feat: list-models subcommand for full CLI

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:24.04
+FROM ubuntu:22.04
 
 ARG DEBIAN_FRONTEND=noninteractive
 # enable 'universe' because musl-tools & clang live there
@@ -11,17 +11,19 @@ RUN apt-get update && \
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     build-essential curl git ca-certificates \
-    pkg-config clang musl-tools libssl-dev just && \
+    pkg-config clang musl-tools libssl-dev && \
     rm -rf /var/lib/apt/lists/*
 
-# Ubuntu 24.04 ships with user 'ubuntu' already created with UID 1000.
-USER ubuntu
+# non-root dev user
+ARG USER=dev
+ARG UID=1000
+RUN useradd -m -u $UID $USER
+USER $USER
 
 # install Rust + musl target as dev user
 RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal && \
-    ~/.cargo/bin/rustup target add aarch64-unknown-linux-musl && \
-    ~/.cargo/bin/rustup component add clippy rustfmt
+    ~/.cargo/bin/rustup target add aarch64-unknown-linux-musl
 
-ENV PATH="/home/ubuntu/.cargo/bin:${PATH}"
+ENV PATH="/home/${USER}/.cargo/bin:${PATH}"
 
 WORKDIR /workspace

.devcontainer/devcontainer.json

@@ -15,13 +15,15 @@
     "CARGO_TARGET_DIR": "${containerWorkspaceFolder}/codex-rs/target-arm64"
   },
 
-  "remoteUser": "ubuntu",
+  "remoteUser": "dev",
   "customizations": {
     "vscode": {
       "settings": {
-        "terminal.integrated.defaultProfile.linux": "bash"
+          "terminal.integrated.defaultProfile.linux": "bash"
       },
-      "extensions": ["rust-lang.rust-analyzer"]
+      "extensions": [
+          "rust-lang.rust-analyzer"
+      ],
     }
   }
 }

.github/actions/codex/action.yml

@@ -20,9 +20,9 @@ inputs:
     description: "Value to use as the CODEX_HOME environment variable when running Codex."
     required: false
   codex_release_tag:
-    description: "The release tag of the Codex model to run, e.g., 'rust-v0.3.0'. Defaults to the latest release."
+    description: "The release tag of the Codex model to run."
     required: false
-    default: ""
+    default: "codex-rs-ca8e97fcbcb991e542b8689f2d4eab9d30c399d6-1-rust-v0.0.2505302325"
 
 runs:
   using: "composite"
@@ -84,10 +84,7 @@ runs:
         # we will need to update this action.yml file to match.
         artifact="codex-exec-${triple}.tar.gz"
 
-        TAG_ARG="${{ inputs.codex_release_tag }}"
-        # The usage is `gh release download [<tag>] [flags]`, so if TAG_ARG
-        # is empty, we do not pass it so we can default to the latest release.
-        gh release download ${TAG_ARG:+$TAG_ARG} --repo openai/codex \
+        gh release download ${{ inputs.codex_release_tag }} --repo openai/codex \
           --pattern "$artifact" --output - \
         | tar xzO > /usr/local/bin/codex-exec
         chmod +x /usr/local/bin/codex-exec

.github/actions/codex/bun.lock

@@ -8,9 +8,9 @@
         "@actions/github": "^6.0.1",
       },
       "devDependencies": {
-        "@types/bun": "^1.2.18",
-        "@types/node": "^24.0.13",
-        "prettier": "^3.6.2",
+        "@types/bun": "^1.2.11",
+        "@types/node": "^22.15.21",
+        "prettier": "^3.5.3",
         "typescript": "^5.8.3",
       },
     },
@@ -48,23 +48,19 @@
 
     "@octokit/types": ["@octokit/types@13.10.0", "", { "dependencies": { "@octokit/openapi-types": "^24.2.0" } }, "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA=="],
 
-    "@types/bun": ["@types/bun@1.2.18", "", { "dependencies": { "bun-types": "1.2.18" } }, "sha512-Xf6RaWVheyemaThV0kUfaAUvCNokFr+bH8Jxp+tTZfx7dAPA8z9ePnP9S9+Vspzuxxx9JRAXhnyccRj3GyCMdQ=="],
+    "@types/bun": ["@types/bun@1.2.13", "", { "dependencies": { "bun-types": "1.2.13" } }, "sha512-u6vXep/i9VBxoJl3GjZsl/BFIsvML8DfVDO0RYLEwtSZSp981kEO1V5NwRcO1CPJ7AmvpbnDCiMKo3JvbDEjAg=="],
 
-    "@types/node": ["@types/node@24.0.13", "", { "dependencies": { "undici-types": "~7.8.0" } }, "sha512-Qm9OYVOFHFYg3wJoTSrz80hoec5Lia/dPp84do3X7dZvLikQvM1YpmvTBEdIr/e+U8HTkFjLHLnl78K/qjf+jQ=="],
-
-    "@types/react": ["@types/react@19.1.8", "", { "dependencies": { "csstype": "^3.0.2" } }, "sha512-AwAfQ2Wa5bCx9WP8nZL2uMZWod7J7/JSplxbTmBQ5ms6QpqNYm672H0Vu9ZVKVngQ+ii4R/byguVEUZQyeg44g=="],
+    "@types/node": ["@types/node@22.15.21", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-EV/37Td6c+MgKAbkcLG6vqZ2zEYHD7bvSrzqqs2RIhbA6w3x+Dqz8MZM3sP6kGTeLrdoOgKZe+Xja7tUB2DNkQ=="],
 
     "before-after-hook": ["before-after-hook@2.2.3", "", {}, "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="],
 
-    "bun-types": ["bun-types@1.2.18", "", { "dependencies": { "@types/node": "*" }, "peerDependencies": { "@types/react": "^19" } }, "sha512-04+Eha5NP7Z0A9YgDAzMk5PHR16ZuLVa83b26kH5+cp1qZW4F6FmAURngE7INf4tKOvCE69vYvDEwoNl1tGiWw=="],
-
-    "csstype": ["csstype@3.1.3", "", {}, "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw=="],
+    "bun-types": ["bun-types@1.2.13", "", { "dependencies": { "@types/node": "*" } }, "sha512-rRjA1T6n7wto4gxhAO/ErZEtOXyEZEmnIHQfl0Dt1QQSB4QV0iP6BZ9/YB5fZaHFQ2dwHFrmPaRQ9GGMX01k9Q=="],
 
     "deprecation": ["deprecation@2.3.1", "", {}, "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="],
 
     "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
 
-    "prettier": ["prettier@3.6.2", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ=="],
+    "prettier": ["prettier@3.5.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw=="],
 
     "tunnel": ["tunnel@0.0.6", "", {}, "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="],
 
@@ -72,7 +68,7 @@
 
     "undici": ["undici@5.29.0", "", { "dependencies": { "@fastify/busboy": "^2.0.0" } }, "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg=="],
 
-    "undici-types": ["undici-types@7.8.0", "", {}, "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw=="],
+    "undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
 
     "universal-user-agent": ["universal-user-agent@6.0.1", "", {}, "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ=="],
 

.github/actions/codex/package.json

@@ -13,9 +13,9 @@
         "@actions/github": "^6.0.1"
     },
     "devDependencies": {
-        "@types/bun": "^1.2.18",
-        "@types/node": "^24.0.13",
-        "prettier": "^3.6.2",
+        "@types/bun": "^1.2.11",
+        "@types/node": "^22.15.21",
+        "prettier": "^3.5.3",
         "typescript": "^5.8.3"
     }
 }

.github/dependabot.yaml

@@ -1,26 +0,0 @@
-# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-
-
-version: 2
-updates:
-  - package-ecosystem: bun
-    directory: .github/actions/codex
-    schedule:
-      interval: weekly
-  - package-ecosystem: cargo
-    directories:
-      - codex-rs
-      - codex-rs/*
-    schedule:
-      interval: weekly
-  - package-ecosystem: devcontainers
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directory: codex-cli
-    schedule:
-      interval: weekly
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly

.github/workflows/ci.yml

@@ -74,12 +74,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: pnpm stage-release
 
-      - name: Ensure root README.md contains only ASCII and certain Unicode code points
+      - name: Ensure README.md contains only ASCII and certain Unicode code points
         run: ./scripts/asciicheck.py README.md
-      - name: Check root README ToC
+      - name: Check README ToC
         run: python3 scripts/readme_toc.py README.md
-
-      - name: Ensure codex-cli/README.md contains only ASCII and certain Unicode code points
-        run: ./scripts/asciicheck.py codex-cli/README.md
-      - name: Check codex-cli/README ToC
-        run: python3 scripts/readme_toc.py codex-cli/README.md

.github/workflows/codex.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Install dependencies
         run: pnpm install
 
-      - uses: dtolnay/rust-toolchain@1.88
+      - uses: dtolnay/rust-toolchain@1.87
         with:
           targets: x86_64-unknown-linux-gnu
           components: clippy

.github/workflows/rust-ci.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.88
+      - uses: dtolnay/rust-toolchain@1.87
         with:
           components: rustfmt
       - name: cargo fmt
@@ -64,7 +64,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.88
+      - uses: dtolnay/rust-toolchain@1.87
         with:
           targets: ${{ matrix.target }}
           components: clippy

.github/workflows/rust-release.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
+env:
+  TAG_REGEX: '^rust-v[0-9]+\.[0-9]+\.[0-9]+$'
+
 jobs:
   tag-check:
     runs-on: ubuntu-latest
@@ -30,8 +33,8 @@ jobs:
           # 1. Must be a tag and match the regex
           [[ "${GITHUB_REF_TYPE}" == "tag" ]] \
             || { echo "❌  Not a tag push"; exit 1; }
-          [[ "${GITHUB_REF_NAME}" =~ ^rust-v[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta)(\.[0-9]+)?)?$ ]] \
-            || { echo "❌  Tag '${GITHUB_REF_NAME}' doesn't match expected format"; exit 1; }
+          [[ "${GITHUB_REF_NAME}" =~ ${TAG_REGEX} ]] \
+            || { echo "❌  Tag '${GITHUB_REF_NAME}' != ${TAG_REGEX}"; exit 1; }
 
           # 2. Extract versions
           tag_ver="${GITHUB_REF_NAME#rust-v}"
@@ -73,7 +76,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.88
+      - uses: dtolnay/rust-toolchain@1.87
         with:
           targets: ${{ matrix.target }}
 
@@ -157,7 +160,9 @@ jobs:
   release:
     needs: build
     name: release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    env:
+      RELEASE_TAG: codex-rs-${{ github.sha }}-${{ github.run_attempt }}-${{ github.ref_name }}
 
     steps:
       - uses: actions/download-artifact@v4
@@ -167,19 +172,9 @@ jobs:
       - name: List
         run: ls -R dist/
 
-      - name: Define release name
-        id: release_name
-        run: |
-          # Extract the version from the tag name, which is in the format
-          # "rust-v0.1.0".
-          version="${GITHUB_REF_NAME#rust-v}"
-          echo "name=${version}" >> $GITHUB_OUTPUT
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v2
         with:
-          name: ${{ steps.release_name.outputs.name }}
-          tag_name: ${{ github.ref_name }}
+          tag_name: ${{ env.RELEASE_TAG }}
           files: dist/**
           # For now, tag releases as "prerelease" because we are not claiming
           # the Rust CLI is stable yet.
@@ -189,5 +184,5 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          tag: ${{ github.ref_name }}
+          tag: ${{ env.RELEASE_TAG }}
           config: .github/dotslash-config.json

README.md

@@ -1,11 +1,9 @@
 <h1 align="center">OpenAI Codex CLI</h1>
 <p align="center">Lightweight coding agent that runs in your terminal</p>
 
-<p align="center"><code>npm i -g @openai/codex</code><br />or <code>brew install codex</code></p>
+<p align="center"><code>npm i -g @openai/codex</code></p>
 
-This is the home of the **Codex CLI**, which is a coding agent from OpenAI that runs locally on your computer. If you are looking for the _cloud-based agent_ from OpenAI, **Codex [Web]**, see <https://chatgpt.com/codex>.
-
-<!-- ![Codex demo GIF using: codex "explain this codebase to me"](./.github/demo.gif) -->
+![Codex demo GIF using: codex "explain this codebase to me"](./.github/demo.gif)
 
 ---
 
@@ -16,8 +14,6 @@ This is the home of the **Codex CLI**, which is a coding agent from OpenAI that
 
 - [Experimental technology disclaimer](#experimental-technology-disclaimer)
 - [Quickstart](#quickstart)
-  - [OpenAI API Users](#openai-api-users)
-  - [OpenAI Plus/Pro Users](#openai-pluspro-users)
 - [Why Codex?](#why-codex)
 - [Security model & permissions](#security-model--permissions)
   - [Platform sandboxing details](#platform-sandboxing-details)
@@ -25,17 +21,24 @@ This is the home of the **Codex CLI**, which is a coding agent from OpenAI that
 - [CLI reference](#cli-reference)
 - [Memory & project docs](#memory--project-docs)
 - [Non-interactive / CI mode](#non-interactive--ci-mode)
-- [Model Context Protocol (MCP)](#model-context-protocol-mcp)
 - [Tracing / verbose logging](#tracing--verbose-logging)
 - [Recipes](#recipes)
 - [Installation](#installation)
-  - [DotSlash](#dotslash)
-- [Configuration](#configuration)
+- [Configuration guide](#configuration-guide)
+  - [Basic configuration parameters](#basic-configuration-parameters)
+  - [Custom AI provider configuration](#custom-ai-provider-configuration)
+  - [History configuration](#history-configuration)
+  - [Configuration examples](#configuration-examples)
+  - [Full configuration example](#full-configuration-example)
+  - [Custom instructions](#custom-instructions)
+  - [Environment variables setup](#environment-variables-setup)
 - [FAQ](#faq)
 - [Zero data retention (ZDR) usage](#zero-data-retention-zdr-usage)
 - [Codex open source fund](#codex-open-source-fund)
 - [Contributing](#contributing)
   - [Development workflow](#development-workflow)
+  - [Git hooks with Husky](#git-hooks-with-husky)
+  - [Debugging](#debugging)
   - [Writing high-impact code changes](#writing-high-impact-code-changes)
   - [Opening a pull request](#opening-a-pull-request)
   - [Review process](#review-process)
@@ -44,6 +47,8 @@ This is the home of the **Codex CLI**, which is a coding agent from OpenAI that
   - [Contributor license agreement (CLA)](#contributor-license-agreement-cla)
     - [Quick fixes](#quick-fixes)
   - [Releasing `codex`](#releasing-codex)
+  - [Alternative build options](#alternative-build-options)
+    - [Nix flake development](#nix-flake-development)
 - [Security & responsible AI](#security--responsible-ai)
 - [License](#license)
 
@@ -66,94 +71,54 @@ Help us improve by filing issues or submitting PRs (see the section below for ho
 
 ## Quickstart
 
-Install globally with your preferred package manager:
+Install globally:
 
 ```shell
-npm install -g @openai/codex  # Alternatively: `brew install codex`
+npm install -g @openai/codex
 ```
 
-Or go to the [latest GitHub Release](https://github.com/openai/codex/releases/latest) and download the appropriate binary for your platform.
-
-### OpenAI API Users
-
 Next, set your OpenAI API key as an environment variable:
 
 ```shell
 export OPENAI_API_KEY="your-api-key-here"
 ```
 
-> [!NOTE]
-> This command sets the key only for your current terminal session. You can add the `export` line to your shell's configuration file (e.g., `~/.zshrc`), but we recommend setting it for the session.
-
-### OpenAI Plus/Pro Users
-
-If you have a paid OpenAI account, run the following to start the login process:
-
-```
-codex login
-```
-
-If you complete the process successfully, you should have a `~/.codex/auth.json` file that contains the credentials that Codex will use.
-
-If you encounter problems with the login flow, please comment on <https://github.com/openai/codex/issues/1243>.
+> **Note:** This command sets the key only for your current terminal session. You can add the `export` line to your shell's configuration file (e.g., `~/.zshrc`) but we recommend setting for the session. **Tip:** You can also place your API key into a `.env` file at the root of your project:
+>
+> ```env
+> OPENAI_API_KEY=your-api-key-here
+> ```
+>
+> The CLI will automatically load variables from `.env` (via `dotenv/config`).
 
 <details>
-<summary><strong>Use <code>--profile</code> to use other models</strong></summary>
+<summary><strong>Use <code>--provider</code> to use other models</strong></summary>
 
-Codex also allows you to use other providers that support the OpenAI Chat Completions (or Responses) API.
-
-To do so, you must first define custom [providers](./config.md#model_providers) in `~/.codex/config.toml`. For example, the provider for a standard Ollama setup would be defined as follows:
-
-```toml
-[model_providers.ollama]
-name = "Ollama"
-base_url = "http://localhost:11434/v1"
-```
-
-The `base_url` will have `/chat/completions` appended to it to build the full URL for the request.
-
-For providers that also require an `Authorization` header of the form `Bearer: SECRET`, an `env_key` can be specified, which indicates the environment variable to read to use as the value of `SECRET` when making a request:
-
-```toml
-[model_providers.openrouter]
-name = "OpenRouter"
-base_url = "https://openrouter.ai/api/v1"
-env_key = "OPENROUTER_API_KEY"
-```
-
-Providers that speak the Responses API are also supported by adding `wire_api = "responses"` as part of the definition. Accessing OpenAI models via Azure is an example of such a provider, though it also requires specifying additional `query_params` that need to be appended to the request URL:
-
-```toml
-[model_providers.azure]
-name = "Azure"
-# Make sure you set the appropriate subdomain for this URL.
-base_url = "https://YOUR_PROJECT_NAME.openai.azure.com/openai"
-env_key = "AZURE_OPENAI_API_KEY"  # Or "OPENAI_API_KEY", whichever you use.
-# Newer versions appear to support the responses API, see https://github.com/openai/codex/pull/1321
-query_params = { api-version = "2025-04-01-preview" }
-wire_api = "responses"
-```
-
-Once you have defined a provider you wish to use, you can configure it as your default provider as follows:
-
-```toml
-model_provider = "azure"
-```
-
-> [!TIP]
-> If you find yourself experimenting with a variety of models and providers, then you likely want to invest in defining a _profile_ for each configuration like so:
-
-```toml
-[profiles.o3]
-model_provider = "azure"
-model = "o3"
-
-[profiles.mistral]
-model_provider = "ollama"
-model = "mistral"
-```
-
-This way, you can specify one command-line argument (.e.g., `--profile o3`, `--profile mistral`) to override multiple settings together.
+> Codex also allows you to use other providers that support the OpenAI Chat Completions API. You can set the provider in the config file or use the `--provider` flag. The possible options for `--provider` are:
+>
+> - openai (default)
+> - openrouter
+> - azure
+> - gemini
+> - ollama
+> - mistral
+> - deepseek
+> - xai
+> - groq
+> - arceeai
+> - any other provider that is compatible with the OpenAI API
+>
+> If you use a provider other than OpenAI, you will need to set the API key for the provider in the config file or in the environment variable as:
+>
+> ```shell
+> export <provider>_API_KEY="your-api-key-here"
+> ```
+>
+> If you use a provider not listed above, you must also set the base URL for the provider:
+>
+> ```shell
+> export <provider>_BASE_URL="https://your-provider-api-base-url"
+> ```
 
 </details>
 <br />
@@ -171,7 +136,7 @@ codex "explain this codebase to me"
 ```
 
 ```shell
-codex --full-auto "create the fanciest todo-list app"
+codex --approval-mode full-auto "create the fanciest todo-list app"
 ```
 
 That's it - Codex will scaffold a file, run it inside a sandbox, install any
@@ -197,35 +162,41 @@ And it's **fully open-source** so you can see and contribute to how it develops!
 
 ## Security model & permissions
 
-Codex lets you decide _how much autonomy_ you want to grant the agent. The following options can be configured independently:
+Codex lets you decide _how much autonomy_ the agent receives and auto-approval policy via the
+`--approval-mode` flag (or the interactive onboarding prompt):
 
-- [`approval_policy`](./codex-rs/config.md#approval_policy) determines when you should be prompted to approve whether Codex can execute a command
-- [`sandbox`](./codex-rs/config.md#sandbox) determines the _sandbox policy_ that Codex uses to execute untrusted commands
+| Mode                      | What the agent may do without asking                                                                | Still requires approval                                                                         |
+| ------------------------- | --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
+| **Suggest** <br>(default) | <li>Read any file in the repo                                                                       | <li>**All** file writes/patches<li> **Any** arbitrary shell commands (aside from reading files) |
+| **Auto Edit**             | <li>Read **and** apply-patch writes to files                                                        | <li>**All** shell commands                                                                      |
+| **Full Auto**             | <li>Read/write files <li> Execute shell commands (network disabled, writes limited to your workdir) | -                                                                                               |
 
-By default, Codex runs with `--ask-for-approval untrusted` and `--sandbox read-only`, which means that:
+In **Full Auto** every command is run **network-disabled** and confined to the
+current working directory (plus temporary files) for defense-in-depth. Codex
+will also show a warning/confirmation if you start in **auto-edit** or
+**full-auto** while the directory is _not_ tracked by Git, so you always have a
+safety net.
 
-- The user is prompted to approve every command not on the set of "trusted" commands built into Codex (`cat`, `ls`, etc.)
-- Approved commands are run outside of a sandbox because user approval implies "trust," in this case.
-
-Running Codex with the `--full-auto` convenience flag changes the configuration to `--ask-for-approval on-failure` and `--sandbox workspace-write`, which means that:
-
-- Codex does not initially ask for user approval before running an individual command.
-- Though when it runs a command, it is run under a sandbox in which:
-  - It can read any file on the system.
-  - It can only write files under the current directory (or the directory specified via `--cd`).
-  - Network requests are completely disabled.
-- Only if the command exits with a non-zero exit code will it ask the user for approval. If granted, it will re-attempt the command outside of the sandbox. (A common case is when Codex cannot `npm install` a dependency because that requires network access.)
-
-Again, these two options can be configured independently. For example, if you want Codex to perform an "exploration" where you are happy for it to read anything it wants but you never want to be prompted, you could run Codex with `--ask-for-approval never` and `--sandbox read-only`.
+Coming soon: you'll be able to whitelist specific commands to auto-execute with
+the network enabled, once we're confident in additional safeguards.
 
 ### Platform sandboxing details
 
-The mechanism Codex uses to implement the sandbox policy depends on your OS:
+The hardening mechanism Codex uses depends on your OS:
 
-- **macOS 12+** uses **Apple Seatbelt** and runs commands using `sandbox-exec` with a profile (`-p`) that corresponds to the `--sandbox` that was specified.
-- **Linux** uses a combination of Landlock/seccomp APIs to enforce the `sandbox` configuration.
+- **macOS 12+** - commands are wrapped with **Apple Seatbelt** (`sandbox-exec`).
 
-Note that when running Linux in a containerized environment such as Docker, sandboxing may not work if the host/container configuration does not support the necessary Landlock/seccomp APIs. In such cases, we recommend configuring your Docker container so that it provides the sandbox guarantees you are looking for and then running `codex` with `--sandbox danger-full-access` (or, more simply, the `--dangerously-bypass-approvals-and-sandbox` flag) within your container.
+  - Everything is placed in a read-only jail except for a small set of
+    writable roots (`$PWD`, `$TMPDIR`, `~/.codex`, etc.).
+  - Outbound network is _fully blocked_ by default - even if a child process
+    tries to `curl` somewhere it will fail.
+
+- **Linux** - there is no sandboxing by default.
+  We recommend using Docker for sandboxing, where Codex launches itself inside a **minimal
+  container image** and mounts your repo _read/write_ at the same path. A
+  custom `iptables`/`ipset` firewall script denies all egress except the
+  OpenAI API. This gives you deterministic, reproducible runs without needing
+  root on the host. You can use the [`run_in_container.sh`](./codex-cli/scripts/run_in_container.sh) script to set up the sandbox.
 
 ---
 
@@ -234,20 +205,24 @@ Note that when running Linux in a containerized environment such as Docker, sand
 | Requirement                 | Details                                                         |
 | --------------------------- | --------------------------------------------------------------- |
 | Operating systems           | macOS 12+, Ubuntu 20.04+/Debian 10+, or Windows 11 **via WSL2** |
+| Node.js                     | **22 or newer** (LTS recommended)                               |
 | Git (optional, recommended) | 2.23+ for built-in PR helpers                                   |
 | RAM                         | 4-GB minimum (8-GB recommended)                                 |
 
+> Never run `sudo npm install -g`; fix npm permissions instead.
+
 ---
 
 ## CLI reference
 
-| Command            | Purpose                            | Example                         |
-| ------------------ | ---------------------------------- | ------------------------------- |
-| `codex`            | Interactive TUI                    | `codex`                         |
-| `codex "..."`      | Initial prompt for interactive TUI | `codex "fix lint errors"`       |
-| `codex exec "..."` | Non-interactive "automation mode"  | `codex exec "explain utils.ts"` |
+| Command                              | Purpose                             | Example                              |
+| ------------------------------------ | ----------------------------------- | ------------------------------------ |
+| `codex`                              | Interactive REPL                    | `codex`                              |
+| `codex "..."`                        | Initial prompt for interactive REPL | `codex "fix lint errors"`            |
+| `codex -q "..."`                     | Non-interactive "quiet mode"        | `codex -q --json "explain utils.ts"` |
+| `codex completion <bash\|zsh\|fish>` | Print shell completion script       | `codex completion bash`              |
 
-Key flags: `--model/-m`, `--ask-for-approval/-a`.
+Key flags: `--model/-m`, `--approval-mode/-a`, `--quiet/-q`, and `--notify`.
 
 ---
 
@@ -259,6 +234,8 @@ You can give Codex extra instructions and guidance using `AGENTS.md` files. Code
 2. `AGENTS.md` at repo root - shared project notes
 3. `AGENTS.md` in the current working directory - sub-folder/feature specifics
 
+Disable loading of these files with `--no-project-doc` or the environment variable `CODEX_DISABLE_PROJECT_DOC=1`.
+
 ---
 
 ## Non-interactive / CI mode
@@ -270,37 +247,18 @@ Run Codex head-less in pipelines. Example GitHub Action step:
   run: |
     npm install -g @openai/codex
     export OPENAI_API_KEY="${{ secrets.OPENAI_KEY }}"
-    codex exec --full-auto "update CHANGELOG for next release"
+    codex -a auto-edit --quiet "update CHANGELOG for next release"
 ```
 
-## Model Context Protocol (MCP)
-
-The Codex CLI can be configured to leverage MCP servers by defining an [`mcp_servers`](./codex-rs/config.md#mcp_servers) section in `~/.codex/config.toml`. It is intended to mirror how tools such as Claude and Cursor define `mcpServers` in their respective JSON config files, though the Codex format is slightly different since it uses TOML rather than JSON, e.g.:
-
-```toml
-# IMPORTANT: the top-level key is `mcp_servers` rather than `mcpServers`.
-[mcp_servers.server-name]
-command = "npx"
-args = ["-y", "mcp-server"]
-env = { "API_KEY" = "value" }
-```
-
-> [!TIP]
-> It is somewhat experimental, but the Codex CLI can also be run as an MCP _server_ via `codex mcp`. If you launch it with an MCP client such as `npx @modelcontextprotocol/inspector codex mcp` and send it a `tools/list` request, you will see that there is only one tool, `codex`, that accepts a grab-bag of inputs, including a catch-all `config` map for anything you might want to override. Feel free to play around with it and provide feedback via GitHub issues.
+Set `CODEX_QUIET_MODE=1` to silence interactive UI noise.
 
 ## Tracing / verbose logging
 
-Because Codex is written in Rust, it honors the `RUST_LOG` environment variable to configure its logging behavior.
-
-The TUI defaults to `RUST_LOG=codex_core=info,codex_tui=info` and log messages are written to `~/.codex/log/codex-tui.log`, so you can leave the following running in a separate terminal to monitor log messages as they are written:
+Setting the environment variable `DEBUG=true` prints full API request and response details:
 
+```shell
+DEBUG=true codex
 ```
-tail -F ~/.codex/log/codex-tui.log
-```
-
-By comparison, the non-interactive mode (`codex exec`) defaults to `RUST_LOG=error`, but messages are printed inline, so there is no need to monitor a separate file.
-
-See the Rust documentation on [`RUST_LOG`](https://docs.rs/env_logger/latest/env_logger/#enabling-logging) for more information on the configuration options.
 
 ---
 
@@ -323,78 +281,201 @@ Below are a few bite-size examples you can copy-paste. Replace the text in quote
 ## Installation
 
 <details open>
-<summary><strong>Install Codex CLI using your preferred package manager.</strong></summary>
-
-From `brew` (recommended, downloads only the binary for your platform):
+<summary><strong>From npm (Recommended)</strong></summary>
 
 ```bash
-brew install codex
+npm install -g @openai/codex
+# or
+yarn global add @openai/codex
+# or
+bun install -g @openai/codex
+# or
+pnpm add -g @openai/codex
 ```
 
-From `npm` (generally more readily available, but downloads binaries for all supported platforms):
-
-```bash
-npm i -g @openai/codex
-```
-
-Or go to the [latest GitHub Release](https://github.com/openai/codex/releases/latest) and download the appropriate binary for your platform.
-
-Admittedly, each GitHub Release contains many executables, but in practice, you likely want one of these:
-
-- macOS
-  - Apple Silicon/arm64: `codex-aarch64-apple-darwin.tar.gz`
-  - x86_64 (older Mac hardware): `codex-x86_64-apple-darwin.tar.gz`
-- Linux
-  - x86_64: `codex-x86_64-unknown-linux-musl.tar.gz`
-  - arm64: `codex-aarch64-unknown-linux-musl.tar.gz`
-
-Each archive contains a single entry with the platform baked into the name (e.g., `codex-x86_64-unknown-linux-musl`), so you likely want to rename it to `codex` after extracting it.
-
-### DotSlash
-
-The GitHub Release also contains a [DotSlash](https://dotslash-cli.com/) file for the Codex CLI named `codex`. Using a DotSlash file makes it possible to make a lightweight commit to source control to ensure all contributors use the same version of an executable, regardless of what platform they use for development.
-
 </details>
 
 <details>
 <summary><strong>Build from source</strong></summary>
 
 ```bash
-# Clone the repository and navigate to the root of the Cargo workspace.
+# Clone the repository and navigate to the CLI package
 git clone https://github.com/openai/codex.git
-cd codex/codex-rs
+cd codex/codex-cli
 
-# Install the Rust toolchain, if necessary.
-curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-source "$HOME/.cargo/env"
-rustup component add rustfmt
-rustup component add clippy
+# Enable corepack
+corepack enable
 
-# Build Codex.
-cargo build
+# Install dependencies and build
+pnpm install
+pnpm build
 
-# Launch the TUI with a sample prompt.
-cargo run --bin codex -- "explain this codebase to me"
+# Linux-only: download prebuilt sandboxing binaries (requires gh and zstd).
+./scripts/install_native_deps.sh
 
-# After making changes, ensure the code is clean.
-cargo fmt -- --config imports_granularity=Item
-cargo clippy --tests
+# Get the usage and the options
+node ./dist/cli.js --help
 
-# Run the tests.
-cargo test
+# Run the locally-built CLI directly
+node ./dist/cli.js
+
+# Or link the command globally for convenience
+pnpm link
 ```
 
 </details>
 
 ---
 
-## Configuration
+## Configuration guide
 
-Codex supports a rich set of configuration options documented in [`codex-rs/config.md`](./codex-rs/config.md).
+Codex configuration files can be placed in the `~/.codex/` directory, supporting both YAML and JSON formats.
 
-By default, Codex loads its configuration from `~/.codex/config.toml`.
+### Basic configuration parameters
 
-Though `--config` can be used to set/override ad-hoc config values for individual invocations of `codex`.
+| Parameter           | Type    | Default    | Description                      | Available Options                                                                              |
+| ------------------- | ------- | ---------- | -------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `model`             | string  | `o4-mini`  | AI model to use                  | Any model name supporting OpenAI API                                                           |
+| `approvalMode`      | string  | `suggest`  | AI assistant's permission mode   | `suggest` (suggestions only)<br>`auto-edit` (automatic edits)<br>`full-auto` (fully automatic) |
+| `fullAutoErrorMode` | string  | `ask-user` | Error handling in full-auto mode | `ask-user` (prompt for user input)<br>`ignore-and-continue` (ignore and proceed)               |
+| `notify`            | boolean | `true`     | Enable desktop notifications     | `true`/`false`                                                                                 |
+
+### Custom AI provider configuration
+
+In the `providers` object, you can configure multiple AI service providers. Each provider requires the following parameters:
+
+| Parameter | Type   | Description                             | Example                       |
+| --------- | ------ | --------------------------------------- | ----------------------------- |
+| `name`    | string | Display name of the provider            | `"OpenAI"`                    |
+| `baseURL` | string | API service URL                         | `"https://api.openai.com/v1"` |
+| `envKey`  | string | Environment variable name (for API key) | `"OPENAI_API_KEY"`            |
+
+### History configuration
+
+In the `history` object, you can configure conversation history settings:
+
+| Parameter           | Type    | Description                                            | Example Value |
+| ------------------- | ------- | ------------------------------------------------------ | ------------- |
+| `maxSize`           | number  | Maximum number of history entries to save              | `1000`        |
+| `saveHistory`       | boolean | Whether to save history                                | `true`        |
+| `sensitivePatterns` | array   | Patterns of sensitive information to filter in history | `[]`          |
+
+### Configuration examples
+
+1. YAML format (save as `~/.codex/config.yaml`):
+
+```yaml
+model: o4-mini
+approvalMode: suggest
+fullAutoErrorMode: ask-user
+notify: true
+```
+
+2. JSON format (save as `~/.codex/config.json`):
+
+```json
+{
+  "model": "o4-mini",
+  "approvalMode": "suggest",
+  "fullAutoErrorMode": "ask-user",
+  "notify": true
+}
+```
+
+### Full configuration example
+
+Below is a comprehensive example of `config.json` with multiple custom providers:
+
+```json
+{
+  "model": "o4-mini",
+  "provider": "openai",
+  "providers": {
+    "openai": {
+      "name": "OpenAI",
+      "baseURL": "https://api.openai.com/v1",
+      "envKey": "OPENAI_API_KEY"
+    },
+    "azure": {
+      "name": "AzureOpenAI",
+      "baseURL": "https://YOUR_PROJECT_NAME.openai.azure.com/openai",
+      "envKey": "AZURE_OPENAI_API_KEY"
+    },
+    "openrouter": {
+      "name": "OpenRouter",
+      "baseURL": "https://openrouter.ai/api/v1",
+      "envKey": "OPENROUTER_API_KEY"
+    },
+    "gemini": {
+      "name": "Gemini",
+      "baseURL": "https://generativelanguage.googleapis.com/v1beta/openai",
+      "envKey": "GEMINI_API_KEY"
+    },
+    "ollama": {
+      "name": "Ollama",
+      "baseURL": "http://localhost:11434/v1",
+      "envKey": "OLLAMA_API_KEY"
+    },
+    "mistral": {
+      "name": "Mistral",
+      "baseURL": "https://api.mistral.ai/v1",
+      "envKey": "MISTRAL_API_KEY"
+    },
+    "deepseek": {
+      "name": "DeepSeek",
+      "baseURL": "https://api.deepseek.com",
+      "envKey": "DEEPSEEK_API_KEY"
+    },
+    "xai": {
+      "name": "xAI",
+      "baseURL": "https://api.x.ai/v1",
+      "envKey": "XAI_API_KEY"
+    },
+    "groq": {
+      "name": "Groq",
+      "baseURL": "https://api.groq.com/openai/v1",
+      "envKey": "GROQ_API_KEY"
+    },
+    "arceeai": {
+      "name": "ArceeAI",
+      "baseURL": "https://conductor.arcee.ai/v1",
+      "envKey": "ARCEEAI_API_KEY"
+    }
+  },
+  "history": {
+    "maxSize": 1000,
+    "saveHistory": true,
+    "sensitivePatterns": []
+  }
+}
+```
+
+### Custom instructions
+
+You can create a `~/.codex/AGENTS.md` file to define custom guidance for the agent:
+
+```markdown
+- Always respond with emojis
+- Only use git commands when explicitly requested
+```
+
+### Environment variables setup
+
+For each AI provider, you need to set the corresponding API key in your environment variables. For example:
+
+```bash
+# OpenAI
+export OPENAI_API_KEY="your-api-key-here"
+
+# Azure OpenAI
+export AZURE_OPENAI_API_KEY="your-azure-api-key-here"
+export AZURE_OPENAI_API_VERSION="2025-03-01-preview" (Optional)
+
+# OpenRouter
+export OPENROUTER_API_KEY="your-openrouter-key-here"
+
+# Similarly for other providers
+```
 
 ---
 
@@ -443,13 +524,7 @@ Codex CLI **does** support OpenAI organizations with [Zero Data Retention (ZDR)]
 OpenAI rejected the request. Error details: Status: 400, Code: unsupported_parameter, Type: invalid_request_error, Message: 400 Previous response cannot be used for this organization due to Zero Data Retention.
 ```
 
-Ensure you are running `codex` with `--config disable_response_storage=true` or add this line to `~/.codex/config.toml` to avoid specifying the command line option each time:
-
-```toml
-disable_response_storage = true
-```
-
-See [the configuration documentation on `disable_response_storage`](./codex-rs/config.md#disable_response_storage) for details.
+You may need to upgrade to a more recent version with: `npm i -g @openai/codex@latest`
 
 ---
 
@@ -474,7 +549,51 @@ More broadly we welcome contributions - whether you are opening your very first
 
 - Create a _topic branch_ from `main` - e.g. `feat/interactive-prompt`.
 - Keep your changes focused. Multiple unrelated fixes should be opened as separate PRs.
-- Following the [development setup](#development-workflow) instructions above, ensure your change is free of lint warnings and test failures.
+- Use `pnpm test:watch` during development for super-fast feedback.
+- We use **Vitest** for unit tests, **ESLint** + **Prettier** for style, and **TypeScript** for type-checking.
+- Before pushing, run the full test/type/lint suite:
+
+### Git hooks with Husky
+
+This project uses [Husky](https://typicode.github.io/husky/) to enforce code quality checks:
+
+- **Pre-commit hook**: Automatically runs lint-staged to format and lint files before committing
+- **Pre-push hook**: Runs tests and type checking before pushing to the remote
+
+These hooks help maintain code quality and prevent pushing code with failing tests. For more details, see [HUSKY.md](./codex-cli/HUSKY.md).
+
+```bash
+pnpm test && pnpm run lint && pnpm run typecheck
+```
+
+- If you have **not** yet signed the Contributor License Agreement (CLA), add a PR comment containing the exact text
+
+  ```text
+  I have read the CLA Document and I hereby sign the CLA
+  ```
+
+  The CLA-Assistant bot will turn the PR status green once all authors have signed.
+
+```bash
+# Watch mode (tests rerun on change)
+pnpm test:watch
+
+# Type-check without emitting files
+pnpm typecheck
+
+# Automatically fix lint + prettier issues
+pnpm lint:fix
+pnpm format:fix
+```
+
+### Debugging
+
+To debug the CLI with a visual debugger, do the following in the `codex-cli` folder:
+
+- Run `pnpm run build` to build the CLI, which will generate `cli.js.map` alongside `cli.js` in the `dist` folder.
+- Run the CLI with `node --inspect-brk ./dist/cli.js` The program then waits until a debugger is attached before proceeding. Options:
+  - In VS Code, choose **Debug: Attach to Node Process** from the command palette and choose the option in the dropdown with debug port `9229` (likely the first option)
+  - Go to <chrome://inspect> in Chrome and find **localhost:9229** and click **trace**
 
 ### Writing high-impact code changes
 
@@ -486,7 +605,7 @@ More broadly we welcome contributions - whether you are opening your very first
 ### Opening a pull request
 
 - Fill in the PR template (or include similar information) - **What? Why? How?**
-- Run **all** checks locally (`cargo test && cargo clippy --tests && cargo fmt -- --config imports_granularity=Item`). CI failures that could have been caught locally slow down the process.
+- Run **all** checks locally (`npm test && npm run lint && npm run typecheck`). CI failures that could have been caught locally slow down the process.
 - Make sure your branch is up-to-date with `main` and that you have resolved merge conflicts.
 - Mark the PR as **Ready for review** only when you believe it is in a merge-able state.
 
@@ -533,22 +652,73 @@ The **DCO check** blocks merges until every commit in the PR carries the footer
 
 ### Releasing `codex`
 
-_For admins only._
+To publish a new version of the CLI you first need to stage the npm package. A
+helper script in `codex-cli/scripts/` does all the heavy lifting. Inside the
+`codex-cli` folder run:
 
-Make sure you are on `main` and have no local changes. Then run:
+```bash
+# Classic, JS implementation that includes small, native binaries for Linux sandboxing.
+pnpm stage-release
 
-```shell
-VERSION=0.2.0  # Can also be 0.2.0-alpha.1 or any valid Rust version.
-./codex-rs/scripts/create_github_release.sh "$VERSION"
+# Optionally specify the temp directory to reuse between runs.
+RELEASE_DIR=$(mktemp -d)
+pnpm stage-release --tmp "$RELEASE_DIR"
+
+# "Fat" package that additionally bundles the native Rust CLI binaries for
+# Linux. End-users can then opt-in at runtime by setting CODEX_RUST=1.
+pnpm stage-release --native
 ```
 
-This will make a local commit on top of `main` with `version` set to `$VERSION` in `codex-rs/Cargo.toml` (note that on `main`, we leave the version as `version = "0.0.0"`).
+Go to the folder where the release is staged and verify that it works as intended. If so, run the following from the temp folder:
 
-This will push the commit using the tag `rust-v${VERSION}`, which in turn kicks off [the release workflow](.github/workflows/rust-release.yml). This will create a new GitHub Release named `$VERSION`.
+```
+cd "$RELEASE_DIR"
+npm publish
+```
 
-If everything looks good in the generated GitHub Release, uncheck the **pre-release** box so it is the latest release.
+### Alternative build options
 
-Create a PR to update [`Formula/c/codex.rb`](https://github.com/Homebrew/homebrew-core/blob/main/Formula/c/codex.rb) on Homebrew.
+#### Nix flake development
+
+Prerequisite: Nix >= 2.4 with flakes enabled (`experimental-features = nix-command flakes` in `~/.config/nix/nix.conf`).
+
+Enter a Nix development shell:
+
+```bash
+# Use either one of the commands according to which implementation you want to work with
+nix develop .#codex-cli # For entering codex-cli specific shell
+nix develop .#codex-rs # For entering codex-rs specific shell
+```
+
+This shell includes Node.js, installs dependencies, builds the CLI, and provides a `codex` command alias.
+
+Build and run the CLI directly:
+
+```bash
+# Use either one of the commands according to which implementation you want to work with
+nix build .#codex-cli # For building codex-cli
+nix build .#codex-rs # For building codex-rs
+./result/bin/codex --help
+```
+
+Run the CLI via the flake app:
+
+```bash
+# Use either one of the commands according to which implementation you want to work with
+nix run .#codex-cli # For running codex-cli
+nix run .#codex-rs # For running codex-rs
+```
+
+Use direnv with flakes
+
+If you have direnv installed, you can use the following `.envrc` to automatically enter the Nix shell when you `cd` into the project directory:
+
+```bash
+cd codex-rs
+echo "use flake ../flake.nix#codex-cli" >> .envrc && direnv allow
+cd codex-cli
+echo "use flake ../flake.nix#codex-rs" >> .envrc && direnv allow
+```
 
 ---
 

codex-cli/.gitignore

@@ -1,7 +1,3 @@
 # Added by ./scripts/install_native_deps.sh
-/bin/codex-aarch64-apple-darwin
-/bin/codex-aarch64-unknown-linux-musl
 /bin/codex-linux-sandbox-arm64
 /bin/codex-linux-sandbox-x64
-/bin/codex-x86_64-apple-darwin
-/bin/codex-x86_64-unknown-linux-musl

codex-cli/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-slim
+FROM node:20-slim
 
 ARG TZ
 ENV TZ="$TZ"

codex-cli/README.md

@@ -1,736 +0,0 @@
-<h1 align="center">OpenAI Codex CLI</h1>
-<p align="center">Lightweight coding agent that runs in your terminal</p>
-
-<p align="center"><code>npm i -g @openai/codex</code></p>
-
-> [!IMPORTANT]
-> This is the documentation for the _legacy_ TypeScript implementation of the Codex CLI. It has been superseded by the _Rust_ implementation. See the [README in the root of the Codex repository](https://github.com/openai/codex/blob/main/README.md) for details.
-
-![Codex demo GIF using: codex "explain this codebase to me"](../.github/demo.gif)
-
----
-
-<details>
-<summary><strong>Table of contents</strong></summary>
-
-<!-- Begin ToC -->
-
-- [Experimental technology disclaimer](#experimental-technology-disclaimer)
-- [Quickstart](#quickstart)
-- [Why Codex?](#why-codex)
-- [Security model & permissions](#security-model--permissions)
-  - [Platform sandboxing details](#platform-sandboxing-details)
-- [System requirements](#system-requirements)
-- [CLI reference](#cli-reference)
-- [Memory & project docs](#memory--project-docs)
-- [Non-interactive / CI mode](#non-interactive--ci-mode)
-- [Tracing / verbose logging](#tracing--verbose-logging)
-- [Recipes](#recipes)
-- [Installation](#installation)
-- [Configuration guide](#configuration-guide)
-  - [Basic configuration parameters](#basic-configuration-parameters)
-  - [Custom AI provider configuration](#custom-ai-provider-configuration)
-  - [History configuration](#history-configuration)
-  - [Configuration examples](#configuration-examples)
-  - [Full configuration example](#full-configuration-example)
-  - [Custom instructions](#custom-instructions)
-  - [Environment variables setup](#environment-variables-setup)
-- [FAQ](#faq)
-- [Zero data retention (ZDR) usage](#zero-data-retention-zdr-usage)
-- [Codex open source fund](#codex-open-source-fund)
-- [Contributing](#contributing)
-  - [Development workflow](#development-workflow)
-  - [Git hooks with Husky](#git-hooks-with-husky)
-  - [Debugging](#debugging)
-  - [Writing high-impact code changes](#writing-high-impact-code-changes)
-  - [Opening a pull request](#opening-a-pull-request)
-  - [Review process](#review-process)
-  - [Community values](#community-values)
-  - [Getting help](#getting-help)
-  - [Contributor license agreement (CLA)](#contributor-license-agreement-cla)
-    - [Quick fixes](#quick-fixes)
-  - [Releasing `codex`](#releasing-codex)
-  - [Alternative build options](#alternative-build-options)
-    - [Nix flake development](#nix-flake-development)
-- [Security & responsible AI](#security--responsible-ai)
-- [License](#license)
-
-<!-- End ToC -->
-
-</details>
-
----
-
-## Experimental technology disclaimer
-
-Codex CLI is an experimental project under active development. It is not yet stable, may contain bugs, incomplete features, or undergo breaking changes. We're building it in the open with the community and welcome:
-
-- Bug reports
-- Feature requests
-- Pull requests
-- Good vibes
-
-Help us improve by filing issues or submitting PRs (see the section below for how to contribute)!
-
-## Quickstart
-
-Install globally:
-
-```shell
-npm install -g @openai/codex
-```
-
-Next, set your OpenAI API key as an environment variable:
-
-```shell
-export OPENAI_API_KEY="your-api-key-here"
-```
-
-> **Note:** This command sets the key only for your current terminal session. You can add the `export` line to your shell's configuration file (e.g., `~/.zshrc`) but we recommend setting for the session. **Tip:** You can also place your API key into a `.env` file at the root of your project:
->
-> ```env
-> OPENAI_API_KEY=your-api-key-here
-> ```
->
-> The CLI will automatically load variables from `.env` (via `dotenv/config`).
-
-<details>
-<summary><strong>Use <code>--provider</code> to use other models</strong></summary>
-
-> Codex also allows you to use other providers that support the OpenAI Chat Completions API. You can set the provider in the config file or use the `--provider` flag. The possible options for `--provider` are:
->
-> - openai (default)
-> - openrouter
-> - azure
-> - gemini
-> - ollama
-> - mistral
-> - deepseek
-> - xai
-> - groq
-> - arceeai
-> - any other provider that is compatible with the OpenAI API
->
-> If you use a provider other than OpenAI, you will need to set the API key for the provider in the config file or in the environment variable as:
->
-> ```shell
-> export <provider>_API_KEY="your-api-key-here"
-> ```
->
-> If you use a provider not listed above, you must also set the base URL for the provider:
->
-> ```shell
-> export <provider>_BASE_URL="https://your-provider-api-base-url"
-> ```
-
-</details>
-<br />
-
-Run interactively:
-
-```shell
-codex
-```
-
-Or, run with a prompt as input (and optionally in `Full Auto` mode):
-
-```shell
-codex "explain this codebase to me"
-```
-
-```shell
-codex --approval-mode full-auto "create the fanciest todo-list app"
-```
-
-That's it - Codex will scaffold a file, run it inside a sandbox, install any
-missing dependencies, and show you the live result. Approve the changes and
-they'll be committed to your working directory.
-
----
-
-## Why Codex?
-
-Codex CLI is built for developers who already **live in the terminal** and want
-ChatGPT-level reasoning **plus** the power to actually run code, manipulate
-files, and iterate - all under version control. In short, it's _chat-driven
-development_ that understands and executes your repo.
-
-- **Zero setup** - bring your OpenAI API key and it just works!
-- **Full auto-approval, while safe + secure** by running network-disabled and directory-sandboxed
-- **Multimodal** - pass in screenshots or diagrams to implement features ✨
-
-And it's **fully open-source** so you can see and contribute to how it develops!
-
----
-
-## Security model & permissions
-
-Codex lets you decide _how much autonomy_ the agent receives and auto-approval policy via the
-`--approval-mode` flag (or the interactive onboarding prompt):
-
-| Mode                      | What the agent may do without asking                                                                | Still requires approval                                                                         |
-| ------------------------- | --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
-| **Suggest** <br>(default) | <li>Read any file in the repo                                                                       | <li>**All** file writes/patches<li> **Any** arbitrary shell commands (aside from reading files) |
-| **Auto Edit**             | <li>Read **and** apply-patch writes to files                                                        | <li>**All** shell commands                                                                      |
-| **Full Auto**             | <li>Read/write files <li> Execute shell commands (network disabled, writes limited to your workdir) | -                                                                                               |
-
-In **Full Auto** every command is run **network-disabled** and confined to the
-current working directory (plus temporary files) for defense-in-depth. Codex
-will also show a warning/confirmation if you start in **auto-edit** or
-**full-auto** while the directory is _not_ tracked by Git, so you always have a
-safety net.
-
-Coming soon: you'll be able to whitelist specific commands to auto-execute with
-the network enabled, once we're confident in additional safeguards.
-
-### Platform sandboxing details
-
-The hardening mechanism Codex uses depends on your OS:
-
-- **macOS 12+** - commands are wrapped with **Apple Seatbelt** (`sandbox-exec`).
-
-  - Everything is placed in a read-only jail except for a small set of
-    writable roots (`$PWD`, `$TMPDIR`, `~/.codex`, etc.).
-  - Outbound network is _fully blocked_ by default - even if a child process
-    tries to `curl` somewhere it will fail.
-
-- **Linux** - there is no sandboxing by default.
-  We recommend using Docker for sandboxing, where Codex launches itself inside a **minimal
-  container image** and mounts your repo _read/write_ at the same path. A
-  custom `iptables`/`ipset` firewall script denies all egress except the
-  OpenAI API. This gives you deterministic, reproducible runs without needing
-  root on the host. You can use the [`run_in_container.sh`](../codex-cli/scripts/run_in_container.sh) script to set up the sandbox.
-
----
-
-## System requirements
-
-| Requirement                 | Details                                                         |
-| --------------------------- | --------------------------------------------------------------- |
-| Operating systems           | macOS 12+, Ubuntu 20.04+/Debian 10+, or Windows 11 **via WSL2** |
-| Node.js                     | **22 or newer** (LTS recommended)                               |
-| Git (optional, recommended) | 2.23+ for built-in PR helpers                                   |
-| RAM                         | 4-GB minimum (8-GB recommended)                                 |
-
-> Never run `sudo npm install -g`; fix npm permissions instead.
-
----
-
-## CLI reference
-
-| Command                              | Purpose                             | Example                              |
-| ------------------------------------ | ----------------------------------- | ------------------------------------ |
-| `codex`                              | Interactive REPL                    | `codex`                              |
-| `codex "..."`                        | Initial prompt for interactive REPL | `codex "fix lint errors"`            |
-| `codex -q "..."`                     | Non-interactive "quiet mode"        | `codex -q --json "explain utils.ts"` |
-| `codex completion <bash\|zsh\|fish>` | Print shell completion script       | `codex completion bash`              |
-
-Key flags: `--model/-m`, `--approval-mode/-a`, `--quiet/-q`, and `--notify`.
-
----
-
-## Memory & project docs
-
-You can give Codex extra instructions and guidance using `AGENTS.md` files. Codex looks for `AGENTS.md` files in the following places, and merges them top-down:
-
-1. `~/.codex/AGENTS.md` - personal global guidance
-2. `AGENTS.md` at repo root - shared project notes
-3. `AGENTS.md` in the current working directory - sub-folder/feature specifics
-
-Disable loading of these files with `--no-project-doc` or the environment variable `CODEX_DISABLE_PROJECT_DOC=1`.
-
----
-
-## Non-interactive / CI mode
-
-Run Codex head-less in pipelines. Example GitHub Action step:
-
-```yaml
-- name: Update changelog via Codex
-  run: |
-    npm install -g @openai/codex
-    export OPENAI_API_KEY="${{ secrets.OPENAI_KEY }}"
-    codex -a auto-edit --quiet "update CHANGELOG for next release"
-```
-
-Set `CODEX_QUIET_MODE=1` to silence interactive UI noise.
-
-## Tracing / verbose logging
-
-Setting the environment variable `DEBUG=true` prints full API request and response details:
-
-```shell
-DEBUG=true codex
-```
-
----
-
-## Recipes
-
-Below are a few bite-size examples you can copy-paste. Replace the text in quotes with your own task. See the [prompting guide](https://github.com/openai/codex/blob/main/codex-cli/examples/prompting_guide.md) for more tips and usage patterns.
-
-| ✨  | What you type                                                                   | What happens                                                               |
-| --- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
-| 1   | `codex "Refactor the Dashboard component to React Hooks"`                       | Codex rewrites the class component, runs `npm test`, and shows the diff.   |
-| 2   | `codex "Generate SQL migrations for adding a users table"`                      | Infers your ORM, creates migration files, and runs them in a sandboxed DB. |
-| 3   | `codex "Write unit tests for utils/date.ts"`                                    | Generates tests, executes them, and iterates until they pass.              |
-| 4   | `codex "Bulk-rename *.jpeg -> *.jpg with git mv"`                               | Safely renames files and updates imports/usages.                           |
-| 5   | `codex "Explain what this regex does: ^(?=.*[A-Z]).{8,}$"`                      | Outputs a step-by-step human explanation.                                  |
-| 6   | `codex "Carefully review this repo, and propose 3 high impact well-scoped PRs"` | Suggests impactful PRs in the current codebase.                            |
-| 7   | `codex "Look for vulnerabilities and create a security review report"`          | Finds and explains security bugs.                                          |
-
----
-
-## Installation
-
-<details open>
-<summary><strong>From npm (Recommended)</strong></summary>
-
-```bash
-npm install -g @openai/codex
-# or
-yarn global add @openai/codex
-# or
-bun install -g @openai/codex
-# or
-pnpm add -g @openai/codex
-```
-
-</details>
-
-<details>
-<summary><strong>Build from source</strong></summary>
-
-```bash
-# Clone the repository and navigate to the CLI package
-git clone https://github.com/openai/codex.git
-cd codex/codex-cli
-
-# Enable corepack
-corepack enable
-
-# Install dependencies and build
-pnpm install
-pnpm build
-
-# Linux-only: download prebuilt sandboxing binaries (requires gh and zstd).
-./scripts/install_native_deps.sh
-
-# Get the usage and the options
-node ./dist/cli.js --help
-
-# Run the locally-built CLI directly
-node ./dist/cli.js
-
-# Or link the command globally for convenience
-pnpm link
-```
-
-</details>
-
----
-
-## Configuration guide
-
-Codex configuration files can be placed in the `~/.codex/` directory, supporting both YAML and JSON formats.
-
-### Basic configuration parameters
-
-| Parameter           | Type    | Default    | Description                      | Available Options                                                                              |
-| ------------------- | ------- | ---------- | -------------------------------- | ---------------------------------------------------------------------------------------------- |
-| `model`             | string  | `o4-mini`  | AI model to use                  | Any model name supporting OpenAI API                                                           |
-| `approvalMode`      | string  | `suggest`  | AI assistant's permission mode   | `suggest` (suggestions only)<br>`auto-edit` (automatic edits)<br>`full-auto` (fully automatic) |
-| `fullAutoErrorMode` | string  | `ask-user` | Error handling in full-auto mode | `ask-user` (prompt for user input)<br>`ignore-and-continue` (ignore and proceed)               |
-| `notify`            | boolean | `true`     | Enable desktop notifications     | `true`/`false`                                                                                 |
-
-### Custom AI provider configuration
-
-In the `providers` object, you can configure multiple AI service providers. Each provider requires the following parameters:
-
-| Parameter | Type   | Description                             | Example                       |
-| --------- | ------ | --------------------------------------- | ----------------------------- |
-| `name`    | string | Display name of the provider            | `"OpenAI"`                    |
-| `baseURL` | string | API service URL                         | `"https://api.openai.com/v1"` |
-| `envKey`  | string | Environment variable name (for API key) | `"OPENAI_API_KEY"`            |
-
-### History configuration
-
-In the `history` object, you can configure conversation history settings:
-
-| Parameter           | Type    | Description                                            | Example Value |
-| ------------------- | ------- | ------------------------------------------------------ | ------------- |
-| `maxSize`           | number  | Maximum number of history entries to save              | `1000`        |
-| `saveHistory`       | boolean | Whether to save history                                | `true`        |
-| `sensitivePatterns` | array   | Patterns of sensitive information to filter in history | `[]`          |
-
-### Configuration examples
-
-1. YAML format (save as `~/.codex/config.yaml`):
-
-```yaml
-model: o4-mini
-approvalMode: suggest
-fullAutoErrorMode: ask-user
-notify: true
-```
-
-2. JSON format (save as `~/.codex/config.json`):
-
-```json
-{
-  "model": "o4-mini",
-  "approvalMode": "suggest",
-  "fullAutoErrorMode": "ask-user",
-  "notify": true
-}
-```
-
-### Full configuration example
-
-Below is a comprehensive example of `config.json` with multiple custom providers:
-
-```json
-{
-  "model": "o4-mini",
-  "provider": "openai",
-  "providers": {
-    "openai": {
-      "name": "OpenAI",
-      "baseURL": "https://api.openai.com/v1",
-      "envKey": "OPENAI_API_KEY"
-    },
-    "azure": {
-      "name": "AzureOpenAI",
-      "baseURL": "https://YOUR_PROJECT_NAME.openai.azure.com/openai",
-      "envKey": "AZURE_OPENAI_API_KEY"
-    },
-    "openrouter": {
-      "name": "OpenRouter",
-      "baseURL": "https://openrouter.ai/api/v1",
-      "envKey": "OPENROUTER_API_KEY"
-    },
-    "gemini": {
-      "name": "Gemini",
-      "baseURL": "https://generativelanguage.googleapis.com/v1beta/openai",
-      "envKey": "GEMINI_API_KEY"
-    },
-    "ollama": {
-      "name": "Ollama",
-      "baseURL": "http://localhost:11434/v1",
-      "envKey": "OLLAMA_API_KEY"
-    },
-    "mistral": {
-      "name": "Mistral",
-      "baseURL": "https://api.mistral.ai/v1",
-      "envKey": "MISTRAL_API_KEY"
-    },
-    "deepseek": {
-      "name": "DeepSeek",
-      "baseURL": "https://api.deepseek.com",
-      "envKey": "DEEPSEEK_API_KEY"
-    },
-    "xai": {
-      "name": "xAI",
-      "baseURL": "https://api.x.ai/v1",
-      "envKey": "XAI_API_KEY"
-    },
-    "groq": {
-      "name": "Groq",
-      "baseURL": "https://api.groq.com/openai/v1",
-      "envKey": "GROQ_API_KEY"
-    },
-    "arceeai": {
-      "name": "ArceeAI",
-      "baseURL": "https://conductor.arcee.ai/v1",
-      "envKey": "ARCEEAI_API_KEY"
-    }
-  },
-  "history": {
-    "maxSize": 1000,
-    "saveHistory": true,
-    "sensitivePatterns": []
-  }
-}
-```
-
-### Custom instructions
-
-You can create a `~/.codex/AGENTS.md` file to define custom guidance for the agent:
-
-```markdown
-- Always respond with emojis
-- Only use git commands when explicitly requested
-```
-
-### Environment variables setup
-
-For each AI provider, you need to set the corresponding API key in your environment variables. For example:
-
-```bash
-# OpenAI
-export OPENAI_API_KEY="your-api-key-here"
-
-# Azure OpenAI
-export AZURE_OPENAI_API_KEY="your-azure-api-key-here"
-export AZURE_OPENAI_API_VERSION="2025-04-01-preview" (Optional)
-
-# OpenRouter
-export OPENROUTER_API_KEY="your-openrouter-key-here"
-
-# Similarly for other providers
-```
-
----
-
-## FAQ
-
-<details>
-<summary>OpenAI released a model called Codex in 2021 - is this related?</summary>
-
-In 2021, OpenAI released Codex, an AI system designed to generate code from natural language prompts. That original Codex model was deprecated as of March 2023 and is separate from the CLI tool.
-
-</details>
-
-<details>
-<summary>Which models are supported?</summary>
-
-Any model available with [Responses API](https://platform.openai.com/docs/api-reference/responses). The default is `o4-mini`, but pass `--model gpt-4.1` or set `model: gpt-4.1` in your config file to override.
-
-</details>
-<details>
-<summary>Why does <code>o3</code> or <code>o4-mini</code> not work for me?</summary>
-
-It's possible that your [API account needs to be verified](https://help.openai.com/en/articles/10910291-api-organization-verification) in order to start streaming responses and seeing chain of thought summaries from the API. If you're still running into issues, please let us know!
-
-</details>
-
-<details>
-<summary>How do I stop Codex from editing my files?</summary>
-
-Codex runs model-generated commands in a sandbox. If a proposed command or file change doesn't look right, you can simply type **n** to deny the command or give the model feedback.
-
-</details>
-<details>
-<summary>Does it work on Windows?</summary>
-
-Not directly. It requires [Windows Subsystem for Linux (WSL2)](https://learn.microsoft.com/en-us/windows/wsl/install) - Codex has been tested on macOS and Linux with Node 22.
-
-</details>
-
----
-
-## Zero data retention (ZDR) usage
-
-Codex CLI **does** support OpenAI organizations with [Zero Data Retention (ZDR)](https://platform.openai.com/docs/guides/your-data#zero-data-retention) enabled. If your OpenAI organization has Zero Data Retention enabled and you still encounter errors such as:
-
-```
-OpenAI rejected the request. Error details: Status: 400, Code: unsupported_parameter, Type: invalid_request_error, Message: 400 Previous response cannot be used for this organization due to Zero Data Retention.
-```
-
-You may need to upgrade to a more recent version with: `npm i -g @openai/codex@latest`
-
----
-
-## Codex open source fund
-
-We're excited to launch a **$1 million initiative** supporting open source projects that use Codex CLI and other OpenAI models.
-
-- Grants are awarded up to **$25,000** API credits.
-- Applications are reviewed **on a rolling basis**.
-
-**Interested? [Apply here](https://openai.com/form/codex-open-source-fund/).**
-
----
-
-## Contributing
-
-This project is under active development and the code will likely change pretty significantly. We'll update this message once that's complete!
-
-More broadly we welcome contributions - whether you are opening your very first pull request or you're a seasoned maintainer. At the same time we care about reliability and long-term maintainability, so the bar for merging code is intentionally **high**. The guidelines below spell out what "high-quality" means in practice and should make the whole process transparent and friendly.
-
-### Development workflow
-
-- Create a _topic branch_ from `main` - e.g. `feat/interactive-prompt`.
-- Keep your changes focused. Multiple unrelated fixes should be opened as separate PRs.
-- Use `pnpm test:watch` during development for super-fast feedback.
-- We use **Vitest** for unit tests, **ESLint** + **Prettier** for style, and **TypeScript** for type-checking.
-- Before pushing, run the full test/type/lint suite:
-
-### Git hooks with Husky
-
-This project uses [Husky](https://typicode.github.io/husky/) to enforce code quality checks:
-
-- **Pre-commit hook**: Automatically runs lint-staged to format and lint files before committing
-- **Pre-push hook**: Runs tests and type checking before pushing to the remote
-
-These hooks help maintain code quality and prevent pushing code with failing tests. For more details, see [HUSKY.md](./HUSKY.md).
-
-```bash
-pnpm test && pnpm run lint && pnpm run typecheck
-```
-
-- If you have **not** yet signed the Contributor License Agreement (CLA), add a PR comment containing the exact text
-
-  ```text
-  I have read the CLA Document and I hereby sign the CLA
-  ```
-
-  The CLA-Assistant bot will turn the PR status green once all authors have signed.
-
-```bash
-# Watch mode (tests rerun on change)
-pnpm test:watch
-
-# Type-check without emitting files
-pnpm typecheck
-
-# Automatically fix lint + prettier issues
-pnpm lint:fix
-pnpm format:fix
-```
-
-### Debugging
-
-To debug the CLI with a visual debugger, do the following in the `codex-cli` folder:
-
-- Run `pnpm run build` to build the CLI, which will generate `cli.js.map` alongside `cli.js` in the `dist` folder.
-- Run the CLI with `node --inspect-brk ./dist/cli.js` The program then waits until a debugger is attached before proceeding. Options:
-  - In VS Code, choose **Debug: Attach to Node Process** from the command palette and choose the option in the dropdown with debug port `9229` (likely the first option)
-  - Go to <chrome://inspect> in Chrome and find **localhost:9229** and click **trace**
-
-### Writing high-impact code changes
-
-1. **Start with an issue.** Open a new one or comment on an existing discussion so we can agree on the solution before code is written.
-2. **Add or update tests.** Every new feature or bug-fix should come with test coverage that fails before your change and passes afterwards. 100% coverage is not required, but aim for meaningful assertions.
-3. **Document behaviour.** If your change affects user-facing behaviour, update the README, inline help (`codex --help`), or relevant example projects.
-4. **Keep commits atomic.** Each commit should compile and the tests should pass. This makes reviews and potential rollbacks easier.
-
-### Opening a pull request
-
-- Fill in the PR template (or include similar information) - **What? Why? How?**
-- Run **all** checks locally (`npm test && npm run lint && npm run typecheck`). CI failures that could have been caught locally slow down the process.
-- Make sure your branch is up-to-date with `main` and that you have resolved merge conflicts.
-- Mark the PR as **Ready for review** only when you believe it is in a merge-able state.
-
-### Review process
-
-1. One maintainer will be assigned as a primary reviewer.
-2. We may ask for changes - please do not take this personally. We value the work, we just also value consistency and long-term maintainability.
-3. When there is consensus that the PR meets the bar, a maintainer will squash-and-merge.
-
-### Community values
-
-- **Be kind and inclusive.** Treat others with respect; we follow the [Contributor Covenant](https://www.contributor-covenant.org/).
-- **Assume good intent.** Written communication is hard - err on the side of generosity.
-- **Teach & learn.** If you spot something confusing, open an issue or PR with improvements.
-
-### Getting help
-
-If you run into problems setting up the project, would like feedback on an idea, or just want to say _hi_ - please open a Discussion or jump into the relevant issue. We are happy to help.
-
-Together we can make Codex CLI an incredible tool. **Happy hacking!** :rocket:
-
-### Contributor license agreement (CLA)
-
-All contributors **must** accept the CLA. The process is lightweight:
-
-1. Open your pull request.
-2. Paste the following comment (or reply `recheck` if you've signed before):
-
-   ```text
-   I have read the CLA Document and I hereby sign the CLA
-   ```
-
-3. The CLA-Assistant bot records your signature in the repo and marks the status check as passed.
-
-No special Git commands, email attachments, or commit footers required.
-
-#### Quick fixes
-
-| Scenario          | Command                                          |
-| ----------------- | ------------------------------------------------ |
-| Amend last commit | `git commit --amend -s --no-edit && git push -f` |
-
-The **DCO check** blocks merges until every commit in the PR carries the footer (with squash this is just the one).
-
-### Releasing `codex`
-
-To publish a new version of the CLI you first need to stage the npm package. A
-helper script in `codex-cli/scripts/` does all the heavy lifting. Inside the
-`codex-cli` folder run:
-
-```bash
-# Classic, JS implementation that includes small, native binaries for Linux sandboxing.
-pnpm stage-release
-
-# Optionally specify the temp directory to reuse between runs.
-RELEASE_DIR=$(mktemp -d)
-pnpm stage-release --tmp "$RELEASE_DIR"
-
-# "Fat" package that additionally bundles the native Rust CLI binaries for
-# Linux. End-users can then opt-in at runtime by setting CODEX_RUST=1.
-pnpm stage-release --native
-```
-
-Go to the folder where the release is staged and verify that it works as intended. If so, run the following from the temp folder:
-
-```
-cd "$RELEASE_DIR"
-npm publish
-```
-
-### Alternative build options
-
-#### Nix flake development
-
-Prerequisite: Nix >= 2.4 with flakes enabled (`experimental-features = nix-command flakes` in `~/.config/nix/nix.conf`).
-
-Enter a Nix development shell:
-
-```bash
-# Use either one of the commands according to which implementation you want to work with
-nix develop .#codex-cli # For entering codex-cli specific shell
-nix develop .#codex-rs # For entering codex-rs specific shell
-```
-
-This shell includes Node.js, installs dependencies, builds the CLI, and provides a `codex` command alias.
-
-Build and run the CLI directly:
-
-```bash
-# Use either one of the commands according to which implementation you want to work with
-nix build .#codex-cli # For building codex-cli
-nix build .#codex-rs # For building codex-rs
-./result/bin/codex --help
-```
-
-Run the CLI via the flake app:
-
-```bash
-# Use either one of the commands according to which implementation you want to work with
-nix run .#codex-cli # For running codex-cli
-nix run .#codex-rs # For running codex-rs
-```
-
-Use direnv with flakes
-
-If you have direnv installed, you can use the following `.envrc` to automatically enter the Nix shell when you `cd` into the project directory:
-
-```bash
-cd codex-rs
-echo "use flake ../flake.nix#codex-cli" >> .envrc && direnv allow
-cd codex-cli
-echo "use flake ../flake.nix#codex-rs" >> .envrc && direnv allow
-```
-
----
-
-## Security & responsible AI
-
-Have you discovered a vulnerability or have concerns about model output? Please e-mail **security@openai.com** and we will respond promptly.
-
----
-
-## License
-
-This repository is licensed under the [Apache-2.0 License](LICENSE).

codex-cli/bin/codex.js

@@ -41,7 +41,6 @@ if (wantsNative) {
   let targetTriple = null;
   switch (platform) {
     case "linux":
-    case "android":
       switch (arch) {
         case "x64":
           targetTriple = "x86_64-unknown-linux-musl";

codex-cli/package.json

@@ -84,6 +84,6 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/openai/codex.git"
+    "url": "https://github.com/openai/codex"
   }
 }

codex-cli/scripts/README.md

@@ -1,9 +0,0 @@
-# npm releases
-
-Run the following:
-
-To build the 0.2.x or later version of the npm module, which runs the Rust version of the CLI, build it as follows:
-
-```bash
-./codex-cli/scripts/stage_rust_release.py --release-version 0.6.0
-```

codex-cli/scripts/install_native_deps.sh

@@ -8,7 +8,7 @@
 # the native implementation when users set CODEX_RUST=1.
 #
 # Usage
-#   install_native_deps.sh [--full-native] [--workflow-url URL] [CODEX_CLI_ROOT]
+#   install_native_deps.sh [RELEASE_ROOT] [--full-native]
 #
 # The optional RELEASE_ROOT is the path that contains package.json.  Omitting
 # it installs the binaries into the repository's own bin/ folder to support
@@ -20,43 +20,32 @@ set -euo pipefail
 # Parse arguments
 # ------------------
 
-CODEX_CLI_ROOT=""
+DEST_DIR=""
 INCLUDE_RUST=0
 
-# Until we start publishing stable GitHub releases, we have to grab the binaries
-# from the GitHub Action that created them. Update the URL below to point to the
-# appropriate workflow run:
-WORKFLOW_URL="https://github.com/openai/codex/actions/runs/15981617627"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
+for arg in "$@"; do
+  case "$arg" in
     --full-native)
       INCLUDE_RUST=1
       ;;
-    --workflow-url)
-      shift || { echo "--workflow-url requires an argument"; exit 1; }
-      if [ -n "$1" ]; then
-        WORKFLOW_URL="$1"
-      fi
-      ;;
     *)
-      if [[ -z "$CODEX_CLI_ROOT" ]]; then
-        CODEX_CLI_ROOT="$1"
+      if [[ -z "$DEST_DIR" ]]; then
+        DEST_DIR="$arg"
       else
-        echo "Unexpected argument: $1" >&2
+        echo "Unexpected argument: $arg" >&2
         exit 1
       fi
       ;;
   esac
-  shift
 done
 
 # ----------------------------------------------------------------------------
 # Determine where the binaries should be installed.
 # ----------------------------------------------------------------------------
 
-if [ -n "$CODEX_CLI_ROOT" ]; then
+if [[ $# -gt 0 ]]; then
   # The caller supplied a release root directory.
+  CODEX_CLI_ROOT="$1"
   BIN_DIR="$CODEX_CLI_ROOT/bin"
 else
   # No argument; fall back to the repo’s own bin directory.
@@ -73,6 +62,10 @@ mkdir -p "$BIN_DIR"
 # Download and decompress the artifacts from the GitHub Actions workflow.
 # ----------------------------------------------------------------------------
 
+# Until we start publishing stable GitHub releases, we have to grab the binaries
+# from the GitHub Action that created them. Update the URL below to point to the
+# appropriate workflow run:
+WORKFLOW_URL="https://github.com/openai/codex/actions/runs/15483730027"
 WORKFLOW_ID="${WORKFLOW_URL##*/}"
 
 ARTIFACTS_DIR="$(mktemp -d)"

codex-cli/scripts/stage_release.sh

@@ -4,7 +4,10 @@
 # -----------------------------------------------------------------------------
 # Stages an npm release for @openai/codex.
 #
-# Usage:
+# The script used to accept a single optional positional argument that indicated
+# the temporary directory in which to stage the package.  We now support a
+# flag-based interface so that we can extend the command with further options
+# without breaking the call-site contract.
 #
 #   --tmp <dir>  : Use <dir> instead of a freshly created temp directory.
 #   --native     : Bundle the pre-built Rust CLI binaries for Linux alongside
@@ -27,12 +30,11 @@ set -euo pipefail
 
 usage() {
   cat <<EOF
-Usage: $(basename "$0") [--tmp DIR] [--native] [--version VERSION]
+Usage: $(basename "$0") [--tmp DIR] [--native]
 
 Options
   --tmp DIR   Use DIR to stage the release (defaults to a fresh mktemp dir)
   --native    Bundle Rust binaries for Linux (fat package)
-  --version   Specify the version to release (defaults to a timestamp-based version)
   -h, --help  Show this help
 
 Legacy positional argument: the first non-flag argument is still interpreted
@@ -43,9 +45,6 @@ EOF
 
 TMPDIR=""
 INCLUDE_NATIVE=0
-# Default to a timestamp-based version (keep same scheme as before)
-VERSION="$(printf '0.1.%d' "$(date +%y%m%d%H%M)")"
-WORKFLOW_URL=""
 
 # Manual flag parser - Bash getopts does not handle GNU long options well.
 while [[ $# -gt 0 ]]; do
@@ -60,14 +59,6 @@ while [[ $# -gt 0 ]]; do
     --native)
       INCLUDE_NATIVE=1
       ;;
-    --version)
-      shift || { echo "--version requires an argument"; usage 1; }
-      VERSION="$1"
-      ;;
-    --workflow-url)
-      shift || { echo "--workflow-url requires an argument"; exit 1; }
-      WORKFLOW_URL="$1"
-      ;;
     -h|--help)
       usage 0
       ;;
@@ -117,6 +108,9 @@ cp -r dist "$TMPDIR/dist"
 cp -r src "$TMPDIR/src" # keep source for TS sourcemaps
 cp ../README.md "$TMPDIR" || true # README is one level up - ignore if missing
 
+# Derive a timestamp-based version (keep same scheme as before)
+VERSION="$(printf '0.1.%d' "$(date +%y%m%d%H%M)")"
+
 # Modify package.json - bump version and optionally add the native directory to
 # the files array so that the binaries are published to npm.
 
@@ -127,7 +121,7 @@ jq --arg version "$VERSION" \
 # 2. Native runtime deps (sandbox plus optional Rust binaries)
 
 if [[ "$INCLUDE_NATIVE" -eq 1 ]]; then
-  ./scripts/install_native_deps.sh --full-native --workflow-url "$WORKFLOW_URL" "$TMPDIR"
+  ./scripts/install_native_deps.sh "$TMPDIR" --full-native
   touch "${TMPDIR}/bin/use-native"
 else
   ./scripts/install_native_deps.sh "$TMPDIR"
@@ -138,8 +132,7 @@ popd >/dev/null
 echo "Staged version $VERSION for release in $TMPDIR"
 
 if [[ "$INCLUDE_NATIVE" -eq 1 ]]; then
-  echo "Verify the CLI:"
-  echo "    node ${TMPDIR}/bin/codex.js --version"
+  echo "Test Rust:"
   echo "    node ${TMPDIR}/bin/codex.js --help"
 else
   echo "Test Node:"

codex-cli/scripts/stage_rust_release.py

@@ -1,62 +0,0 @@
-#!/usr/bin/env python3
-
-import json
-import subprocess
-import sys
-import argparse
-from pathlib import Path
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(
-        description="""Stage a release for the npm module.
-
-Run this after the GitHub Release has been created and use
-`--release-version` to specify the version to release.
-"""
-    )
-    parser.add_argument(
-        "--release-version", required=True, help="Version to release, e.g., 0.3.0"
-    )
-    args = parser.parse_args()
-    version = args.release_version
-
-    gh_run = subprocess.run(
-        [
-            "gh",
-            "run",
-            "list",
-            "--branch",
-            f"rust-v{version}",
-            "--json",
-            "workflowName,url,headSha",
-            "--jq",
-            'first(.[] | select(.workflowName == "rust-release"))',
-        ],
-        stdout=subprocess.PIPE,
-        check=True,
-    )
-    gh_run.check_returncode()
-    workflow = json.loads(gh_run.stdout)
-    sha = workflow["headSha"]
-
-    print(f"should `git checkout {sha}`")
-
-    current_dir = Path(__file__).parent.resolve()
-    stage_release = subprocess.run(
-        [
-            current_dir / "stage_release.sh",
-            "--version",
-            version,
-            "--workflow-url",
-            workflow["url"],
-            "--native",
-        ]
-    )
-    stage_release.check_returncode()
-
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

codex-cli/src/cli.tsx

@@ -45,7 +45,6 @@ import { createInputItem } from "./utils/input-utils";
 import { initLogger } from "./utils/logger/log";
 import { isModelSupportedForResponses } from "./utils/model-utils.js";
 import { parseToolCall } from "./utils/parsers";
-import { providers } from "./utils/providers";
 import { onExit, setInkRenderer } from "./utils/terminal";
 import chalk from "chalk";
 import { spawnSync } from "child_process";
@@ -328,44 +327,26 @@ try {
   // ignore errors
 }
 
-// Get provider-specific API key if not OpenAI
-if (provider.toLowerCase() !== "openai") {
-  const providerInfo = providers[provider.toLowerCase()];
-  if (providerInfo) {
-    const providerApiKey = process.env[providerInfo.envKey];
-    if (providerApiKey) {
-      apiKey = providerApiKey;
+if (cli.flags.login) {
+  apiKey = await fetchApiKey(client.issuer, client.client_id);
+  try {
+    const home = os.homedir();
+    const authDir = path.join(home, ".codex");
+    const authFile = path.join(authDir, "auth.json");
+    if (fs.existsSync(authFile)) {
+      const data = JSON.parse(fs.readFileSync(authFile, "utf-8"));
+      savedTokens = data.tokens;
     }
+  } catch {
+    /* ignore */
   }
+} else if (!apiKey) {
+  apiKey = await fetchApiKey(client.issuer, client.client_id);
 }
-
-// Only proceed with OpenAI auth flow if:
-// 1. Provider is OpenAI and no API key is set, or
-// 2. Login flag is explicitly set
-if (provider.toLowerCase() === "openai" && !apiKey) {
-  if (cli.flags.login) {
-    apiKey = await fetchApiKey(client.issuer, client.client_id);
-    try {
-      const home = os.homedir();
-      const authDir = path.join(home, ".codex");
-      const authFile = path.join(authDir, "auth.json");
-      if (fs.existsSync(authFile)) {
-        const data = JSON.parse(fs.readFileSync(authFile, "utf-8"));
-        savedTokens = data.tokens;
-      }
-    } catch {
-      /* ignore */
-    }
-  } else {
-    apiKey = await fetchApiKey(client.issuer, client.client_id);
-  }
-}
-
 // Ensure the API key is available as an environment variable for legacy code
 process.env["OPENAI_API_KEY"] = apiKey;
 
-// Only attempt credit redemption for OpenAI provider
-if (cli.flags.free && provider.toLowerCase() === "openai") {
+if (cli.flags.free) {
   // eslint-disable-next-line no-console
   console.log(`${chalk.bold("codex --free")} attempting to redeem credits...`);
   if (!savedTokens?.refresh_token) {
@@ -398,18 +379,13 @@ if (!apiKey && !NO_API_KEY_REQUIRED.has(provider.toLowerCase())) {
           ? `You can create a key here: ${chalk.bold(
               chalk.underline("https://platform.openai.com/account/api-keys"),
             )}\n`
-          : provider.toLowerCase() === "azure"
+          : provider.toLowerCase() === "gemini"
             ? `You can create a ${chalk.bold(
-                `${provider.toUpperCase()}_OPENAI_API_KEY`,
-              )} ` +
-              `in Azure AI Foundry portal at ${chalk.bold(chalk.underline("https://ai.azure.com"))}.\n`
-            : provider.toLowerCase() === "gemini"
-              ? `You can create a ${chalk.bold(
-                  `${provider.toUpperCase()}_API_KEY`,
-                )} ` + `in the ${chalk.bold(`Google AI Studio`)}.\n`
-              : `You can create a ${chalk.bold(
-                  `${provider.toUpperCase()}_API_KEY`,
-                )} ` + `in the ${chalk.bold(`${provider}`)} dashboard.\n`
+                `${provider.toUpperCase()}_API_KEY`,
+              )} ` + `in the ${chalk.bold(`Google AI Studio`)}.\n`
+            : `You can create a ${chalk.bold(
+                `${provider.toUpperCase()}_API_KEY`,
+              )} ` + `in the ${chalk.bold(`${provider}`)} dashboard.\n`
       }`,
   );
   process.exit(1);

codex-cli/src/components/chat/terminal-chat-input.tsx

@@ -10,25 +10,19 @@ import type {
 import MultilineTextEditor from "./multiline-editor";
 import { TerminalChatCommandReview } from "./terminal-chat-command-review.js";
 import TextCompletions from "./terminal-chat-completions.js";
-import { loadConfig, type AppConfig } from "../../utils/config.js";
+import { loadConfig } from "../../utils/config.js";
 import { getFileSystemSuggestions } from "../../utils/file-system-suggestions.js";
 import { expandFileTags } from "../../utils/file-tag-utils";
 import { createInputItem } from "../../utils/input-utils.js";
 import { log } from "../../utils/logger/log.js";
 import { setSessionId } from "../../utils/session.js";
 import { SLASH_COMMANDS, type SlashCommand } from "../../utils/slash-commands";
-import {
-  runSecurityReview,
-  SecurityReviewError,
-} from "../../utils/security-review.js";
-import type { SecurityReviewMode } from "../../utils/security-review.js";
 import {
   loadCommandHistory,
   addToHistory,
 } from "../../utils/storage/command-history.js";
 import { clearTerminal, onExit } from "../../utils/terminal.js";
 import { Box, Text, useApp, useInput, useStdin } from "ink";
-import path from "node:path";
 import { fileURLToPath } from "node:url";
 import React, {
   useCallback,
@@ -45,130 +39,6 @@ const suggestions = [
   "are there any bugs in my code?",
 ];
 
-const SEC_REVIEW_COMMAND = "/secreview";
-
-type SecReviewCommandOptions = {
-  mode: SecurityReviewMode;
-  includePaths: Array<string>;
-  outputPath?: string;
-  repoPath?: string;
-  modelName?: string;
-};
-
-function tokenizeCommand(input: string): Array<string> {
-  const tokens: Array<string> = [];
-  const regex = /"([^"]*)"|'([^']*)'|(\S+)/g;
-  let match: RegExpExecArray | null;
-  while ((match = regex.exec(input)) !== null) {
-    if (match[1] != null) {
-      tokens.push(match[1]);
-    } else if (match[2] != null) {
-      tokens.push(match[2]);
-    } else if (match[3] != null) {
-      tokens.push(match[3]);
-    }
-  }
-  return tokens;
-}
-
-function parseSecReviewCommand(input: string): SecReviewCommandOptions {
-  const tokens = tokenizeCommand(input).slice(1); // drop the command itself
-  let mode: SecurityReviewMode = "full";
-  const includePaths: Array<string> = [];
-  let outputPath: string | undefined;
-  let repoPath: string | undefined;
-  let modelName: string | undefined;
-
-  const parseMode = (value: string, option: string) => {
-    if (value === "bugs") {
-      mode = "bugs";
-    } else if (value === "full") {
-      mode = "full";
-    } else {
-      throw new Error(`Unknown ${option} value "${value}". Use "full" or "bugs".`);
-    }
-  };
-
-  for (let i = 0; i < tokens.length; i += 1) {
-    const token = tokens[i];
-
-    const expectValue = (label: string): string => {
-      if (i + 1 >= tokens.length) {
-        throw new Error(`Expected value after ${label}`);
-      }
-      i += 1;
-      return tokens[i];
-    };
-
-    if (token === "--") {
-      break;
-    } else if (token === "bugs" || token === "--bugs" || token === "--mode=bugs") {
-      mode = "bugs";
-    } else if (token === "full" || token === "--full" || token === "--mode=full") {
-      mode = "full";
-    } else if (token === "--mode") {
-      parseMode(expectValue("--mode"), "--mode");
-    } else if (token.startsWith("--mode=")) {
-      parseMode(token.slice("--mode=".length), "--mode");
-    } else if (token === "--path" || token === "-p") {
-      includePaths.push(expectValue(token));
-    } else if (token.startsWith("--path=")) {
-      includePaths.push(token.slice("--path=".length));
-    } else if (token.startsWith("-p=")) {
-      includePaths.push(token.slice("-p=".length));
-    } else if (
-      token === "--output" ||
-      token === "-o" ||
-      token === "--output-location"
-    ) {
-      outputPath = expectValue(token);
-    } else if (token.startsWith("--output=")) {
-      outputPath = token.slice("--output=".length);
-    } else if (token.startsWith("-o=")) {
-      outputPath = token.slice("-o=".length);
-    } else if (
-      token === "--repo" ||
-      token === "--repo-location" ||
-      token === "--repository"
-    ) {
-      repoPath = expectValue(token);
-    } else if (token.startsWith("--repo=")) {
-      repoPath = token.slice("--repo=".length);
-    } else if (token.startsWith("--repo-location=")) {
-      repoPath = token.slice("--repo-location=".length);
-    } else if (token === "--model" || token === "--model-name") {
-      modelName = expectValue(token);
-    } else if (token.startsWith("--model=")) {
-      modelName = token.slice("--model=".length);
-    } else if (token.startsWith("--model-name=")) {
-      modelName = token.slice("--model-name=".length);
-    } else if (token.length > 0) {
-      includePaths.push(token);
-    }
-  }
-
-  return {
-    mode,
-    includePaths: includePaths.filter((p) => p.length > 0),
-    outputPath,
-    repoPath,
-    modelName,
-  };
-}
-
-function trimLogOutput(logText: string, maxLines: number = 40): string {
-  const normalised = logText.replace(/\r\n/g, "\n").trimEnd();
-  if (normalised === "") {
-    return "(empty)";
-  }
-  const lines = normalised.split("\n");
-  if (lines.length <= maxLines) {
-    return normalised;
-  }
-  const tail = lines.slice(-maxLines);
-  return ["… (showing last " + maxLines + " lines)", ...tail].join("\n");
-}
-
 export default function TerminalChatInput({
   isNew,
   loading,
@@ -190,7 +60,6 @@ export default function TerminalChatInput({
   active,
   thinkingSeconds,
   items = [],
-  config,
 }: {
   isNew: boolean;
   loading: boolean;
@@ -216,7 +85,6 @@ export default function TerminalChatInput({
   thinkingSeconds: number;
   // New: current conversation items so we can include them in bug reports
   items?: Array<ResponseItem>;
-  config: AppConfig;
 }): React.ReactElement {
   // Slash command suggestion index
   const [selectedSlashSuggestion, setSelectedSlashSuggestion] =
@@ -644,230 +512,6 @@ export default function TerminalChatInput({
       } else if (inputValue.startsWith("/approval")) {
         setInput("");
         openApprovalOverlay();
-        return;
-      } else if (inputValue.startsWith(SEC_REVIEW_COMMAND)) {
-        setInput("");
-        const commandId = `secreview-${Date.now()}`;
-
-        let parsed: SecReviewCommandOptions;
-        try {
-          parsed = parseSecReviewCommand(inputValue);
-        } catch (error) {
-          const message =
-            error instanceof Error ? error.message : String(error);
-          setItems((prev) => [
-            ...prev,
-            {
-              id: `${commandId}-parse-error`,
-              type: "message",
-              role: "system",
-              content: [
-                {
-                  type: "input_text",
-                  text: `⚠️ Unable to parse ${SEC_REVIEW_COMMAND} arguments: ${message}`,
-                },
-              ],
-            },
-          ]);
-          return;
-        }
-
-        const repoPath = parsed.repoPath
-          ? path.isAbsolute(parsed.repoPath)
-            ? parsed.repoPath
-            : path.resolve(process.cwd(), parsed.repoPath)
-          : process.cwd();
-
-        const resolvedOutputPath =
-          parsed.outputPath != null
-            ? path.isAbsolute(parsed.outputPath)
-              ? parsed.outputPath
-              : path.resolve(repoPath, parsed.outputPath)
-            : undefined;
-
-        const scopeDescription =
-          parsed.includePaths.length > 0
-            ? parsed.includePaths.join(", ")
-            : "entire repository";
-
-        const introLines = [
-          `🔐 Running AppSec security review (mode: ${parsed.mode}).`,
-          `Repository: ${repoPath}`,
-          `Scope: ${scopeDescription}`,
-        ];
-
-        if (resolvedOutputPath) {
-          introLines.push(`Output: ${resolvedOutputPath}`);
-        }
-
-        if (parsed.modelName) {
-          introLines.push(`Model override: ${parsed.modelName}`);
-        }
-
-        setItems((prev) => [
-          ...prev,
-          {
-            id: `${commandId}-start`,
-            type: "message",
-            role: "system",
-            content: [
-              {
-                type: "input_text",
-                text: introLines.join("\n"),
-              },
-            ],
-          },
-        ]);
-
-        try {
-          const result = await runSecurityReview({
-            repoPath,
-            includePaths: parsed.includePaths,
-            outputPath: resolvedOutputPath,
-            modelName: parsed.modelName,
-            mode: parsed.mode,
-            config,
-          });
-
-          const summaryLines = [
-            "✅ AppSec review complete.",
-            `Artifacts: ${result.outputRoot}`,
-          ];
-          if (!result.reportContent) {
-            summaryLines.push("ℹ️ report.md not found in output.");
-          }
-          if (!result.bugsContent) {
-            summaryLines.push("ℹ️ context/bugs.md not found in output.");
-          }
-
-          setItems((prev) => [
-            ...prev,
-            {
-              id: `${commandId}-complete`,
-              type: "message",
-              role: "system",
-              content: [
-                {
-                  type: "input_text",
-                  text: summaryLines.join("\n"),
-                },
-              ],
-            },
-          ]);
-
-          if (parsed.mode === "full" && result.reportContent) {
-            setItems((prev) => [
-              ...prev,
-              {
-                id: `${commandId}-report`,
-                type: "message",
-                role: "assistant",
-                content: [
-                  {
-                    type: "output_text",
-                    text: `# AppSec Security Review Report\n\n${result.reportContent}`,
-                  },
-                ],
-              },
-            ]);
-          }
-
-          if (result.bugsContent) {
-            const heading =
-              parsed.mode === "full"
-                ? "## Bugs Summary"
-                : "# AppSec Bugs Summary";
-            setItems((prev) => [
-              ...prev,
-              {
-                id: `${commandId}-bugs`,
-                type: "message",
-                role: "assistant",
-                content: [
-                  {
-                    type: "output_text",
-                    text: `${heading}\n\n${result.bugsContent}`,
-                  },
-                ],
-              },
-            ]);
-          } else {
-            setItems((prev) => [
-              ...prev,
-              {
-                id: `${commandId}-no-bugs`,
-                type: "message",
-                role: "system",
-                content: [
-                  {
-                    type: "input_text",
-                    text:
-                      "No bug summary produced. Check the output directory for details.",
-                  },
-                ],
-              },
-            ]);
-          }
-
-          if (parsed.mode === "bugs" && result.reportContent) {
-            setItems((prev) => [
-              ...prev,
-              {
-                id: `${commandId}-report-location`,
-                type: "message",
-                role: "system",
-                content: [
-                  {
-                    type: "input_text",
-                    text: `Full report available at ${result.reportPath}`,
-                  },
-                ],
-              },
-            ]);
-          }
-          if (result.stdout.trim()) {
-            setItems((prev) => [
-              ...prev,
-              {
-                id: `${commandId}-logs`,
-                type: "message",
-                role: "system",
-                content: [
-                  {
-                    type: "input_text",
-                    text: `Logs:\n${trimLogOutput(result.stdout)}`,
-                  },
-                ],
-              },
-            ]);
-          }
-        } catch (error) {
-          const message =
-            error instanceof Error ? error.message : String(error);
-          const stderr =
-            error instanceof SecurityReviewError && error.stderr
-              ? `\n\nstderr last lines:\n${trimLogOutput(error.stderr)}`
-              : "";
-          const stdout =
-            error instanceof SecurityReviewError && error.stdout
-              ? `\n\nstdout last lines:\n${trimLogOutput(error.stdout)}`
-              : "";
-          setItems((prev) => [
-            ...prev,
-            {
-              id: `${commandId}-error`,
-              type: "message",
-              role: "system",
-              content: [
-                {
-                  type: "input_text",
-                  text: `❌ AppSec review failed: ${message}${stderr}${stdout}`,
-                },
-              ],
-            },
-          ]);
-        }
-
         return;
       } else if (["exit", "q", ":q"].includes(inputValue)) {
         setInput("");
@@ -1063,13 +707,13 @@ export default function TerminalChatInput({
       submitInput([inputItem]);
 
       // Get config for history persistence.
-      const historyConfig = loadConfig();
+      const config = loadConfig();
 
       // Add to history and update state.
       const updatedHistory = await addToHistory(value, history, {
-        maxSize: historyConfig.history?.maxSize ?? 1000,
-        saveHistory: historyConfig.history?.saveHistory ?? true,
-        sensitivePatterns: historyConfig.history?.sensitivePatterns ?? [],
+        maxSize: config.history?.maxSize ?? 1000,
+        saveHistory: config.history?.saveHistory ?? true,
+        sensitivePatterns: config.history?.sensitivePatterns ?? [],
       });
 
       setHistory(updatedHistory);
@@ -1098,7 +742,6 @@ export default function TerminalChatInput({
       onCompact,
       skipNextSubmit,
       items,
-      config,
     ],
   );
 

codex-cli/src/components/chat/terminal-chat.tsx

@@ -580,7 +580,6 @@ export default function TerminalChat({
             }}
             items={items}
             thinkingSeconds={thinkingSeconds}
-            config={config}
           />
         )}
         {overlayMode === "history" && (

codex-cli/src/components/help-overlay.tsx

@@ -56,10 +56,6 @@ export default function HelpOverlay({
           <Text color="cyan">/bug</Text> – generate a prefilled GitHub issue URL
           with session log
         </Text>
-        <Text>
-          <Text color="cyan">/secreview</Text> – run AppSec security review and
-          show the results
-        </Text>
         <Text>
           <Text color="cyan">/diff</Text> – view working tree git diff
         </Text>

codex-cli/src/utils/agent/agent-loop.ts

@@ -800,8 +800,7 @@ export class AgentLoop {
 
             const responseCall =
               !this.config.provider ||
-              this.config.provider?.toLowerCase() === "openai" ||
-              this.config.provider?.toLowerCase() === "azure"
+              this.config.provider?.toLowerCase() === "openai"
                 ? (params: ResponseCreateParams) =>
                     this.oai.responses.create(params)
                 : (params: ResponseCreateParams) =>
@@ -1189,8 +1188,7 @@ export class AgentLoop {
 
               const responseCall =
                 !this.config.provider ||
-                this.config.provider?.toLowerCase() === "openai" ||
-                this.config.provider?.toLowerCase() === "azure"
+                this.config.provider?.toLowerCase() === "openai"
                   ? (params: ResponseCreateParams) =>
                       this.oai.responses.create(params)
                   : (params: ResponseCreateParams) =>

codex-cli/src/utils/config.ts

@@ -69,7 +69,7 @@ export const OPENAI_BASE_URL = process.env["OPENAI_BASE_URL"] || "";
 export let OPENAI_API_KEY = process.env["OPENAI_API_KEY"] || "";
 
 export const AZURE_OPENAI_API_VERSION =
-  process.env["AZURE_OPENAI_API_VERSION"] || "2025-04-01-preview";
+  process.env["AZURE_OPENAI_API_VERSION"] || "2025-03-01-preview";
 
 export const DEFAULT_REASONING_EFFORT = "high";
 export const OPENAI_ORGANIZATION = process.env["OPENAI_ORGANIZATION"] || "";

codex-cli/src/utils/slash-commands.ts

@@ -24,10 +24,6 @@ export const SLASH_COMMANDS: Array<SlashCommand> = [
   { command: "/help", description: "Show list of commands" },
   { command: "/model", description: "Open model selection panel" },
   { command: "/approval", description: "Open approval mode selection panel" },
-  {
-    command: "/secreview",
-    description: "Run AppSec security review and display the generated reports",
-  },
   {
     command: "/bug",
     description: "Generate a prefilled GitHub issue URL with session log",

codex-cli/tests/agent-azure-responses-endpoint.test.ts

@@ -1,107 +0,0 @@
-/**
- * tests/agent-azure-responses-endpoint.test.ts
- *
- * Verifies that AgentLoop calls the `/responses` endpoint when provider is set to Azure.
- */
-
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-// Fake stream that yields a completed response event
-class FakeStream {
-  async *[Symbol.asyncIterator]() {
-    yield {
-      type: "response.completed",
-      response: { id: "azure_resp", status: "completed", output: [] },
-    } as any;
-  }
-}
-
-let lastCreateParams: any = null;
-
-vi.mock("openai", () => {
-  class FakeDefaultClient {
-    public responses = {
-      create: async (params: any) => {
-        lastCreateParams = params;
-        return new FakeStream();
-      },
-    };
-  }
-  class FakeAzureClient {
-    public responses = {
-      create: async (params: any) => {
-        lastCreateParams = params;
-        return new FakeStream();
-      },
-    };
-  }
-  class APIConnectionTimeoutError extends Error {}
-  return {
-    __esModule: true,
-    default: FakeDefaultClient,
-    AzureOpenAI: FakeAzureClient,
-    APIConnectionTimeoutError,
-  };
-});
-
-// Stub approvals to bypass command approval logic
-vi.mock("../src/approvals.js", () => ({
-  __esModule: true,
-  alwaysApprovedCommands: new Set<string>(),
-  canAutoApprove: () => ({ type: "auto-approve", runInSandbox: false }),
-  isSafeCommand: () => null,
-}));
-
-// Stub format-command to avoid formatting side effects
-vi.mock("../src/format-command.js", () => ({
-  __esModule: true,
-  formatCommandForDisplay: (cmd: Array<string>) => cmd.join(" "),
-}));
-
-// Stub internal logging to keep output clean
-vi.mock("../src/utils/agent/log.js", () => ({
-  __esModule: true,
-  log: () => {},
-  isLoggingEnabled: () => false,
-}));
-
-import { AgentLoop } from "../src/utils/agent/agent-loop.js";
-
-describe("AgentLoop Azure provider responses endpoint", () => {
-  beforeEach(() => {
-    lastCreateParams = null;
-  });
-
-  it("calls the /responses endpoint when provider is azure", async () => {
-    const cfg: any = {
-      model: "test-model",
-      provider: "azure",
-      instructions: "",
-      disableResponseStorage: false,
-      notify: false,
-    };
-    const loop = new AgentLoop({
-      additionalWritableRoots: [],
-      model: cfg.model,
-      config: cfg,
-      instructions: cfg.instructions,
-      approvalPolicy: { mode: "suggest" } as any,
-      onItem: () => {},
-      onLoading: () => {},
-      getCommandConfirmation: async () => ({ review: "yes" }) as any,
-      onLastResponseId: () => {},
-    });
-
-    await loop.run([
-      {
-        type: "message",
-        role: "user",
-        content: [{ type: "input_text", text: "hello" }],
-      },
-    ]);
-
-    expect(lastCreateParams).not.toBeNull();
-    expect(lastCreateParams.model).toBe(cfg.model);
-    expect(Array.isArray(lastCreateParams.input)).toBe(true);
-  });
-});

codex-cli/tests/clear-command.test.tsx

@@ -61,11 +61,6 @@ describe("/clear command", () => {
       active: true,
       thinkingSeconds: 0,
       items: existingItems,
-      config: {
-        model: "codex-mini-latest",
-        instructions: "",
-        provider: "openai",
-      },
     };
 
     const { stdin, flush, cleanup } = renderTui(

codex-cli/tests/multiline-history-behavior.test.tsx

@@ -66,27 +66,17 @@ function stubProps(): any {
     loading: false,
     submitInput: vi.fn(),
     confirmationPrompt: null,
-    explanation: undefined,
     submitConfirmation: vi.fn(),
     setLastResponseId: vi.fn(),
-    setItems: vi.fn(),
+    // Cast to any to satisfy the generic React.Dispatch signature without
+    // pulling the ResponseItem type into the test bundle.
+    setItems: (() => {}) as any,
     contextLeftPercent: 100,
     openOverlay: vi.fn(),
     openModelOverlay: vi.fn(),
     openHelpOverlay: vi.fn(),
-    openApprovalOverlay: vi.fn(),
-    openSessionsOverlay: vi.fn(),
-    openDiffOverlay: vi.fn(),
-    onCompact: vi.fn(),
     interruptAgent: vi.fn(),
     active: true,
-    thinkingSeconds: 0,
-    items: [],
-    config: {
-      model: "codex-mini-latest",
-      instructions: "",
-      provider: "openai",
-    },
   };
 }
 

codex-cli/tests/slash-commands.test.ts

@@ -10,7 +10,6 @@ test("SLASH_COMMANDS includes expected commands", () => {
   expect(commands).toContain("/help");
   expect(commands).toContain("/model");
   expect(commands).toContain("/approval");
-  expect(commands).toContain("/secreview");
   expect(commands).toContain("/clearhistory");
   expect(commands).toContain("/diff");
 });

codex-cli/tests/terminal-chat-input-compact.test.tsx

@@ -26,11 +26,6 @@ describe("TerminalChatInput compact command", () => {
       interruptAgent: () => {},
       active: true,
       thinkingSeconds: 0,
-      config: {
-        model: "codex-mini-latest",
-        instructions: "",
-        provider: "openai",
-      },
     };
     const { lastFrameStripped } = renderTui(<TerminalChatInput {...props} />);
     const frame = lastFrameStripped();

codex-cli/tests/terminal-chat-input-file-tag-suggestions.test.tsx

@@ -81,11 +81,6 @@ describe("TerminalChatInput file tag suggestions", () => {
     interruptAgent: vi.fn(),
     active: true,
     thinkingSeconds: 0,
-    config: {
-      model: "codex-mini-latest",
-      instructions: "",
-      provider: "openai",
-    },
   };
 
   beforeEach(() => {

codex-cli/tests/terminal-chat-input-multiline.test.tsx

@@ -47,11 +47,6 @@ describe("TerminalChatInput multiline functionality", () => {
       interruptAgent: () => {},
       active: true,
       thinkingSeconds: 0,
-      config: {
-        model: "codex-mini-latest",
-        instructions: "",
-        provider: "openai",
-      },
     };
 
     const { stdin, lastFrameStripped, flush, cleanup } = renderTui(
@@ -104,11 +99,6 @@ describe("TerminalChatInput multiline functionality", () => {
       interruptAgent: () => {},
       active: true,
       thinkingSeconds: 0,
-      config: {
-        model: "codex-mini-latest",
-        instructions: "",
-        provider: "openai",
-      },
     };
 
     const { stdin, lastFrameStripped, flush, cleanup } = renderTui(

codex-rs/Cargo.toml

@@ -8,7 +8,6 @@ members = [
     "core",
     "exec",
     "execpolicy",
-    "file-search",
     "linux-sandbox",
     "login",
     "mcp-client",
@@ -37,6 +36,3 @@ lto = "fat"
 # Because we bundle some of these executables with the TypeScript CLI, we
 # remove everything to make the binary as small as possible.
 strip = "symbols"
-
-# See https://github.com/openai/codex/issues/1411 for details.
-codegen-units = 1

codex-rs/README.md

@@ -39,52 +39,25 @@ You can enable notifications by configuring a script that is run whenever the ag
 
 To run Codex non-interactively, run `codex exec PROMPT` (you can also pass the prompt via `stdin`) and Codex will work on your task until it decides that it is done and exits. Output is printed to the terminal directly. You can set the `RUST_LOG` environment variable to see more about what's going on.
 
-### Use `@` for file search
-
-Typing `@` triggers a fuzzy-filename search over the workspace root. Use up/down to select among the results and Tab or Enter to replace the `@` with the selected path. You can use Esc to cancel the search.
-
 ### `--cd`/`-C` flag
 
 Sometimes it is not convenient to `cd` to the directory you want Codex to use as the "working root" before running Codex. Fortunately, `codex` supports a `--cd` option so you can specify whatever folder you want. You can confirm that Codex is honoring `--cd` by double-checking the **workdir** it reports in the TUI at the start of a new session.
 
-### Shell completions
-
-Generate shell completion scripts via:
-
-```shell
-codex completion bash
-codex completion zsh
-codex completion fish
-```
-
 ### Experimenting with the Codex Sandbox
 
 To test to see what happens when a command is run under the sandbox provided by Codex, we provide the following subcommands in Codex CLI:
 
 ```
 # macOS
-codex debug seatbelt [--full-auto] [COMMAND]...
+codex debug seatbelt [-s SANDBOX_PERMISSION]... [COMMAND]...
 
 # Linux
-codex debug landlock [--full-auto] [COMMAND]...
+codex debug landlock [-s SANDBOX_PERMISSION]... [COMMAND]...
 ```
 
-### Selecting a sandbox policy via `--sandbox`
+You can experiment with different values of `-s` to see what permissions the `COMMAND` needs to execute successfully.
 
-The Rust CLI exposes a dedicated `--sandbox` (`-s`) flag that lets you pick the sandbox policy **without** having to reach for the generic `-c/--config` option:
-
-```shell
-# Run Codex with the default, read-only sandbox
-codex --sandbox read-only
-
-# Allow the agent to write within the current workspace while still blocking network access
-codex --sandbox workspace-write
-
-# Danger! Disable sandboxing entirely (only do this if you are already running in a container or other isolated env)
-codex --sandbox danger-full-access
-```
-
-The same setting can be persisted in `~/.codex/config.toml` via the top-level `sandbox_mode = "MODE"` key, e.g. `sandbox_mode = "workspace-write"`.
+Note that the exact API for the `-s` flag is currently in flux. See https://github.com/openai/codex/issues/1248 for details.
 
 ## Code Organization
 

codex-rs/apply-patch/Cargo.toml

@@ -12,10 +12,11 @@ workspace = true
 
 [dependencies]
 anyhow = "1"
+serde_json = "1.0.110"
 similar = "2.7.0"
 thiserror = "2.0.12"
 tree-sitter = "0.25.3"
-tree-sitter-bash = "0.25.0"
+tree-sitter-bash = "0.23.3"
 
 [dev-dependencies]
 pretty_assertions = "1.4.1"

codex-rs/apply-patch/src/lib.rs

@@ -633,7 +633,7 @@ mod tests {
 
     /// Helper to construct a patch with the given body.
     fn wrap_patch(body: &str) -> String {
-        format!("*** Begin Patch\n{body}\n*** End Patch")
+        format!("*** Begin Patch\n{}\n*** End Patch", body)
     }
 
     fn strs_to_strings(strs: &[&str]) -> Vec<String> {
@@ -661,7 +661,7 @@ mod tests {
                     }]
                 );
             }
-            result => panic!("expected MaybeApplyPatch::Body got {result:?}"),
+            result => panic!("expected MaybeApplyPatch::Body got {:?}", result),
         }
     }
 
@@ -688,7 +688,7 @@ PATCH"#,
                     }]
                 );
             }
-            result => panic!("expected MaybeApplyPatch::Body got {result:?}"),
+            result => panic!("expected MaybeApplyPatch::Body got {:?}", result),
         }
     }
 

codex-rs/chatgpt/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "codex-chatgpt"
-version = { workspace = true }
-edition = "2024"
-
-[lints]
-workspace = true
-
-[dependencies]
-anyhow = "1"
-clap = { version = "4", features = ["derive"] }
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-codex-common = { path = "../common", features = ["cli"] }
-codex-core = { path = "../core" }
-codex-login = { path = "../login" }
-reqwest = { version = "0.12", features = ["json", "stream"] }
-tokio = { version = "1", features = ["full"] }
-
-[dev-dependencies]
-tempfile = "3"

codex-rs/chatgpt/README.md

@@ -1,5 +0,0 @@
-# ChatGPT
-
-This crate pertains to first party ChatGPT APIs and products such as Codex agent.
-
-This crate should be primarily built and maintained by OpenAI employees. Please reach out to a maintainer before making an external contribution.

codex-rs/chatgpt/src/apply_command.rs

@@ -1,89 +0,0 @@
-use clap::Parser;
-use codex_common::CliConfigOverrides;
-use codex_core::config::Config;
-use codex_core::config::ConfigOverrides;
-
-use crate::chatgpt_token::init_chatgpt_token_from_auth;
-use crate::get_task::GetTaskResponse;
-use crate::get_task::OutputItem;
-use crate::get_task::PrOutputItem;
-use crate::get_task::get_task;
-
-/// Applies the latest diff from a Codex agent task.
-#[derive(Debug, Parser)]
-pub struct ApplyCommand {
-    pub task_id: String,
-
-    #[clap(flatten)]
-    pub config_overrides: CliConfigOverrides,
-}
-pub async fn run_apply_command(apply_cli: ApplyCommand) -> anyhow::Result<()> {
-    let config = Config::load_with_cli_overrides(
-        apply_cli
-            .config_overrides
-            .parse_overrides()
-            .map_err(anyhow::Error::msg)?,
-        ConfigOverrides::default(),
-    )?;
-
-    init_chatgpt_token_from_auth(&config.codex_home).await?;
-
-    let task_response = get_task(&config, apply_cli.task_id).await?;
-    apply_diff_from_task(task_response).await
-}
-
-pub async fn apply_diff_from_task(task_response: GetTaskResponse) -> anyhow::Result<()> {
-    let diff_turn = match task_response.current_diff_task_turn {
-        Some(turn) => turn,
-        None => anyhow::bail!("No diff turn found"),
-    };
-    let output_diff = diff_turn.output_items.iter().find_map(|item| match item {
-        OutputItem::Pr(PrOutputItem { output_diff }) => Some(output_diff),
-        _ => None,
-    });
-    match output_diff {
-        Some(output_diff) => apply_diff(&output_diff.diff).await,
-        None => anyhow::bail!("No PR output item found"),
-    }
-}
-
-async fn apply_diff(diff: &str) -> anyhow::Result<()> {
-    let toplevel_output = tokio::process::Command::new("git")
-        .args(vec!["rev-parse", "--show-toplevel"])
-        .output()
-        .await?;
-
-    if !toplevel_output.status.success() {
-        anyhow::bail!("apply must be run from a git repository.");
-    }
-
-    let repo_root = String::from_utf8(toplevel_output.stdout)?
-        .trim()
-        .to_string();
-
-    let mut git_apply_cmd = tokio::process::Command::new("git")
-        .args(vec!["apply", "--3way"])
-        .current_dir(&repo_root)
-        .stdin(std::process::Stdio::piped())
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()?;
-
-    if let Some(mut stdin) = git_apply_cmd.stdin.take() {
-        tokio::io::AsyncWriteExt::write_all(&mut stdin, diff.as_bytes()).await?;
-        drop(stdin);
-    }
-
-    let output = git_apply_cmd.wait_with_output().await?;
-
-    if !output.status.success() {
-        anyhow::bail!(
-            "Git apply failed with status {}: {}",
-            output.status,
-            String::from_utf8_lossy(&output.stderr)
-        );
-    }
-
-    println!("Successfully applied diff");
-    Ok(())
-}

codex-rs/chatgpt/src/chatgpt_client.rs

@@ -1,45 +0,0 @@
-use codex_core::config::Config;
-
-use crate::chatgpt_token::get_chatgpt_token_data;
-use crate::chatgpt_token::init_chatgpt_token_from_auth;
-
-use anyhow::Context;
-use serde::de::DeserializeOwned;
-
-/// Make a GET request to the ChatGPT backend API.
-pub(crate) async fn chatgpt_get_request<T: DeserializeOwned>(
-    config: &Config,
-    path: String,
-) -> anyhow::Result<T> {
-    let chatgpt_base_url = &config.chatgpt_base_url;
-    init_chatgpt_token_from_auth(&config.codex_home).await?;
-
-    // Make direct HTTP request to ChatGPT backend API with the token
-    let client = reqwest::Client::new();
-    let url = format!("{chatgpt_base_url}{path}");
-
-    let token =
-        get_chatgpt_token_data().ok_or_else(|| anyhow::anyhow!("ChatGPT token not available"))?;
-
-    let response = client
-        .get(&url)
-        .bearer_auth(&token.access_token)
-        .header("chatgpt-account-id", &token.account_id)
-        .header("Content-Type", "application/json")
-        .header("User-Agent", "codex-cli")
-        .send()
-        .await
-        .context("Failed to send request")?;
-
-    if response.status().is_success() {
-        let result: T = response
-            .json()
-            .await
-            .context("Failed to parse JSON response")?;
-        Ok(result)
-    } else {
-        let status = response.status();
-        let body = response.text().await.unwrap_or_default();
-        anyhow::bail!("Request failed with status {}: {}", status, body)
-    }
-}

codex-rs/chatgpt/src/chatgpt_token.rs

@@ -1,24 +0,0 @@
-use std::path::Path;
-use std::sync::LazyLock;
-use std::sync::RwLock;
-
-use codex_login::TokenData;
-
-static CHATGPT_TOKEN: LazyLock<RwLock<Option<TokenData>>> = LazyLock::new(|| RwLock::new(None));
-
-pub fn get_chatgpt_token_data() -> Option<TokenData> {
-    CHATGPT_TOKEN.read().ok()?.clone()
-}
-
-pub fn set_chatgpt_token_data(value: TokenData) {
-    if let Ok(mut guard) = CHATGPT_TOKEN.write() {
-        *guard = Some(value);
-    }
-}
-
-/// Initialize the ChatGPT token from auth.json file
-pub async fn init_chatgpt_token_from_auth(codex_home: &Path) -> std::io::Result<()> {
-    let auth_json = codex_login::try_read_auth_json(codex_home).await?;
-    set_chatgpt_token_data(auth_json.tokens.clone());
-    Ok(())
-}

codex-rs/chatgpt/src/get_task.rs

@@ -1,40 +0,0 @@
-use codex_core::config::Config;
-use serde::Deserialize;
-
-use crate::chatgpt_client::chatgpt_get_request;
-
-#[derive(Debug, Deserialize)]
-pub struct GetTaskResponse {
-    pub current_diff_task_turn: Option<AssistantTurn>,
-}
-
-// Only relevant fields for our extraction
-#[derive(Debug, Deserialize)]
-pub struct AssistantTurn {
-    pub output_items: Vec<OutputItem>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type")]
-pub enum OutputItem {
-    #[serde(rename = "pr")]
-    Pr(PrOutputItem),
-
-    #[serde(other)]
-    Other,
-}
-
-#[derive(Debug, Deserialize)]
-pub struct PrOutputItem {
-    pub output_diff: OutputDiff,
-}
-
-#[derive(Debug, Deserialize)]
-pub struct OutputDiff {
-    pub diff: String,
-}
-
-pub(crate) async fn get_task(config: &Config, task_id: String) -> anyhow::Result<GetTaskResponse> {
-    let path = format!("/wham/tasks/{task_id}");
-    chatgpt_get_request(config, path).await
-}

codex-rs/chatgpt/src/lib.rs

@@ -1,4 +0,0 @@
-pub mod apply_command;
-mod chatgpt_client;
-mod chatgpt_token;
-pub mod get_task;

codex-rs/chatgpt/tests/apply_command_e2e.rs

@@ -1,191 +0,0 @@
-#![expect(clippy::expect_used)]
-
-use codex_chatgpt::apply_command::apply_diff_from_task;
-use codex_chatgpt::get_task::GetTaskResponse;
-use std::path::Path;
-use tempfile::TempDir;
-use tokio::process::Command;
-
-/// Creates a temporary git repository with initial commit
-async fn create_temp_git_repo() -> anyhow::Result<TempDir> {
-    let temp_dir = TempDir::new()?;
-    let repo_path = temp_dir.path();
-
-    let output = Command::new("git")
-        .args(["init"])
-        .current_dir(repo_path)
-        .output()
-        .await?;
-
-    if !output.status.success() {
-        anyhow::bail!(
-            "Failed to initialize git repo: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-    }
-
-    Command::new("git")
-        .args(["config", "user.email", "test@example.com"])
-        .current_dir(repo_path)
-        .output()
-        .await?;
-
-    Command::new("git")
-        .args(["config", "user.name", "Test User"])
-        .current_dir(repo_path)
-        .output()
-        .await?;
-
-    std::fs::write(repo_path.join("README.md"), "# Test Repo\n")?;
-
-    Command::new("git")
-        .args(["add", "README.md"])
-        .current_dir(repo_path)
-        .output()
-        .await?;
-
-    let output = Command::new("git")
-        .args(["commit", "-m", "Initial commit"])
-        .current_dir(repo_path)
-        .output()
-        .await?;
-
-    if !output.status.success() {
-        anyhow::bail!(
-            "Failed to create initial commit: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-    }
-
-    Ok(temp_dir)
-}
-
-async fn mock_get_task_with_fixture() -> anyhow::Result<GetTaskResponse> {
-    let fixture_path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/task_turn_fixture.json");
-    let fixture_content = std::fs::read_to_string(fixture_path)?;
-    let response: GetTaskResponse = serde_json::from_str(&fixture_content)?;
-    Ok(response)
-}
-
-#[tokio::test]
-async fn test_apply_command_creates_fibonacci_file() {
-    let temp_repo = create_temp_git_repo()
-        .await
-        .expect("Failed to create temp git repo");
-    let repo_path = temp_repo.path();
-
-    let task_response = mock_get_task_with_fixture()
-        .await
-        .expect("Failed to load fixture");
-
-    let original_dir = std::env::current_dir().expect("Failed to get current dir");
-    std::env::set_current_dir(repo_path).expect("Failed to change directory");
-    struct DirGuard(std::path::PathBuf);
-    impl Drop for DirGuard {
-        fn drop(&mut self) {
-            let _ = std::env::set_current_dir(&self.0);
-        }
-    }
-    let _guard = DirGuard(original_dir);
-
-    apply_diff_from_task(task_response)
-        .await
-        .expect("Failed to apply diff from task");
-
-    // Assert that fibonacci.js was created in scripts/ directory
-    let fibonacci_path = repo_path.join("scripts/fibonacci.js");
-    assert!(fibonacci_path.exists(), "fibonacci.js was not created");
-
-    // Verify the file contents match expected
-    let contents = std::fs::read_to_string(&fibonacci_path).expect("Failed to read fibonacci.js");
-    assert!(
-        contents.contains("function fibonacci(n)"),
-        "fibonacci.js doesn't contain expected function"
-    );
-    assert!(
-        contents.contains("#!/usr/bin/env node"),
-        "fibonacci.js doesn't have shebang"
-    );
-    assert!(
-        contents.contains("module.exports = fibonacci;"),
-        "fibonacci.js doesn't export function"
-    );
-
-    // Verify file has correct number of lines (31 as specified in fixture)
-    let line_count = contents.lines().count();
-    assert_eq!(
-        line_count, 31,
-        "fibonacci.js should have 31 lines, got {line_count}",
-    );
-}
-
-#[tokio::test]
-async fn test_apply_command_with_merge_conflicts() {
-    let temp_repo = create_temp_git_repo()
-        .await
-        .expect("Failed to create temp git repo");
-    let repo_path = temp_repo.path();
-
-    // Create conflicting fibonacci.js file first
-    let scripts_dir = repo_path.join("scripts");
-    std::fs::create_dir_all(&scripts_dir).expect("Failed to create scripts directory");
-
-    let conflicting_content = r#"#!/usr/bin/env node
-
-// This is a different fibonacci implementation
-function fib(num) {
-  if (num <= 1) return num;
-  return fib(num - 1) + fib(num - 2);
-}
-
-console.log("Running fibonacci...");
-console.log(fib(10));
-"#;
-
-    let fibonacci_path = scripts_dir.join("fibonacci.js");
-    std::fs::write(&fibonacci_path, conflicting_content).expect("Failed to write conflicting file");
-
-    Command::new("git")
-        .args(["add", "scripts/fibonacci.js"])
-        .current_dir(repo_path)
-        .output()
-        .await
-        .expect("Failed to add fibonacci.js");
-
-    Command::new("git")
-        .args(["commit", "-m", "Add conflicting fibonacci implementation"])
-        .current_dir(repo_path)
-        .output()
-        .await
-        .expect("Failed to commit conflicting file");
-
-    let original_dir = std::env::current_dir().expect("Failed to get current dir");
-    std::env::set_current_dir(repo_path).expect("Failed to change directory");
-    struct DirGuard(std::path::PathBuf);
-    impl Drop for DirGuard {
-        fn drop(&mut self) {
-            let _ = std::env::set_current_dir(&self.0);
-        }
-    }
-    let _guard = DirGuard(original_dir);
-
-    let task_response = mock_get_task_with_fixture()
-        .await
-        .expect("Failed to load fixture");
-
-    let apply_result = apply_diff_from_task(task_response).await;
-
-    assert!(
-        apply_result.is_err(),
-        "Expected apply to fail due to merge conflicts"
-    );
-
-    let contents = std::fs::read_to_string(&fibonacci_path).expect("Failed to read fibonacci.js");
-
-    assert!(
-        contents.contains("<<<<<<< HEAD")
-            || contents.contains("=======")
-            || contents.contains(">>>>>>> "),
-        "fibonacci.js should contain merge conflict markers, got: {contents}",
-    );
-}

codex-rs/chatgpt/tests/task_turn_fixture.json

@@ -1,65 +0,0 @@
-{
-    "current_diff_task_turn": {
-        "output_items": [
-            {
-                "type": "pr",
-                "pr_title": "Add fibonacci script",
-                "pr_message": "## Summary\n- add a basic Fibonacci script under `scripts/`\n\n## Testing\n- `node scripts/fibonacci.js 10`\n- `npm run lint` *(fails: next not found)*",
-                "output_diff": {
-                    "type": "output_diff",
-                    "repo_id": "/workspace/rddit-vercel",
-                    "base_commit_sha": "1a2e9baf2ce2fdd0c126b47b1bcfd512de2a9f7b",
-                    "diff": "diff --git a/scripts/fibonacci.js b/scripts/fibonacci.js\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..6c9fdfdbf8669b7968936411050525b995d0a9a6\n--- /dev/null\n+++ b/scripts/fibonacci.js\n@@ -0,0 +1,31 @@\n+#!/usr/bin/env node\n+\n+function fibonacci(n) {\n+  if (n < 0) {\n+    throw new Error(\"n must be non-negative\");\n+  }\n+  let a = 0;\n+  let b = 1;\n+  for (let i = 0; i < n; i++) {\n+    const next = a + b;\n+    a = b;\n+    b = next;\n+  }\n+  return a;\n+}\n+\n+function printUsage() {\n+  console.log(\"Usage: node scripts/fibonacci.js <n>\");\n+}\n+\n+if (require.main === module) {\n+  const arg = process.argv[2];\n+  if (arg === undefined || isNaN(Number(arg))) {\n+    printUsage();\n+    process.exit(1);\n+  }\n+  const n = Number(arg);\n+  console.log(fibonacci(n));\n+}\n+\n+module.exports = fibonacci;\n",
-                    "external_storage_diff": {
-                        "file_id": "file_00000000114c61f786900f8c2130ace7",
-                        "ttl": null
-                    },
-                    "files_modified": 1,
-                    "lines_added": 31,
-                    "lines_removed": 0,
-                    "commit_message": "Add fibonacci script"
-                }
-            },
-            {
-                "type": "message",
-                "role": "assistant",
-                "content": [
-                    {
-                        "content_type": "text",
-                        "text": "**Summary**\n\n- Created a command-line Fibonacci script that validates input and prints the result when executed with Node"
-                    },
-                    {
-                        "content_type": "repo_file_citation",
-                        "path": "scripts/fibonacci.js",
-                        "line_range_start": 1,
-                        "line_range_end": 31
-                    },
-                    {
-                        "content_type": "text",
-                        "text": "\n\n**Testing**\n\n- ❌ `npm run lint` (failed to run `next lint`)"
-                    },
-                    {
-                        "content_type": "terminal_chunk_citation",
-                        "terminal_chunk_id": "7dd543",
-                        "line_range_start": 1,
-                        "line_range_end": 5
-                    },
-                    {
-                        "content_type": "text",
-                        "text": "\n- ✅ `node scripts/fibonacci.js 10` produced “55”"
-                    },
-                    {
-                        "content_type": "terminal_chunk_citation",
-                        "terminal_chunk_id": "6ee559",
-                        "line_range_start": 1,
-                        "line_range_end": 3
-                    },
-                    {
-                        "content_type": "text",
-                        "text": "\n\nCodex couldn't run certain commands due to environment limitations. Consider configuring a setup script or internet access in your Codex environment to install dependencies."
-                    }
-                ]
-            }
-        ]
-    }
-}

codex-rs/cli/Cargo.toml

@@ -17,10 +17,8 @@ workspace = true
 [dependencies]
 anyhow = "1"
 clap = { version = "4", features = ["derive"] }
-clap_complete = "4"
-codex-chatgpt = { path = "../chatgpt" }
 codex-core = { path = "../core" }
-codex-common = { path = "../common", features = ["cli"] }
+codex-common = { path = "../common", features = ["cli", "model-list"] }
 codex-exec = { path = "../exec" }
 codex-login = { path = "../login" }
 codex-linux-sandbox = { path = "../linux-sandbox" }

codex-rs/cli/src/debug_sandbox.rs

@@ -1,13 +1,14 @@
 use std::path::PathBuf;
 
 use codex_common::CliConfigOverrides;
+use codex_common::SandboxPermissionOption;
 use codex_core::config::Config;
 use codex_core::config::ConfigOverrides;
-use codex_core::config_types::SandboxMode;
 use codex_core::exec::StdioPolicy;
 use codex_core::exec::spawn_command_under_linux_sandbox;
 use codex_core::exec::spawn_command_under_seatbelt;
 use codex_core::exec_env::create_env;
+use codex_core::protocol::SandboxPolicy;
 
 use crate::LandlockCommand;
 use crate::SeatbeltCommand;
@@ -19,11 +20,13 @@ pub async fn run_command_under_seatbelt(
 ) -> anyhow::Result<()> {
     let SeatbeltCommand {
         full_auto,
+        sandbox,
         config_overrides,
         command,
     } = command;
     run_command_under_sandbox(
         full_auto,
+        sandbox,
         command,
         config_overrides,
         codex_linux_sandbox_exe,
@@ -38,11 +41,13 @@ pub async fn run_command_under_landlock(
 ) -> anyhow::Result<()> {
     let LandlockCommand {
         full_auto,
+        sandbox,
         config_overrides,
         command,
     } = command;
     run_command_under_sandbox(
         full_auto,
+        sandbox,
         command,
         config_overrides,
         codex_linux_sandbox_exe,
@@ -58,19 +63,20 @@ enum SandboxType {
 
 async fn run_command_under_sandbox(
     full_auto: bool,
+    sandbox: SandboxPermissionOption,
     command: Vec<String>,
     config_overrides: CliConfigOverrides,
     codex_linux_sandbox_exe: Option<PathBuf>,
     sandbox_type: SandboxType,
 ) -> anyhow::Result<()> {
-    let sandbox_mode = create_sandbox_mode(full_auto);
+    let sandbox_policy = create_sandbox_policy(full_auto, sandbox);
     let cwd = std::env::current_dir()?;
     let config = Config::load_with_cli_overrides(
         config_overrides
             .parse_overrides()
             .map_err(anyhow::Error::msg)?,
         ConfigOverrides {
-            sandbox_mode: Some(sandbox_mode),
+            sandbox_policy: Some(sandbox_policy),
             codex_linux_sandbox_exe,
             ..Default::default()
         },
@@ -104,10 +110,13 @@ async fn run_command_under_sandbox(
     handle_exit_status(status);
 }
 
-pub fn create_sandbox_mode(full_auto: bool) -> SandboxMode {
+pub fn create_sandbox_policy(full_auto: bool, sandbox: SandboxPermissionOption) -> SandboxPolicy {
     if full_auto {
-        SandboxMode::WorkspaceWrite
+        SandboxPolicy::new_full_auto_policy()
     } else {
-        SandboxMode::ReadOnly
+        match sandbox.permissions.map(Into::into) {
+            Some(sandbox_policy) => sandbox_policy,
+            None => SandboxPolicy::new_read_only_policy(),
+        }
     }
 }

codex-rs/cli/src/lib.rs

@@ -5,6 +5,7 @@ pub mod proto;
 
 use clap::Parser;
 use codex_common::CliConfigOverrides;
+use codex_common::SandboxPermissionOption;
 
 #[derive(Debug, Parser)]
 pub struct SeatbeltCommand {
@@ -12,6 +13,9 @@ pub struct SeatbeltCommand {
     #[arg(long = "full-auto", default_value_t = false)]
     pub full_auto: bool,
 
+    #[clap(flatten)]
+    pub sandbox: SandboxPermissionOption,
+
     #[clap(skip)]
     pub config_overrides: CliConfigOverrides,
 
@@ -26,6 +30,9 @@ pub struct LandlockCommand {
     #[arg(long = "full-auto", default_value_t = false)]
     pub full_auto: bool,
 
+    #[clap(flatten)]
+    pub sandbox: SandboxPermissionOption,
+
     #[clap(skip)]
     pub config_overrides: CliConfigOverrides,
 

codex-rs/cli/src/list_models.rs

@@ -0,0 +1,55 @@
+use clap::Parser;
+
+use codex_common::CliConfigOverrides;
+use codex_core::config::Config;
+use codex_core::config::ConfigOverrides;
+
+/// Print the list of models available for the configured (or overridden)
+/// provider.
+#[derive(Debug, Parser)]
+pub struct ListModelsCli {
+    /// Optional provider override. When set this value is used instead of the
+    /// `model_provider_id` configured in `~/.codex/config.toml`.
+    #[clap(long)]
+    pub provider: Option<String>,
+
+    /// Arbitrary `-c key=value` overrides that apply **in addition** to the
+    /// `--provider` flag.
+    #[clap(flatten)]
+    pub config_overrides: CliConfigOverrides,
+}
+
+impl ListModelsCli {
+    pub async fn run(self) -> anyhow::Result<()> {
+        // Compose strongly-typed overrides. The provider flag, if specified,
+        // is translated into the corresponding field inside `ConfigOverrides`.
+        let overrides = ConfigOverrides {
+            model: None,
+            config_profile: None,
+            approval_policy: None,
+            sandbox_policy: None,
+            cwd: None,
+            model_provider: self.provider.clone(),
+            codex_linux_sandbox_exe: None,
+        };
+
+        // Parse the raw `-c` overrides early so we can bail with a useful
+        // error message if the user supplied an invalid value.
+        let cli_kv_overrides = self
+            .config_overrides
+            .parse_overrides()
+            .map_err(anyhow::Error::msg)?;
+
+        // Load the merged configuration.
+        let cfg = Config::load_with_cli_overrides(cli_kv_overrides, overrides)?;
+
+        // Retrieve the model list.
+        let models = codex_common::fetch_available_models(cfg.model_provider).await?;
+
+        for m in models {
+            println!("{m}");
+        }
+
+        Ok(())
+    }
+}

codex-rs/cli/src/main.rs

@@ -1,9 +1,4 @@
-use clap::CommandFactory;
 use clap::Parser;
-use clap_complete::Shell;
-use clap_complete::generate;
-use codex_chatgpt::apply_command::ApplyCommand;
-use codex_chatgpt::apply_command::run_apply_command;
 use codex_cli::LandlockCommand;
 use codex_cli::SeatbeltCommand;
 use codex_cli::login::run_login_with_chatgpt;
@@ -14,6 +9,7 @@ use codex_tui::Cli as TuiCli;
 use std::path::PathBuf;
 
 use crate::proto::ProtoCli;
+mod list_models;
 
 /// Codex CLI
 ///
@@ -48,26 +44,16 @@ enum Subcommand {
     /// Experimental: run Codex as an MCP server.
     Mcp,
 
+    /// List models for the configured or specified provider.
+    #[clap(name = "list-models", visible_alias = "lm")]
+    ListModels(crate::list_models::ListModelsCli),
+
     /// Run the Protocol stream via stdin/stdout
     #[clap(visible_alias = "p")]
     Proto(ProtoCli),
 
-    /// Generate shell completion scripts.
-    Completion(CompletionCommand),
-
     /// Internal debugging commands.
     Debug(DebugArgs),
-
-    /// Apply the latest diff produced by Codex agent as a `git apply` to your local working tree.
-    #[clap(visible_alias = "a")]
-    Apply(ApplyCommand),
-}
-
-#[derive(Debug, Parser)]
-struct CompletionCommand {
-    /// Shell to generate completions for
-    #[clap(value_enum, default_value_t = Shell::Bash)]
-    shell: Shell,
 }
 
 #[derive(Debug, Parser)]
@@ -122,9 +108,6 @@ async fn cli_main(codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()
             prepend_config_flags(&mut proto_cli.config_overrides, cli.config_overrides);
             proto::run_main(proto_cli).await?;
         }
-        Some(Subcommand::Completion(completion_cli)) => {
-            print_completion(completion_cli);
-        }
         Some(Subcommand::Debug(debug_args)) => match debug_args.cmd {
             DebugCommand::Seatbelt(mut seatbelt_cli) => {
                 prepend_config_flags(&mut seatbelt_cli.config_overrides, cli.config_overrides);
@@ -143,9 +126,12 @@ async fn cli_main(codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()
                 .await?;
             }
         },
-        Some(Subcommand::Apply(mut apply_cli)) => {
-            prepend_config_flags(&mut apply_cli.config_overrides, cli.config_overrides);
-            run_apply_command(apply_cli).await?;
+        Some(Subcommand::ListModels(list_cli)) => {
+            // Combine root-level overrides with subcommand-specific ones so
+            // that the latter take precedence.
+            let mut list_cli = list_cli;
+            prepend_config_flags(&mut list_cli.config_overrides, cli.config_overrides);
+            list_cli.run().await?;
         }
     }
 
@@ -162,9 +148,3 @@ fn prepend_config_flags(
         .raw_overrides
         .splice(0..0, cli_config_overrides.raw_overrides);
 }
-
-fn print_completion(cmd: CompletionCommand) {
-    let mut app = MultitoolCli::command();
-    let name = "codex";
-    generate(cmd.shell, &mut app, name, &mut std::io::stdout());
-}

codex-rs/common/Cargo.toml

@@ -9,11 +9,17 @@ workspace = true
 [dependencies]
 clap = { version = "4", features = ["derive", "wrap_help"], optional = true }
 codex-core = { path = "../core" }
-toml = { version = "0.9", optional = true }
+toml = { version = "0.8", optional = true }
 serde = { version = "1", optional = true }
+reqwest = { version = "0.12", features = ["json"], optional = true }
 
 [features]
 # Separate feature so that `clap` is not a mandatory dependency.
 cli = ["clap", "toml", "serde"]
 elapsed = []
-sandbox_summary = []
+
+# Helper functionality for querying the list of available models from a model
+# provider. This is intentionally behind a separate opt-in feature so that
+# downstream crates that do not need it avoid pulling in the additional heavy
+# dependencies (`reqwest`, etc.).
+model-list = ["reqwest"]

codex-rs/common/src/approval_mode_cli_arg.rs

@@ -1,23 +1,27 @@
 //! Standard type to use with the `--approval-mode` CLI option.
 //! Available when the `cli` feature is enabled for the crate.
 
+use clap::ArgAction;
+use clap::Parser;
 use clap::ValueEnum;
 
+use codex_core::config::parse_sandbox_permission_with_base_path;
 use codex_core::protocol::AskForApproval;
+use codex_core::protocol::SandboxPermission;
 
 #[derive(Clone, Copy, Debug, ValueEnum)]
 #[value(rename_all = "kebab-case")]
 pub enum ApprovalModeCliArg {
-    /// Only run "trusted" commands (e.g. ls, cat, sed) without asking for user
-    /// approval. Will escalate to the user if the model proposes a command that
-    /// is not in the "trusted" set.
-    Untrusted,
-
     /// Run all commands without asking for user approval.
     /// Only asks for approval if a command fails to execute, in which case it
     /// will escalate to the user to ask for un-sandboxed execution.
     OnFailure,
 
+    /// Only run "known safe" commands (e.g. ls, cat, sed) without
+    /// asking for user approval. Will escalate to the user if the model
+    /// proposes a command that is not allow-listed.
+    UnlessAllowListed,
+
     /// Never ask for user approval
     /// Execution failures are immediately returned to the model.
     Never,
@@ -26,9 +30,44 @@ pub enum ApprovalModeCliArg {
 impl From<ApprovalModeCliArg> for AskForApproval {
     fn from(value: ApprovalModeCliArg) -> Self {
         match value {
-            ApprovalModeCliArg::Untrusted => AskForApproval::UnlessTrusted,
             ApprovalModeCliArg::OnFailure => AskForApproval::OnFailure,
+            ApprovalModeCliArg::UnlessAllowListed => AskForApproval::UnlessAllowListed,
             ApprovalModeCliArg::Never => AskForApproval::Never,
         }
     }
 }
+
+#[derive(Parser, Debug)]
+pub struct SandboxPermissionOption {
+    /// Specify this flag multiple times to specify the full set of permissions
+    /// to grant to Codex.
+    ///
+    /// ```shell
+    /// codex -s disk-full-read-access \
+    ///       -s disk-write-cwd \
+    ///       -s disk-write-platform-user-temp-folder \
+    ///       -s disk-write-platform-global-temp-folder
+    /// ```
+    ///
+    /// Note disk-write-folder takes a value:
+    ///
+    /// ```shell
+    ///     -s disk-write-folder=$HOME/.pyenv/shims
+    /// ```
+    ///
+    /// These permissions are quite broad and should be used with caution:
+    ///
+    /// ```shell
+    ///     -s disk-full-write-access
+    ///     -s network-full-access
+    /// ```
+    #[arg(long = "sandbox-permission", short = 's', action = ArgAction::Append, value_parser = parse_sandbox_permission)]
+    pub permissions: Option<Vec<SandboxPermission>>,
+}
+
+/// Custom value-parser so we can keep the CLI surface small *and*
+/// still handle the parameterised `disk-write-folder` case.
+fn parse_sandbox_permission(raw: &str) -> std::io::Result<SandboxPermission> {
+    let base_path = std::env::current_dir()?;
+    parse_sandbox_permission_with_base_path(raw, base_path)
+}

codex-rs/common/src/elapsed.rs

@@ -20,7 +20,7 @@ pub fn format_duration(duration: Duration) -> String {
 
 fn format_elapsed_millis(millis: i64) -> String {
     if millis < 1000 {
-        format!("{millis}ms")
+        format!("{}ms", millis)
     } else if millis < 60_000 {
         format!("{:.2}s", millis as f64 / 1000.0)
     } else {

codex-rs/common/src/lib.rs

@@ -6,12 +6,8 @@ pub mod elapsed;
 
 #[cfg(feature = "cli")]
 pub use approval_mode_cli_arg::ApprovalModeCliArg;
-
 #[cfg(feature = "cli")]
-mod sandbox_mode_cli_arg;
-
-#[cfg(feature = "cli")]
-pub use sandbox_mode_cli_arg::SandboxModeCliArg;
+pub use approval_mode_cli_arg::SandboxPermissionOption;
 
 #[cfg(any(feature = "cli", test))]
 mod config_override;
@@ -19,7 +15,12 @@ mod config_override;
 #[cfg(feature = "cli")]
 pub use config_override::CliConfigOverrides;
 
-mod sandbox_summary;
+// -------------------------------------------------------------------------
+//  Optional helpers for querying the list of available models.
+// -------------------------------------------------------------------------
 
-#[cfg(feature = "sandbox_summary")]
-pub use sandbox_summary::summarize_sandbox_policy;
+#[cfg(feature = "model-list")]
+mod model_list;
+
+#[cfg(feature = "model-list")]
+pub use model_list::fetch_available_models;

codex-rs/common/src/model_list.rs

@@ -0,0 +1,73 @@
+//! Helper for fetching the list of models that are available for a given
+//! [`ModelProviderInfo`] instance.
+//!
+//! The implementation is intentionally lightweight and only covers the subset
+//! of the OpenAI-compatible REST API that is required to discover available
+//! model *identifiers*.  At the time of writing all providers supported by
+//! Codex expose a `GET /models` endpoint that returns a JSON payload in the
+//! following canonical form:
+//!
+//! ```json
+//! {
+//!   "object": "list",
+//!   "data": [
+//!     { "id": "o3", "object": "model" },
+//!     { "id": "o4-mini", "object": "model" }
+//!   ]
+//! }
+//! ```
+//!
+//! We purposefully parse *only* the `id` fields that callers care about and
+//! ignore any additional metadata so that the function keeps working even if
+//! upstream providers add new attributes.
+
+use codex_core::ModelProviderInfo;
+use codex_core::error::CodexErr;
+use codex_core::error::Result;
+use serde::Deserialize;
+
+#[derive(Debug, Deserialize)]
+struct ModelsResponse {
+    data: Vec<ModelId>,
+}
+
+#[derive(Debug, Deserialize)]
+struct ModelId {
+    id: String,
+}
+
+/// Fetch the list of available model identifiers from the given provider.
+///
+/// The caller must ensure that the provider's API key can be resolved via
+/// [`ModelProviderInfo::api_key`] – if this fails the function returns a
+/// [`CodexErr::EnvVar`].  Any network or JSON parsing failures are forwarded
+/// to the caller.
+#[allow(clippy::needless_pass_by_value)]
+pub async fn fetch_available_models(provider: ModelProviderInfo) -> Result<Vec<String>> {
+    let api_key = provider.api_key()?;
+
+    let base_url = provider.base_url.trim_end_matches('/');
+    let url = format!("{base_url}/models");
+
+    // Build the request.  For providers that require authentication we send
+    // the token via the standard Bearer mechanism.  Providers like Ollama do
+    // not require a token – in that case we just omit the header.
+    let client = reqwest::Client::new();
+    let mut req = client.get(&url);
+    if let Some(token) = api_key {
+        req = req.bearer_auth(token);
+    }
+
+    let resp = req.send().await?;
+
+    match resp.error_for_status() {
+        Ok(ok_resp) => {
+            // Guaranteed 2xx
+            let json: ModelsResponse = ok_resp.json().await?;
+            let mut models: Vec<String> = json.data.into_iter().map(|m| m.id).collect();
+            models.sort();
+            Ok(models)
+        }
+        Err(err) => Err(CodexErr::Reqwest(err)),
+    }
+}

codex-rs/common/src/sandbox_mode_cli_arg.rs

@@ -1,28 +0,0 @@
-//! Standard type to use with the `--sandbox` (`-s`) CLI option.
-//!
-//! This mirrors the variants of [`codex_core::protocol::SandboxPolicy`], but
-//! without any of the associated data so it can be expressed as a simple flag
-//! on the command-line. Users that need to tweak the advanced options for
-//! `workspace-write` can continue to do so via `-c` overrides or their
-//! `config.toml`.
-
-use clap::ValueEnum;
-use codex_core::config_types::SandboxMode;
-
-#[derive(Clone, Copy, Debug, ValueEnum)]
-#[value(rename_all = "kebab-case")]
-pub enum SandboxModeCliArg {
-    ReadOnly,
-    WorkspaceWrite,
-    DangerFullAccess,
-}
-
-impl From<SandboxModeCliArg> for SandboxMode {
-    fn from(value: SandboxModeCliArg) -> Self {
-        match value {
-            SandboxModeCliArg::ReadOnly => SandboxMode::ReadOnly,
-            SandboxModeCliArg::WorkspaceWrite => SandboxMode::WorkspaceWrite,
-            SandboxModeCliArg::DangerFullAccess => SandboxMode::DangerFullAccess,
-        }
-    }
-}

codex-rs/common/src/sandbox_summary.rs

@@ -1,28 +0,0 @@
-use codex_core::protocol::SandboxPolicy;
-
-pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
-    match sandbox_policy {
-        SandboxPolicy::DangerFullAccess => "danger-full-access".to_string(),
-        SandboxPolicy::ReadOnly => "read-only".to_string(),
-        SandboxPolicy::WorkspaceWrite {
-            writable_roots,
-            network_access,
-        } => {
-            let mut summary = "workspace-write".to_string();
-            if !writable_roots.is_empty() {
-                summary.push_str(&format!(
-                    " [{}]",
-                    writable_roots
-                        .iter()
-                        .map(|p| p.to_string_lossy())
-                        .collect::<Vec<_>>()
-                        .join(", ")
-                ));
-            }
-            if *network_access {
-                summary.push_str(" (network access enabled)");
-            }
-            summary
-        }
-    }
-}

codex-rs/config.md

@@ -20,11 +20,41 @@ The model that Codex should use.
 model = "o3"  # overrides the default of "codex-mini-latest"
 ```
 
+## model_provider
+
+Codex comes bundled with a number of "model providers" predefined. This config value is a string that indicates which provider to use. You can also define your own providers via `model_providers`.
+
+For example, if you are running ollama with Mistral locally, then you would need to add the following to your config:
+
+```toml
+model = "mistral"
+model_provider = "ollama"
+```
+
+because the following definition for `ollama` is included in Codex:
+
+```toml
+[model_providers.ollama]
+name = "Ollama"
+base_url = "http://localhost:11434/v1"
+wire_api = "chat"
+```
+
+This option defaults to `"openai"` and the corresponding provider is defined as follows:
+
+```toml
+[model_providers.openai]
+name = "OpenAI"
+base_url = "https://api.openai.com/v1"
+env_key = "OPENAI_API_KEY"
+wire_api = "responses"
+```
+
 ## model_providers
 
-This option lets you override and amend the default set of model providers bundled with Codex. This value is a map where the key is the value to use with `model_provider` to select the corresponding provider.
+This option lets you override and amend the default set of model providers bundled with Codex. This value is a map where the key is the value to use with `model_provider` to select the correspodning provider.
 
-For example, if you wanted to add a provider that uses the OpenAI 4o model via the chat completions API, then you could add the following configuration:
+For example, if you wanted to add a provider that uses the OpenAI 4o model via the chat completions API, then you
 
 ```toml
 # Recall that in TOML, root keys must be listed before tables.
@@ -41,68 +71,8 @@ base_url = "https://api.openai.com/v1"
 # using Codex with this provider. The value of the environment variable must be
 # non-empty and will be used in the `Bearer TOKEN` HTTP header for the POST request.
 env_key = "OPENAI_API_KEY"
-# Valid values for wire_api are "chat" and "responses". Defaults to "chat" if omitted.
+# valid values for wire_api are "chat" and "responses".
 wire_api = "chat"
-# If necessary, extra query params that need to be added to the URL.
-# See the Azure example below.
-query_params = {}
-```
-
-Note this makes it possible to use Codex CLI with non-OpenAI models, so long as they use a wire API that is compatible with the OpenAI chat completions API. For example, you could define the following provider to use Codex CLI with Ollama running locally:
-
-```toml
-[model_providers.ollama]
-name = "Ollama"
-base_url = "http://localhost:11434/v1"
-```
-
-Or a third-party provider (using a distinct environment variable for the API key):
-
-```toml
-[model_providers.mistral]
-name = "Mistral"
-base_url = "https://api.mistral.ai/v1"
-env_key = "MISTRAL_API_KEY"
-```
-
-Note that Azure requires `api-version` to be passed as a query parameter, so be sure to specify it as part of `query_params` when defining the Azure provider:
-
-```toml
-[model_providers.azure]
-name = "Azure"
-# Make sure you set the appropriate subdomain for this URL.
-base_url = "https://YOUR_PROJECT_NAME.openai.azure.com/openai"
-env_key = "AZURE_OPENAI_API_KEY"  # Or "OPENAI_API_KEY", whichever you use.
-query_params = { api-version = "2025-04-01-preview" }
-```
-
-It is also possible to configure a provider to include extra HTTP headers with a request. These can be hardcoded values (`http_headers`) or values read from environment variables (`env_http_headers`):
-
-```toml
-[model_providers.example]
-# name, base_url, ...
-
-# This will add the HTTP header `X-Example-Header` with value `example-value`
-# to each request to the model provider.
-http_headers = { "X-Example-Header" = "example-value" }
-
-# This will add the HTTP header `X-Example-Features` with the value of the
-# `EXAMPLE_FEATURES` environment variable to each request to the model provider
-# _if_ the environment variable is set and its value is non-empty.
-env_http_headers = { "X-Example-Features": "EXAMPLE_FEATURES" }
-```
-
-## model_provider
-
-Identifies which provider to use from the `model_providers` map. Defaults to `"openai"`. You can override the `base_url` for the built-in `openai` provider via the `OPENAI_BASE_URL` environment variable.
-
-Note that if you override `model_provider`, then you likely want to override
-`model`, as well. For example, if you are running ollama with Mistral locally,
-then you would need to add the following to your config in addition to the new entry in the `model_providers` map:
-
-```toml
-model_provider = "ollama"
-model = "mistral"
 ```
 
 ## approval_policy
@@ -110,13 +80,8 @@ model = "mistral"
 Determines when the user should be prompted to approve whether Codex can execute a command:
 
 ```toml
-# Codex has hardcoded logic that defines a set of "trusted" commands.
-# Setting the approval_policy to `untrusted` means that Codex will prompt the
-# user before running a command not in the "trusted" set.
-#
-# See https://github.com/openai/codex/issues/1260 for the plan to enable
-# end-users to define their own trusted commands.
-approval_policy = "untrusted"
+# This is analogous to --suggest in the TypeScript Codex CLI
+approval_policy = "unless-allow-listed"
 ```
 
 ```toml
@@ -141,6 +106,7 @@ Here is an example of a `config.toml` that defines multiple profiles:
 ```toml
 model = "o3"
 approval_policy = "unless-allow-listed"
+sandbox_permissions = ["disk-full-read-access"]
 disable_response_storage = false
 
 # Setting `profile` is equivalent to specifying `--profile o3` on the command
@@ -157,8 +123,6 @@ wire_api = "chat"
 model = "o3"
 model_provider = "openai"
 approval_policy = "never"
-model_reasoning_effort = "high"
-model_reasoning_summary = "detailed"
 
 [profiles.gpt3]
 model = "gpt-3.5-turbo"
@@ -206,55 +170,31 @@ To disable reasoning summaries, set `model_reasoning_summary` to `"none"` in you
 model_reasoning_summary = "none"  # disable reasoning summaries
 ```
 
-## model_supports_reasoning_summaries
+## sandbox_permissions
 
-By default, `reasoning` is only set on requests to OpenAI models that are known to support them. To force `reasoning` to set on requests to the current model, you can force this behavior by setting the following in `config.toml`:
+List of permissions to grant to the sandbox that Codex uses to execute untrusted commands:
 
 ```toml
-model_supports_reasoning_summaries = true
+# This is comparable to --full-auto in the TypeScript Codex CLI, though
+# specifying `disk-write-platform-global-temp-folder` adds /tmp as a writable
+# folder in addition to $TMPDIR.
+sandbox_permissions = [
+    "disk-full-read-access",
+    "disk-write-platform-user-temp-folder",
+    "disk-write-platform-global-temp-folder",
+    "disk-write-cwd",
+]
 ```
 
-## sandbox_mode
-
-Codex executes model-generated shell commands inside an OS-level sandbox.
-
-In most cases you can pick the desired behaviour with a single option:
+To add additional writable folders, use `disk-write-folder`, which takes a parameter (this can be specified multiple times):
 
 ```toml
-# same as `--sandbox read-only`
-sandbox_mode = "read-only"
+sandbox_permissions = [
+    # ...
+    "disk-write-folder=/Users/mbolin/.pyenv/shims",
+]
 ```
 
-The default policy is `read-only`, which means commands can read any file on
-disk, but attempts to write a file or access the network will be blocked.
-
-A more relaxed policy is `workspace-write`. When specified, the current working directory for the Codex task will be writable (as well as `$TMPDIR` on macOS). Note that the CLI defaults to using the directory where it was spawned as `cwd`, though this can be overridden using `--cwd/-C`.
-
-```toml
-# same as `--sandbox workspace-write`
-sandbox_mode = "workspace-write"
-
-# Extra settings that only apply when `sandbox = "workspace-write"`.
-[sandbox_workspace_write]
-# By default, only the cwd for the Codex session will be writable (and $TMPDIR
-# on macOS), but you can specify additional writable folders in this array.
-writable_roots = ["/tmp"]
-# Allow the command being run inside the sandbox to make outbound network
-# requests. Disabled by default.
-network_access = false
-```
-
-To disable sandboxing altogether, specify `danger-full-access` like so:
-
-```toml
-# same as `--sandbox danger-full-access`
-sandbox_mode = "danger-full-access"
-```
-
-This is reasonable to use if Codex is running in an environment that provides its own sandboxing (such as a Docker container) such that further sandboxing is unnecessary.
-
-Though using this option may also be necessary if you try to use Codex in environments where its native sandboxing mechanisms are unsupported, such as older Linux kernels or on Windows.
-
 ## mcp_servers
 
 Defines the list of MCP servers that Codex can consult for tool use. Currently, only servers that are launched by executing a program that communicate over stdio are supported. For servers that use the SSE transport, consider an adapter like [mcp-proxy](https://github.com/sparfenyuk/mcp-proxy).
@@ -452,16 +392,6 @@ Setting `hide_agent_reasoning` to `true` suppresses these events in **both** the
 hide_agent_reasoning = true   # defaults to false
 ```
 
-## model_context_window
-
-The size of the context window for the model, in tokens.
-
-In general, Codex knows the context window for the most common OpenAI models, but if you are using a new model with an old version of the Codex CLI, then you can use `model_context_window` to tell Codex what value to use to determine how much context is left during a conversation.
-
-## model_max_output_tokens
-
-This is analogous to `model_context_window`, but for the maximum number of output tokens for the model.
-
 ## project_doc_max_bytes
 
 Maximum number of bytes to read from an `AGENTS.md` file to include in the instructions sent with the first turn of a session. Defaults to 32 KiB.

codex-rs/core/Cargo.toml

@@ -13,21 +13,26 @@ workspace = true
 [dependencies]
 anyhow = "1"
 async-channel = "2.3.1"
-base64 = "0.22"
+base64 = "0.21"
 bytes = "1.10.1"
 codex-apply-patch = { path = "../apply-patch" }
+codex-login = { path = "../login" }
 codex-mcp-client = { path = "../mcp-client" }
 dirs = "6"
 env-flags = "0.1.1"
 eventsource-stream = "0.2.3"
 fs2 = "0.4.3"
+fs-err = "3.1.0"
 futures = "0.3"
 mcp-types = { path = "../mcp-types" }
 mime_guess = "2.0"
+patch = "0.7"
+path-absolutize = "3.1.1"
 rand = "0.9"
 reqwest = { version = "0.12", features = ["json", "stream"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+strum = "0.27.1"
 strum_macros = "0.27.1"
 thiserror = "2.0.12"
 time = { version = "0.3", features = ["formatting", "local-offset", "macros"] }
@@ -39,10 +44,10 @@ tokio = { version = "1", features = [
     "signal",
 ] }
 tokio-util = "0.7.14"
-toml = "0.9.1"
+toml = "0.8.20"
 tracing = { version = "0.1.41", features = ["log"] }
 tree-sitter = "0.25.3"
-tree-sitter-bash = "0.25.0"
+tree-sitter-bash = "0.23.3"
 uuid = { version = "1", features = ["serde", "v4"] }
 wildmatch = "2.4.0"
 
@@ -64,5 +69,4 @@ maplit = "1.0.2"
 predicates = "3"
 pretty_assertions = "1.4.1"
 tempfile = "3"
-tokio-test = "0.4"
 wiremock = "0.6"

codex-rs/core/src/chat_completions.rs

@@ -114,18 +114,23 @@ pub(crate) async fn stream_chat_completions(
         "tools": tools_json,
     });
 
+    let base_url = provider.base_url.trim_end_matches('/');
+    let url = format!("{}/chat/completions", base_url);
+
     debug!(
-        "POST to {}: {}",
-        provider.get_full_url(),
+        "POST to {url}: {}",
         serde_json::to_string_pretty(&payload).unwrap_or_default()
     );
 
+    let api_key = provider.api_key()?;
     let mut attempt = 0;
     loop {
         attempt += 1;
 
-        let req_builder = provider.create_request_builder(client)?;
-
+        let mut req_builder = client.post(&url);
+        if let Some(api_key) = &api_key {
+            req_builder = req_builder.bearer_auth(api_key.clone());
+        }
         let res = req_builder
             .header(reqwest::header::ACCEPT, "text/event-stream")
             .json(&payload)
@@ -210,7 +215,6 @@ where
                 let _ = tx_event
                     .send(Ok(ResponseEvent::Completed {
                         response_id: String::new(),
-                        token_usage: None,
                     }))
                     .await;
                 return;
@@ -228,7 +232,6 @@ where
             let _ = tx_event
                 .send(Ok(ResponseEvent::Completed {
                     response_id: String::new(),
-                    token_usage: None,
                 }))
                 .await;
             return;
@@ -314,7 +317,6 @@ where
                 let _ = tx_event
                     .send(Ok(ResponseEvent::Completed {
                         response_id: String::new(),
-                        token_usage: None,
                     }))
                     .await;
 
@@ -392,10 +394,7 @@ where
                     // Not an assistant message – forward immediately.
                     return Poll::Ready(Some(Ok(ResponseEvent::OutputItemDone(item))));
                 }
-                Poll::Ready(Some(Ok(ResponseEvent::Completed {
-                    response_id,
-                    token_usage,
-                }))) => {
+                Poll::Ready(Some(Ok(ResponseEvent::Completed { response_id }))) => {
                     if !this.cumulative.is_empty() {
                         let aggregated_item = crate::models::ResponseItem::Message {
                             role: "assistant".to_string(),
@@ -405,10 +404,7 @@ where
                         };
 
                         // Buffer Completed so it is returned *after* the aggregated message.
-                        this.pending_completed = Some(ResponseEvent::Completed {
-                            response_id,
-                            token_usage,
-                        });
+                        this.pending_completed = Some(ResponseEvent::Completed { response_id });
 
                         return Poll::Ready(Some(Ok(ResponseEvent::OutputItemDone(
                             aggregated_item,
@@ -416,16 +412,8 @@ where
                     }
 
                     // Nothing aggregated – forward Completed directly.
-                    return Poll::Ready(Some(Ok(ResponseEvent::Completed {
-                        response_id,
-                        token_usage,
-                    })));
-                }
-                Poll::Ready(Some(Ok(ResponseEvent::Created))) => {
-                    // These events are exclusive to the Responses API and
-                    // will never appear in a Chat Completions stream.
-                    continue;
-                }
+                    return Poll::Ready(Some(Ok(ResponseEvent::Completed { response_id })));
+                } // No other `Ok` variants exist at the moment, continue polling.
             }
         }
     }
@@ -439,7 +427,7 @@ pub(crate) trait AggregateStreamExt: Stream<Item = Result<ResponseEvent>> + Size
     ///
     /// ```ignore
     ///     OutputItemDone(<full message>)
-    ///     Completed
+    ///     Completed { .. }
     /// ```
     ///
     /// No other `OutputItemDone` events will be seen by the caller.

codex-rs/core/src/client.rs

@@ -23,10 +23,10 @@ use crate::client_common::ResponseEvent;
 use crate::client_common::ResponseStream;
 use crate::client_common::ResponsesApiRequest;
 use crate::client_common::create_reasoning_param_for_request;
-use crate::config::Config;
 use crate::config_types::ReasoningEffort as ReasoningEffortConfig;
 use crate::config_types::ReasoningSummary as ReasoningSummaryConfig;
 use crate::error::CodexErr;
+use crate::error::EnvVarError;
 use crate::error::Result;
 use crate::flags::CODEX_RS_SSE_FIXTURE;
 use crate::flags::OPENAI_REQUEST_MAX_RETRIES;
@@ -35,13 +35,11 @@ use crate::model_provider_info::ModelProviderInfo;
 use crate::model_provider_info::WireApi;
 use crate::models::ResponseItem;
 use crate::openai_tools::create_tools_json_for_responses_api;
-use crate::protocol::TokenUsage;
 use crate::util::backoff;
-use std::sync::Arc;
 
 #[derive(Clone)]
 pub struct ModelClient {
-    config: Arc<Config>,
+    model: String,
     client: reqwest::Client,
     provider: ModelProviderInfo,
     effort: ReasoningEffortConfig,
@@ -50,13 +48,13 @@ pub struct ModelClient {
 
 impl ModelClient {
     pub fn new(
-        config: Arc<Config>,
+        model: impl ToString,
         provider: ModelProviderInfo,
         effort: ReasoningEffortConfig,
         summary: ReasoningSummaryConfig,
     ) -> Self {
         Self {
-            config,
+            model: model.to_string(),
             client: reqwest::Client::new(),
             provider,
             effort,
@@ -72,13 +70,9 @@ impl ModelClient {
             WireApi::Responses => self.stream_responses(prompt).await,
             WireApi::Chat => {
                 // Create the raw streaming connection first.
-                let response_stream = stream_chat_completions(
-                    prompt,
-                    &self.config.model,
-                    &self.client,
-                    &self.provider,
-                )
-                .await?;
+                let response_stream =
+                    stream_chat_completions(prompt, &self.model, &self.client, &self.provider)
+                        .await?;
 
                 // Wrap it with the aggregation adapter so callers see *only*
                 // the final assistant message per turn (matching the
@@ -112,11 +106,11 @@ impl ModelClient {
             return stream_from_fixture(path).await;
         }
 
-        let full_instructions = prompt.get_full_instructions(&self.config.model);
-        let tools_json = create_tools_json_for_responses_api(prompt, &self.config.model)?;
-        let reasoning = create_reasoning_param_for_request(&self.config, self.effort, self.summary);
+        let full_instructions = prompt.get_full_instructions(&self.model);
+        let tools_json = create_tools_json_for_responses_api(prompt, &self.model)?;
+        let reasoning = create_reasoning_param_for_request(&self.model, self.effort, self.summary);
         let payload = ResponsesApiRequest {
-            model: &self.config.model,
+            model: &self.model,
             instructions: &full_instructions,
             input: &prompt.input,
             tools: &tools_json,
@@ -128,24 +122,30 @@ impl ModelClient {
             stream: true,
         };
 
-        trace!(
-            "POST to {}: {}",
-            self.provider.get_full_url(),
-            serde_json::to_string(&payload)?
-        );
+        let base_url = self.provider.base_url.clone();
+        let base_url = base_url.trim_end_matches('/');
+        let url = format!("{}/responses", base_url);
+        trace!("POST to {url}: {}", serde_json::to_string(&payload)?);
 
         let mut attempt = 0;
         loop {
             attempt += 1;
 
-            let req_builder = self
-                .provider
-                .create_request_builder(&self.client)?
+            let api_key = self.provider.api_key()?.ok_or_else(|| {
+                CodexErr::EnvVar(EnvVarError {
+                    var: self.provider.env_key.clone().unwrap_or_default(),
+                    instructions: None,
+                })
+            })?;
+            let res = self
+                .client
+                .post(&url)
+                .bearer_auth(api_key)
                 .header("OpenAI-Beta", "responses=experimental")
                 .header(reqwest::header::ACCEPT, "text/event-stream")
-                .json(&payload);
-
-            let res = req_builder.send().await;
+                .json(&payload)
+                .send()
+                .await;
             match res {
                 Ok(resp) if resp.status().is_success() => {
                     let (tx_event, rx_event) = mpsc::channel::<Result<ResponseEvent>>(16);
@@ -167,7 +167,7 @@ impl ModelClient {
                     // negligible.
                     if !(status == StatusCode::TOO_MANY_REQUESTS || status.is_server_error()) {
                         // Surface the error body to callers. Use `unwrap_or_default` per Clippy.
-                        let body = res.text().await.unwrap_or_default();
+                        let body = (res.text().await).unwrap_or_default();
                         return Err(CodexErr::UnexpectedStatus(status, body));
                     }
 
@@ -207,44 +207,9 @@ struct SseEvent {
     item: Option<Value>,
 }
 
-#[derive(Debug, Deserialize)]
-struct ResponseCreated {}
-
 #[derive(Debug, Deserialize)]
 struct ResponseCompleted {
     id: String,
-    usage: Option<ResponseCompletedUsage>,
-}
-
-#[derive(Debug, Deserialize)]
-struct ResponseCompletedUsage {
-    input_tokens: u64,
-    input_tokens_details: Option<ResponseCompletedInputTokensDetails>,
-    output_tokens: u64,
-    output_tokens_details: Option<ResponseCompletedOutputTokensDetails>,
-    total_tokens: u64,
-}
-
-impl From<ResponseCompletedUsage> for TokenUsage {
-    fn from(val: ResponseCompletedUsage) -> Self {
-        TokenUsage {
-            input_tokens: val.input_tokens,
-            cached_input_tokens: val.input_tokens_details.map(|d| d.cached_tokens),
-            output_tokens: val.output_tokens,
-            reasoning_output_tokens: val.output_tokens_details.map(|d| d.reasoning_tokens),
-            total_tokens: val.total_tokens,
-        }
-    }
-}
-
-#[derive(Debug, Deserialize)]
-struct ResponseCompletedInputTokensDetails {
-    cached_tokens: u64,
-}
-
-#[derive(Debug, Deserialize)]
-struct ResponseCompletedOutputTokensDetails {
-    reasoning_tokens: u64,
 }
 
 async fn process_sse<S>(stream: S, tx_event: mpsc::Sender<Result<ResponseEvent>>)
@@ -256,7 +221,7 @@ where
     // If the stream stays completely silent for an extended period treat it as disconnected.
     let idle_timeout = *OPENAI_STREAM_IDLE_TIMEOUT_MS;
     // The response id returned from the "complete" message.
-    let mut response_completed: Option<ResponseCompleted> = None;
+    let mut response_id = None;
 
     loop {
         let sse = match timeout(idle_timeout, stream.next()).await {
@@ -268,15 +233,9 @@ where
                 return;
             }
             Ok(None) => {
-                match response_completed {
-                    Some(ResponseCompleted {
-                        id: response_id,
-                        usage,
-                    }) => {
-                        let event = ResponseEvent::Completed {
-                            response_id,
-                            token_usage: usage.map(Into::into),
-                        };
+                match response_id {
+                    Some(response_id) => {
+                        let event = ResponseEvent::Completed { response_id };
                         let _ = tx_event.send(Ok(event)).await;
                     }
                     None => {
@@ -337,17 +296,12 @@ where
                     return;
                 }
             }
-            "response.created" => {
-                if event.response.is_some() {
-                    let _ = tx_event.send(Ok(ResponseEvent::Created {})).await;
-                }
-            }
             // Final response completed – includes array of output items & id
             "response.completed" => {
                 if let Some(resp_val) = event.response {
                     match serde_json::from_value::<ResponseCompleted>(resp_val) {
                         Ok(r) => {
-                            response_completed = Some(r);
+                            response_id = Some(r.id);
                         }
                         Err(e) => {
                             debug!("failed to parse ResponseCompleted: {e}");
@@ -357,6 +311,7 @@ where
                 };
             }
             "response.content_part.done"
+            | "response.created"
             | "response.function_call_arguments.delta"
             | "response.in_progress"
             | "response.output_item.added"
@@ -391,241 +346,3 @@ async fn stream_from_fixture(path: impl AsRef<Path>) -> Result<ResponseStream> {
     tokio::spawn(process_sse(stream, tx_event));
     Ok(ResponseStream { rx_event })
 }
-
-#[cfg(test)]
-mod tests {
-    #![allow(clippy::expect_used, clippy::unwrap_used)]
-
-    use super::*;
-    use serde_json::json;
-    use tokio::sync::mpsc;
-    use tokio_test::io::Builder as IoBuilder;
-    use tokio_util::io::ReaderStream;
-
-    // ────────────────────────────
-    // Helpers
-    // ────────────────────────────
-
-    /// Runs the SSE parser on pre-chunked byte slices and returns every event
-    /// (including any final `Err` from a stream-closure check).
-    async fn collect_events(chunks: &[&[u8]]) -> Vec<Result<ResponseEvent>> {
-        let mut builder = IoBuilder::new();
-        for chunk in chunks {
-            builder.read(chunk);
-        }
-
-        let reader = builder.build();
-        let stream = ReaderStream::new(reader).map_err(CodexErr::Io);
-        let (tx, mut rx) = mpsc::channel::<Result<ResponseEvent>>(16);
-        tokio::spawn(process_sse(stream, tx));
-
-        let mut events = Vec::new();
-        while let Some(ev) = rx.recv().await {
-            events.push(ev);
-        }
-        events
-    }
-
-    /// Builds an in-memory SSE stream from JSON fixtures and returns only the
-    /// successfully parsed events (panics on internal channel errors).
-    async fn run_sse(events: Vec<serde_json::Value>) -> Vec<ResponseEvent> {
-        let mut body = String::new();
-        for e in events {
-            let kind = e
-                .get("type")
-                .and_then(|v| v.as_str())
-                .expect("fixture event missing type");
-            if e.as_object().map(|o| o.len() == 1).unwrap_or(false) {
-                body.push_str(&format!("event: {kind}\n\n"));
-            } else {
-                body.push_str(&format!("event: {kind}\ndata: {e}\n\n"));
-            }
-        }
-
-        let (tx, mut rx) = mpsc::channel::<Result<ResponseEvent>>(8);
-        let stream = ReaderStream::new(std::io::Cursor::new(body)).map_err(CodexErr::Io);
-        tokio::spawn(process_sse(stream, tx));
-
-        let mut out = Vec::new();
-        while let Some(ev) = rx.recv().await {
-            out.push(ev.expect("channel closed"));
-        }
-        out
-    }
-
-    // ────────────────────────────
-    // Tests from `implement-test-for-responses-api-sse-parser`
-    // ────────────────────────────
-
-    #[tokio::test]
-    async fn parses_items_and_completed() {
-        let item1 = json!({
-            "type": "response.output_item.done",
-            "item": {
-                "type": "message",
-                "role": "assistant",
-                "content": [{"type": "output_text", "text": "Hello"}]
-            }
-        })
-        .to_string();
-
-        let item2 = json!({
-            "type": "response.output_item.done",
-            "item": {
-                "type": "message",
-                "role": "assistant",
-                "content": [{"type": "output_text", "text": "World"}]
-            }
-        })
-        .to_string();
-
-        let completed = json!({
-            "type": "response.completed",
-            "response": { "id": "resp1" }
-        })
-        .to_string();
-
-        let sse1 = format!("event: response.output_item.done\ndata: {item1}\n\n");
-        let sse2 = format!("event: response.output_item.done\ndata: {item2}\n\n");
-        let sse3 = format!("event: response.completed\ndata: {completed}\n\n");
-
-        let events = collect_events(&[sse1.as_bytes(), sse2.as_bytes(), sse3.as_bytes()]).await;
-
-        assert_eq!(events.len(), 3);
-
-        matches!(
-            &events[0],
-            Ok(ResponseEvent::OutputItemDone(ResponseItem::Message { role, .. }))
-                if role == "assistant"
-        );
-
-        matches!(
-            &events[1],
-            Ok(ResponseEvent::OutputItemDone(ResponseItem::Message { role, .. }))
-                if role == "assistant"
-        );
-
-        match &events[2] {
-            Ok(ResponseEvent::Completed {
-                response_id,
-                token_usage,
-            }) => {
-                assert_eq!(response_id, "resp1");
-                assert!(token_usage.is_none());
-            }
-            other => panic!("unexpected third event: {other:?}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn error_when_missing_completed() {
-        let item1 = json!({
-            "type": "response.output_item.done",
-            "item": {
-                "type": "message",
-                "role": "assistant",
-                "content": [{"type": "output_text", "text": "Hello"}]
-            }
-        })
-        .to_string();
-
-        let sse1 = format!("event: response.output_item.done\ndata: {item1}\n\n");
-
-        let events = collect_events(&[sse1.as_bytes()]).await;
-
-        assert_eq!(events.len(), 2);
-
-        matches!(events[0], Ok(ResponseEvent::OutputItemDone(_)));
-
-        match &events[1] {
-            Err(CodexErr::Stream(msg)) => {
-                assert_eq!(msg, "stream closed before response.completed")
-            }
-            other => panic!("unexpected second event: {other:?}"),
-        }
-    }
-
-    // ────────────────────────────
-    // Table-driven test from `main`
-    // ────────────────────────────
-
-    /// Verifies that the adapter produces the right `ResponseEvent` for a
-    /// variety of incoming `type` values.
-    #[tokio::test]
-    async fn table_driven_event_kinds() {
-        struct TestCase {
-            name: &'static str,
-            event: serde_json::Value,
-            expect_first: fn(&ResponseEvent) -> bool,
-            expected_len: usize,
-        }
-
-        fn is_created(ev: &ResponseEvent) -> bool {
-            matches!(ev, ResponseEvent::Created)
-        }
-        fn is_output(ev: &ResponseEvent) -> bool {
-            matches!(ev, ResponseEvent::OutputItemDone(_))
-        }
-        fn is_completed(ev: &ResponseEvent) -> bool {
-            matches!(ev, ResponseEvent::Completed { .. })
-        }
-
-        let completed = json!({
-            "type": "response.completed",
-            "response": {
-                "id": "c",
-                "usage": {
-                    "input_tokens": 0,
-                    "input_tokens_details": null,
-                    "output_tokens": 0,
-                    "output_tokens_details": null,
-                    "total_tokens": 0
-                },
-                "output": []
-            }
-        });
-
-        let cases = vec![
-            TestCase {
-                name: "created",
-                event: json!({"type": "response.created", "response": {}}),
-                expect_first: is_created,
-                expected_len: 2,
-            },
-            TestCase {
-                name: "output_item.done",
-                event: json!({
-                    "type": "response.output_item.done",
-                    "item": {
-                        "type": "message",
-                        "role": "assistant",
-                        "content": [
-                            {"type": "output_text", "text": "hi"}
-                        ]
-                    }
-                }),
-                expect_first: is_output,
-                expected_len: 2,
-            },
-            TestCase {
-                name: "unknown",
-                event: json!({"type": "response.new_tool_event"}),
-                expect_first: is_completed,
-                expected_len: 1,
-            },
-        ];
-
-        for case in cases {
-            let mut evs = vec![case.event];
-            evs.push(completed.clone());
-
-            let out = run_sse(evs).await;
-            assert_eq!(out.len(), case.expected_len, "case {}", case.name);
-            assert!(
-                (case.expect_first)(&out[0]),
-                "first event mismatch in case {}",
-                case.name
-            );
-        }
-    }
-}

codex-rs/core/src/client_common.rs

@@ -2,7 +2,6 @@ use crate::config_types::ReasoningEffort as ReasoningEffortConfig;
 use crate::config_types::ReasoningSummary as ReasoningSummaryConfig;
 use crate::error::Result;
 use crate::models::ResponseItem;
-use crate::protocol::TokenUsage;
 use codex_apply_patch::APPLY_PATCH_TOOL_INSTRUCTIONS;
 use futures::Stream;
 use serde::Serialize;
@@ -37,7 +36,7 @@ pub struct Prompt {
 }
 
 impl Prompt {
-    pub(crate) fn get_full_instructions(&self, model: &str) -> Cow<'_, str> {
+    pub(crate) fn get_full_instructions(&self, model: &str) -> Cow<str> {
         let mut sections: Vec<&str> = vec![BASE_INSTRUCTIONS];
         if let Some(ref user) = self.user_instructions {
             sections.push(user);
@@ -51,12 +50,8 @@ impl Prompt {
 
 #[derive(Debug)]
 pub enum ResponseEvent {
-    Created,
     OutputItemDone(ResponseItem),
-    Completed {
-        response_id: String,
-        token_usage: Option<TokenUsage>,
-    },
+    Completed { response_id: String },
 }
 
 #[derive(Debug, Serialize)]
@@ -131,16 +126,15 @@ pub(crate) struct ResponsesApiRequest<'a> {
     pub(crate) stream: bool,
 }
 
-use crate::config::Config;
-
 pub(crate) fn create_reasoning_param_for_request(
-    config: &Config,
+    model: &str,
     effort: ReasoningEffortConfig,
     summary: ReasoningSummaryConfig,
 ) -> Option<Reasoning> {
-    if model_supports_reasoning_summaries(config) {
-        let effort: Option<OpenAiReasoningEffort> = effort.into();
-        let effort = effort?;
+    let effort: Option<OpenAiReasoningEffort> = effort.into();
+    let effort = effort?;
+
+    if model_supports_reasoning_summaries(model) {
         Some(Reasoning {
             effort,
             summary: summary.into(),
@@ -150,24 +144,19 @@ pub(crate) fn create_reasoning_param_for_request(
     }
 }
 
-pub fn model_supports_reasoning_summaries(config: &Config) -> bool {
-    // Currently, we hardcode this rule to decide whether to enable reasoning.
+pub fn model_supports_reasoning_summaries(model: &str) -> bool {
+    // Currently, we hardcode this rule to decide whether enable reasoning.
     // We expect reasoning to apply only to OpenAI models, but we do not want
     // users to have to mess with their config to disable reasoning for models
     // that do not support it, such as `gpt-4.1`.
     //
     // Though if a user is using Codex with non-OpenAI models that, say, happen
-    // to start with "o", then they can set `model_reasoning_effort = "none"` in
+    // to start with "o", then they can set `model_reasoning_effort = "none` in
     // config.toml to disable reasoning.
     //
-    // Converseley, if a user has a non-OpenAI provider that supports reasoning,
-    // they can set the top-level `model_supports_reasoning_summaries = true`
-    // config option to enable reasoning.
-    if config.model_supports_reasoning_summaries {
-        return true;
-    }
-
-    let model = &config.model;
+    // Ultimately, this should also be configurable in config.toml, but we
+    // need to have defaults that "just work." Perhaps we could have a
+    // "reasoning models pattern" as part of ModelProviderInfo?
     model.starts_with("o") || model.starts_with("codex")
 }
 

codex-rs/core/src/codex.rs

@@ -1,7 +1,6 @@
 // Poisoned mutex should fail the program
 #![allow(clippy::unwrap_used)]
 
-use std::borrow::Cow;
 use std::collections::HashMap;
 use std::collections::HashSet;
 use std::path::Path;
@@ -189,7 +188,7 @@ pub(crate) struct Session {
 
     /// Optional rollout recorder for persisting the conversation transcript so
     /// sessions can be replayed or inspected later.
-    rollout: Mutex<Option<RolloutRecorder>>,
+    rollout: Mutex<Option<crate::rollout::RolloutRecorder>>,
     state: Mutex<State>,
     codex_linux_sandbox_exe: Option<PathBuf>,
 }
@@ -207,9 +206,6 @@ impl Session {
 struct State {
     approved_commands: HashSet<Vec<String>>,
     current_task: Option<AgentTask>,
-    /// Call IDs that have been sent from the Responses API but have not been sent back yet.
-    /// You CANNOT send a Responses API follow-up message unless you have sent back the output for all pending calls or else it will 400.
-    pending_call_ids: HashSet<String>,
     previous_response_id: Option<String>,
     pending_approvals: HashMap<String, oneshot::Sender<ReviewDecision>>,
     pending_input: Vec<ResponseInputItem>,
@@ -316,7 +312,7 @@ impl Session {
     /// Append the given items to the session's rollout transcript (if enabled)
     /// and persist them to disk.
     async fn record_rollout_items(&self, items: &[ResponseItem]) {
-        // Clone the recorder outside of the mutex so we don't hold the lock
+        // Clone the recorder outside of the mutex so we don’t hold the lock
         // across an await point (MutexGuard is not Send).
         let recorder = {
             let guard = self.rollout.lock().unwrap();
@@ -415,8 +411,6 @@ impl Session {
     pub fn abort(&self) {
         info!("Aborting existing session");
         let mut state = self.state.lock().unwrap();
-        // Don't clear pending_call_ids because we need to keep track of them to ensure we don't 400 on the next turn.
-        // We will generate a synthetic aborted response for each pending call id.
         state.pending_approvals.clear();
         state.pending_input.clear();
         if let Some(task) = state.current_task.take() {
@@ -437,7 +431,7 @@ impl Session {
         }
 
         let Ok(json) = serde_json::to_string(&notification) else {
-            error!("failed to serialise notification payload");
+            tracing::error!("failed to serialise notification payload");
             return;
         };
 
@@ -449,7 +443,7 @@ impl Session {
 
         // Fire-and-forget – we do not wait for completion.
         if let Err(e) = command.spawn() {
-            warn!("failed to spawn notifier '{}': {e}", notify_command[0]);
+            tracing::warn!("failed to spawn notifier '{}': {e}", notify_command[0]);
         }
     }
 }
@@ -586,7 +580,7 @@ async fn submission_loop(
                 }
 
                 let client = ModelClient::new(
-                    config.clone(),
+                    model.clone(),
                     provider.clone(),
                     model_reasoning_effort,
                     model_reasoning_summary,
@@ -653,7 +647,7 @@ async fn submission_loop(
                     match RolloutRecorder::new(&config, session_id, instructions.clone()).await {
                         Ok(r) => Some(r),
                         Err(e) => {
-                            warn!("failed to initialise rollout recorder: {e}");
+                            tracing::warn!("failed to initialise rollout recorder: {e}");
                             None
                         }
                     };
@@ -748,7 +742,7 @@ async fn submission_loop(
                 tokio::spawn(async move {
                     if let Err(e) = crate::message_history::append_entry(&text, &id, &config).await
                     {
-                        warn!("failed to append to message history: {e}");
+                        tracing::warn!("failed to append to message history: {e}");
                     }
                 });
             }
@@ -778,7 +772,7 @@ async fn submission_loop(
                     };
 
                     if let Err(e) = tx_event.send(event).await {
-                        warn!("failed to send GetHistoryEntryResponse event: {e}");
+                        tracing::warn!("failed to send GetHistoryEntryResponse event: {e}");
                     }
                 });
             }
@@ -1058,7 +1052,6 @@ async fn run_turn(
 /// events map to a `ResponseItem`. A `ResponseItem` may need to be
 /// "handled" such that it produces a `ResponseInputItem` that needs to be
 /// sent back to the model on the next turn.
-#[derive(Debug)]
 struct ProcessedResponseItem {
     item: ResponseItem,
     response: Option<ResponseInputItem>,
@@ -1069,57 +1062,7 @@ async fn try_run_turn(
     sub_id: &str,
     prompt: &Prompt,
 ) -> CodexResult<Vec<ProcessedResponseItem>> {
-    // call_ids that are part of this response.
-    let completed_call_ids = prompt
-        .input
-        .iter()
-        .filter_map(|ri| match ri {
-            ResponseItem::FunctionCallOutput { call_id, .. } => Some(call_id),
-            ResponseItem::LocalShellCall {
-                call_id: Some(call_id),
-                ..
-            } => Some(call_id),
-            _ => None,
-        })
-        .collect::<Vec<_>>();
-
-    // call_ids that were pending but are not part of this response.
-    // This usually happens because the user interrupted the model before we responded to one of its tool calls
-    // and then the user sent a follow-up message.
-    let missing_calls = {
-        sess.state
-            .lock()
-            .unwrap()
-            .pending_call_ids
-            .iter()
-            .filter_map(|call_id| {
-                if completed_call_ids.contains(&call_id) {
-                    None
-                } else {
-                    Some(call_id.clone())
-                }
-            })
-            .map(|call_id| ResponseItem::FunctionCallOutput {
-                call_id: call_id.clone(),
-                output: FunctionCallOutputPayload {
-                    content: "aborted".to_string(),
-                    success: Some(false),
-                },
-            })
-            .collect::<Vec<_>>()
-    };
-    let prompt: Cow<Prompt> = if missing_calls.is_empty() {
-        Cow::Borrowed(prompt)
-    } else {
-        // Add the synthetic aborted missing calls to the beginning of the input to ensure all call ids have responses.
-        let input = [missing_calls, prompt.input.clone()].concat();
-        Cow::Owned(Prompt {
-            input,
-            ..prompt.clone()
-        })
-    };
-
-    let mut stream = sess.client.clone().stream(&prompt).await?;
+    let mut stream = sess.client.clone().stream(prompt).await?;
 
     // Buffer all the incoming messages from the stream first, then execute them.
     // If we execute a function call in the middle of handling the stream, it can time out.
@@ -1131,43 +1074,11 @@ async fn try_run_turn(
     let mut output = Vec::new();
     for event in input {
         match event {
-            ResponseEvent::Created => {
-                let mut state = sess.state.lock().unwrap();
-                // We successfully created a new response and ensured that all pending calls were included so we can clear the pending call ids.
-                state.pending_call_ids.clear();
-            }
             ResponseEvent::OutputItemDone(item) => {
-                let call_id = match &item {
-                    ResponseItem::LocalShellCall {
-                        call_id: Some(call_id),
-                        ..
-                    } => Some(call_id),
-                    ResponseItem::FunctionCall { call_id, .. } => Some(call_id),
-                    _ => None,
-                };
-                if let Some(call_id) = call_id {
-                    // We just got a new call id so we need to make sure to respond to it in the next turn.
-                    let mut state = sess.state.lock().unwrap();
-                    state.pending_call_ids.insert(call_id.clone());
-                }
                 let response = handle_response_item(sess, sub_id, item.clone()).await?;
-
                 output.push(ProcessedResponseItem { item, response });
             }
-            ResponseEvent::Completed {
-                response_id,
-                token_usage,
-            } => {
-                if let Some(token_usage) = token_usage {
-                    sess.tx_event
-                        .send(Event {
-                            id: sub_id.to_string(),
-                            msg: EventMsg::TokenCount(token_usage),
-                        })
-                        .await
-                        .ok();
-                }
-
+            ResponseEvent::Completed { response_id } => {
                 let mut state = sess.state.lock().unwrap();
                 state.previous_response_id = Some(response_id);
                 break;
@@ -1214,7 +1125,7 @@ async fn handle_response_item(
             arguments,
             call_id,
         } => {
-            info!("FunctionCall: {arguments}");
+            tracing::info!("FunctionCall: {arguments}");
             Some(handle_function_call(sess, sub_id.to_string(), name, arguments, call_id).await)
         }
         ResponseItem::LocalShellCall {
@@ -1296,8 +1207,8 @@ async fn handle_function_call(
                     // Unknown function: reply with structured failure so the model can adapt.
                     ResponseInputItem::FunctionCallOutput {
                         call_id,
-                        output: FunctionCallOutputPayload {
-                            content: format!("unsupported call: {name}"),
+                        output: crate::models::FunctionCallOutputPayload {
+                            content: format!("unsupported call: {}", name),
                             success: None,
                         },
                     }
@@ -1328,7 +1239,7 @@ fn parse_container_exec_arguments(
             // allow model to re-sample
             let output = ResponseInputItem::FunctionCallOutput {
                 call_id: call_id.to_string(),
-                output: FunctionCallOutputPayload {
+                output: crate::models::FunctionCallOutputPayload {
                     content: format!("failed to parse function arguments: {e}"),
                     success: None,
                 },
@@ -1396,7 +1307,7 @@ async fn handle_container_exec_with_params(
                 ReviewDecision::Denied | ReviewDecision::Abort => {
                     return ResponseInputItem::FunctionCallOutput {
                         call_id,
-                        output: FunctionCallOutputPayload {
+                        output: crate::models::FunctionCallOutputPayload {
                             content: "exec command rejected by user".to_string(),
                             success: None,
                         },
@@ -1412,7 +1323,7 @@ async fn handle_container_exec_with_params(
         SafetyCheck::Reject { reason } => {
             return ResponseInputItem::FunctionCallOutput {
                 call_id,
-                output: FunctionCallOutputPayload {
+                output: crate::models::FunctionCallOutputPayload {
                     content: format!("exec command rejected: {reason}"),
                     success: None,
                 },
@@ -1460,7 +1371,7 @@ async fn handle_container_exec_with_params(
             }
         }
         Err(CodexErr::Sandbox(error)) => {
-            handle_sandbox_error(error, sandbox_type, params, sess, sub_id, call_id).await
+            handle_sanbox_error(error, sandbox_type, params, sess, sub_id, call_id).await
         }
         Err(e) => {
             // Handle non-sandbox errors
@@ -1475,7 +1386,7 @@ async fn handle_container_exec_with_params(
     }
 }
 
-async fn handle_sandbox_error(
+async fn handle_sanbox_error(
     error: SandboxErr,
     sandbox_type: SandboxType,
     params: ExecParams,
@@ -1489,21 +1400,15 @@ async fn handle_sandbox_error(
             call_id,
             output: FunctionCallOutputPayload {
                 content: format!(
-                    "failed in sandbox {sandbox_type:?} with execution error: {error}"
+                    "failed in sandbox {:?} with execution error: {error}",
+                    sandbox_type
                 ),
                 success: Some(false),
             },
         };
     }
 
-    // Note that when `error` is `SandboxErr::Denied`, it could be a false
-    // positive. That is, it may have exited with a non-zero exit code, not
-    // because the sandbox denied it, but because that is its expected behavior,
-    // i.e., a grep command that did not match anything. Ideally we would
-    // include additional metadata on the command to indicate whether non-zero
-    // exit codes merit a retry.
-
-    // For now, we categorically ask the user to retry without sandbox.
+    // Ask the user to retry without sandbox
     sess.notify_background_event(&sub_id, format!("Execution failed: {error}"))
         .await;
 
@@ -1945,7 +1850,7 @@ fn apply_changes_from_apply_patch(action: &ApplyPatchAction) -> anyhow::Result<A
     })
 }
 
-fn get_writable_roots(cwd: &Path) -> Vec<PathBuf> {
+fn get_writable_roots(cwd: &Path) -> Vec<std::path::PathBuf> {
     let mut writable_roots = Vec::new();
     if cfg!(target_os = "macos") {
         // On macOS, $TMPDIR is private to the user.
@@ -1973,7 +1878,7 @@ fn get_writable_roots(cwd: &Path) -> Vec<PathBuf> {
 }
 
 /// Exec output is a pre-serialized JSON payload
-fn format_exec_output(output: &str, exit_code: i32, duration: Duration) -> String {
+fn format_exec_output(output: &str, exit_code: i32, duration: std::time::Duration) -> String {
     #[derive(Serialize)]
     struct ExecMetadata {
         exit_code: i32,

codex-rs/core/src/config.rs

@@ -3,8 +3,6 @@ use crate::config_types::History;
 use crate::config_types::McpServerConfig;
 use crate::config_types::ReasoningEffort;
 use crate::config_types::ReasoningSummary;
-use crate::config_types::SandboxMode;
-use crate::config_types::SandboxWorkplaceWrite;
 use crate::config_types::ShellEnvironmentPolicy;
 use crate::config_types::ShellEnvironmentPolicyToml;
 use crate::config_types::Tui;
@@ -12,8 +10,8 @@ use crate::config_types::UriBasedFileOpener;
 use crate::flags::OPENAI_DEFAULT_MODEL;
 use crate::model_provider_info::ModelProviderInfo;
 use crate::model_provider_info::built_in_model_providers;
-use crate::openai_model_info::get_model_info;
 use crate::protocol::AskForApproval;
+use crate::protocol::SandboxPermission;
 use crate::protocol::SandboxPolicy;
 use dirs::home_dir;
 use serde::Deserialize;
@@ -33,12 +31,6 @@ pub struct Config {
     /// Optional override of model selection.
     pub model: String,
 
-    /// Size of the context window for the model, in tokens.
-    pub model_context_window: Option<u64>,
-
-    /// Maximum number of output tokens.
-    pub model_max_output_tokens: Option<u64>,
-
     /// Key into the model_providers map that specifies which provider to use.
     pub model_provider_id: String,
 
@@ -130,13 +122,6 @@ pub struct Config {
     /// If not "none", the value to use for `reasoning.summary` when making a
     /// request using the Responses API.
     pub model_reasoning_summary: ReasoningSummary,
-
-    /// When set to `true`, overrides the default heuristic and forces
-    /// `model_supports_reasoning_summaries()` to return `true`.
-    pub model_supports_reasoning_summaries: bool,
-
-    /// Base URL for requests to ChatGPT (as opposed to the OpenAI API).
-    pub chatgpt_base_url: String,
 }
 
 impl Config {
@@ -250,23 +235,17 @@ pub struct ConfigToml {
     /// Provider to use from the model_providers map.
     pub model_provider: Option<String>,
 
-    /// Size of the context window for the model, in tokens.
-    pub model_context_window: Option<u64>,
-
-    /// Maximum number of output tokens.
-    pub model_max_output_tokens: Option<u64>,
-
     /// Default approval policy for executing commands.
     pub approval_policy: Option<AskForApproval>,
 
     #[serde(default)]
     pub shell_environment_policy: ShellEnvironmentPolicyToml,
 
-    /// Sandbox mode to use.
-    pub sandbox_mode: Option<SandboxMode>,
-
-    /// Sandbox configuration to apply if `sandbox` is `WorkspaceWrite`.
-    pub sandbox_workspace_write: Option<SandboxWorkplaceWrite>,
+    // The `default` attribute ensures that the field is treated as `None` when
+    // the key is omitted from the TOML. Without it, Serde treats the field as
+    // required because we supply a custom deserializer.
+    #[serde(default, deserialize_with = "deserialize_sandbox_permissions")]
+    pub sandbox_permissions: Option<Vec<SandboxPermission>>,
 
     /// Disable server-side response storage (sends the full conversation
     /// context with every request). Currently necessary for OpenAI customers
@@ -315,31 +294,31 @@ pub struct ConfigToml {
 
     pub model_reasoning_effort: Option<ReasoningEffort>,
     pub model_reasoning_summary: Option<ReasoningSummary>,
-
-    /// Override to force-enable reasoning summaries for the configured model.
-    pub model_supports_reasoning_summaries: Option<bool>,
-
-    /// Base URL for requests to ChatGPT (as opposed to the OpenAI API).
-    pub chatgpt_base_url: Option<String>,
 }
 
-impl ConfigToml {
-    /// Derive the effective sandbox policy from the configuration.
-    fn derive_sandbox_policy(&self, sandbox_mode_override: Option<SandboxMode>) -> SandboxPolicy {
-        let resolved_sandbox_mode = sandbox_mode_override
-            .or(self.sandbox_mode)
-            .unwrap_or_default();
-        match resolved_sandbox_mode {
-            SandboxMode::ReadOnly => SandboxPolicy::new_read_only_policy(),
-            SandboxMode::WorkspaceWrite => match self.sandbox_workspace_write.as_ref() {
-                Some(s) => SandboxPolicy::WorkspaceWrite {
-                    writable_roots: s.writable_roots.clone(),
-                    network_access: s.network_access,
-                },
-                None => SandboxPolicy::new_workspace_write_policy(),
-            },
-            SandboxMode::DangerFullAccess => SandboxPolicy::DangerFullAccess,
+fn deserialize_sandbox_permissions<'de, D>(
+    deserializer: D,
+) -> Result<Option<Vec<SandboxPermission>>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    let permissions: Option<Vec<String>> = Option::deserialize(deserializer)?;
+
+    match permissions {
+        Some(raw_permissions) => {
+            let base_path = find_codex_home().map_err(serde::de::Error::custom)?;
+
+            let converted = raw_permissions
+                .into_iter()
+                .map(|raw| {
+                    parse_sandbox_permission_with_base_path(&raw, base_path.clone())
+                        .map_err(serde::de::Error::custom)
+                })
+                .collect::<Result<Vec<_>, D::Error>>()?;
+
+            Ok(Some(converted))
         }
+        None => Ok(None),
     }
 }
 
@@ -349,7 +328,7 @@ pub struct ConfigOverrides {
     pub model: Option<String>,
     pub cwd: Option<PathBuf>,
     pub approval_policy: Option<AskForApproval>,
-    pub sandbox_mode: Option<SandboxMode>,
+    pub sandbox_policy: Option<SandboxPolicy>,
     pub model_provider: Option<String>,
     pub config_profile: Option<String>,
     pub codex_linux_sandbox_exe: Option<PathBuf>,
@@ -370,16 +349,16 @@ impl Config {
             model,
             cwd,
             approval_policy,
-            sandbox_mode,
+            sandbox_policy,
             model_provider,
             config_profile: config_profile_key,
             codex_linux_sandbox_exe,
         } = overrides;
 
-        let config_profile = match config_profile_key.as_ref().or(cfg.profile.as_ref()) {
+        let config_profile = match config_profile_key.or(cfg.profile) {
             Some(key) => cfg
                 .profiles
-                .get(key)
+                .get(&key)
                 .ok_or_else(|| {
                     std::io::Error::new(
                         std::io::ErrorKind::NotFound,
@@ -390,7 +369,20 @@ impl Config {
             None => ConfigProfile::default(),
         };
 
-        let sandbox_policy = cfg.derive_sandbox_policy(sandbox_mode);
+        let sandbox_policy = match sandbox_policy {
+            Some(sandbox_policy) => sandbox_policy,
+            None => {
+                // Derive a SandboxPolicy from the permissions in the config.
+                match cfg.sandbox_permissions {
+                    // Note this means the user can explicitly set permissions
+                    // to the empty list in the config file, granting it no
+                    // permissions whatsoever.
+                    Some(permissions) => SandboxPolicy::from(permissions),
+                    // Default to read only rather than completely locked down.
+                    None => SandboxPolicy::new_read_only_policy(),
+                }
+            }
+        };
 
         let mut model_providers = built_in_model_providers();
         // Merge user-defined providers into the built-in list.
@@ -435,23 +427,11 @@ impl Config {
 
         let history = cfg.history.unwrap_or_default();
 
-        let model = model
-            .or(config_profile.model)
-            .or(cfg.model)
-            .unwrap_or_else(default_model);
-        let openai_model_info = get_model_info(&model);
-        let model_context_window = cfg
-            .model_context_window
-            .or_else(|| openai_model_info.as_ref().map(|info| info.context_window));
-        let model_max_output_tokens = cfg.model_max_output_tokens.or_else(|| {
-            openai_model_info
-                .as_ref()
-                .map(|info| info.max_output_tokens)
-        });
         let config = Self {
-            model,
-            model_context_window,
-            model_max_output_tokens,
+            model: model
+                .or(config_profile.model)
+                .or(cfg.model)
+                .unwrap_or_else(default_model),
             model_provider_id,
             model_provider,
             cwd: resolved_cwd,
@@ -477,23 +457,8 @@ impl Config {
             codex_linux_sandbox_exe,
 
             hide_agent_reasoning: cfg.hide_agent_reasoning.unwrap_or(false),
-            model_reasoning_effort: config_profile
-                .model_reasoning_effort
-                .or(cfg.model_reasoning_effort)
-                .unwrap_or_default(),
-            model_reasoning_summary: config_profile
-                .model_reasoning_summary
-                .or(cfg.model_reasoning_summary)
-                .unwrap_or_default(),
-
-            model_supports_reasoning_summaries: cfg
-                .model_supports_reasoning_summaries
-                .unwrap_or(false),
-
-            chatgpt_base_url: config_profile
-                .chatgpt_base_url
-                .or(cfg.chatgpt_base_url)
-                .unwrap_or("https://chatgpt.com/backend-api/".to_string()),
+            model_reasoning_effort: cfg.model_reasoning_effort.unwrap_or_default(),
+            model_reasoning_summary: cfg.model_reasoning_summary.unwrap_or_default(),
         };
         Ok(config)
     }
@@ -555,6 +520,50 @@ pub fn log_dir(cfg: &Config) -> std::io::Result<PathBuf> {
     Ok(p)
 }
 
+pub fn parse_sandbox_permission_with_base_path(
+    raw: &str,
+    base_path: PathBuf,
+) -> std::io::Result<SandboxPermission> {
+    use SandboxPermission::*;
+
+    if let Some(path) = raw.strip_prefix("disk-write-folder=") {
+        return if path.is_empty() {
+            Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "--sandbox-permission disk-write-folder=<PATH> requires a non-empty PATH",
+            ))
+        } else {
+            use path_absolutize::*;
+
+            let file = PathBuf::from(path);
+            let absolute_path = if file.is_relative() {
+                file.absolutize_from(base_path)
+            } else {
+                file.absolutize()
+            }
+            .map(|path| path.into_owned())?;
+            Ok(DiskWriteFolder {
+                folder: absolute_path,
+            })
+        };
+    }
+
+    match raw {
+        "disk-full-read-access" => Ok(DiskFullReadAccess),
+        "disk-write-platform-user-temp-folder" => Ok(DiskWritePlatformUserTempFolder),
+        "disk-write-platform-global-temp-folder" => Ok(DiskWritePlatformGlobalTempFolder),
+        "disk-write-cwd" => Ok(DiskWriteCwd),
+        "disk-full-write-access" => Ok(DiskFullWriteAccess),
+        "network-full-access" => Ok(NetworkFullAccess),
+        _ => Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!(
+                "`{raw}` is not a recognised permission.\nRun with `--help` to see the accepted values."
+            ),
+        )),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     #![allow(clippy::expect_used, clippy::unwrap_used)]
@@ -564,14 +573,51 @@ mod tests {
     use pretty_assertions::assert_eq;
     use tempfile::TempDir;
 
+    /// Verify that the `sandbox_permissions` field on `ConfigToml` correctly
+    /// differentiates between a value that is completely absent in the
+    /// provided TOML (i.e. `None`) and one that is explicitly specified as an
+    /// empty array (i.e. `Some(vec![])`). This ensures that downstream logic
+    /// that treats these two cases differently (default read-only policy vs a
+    /// fully locked-down sandbox) continues to function.
+    #[test]
+    fn test_sandbox_permissions_none_vs_empty_vec() {
+        // Case 1: `sandbox_permissions` key is *absent* from the TOML source.
+        let toml_source_without_key = "";
+        let cfg_without_key: ConfigToml = toml::from_str(toml_source_without_key)
+            .expect("TOML deserialization without key should succeed");
+        assert!(cfg_without_key.sandbox_permissions.is_none());
+
+        // Case 2: `sandbox_permissions` is present but set to an *empty array*.
+        let toml_source_with_empty = "sandbox_permissions = []";
+        let cfg_with_empty: ConfigToml = toml::from_str(toml_source_with_empty)
+            .expect("TOML deserialization with empty array should succeed");
+        assert_eq!(Some(vec![]), cfg_with_empty.sandbox_permissions);
+
+        // Case 3: `sandbox_permissions` contains a non-empty list of valid values.
+        let toml_source_with_values = r#"
+            sandbox_permissions = ["disk-full-read-access", "network-full-access"]
+        "#;
+        let cfg_with_values: ConfigToml = toml::from_str(toml_source_with_values)
+            .expect("TOML deserialization with valid permissions should succeed");
+
+        assert_eq!(
+            Some(vec![
+                SandboxPermission::DiskFullReadAccess,
+                SandboxPermission::NetworkFullAccess
+            ]),
+            cfg_with_values.sandbox_permissions
+        );
+    }
+
     #[test]
     fn test_toml_parsing() {
         let history_with_persistence = r#"
 [history]
 persistence = "save-all"
 "#;
-        let history_with_persistence_cfg = toml::from_str::<ConfigToml>(history_with_persistence)
-            .expect("TOML deserialization should succeed");
+        let history_with_persistence_cfg: ConfigToml =
+            toml::from_str::<ConfigToml>(history_with_persistence)
+                .expect("TOML deserialization should succeed");
         assert_eq!(
             Some(History {
                 persistence: HistoryPersistence::SaveAll,
@@ -585,8 +631,9 @@ persistence = "save-all"
 persistence = "none"
 "#;
 
-        let history_no_persistence_cfg = toml::from_str::<ConfigToml>(history_no_persistence)
-            .expect("TOML deserialization should succeed");
+        let history_no_persistence_cfg: ConfigToml =
+            toml::from_str::<ConfigToml>(history_no_persistence)
+                .expect("TOML deserialization should succeed");
         assert_eq!(
             Some(History {
                 persistence: HistoryPersistence::None,
@@ -596,56 +643,20 @@ persistence = "none"
         );
     }
 
+    /// Deserializing a TOML string containing an *invalid* permission should
+    /// fail with a helpful error rather than silently defaulting or
+    /// succeeding.
     #[test]
-    fn test_sandbox_config_parsing() {
-        let sandbox_full_access = r#"
-sandbox_mode = "danger-full-access"
+    fn test_sandbox_permissions_illegal_value() {
+        let toml_bad = r#"sandbox_permissions = ["not-a-real-permission"]"#;
 
-[sandbox_workspace_write]
-network_access = false  # This should be ignored.
-"#;
-        let sandbox_full_access_cfg = toml::from_str::<ConfigToml>(sandbox_full_access)
-            .expect("TOML deserialization should succeed");
-        let sandbox_mode_override = None;
-        assert_eq!(
-            SandboxPolicy::DangerFullAccess,
-            sandbox_full_access_cfg.derive_sandbox_policy(sandbox_mode_override)
-        );
+        let err = toml::from_str::<ConfigToml>(toml_bad)
+            .expect_err("Deserialization should fail for invalid permission");
 
-        let sandbox_read_only = r#"
-sandbox_mode = "read-only"
-
-[sandbox_workspace_write]
-network_access = true  # This should be ignored.
-"#;
-
-        let sandbox_read_only_cfg = toml::from_str::<ConfigToml>(sandbox_read_only)
-            .expect("TOML deserialization should succeed");
-        let sandbox_mode_override = None;
-        assert_eq!(
-            SandboxPolicy::ReadOnly,
-            sandbox_read_only_cfg.derive_sandbox_policy(sandbox_mode_override)
-        );
-
-        let sandbox_workspace_write = r#"
-sandbox_mode = "workspace-write"
-
-[sandbox_workspace_write]
-writable_roots = [
-    "/tmp",
-]
-"#;
-
-        let sandbox_workspace_write_cfg = toml::from_str::<ConfigToml>(sandbox_workspace_write)
-            .expect("TOML deserialization should succeed");
-        let sandbox_mode_override = None;
-        assert_eq!(
-            SandboxPolicy::WorkspaceWrite {
-                writable_roots: vec![PathBuf::from("/tmp")],
-                network_access: false,
-            },
-            sandbox_workspace_write_cfg.derive_sandbox_policy(sandbox_mode_override)
-        );
+        // Make sure the error message contains the invalid value so users have
+        // useful feedback.
+        let msg = err.to_string();
+        assert!(msg.contains("not-a-real-permission"));
     }
 
     struct PrecedenceTestFixture {
@@ -670,7 +681,8 @@ writable_roots = [
     fn create_test_fixture() -> std::io::Result<PrecedenceTestFixture> {
         let toml = r#"
 model = "o3"
-approval_policy = "untrusted"
+approval_policy = "unless-allow-listed"
+sandbox_permissions = ["disk-full-read-access"]
 disable_response_storage = false
 
 # Can be used to determine which profile to use if not specified by
@@ -687,8 +699,6 @@ wire_api = "chat"
 model = "o3"
 model_provider = "openai"
 approval_policy = "never"
-model_reasoning_effort = "high"
-model_reasoning_summary = "detailed"
 
 [profiles.gpt3]
 model = "gpt-3.5-turbo"
@@ -719,10 +729,6 @@ disable_response_storage = true
             env_key: Some("OPENAI_API_KEY".to_string()),
             wire_api: crate::WireApi::Chat,
             env_key_instructions: None,
-            query_params: None,
-            http_headers: None,
-            env_http_headers: None,
-            supports_temperature: true,
         };
         let model_provider_map = {
             let mut model_provider_map = built_in_model_providers();
@@ -777,8 +783,6 @@ disable_response_storage = true
         assert_eq!(
             Config {
                 model: "o3".to_string(),
-                model_context_window: Some(200_000),
-                model_max_output_tokens: Some(100_000),
                 model_provider_id: "openai".to_string(),
                 model_provider: fixture.openai_provider.clone(),
                 approval_policy: AskForApproval::Never,
@@ -797,10 +801,8 @@ disable_response_storage = true
                 tui: Tui::default(),
                 codex_linux_sandbox_exe: None,
                 hide_agent_reasoning: false,
-                model_reasoning_effort: ReasoningEffort::High,
-                model_reasoning_summary: ReasoningSummary::Detailed,
-                model_supports_reasoning_summaries: false,
-                chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
+                model_reasoning_effort: ReasoningEffort::default(),
+                model_reasoning_summary: ReasoningSummary::default(),
             },
             o3_profile_config
         );
@@ -823,11 +825,9 @@ disable_response_storage = true
         )?;
         let expected_gpt3_profile_config = Config {
             model: "gpt-3.5-turbo".to_string(),
-            model_context_window: Some(16_385),
-            model_max_output_tokens: Some(4_096),
             model_provider_id: "openai-chat-completions".to_string(),
             model_provider: fixture.openai_chat_completions_provider.clone(),
-            approval_policy: AskForApproval::UnlessTrusted,
+            approval_policy: AskForApproval::UnlessAllowListed,
             sandbox_policy: SandboxPolicy::new_read_only_policy(),
             shell_environment_policy: ShellEnvironmentPolicy::default(),
             disable_response_storage: false,
@@ -845,8 +845,6 @@ disable_response_storage = true
             hide_agent_reasoning: false,
             model_reasoning_effort: ReasoningEffort::default(),
             model_reasoning_summary: ReasoningSummary::default(),
-            model_supports_reasoning_summaries: false,
-            chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
         };
 
         assert_eq!(expected_gpt3_profile_config, gpt3_profile_config);
@@ -884,8 +882,6 @@ disable_response_storage = true
         )?;
         let expected_zdr_profile_config = Config {
             model: "o3".to_string(),
-            model_context_window: Some(200_000),
-            model_max_output_tokens: Some(100_000),
             model_provider_id: "openai".to_string(),
             model_provider: fixture.openai_provider.clone(),
             approval_policy: AskForApproval::OnFailure,
@@ -906,8 +902,6 @@ disable_response_storage = true
             hide_agent_reasoning: false,
             model_reasoning_effort: ReasoningEffort::default(),
             model_reasoning_summary: ReasoningSummary::default(),
-            model_supports_reasoning_summaries: false,
-            chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
         };
 
         assert_eq!(expected_zdr_profile_config, zdr_profile_config);

codex-rs/core/src/config_profile.rs

@@ -1,7 +1,5 @@
 use serde::Deserialize;
 
-use crate::config_types::ReasoningEffort;
-use crate::config_types::ReasoningSummary;
 use crate::protocol::AskForApproval;
 
 /// Collection of common configuration options that a user can define as a unit
@@ -14,7 +12,4 @@ pub struct ConfigProfile {
     pub model_provider: Option<String>,
     pub approval_policy: Option<AskForApproval>,
     pub disable_response_storage: Option<bool>,
-    pub model_reasoning_effort: Option<ReasoningEffort>,
-    pub model_reasoning_summary: Option<ReasoningSummary>,
-    pub chatgpt_base_url: Option<String>,
 }

codex-rs/core/src/config_types.rs

@@ -4,7 +4,6 @@
 // definitions that do not contain business logic.
 
 use std::collections::HashMap;
-use std::path::PathBuf;
 use strum_macros::Display;
 use wildmatch::WildMatchPattern;
 
@@ -91,28 +90,6 @@ pub struct Tui {
     pub disable_mouse_capture: bool,
 }
 
-#[derive(Deserialize, Debug, Clone, Copy, PartialEq, Default)]
-#[serde(rename_all = "kebab-case")]
-pub enum SandboxMode {
-    #[serde(rename = "read-only")]
-    #[default]
-    ReadOnly,
-
-    #[serde(rename = "workspace-write")]
-    WorkspaceWrite,
-
-    #[serde(rename = "danger-full-access")]
-    DangerFullAccess,
-}
-
-#[derive(Deserialize, Debug, Clone, PartialEq, Default)]
-pub struct SandboxWorkplaceWrite {
-    #[serde(default)]
-    pub writable_roots: Vec<PathBuf>,
-    #[serde(default)]
-    pub network_access: bool,
-}
-
 #[derive(Deserialize, Debug, Clone, PartialEq, Default)]
 #[serde(rename_all = "kebab-case")]
 pub enum ShellEnvironmentPolicyInherit {

codex-rs/core/src/exec.rs

@@ -225,20 +225,41 @@ fn create_linux_sandbox_command_args(
     sandbox_policy: &SandboxPolicy,
     cwd: &Path,
 ) -> Vec<String> {
-    #[expect(clippy::expect_used)]
-    let sandbox_policy_cwd = cwd.to_str().expect("cwd must be valid UTF-8").to_string();
+    let mut linux_cmd: Vec<String> = vec![];
 
-    #[expect(clippy::expect_used)]
-    let sandbox_policy_json =
-        serde_json::to_string(sandbox_policy).expect("Failed to serialize SandboxPolicy to JSON");
+    // Translate individual permissions.
+    // Use high-level helper methods to infer flags when we cannot see the
+    // exact permission list.
+    if sandbox_policy.has_full_disk_read_access() {
+        linux_cmd.extend(["-s", "disk-full-read-access"].map(String::from));
+    }
 
-    let mut linux_cmd: Vec<String> = vec![
-        sandbox_policy_cwd,
-        sandbox_policy_json,
-        // Separator so that command arguments starting with `-` are not parsed as
-        // options of the helper itself.
-        "--".to_string(),
-    ];
+    if sandbox_policy.has_full_disk_write_access() {
+        linux_cmd.extend(["-s", "disk-full-write-access"].map(String::from));
+    } else {
+        // Derive granular writable paths (includes cwd if `DiskWriteCwd` is
+        // present).
+        for root in sandbox_policy.get_writable_roots_with_cwd(cwd) {
+            // Check if this path corresponds exactly to cwd to map to
+            // `disk-write-cwd`, otherwise use the generic folder rule.
+            if root == cwd {
+                linux_cmd.extend(["-s", "disk-write-cwd"].map(String::from));
+            } else {
+                linux_cmd.extend([
+                    "-s".to_string(),
+                    format!("disk-write-folder={}", root.to_string_lossy()),
+                ]);
+            }
+        }
+    }
+
+    if sandbox_policy.has_full_network_access() {
+        linux_cmd.extend(["-s", "network-full-access"].map(String::from));
+    }
+
+    // Separator so that command arguments starting with `-` are not parsed as
+    // options of the helper itself.
+    linux_cmd.push("--".to_string());
 
     // Append the original tool command.
     linux_cmd.extend(command);

codex-rs/core/src/is_safe_command.rs

@@ -240,7 +240,8 @@ mod tests {
         ] {
             assert!(
                 !is_safe_to_call_with_exec(&args),
-                "expected {args:?} to be unsafe"
+                "expected {:?} to be unsafe",
+                args
             );
         }
     }

codex-rs/core/src/lib.rs

@@ -28,7 +28,6 @@ pub use model_provider_info::ModelProviderInfo;
 pub use model_provider_info::WireApi;
 mod models;
 pub mod openai_api_key;
-mod openai_model_info;
 mod openai_tools;
 mod project_doc;
 pub mod protocol;

codex-rs/core/src/model_provider_info.rs

@@ -13,10 +13,6 @@ use std::env::VarError;
 use crate::error::EnvVarError;
 use crate::openai_api_key::get_openai_api_key;
 
-/// Value for the `OpenAI-Originator` header that is sent with requests to
-/// OpenAI.
-const OPENAI_ORIGINATOR_HEADER: &str = "codex_cli_rs";
-
 /// Wire protocol that the provider speaks. Most third-party services only
 /// implement the classic OpenAI Chat Completions JSON schema, whereas OpenAI
 /// itself (and a handful of others) additionally expose the more modern
@@ -27,10 +23,9 @@ const OPENAI_ORIGINATOR_HEADER: &str = "codex_cli_rs";
 #[serde(rename_all = "lowercase")]
 pub enum WireApi {
     /// The experimental “Responses” API exposed by OpenAI at `/v1/responses`.
-    Responses,
-
-    /// Regular Chat Completions compatible with `/v1/chat/completions`.
     #[default]
+    Responses,
+    /// Regular Chat Completions compatible with `/v1/chat/completions`.
     Chat,
 }
 
@@ -49,101 +44,14 @@ pub struct ModelProviderInfo {
     pub env_key_instructions: Option<String>,
 
     /// Which wire protocol this provider expects.
-    #[serde(default)]
     pub wire_api: WireApi,
-
-    /// Optional query parameters to append to the base URL.
-    pub query_params: Option<HashMap<String, String>>,
-
-    /// Additional HTTP headers to include in requests to this provider where
-    /// the (key, value) pairs are the header name and value.
-    pub http_headers: Option<HashMap<String, String>>,
-
-    /// Optional HTTP headers to include in requests to this provider where the
-    /// (key, value) pairs are the header name and _environment variable_ whose
-    /// value should be used. If the environment variable is not set, or the
-    /// value is empty, the header will not be included in the request.
-    pub env_http_headers: Option<HashMap<String, String>>,
-
-    /// Whether the provider accepts an explicit `temperature` parameter.
-    #[serde(default = "default_supports_temperature")]
-    pub supports_temperature: bool,
-}
-
-const fn default_supports_temperature() -> bool {
-    true
 }
 
 impl ModelProviderInfo {
-    /// Construct a `POST` RequestBuilder for the given URL using the provided
-    /// reqwest Client applying:
-    ///   • provider-specific headers (static + env based)
-    ///   • Bearer auth header when an API key is available.
-    ///
-    /// When `require_api_key` is true and the provider declares an `env_key`
-    /// but the variable is missing/empty, returns an [`Err`] identical to the
-    /// one produced by [`ModelProviderInfo::api_key`].
-    pub fn create_request_builder<'a>(
-        &'a self,
-        client: &'a reqwest::Client,
-    ) -> crate::error::Result<reqwest::RequestBuilder> {
-        let api_key = self.api_key()?;
-
-        let url = self.get_full_url();
-
-        let mut builder = client.post(url);
-        if let Some(key) = api_key {
-            builder = builder.bearer_auth(key);
-        }
-
-        Ok(self.apply_http_headers(builder))
-    }
-
-    pub(crate) fn get_full_url(&self) -> String {
-        let query_string = self
-            .query_params
-            .as_ref()
-            .map_or_else(String::new, |params| {
-                let full_params = params
-                    .iter()
-                    .map(|(k, v)| format!("{k}={v}"))
-                    .collect::<Vec<_>>()
-                    .join("&");
-                format!("?{full_params}")
-            });
-        let base_url = &self.base_url;
-        match self.wire_api {
-            WireApi::Responses => format!("{base_url}/responses{query_string}"),
-            WireApi::Chat => format!("{base_url}/chat/completions{query_string}"),
-        }
-    }
-
-    /// Apply provider-specific HTTP headers (both static and environment-based)
-    /// onto an existing `reqwest::RequestBuilder` and return the updated
-    /// builder.
-    fn apply_http_headers(&self, mut builder: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
-        if let Some(extra) = &self.http_headers {
-            for (k, v) in extra {
-                builder = builder.header(k, v);
-            }
-        }
-
-        if let Some(env_headers) = &self.env_http_headers {
-            for (header, env_var) in env_headers {
-                if let Ok(val) = std::env::var(env_var) {
-                    if !val.trim().is_empty() {
-                        builder = builder.header(header, val);
-                    }
-                }
-            }
-        }
-        builder
-    }
-
     /// If `env_key` is Some, returns the API key for this provider if present
     /// (and non-empty) in the environment. If `env_key` is required but
     /// cannot be found, returns an error.
-    fn api_key(&self) -> crate::error::Result<Option<String>> {
+    pub fn api_key(&self) -> crate::error::Result<Option<String>> {
         match &self.env_key {
             Some(env_key) => {
                 let env_value = if env_key == crate::openai_api_key::OPENAI_API_KEY_ENV_VAR {
@@ -175,45 +83,85 @@ impl ModelProviderInfo {
 pub fn built_in_model_providers() -> HashMap<String, ModelProviderInfo> {
     use ModelProviderInfo as P;
 
-    // We do not want to be in the business of adjucating which third-party
-    // providers are bundled with Codex CLI, so we only include the OpenAI
-    // provider by default. Users are encouraged to add to `model_providers`
-    // in config.toml to add their own providers.
     [
         (
             "openai",
             P {
                 name: "OpenAI".into(),
-                // Allow users to override the default OpenAI endpoint by
-                // exporting `OPENAI_BASE_URL`. This is useful when pointing
-                // Codex at a proxy, mock server, or Azure-style deployment
-                // without requiring a full TOML override for the built-in
-                // OpenAI provider.
-                base_url: std::env::var("OPENAI_BASE_URL")
-                    .ok()
-                    .filter(|v| !v.trim().is_empty())
-                    .unwrap_or_else(|| "https://api.openai.com/v1".to_string()),
+                base_url: "https://api.openai.com/v1".into(),
                 env_key: Some("OPENAI_API_KEY".into()),
                 env_key_instructions: Some("Create an API key (https://platform.openai.com) and export it as an environment variable.".into()),
                 wire_api: WireApi::Responses,
-                query_params: None,
-                http_headers: Some(
-                    [
-                        ("originator".to_string(), OPENAI_ORIGINATOR_HEADER.to_string()),
-                        ("version".to_string(), env!("CARGO_PKG_VERSION").to_string()),
-                    ]
-                        .into_iter()
-                        .collect(),
-                ),
-                env_http_headers: Some(
-                    [
-                        ("OpenAI-Organization".to_string(), "OPENAI_ORGANIZATION".to_string()),
-                        ("OpenAI-Project".to_string(), "OPENAI_PROJECT".to_string()),
-                    ]
-                        .into_iter()
-                        .collect(),
-                ),
-                supports_temperature: false,
+            },
+        ),
+        (
+            "openrouter",
+            P {
+                name: "OpenRouter".into(),
+                base_url: "https://openrouter.ai/api/v1".into(),
+                env_key: Some("OPENROUTER_API_KEY".into()),
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
+            },
+        ),
+        (
+            "gemini",
+            P {
+                name: "Gemini".into(),
+                base_url: "https://generativelanguage.googleapis.com/v1beta/openai".into(),
+                env_key: Some("GEMINI_API_KEY".into()),
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
+            },
+        ),
+        (
+            "ollama",
+            P {
+                name: "Ollama".into(),
+                base_url: "http://localhost:11434/v1".into(),
+                env_key: None,
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
+            },
+        ),
+        (
+            "mistral",
+            P {
+                name: "Mistral".into(),
+                base_url: "https://api.mistral.ai/v1".into(),
+                env_key: Some("MISTRAL_API_KEY".into()),
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
+            },
+        ),
+        (
+            "deepseek",
+            P {
+                name: "DeepSeek".into(),
+                base_url: "https://api.deepseek.com".into(),
+                env_key: Some("DEEPSEEK_API_KEY".into()),
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
+            },
+        ),
+        (
+            "xai",
+            P {
+                name: "xAI".into(),
+                base_url: "https://api.x.ai/v1".into(),
+                env_key: Some("XAI_API_KEY".into()),
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
+            },
+        ),
+        (
+            "groq",
+            P {
+                name: "Groq".into(),
+                base_url: "https://api.groq.com/openai/v1".into(),
+                env_key: Some("GROQ_API_KEY".into()),
+                env_key_instructions: None,
+                wire_api: WireApi::Chat,
             },
         ),
     ]
@@ -221,87 +169,3 @@ pub fn built_in_model_providers() -> HashMap<String, ModelProviderInfo> {
     .map(|(k, v)| (k.to_string(), v))
     .collect()
 }
-
-#[cfg(test)]
-mod tests {
-    #![allow(clippy::unwrap_used)]
-    use super::*;
-    use pretty_assertions::assert_eq;
-
-    #[test]
-    fn test_deserialize_ollama_model_provider_toml() {
-        let azure_provider_toml = r#"
-name = "Ollama"
-base_url = "http://localhost:11434/v1"
-        "#;
-        let expected_provider = ModelProviderInfo {
-            name: "Ollama".into(),
-            base_url: "http://localhost:11434/v1".into(),
-            env_key: None,
-            env_key_instructions: None,
-            wire_api: WireApi::Chat,
-            query_params: None,
-            http_headers: None,
-            env_http_headers: None,
-            supports_temperature: true,
-        };
-
-        let provider: ModelProviderInfo = toml::from_str(azure_provider_toml).unwrap();
-        assert_eq!(expected_provider, provider);
-    }
-
-    #[test]
-    fn test_deserialize_azure_model_provider_toml() {
-        let azure_provider_toml = r#"
-name = "Azure"
-base_url = "https://xxxxx.openai.azure.com/openai"
-env_key = "AZURE_OPENAI_API_KEY"
-query_params = { api-version = "2025-04-01-preview" }
-        "#;
-        let expected_provider = ModelProviderInfo {
-            name: "Azure".into(),
-            base_url: "https://xxxxx.openai.azure.com/openai".into(),
-            env_key: Some("AZURE_OPENAI_API_KEY".into()),
-            env_key_instructions: None,
-            wire_api: WireApi::Chat,
-            query_params: Some(maplit::hashmap! {
-                "api-version".to_string() => "2025-04-01-preview".to_string(),
-            }),
-            http_headers: None,
-            env_http_headers: None,
-            supports_temperature: true,
-        };
-
-        let provider: ModelProviderInfo = toml::from_str(azure_provider_toml).unwrap();
-        assert_eq!(expected_provider, provider);
-    }
-
-    #[test]
-    fn test_deserialize_example_model_provider_toml() {
-        let azure_provider_toml = r#"
-name = "Example"
-base_url = "https://example.com"
-env_key = "API_KEY"
-http_headers = { "X-Example-Header" = "example-value" }
-env_http_headers = { "X-Example-Env-Header" = "EXAMPLE_ENV_VAR" }
-        "#;
-        let expected_provider = ModelProviderInfo {
-            name: "Example".into(),
-            base_url: "https://example.com".into(),
-            env_key: Some("API_KEY".into()),
-            env_key_instructions: None,
-            wire_api: WireApi::Chat,
-            query_params: None,
-            http_headers: Some(maplit::hashmap! {
-                "X-Example-Header".to_string() => "example-value".to_string(),
-            }),
-            env_http_headers: Some(maplit::hashmap! {
-                "X-Example-Env-Header".to_string() => "EXAMPLE_ENV_VAR".to_string(),
-            }),
-            supports_temperature: true,
-        };
-
-        let provider: ModelProviderInfo = toml::from_str(azure_provider_toml).unwrap();
-        assert_eq!(expected_provider, provider);
-    }
-}

codex-rs/core/src/models.rs

@@ -145,7 +145,7 @@ impl From<Vec<InputItem>> for ResponseInputItem {
                                 .unwrap_or_else(|| "application/octet-stream".to_string());
                             let encoded = base64::engine::general_purpose::STANDARD.encode(bytes);
                             Some(ContentItem::InputImage {
-                                image_url: format!("data:{mime};base64,{encoded}"),
+                                image_url: format!("data:{};base64,{}", mime, encoded),
                             })
                         }
                         Err(err) => {

codex-rs/core/src/openai_model_info.rs

@@ -1,71 +0,0 @@
-/// Metadata about a model, particularly OpenAI models.
-/// We may want to consider including details like the pricing for
-/// input tokens, output tokens, etc., though users will need to be able to
-/// override this in config.toml, as this information can get out of date.
-/// Though this would help present more accurate pricing information in the UI.
-#[derive(Debug)]
-pub(crate) struct ModelInfo {
-    /// Size of the context window in tokens.
-    pub(crate) context_window: u64,
-
-    /// Maximum number of output tokens that can be generated for the model.
-    pub(crate) max_output_tokens: u64,
-}
-
-/// Note details such as what a model like gpt-4o is aliased to may be out of
-/// date.
-pub(crate) fn get_model_info(name: &str) -> Option<ModelInfo> {
-    match name {
-        // https://platform.openai.com/docs/models/o3
-        "o3" => Some(ModelInfo {
-            context_window: 200_000,
-            max_output_tokens: 100_000,
-        }),
-
-        // https://platform.openai.com/docs/models/o4-mini
-        "o4-mini" => Some(ModelInfo {
-            context_window: 200_000,
-            max_output_tokens: 100_000,
-        }),
-
-        // https://platform.openai.com/docs/models/codex-mini-latest
-        "codex-mini-latest" => Some(ModelInfo {
-            context_window: 200_000,
-            max_output_tokens: 100_000,
-        }),
-
-        // As of Jun 25, 2025, gpt-4.1 defaults to gpt-4.1-2025-04-14.
-        // https://platform.openai.com/docs/models/gpt-4.1
-        "gpt-4.1" | "gpt-4.1-2025-04-14" => Some(ModelInfo {
-            context_window: 1_047_576,
-            max_output_tokens: 32_768,
-        }),
-
-        // As of Jun 25, 2025, gpt-4o defaults to gpt-4o-2024-08-06.
-        // https://platform.openai.com/docs/models/gpt-4o
-        "gpt-4o" | "gpt-4o-2024-08-06" => Some(ModelInfo {
-            context_window: 128_000,
-            max_output_tokens: 16_384,
-        }),
-
-        // https://platform.openai.com/docs/models/gpt-4o?snapshot=gpt-4o-2024-05-13
-        "gpt-4o-2024-05-13" => Some(ModelInfo {
-            context_window: 128_000,
-            max_output_tokens: 4_096,
-        }),
-
-        // https://platform.openai.com/docs/models/gpt-4o?snapshot=gpt-4o-2024-11-20
-        "gpt-4o-2024-11-20" => Some(ModelInfo {
-            context_window: 128_000,
-            max_output_tokens: 16_384,
-        }),
-
-        // https://platform.openai.com/docs/models/gpt-3.5-turbo
-        "gpt-3.5-turbo" => Some(ModelInfo {
-            context_window: 16_385,
-            max_output_tokens: 4_096,
-        }),
-
-        _ => None,
-    }
-}

codex-rs/core/src/protocol.rs

@@ -6,7 +6,6 @@
 use std::collections::HashMap;
 use std::path::Path;
 use std::path::PathBuf;
-use std::str::FromStr;
 
 use mcp_types::CallToolResult;
 use serde::Deserialize;
@@ -110,17 +109,21 @@ pub enum Op {
     GetHistoryEntryRequest { offset: usize, log_id: u64 },
 }
 
-/// Determines the conditions under which the user is consulted to approve
-/// running the command proposed by Codex.
+/// Determines how liberally commands are auto‑approved by the system.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "kebab-case")]
 pub enum AskForApproval {
-    /// Under this policy, only "known safe" commands—as determined by
+    /// Under this policy, only “known safe” commands—as determined by
     /// `is_safe_command()`—that **only read files** are auto‑approved.
     /// Everything else will ask the user to approve.
     #[default]
-    #[serde(rename = "untrusted")]
-    UnlessTrusted,
+    UnlessAllowListed,
+
+    /// In addition to everything allowed by **`Suggest`**, commands that
+    /// *write* to files **within the user’s approved list of writable paths**
+    /// are also auto‑approved.
+    /// TODO(ragona): fix
+    AutoEdit,
 
     /// *All* commands are auto‑approved, but they are expected to run inside a
     /// sandbox where network access is disabled and writes are confined to a
@@ -133,104 +136,155 @@ pub enum AskForApproval {
     Never,
 }
 
-/// Determines execution restrictions for model shell commands.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "mode", rename_all = "kebab-case")]
-pub enum SandboxPolicy {
-    /// No restrictions whatsoever. Use with caution.
-    #[serde(rename = "danger-full-access")]
-    DangerFullAccess,
-
-    /// Read-only access to the entire file-system.
-    #[serde(rename = "read-only")]
-    ReadOnly,
-
-    /// Same as `ReadOnly` but additionally grants write access to the current
-    /// working directory ("workspace").
-    #[serde(rename = "workspace-write")]
-    WorkspaceWrite {
-        /// Additional folders (beyond cwd and possibly TMPDIR) that should be
-        /// writable from within the sandbox.
-        #[serde(default, skip_serializing_if = "Vec::is_empty")]
-        writable_roots: Vec<PathBuf>,
-
-        /// When set to `true`, outbound network access is allowed. `false` by
-        /// default.
-        #[serde(default)]
-        network_access: bool,
-    },
+/// Determines execution restrictions for model shell commands
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct SandboxPolicy {
+    permissions: Vec<SandboxPermission>,
 }
 
-impl FromStr for SandboxPolicy {
-    type Err = serde_json::Error;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        serde_json::from_str(s)
+impl From<Vec<SandboxPermission>> for SandboxPolicy {
+    fn from(permissions: Vec<SandboxPermission>) -> Self {
+        Self { permissions }
     }
 }
 
 impl SandboxPolicy {
-    /// Returns a policy with read-only disk access and no network.
     pub fn new_read_only_policy() -> Self {
-        SandboxPolicy::ReadOnly
-    }
-
-    /// Returns a policy that can read the entire disk, but can only write to
-    /// the current working directory and the per-user tmp dir on macOS. It does
-    /// not allow network access.
-    pub fn new_workspace_write_policy() -> Self {
-        SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![],
-            network_access: false,
+        Self {
+            permissions: vec![SandboxPermission::DiskFullReadAccess],
+        }
+    }
+
+    pub fn new_read_only_policy_with_writable_roots(writable_roots: &[PathBuf]) -> Self {
+        let mut permissions = Self::new_read_only_policy().permissions;
+        permissions.extend(writable_roots.iter().map(|folder| {
+            SandboxPermission::DiskWriteFolder {
+                folder: folder.clone(),
+            }
+        }));
+        Self { permissions }
+    }
+
+    pub fn new_full_auto_policy() -> Self {
+        Self {
+            permissions: vec![
+                SandboxPermission::DiskFullReadAccess,
+                SandboxPermission::DiskWritePlatformUserTempFolder,
+                SandboxPermission::DiskWriteCwd,
+            ],
         }
     }
 
-    /// Always returns `true` for now, as we do not yet support restricting read
-    /// access.
     pub fn has_full_disk_read_access(&self) -> bool {
-        true
+        self.permissions
+            .iter()
+            .any(|perm| matches!(perm, SandboxPermission::DiskFullReadAccess))
     }
 
     pub fn has_full_disk_write_access(&self) -> bool {
-        match self {
-            SandboxPolicy::DangerFullAccess => true,
-            SandboxPolicy::ReadOnly => false,
-            SandboxPolicy::WorkspaceWrite { .. } => false,
-        }
+        self.permissions
+            .iter()
+            .any(|perm| matches!(perm, SandboxPermission::DiskFullWriteAccess))
     }
 
     pub fn has_full_network_access(&self) -> bool {
-        match self {
-            SandboxPolicy::DangerFullAccess => true,
-            SandboxPolicy::ReadOnly => false,
-            SandboxPolicy::WorkspaceWrite { network_access, .. } => *network_access,
-        }
+        self.permissions
+            .iter()
+            .any(|perm| matches!(perm, SandboxPermission::NetworkFullAccess))
     }
 
-    /// Returns the list of writable roots that should be passed down to the
-    /// Landlock rules installer, tailored to the current working directory.
     pub fn get_writable_roots_with_cwd(&self, cwd: &Path) -> Vec<PathBuf> {
-        match self {
-            SandboxPolicy::DangerFullAccess => Vec::new(),
-            SandboxPolicy::ReadOnly => Vec::new(),
-            SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
-                let mut roots = writable_roots.clone();
-                roots.push(cwd.to_path_buf());
+        let mut writable_roots = Vec::<PathBuf>::new();
+        for perm in &self.permissions {
+            use SandboxPermission::*;
+            match perm {
+                DiskWritePlatformUserTempFolder => {
+                    if cfg!(target_os = "macos") {
+                        if let Some(tempdir) = std::env::var_os("TMPDIR") {
+                            // Likely something that starts with /var/folders/...
+                            let tmpdir_path = PathBuf::from(&tempdir);
+                            if tmpdir_path.is_absolute() {
+                                writable_roots.push(tmpdir_path.clone());
+                                match tmpdir_path.canonicalize() {
+                                    Ok(canonicalized) => {
+                                        // Likely something that starts with /private/var/folders/...
+                                        if canonicalized != tmpdir_path {
+                                            writable_roots.push(canonicalized);
+                                        }
+                                    }
+                                    Err(e) => {
+                                        tracing::error!("Failed to canonicalize TMPDIR: {e}");
+                                    }
+                                }
+                            } else {
+                                tracing::error!("TMPDIR is not an absolute path: {tempdir:?}");
+                            }
+                        }
+                    }
 
-                // Also include the per-user tmp dir on macOS.
-                // Note this is added dynamically rather than storing it in
-                // writable_roots because writable_roots contains only static
-                // values deserialized from the config file.
-                if cfg!(target_os = "macos") {
-                    if let Some(tmpdir) = std::env::var_os("TMPDIR") {
-                        roots.push(PathBuf::from(tmpdir));
+                    // For Linux, should this be XDG_RUNTIME_DIR, /run/user/<uid>, or something else?
+                }
+                DiskWritePlatformGlobalTempFolder => {
+                    if cfg!(unix) {
+                        writable_roots.push(PathBuf::from("/tmp"));
                     }
                 }
-
-                roots
+                DiskWriteCwd => {
+                    writable_roots.push(cwd.to_path_buf());
+                }
+                DiskWriteFolder { folder } => {
+                    writable_roots.push(folder.clone());
+                }
+                DiskFullReadAccess | NetworkFullAccess => {}
+                DiskFullWriteAccess => {
+                    // Currently, we expect callers to only invoke this method
+                    // after verifying has_full_disk_write_access() is false.
+                }
             }
         }
+        writable_roots
     }
+
+    pub fn is_unrestricted(&self) -> bool {
+        self.has_full_disk_read_access()
+            && self.has_full_disk_write_access()
+            && self.has_full_network_access()
+    }
+}
+
+/// Permissions that should be granted to the sandbox in which the agent
+/// operates.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SandboxPermission {
+    /// Is allowed to read all files on disk.
+    DiskFullReadAccess,
+
+    /// Is allowed to write to the operating system's temp dir that
+    /// is restricted to the user the agent is running as. For
+    /// example, on macOS, this is generally something under
+    /// `/var/folders` as opposed to `/tmp`.
+    DiskWritePlatformUserTempFolder,
+
+    /// Is allowed to write to the operating system's shared temp
+    /// dir. On UNIX, this is generally `/tmp`.
+    DiskWritePlatformGlobalTempFolder,
+
+    /// Is allowed to write to the current working directory (in practice, this
+    /// is the `cwd` where `codex` was spawned).
+    DiskWriteCwd,
+
+    /// Is allowed to the specified folder. `PathBuf` must be an
+    /// absolute path, though it is up to the caller to canonicalize
+    /// it if the path contains symlinks.
+    DiskWriteFolder { folder: PathBuf },
+
+    /// Is allowed to write to any file on disk.
+    DiskFullWriteAccess,
+
+    /// Can make arbitrary network requests.
+    NetworkFullAccess,
 }
 
 /// User input
@@ -275,10 +329,6 @@ pub enum EventMsg {
     /// Agent has completed all actions
     TaskComplete(TaskCompleteEvent),
 
-    /// Token count event, sent periodically to report the number of tokens
-    /// used in the current session.
-    TokenCount(TokenUsage),
-
     /// Agent text output message
     AgentMessage(AgentMessageEvent),
 
@@ -326,15 +376,6 @@ pub struct TaskCompleteEvent {
     pub last_agent_message: Option<String>,
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, Default)]
-pub struct TokenUsage {
-    pub input_tokens: u64,
-    pub cached_input_tokens: Option<u64>,
-    pub output_tokens: u64,
-    pub reasoning_output_tokens: Option<u64>,
-    pub total_tokens: u64,
-}
-
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct AgentMessageEvent {
     pub message: String,

codex-rs/core/src/safety.rs

@@ -31,12 +31,12 @@ pub fn assess_patch_safety(
     }
 
     match policy {
-        AskForApproval::OnFailure | AskForApproval::Never => {
+        AskForApproval::OnFailure | AskForApproval::AutoEdit | AskForApproval::Never => {
             // Continue to see if this can be auto-approved.
         }
         // TODO(ragona): I'm not sure this is actually correct? I believe in this case
         // we want to continue to the writable paths check before asking the user.
-        AskForApproval::UnlessTrusted => {
+        AskForApproval::UnlessAllowListed => {
             return SafetyCheck::AskUser;
         }
     }
@@ -63,71 +63,40 @@ pub fn assess_patch_safety(
     }
 }
 
-/// For a command to be run _without_ a sandbox, one of the following must be
-/// true:
-///
-/// - the user has explicitly approved the command
-/// - the command is on the "known safe" list
-/// - `DangerFullAccess` was specified and `UnlessTrusted` was not
 pub fn assess_command_safety(
     command: &[String],
     approval_policy: AskForApproval,
     sandbox_policy: &SandboxPolicy,
     approved: &HashSet<Vec<String>>,
 ) -> SafetyCheck {
-    use AskForApproval::*;
-    use SandboxPolicy::*;
+    let approve_without_sandbox = || SafetyCheck::AutoApprove {
+        sandbox_type: SandboxType::None,
+    };
 
-    // A command is "trusted" because either:
-    // - it belongs to a set of commands we consider "safe" by default, or
-    // - the user has explicitly approved the command for this session
-    //
-    // Currently, whether a command is "trusted" is a simple boolean, but we
-    // should include more metadata on this command test to indicate whether it
-    // should be run inside a sandbox or not. (This could be something the user
-    // defines as part of `execpolicy`.)
-    //
-    // For example, when `is_known_safe_command(command)` returns `true`, it
-    // would probably be fine to run the command in a sandbox, but when
-    // `approved.contains(command)` is `true`, the user may have approved it for
-    // the session _because_ they know it needs to run outside a sandbox.
+    // Previously approved or allow-listed commands
+    // All approval modes allow these commands to continue without sandboxing
     if is_known_safe_command(command) || approved.contains(command) {
-        return SafetyCheck::AutoApprove {
-            sandbox_type: SandboxType::None,
-        };
+        // TODO(ragona): I think we should consider running even these inside the sandbox, but it's
+        // a change in behavior so I'm keeping it at parity with upstream for now.
+        return approve_without_sandbox();
     }
 
-    match (approval_policy, sandbox_policy) {
-        (UnlessTrusted, _) => {
-            // Even though the user may have opted into DangerFullAccess,
-            // they also requested that we ask for approval for untrusted
-            // commands.
-            SafetyCheck::AskUser
-        }
-        (OnFailure, DangerFullAccess) | (Never, DangerFullAccess) => SafetyCheck::AutoApprove {
-            sandbox_type: SandboxType::None,
-        },
-        (Never, ReadOnly)
-        | (Never, WorkspaceWrite { .. })
-        | (OnFailure, ReadOnly)
-        | (OnFailure, WorkspaceWrite { .. }) => {
-            match get_platform_sandbox() {
-                Some(sandbox_type) => SafetyCheck::AutoApprove { sandbox_type },
-                None => {
-                    if matches!(approval_policy, OnFailure) {
-                        // Since the command is not trusted, even though the
-                        // user has requested to only ask for approval on
-                        // failure, we will ask the user because no sandbox is
-                        // available.
-                        SafetyCheck::AskUser
-                    } else {
-                        // We are in non-interactive mode and lack approval, so
-                        // all we can do is reject the command.
-                        SafetyCheck::Reject {
-                            reason: "auto-rejected because command is not on trusted list"
-                                .to_string(),
-                        }
-                    }
+    // Command was not known-safe or allow-listed
+    if sandbox_policy.is_unrestricted() {
+        approve_without_sandbox()
+    } else {
+        match get_platform_sandbox() {
+            // We have a sandbox, so we can approve the command in all modes
+            Some(sandbox_type) => SafetyCheck::AutoApprove { sandbox_type },
+            None => {
+                // We do not have a sandbox, so we need to consider the approval policy
+                match approval_policy {
+                    // Never is our "non-interactive" mode; it must automatically reject
+                    AskForApproval::Never => SafetyCheck::Reject {
+                        reason: "auto-rejected by user approval settings".to_string(),
+                    },
+                    // Otherwise, we ask the user for approval
+                    _ => SafetyCheck::AskUser,
                 }
             }
         }

codex-rs/core/tests/cli_responses_fixture.sse

@@ -1,8 +0,0 @@
-event: response.created
-data: {"type":"response.created","response":{"id":"resp1"}}
-
-event: response.output_item.done
-data: {"type":"response.output_item.done","item":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"fixture hello"}]}}
-
-event: response.completed
-data: {"type":"response.completed","response":{"id":"resp1","output":[]}}

codex-rs/core/tests/cli_stream.rs

@@ -1,119 +0,0 @@
-#![expect(clippy::unwrap_used)]
-
-use assert_cmd::Command as AssertCommand;
-use codex_core::exec::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
-use tempfile::TempDir;
-use wiremock::Mock;
-use wiremock::MockServer;
-use wiremock::ResponseTemplate;
-use wiremock::matchers::method;
-use wiremock::matchers::path;
-
-/// Tests streaming chat completions through the CLI using a mock server.
-/// This test:
-/// 1. Sets up a mock server that simulates OpenAI's chat completions API
-/// 2. Configures codex to use this mock server via a custom provider
-/// 3. Sends a simple "hello?" prompt and verifies the streamed response
-/// 4. Ensures the response is received exactly once and contains "hi"
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn chat_mode_stream_cli() {
-    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
-        println!(
-            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
-        );
-        return;
-    }
-
-    let server = MockServer::start().await;
-    let sse = concat!(
-        "data: {\"choices\":[{\"delta\":{\"content\":\"hi\"}}]}\n\n",
-        "data: {\"choices\":[{\"delta\":{}}]}\n\n",
-        "data: [DONE]\n\n"
-    );
-    Mock::given(method("POST"))
-        .and(path("/v1/chat/completions"))
-        .respond_with(
-            ResponseTemplate::new(200)
-                .insert_header("content-type", "text/event-stream")
-                .set_body_raw(sse, "text/event-stream"),
-        )
-        .expect(1)
-        .mount(&server)
-        .await;
-
-    let home = TempDir::new().unwrap();
-    let provider_override = format!(
-        "model_providers.mock={{ name = \"mock\", base_url = \"{}/v1\", env_key = \"PATH\", wire_api = \"chat\" }}",
-        server.uri()
-    );
-    let mut cmd = AssertCommand::new("cargo");
-    cmd.arg("run")
-        .arg("-p")
-        .arg("codex-cli")
-        .arg("--quiet")
-        .arg("--")
-        .arg("exec")
-        .arg("--skip-git-repo-check")
-        .arg("-c")
-        .arg(&provider_override)
-        .arg("-c")
-        .arg("model_provider=\"mock\"")
-        .arg("-C")
-        .arg(env!("CARGO_MANIFEST_DIR"))
-        .arg("hello?");
-    cmd.env("CODEX_HOME", home.path())
-        .env("OPENAI_API_KEY", "dummy")
-        .env("OPENAI_BASE_URL", format!("{}/v1", server.uri()));
-
-    let output = cmd.output().unwrap();
-    println!("Status: {}", output.status);
-    println!("Stdout:\n{}", String::from_utf8_lossy(&output.stdout));
-    println!("Stderr:\n{}", String::from_utf8_lossy(&output.stderr));
-    assert!(output.status.success());
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    assert!(stdout.contains("hi"));
-    assert_eq!(stdout.matches("hi").count(), 1);
-
-    server.verify().await;
-}
-
-/// Tests streaming responses through the CLI using a local SSE fixture file.
-/// This test:
-/// 1. Uses a pre-recorded SSE response fixture instead of a live server
-/// 2. Configures codex to read from this fixture via CODEX_RS_SSE_FIXTURE env var
-/// 3. Sends a "hello?" prompt and verifies the response
-/// 4. Ensures the fixture content is correctly streamed through the CLI
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn responses_api_stream_cli() {
-    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
-        println!(
-            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
-        );
-        return;
-    }
-
-    let fixture =
-        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/cli_responses_fixture.sse");
-
-    let home = TempDir::new().unwrap();
-    let mut cmd = AssertCommand::new("cargo");
-    cmd.arg("run")
-        .arg("-p")
-        .arg("codex-cli")
-        .arg("--quiet")
-        .arg("--")
-        .arg("exec")
-        .arg("--skip-git-repo-check")
-        .arg("-C")
-        .arg(env!("CARGO_MANIFEST_DIR"))
-        .arg("hello?");
-    cmd.env("CODEX_HOME", home.path())
-        .env("OPENAI_API_KEY", "dummy")
-        .env("CODEX_RS_SSE_FIXTURE", fixture)
-        .env("OPENAI_BASE_URL", "http://unused.local");
-
-    let output = cmd.output().unwrap();
-    assert!(output.status.success());
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    assert!(stdout.contains("fixture hello"));
-}

codex-rs/core/tests/fixtures/completed_template.json

@@ -1,16 +0,0 @@
-[
-  {
-    "type": "response.completed",
-    "response": {
-      "id": "__ID__",
-      "usage": {
-        "input_tokens": 0,
-        "input_tokens_details": null,
-        "output_tokens": 0,
-        "output_tokens_details": null,
-        "total_tokens": 0
-      },
-      "output": []
-    }
-  }
-]

codex-rs/core/tests/fixtures/incomplete_sse.json

@@ -1,3 +0,0 @@
-[
-  {"type": "response.output_item.done"}
-]

codex-rs/core/tests/previous_response_id.rs

@@ -11,7 +11,6 @@ mod test_support;
 use serde_json::Value;
 use tempfile::TempDir;
 use test_support::load_default_config_for_test;
-use test_support::load_sse_fixture_with_id;
 use tokio::time::timeout;
 use wiremock::Match;
 use wiremock::Mock;
@@ -43,9 +42,13 @@ impl Match for HasPrevId {
     }
 }
 
-/// Build minimal SSE stream with completed marker using the JSON fixture.
+/// Build minimal SSE stream with completed marker.
 fn sse_completed(id: &str) -> String {
-    load_sse_fixture_with_id("tests/fixtures/completed_template.json", id)
+    format!(
+        "event: response.completed\n\
+data: {{\"type\":\"response.completed\",\"response\":{{\"id\":\"{}\",\"output\":[]}}}}\n\n\n",
+        id
+    )
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -104,10 +107,6 @@ async fn keeps_previous_response_id_between_tasks() {
         env_key: Some("PATH".into()),
         env_key_instructions: None,
         wire_api: codex_core::WireApi::Responses,
-        query_params: None,
-        http_headers: None,
-        env_http_headers: None,
-        supports_temperature: true,
     };
 
     // Init session

codex-rs/core/tests/stream_no_completed.rs

@@ -12,8 +12,6 @@ use codex_core::protocol::Op;
 mod test_support;
 use tempfile::TempDir;
 use test_support::load_default_config_for_test;
-use test_support::load_sse_fixture;
-use test_support::load_sse_fixture_with_id;
 use tokio::time::timeout;
 use wiremock::Mock;
 use wiremock::MockServer;
@@ -24,11 +22,16 @@ use wiremock::matchers::method;
 use wiremock::matchers::path;
 
 fn sse_incomplete() -> String {
-    load_sse_fixture("tests/fixtures/incomplete_sse.json")
+    // Only a single line; missing the completed event.
+    "event: response.output_item.done\n\n".to_string()
 }
 
 fn sse_completed(id: &str) -> String {
-    load_sse_fixture_with_id("tests/fixtures/completed_template.json", id)
+    format!(
+        "event: response.completed\n\
+data: {{\"type\":\"response.completed\",\"response\":{{\"id\":\"{}\",\"output\":[]}}}}\n\n\n",
+        id
+    )
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -93,10 +96,6 @@ async fn retries_on_early_close() {
         env_key: Some("PATH".into()),
         env_key_instructions: None,
         wire_api: codex_core::WireApi::Responses,
-        query_params: None,
-        http_headers: None,
-        env_http_headers: None,
-        supports_temperature: true,
     };
 
     let ctrl_c = std::sync::Arc::new(tokio::sync::Notify::new());

codex-rs/core/tests/test_support.rs

@@ -21,58 +21,3 @@ pub fn load_default_config_for_test(codex_home: &TempDir) -> Config {
     )
     .expect("defaults for test should always succeed")
 }
-
-/// Builds an SSE stream body from a JSON fixture.
-///
-/// The fixture must contain an array of objects where each object represents a
-/// single SSE event with at least a `type` field matching the `event:` value.
-/// Additional fields become the JSON payload for the `data:` line. An object
-/// with only a `type` field results in an event with no `data:` section. This
-/// makes it trivial to extend the fixtures as OpenAI adds new event kinds or
-/// fields.
-#[allow(dead_code)]
-pub fn load_sse_fixture(path: impl AsRef<std::path::Path>) -> String {
-    let events: Vec<serde_json::Value> =
-        serde_json::from_reader(std::fs::File::open(path).expect("read fixture"))
-            .expect("parse JSON fixture");
-    events
-        .into_iter()
-        .map(|e| {
-            let kind = e
-                .get("type")
-                .and_then(|v| v.as_str())
-                .expect("fixture event missing type");
-            if e.as_object().map(|o| o.len() == 1).unwrap_or(false) {
-                format!("event: {kind}\n\n")
-            } else {
-                format!("event: {kind}\ndata: {e}\n\n")
-            }
-        })
-        .collect()
-}
-
-/// Same as [`load_sse_fixture`], but replaces the placeholder `__ID__` in the
-/// fixture template with the supplied identifier before parsing. This lets a
-/// single JSON template be reused by multiple tests that each need a unique
-/// `response_id`.
-#[allow(dead_code)]
-pub fn load_sse_fixture_with_id(path: impl AsRef<std::path::Path>, id: &str) -> String {
-    let raw = std::fs::read_to_string(path).expect("read fixture template");
-    let replaced = raw.replace("__ID__", id);
-    let events: Vec<serde_json::Value> =
-        serde_json::from_str(&replaced).expect("parse JSON fixture");
-    events
-        .into_iter()
-        .map(|e| {
-            let kind = e
-                .get("type")
-                .and_then(|v| v.as_str())
-                .expect("fixture event missing type");
-            if e.as_object().map(|o| o.len() == 1).unwrap_or(false) {
-                format!("event: {kind}\n\n")
-            } else {
-                format!("event: {kind}\ndata: {e}\n\n")
-            }
-        })
-        .collect()
-}

codex-rs/exec/Cargo.toml

@@ -19,12 +19,9 @@ anyhow = "1"
 chrono = "0.4.40"
 clap = { version = "4", features = ["derive"] }
 codex-core = { path = "../core" }
-codex-common = { path = "../common", features = [
-    "cli",
-    "elapsed",
-    "sandbox_summary",
-] }
+codex-common = { path = "../common", features = ["cli", "elapsed"] }
 codex-linux-sandbox = { path = "../linux-sandbox" }
+mcp-types = { path = "../mcp-types" }
 owo-colors = "4.2.0"
 serde_json = "1"
 shlex = "1.3.0"

codex-rs/exec/src/cli.rs

@@ -1,6 +1,7 @@
 use clap::Parser;
 use clap::ValueEnum;
 use codex_common::CliConfigOverrides;
+use codex_common::SandboxPermissionOption;
 use std::path::PathBuf;
 
 #[derive(Parser, Debug)]
@@ -14,27 +15,16 @@ pub struct Cli {
     #[arg(long, short = 'm')]
     pub model: Option<String>,
 
-    /// Select the sandbox policy to use when executing model-generated shell
-    /// commands.
-    #[arg(long = "sandbox", short = 's')]
-    pub sandbox_mode: Option<codex_common::SandboxModeCliArg>,
-
     /// Configuration profile from config.toml to specify default options.
     #[arg(long = "profile", short = 'p')]
     pub config_profile: Option<String>,
 
-    /// Convenience alias for low-friction sandboxed automatic execution (-a on-failure, --sandbox workspace-write).
+    /// Convenience alias for low-friction sandboxed automatic execution (network-disabled sandbox that can write to cwd and TMPDIR)
     #[arg(long = "full-auto", default_value_t = false)]
     pub full_auto: bool,
 
-    /// Skip all confirmation prompts and execute commands without sandboxing.
-    /// EXTREMELY DANGEROUS. Intended solely for running in environments that are externally sandboxed.
-    #[arg(
-        long = "dangerously-bypass-approvals-and-sandbox",
-        default_value_t = false,
-        conflicts_with = "full_auto"
-    )]
-    pub dangerously_bypass_approvals_and_sandbox: bool,
+    #[clap(flatten)]
+    pub sandbox: SandboxPermissionOption,
 
     /// Tell the agent to use the specified directory as its working root.
     #[clap(long = "cd", short = 'C', value_name = "DIR")]

codex-rs/exec/src/event_processor.rs

@@ -1,5 +1,4 @@
 use codex_common::elapsed::format_elapsed;
-use codex_common::summarize_sandbox_policy;
 use codex_core::WireApi;
 use codex_core::config::Config;
 use codex_core::model_supports_reasoning_summaries;
@@ -16,7 +15,6 @@ use codex_core::protocol::McpToolCallEndEvent;
 use codex_core::protocol::PatchApplyBeginEvent;
 use codex_core::protocol::PatchApplyEndEvent;
 use codex_core::protocol::SessionConfiguredEvent;
-use codex_core::protocol::TokenUsage;
 use owo_colors::OwoColorize;
 use owo_colors::Style;
 use shlex::try_join;
@@ -136,10 +134,10 @@ impl EventProcessor {
             ("model", config.model.clone()),
             ("provider", config.model_provider_id.clone()),
             ("approval", format!("{:?}", config.approval_policy)),
-            ("sandbox", summarize_sandbox_policy(&config.sandbox_policy)),
+            ("sandbox", format!("{:?}", config.sandbox_policy)),
         ];
         if config.model_provider.wire_api == WireApi::Responses
-            && model_supports_reasoning_summaries(config)
+            && model_supports_reasoning_summaries(&config.model)
         {
             entries.push((
                 "reasoning effort",
@@ -181,9 +179,6 @@ impl EventProcessor {
             EventMsg::TaskStarted | EventMsg::TaskComplete(_) => {
                 // Ignore.
             }
-            EventMsg::TokenCount(TokenUsage { total_tokens, .. }) => {
-                ts_println!(self, "tokens used: {total_tokens}");
-            }
             EventMsg::AgentMessage(AgentMessageEvent { message }) => {
                 ts_println!(
                     self,
@@ -415,7 +410,7 @@ impl EventProcessor {
                 {
                     (
                         format!(" in {}", format_elapsed(start_time)),
-                        format!("apply_patch(auto_approved={auto_approved})"),
+                        format!("apply_patch(auto_approved={})", auto_approved),
                     )
                 } else {
                     (String::new(), format!("apply_patch('{call_id}')"))

codex-rs/exec/src/lib.rs

@@ -11,12 +11,12 @@ pub use cli::Cli;
 use codex_core::codex_wrapper;
 use codex_core::config::Config;
 use codex_core::config::ConfigOverrides;
-use codex_core::config_types::SandboxMode;
 use codex_core::protocol::AskForApproval;
 use codex_core::protocol::Event;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
+use codex_core::protocol::SandboxPolicy;
 use codex_core::protocol::TaskCompleteEvent;
 use codex_core::util::is_inside_git_repo;
 use event_processor::EventProcessor;
@@ -31,12 +31,11 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
         model,
         config_profile,
         full_auto,
-        dangerously_bypass_approvals_and_sandbox,
+        sandbox,
         cwd,
         skip_git_repo_check,
         color,
         last_message_file,
-        sandbox_mode: sandbox_mode_cli_arg,
         prompt,
         config_overrides,
     } = cli;
@@ -85,12 +84,10 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
         ),
     };
 
-    let sandbox_mode = if full_auto {
-        Some(SandboxMode::WorkspaceWrite)
-    } else if dangerously_bypass_approvals_and_sandbox {
-        Some(SandboxMode::DangerFullAccess)
+    let sandbox_policy = if full_auto {
+        Some(SandboxPolicy::new_full_auto_policy())
     } else {
-        sandbox_mode_cli_arg.map(Into::<SandboxMode>::into)
+        sandbox.permissions.clone().map(Into::into)
     };
 
     // Load configuration and determine approval policy
@@ -100,7 +97,7 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
         // This CLI is intended to be headless and has no affordances for asking
         // the user for approval.
         approval_policy: Some(AskForApproval::Never),
-        sandbox_mode,
+        sandbox_policy,
         cwd: cwd.map(|p| p.canonicalize().unwrap_or(p)),
         model_provider: None,
         codex_linux_sandbox_exe,

codex-rs/execpolicy/Cargo.toml

@@ -19,7 +19,7 @@ anyhow = "1"
 starlark = "0.13.0"
 allocative = "0.3.3"
 clap = { version = "4", features = ["derive"] }
-derive_more = { version = "2", features = ["display"] }
+derive_more = { version = "1", features = ["display"] }
 env_logger = "0.11.5"
 log = "0.4"
 multimap = "0.10.0"
@@ -28,6 +28,4 @@ regex-lite = "0.1"
 serde = { version = "1.0.194", features = ["derive"] }
 serde_json = "1.0.110"
 serde_with = { version = "3", features = ["macros"] }
-
-[dev-dependencies]
 tempfile = "3.13.0"

codex-rs/execpolicy/src/exec_call.rs

@@ -21,7 +21,7 @@ impl Display for ExecCall {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "{}", self.program)?;
         for arg in &self.args {
-            write!(f, " {arg}")?;
+            write!(f, " {}", arg)?;
         }
         Ok(())
     }

codex-rs/execpolicy/src/main.rs

@@ -89,7 +89,7 @@ fn main() -> Result<()> {
 
     let (output, exit_code) = check_command(&policy, exec, args.require_safe);
     let json = serde_json::to_string(&output)?;
-    println!("{json}");
+    println!("{}", json);
     std::process::exit(exit_code);
 }
 

codex-rs/execpolicy/src/policy.rs

@@ -63,7 +63,7 @@ impl Policy {
                             arg: arg.clone(),
                             exec_call: exec_call.clone(),
                         },
-                        reason: format!("arg `{arg}` contains forbidden substring"),
+                        reason: format!("arg `{}` contains forbidden substring", arg),
                     });
                 }
             }

codex-rs/execpolicy/src/policy_parser.rs

@@ -101,7 +101,7 @@ impl PolicyBuilder {
     }
 
     fn add_program_spec(&self, program_spec: ProgramSpec) {
-        info!("adding program spec: {program_spec:?}");
+        info!("adding program spec: {:?}", program_spec);
         let name = program_spec.program.clone();
         let mut programs = self.programs.borrow_mut();
         programs.insert(name.clone(), program_spec);

codex-rs/file-search/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "codex-file-search"
-version = { workspace = true }
-edition = "2024"
-
-[[bin]]
-name = "codex-file-search"
-path = "src/main.rs"
-
-[lib]
-name = "codex_file_search"
-path = "src/lib.rs"
-
-[dependencies]
-anyhow = "1"
-clap = { version = "4", features = ["derive"] }
-ignore = "0.4.23"
-nucleo-matcher = "0.3.1"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1.0.110"
-tokio = { version = "1", features = ["full"] }

codex-rs/file-search/README.md

@@ -1,5 +0,0 @@
-# codex_file_search
-
-Fast fuzzy file search tool for Codex.
-
-Uses <https://crates.io/crates/ignore> under the hood (which is what `ripgrep` uses) to traverse a directory (while honoring `.gitignore`, etc.) to produce the list of files to search and then uses <https://crates.io/crates/nucleo-matcher> to fuzzy-match the user supplied `PATTERN` against the corpus.

codex-rs/file-search/src/cli.rs

@@ -1,42 +0,0 @@
-use std::num::NonZero;
-use std::path::PathBuf;
-
-use clap::ArgAction;
-use clap::Parser;
-
-/// Fuzzy matches filenames under a directory.
-#[derive(Parser)]
-#[command(version)]
-pub struct Cli {
-    /// Whether to output results in JSON format.
-    #[clap(long, default_value = "false")]
-    pub json: bool,
-
-    /// Maximum number of results to return.
-    #[clap(long, short = 'l', default_value = "64")]
-    pub limit: NonZero<usize>,
-
-    /// Directory to search.
-    #[clap(long, short = 'C')]
-    pub cwd: Option<PathBuf>,
-
-    /// Include matching file indices in the output.
-    #[arg(long, default_value = "false")]
-    pub compute_indices: bool,
-
-    // While it is common to default to the number of logical CPUs when creating
-    // a thread pool, empirically, the I/O of the filetree traversal offers
-    // limited parallelism and is the bottleneck, so using a smaller number of
-    // threads is more efficient. (Empirically, using more than 2 threads doesn't seem to provide much benefit.)
-    //
-    /// Number of worker threads to use.
-    #[clap(long, default_value = "2")]
-    pub threads: NonZero<usize>,
-
-    /// Exclude patterns
-    #[arg(short, long, action = ArgAction::Append)]
-    pub exclude: Vec<String>,
-
-    /// Search pattern.
-    pub pattern: Option<String>,
-}

codex-rs/file-search/src/lib.rs

@@ -1,400 +0,0 @@
-use ignore::WalkBuilder;
-use ignore::overrides::OverrideBuilder;
-use nucleo_matcher::Matcher;
-use nucleo_matcher::Utf32Str;
-use nucleo_matcher::pattern::AtomKind;
-use nucleo_matcher::pattern::CaseMatching;
-use nucleo_matcher::pattern::Normalization;
-use nucleo_matcher::pattern::Pattern;
-use serde::Serialize;
-use std::cell::UnsafeCell;
-use std::cmp::Reverse;
-use std::collections::BinaryHeap;
-use std::num::NonZero;
-use std::path::Path;
-use std::sync::Arc;
-use std::sync::atomic::AtomicBool;
-use std::sync::atomic::AtomicUsize;
-use std::sync::atomic::Ordering;
-use tokio::process::Command;
-
-mod cli;
-
-pub use cli::Cli;
-
-/// A single match result returned from the search.
-///
-/// * `score` – Relevance score returned by `nucleo_matcher`.
-/// * `path`  – Path to the matched file (relative to the search directory).
-/// * `indices` – Optional list of character indices that matched the query.
-///   These are only filled when the caller of [`run`] sets
-///   `compute_indices` to `true`.  The indices vector follows the
-///   guidance from `nucleo_matcher::Pattern::indices`: they are
-///   unique and sorted in ascending order so that callers can use
-///   them directly for highlighting.
-#[derive(Debug, Clone, Serialize)]
-pub struct FileMatch {
-    pub score: u32,
-    pub path: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub indices: Option<Vec<u32>>, // Sorted & deduplicated when present
-}
-
-pub struct FileSearchResults {
-    pub matches: Vec<FileMatch>,
-    pub total_match_count: usize,
-}
-
-pub trait Reporter {
-    fn report_match(&self, file_match: &FileMatch);
-    fn warn_matches_truncated(&self, total_match_count: usize, shown_match_count: usize);
-    fn warn_no_search_pattern(&self, search_directory: &Path);
-}
-
-pub async fn run_main<T: Reporter>(
-    Cli {
-        pattern,
-        limit,
-        cwd,
-        compute_indices,
-        json: _,
-        exclude,
-        threads,
-    }: Cli,
-    reporter: T,
-) -> anyhow::Result<()> {
-    let search_directory = match cwd {
-        Some(dir) => dir,
-        None => std::env::current_dir()?,
-    };
-    let pattern_text = match pattern {
-        Some(pattern) => pattern,
-        None => {
-            reporter.warn_no_search_pattern(&search_directory);
-            #[cfg(unix)]
-            Command::new("ls")
-                .arg("-al")
-                .current_dir(search_directory)
-                .stdout(std::process::Stdio::inherit())
-                .stderr(std::process::Stdio::inherit())
-                .status()
-                .await?;
-            #[cfg(windows)]
-            {
-                Command::new("cmd")
-                    .arg("/c")
-                    .arg(search_directory)
-                    .stdout(std::process::Stdio::inherit())
-                    .stderr(std::process::Stdio::inherit())
-                    .status()
-                    .await?;
-            }
-            return Ok(());
-        }
-    };
-
-    let cancel_flag = Arc::new(AtomicBool::new(false));
-    let FileSearchResults {
-        total_match_count,
-        matches,
-    } = run(
-        &pattern_text,
-        limit,
-        &search_directory,
-        exclude,
-        threads,
-        cancel_flag,
-        compute_indices,
-    )?;
-    let match_count = matches.len();
-    let matches_truncated = total_match_count > match_count;
-
-    for file_match in matches {
-        reporter.report_match(&file_match);
-    }
-    if matches_truncated {
-        reporter.warn_matches_truncated(total_match_count, match_count);
-    }
-
-    Ok(())
-}
-
-/// The worker threads will periodically check `cancel_flag` to see if they
-/// should stop processing files.
-pub fn run(
-    pattern_text: &str,
-    limit: NonZero<usize>,
-    search_directory: &Path,
-    exclude: Vec<String>,
-    threads: NonZero<usize>,
-    cancel_flag: Arc<AtomicBool>,
-    compute_indices: bool,
-) -> anyhow::Result<FileSearchResults> {
-    let pattern = create_pattern(pattern_text);
-    // Create one BestMatchesList per worker thread so that each worker can
-    // operate independently. The results across threads will be merged when
-    // the traversal is complete.
-    let WorkerCount {
-        num_walk_builder_threads,
-        num_best_matches_lists,
-    } = create_worker_count(threads);
-    let best_matchers_per_worker: Vec<UnsafeCell<BestMatchesList>> = (0..num_best_matches_lists)
-        .map(|_| {
-            UnsafeCell::new(BestMatchesList::new(
-                limit.get(),
-                pattern.clone(),
-                Matcher::new(nucleo_matcher::Config::DEFAULT),
-            ))
-        })
-        .collect();
-
-    // Use the same tree-walker library that ripgrep uses. We use it directly so
-    // that we can leverage the parallelism it provides.
-    let mut walk_builder = WalkBuilder::new(search_directory);
-    walk_builder.threads(num_walk_builder_threads);
-    if !exclude.is_empty() {
-        let mut override_builder = OverrideBuilder::new(search_directory);
-        for exclude in exclude {
-            // The `!` prefix is used to indicate an exclude pattern.
-            let exclude_pattern = format!("!{exclude}");
-            override_builder.add(&exclude_pattern)?;
-        }
-        let override_matcher = override_builder.build()?;
-        walk_builder.overrides(override_matcher);
-    }
-    let walker = walk_builder.build_parallel();
-
-    // Each worker created by `WalkParallel::run()` will have its own
-    // `BestMatchesList` to update.
-    let index_counter = AtomicUsize::new(0);
-    walker.run(|| {
-        let index = index_counter.fetch_add(1, Ordering::Relaxed);
-        let best_list_ptr = best_matchers_per_worker[index].get();
-        let best_list = unsafe { &mut *best_list_ptr };
-
-        // Each worker keeps a local counter so we only read the atomic flag
-        // every N entries which is cheaper than checking on every file.
-        const CHECK_INTERVAL: usize = 1024;
-        let mut processed = 0;
-
-        let cancel = cancel_flag.clone();
-
-        Box::new(move |entry| {
-            if let Some(path) = get_file_path(&entry, search_directory) {
-                best_list.insert(path);
-            }
-
-            processed += 1;
-            if processed % CHECK_INTERVAL == 0 && cancel.load(Ordering::Relaxed) {
-                ignore::WalkState::Quit
-            } else {
-                ignore::WalkState::Continue
-            }
-        })
-    });
-
-    fn get_file_path<'a>(
-        entry_result: &'a Result<ignore::DirEntry, ignore::Error>,
-        search_directory: &std::path::Path,
-    ) -> Option<&'a str> {
-        let entry = match entry_result {
-            Ok(e) => e,
-            Err(_) => return None,
-        };
-        if entry.file_type().is_some_and(|ft| ft.is_dir()) {
-            return None;
-        }
-        let path = entry.path();
-        match path.strip_prefix(search_directory) {
-            Ok(rel_path) => rel_path.to_str(),
-            Err(_) => None,
-        }
-    }
-
-    // If the cancel flag is set, we return early with an empty result.
-    if cancel_flag.load(Ordering::Relaxed) {
-        return Ok(FileSearchResults {
-            matches: Vec::new(),
-            total_match_count: 0,
-        });
-    }
-
-    // Merge results across best_matchers_per_worker.
-    let mut global_heap: BinaryHeap<Reverse<(u32, String)>> = BinaryHeap::new();
-    let mut total_match_count = 0;
-    for best_list_cell in best_matchers_per_worker.iter() {
-        let best_list = unsafe { &*best_list_cell.get() };
-        total_match_count += best_list.num_matches;
-        for &Reverse((score, ref line)) in best_list.binary_heap.iter() {
-            if global_heap.len() < limit.get() {
-                global_heap.push(Reverse((score, line.clone())));
-            } else if let Some(min_element) = global_heap.peek() {
-                if score > min_element.0.0 {
-                    global_heap.pop();
-                    global_heap.push(Reverse((score, line.clone())));
-                }
-            }
-        }
-    }
-
-    let mut raw_matches: Vec<(u32, String)> = global_heap.into_iter().map(|r| r.0).collect();
-    sort_matches(&mut raw_matches);
-
-    // Transform into `FileMatch`, optionally computing indices.
-    let mut matcher = if compute_indices {
-        Some(Matcher::new(nucleo_matcher::Config::DEFAULT))
-    } else {
-        None
-    };
-
-    let matches: Vec<FileMatch> = raw_matches
-        .into_iter()
-        .map(|(score, path)| {
-            let indices = if compute_indices {
-                let mut buf = Vec::<char>::new();
-                let haystack: Utf32Str<'_> = Utf32Str::new(&path, &mut buf);
-                let mut idx_vec: Vec<u32> = Vec::new();
-                if let Some(ref mut m) = matcher {
-                    // Ignore the score returned from indices – we already have `score`.
-                    pattern.indices(haystack, m, &mut idx_vec);
-                }
-                idx_vec.sort_unstable();
-                idx_vec.dedup();
-                Some(idx_vec)
-            } else {
-                None
-            };
-
-            FileMatch {
-                score,
-                path,
-                indices,
-            }
-        })
-        .collect();
-
-    Ok(FileSearchResults {
-        matches,
-        total_match_count,
-    })
-}
-
-/// Sort matches in-place by descending score, then ascending path.
-fn sort_matches(matches: &mut [(u32, String)]) {
-    matches.sort_by(|a, b| match b.0.cmp(&a.0) {
-        std::cmp::Ordering::Equal => a.1.cmp(&b.1),
-        other => other,
-    });
-}
-
-/// Maintains the `max_count` best matches for a given pattern.
-struct BestMatchesList {
-    max_count: usize,
-    num_matches: usize,
-    pattern: Pattern,
-    matcher: Matcher,
-    binary_heap: BinaryHeap<Reverse<(u32, String)>>,
-
-    /// Internal buffer for converting strings to UTF-32.
-    utf32buf: Vec<char>,
-}
-
-impl BestMatchesList {
-    fn new(max_count: usize, pattern: Pattern, matcher: Matcher) -> Self {
-        Self {
-            max_count,
-            num_matches: 0,
-            pattern,
-            matcher,
-            binary_heap: BinaryHeap::new(),
-            utf32buf: Vec::<char>::new(),
-        }
-    }
-
-    fn insert(&mut self, line: &str) {
-        let haystack: Utf32Str<'_> = Utf32Str::new(line, &mut self.utf32buf);
-        if let Some(score) = self.pattern.score(haystack, &mut self.matcher) {
-            // In the tests below, we verify that score() returns None for a
-            // non-match, so we can categorically increment the count here.
-            self.num_matches += 1;
-
-            if self.binary_heap.len() < self.max_count {
-                self.binary_heap.push(Reverse((score, line.to_string())));
-            } else if let Some(min_element) = self.binary_heap.peek() {
-                if score > min_element.0.0 {
-                    self.binary_heap.pop();
-                    self.binary_heap.push(Reverse((score, line.to_string())));
-                }
-            }
-        }
-    }
-}
-
-struct WorkerCount {
-    num_walk_builder_threads: usize,
-    num_best_matches_lists: usize,
-}
-
-fn create_worker_count(num_workers: NonZero<usize>) -> WorkerCount {
-    // It appears that the number of times the function passed to
-    // `WalkParallel::run()` is called is: the number of threads specified to
-    // the builder PLUS ONE.
-    //
-    // In `WalkParallel::visit()`, the builder function gets called once here:
-    // https://github.com/BurntSushi/ripgrep/blob/79cbe89deb1151e703f4d91b19af9cdcc128b765/crates/ignore/src/walk.rs#L1233
-    //
-    // And then once for every worker here:
-    // https://github.com/BurntSushi/ripgrep/blob/79cbe89deb1151e703f4d91b19af9cdcc128b765/crates/ignore/src/walk.rs#L1288
-    let num_walk_builder_threads = num_workers.get();
-    let num_best_matches_lists = num_walk_builder_threads + 1;
-
-    WorkerCount {
-        num_walk_builder_threads,
-        num_best_matches_lists,
-    }
-}
-
-fn create_pattern(pattern: &str) -> Pattern {
-    Pattern::new(
-        pattern,
-        CaseMatching::Smart,
-        Normalization::Smart,
-        AtomKind::Fuzzy,
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn verify_score_is_none_for_non_match() {
-        let mut utf32buf = Vec::<char>::new();
-        let line = "hello";
-        let mut matcher = Matcher::new(nucleo_matcher::Config::DEFAULT);
-        let haystack: Utf32Str<'_> = Utf32Str::new(line, &mut utf32buf);
-        let pattern = create_pattern("zzz");
-        let score = pattern.score(haystack, &mut matcher);
-        assert_eq!(score, None);
-    }
-
-    #[test]
-    fn tie_breakers_sort_by_path_when_scores_equal() {
-        let mut matches = vec![
-            (100, "b_path".to_string()),
-            (100, "a_path".to_string()),
-            (90, "zzz".to_string()),
-        ];
-
-        sort_matches(&mut matches);
-
-        // Highest score first; ties broken alphabetically.
-        let expected = vec![
-            (100, "a_path".to_string()),
-            (100, "b_path".to_string()),
-            (90, "zzz".to_string()),
-        ];
-
-        assert_eq!(matches, expected);
-    }
-}

codex-rs/file-search/src/main.rs

@@ -1,78 +0,0 @@
-use std::io::IsTerminal;
-use std::path::Path;
-
-use clap::Parser;
-use codex_file_search::Cli;
-use codex_file_search::FileMatch;
-use codex_file_search::Reporter;
-use codex_file_search::run_main;
-use serde_json::json;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let cli = Cli::parse();
-    let reporter = StdioReporter {
-        write_output_as_json: cli.json,
-        show_indices: cli.compute_indices && std::io::stdout().is_terminal(),
-    };
-    run_main(cli, reporter).await?;
-    Ok(())
-}
-
-struct StdioReporter {
-    write_output_as_json: bool,
-    show_indices: bool,
-}
-
-impl Reporter for StdioReporter {
-    fn report_match(&self, file_match: &FileMatch) {
-        if self.write_output_as_json {
-            println!("{}", serde_json::to_string(&file_match).unwrap());
-        } else if self.show_indices {
-            let indices = file_match
-                .indices
-                .as_ref()
-                .expect("--compute-indices was specified");
-            // `indices` is guaranteed to be sorted in ascending order. Instead
-            // of calling `contains` for every character (which would be O(N^2)
-            // in the worst-case), walk through the `indices` vector once while
-            // iterating over the characters.
-            let mut indices_iter = indices.iter().peekable();
-
-            for (i, c) in file_match.path.chars().enumerate() {
-                match indices_iter.peek() {
-                    Some(next) if **next == i as u32 => {
-                        // ANSI escape code for bold: \x1b[1m ... \x1b[0m
-                        print!("\x1b[1m{c}\x1b[0m");
-                        // advance the iterator since we've consumed this index
-                        indices_iter.next();
-                    }
-                    _ => {
-                        print!("{c}");
-                    }
-                }
-            }
-            println!();
-        } else {
-            println!("{}", file_match.path);
-        }
-    }
-
-    fn warn_matches_truncated(&self, total_match_count: usize, shown_match_count: usize) {
-        if self.write_output_as_json {
-            let value = json!({"matches_truncated": true});
-            println!("{}", serde_json::to_string(&value).unwrap());
-        } else {
-            eprintln!(
-                "Warning: showing {shown_match_count} out of {total_match_count} results. Provide a more specific pattern or increase the --limit.",
-            );
-        }
-    }
-
-    fn warn_no_search_pattern(&self, search_directory: &Path) {
-        eprintln!(
-            "No search pattern specified. Showing the contents of the current directory ({}):",
-            search_directory.to_string_lossy()
-        );
-    }
-}

codex-rs/justfile

@@ -16,10 +16,6 @@ exec *args:
 tui *args:
     cargo run --bin codex -- tui "$@"
 
-# Run the CLI version of the file-search crate.
-file-search *args:
-    cargo run --bin codex-file-search -- "$@"
-
 # format code
 fmt:
     cargo fmt -- --config imports_granularity=Item

codex-rs/linux-sandbox/Cargo.toml

@@ -15,9 +15,15 @@ path = "src/lib.rs"
 workspace = true
 
 [dependencies]
-anyhow = "1"
 clap = { version = "4", features = ["derive"] }
 codex-core = { path = "../core" }
+codex-common = { path = "../common", features = ["cli"] }
+
+# Used for error handling in the helper that unifies runtime dispatch across
+# binaries.
+anyhow = "1"
+# Required to construct a Tokio runtime for async execution of the caller's
+# entry-point.
 tokio = { version = "1", features = ["rt-multi-thread"] }
 
 [dev-dependencies]