ -1385,7 +1386,6 @@
            "exit_code",
            "formatted_output",
            "parsed_cmd",
-            "status",
            "stderr",
            "stdout",
            "turn_id",
@@ -1814,14 +1814,6 @@
              "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
              "type": "object"
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
            "stderr": {
              "description": "Captured stderr (parser errors, IO failures, etc.).",
              "type": "string"
@@ -1849,7 +1841,6 @@
          },
          "required": [
            "call_id",
-            "status",
            "stderr",
            "stdout",
            "success",
@@ -2127,12 +2118,6 @@
            "reason": {
              "$ref": "#/definitions/TurnAbortReason"
            },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "turn_aborted"
@@ -2891,14 +2876,6 @@
      ],
      "type": "string"
    },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "ExecOutputStream": {
      "enum": [
        "stdout",
@@ -3426,14 +3403,6 @@
        }
      ]
    },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "PlanItemArg": {
      "additionalProperties": false,
      "properties": {
@@ -3476,18 +3445,6 @@
            }
          ]
        },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "plan_type": {
          "anyOf": [
            {
@@ -3550,57 +3507,6 @@
      ],
      "type": "object"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -4438,16 +4344,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -4506,14 +4404,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -4537,25 +4427,6 @@
        }
      ]
    },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
    "SkillDependencies": {
      "properties": {
        "tools": {
--- a/codex-rs/app-server-protocol/schema/json/v1/SendUserTurnParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/SendUserTurnParams.json
@@ -16,7 +16,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -142,57 +142,6 @@
      ],
      "type": "string"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -246,16 +195,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -314,14 +255,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
--- a/codex-rs/app-server-protocol/schema/json/v1/SessionConfiguredNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v1/SessionConfiguredNotification.json
@@ -104,7 +104,7 @@
          "type": "string"
        },
        {
-          "description": "DEPRECATED: *All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox. Prefer `OnRequest` for interactive runs or `Never` for non-interactive runs.",
+          "description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
          "enum": [
            "on-failure"
          ],
@@ -175,7 +175,6 @@
          "enum": [
            "context_window_exceeded",
            "usage_limit_exceeded",
-            "server_overloaded",
            "internal_server_error",
            "unauthorized",
            "bad_request",
@@ -185,6 +184,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "model_cap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "model_cap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -532,9 +560,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_started"
@@ -544,7 +569,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskStartedEventMsg",
@@ -559,9 +583,6 @@
                "null"
              ]
            },
-            "turn_id": {
-              "type": "string"
-            },
            "type": {
              "enum": [
                "task_complete"
@@ -571,7 +592,6 @@
            }
          },
          "required": [
-            "turn_id",
            "type"
          ],
          "title": "TaskCompleteEventMsg",
@@ -867,17 +887,6 @@
            "model_provider_id": {
              "type": "string"
            },
-            "network_proxy": {
-              "anyOf": [
-                {
-                  "$ref": "#/definitions/SessionNetworkProxyRuntime"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Runtime proxy bind addresses, when the managed proxy was started for this session."
-            },
            "reasoning_effort": {
              "anyOf": [
                {
@@ -1349,14 +1358,6 @@
              "default": "agent",
              "description": "Where the command originated. Defaults to Agent for backward compatibility."
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ExecCommandStatus"
-                }
-              ],
-              "description": "Completion status for this command execution."
-            },
            "stderr": {
              "description": "Captured stderr",
              "type": "string"
@@ -1385,7 +1386,6 @@
            "exit_code",
            "formatted_output",
            "parsed_cmd",
-            "status",
            "stderr",
            "stdout",
            "turn_id",
@@ -1814,14 +1814,6 @@
              "description": "The changes that were applied (mirrors PatchApplyBeginEvent::changes).",
              "type": "object"
            },
-            "status": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/PatchApplyStatus"
-                }
-              ],
-              "description": "Completion status for this patch application."
-            },
            "stderr": {
              "description": "Captured stderr (parser errors, IO failures, etc.).",
              "type": "string"
@@ -1849,7 +1841,6 @@
          },
          "required": [
            "call_id",
-            "status",
            "stderr",
            "stdout",
            "success",
@@ -2127,12 +2118,6 @@
            "reason": {
              "$ref": "#/definitions/TurnAbortReason"
            },
-            "turn_id": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
            "type": {
              "enum": [
                "turn_aborted"
@@ -2891,14 +2876,6 @@
      ],
      "type": "string"
    },
-    "ExecCommandStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "ExecOutputStream": {
      "enum": [
        "stdout",
@@ -3426,14 +3403,6 @@
        }
      ]
    },
-    "PatchApplyStatus": {
-      "enum": [
-        "completed",
-        "failed",
-        "declined"
-      ],
-      "type": "string"
-    },
    "PlanItemArg": {
      "additionalProperties": false,
      "properties": {
@@ -3476,18 +3445,6 @@
            }
          ]
        },
-        "limit_id": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limit_name": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "plan_type": {
          "anyOf": [
            {
@@ -3550,57 +3507,6 @@
      ],
      "type": "object"
    },
-    "ReadOnlyAccess": {
-      "description": "Determines how read-only file access is granted inside a restricted sandbox.",
-      "oneOf": [
-        {
-          "description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
-          "properties": {
-            "include_platform_defaults": {
-              "default": true,
-              "description": "Include built-in platform read roots required for basic process execution.",
-              "type": "boolean"
-            },
-            "readable_roots": {
-              "description": "Additional absolute roots that should be readable.",
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "description": "Allow unrestricted file reads.",
-          "properties": {
-            "type": {
-              "enum": [
-                "full-access"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -4438,16 +4344,8 @@
          "type": "object"
        },
        {
-          "description": "Read-only access configuration.",
+          "description": "Read-only access to the entire file-system.",
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "read-only"
@@ -4506,14 +4404,6 @@
              "description": "When set to `true`, outbound network access is allowed. `false` by default.",
              "type": "boolean"
            },
-            "read_only_access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "description": "Read access granted while running under this policy."
-            },
            "type": {
              "enum": [
                "workspace-write"
@@ -4537,25 +4427,6 @@
        }
      ]
    },
-    "SessionNetworkProxyRuntime": {
-      "properties": {
-        "admin_addr": {
-          "type": "string"
-        },
-        "http_addr": {
-          "type": "string"
-        },
-        "socks_addr": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "admin_addr",
-        "http_addr",
-        "socks_addr"
-      ],
-      "type": "object"
-    },
    "SkillDependencies": {
      "properties": {
        "tools": {
--- a/codex-rs/app-server-protocol/schema/json/v2/AccountRateLimitsUpdatedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/AccountRateLimitsUpdatedNotification.json
@@ -48,18 +48,6 @@
            }
          ]
        },
-        "limitId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limitName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "planType": {
          "anyOf": [
            {
--- a/codex-rs/app-server-protocol/schema/json/v2/AppListUpdatedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/AppListUpdatedNotification.json
@@ -29,11 +29,6 @@
          "default": false,
          "type": "boolean"
        },
-        "isEnabled": {
-          "default": true,
-          "description": "Whether this app is enabled in config.toml. Example: ```toml [apps.bad_app] enabled = false ```",
-          "type": "boolean"
-        },
        "logoUrl": {
          "type": [
            "string",
--- a/codex-rs/app-server-protocol/schema/json/v2/AppsListParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/AppsListParams.json
@@ -21,13 +21,6 @@
        "integer",
        "null"
      ]
-    },
-    "threadId": {
-      "description": "Optional thread id used to evaluate app feature gating from that thread's config.",
-      "type": [
-        "string",
-        "null"
-      ]
    }
  },
  "title": "AppsListParams",
--- a/codex-rs/app-server-protocol/schema/json/v2/AppsListResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/AppsListResponse.json
@@ -29,11 +29,6 @@
          "default": false,
          "type": "boolean"
        },
-        "isEnabled": {
-          "default": true,
-          "description": "Whether this app is enabled in config.toml. Example: ```toml [apps.bad_app] enabled = false ```",
-          "type": "boolean"
-        },
        "logoUrl": {
          "type": [
            "string",
--- a/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
@@ -12,53 +12,6 @@
      ],
      "type": "string"
    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "SandboxPolicy": {
      "oneOf": [
        {
@@ -79,16 +32,6 @@
        },
        {
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "readOnly"
@@ -141,16 +84,6 @@
              "default": false,
              "type": "boolean"
            },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "workspaceWrite"
--- a/codex-rs/app-server-protocol/schema/json/v2/ErrorNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ErrorNotification.json
@@ -8,7 +8,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -18,6 +17,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
--- a/codex-rs/app-server-protocol/schema/json/v2/GetAccountRateLimitsResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/GetAccountRateLimitsResponse.json
@@ -48,18 +48,6 @@
            }
          ]
        },
-        "limitId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "limitName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "planType": {
          "anyOf": [
            {
@@ -122,22 +110,7 @@
  },
  "properties": {
    "rateLimits": {
-      "allOf": [
-        {
-          "$ref": "#/definitions/RateLimitSnapshot"
-        }
-      ],
-      "description": "Backward-compatible single-bucket view; mirrors the historical payload."
-    },
-    "rateLimitsByLimitId": {
-      "additionalProperties": {
-        "$ref": "#/definitions/RateLimitSnapshot"
-      },
-      "description": "Multi-bucket view keyed by metered `limit_id` (for example, `codex`).",
-      "type": [
-        "object",
-        "null"
-      ]
+      "$ref": "#/definitions/RateLimitSnapshot"
    }
  },
  "required": [
--- a/codex-rs/app-server-protocol/schema/json/v2/LoginAccountParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/LoginAccountParams.json
@@ -41,20 +41,13 @@
      "description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE. The access token must contain the same scopes that Codex-managed ChatGPT auth tokens have.",
      "properties": {
        "accessToken": {
-          "description": "Access token (JWT) supplied by the client. This token is used for backend API requests and email extraction.",
+          "description": "Access token (JWT) supplied by the client. This token is used for backend API requests.",
          "type": "string"
        },
-        "chatgptAccountId": {
-          "description": "Workspace/account identifier supplied by the client.",
+        "idToken": {
+          "description": "ID token (JWT) supplied by the client.\n\nThis token is used for identity and account metadata (email, plan type, workspace id).",
          "type": "string"
        },
-        "chatgptPlanType": {
-          "description": "Optional plan type supplied by the client.\n\nWhen `null`, Codex attempts to derive the plan type from access-token claims. If unavailable, the plan defaults to `unknown`.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
        "type": {
          "enum": [
            "chatgptAuthTokens"
@@ -65,7 +58,7 @@
      },
      "required": [
        "accessToken",
-        "chatgptAccountId",
+        "idToken",
        "type"
      ],
      "title": "ChatgptAuthTokensv2::LoginAccountParams",
--- a/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
--- a/codex-rs/app-server-protocol/schema/json/v2/SkillsListParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/SkillsListParams.json
@@ -1,25 +1,5 @@
 {
  "$schema": "http://json-schema.org/draft-07/schema#",
-  "definitions": {
-    "SkillsListExtraRootsForCwd": {
-      "properties": {
-        "cwd": {
-          "type": "string"
-        },
-        "extraUserRoots": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "cwd",
-        "extraUserRoots"
-      ],
-      "type": "object"
-    }
-  },
  "properties": {
    "cwds": {
      "description": "When empty, defaults to the current session working directory.",
@@ -31,17 +11,6 @@
    "forceReload": {
      "description": "When true, bypass the skills cache and re-scan skills from disk.",
      "type": "boolean"
-    },
-    "perCwdExtraUserRoots": {
-      "default": null,
-      "description": "Optional per-cwd extra roots to scan as user-scoped skills.",
-      "items": {
-        "$ref": "#/definitions/SkillsListExtraRootsForCwd"
-      },
-      "type": [
-        "array",
-        "null"
-      ]
    }
  },
  "title": "SkillsListParams",
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
@@ -40,7 +40,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -50,6 +49,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -460,53 +488,6 @@
        }
      ]
    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -539,16 +520,6 @@
        },
        {
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "readOnly"
@@ -601,16 +572,6 @@
              "default": false,
              "type": "boolean"
            },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "workspaceWrite"
@@ -666,8 +627,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadListParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadListParams.json
@@ -39,13 +39,6 @@
        "null"
      ]
    },
-    "cwd": {
-      "description": "Optional cwd filter; when set, only threads whose session cwd exactly matches this path are returned.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
    "limit": {
      "description": "Optional page size; defaults to a reasonable server-side value.",
      "format": "uint32",
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -472,8 +500,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -472,8 +500,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
@@ -40,7 +40,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -50,6 +49,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -460,53 +488,6 @@
        }
      ]
    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -539,16 +520,6 @@
        },
        {
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "readOnly"
@@ -601,16 +572,6 @@
              "default": false,
              "type": "boolean"
            },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "workspaceWrite"
@@ -666,8 +627,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -472,8 +500,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
@@ -40,7 +40,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -50,6 +49,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -460,53 +488,6 @@
        }
      ]
    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -539,16 +520,6 @@
        },
        {
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "readOnly"
@@ -601,16 +572,6 @@
              "default": false,
              "type": "boolean"
            },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "workspaceWrite"
@@ -666,8 +627,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -472,8 +500,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
@@ -472,8 +500,7 @@
        {
          "enum": [
            "review",
-            "compact",
-            "memory_consolidation"
+            "compact"
          ],
          "type": "string"
        },
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
@@ -72,53 +72,6 @@
      ],
      "type": "string"
    },
-    "ReadOnlyAccess": {
-      "oneOf": [
-        {
-          "properties": {
-            "includePlatformDefaults": {
-              "default": true,
-              "type": "boolean"
-            },
-            "readableRoots": {
-              "default": [],
-              "items": {
-                "$ref": "#/definitions/AbsolutePathBuf"
-              },
-              "type": "array"
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "RestrictedReadOnlyAccess",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "fullAccess"
-              ],
-              "title": "FullAccessReadOnlyAccessType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "FullAccessReadOnlyAccess",
-          "type": "object"
-        }
-      ]
-    },
    "ReasoningEffort": {
      "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
      "enum": [
@@ -171,16 +124,6 @@
        },
        {
          "properties": {
-            "access": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "readOnly"
@@ -233,16 +176,6 @@
              "default": false,
              "type": "boolean"
            },
-            "readOnlyAccess": {
-              "allOf": [
-                {
-                  "$ref": "#/definitions/ReadOnlyAccess"
-                }
-              ],
-              "default": {
-                "type": "fullAccess"
-              }
-            },
            "type": {
              "enum": [
                "workspaceWrite"
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json
@@ -27,7 +27,6 @@
          "enum": [
            "contextWindowExceeded",
            "usageLimitExceeded",
-            "serverOverloaded",
            "internalServerError",
            "unauthorized",
            "badRequest",
@@ -37,6 +36,35 @@
          ],
          "type": "string"
        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "modelCap": {
+              "properties": {
+                "model": {
+                  "type": "string"
+                },
+                "reset_after_seconds": {
+                  "format": "uint64",
+                  "minimum": 0.0,
+                  "type": [
+                    "integer",
+                    "null"
+                  ]
+                }
+              },
+              "required": [
+                "model"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "modelCap"
+          ],
+          "title": "ModelCapCodexErrorInfo",
+          "type": "object"
+        },
        {
          "additionalProperties": false,
          "properties": {
--- a/codex-rs/app-server-protocol/schema/typescript/CodexErrorInfo.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/CodexErrorInfo.ts
@@ -5,4 +5,4 @@
 /**
 * Codex errors that we expose to clients.
 */
-export type CodexErrorInfo = "context_window_exceeded" | "usage_limit_exceeded" | "server_overloaded" | { "http_connection_failed": { http_status_code: number | null, } } | { "response_stream_connection_failed": { http_status_code: number | null, } } | "internal_server_error" | "unauthorized" | "bad_request" | "sandbox_error" | { "response_stream_disconnected": { http_status_code: number | null, } } | { "response_too_many_failed_attempts": { http_status_code: number | null, } } | "thread_rollback_failed" | "other";
+export type CodexErrorInfo = "context_window_exceeded" | "usage_limit_exceeded" | { "model_cap": { model: string, reset_after_seconds: bigint | null, } } | { "http_connection_failed": { http_status_code: number | null, } } | { "response_stream_connection_failed": { http_status_code: number | null, } } | "internal_server_error" | "unauthorized" | "bad_request" | "sandbox_error" | { "response_stream_disconnected": { http_status_code: number | null, } } | { "response_too_many_failed_attempts": { http_status_code: number | null, } } | "thread_rollback_failed" | "other";
--- a/codex-rs/app-server-protocol/schema/typescript/PatchApplyStatus.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/PatchApplyStatus.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type PatchApplyStatus = "completed" | "failed" | "declined";
+export type Compaction = { encrypted_content: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/SessionNetworkProxyRuntime.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SessionNetworkProxyRuntime.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type SessionNetworkProxyRuntime = { http_addr: string, socks_addr: string, admin_addr: string, };
+export type CustomToolCall = { status?: string, call_id: string, name: string, input: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/CustomToolCallOutput.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/CustomToolCallOutput.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ExecCommandStatus = "completed" | "failed" | "declined";
+export type CustomToolCallOutput = { call_id: string, output: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/ExecCommandEndEvent.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ExecCommandEndEvent.ts
@@ -2,7 +2,6 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ExecCommandSource } from "./ExecCommandSource";
-import type { ExecCommandStatus } from "./ExecCommandStatus";
 import type { ParsedCommand } from "./ParsedCommand";

 export type ExecCommandEndEvent = { 
@@ -57,8 +56,4 @@ duration: string,
 /**
 * Formatted output from the command, as seen by the model.
 */
-formatted_output: string, 
-/**
- * Completion status for this command execution.
- */
-status: ExecCommandStatus, };
+formatted_output: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/SkillsListExtraRootsForCwd.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/SkillsListExtraRootsForCwd.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type SkillsListExtraRootsForCwd = { cwd: string, extraUserRoots: Array<string>, };
+export type FunctionCall = { name: string, arguments: string, call_id: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/FunctionCallOutput.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/FunctionCallOutput.ts
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { FunctionCallOutputPayload } from "./FunctionCallOutputPayload";
+
+export type FunctionCallOutput = { call_id: string, output: FunctionCallOutputPayload, };
--- a/codex-rs/app-server-protocol/schema/typescript/FuzzyFileSearchSessionUpdatedNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/FuzzyFileSearchSessionUpdatedNotification.ts
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { FuzzyFileSearchResult } from "./FuzzyFileSearchResult";
-
-export type FuzzyFileSearchSessionUpdatedNotification = { sessionId: string, query: string, files: Array<FuzzyFileSearchResult>, };
--- a/codex-rs/app-server-protocol/schema/typescript/GhostSnapshot.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/GhostSnapshot.ts
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { GhostCommit } from "./GhostCommit";
+
+export type GhostSnapshot = { ghost_commit: GhostCommit, };
--- a/codex-rs/app-server-protocol/schema/typescript/InitializeCapabilities.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/InitializeCapabilities.ts
@@ -9,9 +9,4 @@ export type InitializeCapabilities = {
 /**
 * Opt into receiving experimental API methods and fields.
 */
-experimentalApi: boolean, 
-/**
- * Exact notification method names that should be suppressed for this
- * connection (for example `codex/event/session_configured`).
- */
-optOutNotificationMethods?: Array<string> | null, };
+experimentalApi: boolean, };
--- a/codex-rs/app-server-protocol/schema/typescript/LocalShellCall.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/LocalShellCall.ts
@@ -0,0 +1,11 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { LocalShellAction } from "./LocalShellAction";
+import type { LocalShellStatus } from "./LocalShellStatus";
+
+export type LocalShellCall = { 
+/**
+ * Set when using the Responses API.
+ */
+call_id: string | null, status: LocalShellStatus, action: LocalShellAction, };
--- a/codex-rs/app-server-protocol/schema/typescript/Message.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/Message.ts
@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ContentItem } from "./ContentItem";
+import type { MessagePhase } from "./MessagePhase";
+
+export type Message = { role: string, content: Array<ContentItem>, end_turn?: boolean, phase?: MessagePhase, };
--- a/codex-rs/app-server-protocol/schema/typescript/PatchApplyEndEvent.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/PatchApplyEndEvent.ts
@@ -2,7 +2,6 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { FileChange } from "./FileChange";
-import type { PatchApplyStatus } from "./PatchApplyStatus";

 export type PatchApplyEndEvent = { 
 /**
@@ -29,8 +28,4 @@ success: boolean,
 /**
 * The changes that were applied (mirrors PatchApplyBeginEvent::changes).
 */
-changes: { [key in string]?: FileChange }, 
-/**
- * Completion status for this patch application.
- */
-status: PatchApplyStatus, };
+changes: { [key in string]?: FileChange }, };
--- a/codex-rs/app-server-protocol/schema/typescript/RateLimitSnapshot.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/RateLimitSnapshot.ts
@@ -5,4 +5,4 @@ import type { CreditsSnapshot } from "./CreditsSnapshot";
 import type { PlanType } from "./PlanType";
 import type { RateLimitWindow } from "./RateLimitWindow";

-export type RateLimitSnapshot = { limit_id: string | null, limit_name: string | null, primary: RateLimitWindow | null, secondary: RateLimitWindow | null, credits: CreditsSnapshot | null, plan_type: PlanType | null, };
+export type RateLimitSnapshot = { primary: RateLimitWindow | null, secondary: RateLimitWindow | null, credits: CreditsSnapshot | null, plan_type: PlanType | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ReadOnlyAccess.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ReadOnlyAccess.ts
@@ -1,19 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AbsolutePathBuf } from "./AbsolutePathBuf";
-
-/**
- * Determines how read-only file access is granted inside a restricted
- * sandbox.
- */
-export type ReadOnlyAccess = { "type": "restricted", 
-/**
- * Include built-in platform read roots required for basic process
- * execution.
- */
-include_platform_defaults: boolean, 
-/**
- * Additional absolute roots that should be readable.
- */
-readable_roots?: Array<AbsolutePathBuf>, } | { "type": "full-access" };
--- a/codex-rs/app-server-protocol/schema/typescript/Reasoning.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/Reasoning.ts
@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ReasoningItemContent } from "./ReasoningItemContent";
+import type { ReasoningItemReasoningSummary } from "./ReasoningItemReasoningSummary";
+
+export type Reasoning = { summary: Array<ReasoningItemReasoningSummary>, content?: Array<ReasoningItemContent>, encrypted_content: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
@@ -1,18 +1,15 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ContentItem } from "./ContentItem";
-import type { FunctionCallOutputPayload } from "./FunctionCallOutputPayload";
-import type { GhostCommit } from "./GhostCommit";
-import type { LocalShellAction } from "./LocalShellAction";
-import type { LocalShellStatus } from "./LocalShellStatus";
-import type { MessagePhase } from "./MessagePhase";
-import type { ReasoningItemContent } from "./ReasoningItemContent";
-import type { ReasoningItemReasoningSummary } from "./ReasoningItemReasoningSummary";
-import type { WebSearchAction } from "./WebSearchAction";
+import type { Compaction } from "./Compaction";
+import type { CustomToolCall } from "./CustomToolCall";
+import type { CustomToolCallOutput } from "./CustomToolCallOutput";
+import type { FunctionCall } from "./FunctionCall";
+import type { FunctionCallOutput } from "./FunctionCallOutput";
+import type { GhostSnapshot } from "./GhostSnapshot";
+import type { LocalShellCall } from "./LocalShellCall";
+import type { Message } from "./Message";
+import type { Reasoning } from "./Reasoning";
+import type { WebSearchCall } from "./WebSearchCall";

-export type ResponseItem = { "type": "message", role: string, content: Array<ContentItem>, end_turn?: boolean, phase?: MessagePhase, } | { "type": "reasoning", summary: Array<ReasoningItemReasoningSummary>, content?: Array<ReasoningItemContent>, encrypted_content: string | null, } | { "type": "local_shell_call", 
-/**
- * Set when using the Responses API.
- */
-call_id: string | null, status: LocalShellStatus, action: LocalShellAction, } | { "type": "function_call", name: string, arguments: string, call_id: string, } | { "type": "function_call_output", call_id: string, output: FunctionCallOutputPayload, } | { "type": "custom_tool_call", status?: string, call_id: string, name: string, input: string, } | { "type": "custom_tool_call_output", call_id: string, output: string, } | { "type": "web_search_call", status?: string, action?: WebSearchAction, } | { "type": "ghost_snapshot", ghost_commit: GhostCommit, } | { "type": "compaction", encrypted_content: string, } | { "type": "other" };
+export type ResponseItem = { "type": "message" } & Message | { "type": "reasoning" } & Reasoning | { "type": "local_shell_call" } & LocalShellCall | { "type": "function_call" } & FunctionCall | { "type": "function_call_output" } & FunctionCallOutput | { "type": "custom_tool_call" } & CustomToolCall | { "type": "custom_tool_call_output" } & CustomToolCallOutput | { "type": "web_search_call" } & WebSearchCall | { "type": "ghost_snapshot" } & GhostSnapshot | { "type": "compaction" } & Compaction | { "type": "other" };
--- a/codex-rs/app-server-protocol/schema/typescript/SandboxPolicy.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SandboxPolicy.ts
@@ -3,16 +3,11 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "./AbsolutePathBuf";
 import type { NetworkAccess } from "./NetworkAccess";
-import type { ReadOnlyAccess } from "./ReadOnlyAccess";

 /**
 * Determines execution restrictions for model shell commands.
 */
-export type SandboxPolicy = { "type": "danger-full-access" } | { "type": "read-only", 
-/**
- * Read access granted while running under this policy.
- */
-access?: ReadOnlyAccess, } | { "type": "external-sandbox", 
+export type SandboxPolicy = { "type": "danger-full-access" } | { "type": "read-only" } | { "type": "external-sandbox", 
 /**
 * Whether the external sandbox permits outbound network traffic.
 */
@@ -22,10 +17,6 @@ network_access: NetworkAccess, } | { "type": "workspace-write",
 * writable from within the sandbox.
 */
 writable_roots?: Array<AbsolutePathBuf>, 
-/**
- * Read access granted while running under this policy.
- */
-read_only_access?: ReadOnlyAccess, 
 /**
 * When set to `true`, outbound network access is allowed. `false` by
 * default.
--- a/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts
@@ -2,7 +2,6 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AuthStatusChangeNotification } from "./AuthStatusChangeNotification";
-import type { FuzzyFileSearchSessionUpdatedNotification } from "./FuzzyFileSearchSessionUpdatedNotification";
 import type { LoginChatGptCompleteNotification } from "./LoginChatGptCompleteNotification";
 import type { SessionConfiguredNotification } from "./SessionConfiguredNotification";
 import type { AccountLoginCompletedNotification } from "./v2/AccountLoginCompletedNotification";
@@ -38,4 +37,4 @@ import type { WindowsWorldWritableWarningNotification } from "./v2/WindowsWorldW
 /**
 * Notification sent from the server to the client.
 */
-export type ServerNotification = { "method": "error", "params": ErrorNotification } | { "method": "thread/started", "params": ThreadStartedNotification } | { "method": "thread/name/updated", "params": ThreadNameUpdatedNotification } | { "method": "thread/tokenUsage/updated", "params": ThreadTokenUsageUpdatedNotification } | { "method": "turn/started", "params": TurnStartedNotification } | { "method": "turn/completed", "params": TurnCompletedNotification } | { "method": "turn/diff/updated", "params": TurnDiffUpdatedNotification } | { "method": "turn/plan/updated", "params": TurnPlanUpdatedNotification } | { "method": "item/started", "params": ItemStartedNotification } | { "method": "item/completed", "params": ItemCompletedNotification } | { "method": "rawResponseItem/completed", "params": RawResponseItemCompletedNotification } | { "method": "item/agentMessage/delta", "params": AgentMessageDeltaNotification } | { "method": "item/plan/delta", "params": PlanDeltaNotification } | { "method": "item/commandExecution/outputDelta", "params": CommandExecutionOutputDeltaNotification } | { "method": "item/commandExecution/terminalInteraction", "params": TerminalInteractionNotification } | { "method": "item/fileChange/outputDelta", "params": FileChangeOutputDeltaNotification } | { "method": "item/mcpToolCall/progress", "params": McpToolCallProgressNotification } | { "method": "mcpServer/oauthLogin/completed", "params": McpServerOauthLoginCompletedNotification } | { "method": "account/updated", "params": AccountUpdatedNotification } | { "method": "account/rateLimits/updated", "params": AccountRateLimitsUpdatedNotification } | { "method": "app/list/updated", "params": AppListUpdatedNotification } | { "method": "item/reasoning/summaryTextDelta", "params": ReasoningSummaryTextDeltaNotification } | { "method": "item/reasoning/summaryPartAdded", "params": ReasoningSummaryPartAddedNotification } | { "method": "item/reasoning/textDelta", "params": ReasoningTextDeltaNotification } | { "method": "thread/compacted", "params": ContextCompactedNotification } | { "method": "deprecationNotice", "params": DeprecationNoticeNotification } | { "method": "configWarning", "params": ConfigWarningNotification } | { "method": "fuzzyFileSearch/sessionUpdated", "params": FuzzyFileSearchSessionUpdatedNotification } | { "method": "windows/worldWritableWarning", "params": WindowsWorldWritableWarningNotification } | { "method": "account/login/completed", "params": AccountLoginCompletedNotification } | { "method": "authStatusChange", "params": AuthStatusChangeNotification } | { "method": "loginChatGptComplete", "params": LoginChatGptCompleteNotification } | { "method": "sessionConfigured", "params": SessionConfiguredNotification };
+export type ServerNotification = { "method": "error", "params": ErrorNotification } | { "method": "thread/started", "params": ThreadStartedNotification } | { "method": "thread/name/updated", "params": ThreadNameUpdatedNotification } | { "method": "thread/tokenUsage/updated", "params": ThreadTokenUsageUpdatedNotification } | { "method": "turn/started", "params": TurnStartedNotification } | { "method": "turn/completed", "params": TurnCompletedNotification } | { "method": "turn/diff/updated", "params": TurnDiffUpdatedNotification } | { "method": "turn/plan/updated", "params": TurnPlanUpdatedNotification } | { "method": "item/started", "params": ItemStartedNotification } | { "method": "item/completed", "params": ItemCompletedNotification } | { "method": "rawResponseItem/completed", "params": RawResponseItemCompletedNotification } | { "method": "item/agentMessage/delta", "params": AgentMessageDeltaNotification } | { "method": "item/plan/delta", "params": PlanDeltaNotification } | { "method": "item/commandExecution/outputDelta", "params": CommandExecutionOutputDeltaNotification } | { "method": "item/commandExecution/terminalInteraction", "params": TerminalInteractionNotification } | { "method": "item/fileChange/outputDelta", "params": FileChangeOutputDeltaNotification } | { "method": "item/mcpToolCall/progress", "params": McpToolCallProgressNotification } | { "method": "mcpServer/oauthLogin/completed", "params": McpServerOauthLoginCompletedNotification } | { "method": "account/updated", "params": AccountUpdatedNotification } | { "method": "account/rateLimits/updated", "params": AccountRateLimitsUpdatedNotification } | { "method": "app/list/updated", "params": AppListUpdatedNotification } | { "method": "item/reasoning/summaryTextDelta", "params": ReasoningSummaryTextDeltaNotification } | { "method": "item/reasoning/summaryPartAdded", "params": ReasoningSummaryPartAddedNotification } | { "method": "item/reasoning/textDelta", "params": ReasoningTextDeltaNotification } | { "method": "thread/compacted", "params": ContextCompactedNotification } | { "method": "deprecationNotice", "params": DeprecationNoticeNotification } | { "method": "configWarning", "params": ConfigWarningNotification } | { "method": "windows/worldWritableWarning", "params": WindowsWorldWritableWarningNotification } | { "method": "account/login/completed", "params": AccountLoginCompletedNotification } | { "method": "authStatusChange", "params": AuthStatusChangeNotification } | { "method": "loginChatGptComplete", "params": LoginChatGptCompleteNotification } | { "method": "sessionConfigured", "params": SessionConfiguredNotification };
--- a/codex-rs/app-server-protocol/schema/typescript/SessionConfiguredEvent.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SessionConfiguredEvent.ts
@@ -5,7 +5,6 @@ import type { AskForApproval } from "./AskForApproval";
 import type { EventMsg } from "./EventMsg";
 import type { ReasoningEffort } from "./ReasoningEffort";
 import type { SandboxPolicy } from "./SandboxPolicy";
-import type { SessionNetworkProxyRuntime } from "./SessionNetworkProxyRuntime";
 import type { ThreadId } from "./ThreadId";

 export type SessionConfiguredEvent = { session_id: ThreadId, forked_from_id: ThreadId | null, 
@@ -47,10 +46,6 @@ history_entry_count: number,
 * When present, UIs can use these to seed the history.
 */
 initial_messages: Array<EventMsg> | null, 
-/**
- * Runtime proxy bind addresses, when the managed proxy was started for this session.
- */
-network_proxy?: SessionNetworkProxyRuntime, 
 /**
 * Path in which the rollout is stored. Can be `None` for ephemeral threads
 */
--- a/codex-rs/app-server-protocol/schema/typescript/SubAgentSource.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/SubAgentSource.ts
@@ -3,4 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ThreadId } from "./ThreadId";

-export type SubAgentSource = "review" | "compact" | { "thread_spawn": { parent_thread_id: ThreadId, depth: number, } } | "memory_consolidation" | { "other": string };
+export type SubAgentSource = "review" | "compact" | { "thread_spawn": { parent_thread_id: ThreadId, depth: number, } } | { "other": string };
--- a/codex-rs/app-server-protocol/schema/typescript/TurnAbortedEvent.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/TurnAbortedEvent.ts
@@ -3,4 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { TurnAbortReason } from "./TurnAbortReason";

-export type TurnAbortedEvent = { turn_id: string | null, reason: TurnAbortReason, };
+export type TurnAbortedEvent = { reason: TurnAbortReason, };
--- a/codex-rs/app-server-protocol/schema/typescript/TurnCompleteEvent.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/TurnCompleteEvent.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type TurnCompleteEvent = { turn_id: string, last_agent_message: string | null, };
+export type TurnCompleteEvent = { last_agent_message: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/TurnStartedEvent.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/TurnStartedEvent.ts
@@ -3,4 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ModeKind } from "./ModeKind";

-export type TurnStartedEvent = { turn_id: string, model_context_window: bigint | null, collaboration_mode_kind: ModeKind, };
+export type TurnStartedEvent = { model_context_window: bigint | null, collaboration_mode_kind: ModeKind, };
--- a/codex-rs/app-server-protocol/schema/typescript/WebSearchCall.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/WebSearchCall.ts
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { WebSearchAction } from "./WebSearchAction";
+
+export type WebSearchCall = { status?: string, action?: WebSearchAction, };
--- a/codex-rs/app-server-protocol/schema/typescript/index.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/index.ts
@@ -43,6 +43,7 @@ export type { CollabWaitingBeginEvent } from "./CollabWaitingBeginEvent";
 export type { CollabWaitingEndEvent } from "./CollabWaitingEndEvent";
 export type { CollaborationMode } from "./CollaborationMode";
 export type { CollaborationModeMask } from "./CollaborationModeMask";
+export type { Compaction } from "./Compaction";
 export type { ContentItem } from "./ContentItem";
 export type { ContextCompactedEvent } from "./ContextCompactedEvent";
 export type { ContextCompactionItem } from "./ContextCompactionItem";
@@ -50,6 +51,8 @@ export type { ConversationGitInfo } from "./ConversationGitInfo";
 export type { ConversationSummary } from "./ConversationSummary";
 export type { CreditsSnapshot } from "./CreditsSnapshot";
 export type { CustomPrompt } from "./CustomPrompt";
+export type { CustomToolCall } from "./CustomToolCall";
+export type { CustomToolCallOutput } from "./CustomToolCallOutput";
 export type { DeprecationNoticeEvent } from "./DeprecationNoticeEvent";
 export type { DynamicToolCallRequest } from "./DynamicToolCallRequest";
 export type { ElicitationRequestEvent } from "./ElicitationRequestEvent";
@@ -62,7 +65,6 @@ export type { ExecCommandBeginEvent } from "./ExecCommandBeginEvent";
 export type { ExecCommandEndEvent } from "./ExecCommandEndEvent";
 export type { ExecCommandOutputDeltaEvent } from "./ExecCommandOutputDeltaEvent";
 export type { ExecCommandSource } from "./ExecCommandSource";
-export type { ExecCommandStatus } from "./ExecCommandStatus";
 export type { ExecOneOffCommandParams } from "./ExecOneOffCommandParams";
 export type { ExecOneOffCommandResponse } from "./ExecOneOffCommandResponse";
 export type { ExecOutputStream } from "./ExecOutputStream";
@@ -72,13 +74,14 @@ export type { FileChange } from "./FileChange";
 export type { ForcedLoginMethod } from "./ForcedLoginMethod";
 export type { ForkConversationParams } from "./ForkConversationParams";
 export type { ForkConversationResponse } from "./ForkConversationResponse";
+export type { FunctionCall } from "./FunctionCall";
+export type { FunctionCallOutput } from "./FunctionCallOutput";
 export type { FunctionCallOutputBody } from "./FunctionCallOutputBody";
 export type { FunctionCallOutputContentItem } from "./FunctionCallOutputContentItem";
 export type { FunctionCallOutputPayload } from "./FunctionCallOutputPayload";
 export type { FuzzyFileSearchParams } from "./FuzzyFileSearchParams";
 export type { FuzzyFileSearchResponse } from "./FuzzyFileSearchResponse";
 export type { FuzzyFileSearchResult } from "./FuzzyFileSearchResult";
-export type { FuzzyFileSearchSessionUpdatedNotification } from "./FuzzyFileSearchSessionUpdatedNotification";
 export type { GetAuthStatusParams } from "./GetAuthStatusParams";
 export type { GetAuthStatusResponse } from "./GetAuthStatusResponse";
 export type { GetConversationSummaryParams } from "./GetConversationSummaryParams";
@@ -87,6 +90,7 @@ export type { GetHistoryEntryResponseEvent } from "./GetHistoryEntryResponseEven
 export type { GetUserAgentResponse } from "./GetUserAgentResponse";
 export type { GetUserSavedConfigResponse } from "./GetUserSavedConfigResponse";
 export type { GhostCommit } from "./GhostCommit";
+export type { GhostSnapshot } from "./GhostSnapshot";
 export type { GitDiffToRemoteParams } from "./GitDiffToRemoteParams";
 export type { GitDiffToRemoteResponse } from "./GitDiffToRemoteResponse";
 export type { GitSha } from "./GitSha";
@@ -106,6 +110,7 @@ export type { ListCustomPromptsResponseEvent } from "./ListCustomPromptsResponse
 export type { ListRemoteSkillsResponseEvent } from "./ListRemoteSkillsResponseEvent";
 export type { ListSkillsResponseEvent } from "./ListSkillsResponseEvent";
 export type { LocalShellAction } from "./LocalShellAction";
+export type { LocalShellCall } from "./LocalShellCall";
 export type { LocalShellExecAction } from "./LocalShellExecAction";
 export type { LocalShellStatus } from "./LocalShellStatus";
 export type { LoginApiKeyParams } from "./LoginApiKeyParams";
@@ -122,6 +127,7 @@ export type { McpStartupStatus } from "./McpStartupStatus";
 export type { McpStartupUpdateEvent } from "./McpStartupUpdateEvent";
 export type { McpToolCallBeginEvent } from "./McpToolCallBeginEvent";
 export type { McpToolCallEndEvent } from "./McpToolCallEndEvent";
+export type { Message } from "./Message";
 export type { MessagePhase } from "./MessagePhase";
 export type { ModeKind } from "./ModeKind";
 export type { NetworkAccess } from "./NetworkAccess";
@@ -130,7 +136,6 @@ export type { NewConversationResponse } from "./NewConversationResponse";
 export type { ParsedCommand } from "./ParsedCommand";
 export type { PatchApplyBeginEvent } from "./PatchApplyBeginEvent";
 export type { PatchApplyEndEvent } from "./PatchApplyEndEvent";
-export type { PatchApplyStatus } from "./PatchApplyStatus";
 export type { Personality } from "./Personality";
 export type { PlanDeltaEvent } from "./PlanDeltaEvent";
 export type { PlanItem } from "./PlanItem";
@@ -140,7 +145,7 @@ export type { Profile } from "./Profile";
 export type { RateLimitSnapshot } from "./RateLimitSnapshot";
 export type { RateLimitWindow } from "./RateLimitWindow";
 export type { RawResponseItemEvent } from "./RawResponseItemEvent";
-export type { ReadOnlyAccess } from "./ReadOnlyAccess";
+export type { Reasoning } from "./Reasoning";
 export type { ReasoningContentDeltaEvent } from "./ReasoningContentDeltaEvent";
 export type { ReasoningEffort } from "./ReasoningEffort";
 export type { ReasoningItem } from "./ReasoningItem";
@@ -179,7 +184,6 @@ export type { ServerNotification } from "./ServerNotification";
 export type { ServerRequest } from "./ServerRequest";
 export type { SessionConfiguredEvent } from "./SessionConfiguredEvent";
 export type { SessionConfiguredNotification } from "./SessionConfiguredNotification";
-export type { SessionNetworkProxyRuntime } from "./SessionNetworkProxyRuntime";
 export type { SessionSource } from "./SessionSource";
 export type { SetDefaultModelParams } from "./SetDefaultModelParams";
 export type { SetDefaultModelResponse } from "./SetDefaultModelResponse";
@@ -223,6 +227,7 @@ export type { ViewImageToolCallEvent } from "./ViewImageToolCallEvent";
 export type { WarningEvent } from "./WarningEvent";
 export type { WebSearchAction } from "./WebSearchAction";
 export type { WebSearchBeginEvent } from "./WebSearchBeginEvent";
+export type { WebSearchCall } from "./WebSearchCall";
 export type { WebSearchEndEvent } from "./WebSearchEndEvent";
 export type { WebSearchItem } from "./WebSearchItem";
 export type { WebSearchMode } from "./WebSearchMode";
--- a/codex-rs/app-server-protocol/schema/typescript/v2/AppInfo.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/AppInfo.ts
@@ -5,13 +5,4 @@
 /**
 * EXPERIMENTAL - app metadata returned by app-list APIs.
 */
-export type AppInfo = { id: string, name: string, description: string | null, logoUrl: string | null, logoUrlDark: string | null, distributionChannel: string | null, installUrl: string | null, isAccessible: boolean, 
-/**
- * Whether this app is enabled in config.toml.
- * Example:
- * ```toml
- * [apps.bad_app]
- * enabled = false
- * ```
- */
-isEnabled: boolean, };
+export type AppInfo = { id: string, name: string, description: string | null, logoUrl: string | null, logoUrlDark: string | null, distributionChannel: string | null, installUrl: string | null, isAccessible: boolean, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/AppsListParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/AppsListParams.ts
@@ -14,10 +14,6 @@ cursor?: string | null,
 * Optional page size; defaults to a reasonable server-side value.
 */
 limit?: number | null, 
-/**
- * Optional thread id used to evaluate app feature gating from that thread's config.
- */
-threadId?: string | null, 
 /**
 * When true, bypass app caches and fetch the latest data from sources.
 */
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ChatgptAuthTokensRefreshParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ChatgptAuthTokensRefreshParams.ts
@@ -10,7 +10,7 @@ export type ChatgptAuthTokensRefreshParams = { reason: ChatgptAuthTokensRefreshR
 * Clients that manage multiple accounts/workspaces can use this as a hint
 * to refresh the token for the correct workspace.
 *
- * This may be `null` when the prior auth state did not include a workspace
- * identifier (`chatgpt_account_id`).
+ * This may be `null` when the prior ID token did not include a workspace
+ * identifier (`chatgpt_account_id`) or when the token could not be parsed.
 */
 previousAccountId?: string | null, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ChatgptAuthTokensRefreshResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ChatgptAuthTokensRefreshResponse.ts
@@ -2,4 +2,4 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ChatgptAuthTokensRefreshResponse = { accessToken: string, chatgptAccountId: string, chatgptPlanType: string | null, };
+export type ChatgptAuthTokensRefreshResponse = { idToken: string, accessToken: string, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/CodexErrorInfo.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/CodexErrorInfo.ts
@@ -8,4 +8,4 @@
 * When an upstream HTTP status is available (for example, from the Responses API or a provider),
 * it is forwarded in `httpStatusCode` on the relevant `codexErrorInfo` variant.
 */
-export type CodexErrorInfo = "contextWindowExceeded" | "usageLimitExceeded" | "serverOverloaded" | { "httpConnectionFailed": { httpStatusCode: number | null, } } | { "responseStreamConnectionFailed": { httpStatusCode: number | null, } } | "internalServerError" | "unauthorized" | "badRequest" | "threadRollbackFailed" | "sandboxError" | { "responseStreamDisconnected": { httpStatusCode: number | null, } } | { "responseTooManyFailedAttempts": { httpStatusCode: number | null, } } | "other";
+export type CodexErrorInfo = "contextWindowExceeded" | "usageLimitExceeded" | { "modelCap": { model: string, reset_after_seconds: bigint | null, } } | { "httpConnectionFailed": { httpStatusCode: number | null, } } | { "responseStreamConnectionFailed": { httpStatusCode: number | null, } } | "internalServerError" | "unauthorized" | "badRequest" | "threadRollbackFailed" | "sandboxError" | { "responseStreamDisconnected": { httpStatusCode: number | null, } } | { "responseTooManyFailedAttempts": { httpStatusCode: number | null, } } | "other";
--- a/codex-rs/app-server-protocol/schema/typescript/v2/GetAccountRateLimitsResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/GetAccountRateLimitsResponse.ts
@@ -3,12 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { RateLimitSnapshot } from "./RateLimitSnapshot";

-export type GetAccountRateLimitsResponse = { 
-/**
- * Backward-compatible single-bucket view; mirrors the historical payload.
- */
-rateLimits: RateLimitSnapshot, 
-/**
- * Multi-bucket view keyed by metered `limit_id` (for example, `codex`).
- */
-rateLimitsByLimitId: { [key in string]?: RateLimitSnapshot } | null, };
+export type GetAccountRateLimitsResponse = { rateLimits: RateLimitSnapshot, };
--- a/codex-rs/app-server-protocol/schema/typescript/v2/LoginAccountParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/LoginAccountParams.ts
@@ -4,18 +4,14 @@

 export type LoginAccountParams = { "type": "apiKey", apiKey: string, } | { "type": "chatgpt" } | { "type": "chatgptAuthTokens", 
 /**
- * Access token (JWT) supplied by the client.
- * This token is used for backend API requests and email extraction.
- */
-accessToken: string, 
-/**
- * Workspace/account identifier supplied by the client.
- */
-chatgptAccountId: string, 
-/**
- * Optional plan type supplied by the client.
+ * ID token (JWT) supplied by the client.
 *
- * When `null`, Codex attempts to derive the plan type from access-token
- * claims. If unavailable, the plan defaults to `unknown`.
+ * This token is used for identity and account metadata (email, plan type,
+ * workspace id).
 */
-chatgptPlanType?: string | null, };
+idToken: string, 
+/**
+ * Access token (JWT) supplied by the client.
+ * This token is used for backend API requests.
+ */
+accessToken: string, };
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ahmed Ibrahim	0fd69f1b37	Extract ContextDiscoverable history handling	2026-02-08 20:02:58 -08:00
Ahmed Ibrahim	ed4dd2b10e	fix	2026-02-08 19:02:22 -08:00
Ahmed Ibrahim	508e9ebe32	Update app-server protocol schema fixtures for ResponseItem refactor	2026-02-08 18:27:46 -08:00
Ahmed Ibrahim	2e267dec61	Refactor ResponseItem to typed variant payload structs	2026-02-08 18:18:51 -08:00