rate-limit-error

2026-02-08 18:03:37 +00:00 · 2025-09-23 22:27:28 -07:00 · 2025-09-23 21:39:13 -07:00 · 2025-09-23 21:35:02 -07:00 · 2025-09-23 21:28:18 -07:00 · 2025-09-23 21:16:14 -07:00
237 changed files with 4982 additions and 13815 deletions
--- a/.github/dotslash-config.json
+++ b/.github/dotslash-config.json
@@ -27,34 +27,6 @@
          "path": "codex.exe"
        }
      }
-    },
-    "codex-responses-api-proxy": {
-      "platforms": {
-        "macos-aarch64": {
-          "regex": "^codex-responses-api-proxy-aarch64-apple-darwin\\.zst$",
-          "path": "codex-responses-api-proxy"
-        },
-        "macos-x86_64": {
-          "regex": "^codex-responses-api-proxy-x86_64-apple-darwin\\.zst$",
-          "path": "codex-responses-api-proxy"
-        },
-        "linux-x86_64": {
-          "regex": "^codex-responses-api-proxy-x86_64-unknown-linux-musl\\.zst$",
-          "path": "codex-responses-api-proxy"
-        },
-        "linux-aarch64": {
-          "regex": "^codex-responses-api-proxy-aarch64-unknown-linux-musl\\.zst$",
-          "path": "codex-responses-api-proxy"
-        },
-        "windows-x86_64": {
-          "regex": "^codex-responses-api-proxy-x86_64-pc-windows-msvc\\.exe\\.zst$",
-          "path": "codex-responses-api-proxy.exe"
-        },
-        "windows-aarch64": {
-          "regex": "^codex-responses-api-proxy-aarch64-pc-windows-msvc\\.exe\\.zst$",
-          "path": "codex-responses-api-proxy.exe"
-        }
-      }
    }
  }
 }
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,7 @@
 name: ci

 on:
-  pull_request: {}
+  pull_request: { branches: [main] }
  push: { branches: [main] }

 jobs:
@@ -27,27 +27,12 @@ jobs:
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

-      # build_npm_package.py requires DotSlash when staging releases.
-      - uses: facebook/install-dotslash@v2
+      # Run all tasks using workspace filters

-      - name: Stage npm package
-        id: stage_npm_package
+      - name: Ensure staging a release works.
        env:
          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          CODEX_VERSION=0.40.0
-          PACK_OUTPUT="${RUNNER_TEMP}/codex-npm.tgz"
-          python3 ./codex-cli/scripts/build_npm_package.py \
-            --release-version "$CODEX_VERSION" \
-            --pack-output "$PACK_OUTPUT"
-          echo "pack_output=$PACK_OUTPUT" >> "$GITHUB_OUTPUT"
-
-      - name: Upload staged npm package artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: codex-npm-staging
-          path: ${{ steps.stage_npm_package.outputs.pack_output }}
+        run: ./codex-cli/scripts/stage_release.sh

      - name: Ensure root README.md contains only ASCII and certain Unicode code points
        run: ./scripts/asciicheck.py README.md
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -22,7 +22,7 @@ jobs:
      - name: Annotate locations with typos
        uses: codespell-project/codespell-problem-matcher@b80729f885d32f78a716c2f107b4db1025001c42 # v1
      - name: Codespell
-        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2.1
+        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
        with:
          ignore_words_file: .codespellignore
          skip: frame*.txt
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -57,7 +57,7 @@ jobs:
        working-directory: codex-rs
    steps:
      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.90
+      - uses: dtolnay/rust-toolchain@1.89
        with:
          components: rustfmt
      - name: cargo fmt
@@ -75,7 +75,7 @@ jobs:
        working-directory: codex-rs
    steps:
      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.90
+      - uses: dtolnay/rust-toolchain@1.89
      - uses: taiki-e/install-action@0c5db7f7f897c03b771660e91d065338615679f4 # v2
        with:
          tool: cargo-shear
@@ -143,7 +143,7 @@ jobs:

    steps:
      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.90
+      - uses: dtolnay/rust-toolchain@1.89
        with:
          targets: ${{ matrix.target }}
          components: clippy
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -77,7 +77,7 @@ jobs:

    steps:
      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.90
+      - uses: dtolnay/rust-toolchain@1.89
        with:
          targets: ${{ matrix.target }}

@@ -97,7 +97,7 @@ jobs:
          sudo apt install -y musl-tools pkg-config

      - name: Cargo build
-        run: cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy
+        run: cargo build --target ${{ matrix.target }} --release --bin codex

      - name: Stage artifacts
        shell: bash
@@ -107,10 +107,8 @@ jobs:

          if [[ "${{ matrix.runner }}" == windows* ]]; then
            cp target/${{ matrix.target }}/release/codex.exe "$dest/codex-${{ matrix.target }}.exe"
-            cp target/${{ matrix.target }}/release/codex-responses-api-proxy.exe "$dest/codex-responses-api-proxy-${{ matrix.target }}.exe"
          else
            cp target/${{ matrix.target }}/release/codex "$dest/codex-${{ matrix.target }}"
-            cp target/${{ matrix.target }}/release/codex-responses-api-proxy "$dest/codex-responses-api-proxy-${{ matrix.target }}"
          fi

      - if: ${{ matrix.runner == 'windows-11-arm' }}
@@ -175,8 +173,6 @@ jobs:
    outputs:
      version: ${{ steps.release_name.outputs.name }}
      tag: ${{ github.ref_name }}
-      should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }}
-      npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }}

    steps:
      - name: Checkout repository
@@ -197,50 +193,21 @@ jobs:
          version="${GITHUB_REF_NAME#rust-v}"
          echo "name=${version}" >> $GITHUB_OUTPUT

-      - name: Determine npm publish settings
-        id: npm_publish_settings
-        env:
-          VERSION: ${{ steps.release_name.outputs.name }}
-        run: |
-          set -euo pipefail
-          version="${VERSION}"
-
-          if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "should_publish=true" >> "$GITHUB_OUTPUT"
-            echo "npm_tag=" >> "$GITHUB_OUTPUT"
-          elif [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then
-            echo "should_publish=true" >> "$GITHUB_OUTPUT"
-            echo "npm_tag=alpha" >> "$GITHUB_OUTPUT"
-          else
-            echo "should_publish=false" >> "$GITHUB_OUTPUT"
-            echo "npm_tag=" >> "$GITHUB_OUTPUT"
-          fi
-
-      # build_npm_package.py requires DotSlash when staging releases.
-      - uses: facebook/install-dotslash@v2
-      - name: Stage codex CLI npm package
+      - name: Stage npm package
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          TMP_DIR="${RUNNER_TEMP}/npm-stage"
-          ./codex-cli/scripts/build_npm_package.py \
-            --package codex \
+          python3 codex-cli/scripts/stage_rust_release.py \
            --release-version "${{ steps.release_name.outputs.name }}" \
-            --staging-dir "${TMP_DIR}" \
-            --pack-output "${GITHUB_WORKSPACE}/dist/npm/codex-npm-${{ steps.release_name.outputs.name }}.tgz"
-
-      - name: Stage responses API proxy npm package
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          TMP_DIR="${RUNNER_TEMP}/npm-stage-responses"
-          ./codex-cli/scripts/build_npm_package.py \
-            --package codex-responses-api-proxy \
-            --release-version "${{ steps.release_name.outputs.name }}" \
-            --staging-dir "${TMP_DIR}" \
-            --pack-output "${GITHUB_WORKSPACE}/dist/npm/codex-responses-api-proxy-npm-${{ steps.release_name.outputs.name }}.tgz"
+            --tmp "${TMP_DIR}"
+          mkdir -p dist/npm
+          # Produce an npm-ready tarball using `npm pack` and store it in dist/npm.
+          # We then rename it to a stable name used by our publishing script.
+          (cd "$TMP_DIR" && npm pack --pack-destination "${GITHUB_WORKSPACE}/dist/npm")
+          mv "${GITHUB_WORKSPACE}"/dist/npm/*.tgz \
+             "${GITHUB_WORKSPACE}/dist/npm/codex-npm-${{ steps.release_name.outputs.name }}.tgz"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
@@ -263,8 +230,8 @@ jobs:
  # July 31, 2025: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
  # npm docs: https://docs.npmjs.com/trusted-publishers
  publish-npm:
-    # Publish to npm for stable releases and alpha pre-releases with numeric suffixes.
-    if: ${{ needs.release.outputs.should_publish_npm == 'true' }}
+    # Skip this step for pre-releases (alpha/beta).
+    if: ${{ !contains(needs.release.outputs.version, '-') }}
    name: publish-npm
    needs: release
    runs-on: ubuntu-latest
@@ -284,7 +251,7 @@ jobs:
      - name: Update npm
        run: npm install -g npm@latest

-      - name: Download npm tarballs from release
+      - name: Download npm tarball from release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
@@ -296,31 +263,10 @@ jobs:
            --repo "${GITHUB_REPOSITORY}" \
            --pattern "codex-npm-${version}.tgz" \
            --dir dist/npm
-          gh release download "$tag" \
-            --repo "${GITHUB_REPOSITORY}" \
-            --pattern "codex-responses-api-proxy-npm-${version}.tgz" \
-            --dir dist/npm

      # No NODE_AUTH_TOKEN needed because we use OIDC.
      - name: Publish to npm
-        env:
-          VERSION: ${{ needs.release.outputs.version }}
-          NPM_TAG: ${{ needs.release.outputs.npm_tag }}
-        run: |
-          set -euo pipefail
-          tag_args=()
-          if [[ -n "${NPM_TAG}" ]]; then
-            tag_args+=(--tag "${NPM_TAG}")
-          fi
-
-          tarballs=(
-            "codex-npm-${VERSION}.tgz"
-            "codex-responses-api-proxy-npm-${VERSION}.tgz"
-          )
-
-          for tarball in "${tarballs[@]}"; do
-            npm publish "${GITHUB_WORKSPACE}/dist/npm/${tarball}" "${tag_args[@]}"
-          done
+        run: npm publish "${GITHUB_WORKSPACE}/dist/npm/codex-npm-${{ needs.release.outputs.version }}.tgz"

  update-branch:
    name: Update latest-alpha-cli branch
--- a/README.md
+++ b/README.md
@@ -1,3 +1,4 @@
+<h1 align="center">OpenAI Codex CLI</h1>

 <p align="center"><code>npm i -g @openai/codex</code><br />or <code>brew install codex</code></p>

@@ -101,3 +102,4 @@ Codex CLI supports a rich set of configuration options, with preferences stored
 ## License

 This repository is licensed under the [Apache-2.0 License](LICENSE).
+
--- a/codex-cli/.gitignore
+++ b/codex-cli/.gitignore
@@ -1 +1,7 @@
-/vendor/
+# Added by ./scripts/install_native_deps.sh
+/bin/codex-aarch64-apple-darwin
+/bin/codex-aarch64-unknown-linux-musl
+/bin/codex-linux-sandbox-arm64
+/bin/codex-linux-sandbox-x64
+/bin/codex-x86_64-apple-darwin
+/bin/codex-x86_64-unknown-linux-musl
--- a/codex-cli/README.md
+++ b/codex-cli/README.md
@@ -208,7 +208,7 @@ The hardening mechanism Codex uses depends on your OS:
 | Requirement                 | Details                                                         |
 | --------------------------- | --------------------------------------------------------------- |
 | Operating systems           | macOS 12+, Ubuntu 20.04+/Debian 10+, or Windows 11 **via WSL2** |
-| Node.js                     | **16 or newer** (Node 20 LTS recommended)                       |
+| Node.js                     | **22 or newer** (LTS recommended)                               |
 | Git (optional, recommended) | 2.23+ for built-in PR helpers                                   |
 | RAM                         | 4-GB minimum (8-GB recommended)                                 |

@@ -513,7 +513,7 @@ Codex runs model-generated commands in a sandbox. If a proposed command or file
 <details>
 <summary>Does it work on Windows?</summary>

-Not directly. It requires [Windows Subsystem for Linux (WSL2)](https://learn.microsoft.com/en-us/windows/wsl/install) - Codex is regularly tested on macOS and Linux with Node 20+, and also supports Node 16.
+Not directly. It requires [Windows Subsystem for Linux (WSL2)](https://learn.microsoft.com/en-us/windows/wsl/install) - Codex has been tested on macOS and Linux with Node 22.

 </details>

--- a/codex-cli/bin/codex.js
+++ b/codex-cli/bin/codex.js
@@ -1,8 +1,6 @@
 #!/usr/bin/env node
 // Unified entry point for the Codex CLI.

-import { spawn } from "node:child_process";
-import { existsSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";

@@ -42,10 +40,10 @@ switch (platform) {
  case "win32":
    switch (arch) {
      case "x64":
-        targetTriple = "x86_64-pc-windows-msvc";
+        targetTriple = "x86_64-pc-windows-msvc.exe";
        break;
      case "arm64":
-        targetTriple = "aarch64-pc-windows-msvc";
+        targetTriple = "aarch64-pc-windows-msvc.exe";
        break;
      default:
        break;
@@ -59,16 +57,31 @@ if (!targetTriple) {
  throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }

-const vendorRoot = path.join(__dirname, "..", "vendor");
-const archRoot = path.join(vendorRoot, targetTriple);
-const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
-const binaryPath = path.join(archRoot, "codex", codexBinaryName);
+const binaryPath = path.join(__dirname, "..", "bin", `codex-${targetTriple}`);

 // Use an asynchronous spawn instead of spawnSync so that Node is able to
 // respond to signals (e.g. Ctrl-C / SIGINT) while the native binary is
 // executing. This allows us to forward those signals to the child process
 // and guarantees that when either the child terminates or the parent
 // receives a fatal signal, both processes exit in a predictable manner.
+const { spawn } = await import("child_process");
+
+async function tryImport(moduleName) {
+  try {
+    // eslint-disable-next-line node/no-unsupported-features/es-syntax
+    return await import(moduleName);
+  } catch (err) {
+    return null;
+  }
+}
+
+async function resolveRgDir() {
+  const ripgrep = await tryImport("@vscode/ripgrep");
+  if (!ripgrep?.rgPath) {
+    return null;
+  }
+  return path.dirname(ripgrep.rgPath);
+}

 function getUpdatedPath(newDirs) {
  const pathSep = process.platform === "win32" ? ";" : ":";
@@ -81,9 +94,9 @@ function getUpdatedPath(newDirs) {
 }

 const additionalDirs = [];
-const pathDir = path.join(archRoot, "path");
-if (existsSync(pathDir)) {
-  additionalDirs.push(pathDir);
+const rgDir = await resolveRgDir();
+if (rgDir) {
+  additionalDirs.push(rgDir);
 }
 const updatedPath = getUpdatedPath(additionalDirs);

--- a/codex-cli/bin/rg
+++ b/codex-cli/bin/rg
@@ -1,79 +0,0 @@
-#!/usr/bin/env dotslash
-
-{
-  "name": "rg",
-  "platforms": {
-    "macos-aarch64": {
-      "size": 1787248,
-      "hash": "blake3",
-      "digest": "8d9942032585ea8ee805937634238d9aee7b210069f4703c88fbe568e26fb78a",
-      "format": "tar.gz",
-      "path": "ripgrep-14.1.1-aarch64-apple-darwin/rg",
-      "providers": [
-        {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-apple-darwin.tar.gz"
-        }
-      ]
-    },
-    "linux-aarch64": {
-      "size": 2047405,
-      "hash": "blake3",
-      "digest": "0b670b8fa0a3df2762af2fc82cc4932f684ca4c02dbd1260d4f3133fd4b2a515",
-      "format": "tar.gz",
-      "path": "ripgrep-14.1.1-aarch64-unknown-linux-gnu/rg",
-      "providers": [
-        {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-unknown-linux-gnu.tar.gz"
-        }
-      ]
-    },
-    "macos-x86_64": {
-      "size": 2082672,
-      "hash": "blake3",
-      "digest": "e9b862fc8da3127f92791f0ff6a799504154ca9d36c98bf3e60a81c6b1f7289e",
-      "format": "tar.gz",
-      "path": "ripgrep-14.1.1-x86_64-apple-darwin/rg",
-      "providers": [
-        {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-apple-darwin.tar.gz"
-        }
-      ]
-    },
-    "linux-x86_64": {
-      "size": 2566310,
-      "hash": "blake3",
-      "digest": "f73cca4e54d78c31f832c7f6e2c0b4db8b04fa3eaa747915727d570893dbee76",
-      "format": "tar.gz",
-      "path": "ripgrep-14.1.1-x86_64-unknown-linux-musl/rg",
-      "providers": [
-        {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz"
-        }
-      ]
-    },
-    "windows-x86_64": {
-      "size": 2058893,
-      "hash": "blake3",
-      "digest": "a8ce1a6fed4f8093ee997e57f33254e94b2cd18e26358b09db599c89882eadbd",
-      "format": "zip",
-      "path": "ripgrep-14.1.1-x86_64-pc-windows-msvc/rg.exe",
-      "providers": [
-        {
-          "url": "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-pc-windows-msvc.zip"
-        }
-      ]
-    },
-    "windows-aarch64": {
-      "size": 1667740,
-      "hash": "blake3",
-      "digest": "47b971a8c4fca1d23a4e7c19bd4d88465ebc395598458133139406d3bf85f3fa",
-      "format": "zip",
-      "path": "rg.exe",
-      "providers": [
-        {
-          "url": "https://github.com/microsoft/ripgrep-prebuilt/releases/download/v13.0.0-13/ripgrep-v13.0.0-13-aarch64-pc-windows-msvc.zip"
-        }
-      ]
-    }
-  }
-}
--- a/codex-cli/package-lock.json
+++ b/codex-cli/package-lock.json
@@ -2,16 +2,117 @@
  "name": "@openai/codex",
  "version": "0.0.0-dev",
  "lockfileVersion": 3,
+  "requires": true,
  "packages": {
    "": {
      "name": "@openai/codex",
      "version": "0.0.0-dev",
      "license": "Apache-2.0",
+      "dependencies": {
+        "@vscode/ripgrep": "^1.15.14"
+      },
      "bin": {
        "codex": "bin/codex.js"
      },
      "engines": {
-        "node": ">=16"
+        "node": ">=20"
+      }
+    },
+    "node_modules/@vscode/ripgrep": {
+      "version": "1.15.14",
+      "resolved": "https://registry.npmjs.org/@vscode/ripgrep/-/ripgrep-1.15.14.tgz",
+      "integrity": "sha512-/G1UJPYlm+trBWQ6cMO3sv6b8D1+G16WaJH1/DSqw32JOVlzgZbLkDxRyzIpTpv30AcYGMkCf5tUqGlW6HbDWw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "https-proxy-agent": "^7.0.2",
+        "proxy-from-env": "^1.1.0",
+        "yauzl": "^2.9.2"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/buffer-crc32": {
+      "version": "0.2.13",
+      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
+      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fd-slicer": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
+      "license": "MIT",
+      "dependencies": {
+        "pend": "~1.2.0"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/pend": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
+      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+      "license": "MIT"
+    },
+    "node_modules/yauzl": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-crc32": "~0.2.3",
+        "fd-slicer": "~1.1.0"
      }
    }
  }
--- a/codex-cli/package.json
+++ b/codex-cli/package.json
@@ -7,15 +7,21 @@
  },
  "type": "module",
  "engines": {
-    "node": ">=16"
+    "node": ">=20"
  },
  "files": [
    "bin",
-    "vendor"
+    "dist"
  ],
  "repository": {
    "type": "git",
    "url": "git+https://github.com/openai/codex.git",
    "directory": "codex-cli"
+  },
+  "dependencies": {
+    "@vscode/ripgrep": "^1.15.14"
+  },
+  "devDependencies": {
+    "prettier": "^3.3.3"
  }
 }
--- a/codex-cli/scripts/README.md
+++ b/codex-cli/scripts/README.md
@@ -5,7 +5,5 @@ Run the following:
 To build the 0.2.x or later version of the npm module, which runs the Rust version of the CLI, build it as follows:

 ```bash
-./codex-cli/scripts/build_npm_package.py --release-version 0.6.0
+./codex-cli/scripts/stage_rust_release.py --release-version 0.6.0
 ```
-
-Note this will create `./codex-cli/vendor/` as a side-effect.
--- a/codex-cli/scripts/build_npm_package.py
+++ b/codex-cli/scripts/build_npm_package.py
@@ -1,307 +0,0 @@
-#!/usr/bin/env python3
-"""Stage and optionally package the @openai/codex npm module."""
-
-import argparse
-import json
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-CODEX_CLI_ROOT = SCRIPT_DIR.parent
-REPO_ROOT = CODEX_CLI_ROOT.parent
-RESPONSES_API_PROXY_NPM_ROOT = REPO_ROOT / "codex-rs" / "responses-api-proxy" / "npm"
-GITHUB_REPO = "openai/codex"
-
-# The docs are not clear on what the expected value/format of
-# workflow/workflowName is:
-# https://cli.github.com/manual/gh_run_list
-WORKFLOW_NAME = ".github/workflows/rust-release.yml"
-
-
-def parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Build or stage the Codex CLI npm package.")
-    parser.add_argument(
-        "--package",
-        choices=("codex", "codex-responses-api-proxy"),
-        default="codex",
-        help="Which npm package to stage (default: codex).",
-    )
-    parser.add_argument(
-        "--version",
-        help="Version number to write to package.json inside the staged package.",
-    )
-    parser.add_argument(
-        "--release-version",
-        help=(
-            "Version to stage for npm release. When provided, the script also resolves the "
-            "matching rust-release workflow unless --workflow-url is supplied."
-        ),
-    )
-    parser.add_argument(
-        "--workflow-url",
-        help="Optional GitHub Actions workflow run URL used to download native binaries.",
-    )
-    parser.add_argument(
-        "--staging-dir",
-        type=Path,
-        help=(
-            "Directory to stage the package contents. Defaults to a new temporary directory "
-            "if omitted. The directory must be empty when provided."
-        ),
-    )
-    parser.add_argument(
-        "--tmp",
-        dest="staging_dir",
-        type=Path,
-        help=argparse.SUPPRESS,
-    )
-    parser.add_argument(
-        "--pack-output",
-        type=Path,
-        help="Path where the generated npm tarball should be written.",
-    )
-    return parser.parse_args()
-
-
-def main() -> int:
-    args = parse_args()
-
-    package = args.package
-    version = args.version
-    release_version = args.release_version
-    if release_version:
-        if version and version != release_version:
-            raise RuntimeError("--version and --release-version must match when both are provided.")
-        version = release_version
-
-    if not version:
-        raise RuntimeError("Must specify --version or --release-version.")
-
-    staging_dir, created_temp = prepare_staging_dir(args.staging_dir)
-
-    try:
-        stage_sources(staging_dir, version, package)
-
-        workflow_url = args.workflow_url
-        resolved_head_sha: str | None = None
-        if not workflow_url:
-            if release_version:
-                workflow = resolve_release_workflow(version)
-                workflow_url = workflow["url"]
-                resolved_head_sha = workflow.get("headSha")
-            else:
-                workflow_url = resolve_latest_alpha_workflow_url()
-        elif release_version:
-            try:
-                workflow = resolve_release_workflow(version)
-                resolved_head_sha = workflow.get("headSha")
-            except Exception:
-                resolved_head_sha = None
-
-        if release_version and resolved_head_sha:
-            print(f"should `git checkout {resolved_head_sha}`")
-
-        if not workflow_url:
-            raise RuntimeError("Unable to determine workflow URL for native binaries.")
-
-        install_native_binaries(staging_dir, workflow_url, package)
-
-        if release_version:
-            staging_dir_str = str(staging_dir)
-            if package == "codex":
-                print(
-                    f"Staged version {version} for release in {staging_dir_str}\n\n"
-                    "Verify the CLI:\n"
-                    f"    node {staging_dir_str}/bin/codex.js --version\n"
-                    f"    node {staging_dir_str}/bin/codex.js --help\n\n"
-                )
-            else:
-                print(
-                    f"Staged version {version} for release in {staging_dir_str}\n\n"
-                    "Verify the responses API proxy:\n"
-                    f"    node {staging_dir_str}/bin/codex-responses-api-proxy.js --help\n\n"
-                )
-        else:
-            print(f"Staged package in {staging_dir}")
-
-        if args.pack_output is not None:
-            output_path = run_npm_pack(staging_dir, args.pack_output)
-            print(f"npm pack output written to {output_path}")
-    finally:
-        if created_temp:
-            # Preserve the staging directory for further inspection.
-            pass
-
-    return 0
-
-
-def prepare_staging_dir(staging_dir: Path | None) -> tuple[Path, bool]:
-    if staging_dir is not None:
-        staging_dir = staging_dir.resolve()
-        staging_dir.mkdir(parents=True, exist_ok=True)
-        if any(staging_dir.iterdir()):
-            raise RuntimeError(f"Staging directory {staging_dir} is not empty.")
-        return staging_dir, False
-
-    temp_dir = Path(tempfile.mkdtemp(prefix="codex-npm-stage-"))
-    return temp_dir, True
-
-
-def stage_sources(staging_dir: Path, version: str, package: str) -> None:
-    bin_dir = staging_dir / "bin"
-    bin_dir.mkdir(parents=True, exist_ok=True)
-
-    if package == "codex":
-        shutil.copy2(CODEX_CLI_ROOT / "bin" / "codex.js", bin_dir / "codex.js")
-        rg_manifest = CODEX_CLI_ROOT / "bin" / "rg"
-        if rg_manifest.exists():
-            shutil.copy2(rg_manifest, bin_dir / "rg")
-
-        readme_src = REPO_ROOT / "README.md"
-        if readme_src.exists():
-            shutil.copy2(readme_src, staging_dir / "README.md")
-
-        package_json_path = CODEX_CLI_ROOT / "package.json"
-    elif package == "codex-responses-api-proxy":
-        launcher_src = RESPONSES_API_PROXY_NPM_ROOT / "bin" / "codex-responses-api-proxy.js"
-        shutil.copy2(launcher_src, bin_dir / "codex-responses-api-proxy.js")
-
-        readme_src = RESPONSES_API_PROXY_NPM_ROOT / "README.md"
-        if readme_src.exists():
-            shutil.copy2(readme_src, staging_dir / "README.md")
-
-        package_json_path = RESPONSES_API_PROXY_NPM_ROOT / "package.json"
-    else:
-        raise RuntimeError(f"Unknown package '{package}'.")
-
-    with open(package_json_path, "r", encoding="utf-8") as fh:
-        package_json = json.load(fh)
-    package_json["version"] = version
-
-    with open(staging_dir / "package.json", "w", encoding="utf-8") as out:
-        json.dump(package_json, out, indent=2)
-        out.write("\n")
-
-
-def install_native_binaries(staging_dir: Path, workflow_url: str, package: str) -> None:
-    package_components = {
-        "codex": ["codex", "rg"],
-        "codex-responses-api-proxy": ["codex-responses-api-proxy"],
-    }
-
-    components = package_components.get(package)
-    if components is None:
-        raise RuntimeError(f"Unknown package '{package}'.")
-
-    cmd = ["./scripts/install_native_deps.py", "--workflow-url", workflow_url]
-    for component in components:
-        cmd.extend(["--component", component])
-    cmd.append(str(staging_dir))
-    subprocess.check_call(cmd, cwd=CODEX_CLI_ROOT)
-
-
-def resolve_latest_alpha_workflow_url() -> str:
-    version = determine_latest_alpha_version()
-    workflow = resolve_release_workflow(version)
-    return workflow["url"]
-
-
-def determine_latest_alpha_version() -> str:
-    releases = list_releases()
-    best_key: tuple[int, int, int, int] | None = None
-    best_version: str | None = None
-    pattern = re.compile(r"^rust-v(\d+)\.(\d+)\.(\d+)-alpha\.(\d+)$")
-    for release in releases:
-        tag = release.get("tag_name", "")
-        match = pattern.match(tag)
-        if not match:
-            continue
-        key = tuple(int(match.group(i)) for i in range(1, 5))
-        if best_key is None or key > best_key:
-            best_key = key
-            best_version = (
-                f"{match.group(1)}.{match.group(2)}.{match.group(3)}-alpha.{match.group(4)}"
-            )
-
-    if best_version is None:
-        raise RuntimeError("No alpha releases found when resolving workflow URL.")
-    return best_version
-
-
-def list_releases() -> list[dict]:
-    stdout = subprocess.check_output(
-        ["gh", "api", f"/repos/{GITHUB_REPO}/releases?per_page=100"],
-        text=True,
-    )
-    try:
-        releases = json.loads(stdout or "[]")
-    except json.JSONDecodeError as exc:
-        raise RuntimeError("Unable to parse releases JSON.") from exc
-    if not isinstance(releases, list):
-        raise RuntimeError("Unexpected response when listing releases.")
-    return releases
-
-
-def resolve_release_workflow(version: str) -> dict:
-    stdout = subprocess.check_output(
-        [
-            "gh",
-            "run",
-            "list",
-            "--branch",
-            f"rust-v{version}",
-            "--json",
-            "workflowName,url,headSha",
-            "--workflow",
-            WORKFLOW_NAME,
-            "--jq",
-            "first(.[])",
-        ],
-        text=True,
-    )
-    workflow = json.loads(stdout or "[]")
-    if not workflow:
-        raise RuntimeError(f"Unable to find rust-release workflow for version {version}.")
-    return workflow
-
-
-def run_npm_pack(staging_dir: Path, output_path: Path) -> Path:
-    output_path = output_path.resolve()
-    output_path.parent.mkdir(parents=True, exist_ok=True)
-
-    with tempfile.TemporaryDirectory(prefix="codex-npm-pack-") as pack_dir_str:
-        pack_dir = Path(pack_dir_str)
-        stdout = subprocess.check_output(
-            ["npm", "pack", "--json", "--pack-destination", str(pack_dir)],
-            cwd=staging_dir,
-            text=True,
-        )
-        try:
-            pack_output = json.loads(stdout)
-        except json.JSONDecodeError as exc:
-            raise RuntimeError("Failed to parse npm pack output.") from exc
-
-        if not pack_output:
-            raise RuntimeError("npm pack did not produce an output tarball.")
-
-        tarball_name = pack_output[0].get("filename") or pack_output[0].get("name")
-        if not tarball_name:
-            raise RuntimeError("Unable to determine npm pack output filename.")
-
-        tarball_path = pack_dir / tarball_name
-        if not tarball_path.exists():
-            raise RuntimeError(f"Expected npm pack output not found: {tarball_path}")
-
-        shutil.move(str(tarball_path), output_path)
-
-    return output_path
-
-
-if __name__ == "__main__":
-    import sys
-
-    sys.exit(main())
--- a/codex-cli/scripts/install_native_deps.py
+++ b/codex-cli/scripts/install_native_deps.py
@@ -1,383 +0,0 @@
-#!/usr/bin/env python3
-"""Install Codex native binaries (Rust CLI plus ripgrep helpers)."""
-
-import argparse
-import json
-import os
-import shutil
-import subprocess
-import tarfile
-import tempfile
-import zipfile
-from dataclasses import dataclass
-from concurrent.futures import ThreadPoolExecutor, as_completed
-from pathlib import Path
-from typing import Iterable, Sequence
-from urllib.parse import urlparse
-from urllib.request import urlopen
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-CODEX_CLI_ROOT = SCRIPT_DIR.parent
-DEFAULT_WORKFLOW_URL = "https://github.com/openai/codex/actions/runs/17952349351"  # rust-v0.40.0
-VENDOR_DIR_NAME = "vendor"
-RG_MANIFEST = CODEX_CLI_ROOT / "bin" / "rg"
-BINARY_TARGETS = (
-    "x86_64-unknown-linux-musl",
-    "aarch64-unknown-linux-musl",
-    "x86_64-apple-darwin",
-    "aarch64-apple-darwin",
-    "x86_64-pc-windows-msvc",
-    "aarch64-pc-windows-msvc",
-)
-
-
-@dataclass(frozen=True)
-class BinaryComponent:
-    artifact_prefix: str  # matches the artifact filename prefix (e.g. codex-<target>.zst)
-    dest_dir: str  # directory under vendor/<target>/ where the binary is installed
-    binary_basename: str  # executable name inside dest_dir (before optional .exe)
-
-
-BINARY_COMPONENTS = {
-    "codex": BinaryComponent(
-        artifact_prefix="codex",
-        dest_dir="codex",
-        binary_basename="codex",
-    ),
-    "codex-responses-api-proxy": BinaryComponent(
-        artifact_prefix="codex-responses-api-proxy",
-        dest_dir="codex-responses-api-proxy",
-        binary_basename="codex-responses-api-proxy",
-    ),
-}
-
-RG_TARGET_PLATFORM_PAIRS: list[tuple[str, str]] = [
-    ("x86_64-unknown-linux-musl", "linux-x86_64"),
-    ("aarch64-unknown-linux-musl", "linux-aarch64"),
-    ("x86_64-apple-darwin", "macos-x86_64"),
-    ("aarch64-apple-darwin", "macos-aarch64"),
-    ("x86_64-pc-windows-msvc", "windows-x86_64"),
-    ("aarch64-pc-windows-msvc", "windows-aarch64"),
-]
-RG_TARGET_TO_PLATFORM = {target: platform for target, platform in RG_TARGET_PLATFORM_PAIRS}
-DEFAULT_RG_TARGETS = [target for target, _ in RG_TARGET_PLATFORM_PAIRS]
-
-
-def parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Install native Codex binaries.")
-    parser.add_argument(
-        "--workflow-url",
-        help=(
-            "GitHub Actions workflow URL that produced the artifacts. Defaults to a "
-            "known good run when omitted."
-        ),
-    )
-    parser.add_argument(
-        "--component",
-        dest="components",
-        action="append",
-        choices=tuple(list(BINARY_COMPONENTS) + ["rg"]),
-        help=(
-            "Limit installation to the specified components."
-            " May be repeated. Defaults to 'codex' and 'rg'."
-        ),
-    )
-    parser.add_argument(
-        "root",
-        nargs="?",
-        type=Path,
-        help=(
-            "Directory containing package.json for the staged package. If omitted, the "
-            "repository checkout is used."
-        ),
-    )
-    return parser.parse_args()
-
-
-def main() -> int:
-    args = parse_args()
-
-    codex_cli_root = (args.root or CODEX_CLI_ROOT).resolve()
-    vendor_dir = codex_cli_root / VENDOR_DIR_NAME
-    vendor_dir.mkdir(parents=True, exist_ok=True)
-
-    components = args.components or ["codex", "rg"]
-
-    workflow_url = (args.workflow_url or DEFAULT_WORKFLOW_URL).strip()
-    if not workflow_url:
-        workflow_url = DEFAULT_WORKFLOW_URL
-
-    workflow_id = workflow_url.rstrip("/").split("/")[-1]
-    print(f"Downloading native artifacts from workflow {workflow_id}...")
-
-    with tempfile.TemporaryDirectory(prefix="codex-native-artifacts-") as artifacts_dir_str:
-        artifacts_dir = Path(artifacts_dir_str)
-        _download_artifacts(workflow_id, artifacts_dir)
-        install_binary_components(
-            artifacts_dir,
-            vendor_dir,
-            BINARY_TARGETS,
-            [name for name in components if name in BINARY_COMPONENTS],
-        )
-
-    if "rg" in components:
-        print("Fetching ripgrep binaries...")
-        fetch_rg(vendor_dir, DEFAULT_RG_TARGETS, manifest_path=RG_MANIFEST)
-
-    print(f"Installed native dependencies into {vendor_dir}")
-    return 0
-
-
-def fetch_rg(
-    vendor_dir: Path,
-    targets: Sequence[str] | None = None,
-    *,
-    manifest_path: Path,
-) -> list[Path]:
-    """Download ripgrep binaries described by the DotSlash manifest."""
-
-    if targets is None:
-        targets = DEFAULT_RG_TARGETS
-
-    if not manifest_path.exists():
-        raise FileNotFoundError(f"DotSlash manifest not found: {manifest_path}")
-
-    manifest = _load_manifest(manifest_path)
-    platforms = manifest.get("platforms", {})
-
-    vendor_dir.mkdir(parents=True, exist_ok=True)
-
-    targets = list(targets)
-    if not targets:
-        return []
-
-    task_configs: list[tuple[str, str, dict]] = []
-    for target in targets:
-        platform_key = RG_TARGET_TO_PLATFORM.get(target)
-        if platform_key is None:
-            raise ValueError(f"Unsupported ripgrep target '{target}'.")
-
-        platform_info = platforms.get(platform_key)
-        if platform_info is None:
-            raise RuntimeError(f"Platform '{platform_key}' not found in manifest {manifest_path}.")
-
-        task_configs.append((target, platform_key, platform_info))
-
-    results: dict[str, Path] = {}
-    max_workers = min(len(task_configs), max(1, (os.cpu_count() or 1)))
-
-    print("Installing ripgrep binaries for targets: " + ", ".join(targets))
-
-    with ThreadPoolExecutor(max_workers=max_workers) as executor:
-        future_map = {
-            executor.submit(
-                _fetch_single_rg,
-                vendor_dir,
-                target,
-                platform_key,
-                platform_info,
-                manifest_path,
-            ): target
-            for target, platform_key, platform_info in task_configs
-        }
-
-        for future in as_completed(future_map):
-            target = future_map[future]
-            results[target] = future.result()
-            print(f"  installed ripgrep for {target}")
-
-    return [results[target] for target in targets]
-
-
-def _download_artifacts(workflow_id: str, dest_dir: Path) -> None:
-    cmd = [
-        "gh",
-        "run",
-        "download",
-        "--dir",
-        str(dest_dir),
-        "--repo",
-        "openai/codex",
-        workflow_id,
-    ]
-    subprocess.check_call(cmd)
-
-
-def install_binary_components(
-    artifacts_dir: Path,
-    vendor_dir: Path,
-    targets: Iterable[str],
-    component_names: Sequence[str],
-) -> None:
-    selected_components = [BINARY_COMPONENTS[name] for name in component_names if name in BINARY_COMPONENTS]
-    if not selected_components:
-        return
-
-    targets = list(targets)
-    if not targets:
-        return
-
-    for component in selected_components:
-        print(
-            f"Installing {component.binary_basename} binaries for targets: "
-            + ", ".join(targets)
-        )
-        max_workers = min(len(targets), max(1, (os.cpu_count() or 1)))
-        with ThreadPoolExecutor(max_workers=max_workers) as executor:
-            futures = {
-                executor.submit(
-                    _install_single_binary,
-                    artifacts_dir,
-                    vendor_dir,
-                    target,
-                    component,
-                ): target
-                for target in targets
-            }
-            for future in as_completed(futures):
-                installed_path = future.result()
-                print(f"  installed {installed_path}")
-
-
-def _install_single_binary(
-    artifacts_dir: Path,
-    vendor_dir: Path,
-    target: str,
-    component: BinaryComponent,
-) -> Path:
-    artifact_subdir = artifacts_dir / target
-    archive_name = _archive_name_for_target(component.artifact_prefix, target)
-    archive_path = artifact_subdir / archive_name
-    if not archive_path.exists():
-        raise FileNotFoundError(f"Expected artifact not found: {archive_path}")
-
-    dest_dir = vendor_dir / target / component.dest_dir
-    dest_dir.mkdir(parents=True, exist_ok=True)
-
-    binary_name = (
-        f"{component.binary_basename}.exe" if "windows" in target else component.binary_basename
-    )
-    dest = dest_dir / binary_name
-    dest.unlink(missing_ok=True)
-    extract_archive(archive_path, "zst", None, dest)
-    if "windows" not in target:
-        dest.chmod(0o755)
-    return dest
-
-
-def _archive_name_for_target(artifact_prefix: str, target: str) -> str:
-    if "windows" in target:
-        return f"{artifact_prefix}-{target}.exe.zst"
-    return f"{artifact_prefix}-{target}.zst"
-
-
-def _fetch_single_rg(
-    vendor_dir: Path,
-    target: str,
-    platform_key: str,
-    platform_info: dict,
-    manifest_path: Path,
-) -> Path:
-    providers = platform_info.get("providers", [])
-    if not providers:
-        raise RuntimeError(f"No providers listed for platform '{platform_key}' in {manifest_path}.")
-
-    url = providers[0]["url"]
-    archive_format = platform_info.get("format", "zst")
-    archive_member = platform_info.get("path")
-
-    dest_dir = vendor_dir / target / "path"
-    dest_dir.mkdir(parents=True, exist_ok=True)
-
-    is_windows = platform_key.startswith("win")
-    binary_name = "rg.exe" if is_windows else "rg"
-    dest = dest_dir / binary_name
-
-    with tempfile.TemporaryDirectory() as tmp_dir_str:
-        tmp_dir = Path(tmp_dir_str)
-        archive_filename = os.path.basename(urlparse(url).path)
-        download_path = tmp_dir / archive_filename
-        _download_file(url, download_path)
-
-        dest.unlink(missing_ok=True)
-        extract_archive(download_path, archive_format, archive_member, dest)
-
-    if not is_windows:
-        dest.chmod(0o755)
-
-    return dest
-
-
-def _download_file(url: str, dest: Path) -> None:
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    with urlopen(url) as response, open(dest, "wb") as out:
-        shutil.copyfileobj(response, out)
-
-
-def extract_archive(
-    archive_path: Path,
-    archive_format: str,
-    archive_member: str | None,
-    dest: Path,
-) -> None:
-    dest.parent.mkdir(parents=True, exist_ok=True)
-
-    if archive_format == "zst":
-        output_path = archive_path.parent / dest.name
-        subprocess.check_call(
-            ["zstd", "-f", "-d", str(archive_path), "-o", str(output_path)]
-        )
-        shutil.move(str(output_path), dest)
-        return
-
-    if archive_format == "tar.gz":
-        if not archive_member:
-            raise RuntimeError("Missing 'path' for tar.gz archive in DotSlash manifest.")
-        with tarfile.open(archive_path, "r:gz") as tar:
-            try:
-                member = tar.getmember(archive_member)
-            except KeyError as exc:
-                raise RuntimeError(
-                    f"Entry '{archive_member}' not found in archive {archive_path}."
-                ) from exc
-            tar.extract(member, path=archive_path.parent, filter="data")
-        extracted = archive_path.parent / archive_member
-        shutil.move(str(extracted), dest)
-        return
-
-    if archive_format == "zip":
-        if not archive_member:
-            raise RuntimeError("Missing 'path' for zip archive in DotSlash manifest.")
-        with zipfile.ZipFile(archive_path) as archive:
-            try:
-                with archive.open(archive_member) as src, open(dest, "wb") as out:
-                    shutil.copyfileobj(src, out)
-            except KeyError as exc:
-                raise RuntimeError(
-                    f"Entry '{archive_member}' not found in archive {archive_path}."
-                ) from exc
-        return
-
-    raise RuntimeError(f"Unsupported archive format '{archive_format}'.")
-
-
-def _load_manifest(manifest_path: Path) -> dict:
-    cmd = ["dotslash", "--", "parse", str(manifest_path)]
-    stdout = subprocess.check_output(cmd, text=True)
-    try:
-        manifest = json.loads(stdout)
-    except json.JSONDecodeError as exc:
-        raise RuntimeError(f"Invalid DotSlash manifest output from {manifest_path}.") from exc
-
-    if not isinstance(manifest, dict):
-        raise RuntimeError(
-            f"Unexpected DotSlash manifest structure for {manifest_path}: {type(manifest)!r}"
-        )
-
-    return manifest
-
-
-if __name__ == "__main__":
-    import sys
-
-    sys.exit(main())
--- a/codex-cli/scripts/install_native_deps.sh
+++ b/codex-cli/scripts/install_native_deps.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+# Install native runtime dependencies for codex-cli.
+#
+# Usage
+#   install_native_deps.sh [--workflow-url URL] [CODEX_CLI_ROOT]
+#
+# The optional RELEASE_ROOT is the path that contains package.json.  Omitting
+# it installs the binaries into the repository's own bin/ folder to support
+# local development.
+
+set -euo pipefail
+
+# ------------------
+# Parse arguments
+# ------------------
+
+CODEX_CLI_ROOT=""
+
+# Until we start publishing stable GitHub releases, we have to grab the binaries
+# from the GitHub Action that created them. Update the URL below to point to the
+# appropriate workflow run:
+WORKFLOW_URL="https://github.com/openai/codex/actions/runs/17417194663" # rust-v0.28.0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --workflow-url)
+      shift || { echo "--workflow-url requires an argument"; exit 1; }
+      if [ -n "$1" ]; then
+        WORKFLOW_URL="$1"
+      fi
+      ;;
+    *)
+      if [[ -z "$CODEX_CLI_ROOT" ]]; then
+        CODEX_CLI_ROOT="$1"
+      else
+        echo "Unexpected argument: $1" >&2
+        exit 1
+      fi
+      ;;
+  esac
+  shift
+done
+
+# ----------------------------------------------------------------------------
+# Determine where the binaries should be installed.
+# ----------------------------------------------------------------------------
+
+if [ -n "$CODEX_CLI_ROOT" ]; then
+  # The caller supplied a release root directory.
+  BIN_DIR="$CODEX_CLI_ROOT/bin"
+else
+  # No argument; fall back to the repo’s own bin directory.
+  # Resolve the path of this script, then walk up to the repo root.
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  CODEX_CLI_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  BIN_DIR="$CODEX_CLI_ROOT/bin"
+fi
+
+# Make sure the destination directory exists.
+mkdir -p "$BIN_DIR"
+
+# ----------------------------------------------------------------------------
+# Download and decompress the artifacts from the GitHub Actions workflow.
+# ----------------------------------------------------------------------------
+
+WORKFLOW_ID="${WORKFLOW_URL##*/}"
+
+ARTIFACTS_DIR="$(mktemp -d)"
+trap 'rm -rf "$ARTIFACTS_DIR"' EXIT
+
+# NB: The GitHub CLI `gh` must be installed and authenticated.
+gh run download --dir "$ARTIFACTS_DIR" --repo openai/codex "$WORKFLOW_ID"
+
+# x64 Linux
+zstd -d "$ARTIFACTS_DIR/x86_64-unknown-linux-musl/codex-x86_64-unknown-linux-musl.zst" \
+    -o "$BIN_DIR/codex-x86_64-unknown-linux-musl"
+# ARM64 Linux
+zstd -d "$ARTIFACTS_DIR/aarch64-unknown-linux-musl/codex-aarch64-unknown-linux-musl.zst" \
+    -o "$BIN_DIR/codex-aarch64-unknown-linux-musl"
+# x64 macOS
+zstd -d "$ARTIFACTS_DIR/x86_64-apple-darwin/codex-x86_64-apple-darwin.zst" \
+    -o "$BIN_DIR/codex-x86_64-apple-darwin"
+# ARM64 macOS
+zstd -d "$ARTIFACTS_DIR/aarch64-apple-darwin/codex-aarch64-apple-darwin.zst" \
+    -o "$BIN_DIR/codex-aarch64-apple-darwin"
+# x64 Windows
+zstd -d "$ARTIFACTS_DIR/x86_64-pc-windows-msvc/codex-x86_64-pc-windows-msvc.exe.zst" \
+    -o "$BIN_DIR/codex-x86_64-pc-windows-msvc.exe"
+# ARM64 Windows
+zstd -d "$ARTIFACTS_DIR/aarch64-pc-windows-msvc/codex-aarch64-pc-windows-msvc.exe.zst" \
+    -o "$BIN_DIR/codex-aarch64-pc-windows-msvc.exe"
+
+echo "Installed native dependencies into $BIN_DIR"
--- a/codex-cli/scripts/stage_release.sh
+++ b/codex-cli/scripts/stage_release.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------------------------
+# stage_release.sh
+# -----------------------------------------------------------------------------
+# Stages an npm release for @openai/codex.
+#
+# Usage:
+#
+#   --tmp <dir>  : Use <dir> instead of a freshly created temp directory.
+#   -h|--help    : Print usage.
+#
+# -----------------------------------------------------------------------------
+
+set -euo pipefail
+
+# Helper - usage / flag parsing
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [--tmp DIR] [--version VERSION]
+
+Options
+  --tmp DIR   Use DIR to stage the release (defaults to a fresh mktemp dir)
+  --version   Specify the version to release (defaults to a timestamp-based version)
+  -h, --help  Show this help
+
+Legacy positional argument: the first non-flag argument is still interpreted
+as the temporary directory (for backwards compatibility) but is deprecated.
+EOF
+  exit "${1:-0}"
+}
+
+TMPDIR=""
+# Default to a timestamp-based version (keep same scheme as before)
+VERSION="$(printf '0.1.%d' "$(date +%y%m%d%H%M)")"
+WORKFLOW_URL=""
+
+# Manual flag parser - Bash getopts does not handle GNU long options well.
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --tmp)
+      shift || { echo "--tmp requires an argument"; usage 1; }
+      TMPDIR="$1"
+      ;;
+    --tmp=*)
+      TMPDIR="${1#*=}"
+      ;;
+    --version)
+      shift || { echo "--version requires an argument"; usage 1; }
+      VERSION="$1"
+      ;;
+    --workflow-url)
+      shift || { echo "--workflow-url requires an argument"; exit 1; }
+      WORKFLOW_URL="$1"
+      ;;
+    -h|--help)
+      usage 0
+      ;;
+    --*)
+      echo "Unknown option: $1" >&2
+      usage 1
+      ;;
+    *)
+      echo "Unexpected extra argument: $1" >&2
+      usage 1
+      ;;
+  esac
+  shift
+done
+
+# Fallback when the caller did not specify a directory.
+# If no directory was specified create a fresh temporary one.
+if [[ -z "$TMPDIR" ]]; then
+  TMPDIR="$(mktemp -d)"
+fi
+
+# Ensure the directory exists, then resolve to an absolute path.
+mkdir -p "$TMPDIR"
+TMPDIR="$(cd "$TMPDIR" && pwd)"
+
+# Main build logic
+
+echo "Staging release in $TMPDIR"
+
+# The script lives in codex-cli/scripts/ - change into codex-cli root so that
+# relative paths keep working.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CODEX_CLI_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+pushd "$CODEX_CLI_ROOT" >/dev/null
+
+# 1. Build the JS artifacts ---------------------------------------------------
+
+# Paths inside the staged package
+mkdir -p "$TMPDIR/bin"
+
+cp -r bin/codex.js "$TMPDIR/bin/codex.js"
+cp ../README.md "$TMPDIR" || true # README is one level up - ignore if missing
+
+# Modify package.json - bump version and optionally add the native directory to
+# the files array so that the binaries are published to npm.
+
+jq --arg version "$VERSION" \
+    '.version = $version' \
+    package.json > "$TMPDIR/package.json"
+
+# 2. Native runtime deps (sandbox plus optional Rust binaries)
+
+./scripts/install_native_deps.sh --workflow-url "$WORKFLOW_URL" "$TMPDIR"
+
+popd >/dev/null
+
+echo "Staged version $VERSION for release in $TMPDIR"
+
+echo "Verify the CLI:"
+echo "    node ${TMPDIR}/bin/codex.js --version"
+echo "    node ${TMPDIR}/bin/codex.js --help"
+
+# Print final hint for convenience
+echo "Next:  cd \"$TMPDIR\" && npm publish"
--- a/codex-cli/scripts/stage_rust_release.py
+++ b/codex-cli/scripts/stage_rust_release.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+
+import json
+import subprocess
+import sys
+import argparse
+from pathlib import Path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="""Stage a release for the npm module.
+
+Run this after the GitHub Release has been created and use
+`--release-version` to specify the version to release.
+
+Optionally pass `--tmp` to control the temporary staging directory that will be
+forwarded to stage_release.sh.
+"""
+    )
+    parser.add_argument(
+        "--release-version", required=True, help="Version to release, e.g., 0.3.0"
+    )
+    parser.add_argument(
+        "--tmp",
+        help="Optional path to stage the npm package; forwarded to stage_release.sh",
+    )
+    args = parser.parse_args()
+    version = args.release_version
+
+    gh_run = subprocess.run(
+        [
+            "gh",
+            "run",
+            "list",
+            "--branch",
+            f"rust-v{version}",
+            "--json",
+            "workflowName,url,headSha",
+            "--jq",
+            'first(.[] | select(.workflowName == "rust-release"))',
+        ],
+        stdout=subprocess.PIPE,
+        check=True,
+    )
+    gh_run.check_returncode()
+    workflow = json.loads(gh_run.stdout)
+    sha = workflow["headSha"]
+
+    print(f"should `git checkout {sha}`")
+
+    current_dir = Path(__file__).parent.resolve()
+    cmd = [
+        str(current_dir / "stage_release.sh"),
+        "--version",
+        version,
+        "--workflow-url",
+        workflow["url"],
+    ]
+    if args.tmp:
+        cmd.extend(["--tmp", args.tmp])
+
+    stage_release = subprocess.run(cmd)
+    stage_release.check_returncode()
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -56,7 +56,7 @@ checksum = "8fac2ce611db8b8cee9b2aa886ca03c924e9da5e5295d0dbd0526e5d0b0710f7"
 dependencies = [
 "allocative_derive",
 "bumpalo",
- "ctor 0.1.26",
+ "ctor",
 "hashbrown 0.14.5",
 "num-bigint",
 ]
@@ -78,6 +78,12 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -333,54 +339,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

-[[package]]
-name = "axum"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5"
-dependencies = [
- "axum-core",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "sync_wrapper",
- "tokio",
- "tower",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "axum-core"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "backtrace"
 version = "0.3.75"
@@ -536,24 +494,19 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"

-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
 [[package]]
 name = "chrono"
-version = "0.4.42"
+version = "0.4.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
+checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
 dependencies = [
+ "android-tzdata",
 "iana-time-zone",
 "js-sys",
 "num-traits",
 "serde",
 "wasm-bindgen",
- "windows-link 0.2.0",
+ "windows-link",
 ]

 [[package]]
@@ -642,6 +595,7 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "assert_cmd",
+ "once_cell",
 "pretty_assertions",
 "similar",
 "tempfile",
@@ -692,11 +646,9 @@ dependencies = [
 "codex-exec",
 "codex-login",
 "codex-mcp-server",
- "codex-process-hardening",
 "codex-protocol",
 "codex-protocol-ts",
 "codex-tui",
- "ctor 0.5.0",
 "owo-colors",
 "predicates",
 "pretty_assertions",
@@ -712,10 +664,13 @@ dependencies = [
 name = "codex-common"
 version = "0.0.0"
 dependencies = [
+ "async-trait",
 "clap",
 "codex-core",
 "codex-protocol",
 "serde",
+ "thiserror 2.0.16",
+ "tokio",
 "toml",
 ]

@@ -727,7 +682,6 @@ dependencies = [
 "askama",
 "assert_cmd",
 "async-channel",
- "async-trait",
 "base64",
 "bytes",
 "chrono",
@@ -735,14 +689,11 @@ dependencies = [
 "codex-file-search",
 "codex-mcp-client",
 "codex-protocol",
- "codex-rmcp-client",
 "core_test_support",
 "dirs",
 "env-flags",
- "escargot",
 "eventsource-stream",
 "futures",
- "indexmap 2.10.0",
 "landlock",
 "libc",
 "maplit",
@@ -797,15 +748,12 @@ dependencies = [
 "libc",
 "owo-colors",
 "predicates",
- "pretty_assertions",
- "serde",
 "serde_json",
 "shlex",
 "tempfile",
 "tokio",
 "tracing",
 "tracing-subscriber",
- "ts-rs",
 "uuid",
 "walkdir",
 "wiremock",
@@ -948,13 +896,6 @@ dependencies = [
 "wiremock",
 ]

-[[package]]
-name = "codex-process-hardening"
-version = "0.0.0"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "codex-protocol"
 version = "0.0.0"
@@ -989,39 +930,6 @@ dependencies = [
 "ts-rs",
 ]

-[[package]]
-name = "codex-responses-api-proxy"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "clap",
- "codex-process-hardening",
- "ctor 0.5.0",
- "libc",
- "reqwest",
- "serde",
- "serde_json",
- "tiny_http",
- "zeroize",
-]
-
-[[package]]
-name = "codex-rmcp-client"
-version = "0.0.0"
-dependencies = [
- "anyhow",
- "axum",
- "futures",
- "mcp-types",
- "pretty_assertions",
- "reqwest",
- "rmcp",
- "serde",
- "serde_json",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "codex-tui"
 version = "0.0.0"
@@ -1051,6 +959,7 @@ dependencies = [
 "lazy_static",
 "libc",
 "mcp-types",
+ "once_cell",
 "path-clean",
 "pathdiff",
 "pretty_assertions",
@@ -1072,21 +981,11 @@ dependencies = [
 "tracing-appender",
 "tracing-subscriber",
 "unicode-segmentation",
- "unicode-width 0.2.1",
+ "unicode-width 0.1.14",
 "url",
 "vt100",
 ]

-[[package]]
-name = "codex-utils-readiness"
-version = "0.0.0"
-dependencies = [
- "async-trait",
- "thiserror 2.0.16",
- "time",
- "tokio",
-]
-
 [[package]]
 name = "color-eyre"
 version = "0.6.5"
@@ -1205,7 +1104,6 @@ name = "core_test_support"
 version = "0.0.0"
 dependencies = [
 "anyhow",
- "assert_cmd",
 "codex-core",
 "serde_json",
 "tempfile",
@@ -1317,40 +1215,14 @@ dependencies = [
 "syn 1.0.109",
 ]

-[[package]]
-name = "ctor"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67773048316103656a637612c4a62477603b777d91d9c62ff2290f9cde178fdb"
-dependencies = [
- "ctor-proc-macro",
- "dtor",
-]
-
-[[package]]
-name = "ctor-proc-macro"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2931af7e13dc045d8e9d26afccc6fa115d64e115c9c84b1166288b46f6782c2"
-
 [[package]]
 name = "darling"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
- "darling_core 0.20.11",
- "darling_macro 0.20.11",
-]
-
-[[package]]
-name = "darling"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
-dependencies = [
- "darling_core 0.21.3",
- "darling_macro 0.21.3",
+ "darling_core",
+ "darling_macro",
 ]

 [[package]]
@@ -1367,38 +1239,13 @@ dependencies = [
 "syn 2.0.104",
 ]

-[[package]]
-name = "darling_core"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim 0.11.1",
- "syn 2.0.104",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
- "darling_core 0.20.11",
- "quote",
- "syn 2.0.104",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
-dependencies = [
- "darling_core 0.21.3",
+ "darling_core",
 "quote",
 "syn 2.0.104",
 ]
@@ -1434,12 +1281,12 @@ dependencies = [

 [[package]]
 name = "deranged"
-version = "0.5.4"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a41953f86f8a05768a6cda24def994fd2f424b04ec5c719cf89989779f199071"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
 dependencies = [
 "powerfmt",
- "serde_core",
+ "serde",
 ]

 [[package]]
@@ -1618,21 +1465,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"

-[[package]]
-name = "dtor"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e58a0764cddb55ab28955347b45be00ade43d4d6f3ba4bf3dc354e4ec9432934"
-dependencies = [
- "dtor-proc-macro",
-]
-
-[[package]]
-name = "dtor-proc-macro"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
-
 [[package]]
 name = "dupe"
 version = "0.9.1"
@@ -1775,17 +1607,6 @@ version = "3.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"

-[[package]]
-name = "escargot"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11c3aea32bc97b500c9ca6a72b768a26e558264303d101d3409cf6d57a9ed0cf"
-dependencies = [
- "log",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "event-listener"
 version = "5.4.0"
@@ -2091,10 +1912,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
 "cfg-if",
- "js-sys",
 "libc",
 "wasi 0.11.1+wasi-snapshot-preview1",
- "wasm-bindgen",
 ]

 [[package]]
@@ -2104,11 +1923,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
- "js-sys",
 "libc",
 "r-efi",
 "wasi 0.14.2+wasi-0.2.4",
- "wasm-bindgen",
 ]

 [[package]]
@@ -2305,7 +2122,6 @@ dependencies = [
 "tokio",
 "tokio-rustls",
 "tower-service",
- "webpki-roots",
 ]

 [[package]]
@@ -2615,7 +2431,7 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "435d80800b936787d62688c927b6490e887c7ef5ff9ce922c6c6050fca75eb9a"
 dependencies = [
- "darling 0.20.11",
+ "darling",
 "indoc",
 "proc-macro2",
 "quote",
@@ -2870,9 +2686,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"

 [[package]]
 name = "logos"
@@ -2906,12 +2722,6 @@ dependencies = [
 "hashbrown 0.15.4",
 ]

-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
 [[package]]
 name = "lsp-types"
 version = "0.94.1"
@@ -2940,12 +2750,6 @@ dependencies = [
 "regex-automata",
 ]

-[[package]]
-name = "matchit"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
-
 [[package]]
 name = "mcp-types"
 version = "0.0.0"
@@ -3097,19 +2901,7 @@ checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
 "bitflags 2.9.1",
 "cfg-if",
- "cfg_aliases 0.1.1",
- "libc",
-]
-
-[[package]]
-name = "nix"
-version = "0.30.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
-dependencies = [
- "bitflags 2.9.1",
- "cfg-if",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
 "libc",
 ]

@@ -3535,7 +3327,7 @@ dependencies = [
 "lazy_static",
 "libc",
 "log",
- "nix 0.28.0",
+ "nix",
 "serial2",
 "shared_library",
 "shell-words",
@@ -3623,20 +3415,6 @@ dependencies = [
 "unicode-ident",
 ]

-[[package]]
-name = "process-wrap"
-version = "8.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3ef4f2f0422f23a82ec9f628ea2acd12871c81a9362b02c43c1aa86acfc3ba1"
-dependencies = [
- "futures",
- "indexmap 2.10.0",
- "nix 0.30.1",
- "tokio",
- "tracing",
- "windows",
-]
-
 [[package]]
 name = "pulldown-cmark"
 version = "0.10.3"
@@ -3680,61 +3458,6 @@ dependencies = [
 "memchr",
 ]

-[[package]]
-name = "quinn"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
-dependencies = [
- "bytes",
- "cfg_aliases 0.2.1",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2",
- "thiserror 2.0.16",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
-dependencies = [
- "bytes",
- "getrandom 0.3.3",
- "lru-slab",
- "rand",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.16",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
-dependencies = [
- "cfg_aliases 0.2.1",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.60.2",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -3927,8 +3650,6 @@ dependencies = [
 "native-tls",
 "percent-encoding",
 "pin-project-lite",
- "quinn",
- "rustls",
 "rustls-pki-types",
 "serde",
 "serde_json",
@@ -3936,7 +3657,6 @@ dependencies = [
 "sync_wrapper",
 "tokio",
 "tokio-native-tls",
- "tokio-rustls",
 "tokio-util",
 "tower",
 "tower-http",
@@ -3946,7 +3666,6 @@ dependencies = [
 "wasm-bindgen-futures",
 "wasm-streams",
 "web-sys",
- "webpki-roots",
 ]

 [[package]]
@@ -3963,63 +3682,12 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

-[[package]]
-name = "rmcp"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534fd1cd0601e798ac30545ff2b7f4a62c6f14edd4aaed1cc5eb1e85f69f09af"
-dependencies = [
- "base64",
- "bytes",
- "chrono",
- "futures",
- "http",
- "http-body",
- "http-body-util",
- "paste",
- "pin-project-lite",
- "process-wrap",
- "rand",
- "reqwest",
- "rmcp-macros",
- "schemars 1.0.4",
- "serde",
- "serde_json",
- "sse-stream",
- "thiserror 2.0.16",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "tower-service",
- "tracing",
- "uuid",
-]
-
-[[package]]
-name = "rmcp-macros"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ba777eb0e5f53a757e36f0e287441da0ab766564ba7201600eeb92a4753022e"
-dependencies = [
- "darling 0.21.3",
- "proc-macro2",
- "quote",
- "serde_json",
- "syn 2.0.104",
-]
-
 [[package]]
 name = "rustc-demangle"
 version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"

-[[package]]
-name = "rustc-hash"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
-
 [[package]]
 name = "rustix"
 version = "0.38.44"
@@ -4053,7 +3721,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2491382039b29b9b11ff08b76ff6c97cf287671dbb74f0be44bda389fffe9bd1"
 dependencies = [
 "once_cell",
- "ring",
 "rustls-pki-types",
 "rustls-webpki",
 "subtle",
@@ -4066,7 +3733,6 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
- "web-time",
 "zeroize",
 ]

@@ -4101,7 +3767,7 @@ dependencies = [
 "libc",
 "log",
 "memchr",
- "nix 0.28.0",
+ "nix",
 "radix_trie",
 "unicode-segmentation",
 "unicode-width 0.1.14",
@@ -4182,7 +3848,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
 dependencies = [
 "dyn-clone",
- "schemars_derive 0.8.22",
+ "schemars_derive",
 "serde",
 "serde_json",
 ]
@@ -4205,10 +3871,8 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82d20c4491bc164fa2f6c5d44565947a52ad80b9505d8e36f8d54c27c739fcd0"
 dependencies = [
- "chrono",
 "dyn-clone",
 "ref-cast",
- "schemars_derive 1.0.4",
 "serde",
 "serde_json",
 ]
@@ -4225,18 +3889,6 @@ dependencies = [
 "syn 2.0.104",
 ]

-[[package]]
-name = "schemars_derive"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33d020396d1d138dc19f1165df7545479dcd58d93810dc5d646a16e55abefa80"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde_derive_internals",
- "syn 2.0.104",
-]
-
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -4277,9 +3929,9 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.226"
+version = "1.0.224"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
+checksum = "6aaeb1e94f53b16384af593c71e20b095e958dab1d26939c1b70645c5cfbcc0b"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -4287,18 +3939,18 @@ dependencies = [

 [[package]]
 name = "serde_core"
-version = "1.0.226"
+version = "1.0.224"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
+checksum = "32f39390fa6346e24defbcdd3d9544ba8a19985d0af74df8501fbfe9a64341ab"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.226"
+version = "1.0.224"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
+checksum = "87ff78ab5e8561c9a675bfc1785cb07ae721f0ee53329a595cefd8c04c2ac4e0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4388,7 +4040,7 @@ version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de90945e6565ce0d9a25098082ed4ee4002e047cb59892c318d66821e14bb30f"
 dependencies = [
- "darling 0.20.11",
+ "darling",
 "proc-macro2",
 "quote",
 "syn 2.0.104",
@@ -4540,19 +4192,6 @@ dependencies = [
 "windows-sys 0.59.0",
 ]

-[[package]]
-name = "sse-stream"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb4dc4d33c68ec1f27d386b5610a351922656e1fdf5c05bbaad930cd1519479a"
-dependencies = [
- "bytes",
- "futures-util",
- "http-body",
- "http-body-util",
- "pin-project-lite",
-]
-
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -4814,15 +4453,15 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
 dependencies = [
 "fastrand",
 "getrandom 0.3.3",
 "once_cell",
 "rustix 1.0.8",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -4946,9 +4585,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.44"
+version = "0.3.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
+checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
 dependencies = [
 "deranged",
 "itoa",
@@ -4963,15 +4602,15 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.6"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
+checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"

 [[package]]
 name = "time-macros"
-version = "0.2.24"
+version = "0.2.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
+checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
 dependencies = [
 "num-conv",
 "time-core",
@@ -5008,21 +4647,6 @@ dependencies = [
 "zerovec",
 ]

-[[package]]
-name = "tinyvec"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "tokio"
 version = "1.47.1"
@@ -5635,16 +5259,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "webbrowser"
 version = "1.0.5"
@@ -5661,15 +5275,6 @@ dependencies = [
 "web-sys",
 ]

-[[package]]
-name = "webpki-roots"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "weezl"
 version = "0.1.10"
@@ -5725,28 +5330,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

-[[package]]
-name = "windows"
-version = "0.61.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
-dependencies = [
- "windows-collections",
- "windows-core",
- "windows-future",
- "windows-link 0.1.3",
- "windows-numerics",
-]
-
-[[package]]
-name = "windows-collections"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
-dependencies = [
- "windows-core",
-]
-
 [[package]]
 name = "windows-core"
 version = "0.61.2"
@@ -5755,22 +5338,11 @@ checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
 "windows-implement",
 "windows-interface",
- "windows-link 0.1.3",
+ "windows-link",
 "windows-result",
 "windows-strings",
 ]

-[[package]]
-name = "windows-future"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
-dependencies = [
- "windows-core",
- "windows-link 0.1.3",
- "windows-threading",
-]
-
 [[package]]
 name = "windows-implement"
 version = "0.60.0"
@@ -5799,29 +5371,13 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"

-[[package]]
-name = "windows-link"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45e46c0661abb7180e7b9c281db115305d49ca1709ab8242adf09666d2173c65"
-
-[[package]]
-name = "windows-numerics"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
-dependencies = [
- "windows-core",
- "windows-link 0.1.3",
-]
-
 [[package]]
 name = "windows-registry"
 version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 "windows-result",
 "windows-strings",
 ]
@@ -5832,7 +5388,7 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 ]

 [[package]]
@@ -5841,7 +5397,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 ]

 [[package]]
@@ -5942,15 +5498,6 @@ dependencies = [
 "windows_x86_64_msvc 0.53.0",
 ]

-[[package]]
-name = "windows-threading"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
-dependencies = [
- "windows-link 0.1.3",
-]
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -16,13 +16,9 @@ members = [
    "mcp-server",
    "mcp-types",
    "ollama",
-    "process-hardening",
    "protocol",
    "protocol-ts",
-    "rmcp-client",
-    "responses-api-proxy",
    "tui",
-    "utils/readiness",
 ]
 resolver = "2"

@@ -50,12 +46,9 @@ codex-login = { path = "login" }
 codex-mcp-client = { path = "mcp-client" }
 codex-mcp-server = { path = "mcp-server" }
 codex-ollama = { path = "ollama" }
-codex-process-hardening = { path = "process-hardening" }
 codex-protocol = { path = "protocol" }
 codex-protocol-ts = { path = "protocol-ts" }
-codex-rmcp-client = { path = "rmcp-client" }
 codex-tui = { path = "tui" }
-codex-utils-readiness = { path = "utils/readiness" }
 core_test_support = { path = "core/tests/common" }
 mcp-types = { path = "mcp-types" }
 mcp_test_support = { path = "mcp-server/tests/common" }
@@ -72,26 +65,23 @@ async-stream = "0.3.6"
 async-trait = "0.1.89"
 base64 = "0.22.1"
 bytes = "1.10.1"
-chrono = "0.4.42"
+chrono = "0.4.40"
 clap = "4"
 clap_complete = "4"
 color-eyre = "0.6.3"
 crossterm = "0.28.1"
-ctor = "0.5.0"
 derive_more = "2"
 diffy = "0.4.2"
 dirs = "6"
 dotenvy = "0.15.7"
 env-flags = "0.1.1"
 env_logger = "0.11.5"
-escargot = "0.5"
 eventsource-stream = "0.2.3"
 futures = "0.3"
 icu_decimal = "2.0.0"
 icu_locale_core = "2.0.0"
 ignore = "0.4.23"
 image = { version = "^0.25.8", default-features = false }
-indexmap = "2.6.0"
 insta = "1.43.2"
 itertools = "0.14.0"
 landlock = "0.4.1"
@@ -102,6 +92,7 @@ maplit = "1.0.2"
 mime_guess = "2.0.5"
 multimap = "0.10.0"
 nucleo-matcher = "0.3.1"
+once_cell = "1"
 openssl-sys = "*"
 os_info = "3.12.0"
 owo-colors = "4.2.0"
@@ -130,7 +121,7 @@ strum = "0.27.2"
 strum_macros = "0.27.2"
 supports-color = "3.0.2"
 sys-locale = "0.3.2"
-tempfile = "3.23.0"
+tempfile = "3.13.0"
 textwrap = "0.16.2"
 thiserror = "2.0.16"
 time = "0.3"
@@ -148,7 +139,7 @@ tree-sitter = "0.25.9"
 tree-sitter-bash = "0.25.0"
 ts-rs = "11"
 unicode-segmentation = "1.12.0"
-unicode-width = "0.2"
+unicode-width = "0.1"
 url = "2"
 urlencoding = "2.1"
 uuid = "1"
@@ -158,7 +149,6 @@ webbrowser = "1.0"
 which = "6"
 wildmatch = "2.5.0"
 wiremock = "0.6"
-zeroize = "1.8.1"

 [workspace.lints]
 rust = {}
@@ -201,7 +191,7 @@ unwrap_used = "deny"
 # cargo-shear cannot see the platform-specific openssl-sys usage, so we
 # silence the false positive here instead of deleting a real dependency.
 [workspace.metadata.cargo-shear]
-ignored = ["openssl-sys", "codex-utils-readiness"]
+ignored = ["openssl-sys"]

 [profile.release]
 lto = "fat"
--- a/codex-rs/README.md
+++ b/codex-rs/README.md
@@ -4,18 +4,18 @@ We provide Codex CLI as a standalone, native executable to ensure a zero-depende

 ## Installing Codex

-Today, the easiest way to install Codex is via `npm`:
+Today, the easiest way to install Codex is via `npm`, though we plan to publish Codex to other package managers soon.

 ```shell
-npm i -g @openai/codex
+npm i -g @openai/codex@native
 codex
 ```

-You can also install via Homebrew (`brew install codex`) or download a platform-specific release directly from our [GitHub Releases](https://github.com/openai/codex/releases).
+You can also download a platform-specific release directly from our [GitHub Releases](https://github.com/openai/codex/releases).

 ## What's new in the Rust CLI

-The Rust implementation is now the maintained Codex CLI and serves as the default experience. It includes a number of features that the legacy TypeScript CLI never supported.
+While we are [working to close the gap between the TypeScript and Rust implementations of Codex CLI](https://github.com/openai/codex/issues/1262), note that the Rust CLI has a number of features that the TypeScript CLI does not!

 ### Config

--- a/codex-rs/apply-patch/Cargo.toml
+++ b/codex-rs/apply-patch/Cargo.toml
@@ -20,6 +20,7 @@ similar = { workspace = true }
 thiserror = { workspace = true }
 tree-sitter = { workspace = true }
 tree-sitter-bash = { workspace = true }
+once_cell = { workspace = true }

 [dev-dependencies]
 assert_cmd = { workspace = true }
--- a/codex-rs/apply-patch/src/lib.rs
+++ b/codex-rs/apply-patch/src/lib.rs
@@ -6,10 +6,10 @@ use std::collections::HashMap;
 use std::path::Path;
 use std::path::PathBuf;
 use std::str::Utf8Error;
-use std::sync::LazyLock;

 use anyhow::Context;
 use anyhow::Result;
+use once_cell::sync::Lazy;
 pub use parser::Hunk;
 pub use parser::ParseError;
 use parser::ParseError::*;
@@ -351,7 +351,7 @@ fn extract_apply_patch_from_bash(
    // also run an arbitrary query against the AST. This is useful for understanding
    // how tree-sitter parses the script and whether the query syntax is correct. Be sure
    // to test both positive and negative cases.
-    static APPLY_PATCH_QUERY: LazyLock<Query> = LazyLock::new(|| {
+    static APPLY_PATCH_QUERY: Lazy<Query> = Lazy::new(|| {
        let language = BASH.into();
        #[expect(clippy::expect_used)]
        Query::new(
--- a/codex-rs/cli/Cargo.toml
+++ b/codex-rs/cli/Cargo.toml
@@ -25,11 +25,9 @@ codex-core = { workspace = true }
 codex-exec = { workspace = true }
 codex-login = { workspace = true }
 codex-mcp-server = { workspace = true }
-codex-process-hardening = { workspace = true }
 codex-protocol = { workspace = true }
 codex-protocol-ts = { workspace = true }
 codex-tui = { workspace = true }
-ctor = { workspace = true }
 owo-colors = { workspace = true }
 serde_json = { workspace = true }
 supports-color = { workspace = true }
--- a/codex-rs/cli/src/main.rs
+++ b/codex-rs/cli/src/main.rs
@@ -181,7 +181,7 @@ fn format_exit_messages(exit_info: AppExitInfo, color_enabled: bool) -> Vec<Stri
        } else {
            resume_cmd
        };
-        lines.push(format!("To continue this session, run {command}"));
+        lines.push(format!("To continue this session, run {command}."));
    }

    lines
@@ -194,27 +194,6 @@ fn print_exit_messages(exit_info: AppExitInfo) {
    }
 }

-pub(crate) const CODEX_SECURE_MODE_ENV_VAR: &str = "CODEX_SECURE_MODE";
-
-/// As early as possible in the process lifecycle, apply hardening measures
-/// if the CODEX_SECURE_MODE environment variable is set to "1".
-#[ctor::ctor]
-fn pre_main_hardening() {
-    let secure_mode = match std::env::var(CODEX_SECURE_MODE_ENV_VAR) {
-        Ok(value) => value,
-        Err(_) => return,
-    };
-
-    if secure_mode == "1" {
-        codex_process_hardening::pre_main_hardening();
-    }
-
-    // Always clear this env var so child processes don't inherit it.
-    unsafe {
-        std::env::remove_var(CODEX_SECURE_MODE_ENV_VAR);
-    }
-}
-
 fn main() -> anyhow::Result<()> {
    arg0_dispatch_or_else(|codex_linux_sandbox_exe| async move {
        cli_main(codex_linux_sandbox_exe).await?;
@@ -481,7 +460,7 @@ mod tests {
            lines,
            vec![
                "Token usage: total=2 input=0 output=2".to_string(),
-                "To continue this session, run codex resume 123e4567-e89b-12d3-a456-426614174000"
+                "To continue this session, run codex resume 123e4567-e89b-12d3-a456-426614174000."
                    .to_string(),
            ]
        );
--- a/codex-rs/cli/src/mcp_cmd.rs
+++ b/codex-rs/cli/src/mcp_cmd.rs
@@ -1,3 +1,4 @@
+use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::path::PathBuf;

@@ -12,7 +13,6 @@ use codex_core::config::find_codex_home;
 use codex_core::config::load_global_mcp_servers;
 use codex_core::config::write_global_mcp_servers;
 use codex_core::config_types::McpServerConfig;
-use codex_core::config_types::McpServerTransportConfig;

 /// [experimental] Launch Codex as an MCP server or manage configured MCP servers.
 ///
@@ -145,11 +145,9 @@ fn run_add(config_overrides: &CliConfigOverrides, add_args: AddArgs) -> Result<(
        .with_context(|| format!("failed to load MCP servers from {}", codex_home.display()))?;

    let new_entry = McpServerConfig {
-        transport: McpServerTransportConfig::Stdio {
-            command: command_bin,
-            args: command_args,
-            env: env_map,
-        },
+        command: command_bin,
+        args: command_args,
+        env: env_map,
        startup_timeout_sec: None,
        tool_timeout_sec: None,
    };
@@ -203,25 +201,16 @@ fn run_list(config_overrides: &CliConfigOverrides, list_args: ListArgs) -> Resul
        let json_entries: Vec<_> = entries
            .into_iter()
            .map(|(name, cfg)| {
-                let transport = match &cfg.transport {
-                    McpServerTransportConfig::Stdio { command, args, env } => serde_json::json!({
-                        "type": "stdio",
-                        "command": command,
-                        "args": args,
-                        "env": env,
-                    }),
-                    McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-                        serde_json::json!({
-                            "type": "streamable_http",
-                            "url": url,
-                            "bearer_token": bearer_token,
-                        })
-                    }
-                };
-
+                let env = cfg.env.as_ref().map(|env| {
+                    env.iter()
+                        .map(|(k, v)| (k.clone(), v.clone()))
+                        .collect::<BTreeMap<_, _>>()
+                });
                serde_json::json!({
                    "name": name,
-                    "transport": transport,
+                    "command": cfg.command,
+                    "args": cfg.args,
+                    "env": env,
                    "startup_timeout_sec": cfg
                        .startup_timeout_sec
                        .map(|timeout| timeout.as_secs_f64()),
@@ -241,111 +230,62 @@ fn run_list(config_overrides: &CliConfigOverrides, list_args: ListArgs) -> Resul
        return Ok(());
    }

-    let mut stdio_rows: Vec<[String; 4]> = Vec::new();
-    let mut http_rows: Vec<[String; 3]> = Vec::new();
-
+    let mut rows: Vec<[String; 4]> = Vec::new();
    for (name, cfg) in entries {
-        match &cfg.transport {
-            McpServerTransportConfig::Stdio { command, args, env } => {
-                let args_display = if args.is_empty() {
-                    "-".to_string()
-                } else {
-                    args.join(" ")
-                };
-                let env_display = match env.as_ref() {
-                    None => "-".to_string(),
-                    Some(map) if map.is_empty() => "-".to_string(),
-                    Some(map) => {
-                        let mut pairs: Vec<_> = map.iter().collect();
-                        pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                        pairs
-                            .into_iter()
-                            .map(|(k, v)| format!("{k}={v}"))
-                            .collect::<Vec<_>>()
-                            .join(", ")
-                    }
-                };
-                stdio_rows.push([name.clone(), command.clone(), args_display, env_display]);
-            }
-            McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-                let has_bearer = if bearer_token.is_some() {
-                    "True"
-                } else {
-                    "False"
-                };
-                http_rows.push([name.clone(), url.clone(), has_bearer.into()]);
+        let args = if cfg.args.is_empty() {
+            "-".to_string()
+        } else {
+            cfg.args.join(" ")
+        };
+
+        let env = match cfg.env.as_ref() {
+            None => "-".to_string(),
+            Some(map) if map.is_empty() => "-".to_string(),
+            Some(map) => {
+                let mut pairs: Vec<_> = map.iter().collect();
+                pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+                pairs
+                    .into_iter()
+                    .map(|(k, v)| format!("{k}={v}"))
+                    .collect::<Vec<_>>()
+                    .join(", ")
            }
+        };
+
+        rows.push([name.clone(), cfg.command.clone(), args, env]);
+    }
+
+    let mut widths = ["Name".len(), "Command".len(), "Args".len(), "Env".len()];
+    for row in &rows {
+        for (i, cell) in row.iter().enumerate() {
+            widths[i] = widths[i].max(cell.len());
        }
    }

-    if !stdio_rows.is_empty() {
-        let mut widths = ["Name".len(), "Command".len(), "Args".len(), "Env".len()];
-        for row in &stdio_rows {
-            for (i, cell) in row.iter().enumerate() {
-                widths[i] = widths[i].max(cell.len());
-            }
-        }
+    println!(
+        "{:<name_w$}  {:<cmd_w$}  {:<args_w$}  {:<env_w$}",
+        "Name",
+        "Command",
+        "Args",
+        "Env",
+        name_w = widths[0],
+        cmd_w = widths[1],
+        args_w = widths[2],
+        env_w = widths[3],
+    );

+    for row in rows {
        println!(
            "{:<name_w$}  {:<cmd_w$}  {:<args_w$}  {:<env_w$}",
-            "Name",
-            "Command",
-            "Args",
-            "Env",
+            row[0],
+            row[1],
+            row[2],
+            row[3],
            name_w = widths[0],
            cmd_w = widths[1],
            args_w = widths[2],
            env_w = widths[3],
        );
-
-        for row in &stdio_rows {
-            println!(
-                "{:<name_w$}  {:<cmd_w$}  {:<args_w$}  {:<env_w$}",
-                row[0],
-                row[1],
-                row[2],
-                row[3],
-                name_w = widths[0],
-                cmd_w = widths[1],
-                args_w = widths[2],
-                env_w = widths[3],
-            );
-        }
-    }
-
-    if !stdio_rows.is_empty() && !http_rows.is_empty() {
-        println!();
-    }
-
-    if !http_rows.is_empty() {
-        let mut widths = ["Name".len(), "Url".len(), "Has Bearer Token".len()];
-        for row in &http_rows {
-            for (i, cell) in row.iter().enumerate() {
-                widths[i] = widths[i].max(cell.len());
-            }
-        }
-
-        println!(
-            "{:<name_w$}  {:<url_w$}  {:<token_w$}",
-            "Name",
-            "Url",
-            "Has Bearer Token",
-            name_w = widths[0],
-            url_w = widths[1],
-            token_w = widths[2],
-        );
-
-        for row in &http_rows {
-            println!(
-                "{:<name_w$}  {:<url_w$}  {:<token_w$}",
-                row[0],
-                row[1],
-                row[2],
-                name_w = widths[0],
-                url_w = widths[1],
-                token_w = widths[2],
-            );
-        }
    }

    Ok(())
@@ -361,22 +301,16 @@ fn run_get(config_overrides: &CliConfigOverrides, get_args: GetArgs) -> Result<(
    };

    if get_args.json {
-        let transport = match &server.transport {
-            McpServerTransportConfig::Stdio { command, args, env } => serde_json::json!({
-                "type": "stdio",
-                "command": command,
-                "args": args,
-                "env": env,
-            }),
-            McpServerTransportConfig::StreamableHttp { url, bearer_token } => serde_json::json!({
-                "type": "streamable_http",
-                "url": url,
-                "bearer_token": bearer_token,
-            }),
-        };
+        let env = server.env.as_ref().map(|env| {
+            env.iter()
+                .map(|(k, v)| (k.clone(), v.clone()))
+                .collect::<BTreeMap<_, _>>()
+        });
        let output = serde_json::to_string_pretty(&serde_json::json!({
            "name": get_args.name,
-            "transport": transport,
+            "command": server.command,
+            "args": server.args,
+            "env": env,
            "startup_timeout_sec": server
                .startup_timeout_sec
                .map(|timeout| timeout.as_secs_f64()),
@@ -389,38 +323,27 @@ fn run_get(config_overrides: &CliConfigOverrides, get_args: GetArgs) -> Result<(
    }

    println!("{}", get_args.name);
-    match &server.transport {
-        McpServerTransportConfig::Stdio { command, args, env } => {
-            println!("  transport: stdio");
-            println!("  command: {command}");
-            let args_display = if args.is_empty() {
-                "-".to_string()
-            } else {
-                args.join(" ")
-            };
-            println!("  args: {args_display}");
-            let env_display = match env.as_ref() {
-                None => "-".to_string(),
-                Some(map) if map.is_empty() => "-".to_string(),
-                Some(map) => {
-                    let mut pairs: Vec<_> = map.iter().collect();
-                    pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                    pairs
-                        .into_iter()
-                        .map(|(k, v)| format!("{k}={v}"))
-                        .collect::<Vec<_>>()
-                        .join(", ")
-                }
-            };
-            println!("  env: {env_display}");
+    println!("  command: {}", server.command);
+    let args = if server.args.is_empty() {
+        "-".to_string()
+    } else {
+        server.args.join(" ")
+    };
+    println!("  args: {args}");
+    let env_display = match server.env.as_ref() {
+        None => "-".to_string(),
+        Some(map) if map.is_empty() => "-".to_string(),
+        Some(map) => {
+            let mut pairs: Vec<_> = map.iter().collect();
+            pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+            pairs
+                .into_iter()
+                .map(|(k, v)| format!("{k}={v}"))
+                .collect::<Vec<_>>()
+                .join(", ")
        }
-        McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-            println!("  transport: streamable_http");
-            println!("  url: {url}");
-            let bearer = bearer_token.as_deref().unwrap_or("-");
-            println!("  bearer_token: {bearer}");
-        }
-    }
+    };
+    println!("  env: {env_display}");
    if let Some(timeout) = server.startup_timeout_sec {
        println!("  startup_timeout_sec: {}", timeout.as_secs_f64());
    }
--- a/codex-rs/cli/tests/mcp_add_remove.rs
+++ b/codex-rs/cli/tests/mcp_add_remove.rs
@@ -2,7 +2,6 @@ use std::path::Path;

 use anyhow::Result;
 use codex_core::config::load_global_mcp_servers;
-use codex_core::config_types::McpServerTransportConfig;
 use predicates::str::contains;
 use pretty_assertions::assert_eq;
 use tempfile::TempDir;
@@ -27,14 +26,9 @@ fn add_and_remove_server_updates_global_config() -> Result<()> {
    let servers = load_global_mcp_servers(codex_home.path())?;
    assert_eq!(servers.len(), 1);
    let docs = servers.get("docs").expect("server should exist");
-    match &docs.transport {
-        McpServerTransportConfig::Stdio { command, args, env } => {
-            assert_eq!(command, "echo");
-            assert_eq!(args, &vec!["hello".to_string()]);
-            assert!(env.is_none());
-        }
-        other => panic!("unexpected transport: {other:?}"),
-    }
+    assert_eq!(docs.command, "echo");
+    assert_eq!(docs.args, vec!["hello".to_string()]);
+    assert!(docs.env.is_none());

    let mut remove_cmd = codex_command(codex_home.path())?;
    remove_cmd
@@ -82,10 +76,7 @@ fn add_with_env_preserves_key_order_and_values() -> Result<()> {

    let servers = load_global_mcp_servers(codex_home.path())?;
    let envy = servers.get("envy").expect("server should exist");
-    let env = match &envy.transport {
-        McpServerTransportConfig::Stdio { env: Some(env), .. } => env,
-        other => panic!("unexpected transport: {other:?}"),
-    };
+    let env = envy.env.as_ref().expect("env should be present");

    assert_eq!(env.len(), 2);
    assert_eq!(env.get("FOO"), Some(&"bar".to_string()));
--- a/codex-rs/cli/tests/mcp_list.rs
+++ b/codex-rs/cli/tests/mcp_list.rs
@@ -4,7 +4,6 @@ use anyhow::Result;
 use predicates::str::contains;
 use pretty_assertions::assert_eq;
 use serde_json::Value as JsonValue;
-use serde_json::json;
 use tempfile::TempDir;

 fn codex_command(codex_home: &Path) -> Result<assert_cmd::Command> {
@@ -59,35 +58,38 @@ fn list_and_get_render_expected_output() -> Result<()> {
    assert!(json_output.status.success());
    let stdout = String::from_utf8(json_output.stdout)?;
    let parsed: JsonValue = serde_json::from_str(&stdout)?;
+    let array = parsed.as_array().expect("expected array");
+    assert_eq!(array.len(), 1);
+    let entry = &array[0];
+    assert_eq!(entry.get("name"), Some(&JsonValue::String("docs".into())));
    assert_eq!(
-        parsed,
-        json!([
-          {
-            "name": "docs",
-            "transport": {
-              "type": "stdio",
-              "command": "docs-server",
-              "args": [
-                "--port",
-                "4000"
-              ],
-              "env": {
-                "TOKEN": "secret"
-              }
-            },
-            "startup_timeout_sec": null,
-            "tool_timeout_sec": null
-          }
-        ]
-        )
+        entry.get("command"),
+        Some(&JsonValue::String("docs-server".into()))
    );

+    let args = entry
+        .get("args")
+        .and_then(|v| v.as_array())
+        .expect("args array");
+    assert_eq!(
+        args,
+        &vec![
+            JsonValue::String("--port".into()),
+            JsonValue::String("4000".into())
+        ]
+    );
+
+    let env = entry
+        .get("env")
+        .and_then(|v| v.as_object())
+        .expect("env map");
+    assert_eq!(env.get("TOKEN"), Some(&JsonValue::String("secret".into())));
+
    let mut get_cmd = codex_command(codex_home.path())?;
    let get_output = get_cmd.args(["mcp", "get", "docs"]).output()?;
    assert!(get_output.status.success());
    let stdout = String::from_utf8(get_output.stdout)?;
    assert!(stdout.contains("docs"));
-    assert!(stdout.contains("transport: stdio"));
    assert!(stdout.contains("command: docs-server"));
    assert!(stdout.contains("args: --port 4000"));
    assert!(stdout.contains("env: TOKEN=secret"));
--- a/codex-rs/code
+++ b/codex-rs/code
--- a/codex-rs/common/Cargo.toml
+++ b/codex-rs/common/Cargo.toml
@@ -7,11 +7,14 @@ version = { workspace = true }
 workspace = true

 [dependencies]
+async-trait = { workspace = true }
 clap = { workspace = true, features = ["derive", "wrap_help"], optional = true }
 codex-core = { workspace = true }
 codex-protocol = { workspace = true }
 serde = { workspace = true, optional = true }
 toml = { workspace = true, optional = true }
+thiserror = { workspace = true }
+tokio = { workspace = true }

 [features]
 # Separate feature so that `clap` is not a mandatory dependency.
--- a/codex-rs/common/src/lib.rs
+++ b/codex-rs/common/src/lib.rs
@@ -34,3 +34,5 @@ pub mod model_presets;
 // Shared approval presets (AskForApproval + Sandbox) used by TUI and MCP server
 // Not to be confused with AskForApproval, which we should probably rename to EscalationPolicy.
 pub mod approval_presets;
+// Readiness flag with token-based authorization and async waiting (Tokio).
+pub mod readiness;
--- a/codex-rs/common/src/model_presets.rs
+++ b/codex-rs/common/src/model_presets.rs
@@ -29,7 +29,7 @@ const PRESETS: &[ModelPreset] = &[
        label: "gpt-5-codex medium",
        description: "",
        model: "gpt-5-codex",
-        effort: Some(ReasoningEffort::Medium),
+        effort: None,
    },
    ModelPreset {
        id: "gpt-5-codex-high",
--- a/codex-rs/utils/readiness/src/lib.rs
+++ b/codex-rs/utils/readiness/src/lib.rs
--- a/codex-rs/core/Cargo.toml
+++ b/codex-rs/core/Cargo.toml
@@ -15,20 +15,17 @@ workspace = true
 anyhow = { workspace = true }
 askama = { workspace = true }
 async-channel = { workspace = true }
-async-trait = { workspace = true }
 base64 = { workspace = true }
 bytes = { workspace = true }
 chrono = { workspace = true, features = ["serde"] }
 codex-apply-patch = { workspace = true }
 codex-file-search = { workspace = true }
 codex-mcp-client = { workspace = true }
-codex-rmcp-client = { workspace = true }
 codex-protocol = { workspace = true }
 dirs = { workspace = true }
 env-flags = { workspace = true }
 eventsource-stream = { workspace = true }
 futures = { workspace = true }
-indexmap = { workspace = true }
 libc = { workspace = true }
 mcp-types = { workspace = true }
 os_info = { workspace = true }
@@ -83,7 +80,6 @@ openssl-sys = { workspace = true, features = ["vendored"] }
 [dev-dependencies]
 assert_cmd = { workspace = true }
 core_test_support = { workspace = true }
-escargot = { workspace = true }
 maplit = { workspace = true }
 predicates = { workspace = true }
 pretty_assertions = { workspace = true }
--- a/codex-rs/core/src/apply_patch.rs
+++ b/codex-rs/core/src/apply_patch.rs
@@ -1,12 +1,13 @@
 use crate::codex::Session;
 use crate::codex::TurnContext;
-use crate::function_tool::FunctionCallError;
 use crate::protocol::FileChange;
 use crate::protocol::ReviewDecision;
 use crate::safety::SafetyCheck;
 use crate::safety::assess_patch_safety;
 use codex_apply_patch::ApplyPatchAction;
 use codex_apply_patch::ApplyPatchFileChange;
+use codex_protocol::models::FunctionCallOutputPayload;
+use codex_protocol::models::ResponseInputItem;
 use std::collections::HashMap;
 use std::path::PathBuf;

@@ -16,7 +17,7 @@ pub(crate) enum InternalApplyPatchInvocation {
    /// The `apply_patch` call was handled programmatically, without any sort
    /// of sandbox, because the user explicitly approved it. This is the
    /// result to use with the `shell` function call that contained `apply_patch`.
-    Output(Result<String, FunctionCallError>),
+    Output(ResponseInputItem),

    /// The `apply_patch` call was approved, either automatically because it
    /// appears that it should be allowed based on the user's sandbox policy
@@ -32,6 +33,12 @@ pub(crate) struct ApplyPatchExec {
    pub(crate) user_explicitly_approved_this_action: bool,
 }

+impl From<ResponseInputItem> for InternalApplyPatchInvocation {
+    fn from(item: ResponseInputItem) -> Self {
+        InternalApplyPatchInvocation::Output(item)
+    }
+}
+
 pub(crate) async fn apply_patch(
    sess: &Session,
    turn_context: &TurnContext,
@@ -70,15 +77,25 @@ pub(crate) async fn apply_patch(
                    })
                }
                ReviewDecision::Denied | ReviewDecision::Abort => {
-                    InternalApplyPatchInvocation::Output(Err(FunctionCallError::RespondToModel(
-                        "patch rejected by user".to_string(),
-                    )))
+                    ResponseInputItem::FunctionCallOutput {
+                        call_id: call_id.to_owned(),
+                        output: FunctionCallOutputPayload {
+                            content: "patch rejected by user".to_string(),
+                            success: Some(false),
+                        },
+                    }
+                    .into()
                }
            }
        }
-        SafetyCheck::Reject { reason } => InternalApplyPatchInvocation::Output(Err(
-            FunctionCallError::RespondToModel(format!("patch rejected: {reason}")),
-        )),
+        SafetyCheck::Reject { reason } => ResponseInputItem::FunctionCallOutput {
+            call_id: call_id.to_owned(),
+            output: FunctionCallOutputPayload {
+                content: format!("patch rejected: {reason}"),
+                success: Some(false),
+            },
+        }
+        .into(),
    }
 }

--- a/codex-rs/core/src/auth.rs
+++ b/codex-rs/core/src/auth.rs
@@ -267,9 +267,6 @@ pub fn try_read_auth_json(auth_file: &Path) -> std::io::Result<AuthDotJson> {
 }

 pub fn write_auth_json(auth_file: &Path, auth_dot_json: &AuthDotJson) -> std::io::Result<()> {
-    if let Some(parent) = auth_file.parent() {
-        std::fs::create_dir_all(parent)?;
-    }
    let json_data = serde_json::to_string_pretty(auth_dot_json)?;
    let mut options = OpenOptions::new();
    options.truncate(true).write(true).create(true);
--- a/codex-rs/core/src/bash.rs
+++ b/codex-rs/core/src/bash.rs
@@ -88,21 +88,6 @@ pub fn try_parse_word_only_commands_sequence(tree: &Tree, src: &str) -> Option<V
    Some(commands)
 }

-/// Returns the sequence of plain commands within a `bash -lc "..."` invocation
-/// when the script only contains word-only commands joined by safe operators.
-pub fn parse_bash_lc_plain_commands(command: &[String]) -> Option<Vec<Vec<String>>> {
-    let [bash, flag, script] = command else {
-        return None;
-    };
-
-    if bash != "bash" || flag != "-lc" {
-        return None;
-    }
-
-    let tree = try_parse_bash(script)?;
-    try_parse_word_only_commands_sequence(&tree, script)
-}
-
 fn parse_plain_command_from_node(cmd: tree_sitter::Node, src: &str) -> Option<Vec<String>> {
    if cmd.kind() != "command" {
        return None;
--- a/codex-rs/core/src/client.rs
+++ b/codex-rs/core/src/client.rs
@@ -66,7 +66,6 @@ struct Error {

    // Optional fields available on "usage_limit_reached" and "usage_not_included" errors
    plan_type: Option<PlanType>,
-    resets_in_seconds: Option<u64>,
 }

 #[derive(Debug, Clone)]
@@ -184,22 +183,18 @@ impl ModelClient {

        let input_with_instructions = prompt.get_formatted_input();

-        let verbosity = match &self.config.model_family.family {
-            family if family == "gpt-5" => self.config.model_verbosity,
-            _ => {
-                if self.config.model_verbosity.is_some() {
-                    warn!(
-                        "model_verbosity is set but ignored for non-gpt-5 model family: {}",
-                        self.config.model_family.family
-                    );
-                }
-
-                None
-            }
-        };
-
        // Only include `text.verbosity` for GPT-5 family models
-        let text = create_text_param_for_request(verbosity, &prompt.output_schema);
+        let text = if self.config.model_family.family == "gpt-5" {
+            create_text_param_for_request(self.config.model_verbosity, &prompt.output_schema)
+        } else {
+            if self.config.model_verbosity.is_some() {
+                warn!(
+                    "model_verbosity is set but ignored for non-gpt-5 model family: {}",
+                    self.config.model_family.family
+                );
+            }
+            None
+        };

        // In general, we want to explicitly send `store: false` when using the Responses API,
        // but in practice, the Azure Responses API rejects `store: false`:
@@ -229,169 +224,156 @@ impl ModelClient {
        if azure_workaround {
            attach_item_ids(&mut payload_json, &input_with_instructions);
        }
+        let payload_body = serde_json::to_string(&payload_json)?;

-        let max_attempts = self.provider.request_max_retries();
-        for attempt in 0..=max_attempts {
-            match self
-                .attempt_stream_responses(&payload_json, &auth_manager)
-                .await
+        let mut attempt = 0;
+        let max_retries = self.provider.request_max_retries();
+
+        loop {
+            attempt += 1;
+
+            // Always fetch the latest auth in case a prior attempt refreshed the token.
+            let auth = auth_manager.as_ref().and_then(|m| m.auth());
+
+            trace!(
+                "POST to {}: {}",
+                self.provider.get_full_url(&auth),
+                payload_body.as_str()
+            );
+
+            let mut req_builder = self
+                .provider
+                .create_request_builder(&self.client, &auth)
+                .await?;
+
+            req_builder = req_builder
+                .header("OpenAI-Beta", "responses=experimental")
+                // Send session_id for compatibility.
+                .header("conversation_id", self.conversation_id.to_string())
+                .header("session_id", self.conversation_id.to_string())
+                .header(reqwest::header::ACCEPT, "text/event-stream")
+                .json(&payload_json);
+
+            if let Some(auth) = auth.as_ref()
+                && auth.mode == AuthMode::ChatGPT
+                && let Some(account_id) = auth.get_account_id()
            {
-                Ok(stream) => {
-                    return Ok(stream);
-                }
-                Err(StreamAttemptError::Fatal(e)) => {
-                    return Err(e);
-                }
-                Err(retryable_attempt_error) => {
-                    if attempt == max_attempts {
-                        return Err(retryable_attempt_error.into_error());
+                req_builder = req_builder.header("chatgpt-account-id", account_id);
+            }
+
+            let res = req_builder.send().await;
+            if let Ok(resp) = &res {
+                trace!(
+                    "Response status: {}, cf-ray: {}",
+                    resp.status(),
+                    resp.headers()
+                        .get("cf-ray")
+                        .map(|v| v.to_str().unwrap_or_default())
+                        .unwrap_or_default()
+                );
+            }
+
+            match res {
+                Ok(resp) if resp.status().is_success() => {
+                    let (tx_event, rx_event) = mpsc::channel::<Result<ResponseEvent>>(1600);
+
+                    if let Some(snapshot) = parse_rate_limit_snapshot(resp.headers())
+                        && tx_event
+                            .send(Ok(ResponseEvent::RateLimits(snapshot)))
+                            .await
+                            .is_err()
+                    {
+                        debug!("receiver dropped rate limit snapshot event");
                    }

-                    tokio::time::sleep(retryable_attempt_error.delay(attempt)).await;
+                    // spawn task to process SSE
+                    let stream = resp.bytes_stream().map_err(CodexErr::Reqwest);
+                    tokio::spawn(process_sse(
+                        stream,
+                        tx_event,
+                        self.provider.stream_idle_timeout(),
+                    ));
+
+                    return Ok(ResponseStream { rx_event });
                }
-            }
-        }
+                Ok(res) => {
+                    let status = res.status();

-        unreachable!("stream_responses_attempt should always return");
-    }
+                    // Pull out Retry‑After header if present.
+                    let retry_after_secs = res
+                        .headers()
+                        .get(reqwest::header::RETRY_AFTER)
+                        .and_then(|v| v.to_str().ok())
+                        .and_then(|s| s.parse::<u64>().ok());

-    /// Single attempt to start a streaming Responses API call.
-    async fn attempt_stream_responses(
-        &self,
-        payload_json: &Value,
-        auth_manager: &Option<Arc<AuthManager>>,
-    ) -> std::result::Result<ResponseStream, StreamAttemptError> {
-        // Always fetch the latest auth in case a prior attempt refreshed the token.
-        let auth = auth_manager.as_ref().and_then(|m| m.auth());
+                    if status == StatusCode::UNAUTHORIZED
+                        && let Some(manager) = auth_manager.as_ref()
+                        && manager.auth().is_some()
+                    {
+                        let _ = manager.refresh_token().await;
+                    }

-        trace!(
-            "POST to {}: {:?}",
-            self.provider.get_full_url(&auth),
-            serde_json::to_string(payload_json)
-        );
+                    // The OpenAI Responses endpoint returns structured JSON bodies even for 4xx/5xx
+                    // errors. When we bubble early with only the HTTP status the caller sees an opaque
+                    // "unexpected status 400 Bad Request" which makes debugging nearly impossible.
+                    // Instead, read (and include) the response text so higher layers and users see the
+                    // exact error message (e.g. "Unknown parameter: 'input[0].metadata'"). The body is
+                    // small and this branch only runs on error paths so the extra allocation is
+                    // negligible.
+                    if !(status == StatusCode::TOO_MANY_REQUESTS
+                        || status == StatusCode::UNAUTHORIZED
+                        || status.is_server_error())
+                    {
+                        // Surface the error body to callers. Use `unwrap_or_default` per Clippy.
+                        let body = res.text().await.unwrap_or_default();
+                        return Err(CodexErr::UnexpectedStatus(status, body));
+                    }

-        let mut req_builder = self
-            .provider
-            .create_request_builder(&self.client, &auth)
-            .await
-            .map_err(StreamAttemptError::Fatal)?;
-
-        req_builder = req_builder
-            .header("OpenAI-Beta", "responses=experimental")
-            // Send session_id for compatibility.
-            .header("conversation_id", self.conversation_id.to_string())
-            .header("session_id", self.conversation_id.to_string())
-            .header(reqwest::header::ACCEPT, "text/event-stream")
-            .json(payload_json);
-
-        if let Some(auth) = auth.as_ref()
-            && auth.mode == AuthMode::ChatGPT
-            && let Some(account_id) = auth.get_account_id()
-        {
-            req_builder = req_builder.header("chatgpt-account-id", account_id);
-        }
-
-        let res = req_builder.send().await;
-        if let Ok(resp) = &res {
-            trace!(
-                "Response status: {}, cf-ray: {}",
-                resp.status(),
-                resp.headers()
-                    .get("cf-ray")
-                    .map(|v| v.to_str().unwrap_or_default())
-                    .unwrap_or_default()
-            );
-        }
-
-        match res {
-            Ok(resp) if resp.status().is_success() => {
-                let (tx_event, rx_event) = mpsc::channel::<Result<ResponseEvent>>(1600);
-
-                if let Some(snapshot) = parse_rate_limit_snapshot(resp.headers())
-                    && tx_event
-                        .send(Ok(ResponseEvent::RateLimits(snapshot)))
-                        .await
-                        .is_err()
-                {
-                    debug!("receiver dropped rate limit snapshot event");
-                }
-
-                // spawn task to process SSE
-                let stream = resp.bytes_stream().map_err(CodexErr::Reqwest);
-                tokio::spawn(process_sse(
-                    stream,
-                    tx_event,
-                    self.provider.stream_idle_timeout(),
-                ));
-
-                Ok(ResponseStream { rx_event })
-            }
-            Ok(res) => {
-                let status = res.status();
-
-                // Pull out Retry‑After header if present.
-                let retry_after_secs = res
-                    .headers()
-                    .get(reqwest::header::RETRY_AFTER)
-                    .and_then(|v| v.to_str().ok())
-                    .and_then(|s| s.parse::<u64>().ok());
-                let retry_after = retry_after_secs.map(|s| Duration::from_millis(s * 1_000));
-
-                if status == StatusCode::UNAUTHORIZED
-                    && let Some(manager) = auth_manager.as_ref()
-                    && manager.auth().is_some()
-                {
-                    let _ = manager.refresh_token().await;
-                }
-
-                // The OpenAI Responses endpoint returns structured JSON bodies even for 4xx/5xx
-                // errors. When we bubble early with only the HTTP status the caller sees an opaque
-                // "unexpected status 400 Bad Request" which makes debugging nearly impossible.
-                // Instead, read (and include) the response text so higher layers and users see the
-                // exact error message (e.g. "Unknown parameter: 'input[0].metadata'"). The body is
-                // small and this branch only runs on error paths so the extra allocation is
-                // negligible.
-                if !(status == StatusCode::TOO_MANY_REQUESTS
-                    || status == StatusCode::UNAUTHORIZED
-                    || status.is_server_error())
-                {
-                    // Surface the error body to callers. Use `unwrap_or_default` per Clippy.
-                    let body = res.text().await.unwrap_or_default();
-                    return Err(StreamAttemptError::Fatal(CodexErr::UnexpectedStatus(
-                        status, body,
-                    )));
-                }
-
-                if status == StatusCode::TOO_MANY_REQUESTS {
-                    let rate_limit_snapshot = parse_rate_limit_snapshot(res.headers());
-                    let body = res.json::<ErrorResponse>().await.ok();
-                    if let Some(ErrorResponse { error }) = body {
-                        if error.r#type.as_deref() == Some("usage_limit_reached") {
-                            // Prefer the plan_type provided in the error message if present
-                            // because it's more up to date than the one encoded in the auth
-                            // token.
-                            let plan_type = error
-                                .plan_type
-                                .or_else(|| auth.as_ref().and_then(CodexAuth::get_plan_type));
-                            let resets_in_seconds = error.resets_in_seconds;
-                            let codex_err = CodexErr::UsageLimitReached(UsageLimitReachedError {
-                                plan_type,
-                                resets_in_seconds,
-                                rate_limits: rate_limit_snapshot,
-                            });
-                            return Err(StreamAttemptError::Fatal(codex_err));
-                        } else if error.r#type.as_deref() == Some("usage_not_included") {
-                            return Err(StreamAttemptError::Fatal(CodexErr::UsageNotIncluded));
+                    if status == StatusCode::TOO_MANY_REQUESTS {
+                        let rate_limit_snapshot = parse_rate_limit_snapshot(res.headers());
+                        let header_reset_hint =
+                            rate_limit_snapshot.as_ref().and_then(rate_limit_reset_hint);
+                        let body = res.json::<ErrorResponse>().await.ok();
+                        if let Some(ErrorResponse { error }) = body {
+                            if error.r#type.as_deref() == Some("usage_limit_reached") {
+                                // Prefer the plan_type provided in the error message if present
+                                // because it's more up to date than the one encoded in the auth
+                                // token.
+                                let plan_type = error
+                                    .plan_type
+                                    .or_else(|| auth.as_ref().and_then(CodexAuth::get_plan_type));
+                                return Err(CodexErr::UsageLimitReached(UsageLimitReachedError {
+                                    plan_type,
+                                    resets_in_seconds: header_reset_hint,
+                                    rate_limits: rate_limit_snapshot,
+                                }));
+                            } else if error.r#type.as_deref() == Some("usage_not_included") {
+                                return Err(CodexErr::UsageNotIncluded);
+                            }
                        }
                    }
-                }

-                Err(StreamAttemptError::RetryableHttpError {
-                    status,
-                    retry_after,
-                })
+                    if attempt > max_retries {
+                        if status == StatusCode::INTERNAL_SERVER_ERROR {
+                            return Err(CodexErr::InternalServerError);
+                        }
+
+                        return Err(CodexErr::RetryLimit(status));
+                    }
+
+                    let delay = retry_after_secs
+                        .map(|s| Duration::from_millis(s * 1_000))
+                        .unwrap_or_else(|| backoff(attempt));
+                    tokio::time::sleep(delay).await;
+                }
+                Err(e) => {
+                    if attempt > max_retries {
+                        return Err(e.into());
+                    }
+                    let delay = backoff(attempt);
+                    tokio::time::sleep(delay).await;
+                }
            }
-            Err(e) => Err(StreamAttemptError::RetryableTransportError(e.into())),
        }
    }

@@ -424,47 +406,6 @@ impl ModelClient {
    }
 }

-enum StreamAttemptError {
-    RetryableHttpError {
-        status: StatusCode,
-        retry_after: Option<Duration>,
-    },
-    RetryableTransportError(CodexErr),
-    Fatal(CodexErr),
-}
-
-impl StreamAttemptError {
-    /// attempt is 0-based.
-    fn delay(&self, attempt: u64) -> Duration {
-        // backoff() uses 1-based attempts.
-        let backoff_attempt = attempt + 1;
-        match self {
-            Self::RetryableHttpError { retry_after, .. } => {
-                retry_after.unwrap_or_else(|| backoff(backoff_attempt))
-            }
-            Self::RetryableTransportError { .. } => backoff(backoff_attempt),
-            Self::Fatal(_) => {
-                // Should not be called on Fatal errors.
-                Duration::from_secs(0)
-            }
-        }
-    }
-
-    fn into_error(self) -> CodexErr {
-        match self {
-            Self::RetryableHttpError { status, .. } => {
-                if status == StatusCode::INTERNAL_SERVER_ERROR {
-                    CodexErr::InternalServerError
-                } else {
-                    CodexErr::RetryLimit(status)
-                }
-            }
-            Self::RetryableTransportError(error) => error,
-            Self::Fatal(error) => error,
-        }
-    }
-}
-
 #[derive(Debug, Deserialize, Serialize)]
 struct SseEvent {
    #[serde(rename = "type")]
@@ -474,6 +415,9 @@ struct SseEvent {
    delta: Option<String>,
 }

+#[derive(Debug, Deserialize)]
+struct ResponseCreated {}
+
 #[derive(Debug, Deserialize)]
 struct ResponseCompleted {
    id: String,
@@ -545,45 +489,48 @@ fn attach_item_ids(payload_json: &mut Value, original_items: &[ResponseItem]) {
 }

 fn parse_rate_limit_snapshot(headers: &HeaderMap) -> Option<RateLimitSnapshot> {
-    let primary = parse_rate_limit_window(
-        headers,
-        "x-codex-primary-used-percent",
-        "x-codex-primary-window-minutes",
-        "x-codex-primary-reset-after-seconds",
-    );
+    let primary_used_percent = parse_header_f64(headers, "x-codex-primary-used-percent");
+    let primary_window_minutes = parse_header_u64(headers, "x-codex-primary-window-minutes");
+    let primary_resets_in_seconds =
+        parse_header_u64(headers, "x-codex-primary-reset-after-seconds");

-    let secondary = parse_rate_limit_window(
-        headers,
-        "x-codex-secondary-used-percent",
-        "x-codex-secondary-window-minutes",
-        "x-codex-secondary-reset-after-seconds",
-    );
+    let primary = primary_used_percent.map(|used_percent| RateLimitWindow {
+        used_percent,
+        window_minutes: primary_window_minutes,
+        resets_in_seconds: primary_resets_in_seconds,
+    });
+
+    let secondary_used_percent = parse_header_f64(headers, "x-codex-secondary-used-percent");
+    let secondary_window_minutes = parse_header_u64(headers, "x-codex-secondary-window-minutes");
+    let secondary_resets_in_seconds =
+        parse_header_u64(headers, "x-codex-secondary-reset-after-seconds");
+
+    let secondary = secondary_used_percent.map(|used_percent| RateLimitWindow {
+        used_percent,
+        window_minutes: secondary_window_minutes,
+        resets_in_seconds: secondary_resets_in_seconds,
+    });
+
+    if primary.is_none() && secondary.is_none() {
+        return None;
+    }

    Some(RateLimitSnapshot { primary, secondary })
 }

-fn parse_rate_limit_window(
-    headers: &HeaderMap,
-    used_percent_header: &str,
-    window_minutes_header: &str,
-    resets_header: &str,
-) -> Option<RateLimitWindow> {
-    let used_percent: Option<f64> = parse_header_f64(headers, used_percent_header);
-
-    used_percent.and_then(|used_percent| {
-        let window_minutes = parse_header_u64(headers, window_minutes_header);
-        let resets_in_seconds = parse_header_u64(headers, resets_header);
-
-        let has_data = used_percent != 0.0
-            || window_minutes.is_some_and(|minutes| minutes != 0)
-            || resets_in_seconds.is_some_and(|seconds| seconds != 0);
-
-        has_data.then_some(RateLimitWindow {
-            used_percent,
-            window_minutes,
-            resets_in_seconds,
+fn rate_limit_reset_hint(snapshot: &RateLimitSnapshot) -> Option<u64> {
+    [snapshot.primary.as_ref(), snapshot.secondary.as_ref()]
+        .into_iter()
+        .flatten()
+        .filter(|window| window.used_percent >= 100.0)
+        .filter_map(|window| {
+            window.resets_in_seconds.or_else(|| {
+                window
+                    .window_minutes
+                    .map(|minutes| minutes.saturating_mul(60))
+            })
        })
-    })
+        .max()
 }

 fn parse_header_f64(headers: &HeaderMap, name: &str) -> Option<f64> {
@@ -1195,7 +1142,6 @@ mod tests {
            message: Some("Rate limit reached for gpt-5 in organization org- on tokens per min (TPM): Limit 1, Used 1, Requested 19304. Please try again in 28ms. Visit https://platform.openai.com/account/rate-limits to learn more.".to_string()),
            code: Some("rate_limit_exceeded".to_string()),
            plan_type: None,
-            resets_in_seconds: None
        };

        let delay = try_parse_retry_after(&err);
@@ -1209,7 +1155,6 @@ mod tests {
            message: Some("Rate limit reached for gpt-5 in organization <ORG> on tokens per min (TPM): Limit 30000, Used 6899, Requested 24050. Please try again in 1.898s. Visit https://platform.openai.com/account/rate-limits to learn more.".to_string()),
            code: Some("rate_limit_exceeded".to_string()),
            plan_type: None,
-            resets_in_seconds: None
        };
        let delay = try_parse_retry_after(&err);
        assert_eq!(delay, Some(Duration::from_secs_f64(1.898)));
--- a/codex-rs/core/src/codex.rs
+++ b/codex-rs/core/src/codex.rs
--- a/codex-rs/core/src/codex/compact.rs
+++ b/codex-rs/core/src/codex/compact.rs
@@ -1,5 +1,6 @@
 use std::sync::Arc;

+use super::AgentTask;
 use super::Session;
 use super::TurnContext;
 use super::get_last_assistant_message_from_turn;
@@ -14,6 +15,7 @@ use crate::protocol::Event;
 use crate::protocol::EventMsg;
 use crate::protocol::InputItem;
 use crate::protocol::InputMessageKind;
+use crate::protocol::TaskCompleteEvent;
 use crate::protocol::TaskStartedEvent;
 use crate::protocol::TurnContextItem;
 use crate::truncate::truncate_middle;
@@ -35,7 +37,17 @@ struct HistoryBridgeTemplate<'a> {
    summary_text: &'a str,
 }

-pub(crate) async fn run_inline_auto_compact_task(
+pub(super) async fn spawn_compact_task(
+    sess: Arc<Session>,
+    turn_context: Arc<TurnContext>,
+    sub_id: String,
+    input: Vec<InputItem>,
+) {
+    let task = AgentTask::compact(sess.clone(), turn_context, sub_id, input);
+    sess.set_task(task).await;
+}
+
+pub(super) async fn run_inline_auto_compact_task(
    sess: Arc<Session>,
    turn_context: Arc<TurnContext>,
 ) {
@@ -43,15 +55,15 @@ pub(crate) async fn run_inline_auto_compact_task(
    let input = vec![InputItem::Text {
        text: SUMMARIZATION_PROMPT.to_string(),
    }];
-    run_compact_task_inner(sess, turn_context, sub_id, input).await;
+    run_compact_task_inner(sess, turn_context, sub_id, input, None, false).await;
 }

-pub(crate) async fn run_compact_task(
+pub(super) async fn run_compact_task(
    sess: Arc<Session>,
    turn_context: Arc<TurnContext>,
    sub_id: String,
    input: Vec<InputItem>,
-) -> Option<String> {
+) {
    let start_event = Event {
        id: sub_id.clone(),
        msg: EventMsg::TaskStarted(TaskStartedEvent {
@@ -59,8 +71,22 @@ pub(crate) async fn run_compact_task(
        }),
    };
    sess.send_event(start_event).await;
-    run_compact_task_inner(sess.clone(), turn_context, sub_id.clone(), input).await;
-    None
+    run_compact_task_inner(
+        sess.clone(),
+        turn_context,
+        sub_id.clone(),
+        input,
+        None,
+        true,
+    )
+    .await;
+    let event = Event {
+        id: sub_id,
+        msg: EventMsg::TaskComplete(TaskCompleteEvent {
+            last_agent_message: None,
+        }),
+    };
+    sess.send_event(event).await;
 }

 async fn run_compact_task_inner(
@@ -68,6 +94,8 @@ async fn run_compact_task_inner(
    turn_context: Arc<TurnContext>,
    sub_id: String,
    input: Vec<InputItem>,
+    instructions_override: Option<String>,
+    remove_task_on_completion: bool,
 ) {
    let initial_input_for_turn: ResponseInputItem = ResponseInputItem::from(input);
    let turn_input = sess
@@ -76,7 +104,9 @@ async fn run_compact_task_inner(

    let prompt = Prompt {
        input: turn_input,
-        ..Default::default()
+        tools: Vec::new(),
+        base_instructions_override: instructions_override,
+        output_schema: None,
    };

    let max_retries = turn_context.client.get_provider().stream_max_retries();
@@ -93,8 +123,7 @@ async fn run_compact_task_inner(
    sess.persist_rollout_items(&[rollout_item]).await;

    loop {
-        let attempt_result =
-            drain_to_completed(&sess, turn_context.as_ref(), &sub_id, &prompt).await;
+        let attempt_result = drain_to_completed(&sess, turn_context.as_ref(), &prompt).await;

        match attempt_result {
            Ok(()) => {
@@ -130,12 +159,21 @@ async fn run_compact_task_inner(
        }
    }

-    let history_snapshot = sess.history_snapshot().await;
+    if remove_task_on_completion {
+        sess.remove_task(&sub_id).await;
+    }
+    let history_snapshot = {
+        let state = sess.state.lock().await;
+        state.history.contents()
+    };
    let summary_text = get_last_assistant_message_from_turn(&history_snapshot).unwrap_or_default();
    let user_messages = collect_user_messages(&history_snapshot);
    let initial_context = sess.build_initial_context(turn_context.as_ref());
    let new_history = build_compacted_history(initial_context, &user_messages, &summary_text);
-    sess.replace_history(new_history).await;
+    {
+        let mut state = sess.state.lock().await;
+        state.history.replace(new_history);
+    }

    let rollout_item = RolloutItem::Compacted(CompactedItem {
        message: summary_text.clone(),
@@ -230,7 +268,6 @@ pub(crate) fn build_compacted_history(
 async fn drain_to_completed(
    sess: &Session,
    turn_context: &TurnContext,
-    sub_id: &str,
    prompt: &Prompt,
 ) -> CodexResult<()> {
    let mut stream = turn_context.client.clone().stream(prompt).await?;
@@ -244,14 +281,10 @@ async fn drain_to_completed(
        };
        match event {
            Ok(ResponseEvent::OutputItemDone(item)) => {
-                sess.record_into_history(std::slice::from_ref(&item)).await;
+                let mut state = sess.state.lock().await;
+                state.history.record_items(std::slice::from_ref(&item));
            }
-            Ok(ResponseEvent::RateLimits(snapshot)) => {
-                sess.update_rate_limits(sub_id, snapshot).await;
-            }
-            Ok(ResponseEvent::Completed { token_usage, .. }) => {
-                sess.update_token_usage_info(sub_id, turn_context, token_usage.as_ref())
-                    .await;
+            Ok(ResponseEvent::Completed { .. }) => {
                return Ok(());
            }
            Ok(_) => continue,
--- a/codex-rs/core/src/command_safety/is_dangerous_command.rs
+++ b/codex-rs/core/src/command_safety/is_dangerous_command.rs
@@ -1,99 +0,0 @@
-use crate::bash::parse_bash_lc_plain_commands;
-
-pub fn command_might_be_dangerous(command: &[String]) -> bool {
-    if is_dangerous_to_call_with_exec(command) {
-        return true;
-    }
-
-    // Support `bash -lc "<script>"` where the any part of the script might contain a dangerous command.
-    if let Some(all_commands) = parse_bash_lc_plain_commands(command)
-        && all_commands
-            .iter()
-            .any(|cmd| is_dangerous_to_call_with_exec(cmd))
-    {
-        return true;
-    }
-
-    false
-}
-
-fn is_dangerous_to_call_with_exec(command: &[String]) -> bool {
-    let cmd0 = command.first().map(String::as_str);
-
-    match cmd0 {
-        Some(cmd) if cmd.ends_with("git") || cmd.ends_with("/git") => {
-            matches!(command.get(1).map(String::as_str), Some("reset" | "rm"))
-        }
-
-        Some("rm") => matches!(command.get(1).map(String::as_str), Some("-f" | "-rf")),
-
-        // for sudo <cmd> simply do the check for <cmd>
-        Some("sudo") => is_dangerous_to_call_with_exec(&command[1..]),
-
-        // ── anything else ─────────────────────────────────────────────────
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn vec_str(items: &[&str]) -> Vec<String> {
-        items.iter().map(std::string::ToString::to_string).collect()
-    }
-
-    #[test]
-    fn git_reset_is_dangerous() {
-        assert!(command_might_be_dangerous(&vec_str(&["git", "reset"])));
-    }
-
-    #[test]
-    fn bash_git_reset_is_dangerous() {
-        assert!(command_might_be_dangerous(&vec_str(&[
-            "bash",
-            "-lc",
-            "git reset --hard"
-        ])));
-    }
-
-    #[test]
-    fn git_status_is_not_dangerous() {
-        assert!(!command_might_be_dangerous(&vec_str(&["git", "status"])));
-    }
-
-    #[test]
-    fn bash_git_status_is_not_dangerous() {
-        assert!(!command_might_be_dangerous(&vec_str(&[
-            "bash",
-            "-lc",
-            "git status"
-        ])));
-    }
-
-    #[test]
-    fn sudo_git_reset_is_dangerous() {
-        assert!(command_might_be_dangerous(&vec_str(&[
-            "sudo", "git", "reset", "--hard"
-        ])));
-    }
-
-    #[test]
-    fn usr_bin_git_is_dangerous() {
-        assert!(command_might_be_dangerous(&vec_str(&[
-            "/usr/bin/git",
-            "reset",
-            "--hard"
-        ])));
-    }
-
-    #[test]
-    fn rm_rf_is_dangerous() {
-        assert!(command_might_be_dangerous(&vec_str(&["rm", "-rf", "/"])));
-    }
-
-    #[test]
-    fn rm_f_is_dangerous() {
-        assert!(command_might_be_dangerous(&vec_str(&["rm", "-f", "/"])));
-    }
-}
--- a/codex-rs/core/src/command_safety/mod.rs
+++ b/codex-rs/core/src/command_safety/mod.rs
@@ -1,4 +0,0 @@
-pub mod is_dangerous_command;
-pub mod is_safe_command;
-#[cfg(target_os = "windows")]
-pub mod windows_safe_commands;
--- a/codex-rs/core/src/command_safety/windows_safe_commands.rs
+++ b/codex-rs/core/src/command_safety/windows_safe_commands.rs
@@ -1,25 +0,0 @@
-// This is a WIP. This will eventually contain a real list of common safe Windows commands.
-pub fn is_safe_command_windows(_command: &[String]) -> bool {
-    false
-}
-
-#[cfg(test)]
-mod tests {
-    use super::is_safe_command_windows;
-
-    fn vec_str(args: &[&str]) -> Vec<String> {
-        args.iter().map(ToString::to_string).collect()
-    }
-
-    #[test]
-    fn everything_is_unsafe() {
-        for cmd in [
-            vec_str(&["powershell.exe", "-NoLogo", "-Command", "echo hello"]),
-            vec_str(&["copy", "foo", "bar"]),
-            vec_str(&["del", "file.txt"]),
-            vec_str(&["powershell.exe", "Get-ChildItem"]),
-        ] {
-            assert!(!is_safe_command_windows(&cmd));
-        }
-    }
-}
--- a/codex-rs/core/src/config.rs
+++ b/codex-rs/core/src/config.rs
@@ -1,7 +1,6 @@
 use crate::config_profile::ConfigProfile;
 use crate::config_types::History;
 use crate::config_types::McpServerConfig;
-use crate::config_types::McpServerTransportConfig;
 use crate::config_types::Notifications;
 use crate::config_types::ReasoningSummaryFormat;
 use crate::config_types::SandboxWorkspaceWrite;
@@ -185,14 +184,8 @@ pub struct Config {
    /// If set to `true`, used only the experimental unified exec tool.
    pub use_experimental_unified_exec_tool: bool,

-    /// If set to `true`, use the experimental official Rust MCP client.
-    /// https://github.com/modelcontextprotocol/rust-sdk
-    pub use_experimental_use_rmcp_client: bool,
-
    /// Include the `view_image` tool that lets the agent attach a local image path to context.
    pub include_view_image_tool: bool,
-    /// When true, sessions run inside a linked git worktree under `cwd/codex/<conversation>`.
-    pub enable_git_worktree: bool,

    /// The active profile name used to derive this `Config` (if any).
    pub active_profile: Option<String>,
@@ -317,37 +310,27 @@ pub fn write_global_mcp_servers(
        for (name, config) in servers {
            let mut entry = TomlTable::new();
            entry.set_implicit(false);
-            match &config.transport {
-                McpServerTransportConfig::Stdio { command, args, env } => {
-                    entry["command"] = toml_edit::value(command.clone());
+            entry["command"] = toml_edit::value(config.command.clone());

-                    if !args.is_empty() {
-                        let mut args_array = TomlArray::new();
-                        for arg in args {
-                            args_array.push(arg.clone());
-                        }
-                        entry["args"] = TomlItem::Value(args_array.into());
-                    }
+            if !config.args.is_empty() {
+                let mut args = TomlArray::new();
+                for arg in &config.args {
+                    args.push(arg.clone());
+                }
+                entry["args"] = TomlItem::Value(args.into());
+            }

-                    if let Some(env) = env
-                        && !env.is_empty()
-                    {
-                        let mut env_table = TomlTable::new();
-                        env_table.set_implicit(false);
-                        let mut pairs: Vec<_> = env.iter().collect();
-                        pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                        for (key, value) in pairs {
-                            env_table.insert(key, toml_edit::value(value.clone()));
-                        }
-                        entry["env"] = TomlItem::Table(env_table);
-                    }
-                }
-                McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-                    entry["url"] = toml_edit::value(url.clone());
-                    if let Some(token) = bearer_token {
-                        entry["bearer_token"] = toml_edit::value(token.clone());
-                    }
+            if let Some(env) = &config.env
+                && !env.is_empty()
+            {
+                let mut env_table = TomlTable::new();
+                env_table.set_implicit(false);
+                let mut pairs: Vec<_> = env.iter().collect();
+                pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+                for (key, value) in pairs {
+                    env_table.insert(key, toml_edit::value(value.clone()));
                }
+                entry["env"] = TomlItem::Table(env_table);
            }

            if let Some(timeout) = config.startup_timeout_sec {
@@ -691,9 +674,6 @@ pub struct ConfigToml {
    /// Defaults to `false`.
    pub show_raw_agent_reasoning: Option<bool>,

-    /// Enable per-session git worktree checkouts.
-    pub enable_git_worktree: Option<bool>,
-
    pub model_reasoning_effort: Option<ReasoningEffort>,
    pub model_reasoning_summary: Option<ReasoningSummary>,
    /// Optional verbosity control for GPT-5 models (Responses API `text.verbosity`).
@@ -713,7 +693,6 @@ pub struct ConfigToml {

    pub experimental_use_exec_command_tool: Option<bool>,
    pub experimental_use_unified_exec_tool: Option<bool>,
-    pub experimental_use_rmcp_client: Option<bool>,

    pub projects: Option<HashMap<String, ProjectConfig>>,

@@ -864,7 +843,6 @@ pub struct ConfigOverrides {
    pub include_view_image_tool: Option<bool>,
    pub show_raw_agent_reasoning: Option<bool>,
    pub tools_web_search_request: Option<bool>,
-    pub enable_git_worktree: Option<bool>,
 }

 impl Config {
@@ -893,7 +871,6 @@ impl Config {
            include_view_image_tool,
            show_raw_agent_reasoning,
            tools_web_search_request: override_tools_web_search_request,
-            enable_git_worktree: override_enable_git_worktree,
        } = overrides;

        let active_profile_name = config_profile_key
@@ -967,10 +944,6 @@ impl Config {
            .or(cfg.tools.as_ref().and_then(|t| t.view_image))
            .unwrap_or(true);

-        let enable_git_worktree = override_enable_git_worktree
-            .or(cfg.enable_git_worktree)
-            .unwrap_or(false);
-
        let model = model
            .or(config_profile.model)
            .or(cfg.model)
@@ -1070,9 +1043,7 @@ impl Config {
            use_experimental_unified_exec_tool: cfg
                .experimental_use_unified_exec_tool
                .unwrap_or(false),
-            use_experimental_use_rmcp_client: cfg.experimental_use_rmcp_client.unwrap_or(false),
            include_view_image_tool,
-            enable_git_worktree,
            active_profile: active_profile_name,
            disable_paste_burst: cfg.disable_paste_burst.unwrap_or(false),
            tui_notifications: cfg
@@ -1317,11 +1288,9 @@ exclude_slash_tmp = true
        servers.insert(
            "docs".to_string(),
            McpServerConfig {
-                transport: McpServerTransportConfig::Stdio {
-                    command: "echo".to_string(),
-                    args: vec!["hello".to_string()],
-                    env: None,
-                },
+                command: "echo".to_string(),
+                args: vec!["hello".to_string()],
+                env: None,
                startup_timeout_sec: Some(Duration::from_secs(3)),
                tool_timeout_sec: Some(Duration::from_secs(5)),
            },
@@ -1332,14 +1301,8 @@ exclude_slash_tmp = true
        let loaded = load_global_mcp_servers(codex_home.path())?;
        assert_eq!(loaded.len(), 1);
        let docs = loaded.get("docs").expect("docs entry");
-        match &docs.transport {
-            McpServerTransportConfig::Stdio { command, args, env } => {
-                assert_eq!(command, "echo");
-                assert_eq!(args, &vec!["hello".to_string()]);
-                assert!(env.is_none());
-            }
-            other => panic!("unexpected transport {other:?}"),
-        }
+        assert_eq!(docs.command, "echo");
+        assert_eq!(docs.args, vec!["hello".to_string()]);
        assert_eq!(docs.startup_timeout_sec, Some(Duration::from_secs(3)));
        assert_eq!(docs.tool_timeout_sec, Some(Duration::from_secs(5)));

@@ -1373,134 +1336,6 @@ startup_timeout_ms = 2500
        Ok(())
    }

-    #[test]
-    fn write_global_mcp_servers_serializes_env_sorted() -> anyhow::Result<()> {
-        let codex_home = TempDir::new()?;
-
-        let servers = BTreeMap::from([(
-            "docs".to_string(),
-            McpServerConfig {
-                transport: McpServerTransportConfig::Stdio {
-                    command: "docs-server".to_string(),
-                    args: vec!["--verbose".to_string()],
-                    env: Some(HashMap::from([
-                        ("ZIG_VAR".to_string(), "3".to_string()),
-                        ("ALPHA_VAR".to_string(), "1".to_string()),
-                    ])),
-                },
-                startup_timeout_sec: None,
-                tool_timeout_sec: None,
-            },
-        )]);
-
-        write_global_mcp_servers(codex_home.path(), &servers)?;
-
-        let config_path = codex_home.path().join(CONFIG_TOML_FILE);
-        let serialized = std::fs::read_to_string(&config_path)?;
-        assert_eq!(
-            serialized,
-            r#"[mcp_servers.docs]
-command = "docs-server"
-args = ["--verbose"]
-
-[mcp_servers.docs.env]
-ALPHA_VAR = "1"
-ZIG_VAR = "3"
-"#
-        );
-
-        let loaded = load_global_mcp_servers(codex_home.path())?;
-        let docs = loaded.get("docs").expect("docs entry");
-        match &docs.transport {
-            McpServerTransportConfig::Stdio { command, args, env } => {
-                assert_eq!(command, "docs-server");
-                assert_eq!(args, &vec!["--verbose".to_string()]);
-                let env = env
-                    .as_ref()
-                    .expect("env should be preserved for stdio transport");
-                assert_eq!(env.get("ALPHA_VAR"), Some(&"1".to_string()));
-                assert_eq!(env.get("ZIG_VAR"), Some(&"3".to_string()));
-            }
-            other => panic!("unexpected transport {other:?}"),
-        }
-
-        Ok(())
-    }
-
-    #[test]
-    fn write_global_mcp_servers_serializes_streamable_http() -> anyhow::Result<()> {
-        let codex_home = TempDir::new()?;
-
-        let mut servers = BTreeMap::from([(
-            "docs".to_string(),
-            McpServerConfig {
-                transport: McpServerTransportConfig::StreamableHttp {
-                    url: "https://example.com/mcp".to_string(),
-                    bearer_token: Some("secret-token".to_string()),
-                },
-                startup_timeout_sec: Some(Duration::from_secs(2)),
-                tool_timeout_sec: None,
-            },
-        )]);
-
-        write_global_mcp_servers(codex_home.path(), &servers)?;
-
-        let config_path = codex_home.path().join(CONFIG_TOML_FILE);
-        let serialized = std::fs::read_to_string(&config_path)?;
-        assert_eq!(
-            serialized,
-            r#"[mcp_servers.docs]
-url = "https://example.com/mcp"
-bearer_token = "secret-token"
-startup_timeout_sec = 2.0
-"#
-        );
-
-        let loaded = load_global_mcp_servers(codex_home.path())?;
-        let docs = loaded.get("docs").expect("docs entry");
-        match &docs.transport {
-            McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-                assert_eq!(url, "https://example.com/mcp");
-                assert_eq!(bearer_token.as_deref(), Some("secret-token"));
-            }
-            other => panic!("unexpected transport {other:?}"),
-        }
-        assert_eq!(docs.startup_timeout_sec, Some(Duration::from_secs(2)));
-
-        servers.insert(
-            "docs".to_string(),
-            McpServerConfig {
-                transport: McpServerTransportConfig::StreamableHttp {
-                    url: "https://example.com/mcp".to_string(),
-                    bearer_token: None,
-                },
-                startup_timeout_sec: None,
-                tool_timeout_sec: None,
-            },
-        );
-        write_global_mcp_servers(codex_home.path(), &servers)?;
-
-        let serialized = std::fs::read_to_string(&config_path)?;
-        assert_eq!(
-            serialized,
-            r#"[mcp_servers.docs]
-url = "https://example.com/mcp"
-"#
-        );
-
-        let loaded = load_global_mcp_servers(codex_home.path())?;
-        let docs = loaded.get("docs").expect("docs entry");
-        match &docs.transport {
-            McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-                assert_eq!(url, "https://example.com/mcp");
-                assert!(bearer_token.is_none());
-            }
-            other => panic!("unexpected transport {other:?}"),
-        }
-
-        Ok(())
-    }
-
    #[tokio::test]
    async fn persist_model_selection_updates_defaults() -> anyhow::Result<()> {
        let codex_home = TempDir::new()?;
@@ -1816,9 +1651,7 @@ model_verbosity = "high"
                tools_web_search_request: false,
                use_experimental_streamable_shell_tool: false,
                use_experimental_unified_exec_tool: false,
-                use_experimental_use_rmcp_client: false,
                include_view_image_tool: true,
-                enable_git_worktree: false,
                active_profile: Some("o3".to_string()),
                disable_paste_burst: false,
                tui_notifications: Default::default(),
@@ -1876,9 +1709,7 @@ model_verbosity = "high"
            tools_web_search_request: false,
            use_experimental_streamable_shell_tool: false,
            use_experimental_unified_exec_tool: false,
-            use_experimental_use_rmcp_client: false,
            include_view_image_tool: true,
-            enable_git_worktree: false,
            active_profile: Some("gpt3".to_string()),
            disable_paste_burst: false,
            tui_notifications: Default::default(),
@@ -1951,9 +1782,7 @@ model_verbosity = "high"
            tools_web_search_request: false,
            use_experimental_streamable_shell_tool: false,
            use_experimental_unified_exec_tool: false,
-            use_experimental_use_rmcp_client: false,
            include_view_image_tool: true,
-            enable_git_worktree: false,
            active_profile: Some("zdr".to_string()),
            disable_paste_burst: false,
            tui_notifications: Default::default(),
@@ -2012,9 +1841,7 @@ model_verbosity = "high"
            tools_web_search_request: false,
            use_experimental_streamable_shell_tool: false,
            use_experimental_unified_exec_tool: false,
-            use_experimental_use_rmcp_client: false,
            include_view_image_tool: true,
-            enable_git_worktree: false,
            active_profile: Some("gpt5".to_string()),
            disable_paste_burst: false,
            tui_notifications: Default::default(),
--- a/codex-rs/core/src/config_types.rs
+++ b/codex-rs/core/src/config_types.rs
@@ -3,20 +3,25 @@
 // Note this file should generally be restricted to simple struct/enum
 // definitions that do not contain business logic.

-use serde::Deserializer;
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::time::Duration;
 use wildmatch::WildMatchPattern;

 use serde::Deserialize;
+use serde::Deserializer;
 use serde::Serialize;
 use serde::de::Error as SerdeError;

 #[derive(Serialize, Debug, Clone, PartialEq)]
 pub struct McpServerConfig {
-    #[serde(flatten)]
-    pub transport: McpServerTransportConfig,
+    pub command: String,
+
+    #[serde(default)]
+    pub args: Vec<String>,
+
+    #[serde(default)]
+    pub env: Option<HashMap<String, String>>,

    /// Startup timeout in seconds for initializing MCP server & initially listing tools.
    #[serde(
@@ -38,15 +43,11 @@ impl<'de> Deserialize<'de> for McpServerConfig {
    {
        #[derive(Deserialize)]
        struct RawMcpServerConfig {
-            command: Option<String>,
+            command: String,
            #[serde(default)]
-            args: Option<Vec<String>>,
+            args: Vec<String>,
            #[serde(default)]
            env: Option<HashMap<String, String>>,
-
-            url: Option<String>,
-            bearer_token: Option<String>,
-
            #[serde(default)]
            startup_timeout_sec: Option<f64>,
            #[serde(default)]
@@ -66,81 +67,16 @@ impl<'de> Deserialize<'de> for McpServerConfig {
            (None, None) => None,
        };

-        fn throw_if_set<E, T>(transport: &str, field: &str, value: Option<&T>) -> Result<(), E>
-        where
-            E: SerdeError,
-        {
-            if value.is_none() {
-                return Ok(());
-            }
-            Err(E::custom(format!(
-                "{field} is not supported for {transport}",
-            )))
-        }
-
-        let transport = match raw {
-            RawMcpServerConfig {
-                command: Some(command),
-                args,
-                env,
-                url,
-                bearer_token,
-                ..
-            } => {
-                throw_if_set("stdio", "url", url.as_ref())?;
-                throw_if_set("stdio", "bearer_token", bearer_token.as_ref())?;
-                McpServerTransportConfig::Stdio {
-                    command,
-                    args: args.unwrap_or_default(),
-                    env,
-                }
-            }
-            RawMcpServerConfig {
-                url: Some(url),
-                bearer_token,
-                command,
-                args,
-                env,
-                ..
-            } => {
-                throw_if_set("streamable_http", "command", command.as_ref())?;
-                throw_if_set("streamable_http", "args", args.as_ref())?;
-                throw_if_set("streamable_http", "env", env.as_ref())?;
-                McpServerTransportConfig::StreamableHttp { url, bearer_token }
-            }
-            _ => return Err(SerdeError::custom("invalid transport")),
-        };
-
        Ok(Self {
-            transport,
+            command: raw.command,
+            args: raw.args,
+            env: raw.env,
            startup_timeout_sec,
            tool_timeout_sec: raw.tool_timeout_sec,
        })
    }
 }

-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-#[serde(untagged, deny_unknown_fields, rename_all = "snake_case")]
-pub enum McpServerTransportConfig {
-    /// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#stdio
-    Stdio {
-        command: String,
-        #[serde(default)]
-        args: Vec<String>,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        env: Option<HashMap<String, String>>,
-    },
-    /// https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http
-    StreamableHttp {
-        url: String,
-        /// A plain text bearer token to use for authentication.
-        /// This bearer token will be included in the HTTP request header as an `Authorization: Bearer <token>` header.
-        /// This should be used with caution because it lives on disk in clear text.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        bearer_token: Option<String>,
-    },
-}
-
 mod option_duration_secs {
    use serde::Deserialize;
    use serde::Deserializer;
@@ -367,139 +303,3 @@ pub enum ReasoningSummaryFormat {
    None,
    Experimental,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use pretty_assertions::assert_eq;
-
-    #[test]
-    fn deserialize_stdio_command_server_config() {
-        let cfg: McpServerConfig = toml::from_str(
-            r#"
-            command = "echo"
-        "#,
-        )
-        .expect("should deserialize command config");
-
-        assert_eq!(
-            cfg.transport,
-            McpServerTransportConfig::Stdio {
-                command: "echo".to_string(),
-                args: vec![],
-                env: None
-            }
-        );
-    }
-
-    #[test]
-    fn deserialize_stdio_command_server_config_with_args() {
-        let cfg: McpServerConfig = toml::from_str(
-            r#"
-            command = "echo"
-            args = ["hello", "world"]
-        "#,
-        )
-        .expect("should deserialize command config");
-
-        assert_eq!(
-            cfg.transport,
-            McpServerTransportConfig::Stdio {
-                command: "echo".to_string(),
-                args: vec!["hello".to_string(), "world".to_string()],
-                env: None
-            }
-        );
-    }
-
-    #[test]
-    fn deserialize_stdio_command_server_config_with_arg_with_args_and_env() {
-        let cfg: McpServerConfig = toml::from_str(
-            r#"
-            command = "echo"
-            args = ["hello", "world"]
-            env = { "FOO" = "BAR" }
-        "#,
-        )
-        .expect("should deserialize command config");
-
-        assert_eq!(
-            cfg.transport,
-            McpServerTransportConfig::Stdio {
-                command: "echo".to_string(),
-                args: vec!["hello".to_string(), "world".to_string()],
-                env: Some(HashMap::from([("FOO".to_string(), "BAR".to_string())]))
-            }
-        );
-    }
-
-    #[test]
-    fn deserialize_streamable_http_server_config() {
-        let cfg: McpServerConfig = toml::from_str(
-            r#"
-            url = "https://example.com/mcp"
-        "#,
-        )
-        .expect("should deserialize http config");
-
-        assert_eq!(
-            cfg.transport,
-            McpServerTransportConfig::StreamableHttp {
-                url: "https://example.com/mcp".to_string(),
-                bearer_token: None
-            }
-        );
-    }
-
-    #[test]
-    fn deserialize_streamable_http_server_config_with_bearer_token() {
-        let cfg: McpServerConfig = toml::from_str(
-            r#"
-            url = "https://example.com/mcp"
-            bearer_token = "secret"
-        "#,
-        )
-        .expect("should deserialize http config");
-
-        assert_eq!(
-            cfg.transport,
-            McpServerTransportConfig::StreamableHttp {
-                url: "https://example.com/mcp".to_string(),
-                bearer_token: Some("secret".to_string())
-            }
-        );
-    }
-
-    #[test]
-    fn deserialize_rejects_command_and_url() {
-        toml::from_str::<McpServerConfig>(
-            r#"
-            command = "echo"
-            url = "https://example.com"
-        "#,
-        )
-        .expect_err("should reject command+url");
-    }
-
-    #[test]
-    fn deserialize_rejects_env_for_http_transport() {
-        toml::from_str::<McpServerConfig>(
-            r#"
-            url = "https://example.com"
-            env = { "FOO" = "BAR" }
-        "#,
-        )
-        .expect_err("should reject env for http transport");
-    }
-
-    #[test]
-    fn deserialize_rejects_bearer_token_for_stdio_transport() {
-        toml::from_str::<McpServerConfig>(
-            r#"
-            command = "echo"
-            bearer_token = "secret"
-        "#,
-        )
-        .expect_err("should reject bearer token for stdio transport");
-    }
-}
--- a/codex-rs/core/src/default_client.rs
+++ b/codex-rs/core/src/default_client.rs
@@ -1,4 +1,3 @@
-use crate::spawn::CODEX_SANDBOX_ENV_VAR;
 use reqwest::header::HeaderValue;
 use std::sync::LazyLock;
 use std::sync::Mutex;
@@ -21,6 +20,7 @@ use std::sync::Mutex;
 pub static USER_AGENT_SUFFIX: LazyLock<Mutex<Option<String>>> = LazyLock::new(|| Mutex::new(None));

 pub const CODEX_INTERNAL_ORIGINATOR_OVERRIDE_ENV_VAR: &str = "CODEX_INTERNAL_ORIGINATOR_OVERRIDE";
+
 #[derive(Debug, Clone)]
 pub struct Originator {
    pub value: String,
@@ -112,25 +112,17 @@ pub fn create_client() -> reqwest::Client {
    headers.insert("originator", ORIGINATOR.header_value.clone());
    let ua = get_codex_user_agent();

-    let mut builder = reqwest::Client::builder()
+    reqwest::Client::builder()
        // Set UA via dedicated helper to avoid header validation pitfalls
        .user_agent(ua)
-        .default_headers(headers);
-    if is_sandboxed() {
-        builder = builder.no_proxy();
-    }
-
-    builder.build().unwrap_or_else(|_| reqwest::Client::new())
-}
-
-fn is_sandboxed() -> bool {
-    std::env::var(CODEX_SANDBOX_ENV_VAR).as_deref() == Ok("seatbelt")
+        .default_headers(headers)
+        .build()
+        .unwrap_or_else(|_| reqwest::Client::new())
 }

 #[cfg(test)]
 mod tests {
    use super::*;
-    use core_test_support::skip_if_no_network;

    #[test]
    fn test_get_codex_user_agent() {
@@ -140,8 +132,6 @@ mod tests {

    #[tokio::test]
    async fn test_create_client_sets_default_headers() {
-        skip_if_no_network!();
-
        use wiremock::Mock;
        use wiremock::MockServer;
        use wiremock::ResponseTemplate;
--- a/codex-rs/core/src/error.rs
+++ b/codex-rs/core/src/error.rs
@@ -156,7 +156,7 @@ impl std::fmt::Display for UsageLimitReachedError {
                )
            }
            Some(PlanType::Known(KnownPlan::Free)) => {
-                "You've hit your usage limit. Upgrade to Plus to continue using Codex (https://openai.com/chatgpt/pricing)."
+                "To use Codex with your ChatGPT plan, upgrade to Plus: https://openai.com/chatgpt/pricing."
                    .to_string()
            }
            Some(PlanType::Known(KnownPlan::Pro))
@@ -306,7 +306,7 @@ mod tests {
        };
        assert_eq!(
            err.to_string(),
-            "You've hit your usage limit. Upgrade to Plus to continue using Codex (https://openai.com/chatgpt/pricing)."
+            "To use Codex with your ChatGPT plan, upgrade to Plus: https://openai.com/chatgpt/pricing."
        );
    }

--- a/codex-rs/core/src/exec_command/mod.rs
+++ b/codex-rs/core/src/exec_command/mod.rs
@@ -12,3 +12,4 @@ pub use responses_api::WRITE_STDIN_TOOL_NAME;
 pub use responses_api::create_exec_command_tool_for_responses_api;
 pub use responses_api::create_write_stdin_tool_for_responses_api;
 pub use session_manager::SessionManager as ExecSessionManager;
+pub use session_manager::result_into_payload;
--- a/codex-rs/core/src/exec_command/session_manager.rs
+++ b/codex-rs/core/src/exec_command/session_manager.rs
@@ -21,6 +21,7 @@ use crate::exec_command::exec_command_params::WriteStdinParams;
 use crate::exec_command::exec_command_session::ExecCommandSession;
 use crate::exec_command::session_id::SessionId;
 use crate::truncate::truncate_middle;
+use codex_protocol::models::FunctionCallOutputPayload;

 #[derive(Debug, Default)]
 pub struct SessionManager {
@@ -37,7 +38,7 @@ pub struct ExecCommandOutput {
 }

 impl ExecCommandOutput {
-    pub(crate) fn to_text_output(&self) -> String {
+    fn to_text_output(&self) -> String {
        let wall_time_secs = self.wall_time.as_secs_f32();
        let termination_status = match self.exit_status {
            ExitStatus::Exited(code) => format!("Process exited with code {code}"),
@@ -67,6 +68,19 @@ pub enum ExitStatus {
    Ongoing(SessionId),
 }

+pub fn result_into_payload(result: Result<ExecCommandOutput, String>) -> FunctionCallOutputPayload {
+    match result {
+        Ok(output) => FunctionCallOutputPayload {
+            content: output.to_text_output(),
+            success: Some(true),
+        },
+        Err(err) => FunctionCallOutputPayload {
+            content: err,
+            success: Some(false),
+        },
+    }
+}
+
 impl SessionManager {
    /// Processes the request and is required to send a response via `outgoing`.
    pub async fn handle_exec_command_request(
--- a/codex-rs/core/src/flags.rs
+++ b/codex-rs/core/src/flags.rs
@@ -1,6 +1,16 @@
+use std::time::Duration;
+
 use env_flags::env_flags;

 env_flags! {
+    pub OPENAI_API_BASE: &str = "https://api.openai.com/v1";
+
+    /// Fallback when the provider-specific key is not set.
+    pub OPENAI_API_KEY: Option<&str> = None;
+    pub OPENAI_TIMEOUT_MS: Duration = Duration::from_millis(300_000), |value| {
+        value.parse().map(Duration::from_millis)
+    };
+
    /// Fixture path for offline tests (see client.rs).
    pub CODEX_RS_SSE_FIXTURE: Option<&str> = None;
 }
--- a/codex-rs/core/src/function_tool.rs
+++ b/codex-rs/core/src/function_tool.rs
@@ -1,7 +0,0 @@
-use thiserror::Error;
-
-#[derive(Debug, Error, PartialEq)]
-pub enum FunctionCallError {
-    #[error("{0}")]
-    RespondToModel(String),
-}
--- a/codex-rs/core/src/git_info.rs
+++ b/codex-rs/core/src/git_info.rs
@@ -589,7 +589,6 @@ pub async fn current_branch_name(cwd: &Path) -> Option<String> {
 mod tests {
    use super::*;

-    use core_test_support::skip_if_sandbox;
    use std::fs;
    use std::path::PathBuf;
    use tempfile::TempDir;
@@ -661,7 +660,6 @@ mod tests {

    #[tokio::test]
    async fn test_recent_commits_orders_and_limits() {
-        skip_if_sandbox!();
        use tokio::time::Duration;
        use tokio::time::sleep;

--- a/codex-rs/core/src/git_worktree.rs
+++ b/codex-rs/core/src/git_worktree.rs
@@ -1,355 +0,0 @@
-use std::fs as std_fs;
-use std::path::Path;
-use std::path::PathBuf;
-
-use anyhow::Context;
-use anyhow::Result;
-use anyhow::anyhow;
-use codex_protocol::mcp_protocol::ConversationId;
-use tokio::fs;
-use tokio::fs::OpenOptions;
-use tokio::io::AsyncWriteExt;
-use tokio::process::Command;
-use tracing::info;
-use tracing::warn;
-
-/// Represents a linked git worktree managed by Codex.
-///
-/// The handle tracks whether Codex created the worktree for the current
-/// conversation. It leaves the checkout in place until [`remove`] is invoked.
-pub struct WorktreeHandle {
-    repo_root: PathBuf,
-    path: PathBuf,
-}
-
-impl WorktreeHandle {
-    /// Create (or reuse) a worktree rooted at
-    /// `<repo_root>/codex/worktree/<conversation_id>`.
-    pub async fn create(repo_root: &Path, conversation_id: &ConversationId) -> Result<Self> {
-        if !repo_root.exists() {
-            return Err(anyhow!(
-                "git worktree root `{}` does not exist",
-                repo_root.display()
-            ));
-        }
-
-        let repo_root = repo_root.to_path_buf();
-        let codex_dir = repo_root.join("codex");
-        let codex_worktree_dir = codex_dir.join("worktree");
-        fs::create_dir_all(&codex_worktree_dir)
-            .await
-            .with_context(|| {
-                format!(
-                    "failed to create codex worktree directory at `{}`",
-                    codex_worktree_dir.display()
-                )
-            })?;
-
-        let path = codex_worktree_dir.join(conversation_id.to_string());
-        let is_registered = worktree_registered(&repo_root, &path).await?;
-
-        if is_registered {
-            if path.exists() {
-                if let Err(err) = ensure_codex_excluded(&repo_root).await {
-                    warn!("failed to add codex worktree path to git exclude: {err:#}");
-                }
-                info!(
-                    worktree = %path.display(),
-                    "reusing existing git worktree for conversation"
-                );
-                return Ok(Self { repo_root, path });
-            }
-
-            warn!(
-                worktree = %path.display(),
-                "git worktree is registered but missing on disk; pruning stale entry"
-            );
-            run_git_command(&repo_root, ["worktree", "prune", "--expire", "now"])
-                .await
-                .with_context(|| {
-                    format!(
-                        "failed to prune git worktrees while recovering `{}`",
-                        path.display()
-                    )
-                })?;
-
-            if worktree_registered(&repo_root, &path).await? {
-                return Err(anyhow!(
-                    "git worktree `{}` is registered but missing on disk; run `git worktree prune --expire now` to remove the stale entry",
-                    path.display()
-                ));
-            }
-
-            info!(
-                worktree = %path.display(),
-                "recreating git worktree for conversation after pruning stale registration"
-            );
-        }
-
-        if path.exists() {
-            return Err(anyhow!(
-                "git worktree path `{}` already exists but is not registered; remove it manually",
-                path.display()
-            ));
-        }
-
-        run_git_command(
-            &repo_root,
-            [
-                "worktree",
-                "add",
-                "--detach",
-                path.to_str().ok_or_else(|| {
-                    anyhow!(
-                        "failed to convert worktree path `{}` to UTF-8",
-                        path.display()
-                    )
-                })?,
-                "HEAD",
-            ],
-        )
-        .await
-        .with_context(|| format!("failed to create git worktree at `{}`", path.display()))?;
-
-        if let Err(err) = ensure_codex_excluded(&repo_root).await {
-            warn!("failed to add codex worktree path to git exclude: {err:#}");
-        }
-
-        info!(
-            worktree = %path.display(),
-            "created git worktree for conversation"
-        );
-
-        Ok(Self { repo_root, path })
-    }
-
-    /// Absolute path to the worktree checkout on disk.
-    pub fn path(&self) -> &Path {
-        &self.path
-    }
-
-    /// Remove the worktree and prune metadata from the repository.
-    pub async fn remove(self) -> Result<()> {
-        let path = self.path.clone();
-
-        // `git worktree remove` fails if refs are missing or the checkout is dirty.
-        // Use --force to ensure best effort removal; the user explicitly requested it.
-        run_git_command(
-            &self.repo_root,
-            [
-                "worktree",
-                "remove",
-                "--force",
-                path.to_str().ok_or_else(|| {
-                    anyhow!(
-                        "failed to convert worktree path `{}` to UTF-8",
-                        path.display()
-                    )
-                })?,
-            ],
-        )
-        .await
-        .with_context(|| format!("failed to remove git worktree `{}`", path.display()))?;
-
-        // Prune dangling metadata so repeated sessions do not accumulate entries.
-        if let Err(err) =
-            run_git_command(&self.repo_root, ["worktree", "prune", "--expire", "now"]).await
-        {
-            warn!("failed to prune git worktrees: {err:#}");
-        }
-
-        Ok(())
-    }
-}
-
-async fn worktree_registered(repo_root: &Path, target: &Path) -> Result<bool> {
-    let output = run_git_command(repo_root, ["worktree", "list", "--porcelain"]).await?;
-    let stdout = String::from_utf8(output.stdout)?;
-
-    let target_canon = std_fs::canonicalize(target).unwrap_or_else(|_| target.to_path_buf());
-
-    for line in stdout.lines() {
-        if let Some(path) = line.strip_prefix("worktree ") {
-            let candidate = Path::new(path);
-            let candidate_canon =
-                std_fs::canonicalize(candidate).unwrap_or_else(|_| candidate.to_path_buf());
-            if candidate_canon == target_canon {
-                return Ok(true);
-            }
-        }
-    }
-    Ok(false)
-}
-
-async fn run_git_command<'a>(
-    repo_root: &Path,
-    args: impl IntoIterator<Item = &'a str>,
-) -> Result<std::process::Output> {
-    let mut cmd = Command::new("git");
-    cmd.args(args);
-    cmd.current_dir(repo_root);
-    let output = cmd
-        .output()
-        .await
-        .with_context(|| format!("failed to execute git command in `{}`", repo_root.display()))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-        let status = output
-            .status
-            .code()
-            .map(|c| c.to_string())
-            .unwrap_or_else(|| "signal".to_string());
-        return Err(anyhow!("git command exited with status {status}: {stderr}",));
-    }
-
-    Ok(output)
-}
-
-async fn ensure_codex_excluded(repo_root: &Path) -> Result<()> {
-    const PATTERN: &str = "/codex/";
-
-    let git_dir_out = run_git_command(repo_root, ["rev-parse", "--git-dir"]).await?;
-    let git_dir_str = String::from_utf8(git_dir_out.stdout)?.trim().to_string();
-    let git_dir_path = if Path::new(&git_dir_str).is_absolute() {
-        PathBuf::from(&git_dir_str)
-    } else {
-        repo_root.join(&git_dir_str)
-    };
-
-    let info_dir = git_dir_path.join("info");
-    fs::create_dir_all(&info_dir).await?;
-    let exclude_path = info_dir.join("exclude");
-
-    let existing_bytes = fs::read(&exclude_path).await.unwrap_or_default();
-    let existing = String::from_utf8(existing_bytes).unwrap_or_default();
-    if existing.lines().any(|line| line.trim() == PATTERN) {
-        return Ok(());
-    }
-
-    let mut file = OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(&exclude_path)
-        .await?;
-
-    if !existing.is_empty() && !existing.ends_with('\n') {
-        file.write_all(b"\n").await?;
-    }
-    file.write_all(PATTERN.as_bytes()).await?;
-    file.write_all(b"\n").await?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use tempfile::TempDir;
-
-    const GIT_ENV: [(&str, &str); 2] = [
-        ("GIT_CONFIG_GLOBAL", "/dev/null"),
-        ("GIT_CONFIG_NOSYSTEM", "1"),
-    ];
-
-    async fn init_repo() -> (TempDir, PathBuf) {
-        let temp = TempDir::new().expect("tempdir");
-        let repo_path = temp.path().join("repo");
-        fs::create_dir_all(&repo_path)
-            .await
-            .expect("create repo dir");
-
-        run_git_with_env(&repo_path, ["init"], &GIT_ENV)
-            .await
-            .expect("git init");
-        run_git_with_env(&repo_path, ["config", "user.name", "Test User"], &GIT_ENV)
-            .await
-            .expect("config user.name");
-        run_git_with_env(
-            &repo_path,
-            ["config", "user.email", "test@example.com"],
-            &GIT_ENV,
-        )
-        .await
-        .expect("config user.email");
-
-        fs::write(repo_path.join("README.md"), b"hello world")
-            .await
-            .expect("write file");
-        run_git_with_env(&repo_path, ["add", "README.md"], &GIT_ENV)
-            .await
-            .expect("git add");
-        run_git_with_env(&repo_path, ["commit", "-m", "init"], &GIT_ENV)
-            .await
-            .expect("git commit");
-
-        (temp, repo_path)
-    }
-
-    async fn run_git_with_env<'a>(
-        cwd: &Path,
-        args: impl IntoIterator<Item = &'a str>,
-        envs: &[(&str, &str)],
-    ) -> Result<()> {
-        let mut cmd = Command::new("git");
-        cmd.args(args);
-        cmd.current_dir(cwd);
-        for (key, value) in envs {
-            cmd.env(key, value);
-        }
-        let status = cmd.status().await.context("failed to spawn git command")?;
-        if !status.success() {
-            return Err(anyhow!(
-                "git command exited with status {status} (cwd: {})",
-                cwd.display()
-            ));
-        }
-        Ok(())
-    }
-
-    async fn is_registered(repo_root: &Path, path: &Path) -> bool {
-        worktree_registered(repo_root, path).await.unwrap_or(false)
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn creates_and_removes_worktree() {
-        let (_temp, repo) = init_repo().await;
-        let conversation_id = ConversationId::new();
-
-        let handle = WorktreeHandle::create(&repo, &conversation_id)
-            .await
-            .expect("create worktree");
-        let path = handle.path().to_path_buf();
-        assert!(path.exists(), "worktree path should exist on disk");
-        assert!(
-            is_registered(&repo, &path).await,
-            "worktree should be registered"
-        );
-
-        handle.remove().await.expect("remove worktree");
-        assert!(
-            !is_registered(&repo, &path).await,
-            "worktree should be removed from registration"
-        );
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn reuses_existing_worktree() {
-        let (_temp, repo) = init_repo().await;
-        let conversation_id = ConversationId::new();
-
-        let first = WorktreeHandle::create(&repo, &conversation_id)
-            .await
-            .expect("create worktree");
-        let path = first.path().to_path_buf();
-        drop(first);
-
-        let second = WorktreeHandle::create(&repo, &conversation_id)
-            .await
-            .expect("reuse worktree");
-        assert_eq!(path, second.path());
-        assert!(is_registered(&repo, second.path()).await);
-
-        second.remove().await.expect("remove worktree");
-    }
-}
--- a/codex-rs/core/src/internal_storage.rs
+++ b/codex-rs/core/src/internal_storage.rs
@@ -0,0 +1,89 @@
+use anyhow::Context;
+use serde::Deserialize;
+use serde::Serialize;
+use std::io::ErrorKind;
+use std::path::Path;
+use std::path::PathBuf;
+
+pub(crate) const INTERNAL_STORAGE_FILE: &str = "internal_storage.json";
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct InternalStorage {
+    #[serde(skip)]
+    storage_path: PathBuf,
+    #[serde(default = "default_gpt_5_codex_model_prompt_seen")]
+    pub gpt_5_codex_model_prompt_seen: bool,
+}
+
+const fn default_gpt_5_codex_model_prompt_seen() -> bool {
+    true
+}
+
+impl Default for InternalStorage {
+    fn default() -> Self {
+        Self {
+            storage_path: PathBuf::new(),
+            gpt_5_codex_model_prompt_seen: default_gpt_5_codex_model_prompt_seen(),
+        }
+    }
+}
+
+// TODO(jif) generalise all the file writers and build proper async channel inserters.
+impl InternalStorage {
+    pub fn load(codex_home: &Path) -> Self {
+        let storage_path = codex_home.join(INTERNAL_STORAGE_FILE);
+
+        match std::fs::read_to_string(&storage_path) {
+            Ok(serialized) => match serde_json::from_str::<Self>(&serialized) {
+                Ok(mut storage) => {
+                    storage.storage_path = storage_path;
+                    storage
+                }
+                Err(error) => {
+                    tracing::warn!("failed to parse internal storage: {error:?}");
+                    Self::empty(storage_path)
+                }
+            },
+            Err(error) => {
+                if error.kind() == ErrorKind::NotFound {
+                    tracing::debug!(
+                        "internal storage not found at {}; initializing defaults",
+                        storage_path.display()
+                    );
+                } else {
+                    tracing::warn!("failed to read internal storage: {error:?}");
+                }
+                Self::empty(storage_path)
+            }
+        }
+    }
+
+    fn empty(storage_path: PathBuf) -> Self {
+        Self {
+            storage_path,
+            ..Default::default()
+        }
+    }
+
+    pub async fn persist(&self) -> anyhow::Result<()> {
+        let serialized = serde_json::to_string_pretty(self)?;
+
+        if let Some(parent) = self.storage_path.parent() {
+            tokio::fs::create_dir_all(parent).await.with_context(|| {
+                format!(
+                    "failed to create internal storage directory at {}",
+                    parent.display()
+                )
+            })?;
+        }
+
+        tokio::fs::write(&self.storage_path, serialized)
+            .await
+            .with_context(|| {
+                format!(
+                    "failed to persist internal storage at {}",
+                    self.storage_path.display()
+                )
+            })
+    }
+}
--- a/codex-rs/core/src/command_safety/is_safe_command.rs
+++ b/codex-rs/core/src/command_safety/is_safe_command.rs
@@ -1,14 +1,7 @@
-use crate::bash::parse_bash_lc_plain_commands;
+use crate::bash::try_parse_bash;
+use crate::bash::try_parse_word_only_commands_sequence;

 pub fn is_known_safe_command(command: &[String]) -> bool {
-    #[cfg(target_os = "windows")]
-    {
-        use super::windows_safe_commands::is_safe_command_windows;
-        if is_safe_command_windows(command) {
-            return true;
-        }
-    }
-
    if is_safe_to_call_with_exec(command) {
        return true;
    }
@@ -19,7 +12,11 @@ pub fn is_known_safe_command(command: &[String]) -> bool {
    // introduce side effects ( "&&", "||", ";", and "|" ). If every
    // individual command in the script is itself a known‑safe command, then
    // the composite expression is considered safe.
-    if let Some(all_commands) = parse_bash_lc_plain_commands(command)
+    if let [bash, flag, script] = command
+        && bash == "bash"
+        && flag == "-lc"
+        && let Some(tree) = try_parse_bash(script)
+        && let Some(all_commands) = try_parse_word_only_commands_sequence(&tree, script)
        && !all_commands.is_empty()
        && all_commands
            .iter()
@@ -27,6 +24,7 @@ pub fn is_known_safe_command(command: &[String]) -> bool {
    {
        return true;
    }
+
    false
 }

--- a/codex-rs/core/src/lib.rs
+++ b/codex-rs/core/src/lib.rs
@@ -15,7 +15,6 @@ pub mod codex;
 mod codex_conversation;
 pub mod token_data;
 pub use codex_conversation::CodexConversation;
-mod command_safety;
 pub mod config;
 pub mod config_edit;
 pub mod config_profile;
@@ -29,7 +28,8 @@ mod exec_command;
 pub mod exec_env;
 mod flags;
 pub mod git_info;
-mod git_worktree;
+pub mod internal_storage;
+mod is_safe_command;
 pub mod landlock;
 mod mcp_connection_manager;
 mod mcp_tool_call;
@@ -75,14 +75,10 @@ pub use rollout::find_conversation_path_by_id_str;
 pub use rollout::list::ConversationItem;
 pub use rollout::list::ConversationsPage;
 pub use rollout::list::Cursor;
-mod function_tool;
-mod state;
-mod tasks;
 mod user_notification;
 pub mod util;

 pub use apply_patch::CODEX_APPLY_PATCH_ARG1;
-pub use command_safety::is_safe_command;
 pub use safety::get_platform_sandbox;
 // Re-export the protocol types from the standalone `codex-protocol` crate so existing
 // `codex_core::protocol::...` references continue to work across the workspace.
--- a/codex-rs/core/src/mcp_connection_manager.rs
+++ b/codex-rs/core/src/mcp_connection_manager.rs
@@ -16,7 +16,6 @@ use anyhow::Context;
 use anyhow::Result;
 use anyhow::anyhow;
 use codex_mcp_client::McpClient;
-use codex_rmcp_client::RmcpClient;
 use mcp_types::ClientCapabilities;
 use mcp_types::Implementation;
 use mcp_types::Tool;
@@ -29,7 +28,6 @@ use tracing::info;
 use tracing::warn;

 use crate::config_types::McpServerConfig;
-use crate::config_types::McpServerTransportConfig;

 /// Delimiter used to separate the server name from the tool name in a fully
 /// qualified tool name.
@@ -88,75 +86,11 @@ struct ToolInfo {
 }

 struct ManagedClient {
-    client: McpClientAdapter,
+    client: Arc<McpClient>,
    startup_timeout: Duration,
    tool_timeout: Option<Duration>,
 }

-#[derive(Clone)]
-enum McpClientAdapter {
-    Legacy(Arc<McpClient>),
-    Rmcp(Arc<RmcpClient>),
-}
-
-impl McpClientAdapter {
-    async fn new_stdio_client(
-        use_rmcp_client: bool,
-        program: OsString,
-        args: Vec<OsString>,
-        env: Option<HashMap<String, String>>,
-        params: mcp_types::InitializeRequestParams,
-        startup_timeout: Duration,
-    ) -> Result<Self> {
-        info!(
-            "new_stdio_client use_rmcp_client: {use_rmcp_client} program: {program:?} args: {args:?} env: {env:?} params: {params:?} startup_timeout: {startup_timeout:?}"
-        );
-        if use_rmcp_client {
-            let client = Arc::new(RmcpClient::new_stdio_client(program, args, env).await?);
-            client.initialize(params, Some(startup_timeout)).await?;
-            Ok(McpClientAdapter::Rmcp(client))
-        } else {
-            let client = Arc::new(McpClient::new_stdio_client(program, args, env).await?);
-            client.initialize(params, Some(startup_timeout)).await?;
-            Ok(McpClientAdapter::Legacy(client))
-        }
-    }
-
-    async fn new_streamable_http_client(
-        url: String,
-        bearer_token: Option<String>,
-        params: mcp_types::InitializeRequestParams,
-        startup_timeout: Duration,
-    ) -> Result<Self> {
-        let client = Arc::new(RmcpClient::new_streamable_http_client(url, bearer_token)?);
-        client.initialize(params, Some(startup_timeout)).await?;
-        Ok(McpClientAdapter::Rmcp(client))
-    }
-
-    async fn list_tools(
-        &self,
-        params: Option<mcp_types::ListToolsRequestParams>,
-        timeout: Option<Duration>,
-    ) -> Result<mcp_types::ListToolsResult> {
-        match self {
-            McpClientAdapter::Legacy(client) => client.list_tools(params, timeout).await,
-            McpClientAdapter::Rmcp(client) => client.list_tools(params, timeout).await,
-        }
-    }
-
-    async fn call_tool(
-        &self,
-        name: String,
-        arguments: Option<serde_json::Value>,
-        timeout: Option<Duration>,
-    ) -> Result<mcp_types::CallToolResult> {
-        match self {
-            McpClientAdapter::Legacy(client) => client.call_tool(name, arguments, timeout).await,
-            McpClientAdapter::Rmcp(client) => client.call_tool(name, arguments, timeout).await,
-        }
-    }
-}
-
 /// A thin wrapper around a set of running [`McpClient`] instances.
 #[derive(Default)]
 pub(crate) struct McpConnectionManager {
@@ -181,7 +115,6 @@ impl McpConnectionManager {
    /// user should be informed about these errors.
    pub async fn new(
        mcp_servers: HashMap<String, McpServerConfig>,
-        use_rmcp_client: bool,
    ) -> Result<(Self, ClientStartErrors)> {
        // Early exit if no servers are configured.
        if mcp_servers.is_empty() {
@@ -203,72 +136,58 @@ impl McpConnectionManager {
                continue;
            }

-            if matches!(
-                cfg.transport,
-                McpServerTransportConfig::StreamableHttp { .. }
-            ) && !use_rmcp_client
-            {
-                info!(
-                    "skipping MCP server `{}` configured with url because rmcp client is disabled",
-                    server_name
-                );
-                continue;
-            }
-
            let startup_timeout = cfg.startup_timeout_sec.unwrap_or(DEFAULT_STARTUP_TIMEOUT);
+
            let tool_timeout = cfg.tool_timeout_sec.unwrap_or(DEFAULT_TOOL_TIMEOUT);

-            let use_rmcp_client_flag = use_rmcp_client;
            join_set.spawn(async move {
-                let McpServerConfig { transport, .. } = cfg;
-                let params = mcp_types::InitializeRequestParams {
-                    capabilities: ClientCapabilities {
-                        experimental: None,
-                        roots: None,
-                        sampling: None,
-                        // https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation#capabilities
-                        // indicates this should be an empty object.
-                        elicitation: Some(json!({})),
-                    },
-                    client_info: Implementation {
-                        name: "codex-mcp-client".to_owned(),
-                        version: env!("CARGO_PKG_VERSION").to_owned(),
-                        title: Some("Codex".into()),
-                        // This field is used by Codex when it is an MCP
-                        // server: it should not be used when Codex is
-                        // an MCP client.
-                        user_agent: None,
-                    },
-                    protocol_version: mcp_types::MCP_SCHEMA_VERSION.to_owned(),
-                };
-
-                let client = match transport {
-                    McpServerTransportConfig::Stdio { command, args, env } => {
-                        let command_os: OsString = command.into();
-                        let args_os: Vec<OsString> = args.into_iter().map(Into::into).collect();
-                        McpClientAdapter::new_stdio_client(
-                            use_rmcp_client_flag,
-                            command_os,
-                            args_os,
-                            env,
-                            params.clone(),
-                            startup_timeout,
+                let McpServerConfig {
+                    command, args, env, ..
+                } = cfg;
+                let client_res = McpClient::new_stdio_client(
+                    command.into(),
+                    args.into_iter().map(OsString::from).collect(),
+                    env,
+                )
+                .await;
+                match client_res {
+                    Ok(client) => {
+                        // Initialize the client.
+                        let params = mcp_types::InitializeRequestParams {
+                            capabilities: ClientCapabilities {
+                                experimental: None,
+                                roots: None,
+                                sampling: None,
+                                // https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation#capabilities
+                                // indicates this should be an empty object.
+                                elicitation: Some(json!({})),
+                            },
+                            client_info: Implementation {
+                                name: "codex-mcp-client".to_owned(),
+                                version: env!("CARGO_PKG_VERSION").to_owned(),
+                                title: Some("Codex".into()),
+                                // This field is used by Codex when it is an MCP
+                                // server: it should not be used when Codex is
+                                // an MCP client.
+                                user_agent: None,
+                            },
+                            protocol_version: mcp_types::MCP_SCHEMA_VERSION.to_owned(),
+                        };
+                        let initialize_notification_params = None;
+                        let init_result = client
+                            .initialize(
+                                params,
+                                initialize_notification_params,
+                                Some(startup_timeout),
+                            )
+                            .await;
+                        (
+                            (server_name, tool_timeout),
+                            init_result.map(|_| (client, startup_timeout)),
                        )
-                        .await
-                    }
-                    McpServerTransportConfig::StreamableHttp { url, bearer_token } => {
-                        McpClientAdapter::new_streamable_http_client(
-                            url,
-                            bearer_token,
-                            params,
-                            startup_timeout,
-                        )
-                        .await
                    }
+                    Err(e) => ((server_name, tool_timeout), Err(e.into())),
                }
-                .map(|c| (c, startup_timeout));
-
-                ((server_name, tool_timeout), client)
            });
        }

@@ -288,7 +207,7 @@ impl McpConnectionManager {
                    clients.insert(
                        server_name,
                        ManagedClient {
-                            client,
+                            client: Arc::new(client),
                            startup_timeout,
                            tool_timeout: Some(tool_timeout),
                        },
--- a/codex-rs/core/src/openai_model_info.rs
+++ b/codex-rs/core/src/openai_model_info.rs
@@ -7,14 +7,13 @@ use crate::model_family::ModelFamily;
 /// Though this would help present more accurate pricing information in the UI.
 #[derive(Debug)]
 pub(crate) struct ModelInfo {
-    /// Size of the context window in tokens. This is the maximum size of the input context.
+    /// Size of the context window in tokens.
    pub(crate) context_window: u64,

    /// Maximum number of output tokens that can be generated for the model.
    pub(crate) max_output_tokens: u64,

-    /// Token threshold where we should automatically compact conversation history. This considers
-    /// input tokens + output tokens of this turn.
+    /// Token threshold where we should automatically compact conversation history.
    pub(crate) auto_compact_token_limit: Option<i64>,
 }

@@ -65,7 +64,7 @@ pub(crate) fn get_model_info(model_family: &ModelFamily) -> Option<ModelInfo> {
        _ if slug.starts_with("gpt-5-codex") => Some(ModelInfo {
            context_window: 272_000,
            max_output_tokens: 128_000,
-            auto_compact_token_limit: Some(350_000),
+            auto_compact_token_limit: Some(220_000),
        }),

        _ if slug.starts_with("gpt-5") => Some(ModelInfo::new(272_000, 128_000)),
--- a/codex-rs/core/src/plan_tool.rs
+++ b/codex-rs/core/src/plan_tool.rs
@@ -2,12 +2,13 @@ use std::collections::BTreeMap;
 use std::sync::LazyLock;

 use crate::codex::Session;
-use crate::function_tool::FunctionCallError;
 use crate::openai_tools::JsonSchema;
 use crate::openai_tools::OpenAiTool;
 use crate::openai_tools::ResponsesApiTool;
 use crate::protocol::Event;
 use crate::protocol::EventMsg;
+use codex_protocol::models::FunctionCallOutputPayload;
+use codex_protocol::models::ResponseInputItem;

 // Use the canonical plan tool types from the protocol crate to ensure
 // type-identity matches events transported via `codex_protocol`.
@@ -66,20 +67,44 @@ pub(crate) async fn handle_update_plan(
    session: &Session,
    arguments: String,
    sub_id: String,
-    _call_id: String,
-) -> Result<String, FunctionCallError> {
-    let args = parse_update_plan_arguments(&arguments)?;
-    session
-        .send_event(Event {
-            id: sub_id.to_string(),
-            msg: EventMsg::PlanUpdate(args),
-        })
-        .await;
-    Ok("Plan updated".to_string())
+    call_id: String,
+) -> ResponseInputItem {
+    match parse_update_plan_arguments(arguments, &call_id) {
+        Ok(args) => {
+            let output = ResponseInputItem::FunctionCallOutput {
+                call_id,
+                output: FunctionCallOutputPayload {
+                    content: "Plan updated".to_string(),
+                    success: Some(true),
+                },
+            };
+            session
+                .send_event(Event {
+                    id: sub_id.to_string(),
+                    msg: EventMsg::PlanUpdate(args),
+                })
+                .await;
+            output
+        }
+        Err(output) => *output,
+    }
 }

-fn parse_update_plan_arguments(arguments: &str) -> Result<UpdatePlanArgs, FunctionCallError> {
-    serde_json::from_str::<UpdatePlanArgs>(arguments).map_err(|e| {
-        FunctionCallError::RespondToModel(format!("failed to parse function arguments: {e}"))
-    })
+fn parse_update_plan_arguments(
+    arguments: String,
+    call_id: &str,
+) -> Result<UpdatePlanArgs, Box<ResponseInputItem>> {
+    match serde_json::from_str::<UpdatePlanArgs>(&arguments) {
+        Ok(args) => Ok(args),
+        Err(e) => {
+            let output = ResponseInputItem::FunctionCallOutput {
+                call_id: call_id.to_string(),
+                output: FunctionCallOutputPayload {
+                    content: format!("failed to parse function arguments: {e}"),
+                    success: None,
+                },
+            };
+            Err(Box::new(output))
+        }
+    }
 }
--- a/codex-rs/core/src/rollout/policy.rs
+++ b/codex-rs/core/src/rollout/policy.rs
@@ -70,7 +70,6 @@ pub(crate) fn should_persist_event_msg(ev: &EventMsg) -> bool {
        | EventMsg::ListCustomPromptsResponse(_)
        | EventMsg::PlanUpdate(_)
        | EventMsg::ShutdownComplete
-        | EventMsg::ConversationPath(_)
-        | EventMsg::WorktreeRemoved(_) => false,
+        | EventMsg::ConversationPath(_) => false,
    }
 }
--- a/codex-rs/core/src/rollout/recorder.rs
+++ b/codex-rs/core/src/rollout/recorder.rs
@@ -7,6 +7,8 @@ use std::path::Path;
 use std::path::PathBuf;

 use codex_protocol::mcp_protocol::ConversationId;
+use serde::Deserialize;
+use serde::Serialize;
 use serde_json::Value;
 use time::OffsetDateTime;
 use time::format_description::FormatItem;
@@ -26,6 +28,7 @@ use super::policy::is_persisted_response_item;
 use crate::config::Config;
 use crate::default_client::ORIGINATOR;
 use crate::git_info::collect_git_info;
+use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::InitialHistory;
 use codex_protocol::protocol::ResumedHistory;
 use codex_protocol::protocol::RolloutItem;
@@ -33,6 +36,19 @@ use codex_protocol::protocol::RolloutLine;
 use codex_protocol::protocol::SessionMeta;
 use codex_protocol::protocol::SessionMetaLine;

+#[derive(Serialize, Deserialize, Default, Clone)]
+pub struct SessionStateSnapshot {}
+
+#[derive(Serialize, Deserialize, Default, Clone)]
+pub struct SavedSession {
+    pub session: SessionMeta,
+    #[serde(default)]
+    pub items: Vec<ResponseItem>,
+    #[serde(default)]
+    pub state: SessionStateSnapshot,
+    pub session_id: ConversationId,
+}
+
 /// Records all [`ResponseItem`]s for a session and flushes them to disk after
 /// every update.
 ///
--- a/codex-rs/core/src/safety.rs
+++ b/codex-rs/core/src/safety.rs
@@ -7,9 +7,7 @@ use codex_apply_patch::ApplyPatchAction;
 use codex_apply_patch::ApplyPatchFileChange;

 use crate::exec::SandboxType;
-
-use crate::command_safety::is_dangerous_command::command_might_be_dangerous;
-use crate::command_safety::is_safe_command::is_known_safe_command;
+use crate::is_safe_command::is_known_safe_command;
 use crate::protocol::AskForApproval;
 use crate::protocol::SandboxPolicy;

@@ -87,20 +85,6 @@ pub fn assess_command_safety(
    approved: &HashSet<Vec<String>>,
    with_escalated_permissions: bool,
 ) -> SafetyCheck {
-    // Some commands look dangerous. Even if they are run inside a sandbox,
-    // unless the user has explicitly approved them, we should ask,
-    // or reject if the approval_policy tells us not to ask.
-    if command_might_be_dangerous(command) && !approved.contains(command) {
-        if approval_policy == AskForApproval::Never {
-            return SafetyCheck::Reject {
-                reason: "dangerous command detected; rejected by user approval settings"
-                    .to_string(),
-            };
-        }
-
-        return SafetyCheck::AskUser;
-    }
-
    // A command is "trusted" because either:
    // - it belongs to a set of commands we consider "safe" by default, or
    // - the user has explicitly approved the command for this session
@@ -114,7 +98,6 @@ pub fn assess_command_safety(
    // would probably be fine to run the command in a sandbox, but when
    // `approved.contains(command)` is `true`, the user may have approved it for
    // the session _because_ they know it needs to run outside a sandbox.
-
    if is_known_safe_command(command) || approved.contains(command) {
        return SafetyCheck::AutoApprove {
            sandbox_type: SandboxType::None,
@@ -342,56 +325,6 @@ mod tests {
        assert_eq!(safety_check, SafetyCheck::AskUser);
    }

-    #[test]
-    fn dangerous_command_allowed_if_explicitly_approved() {
-        let command = vec!["git".to_string(), "reset".to_string(), "--hard".to_string()];
-        let approval_policy = AskForApproval::OnRequest;
-        let sandbox_policy = SandboxPolicy::ReadOnly;
-        let mut approved: HashSet<Vec<String>> = HashSet::new();
-        approved.insert(command.clone());
-        let request_escalated_privileges = false;
-
-        let safety_check = assess_command_safety(
-            &command,
-            approval_policy,
-            &sandbox_policy,
-            &approved,
-            request_escalated_privileges,
-        );
-
-        assert_eq!(
-            safety_check,
-            SafetyCheck::AutoApprove {
-                sandbox_type: SandboxType::None
-            }
-        );
-    }
-
-    #[test]
-    fn dangerous_command_not_allowed_if_not_explicitly_approved() {
-        let command = vec!["git".to_string(), "reset".to_string(), "--hard".to_string()];
-        let approval_policy = AskForApproval::Never;
-        let sandbox_policy = SandboxPolicy::ReadOnly;
-        let approved: HashSet<Vec<String>> = HashSet::new();
-        let request_escalated_privileges = false;
-
-        let safety_check = assess_command_safety(
-            &command,
-            approval_policy,
-            &sandbox_policy,
-            &approved,
-            request_escalated_privileges,
-        );
-
-        assert_eq!(
-            safety_check,
-            SafetyCheck::Reject {
-                reason: "dangerous command detected; rejected by user approval settings"
-                    .to_string(),
-            }
-        );
-    }
-
    #[test]
    fn test_request_escalated_privileges_no_sandbox_fallback() {
        let command = vec!["git".to_string(), "commit".to_string()];
--- a/codex-rs/core/src/state/mod.rs
+++ b/codex-rs/core/src/state/mod.rs
@@ -1,9 +0,0 @@
-mod service;
-mod session;
-mod turn;
-
-pub(crate) use service::SessionServices;
-pub(crate) use session::SessionState;
-pub(crate) use turn::ActiveTurn;
-pub(crate) use turn::RunningTask;
-pub(crate) use turn::TaskKind;
--- a/codex-rs/core/src/state/service.rs
+++ b/codex-rs/core/src/state/service.rs
@@ -1,20 +0,0 @@
-use crate::RolloutRecorder;
-use crate::exec_command::ExecSessionManager;
-use crate::git_worktree::WorktreeHandle;
-use crate::mcp_connection_manager::McpConnectionManager;
-use crate::unified_exec::UnifiedExecSessionManager;
-use crate::user_notification::UserNotifier;
-use std::path::PathBuf;
-use tokio::sync::Mutex;
-
-pub(crate) struct SessionServices {
-    pub(crate) mcp_connection_manager: McpConnectionManager,
-    pub(crate) session_manager: ExecSessionManager,
-    pub(crate) unified_exec_manager: UnifiedExecSessionManager,
-    pub(crate) notifier: UserNotifier,
-    pub(crate) rollout: Mutex<Option<RolloutRecorder>>,
-    pub(crate) worktree: Mutex<Option<WorktreeHandle>>,
-    pub(crate) codex_linux_sandbox_exe: Option<PathBuf>,
-    pub(crate) user_shell: crate::shell::Shell,
-    pub(crate) show_raw_agent_reasoning: bool,
-}
--- a/codex-rs/core/src/state/session.rs
+++ b/codex-rs/core/src/state/session.rs
@@ -1,80 +0,0 @@
-//! Session-wide mutable state.
-
-use std::collections::HashSet;
-
-use codex_protocol::models::ResponseItem;
-
-use crate::conversation_history::ConversationHistory;
-use crate::protocol::RateLimitSnapshot;
-use crate::protocol::TokenUsage;
-use crate::protocol::TokenUsageInfo;
-
-/// Persistent, session-scoped state previously stored directly on `Session`.
-#[derive(Default)]
-pub(crate) struct SessionState {
-    pub(crate) approved_commands: HashSet<Vec<String>>,
-    pub(crate) history: ConversationHistory,
-    pub(crate) token_info: Option<TokenUsageInfo>,
-    pub(crate) latest_rate_limits: Option<RateLimitSnapshot>,
-}
-
-impl SessionState {
-    /// Create a new session state mirroring previous `State::default()` semantics.
-    pub(crate) fn new() -> Self {
-        Self {
-            history: ConversationHistory::new(),
-            ..Default::default()
-        }
-    }
-
-    // History helpers
-    pub(crate) fn record_items<I>(&mut self, items: I)
-    where
-        I: IntoIterator,
-        I::Item: std::ops::Deref<Target = ResponseItem>,
-    {
-        self.history.record_items(items)
-    }
-
-    pub(crate) fn history_snapshot(&self) -> Vec<ResponseItem> {
-        self.history.contents()
-    }
-
-    pub(crate) fn replace_history(&mut self, items: Vec<ResponseItem>) {
-        self.history.replace(items);
-    }
-
-    // Approved command helpers
-    pub(crate) fn add_approved_command(&mut self, cmd: Vec<String>) {
-        self.approved_commands.insert(cmd);
-    }
-
-    pub(crate) fn approved_commands_ref(&self) -> &HashSet<Vec<String>> {
-        &self.approved_commands
-    }
-
-    // Token/rate limit helpers
-    pub(crate) fn update_token_info_from_usage(
-        &mut self,
-        usage: &TokenUsage,
-        model_context_window: Option<u64>,
-    ) {
-        self.token_info = TokenUsageInfo::new_or_append(
-            &self.token_info,
-            &Some(usage.clone()),
-            model_context_window,
-        );
-    }
-
-    pub(crate) fn set_rate_limits(&mut self, snapshot: RateLimitSnapshot) {
-        self.latest_rate_limits = Some(snapshot);
-    }
-
-    pub(crate) fn token_info_and_rate_limits(
-        &self,
-    ) -> (Option<TokenUsageInfo>, Option<RateLimitSnapshot>) {
-        (self.token_info.clone(), self.latest_rate_limits.clone())
-    }
-
-    // Pending input/approval moved to TurnState.
-}
--- a/codex-rs/core/src/state/turn.rs
+++ b/codex-rs/core/src/state/turn.rs
@@ -1,115 +0,0 @@
-//! Turn-scoped state and active turn metadata scaffolding.
-
-use indexmap::IndexMap;
-use std::collections::HashMap;
-use std::sync::Arc;
-use tokio::sync::Mutex;
-use tokio::task::AbortHandle;
-
-use codex_protocol::models::ResponseInputItem;
-use tokio::sync::oneshot;
-
-use crate::protocol::ReviewDecision;
-use crate::tasks::SessionTask;
-
-/// Metadata about the currently running turn.
-pub(crate) struct ActiveTurn {
-    pub(crate) tasks: IndexMap<String, RunningTask>,
-    pub(crate) turn_state: Arc<Mutex<TurnState>>,
-}
-
-impl Default for ActiveTurn {
-    fn default() -> Self {
-        Self {
-            tasks: IndexMap::new(),
-            turn_state: Arc::new(Mutex::new(TurnState::default())),
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(crate) enum TaskKind {
-    Regular,
-    Review,
-    Compact,
-}
-
-#[derive(Clone)]
-pub(crate) struct RunningTask {
-    pub(crate) handle: AbortHandle,
-    pub(crate) kind: TaskKind,
-    pub(crate) task: Arc<dyn SessionTask>,
-}
-
-impl ActiveTurn {
-    pub(crate) fn add_task(&mut self, sub_id: String, task: RunningTask) {
-        self.tasks.insert(sub_id, task);
-    }
-
-    pub(crate) fn remove_task(&mut self, sub_id: &str) -> bool {
-        self.tasks.swap_remove(sub_id);
-        self.tasks.is_empty()
-    }
-
-    pub(crate) fn drain_tasks(&mut self) -> IndexMap<String, RunningTask> {
-        std::mem::take(&mut self.tasks)
-    }
-}
-
-/// Mutable state for a single turn.
-#[derive(Default)]
-pub(crate) struct TurnState {
-    pending_approvals: HashMap<String, oneshot::Sender<ReviewDecision>>,
-    pending_input: Vec<ResponseInputItem>,
-}
-
-impl TurnState {
-    pub(crate) fn insert_pending_approval(
-        &mut self,
-        key: String,
-        tx: oneshot::Sender<ReviewDecision>,
-    ) -> Option<oneshot::Sender<ReviewDecision>> {
-        self.pending_approvals.insert(key, tx)
-    }
-
-    pub(crate) fn remove_pending_approval(
-        &mut self,
-        key: &str,
-    ) -> Option<oneshot::Sender<ReviewDecision>> {
-        self.pending_approvals.remove(key)
-    }
-
-    pub(crate) fn clear_pending(&mut self) {
-        self.pending_approvals.clear();
-        self.pending_input.clear();
-    }
-
-    pub(crate) fn push_pending_input(&mut self, input: ResponseInputItem) {
-        self.pending_input.push(input);
-    }
-
-    pub(crate) fn take_pending_input(&mut self) -> Vec<ResponseInputItem> {
-        if self.pending_input.is_empty() {
-            Vec::with_capacity(0)
-        } else {
-            let mut ret = Vec::new();
-            std::mem::swap(&mut ret, &mut self.pending_input);
-            ret
-        }
-    }
-}
-
-impl ActiveTurn {
-    /// Clear any pending approvals and input buffered for the current turn.
-    pub(crate) async fn clear_pending(&self) {
-        let mut ts = self.turn_state.lock().await;
-        ts.clear_pending();
-    }
-
-    /// Best-effort, non-blocking variant for synchronous contexts (Drop/interrupt).
-    pub(crate) fn try_clear_pending_sync(&self) {
-        if let Ok(mut ts) = self.turn_state.try_lock() {
-            ts.clear_pending();
-        }
-    }
-}
--- a/codex-rs/core/src/tasks/compact.rs
+++ b/codex-rs/core/src/tasks/compact.rs
@@ -1,31 +0,0 @@
-use std::sync::Arc;
-
-use async_trait::async_trait;
-
-use crate::codex::TurnContext;
-use crate::codex::compact;
-use crate::protocol::InputItem;
-use crate::state::TaskKind;
-
-use super::SessionTask;
-use super::SessionTaskContext;
-
-#[derive(Clone, Copy, Default)]
-pub(crate) struct CompactTask;
-
-#[async_trait]
-impl SessionTask for CompactTask {
-    fn kind(&self) -> TaskKind {
-        TaskKind::Compact
-    }
-
-    async fn run(
-        self: Arc<Self>,
-        session: Arc<SessionTaskContext>,
-        ctx: Arc<TurnContext>,
-        sub_id: String,
-        input: Vec<InputItem>,
-    ) -> Option<String> {
-        compact::run_compact_task(session.clone_session(), ctx, sub_id, input).await
-    }
-}
--- a/codex-rs/core/src/tasks/mod.rs
+++ b/codex-rs/core/src/tasks/mod.rs
@@ -1,166 +0,0 @@
-mod compact;
-mod regular;
-mod review;
-
-use std::sync::Arc;
-
-use async_trait::async_trait;
-use tracing::trace;
-
-use crate::codex::Session;
-use crate::codex::TurnContext;
-use crate::protocol::Event;
-use crate::protocol::EventMsg;
-use crate::protocol::InputItem;
-use crate::protocol::TaskCompleteEvent;
-use crate::protocol::TurnAbortReason;
-use crate::protocol::TurnAbortedEvent;
-use crate::state::ActiveTurn;
-use crate::state::RunningTask;
-use crate::state::TaskKind;
-
-pub(crate) use compact::CompactTask;
-pub(crate) use regular::RegularTask;
-pub(crate) use review::ReviewTask;
-
-/// Thin wrapper that exposes the parts of [`Session`] task runners need.
-#[derive(Clone)]
-pub(crate) struct SessionTaskContext {
-    session: Arc<Session>,
-}
-
-impl SessionTaskContext {
-    pub(crate) fn new(session: Arc<Session>) -> Self {
-        Self { session }
-    }
-
-    pub(crate) fn clone_session(&self) -> Arc<Session> {
-        Arc::clone(&self.session)
-    }
-}
-
-#[async_trait]
-pub(crate) trait SessionTask: Send + Sync + 'static {
-    fn kind(&self) -> TaskKind;
-
-    async fn run(
-        self: Arc<Self>,
-        session: Arc<SessionTaskContext>,
-        ctx: Arc<TurnContext>,
-        sub_id: String,
-        input: Vec<InputItem>,
-    ) -> Option<String>;
-
-    async fn abort(&self, session: Arc<SessionTaskContext>, sub_id: &str) {
-        let _ = (session, sub_id);
-    }
-}
-
-impl Session {
-    pub async fn spawn_task<T: SessionTask>(
-        self: &Arc<Self>,
-        turn_context: Arc<TurnContext>,
-        sub_id: String,
-        input: Vec<InputItem>,
-        task: T,
-    ) {
-        self.abort_all_tasks(TurnAbortReason::Replaced).await;
-
-        let task: Arc<dyn SessionTask> = Arc::new(task);
-        let task_kind = task.kind();
-
-        let handle = {
-            let session_ctx = Arc::new(SessionTaskContext::new(Arc::clone(self)));
-            let ctx = Arc::clone(&turn_context);
-            let task_for_run = Arc::clone(&task);
-            let sub_clone = sub_id.clone();
-            tokio::spawn(async move {
-                let last_agent_message = task_for_run
-                    .run(Arc::clone(&session_ctx), ctx, sub_clone.clone(), input)
-                    .await;
-                // Emit completion uniformly from spawn site so all tasks share the same lifecycle.
-                let sess = session_ctx.clone_session();
-                sess.on_task_finished(sub_clone, last_agent_message).await;
-            })
-            .abort_handle()
-        };
-
-        let running_task = RunningTask {
-            handle,
-            kind: task_kind,
-            task,
-        };
-        self.register_new_active_task(sub_id, running_task).await;
-    }
-
-    pub async fn abort_all_tasks(self: &Arc<Self>, reason: TurnAbortReason) {
-        for (sub_id, task) in self.take_all_running_tasks().await {
-            self.handle_task_abort(sub_id, task, reason.clone()).await;
-        }
-    }
-
-    pub async fn on_task_finished(
-        self: &Arc<Self>,
-        sub_id: String,
-        last_agent_message: Option<String>,
-    ) {
-        let mut active = self.active_turn.lock().await;
-        if let Some(at) = active.as_mut()
-            && at.remove_task(&sub_id)
-        {
-            *active = None;
-        }
-        drop(active);
-        let event = Event {
-            id: sub_id,
-            msg: EventMsg::TaskComplete(TaskCompleteEvent { last_agent_message }),
-        };
-        self.send_event(event).await;
-    }
-
-    async fn register_new_active_task(&self, sub_id: String, task: RunningTask) {
-        let mut active = self.active_turn.lock().await;
-        let mut turn = ActiveTurn::default();
-        turn.add_task(sub_id, task);
-        *active = Some(turn);
-    }
-
-    async fn take_all_running_tasks(&self) -> Vec<(String, RunningTask)> {
-        let mut active = self.active_turn.lock().await;
-        match active.take() {
-            Some(mut at) => {
-                at.clear_pending().await;
-                let tasks = at.drain_tasks();
-                tasks.into_iter().collect()
-            }
-            None => Vec::new(),
-        }
-    }
-
-    async fn handle_task_abort(
-        self: &Arc<Self>,
-        sub_id: String,
-        task: RunningTask,
-        reason: TurnAbortReason,
-    ) {
-        if task.handle.is_finished() {
-            return;
-        }
-
-        trace!(task_kind = ?task.kind, sub_id, "aborting running task");
-        let session_task = task.task;
-        let handle = task.handle;
-        handle.abort();
-        let session_ctx = Arc::new(SessionTaskContext::new(Arc::clone(self)));
-        session_task.abort(session_ctx, &sub_id).await;
-
-        let event = Event {
-            id: sub_id.clone(),
-            msg: EventMsg::TurnAborted(TurnAbortedEvent { reason }),
-        };
-        self.send_event(event).await;
-    }
-}
-
-#[cfg(test)]
-mod tests {}
--- a/codex-rs/core/src/tasks/regular.rs
+++ b/codex-rs/core/src/tasks/regular.rs
@@ -1,32 +0,0 @@
-use std::sync::Arc;
-
-use async_trait::async_trait;
-
-use crate::codex::TurnContext;
-use crate::codex::run_task;
-use crate::protocol::InputItem;
-use crate::state::TaskKind;
-
-use super::SessionTask;
-use super::SessionTaskContext;
-
-#[derive(Clone, Copy, Default)]
-pub(crate) struct RegularTask;
-
-#[async_trait]
-impl SessionTask for RegularTask {
-    fn kind(&self) -> TaskKind {
-        TaskKind::Regular
-    }
-
-    async fn run(
-        self: Arc<Self>,
-        session: Arc<SessionTaskContext>,
-        ctx: Arc<TurnContext>,
-        sub_id: String,
-        input: Vec<InputItem>,
-    ) -> Option<String> {
-        let sess = session.clone_session();
-        run_task(sess, ctx, sub_id, input).await
-    }
-}
--- a/codex-rs/core/src/tasks/review.rs
+++ b/codex-rs/core/src/tasks/review.rs
@@ -1,37 +0,0 @@
-use std::sync::Arc;
-
-use async_trait::async_trait;
-
-use crate::codex::TurnContext;
-use crate::codex::exit_review_mode;
-use crate::codex::run_task;
-use crate::protocol::InputItem;
-use crate::state::TaskKind;
-
-use super::SessionTask;
-use super::SessionTaskContext;
-
-#[derive(Clone, Copy, Default)]
-pub(crate) struct ReviewTask;
-
-#[async_trait]
-impl SessionTask for ReviewTask {
-    fn kind(&self) -> TaskKind {
-        TaskKind::Review
-    }
-
-    async fn run(
-        self: Arc<Self>,
-        session: Arc<SessionTaskContext>,
-        ctx: Arc<TurnContext>,
-        sub_id: String,
-        input: Vec<InputItem>,
-    ) -> Option<String> {
-        let sess = session.clone_session();
-        run_task(sess, ctx, sub_id, input).await
-    }
-
-    async fn abort(&self, session: Arc<SessionTaskContext>, sub_id: &str) {
-        exit_review_mode(session.clone_session(), sub_id.to_string(), None).await;
-    }
-}
--- a/codex-rs/core/src/tool_apply_patch.rs
+++ b/codex-rs/core/src/tool_apply_patch.rs
@@ -10,6 +10,11 @@ use crate::openai_tools::ResponsesApiTool;

 const APPLY_PATCH_LARK_GRAMMAR: &str = include_str!("tool_apply_patch.lark");

+#[derive(Serialize, Deserialize)]
+pub(crate) struct ApplyPatchToolArgs {
+    pub(crate) input: String,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
 #[serde(rename_all = "snake_case")]
 pub enum ApplyPatchToolType {
--- a/codex-rs/core/src/unified_exec/mod.rs
+++ b/codex-rs/core/src/unified_exec/mod.rs
@@ -404,8 +404,6 @@ async fn create_unified_exec_session(
 #[cfg(test)]
 mod tests {
    use super::*;
-    #[cfg(unix)]
-    use core_test_support::skip_if_sandbox;

    #[test]
    fn push_chunk_trims_only_excess_bytes() {
@@ -427,8 +425,6 @@ mod tests {
    #[cfg(unix)]
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn unified_exec_persists_across_requests_jif() -> Result<(), UnifiedExecError> {
-        skip_if_sandbox!(Ok(()));
-
        let manager = UnifiedExecSessionManager::default();

        let open_shell = manager
@@ -466,8 +462,6 @@ mod tests {
    #[cfg(unix)]
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn multi_unified_exec_sessions() -> Result<(), UnifiedExecError> {
-        skip_if_sandbox!(Ok(()));
-
        let manager = UnifiedExecSessionManager::default();

        let shell_a = manager
@@ -514,8 +508,6 @@ mod tests {
    #[cfg(unix)]
    #[tokio::test]
    async fn unified_exec_timeouts() -> Result<(), UnifiedExecError> {
-        skip_if_sandbox!(Ok(()));
-
        let manager = UnifiedExecSessionManager::default();

        let open_shell = manager
@@ -609,8 +601,6 @@ mod tests {
    #[cfg(unix)]
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn reusing_completed_session_returns_unknown_session() -> Result<(), UnifiedExecError> {
-        skip_if_sandbox!(Ok(()));
-
        let manager = UnifiedExecSessionManager::default();

        let open_shell = manager
--- a/codex-rs/core/tests/common/Cargo.toml
+++ b/codex-rs/core/tests/common/Cargo.toml
@@ -8,7 +8,6 @@ path = "lib.rs"

 [dependencies]
 anyhow = { workspace = true }
-assert_cmd = { workspace = true }
 codex-core = { workspace = true }
 serde_json = { workspace = true }
 tempfile = { workspace = true }
--- a/codex-rs/core/tests/common/lib.rs
+++ b/codex-rs/core/tests/common/lib.rs
@@ -9,7 +9,6 @@ use codex_core::config::ConfigToml;

 pub mod responses;
 pub mod test_codex;
-pub mod test_codex_exec;

 /// Returns a default `Config` whose on-disk state is confined to the provided
 /// temporary directory. Using a per-test directory keeps tests hermetic and
@@ -129,56 +128,20 @@ where
    }
 }

-pub fn sandbox_env_var() -> &'static str {
-    codex_core::spawn::CODEX_SANDBOX_ENV_VAR
-}
-
-pub fn sandbox_network_env_var() -> &'static str {
-    codex_core::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR
-}
-
 #[macro_export]
-macro_rules! skip_if_sandbox {
+macro_rules! non_sandbox_test {
+    // For tests that return ()
    () => {{
-        if ::std::env::var($crate::sandbox_env_var())
-            == ::core::result::Result::Ok("seatbelt".to_string())
-        {
-            eprintln!(
-                "{} is set to 'seatbelt', skipping test.",
-                $crate::sandbox_env_var()
-            );
+        if ::std::env::var("CODEX_SANDBOX_NETWORK_DISABLED").is_ok() {
+            println!("Skipping test because it cannot execute when network is disabled in a Codex sandbox.");
            return;
        }
    }};
-    ($return_value:expr $(,)?) => {{
-        if ::std::env::var($crate::sandbox_env_var())
-            == ::core::result::Result::Ok("seatbelt".to_string())
-        {
-            eprintln!(
-                "{} is set to 'seatbelt', skipping test.",
-                $crate::sandbox_env_var()
-            );
-            return $return_value;
-        }
-    }};
-}
-
-#[macro_export]
-macro_rules! skip_if_no_network {
-    () => {{
-        if ::std::env::var($crate::sandbox_network_env_var()).is_ok() {
-            println!(
-                "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
-            );
-            return;
-        }
-    }};
-    ($return_value:expr $(,)?) => {{
-        if ::std::env::var($crate::sandbox_network_env_var()).is_ok() {
-            println!(
-                "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
-            );
-            return $return_value;
+    // For tests that return Result<(), _>
+    (result $(,)?) => {{
+        if ::std::env::var("CODEX_SANDBOX_NETWORK_DISABLED").is_ok() {
+            println!("Skipping test because it cannot execute when network is disabled in a Codex sandbox.");
+            return ::core::result::Result::Ok(());
        }
    }};
 }
--- a/codex-rs/core/tests/common/responses.rs
+++ b/codex-rs/core/tests/common/responses.rs
@@ -2,7 +2,6 @@ use serde_json::Value;
 use wiremock::BodyPrintLimit;
 use wiremock::Mock;
 use wiremock::MockServer;
-use wiremock::Respond;
 use wiremock::ResponseTemplate;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
@@ -122,7 +121,6 @@ where
        .and(path("/v1/responses"))
        .and(matcher)
        .respond_with(sse_response(body))
-        .up_to_n_times(1)
        .mount(server)
        .await;
 }
@@ -133,41 +131,3 @@ pub async fn start_mock_server() -> MockServer {
        .start()
        .await
 }
-
-/// Mounts a sequence of SSE response bodies and serves them in order for each
-/// POST to `/v1/responses`. Panics if more requests are received than bodies
-/// provided. Also asserts the exact number of expected calls.
-pub async fn mount_sse_sequence(server: &MockServer, bodies: Vec<String>) {
-    use std::sync::atomic::AtomicUsize;
-    use std::sync::atomic::Ordering;
-
-    struct SeqResponder {
-        num_calls: AtomicUsize,
-        responses: Vec<String>,
-    }
-
-    impl Respond for SeqResponder {
-        fn respond(&self, _: &wiremock::Request) -> ResponseTemplate {
-            let call_num = self.num_calls.fetch_add(1, Ordering::SeqCst);
-            match self.responses.get(call_num) {
-                Some(body) => ResponseTemplate::new(200)
-                    .insert_header("content-type", "text/event-stream")
-                    .set_body_string(body.clone()),
-                None => panic!("no response for {call_num}"),
-            }
-        }
-    }
-
-    let num_calls = bodies.len();
-    let responder = SeqResponder {
-        num_calls: AtomicUsize::new(0),
-        responses: bodies,
-    };
-
-    Mock::given(method("POST"))
-        .and(path("/v1/responses"))
-        .respond_with(responder)
-        .expect(num_calls as u64)
-        .mount(server)
-        .await;
-}
--- a/codex-rs/core/tests/common/test_codex_exec.rs
+++ b/codex-rs/core/tests/common/test_codex_exec.rs
@@ -1,40 +0,0 @@
-#![allow(clippy::expect_used)]
-use std::path::Path;
-use tempfile::TempDir;
-use wiremock::MockServer;
-
-pub struct TestCodexExecBuilder {
-    home: TempDir,
-    cwd: TempDir,
-}
-
-impl TestCodexExecBuilder {
-    pub fn cmd(&self) -> assert_cmd::Command {
-        let mut cmd = assert_cmd::Command::cargo_bin("codex-exec")
-            .expect("should find binary for codex-exec");
-        cmd.current_dir(self.cwd.path())
-            .env("CODEX_HOME", self.home.path())
-            .env("OPENAI_API_KEY", "dummy");
-        cmd
-    }
-    pub fn cmd_with_server(&self, server: &MockServer) -> assert_cmd::Command {
-        let mut cmd = self.cmd();
-        let base = format!("{}/v1", server.uri());
-        cmd.env("OPENAI_BASE_URL", base);
-        cmd
-    }
-
-    pub fn cwd_path(&self) -> &Path {
-        self.cwd.path()
-    }
-    pub fn home_path(&self) -> &Path {
-        self.home.path()
-    }
-}
-
-pub fn test_codex_exec() -> TestCodexExecBuilder {
-    TestCodexExecBuilder {
-        home: TempDir::new().expect("create temp home"),
-        cwd: TempDir::new().expect("create temp cwd"),
-    }
-}
--- a/codex-rs/core/tests/suite/abort_tasks.rs
+++ b/codex-rs/core/tests/suite/abort_tasks.rs
@@ -1,66 +0,0 @@
-use std::time::Duration;
-
-use codex_core::protocol::EventMsg;
-use codex_core::protocol::InputItem;
-use codex_core::protocol::Op;
-use core_test_support::responses::ev_function_call;
-use core_test_support::responses::mount_sse_once;
-use core_test_support::responses::sse;
-use core_test_support::responses::start_mock_server;
-use core_test_support::test_codex::test_codex;
-use core_test_support::wait_for_event_with_timeout;
-use serde_json::json;
-use wiremock::matchers::body_string_contains;
-
-/// Integration test: spawn a long‑running shell tool via a mocked Responses SSE
-/// function call, then interrupt the session and expect TurnAborted.
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn interrupt_long_running_tool_emits_turn_aborted() {
-    let command = vec![
-        "bash".to_string(),
-        "-lc".to_string(),
-        "sleep 60".to_string(),
-    ];
-
-    let args = json!({
-        "command": command,
-        "timeout_ms": 60_000
-    })
-    .to_string();
-    let body = sse(vec![ev_function_call("call_sleep", "shell", &args)]);
-
-    let server = start_mock_server().await;
-    mount_sse_once(&server, body_string_contains("start sleep"), body).await;
-
-    let codex = test_codex().build(&server).await.unwrap().codex;
-
-    let wait_timeout = Duration::from_secs(5);
-
-    // Kick off a turn that triggers the function call.
-    codex
-        .submit(Op::UserInput {
-            items: vec![InputItem::Text {
-                text: "start sleep".into(),
-            }],
-        })
-        .await
-        .unwrap();
-
-    // Wait until the exec begins to avoid a race, then interrupt.
-    wait_for_event_with_timeout(
-        &codex,
-        |ev| matches!(ev, EventMsg::ExecCommandBegin(_)),
-        wait_timeout,
-    )
-    .await;
-
-    codex.submit(Op::Interrupt).await.unwrap();
-
-    // Expect TurnAborted soon after.
-    wait_for_event_with_timeout(
-        &codex,
-        |ev| matches!(ev, EventMsg::TurnAborted(_)),
-        wait_timeout,
-    )
-    .await;
-}
--- a/codex-rs/core/tests/suite/cli_stream.rs
+++ b/codex-rs/core/tests/suite/cli_stream.rs
@@ -1,7 +1,7 @@
 use assert_cmd::Command as AssertCommand;
 use codex_core::RolloutRecorder;
 use codex_core::protocol::GitInfo;
-use core_test_support::skip_if_no_network;
+use core_test_support::non_sandbox_test;
 use std::time::Duration;
 use std::time::Instant;
 use tempfile::TempDir;
@@ -21,7 +21,7 @@ use wiremock::matchers::path;
 /// 4. Ensures the response is received exactly once and contains "hi"
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn chat_mode_stream_cli() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = MockServer::start().await;
    let sse = concat!(
@@ -97,7 +97,7 @@ async fn chat_mode_stream_cli() {
 /// received by a mock OpenAI Responses endpoint.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn exec_cli_applies_experimental_instructions_file() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Start mock server which will capture the request and return a minimal
    // SSE stream for a single turn.
@@ -185,7 +185,7 @@ async fn exec_cli_applies_experimental_instructions_file() {
 /// 4. Ensures the fixture content is correctly streamed through the CLI
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn responses_api_stream_cli() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let fixture =
        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/cli_responses_fixture.sse");
@@ -217,7 +217,7 @@ async fn responses_api_stream_cli() {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn integration_creates_and_checks_session_file() {
    // Honor sandbox network restrictions for CI parity with the other tests.
-    skip_if_no_network!();
+    non_sandbox_test!();

    // 1. Temp home so we read/write isolated session files.
    let home = TempDir::new().unwrap();
--- a/codex-rs/core/tests/suite/client.rs
+++ b/codex-rs/core/tests/suite/client.rs
@@ -21,8 +21,8 @@ use codex_protocol::models::ReasoningItemReasoningSummary;
 use codex_protocol::models::WebSearchAction;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id;
+use core_test_support::non_sandbox_test;
 use core_test_support::responses;
-use core_test_support::skip_if_no_network;
 use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
 use futures::StreamExt;
@@ -127,7 +127,7 @@ fn write_auth_json(

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn resume_includes_initial_messages_and_sends_prior_items() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Create a fake rollout session file with prior user + system + assistant messages.
    let tmpdir = TempDir::new().unwrap();
@@ -293,7 +293,7 @@ async fn resume_includes_initial_messages_and_sends_prior_items() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn includes_conversation_id_and_model_headers_in_request() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Mock server
    let server = MockServer::start().await;
@@ -361,7 +361,6 @@ async fn includes_conversation_id_and_model_headers_in_request() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn includes_base_instructions_override_in_request() {
-    skip_if_no_network!();
    // Mock server
    let server = MockServer::start().await;

@@ -419,7 +418,7 @@ async fn includes_base_instructions_override_in_request() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn chatgpt_auth_sends_correct_request() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Mock server
    let server = MockServer::start().await;
@@ -493,7 +492,7 @@ async fn chatgpt_auth_sends_correct_request() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn prefers_apikey_when_config_prefers_apikey_even_with_chatgpt_tokens() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Mock server
    let server = MockServer::start().await;
@@ -559,7 +558,6 @@ async fn prefers_apikey_when_config_prefers_apikey_even_with_chatgpt_tokens() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn includes_user_instructions_message_in_request() {
-    skip_if_no_network!();
    let server = MockServer::start().await;

    let first = ResponseTemplate::new(200)
@@ -621,7 +619,7 @@ async fn includes_user_instructions_message_in_request() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn azure_responses_request_includes_store_and_reasoning_ids() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = MockServer::start().await;

@@ -757,7 +755,6 @@ async fn azure_responses_request_includes_store_and_reasoning_ids() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn token_count_includes_rate_limits_snapshot() {
-    skip_if_no_network!();
    let server = MockServer::start().await;

    let sse_body = responses::sse(vec![responses::ev_completed_with_tokens("resp_rate", 123)]);
@@ -902,7 +899,6 @@ async fn token_count_includes_rate_limits_snapshot() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn usage_limit_error_emits_rate_limit_event() -> anyhow::Result<()> {
-    skip_if_no_network!(Ok(()));
    let server = MockServer::start().await;

    let response = ResponseTemplate::new(429)
@@ -911,6 +907,8 @@ async fn usage_limit_error_emits_rate_limit_event() -> anyhow::Result<()> {
        .insert_header("x-codex-primary-over-secondary-limit-percent", "95.0")
        .insert_header("x-codex-primary-window-minutes", "15")
        .insert_header("x-codex-secondary-window-minutes", "60")
+        .insert_header("x-codex-primary-reset-after-seconds", "900")
+        .insert_header("x-codex-secondary-reset-after-seconds", "3600")
        .set_body_json(json!({
            "error": {
                "type": "usage_limit_reached",
@@ -935,12 +933,12 @@ async fn usage_limit_error_emits_rate_limit_event() -> anyhow::Result<()> {
        "primary": {
            "used_percent": 100.0,
            "window_minutes": 15,
-            "resets_in_seconds": null
+            "resets_in_seconds": 900
        },
        "secondary": {
            "used_percent": 87.5,
            "window_minutes": 60,
-            "resets_in_seconds": null
+            "resets_in_seconds": 3600
        }
    });

@@ -976,13 +974,73 @@ async fn usage_limit_error_emits_rate_limit_event() -> anyhow::Result<()> {
        "unexpected error message for submission {submission_id}: {}",
        error_event.message
    );
+    assert!(
+        error_event.message.contains("15 minutes"),
+        "expected reset hint in error message for submission {submission_id}: {}",
+        error_event.message
+    );
+
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn usage_limit_error_prefers_longer_reset_window() -> anyhow::Result<()> {
+    let server = MockServer::start().await;
+
+    let response = ResponseTemplate::new(429)
+        .insert_header("x-codex-primary-used-percent", "100.0")
+        .insert_header("x-codex-secondary-used-percent", "100.0")
+        .insert_header("x-codex-primary-window-minutes", "10")
+        .insert_header("x-codex-secondary-window-minutes", "60")
+        .insert_header("x-codex-primary-reset-after-seconds", "600")
+        .insert_header("x-codex-secondary-reset-after-seconds", "7200")
+        .set_body_json(json!({
+            "error": {
+                "type": "usage_limit_reached",
+                "message": "limit reached",
+                "resets_in_seconds": 5,
+                "plan_type": "pro"
+            }
+        }));
+
+    Mock::given(method("POST"))
+        .and(path("/v1/responses"))
+        .respond_with(response)
+        .expect(1)
+        .mount(&server)
+        .await;
+
+    let mut builder = test_codex();
+    let codex_fixture = builder.build(&server).await?;
+    let codex = codex_fixture.codex.clone();
+
+    codex
+        .submit(Op::UserInput {
+            items: vec![InputItem::Text {
+                text: "hello".into(),
+            }],
+        })
+        .await
+        .expect("submission should succeed while emitting usage limit error events");
+
+    wait_for_event(&codex, |msg| matches!(msg, EventMsg::TokenCount(_))).await;
+
+    let error_event = wait_for_event(&codex, |msg| matches!(msg, EventMsg::Error(_))).await;
+    let EventMsg::Error(error_event) = error_event else {
+        unreachable!();
+    };
+
+    assert!(
+        error_event.message.contains("2 hours"),
+        "expected longer reset hint in error message: {}",
+        error_event.message
+    );

    Ok(())
 }

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn azure_overrides_assign_properties_used_for_responses_url() {
-    skip_if_no_network!();
    let existing_env_var_with_random_value = if cfg!(windows) { "USERNAME" } else { "USER" };

    // Mock server
@@ -1059,7 +1117,6 @@ async fn azure_overrides_assign_properties_used_for_responses_url() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn env_var_overrides_loaded_auth() {
-    skip_if_no_network!();
    let existing_env_var_with_random_value = if cfg!(windows) { "USERNAME" } else { "USER" };

    // Mock server
@@ -1147,7 +1204,7 @@ fn create_dummy_codex_auth() -> CodexAuth {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn history_dedupes_streamed_and_final_messages_across_turns() {
    // Skip under Codex sandbox network restrictions (mirrors other tests).
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Mock server that will receive three sequential requests and return the same SSE stream
    // each time: a few deltas, then a final assistant message, then completed.
--- a/codex-rs/core/tests/suite/compact.rs
+++ b/codex-rs/core/tests/suite/compact.rs
@@ -10,7 +10,6 @@ use codex_core::protocol::Op;
 use codex_core::protocol::RolloutItem;
 use codex_core::protocol::RolloutLine;
 use core_test_support::load_default_config_for_test;
-use core_test_support::skip_if_no_network;
 use core_test_support::wait_for_event;
 use tempfile::TempDir;
 use wiremock::Mock;
@@ -21,6 +20,7 @@ use wiremock::matchers::method;
 use wiremock::matchers::path;

 use codex_core::codex::compact::SUMMARIZATION_PROMPT;
+use core_test_support::non_sandbox_test;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_completed_with_tokens;
@@ -53,7 +53,7 @@ const DUMMY_CALL_ID: &str = "call-multi-auto";

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn summarize_context_three_requests_and_instructions() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Set up a mock server that we can inspect after the run.
    let server = start_mock_server().await;
@@ -270,7 +270,7 @@ async fn summarize_context_three_requests_and_instructions() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn auto_compact_runs_after_token_limit_hit() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = start_mock_server().await;

@@ -430,7 +430,7 @@ async fn auto_compact_runs_after_token_limit_hit() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_persists_rollout_entries() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = start_mock_server().await;

@@ -558,7 +558,7 @@ async fn auto_compact_persists_rollout_entries() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_stops_after_failed_attempt() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = start_mock_server().await;

@@ -679,7 +679,7 @@ async fn auto_compact_stops_after_failed_attempt() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_allows_multiple_attempts_when_interleaved_with_other_turn_events() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = start_mock_server().await;

--- a/codex-rs/core/tests/suite/fork_conversation.rs
+++ b/codex-rs/core/tests/suite/fork_conversation.rs
@@ -14,7 +14,6 @@ use codex_core::protocol::Op;
 use codex_core::protocol::RolloutItem;
 use codex_core::protocol::RolloutLine;
 use core_test_support::load_default_config_for_test;
-use core_test_support::skip_if_no_network;
 use core_test_support::wait_for_event;
 use tempfile::TempDir;
 use wiremock::Mock;
@@ -30,8 +29,6 @@ fn sse_completed(id: &str) -> String {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn fork_conversation_twice_drops_to_first_message() {
-    skip_if_no_network!();
-
    // Start a mock server that completes three turns.
    let server = MockServer::start().await;
    let sse = sse_completed("resp");
--- a/codex-rs/core/tests/suite/json_result.rs
+++ b/codex-rs/core/tests/suite/json_result.rs
@@ -6,8 +6,8 @@ use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use codex_core::protocol::SandboxPolicy;
 use codex_protocol::config_types::ReasoningSummary;
+use core_test_support::non_sandbox_test;
 use core_test_support::responses;
-use core_test_support::skip_if_no_network;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
@@ -30,17 +30,8 @@ const SCHEMA: &str = r#"
 "#;

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn codex_returns_json_result_for_gpt5() -> anyhow::Result<()> {
-    codex_returns_json_result("gpt-5".to_string()).await
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn codex_returns_json_result_for_gpt5_codex() -> anyhow::Result<()> {
-    codex_returns_json_result("gpt-5-codex".to_string()).await
-}
-
-async fn codex_returns_json_result(model: String) -> anyhow::Result<()> {
-    skip_if_no_network!(Ok(()));
+async fn codex_returns_json_result() -> anyhow::Result<()> {
+    non_sandbox_test!(result);

    let server = start_mock_server().await;

@@ -81,7 +72,7 @@ async fn codex_returns_json_result(model: String) -> anyhow::Result<()> {
            cwd: cwd.path().to_path_buf(),
            approval_policy: AskForApproval::Never,
            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            model,
+            model: "gpt-5".to_string(),
            effort: None,
            summary: ReasoningSummary::Auto,
        })
--- a/codex-rs/core/tests/suite/mod.rs
+++ b/codex-rs/core/tests/suite/mod.rs
@@ -1,7 +1,5 @@
 // Aggregates all former standalone integration tests as modules.

-#[cfg(not(target_os = "windows"))]
-mod abort_tasks;
 mod cli_stream;
 mod client;
 mod compact;
@@ -14,7 +12,6 @@ mod live_cli;
 mod model_overrides;
 mod prompt_caching;
 mod review;
-mod rmcp_client;
 mod rollout_list_find;
 mod seatbelt;
 mod stream_error_allows_next_turn;
--- a/codex-rs/core/tests/suite/prompt_caching.rs
+++ b/codex-rs/core/tests/suite/prompt_caching.rs
@@ -16,7 +16,6 @@ use codex_core::shell::Shell;
 use codex_core::shell::default_user_shell;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id;
-use core_test_support::skip_if_no_network;
 use core_test_support::wait_for_event;
 use tempfile::TempDir;
 use wiremock::Mock;
@@ -68,7 +67,6 @@ fn assert_tool_names(body: &serde_json::Value, expected_names: &[&str]) {

 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn codex_mini_latest_tools() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
@@ -153,7 +151,6 @@ async fn codex_mini_latest_tools() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn prompt_tools_are_consistent_across_requests() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
@@ -237,7 +234,6 @@ async fn prompt_tools_are_consistent_across_requests() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn prefixes_context_and_instructions_once_and_consistently_across_requests() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
@@ -356,7 +352,6 @@ async fn prefixes_context_and_instructions_once_and_consistently_across_requests

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
@@ -484,7 +479,6 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn per_turn_overrides_keep_cached_prefix_and_key_constant() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
@@ -608,7 +602,6 @@ async fn per_turn_overrides_keep_cached_prefix_and_key_constant() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn send_user_turn_with_no_changes_does_not_send_environment_context() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
@@ -722,7 +715,6 @@ async fn send_user_turn_with_no_changes_does_not_send_environment_context() {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn send_user_turn_with_changes_sends_environment_context() {
-    skip_if_no_network!();
    use pretty_assertions::assert_eq;

    let server = MockServer::start().await;
--- a/codex-rs/core/tests/suite/review.rs
+++ b/codex-rs/core/tests/suite/review.rs
@@ -22,7 +22,7 @@ use codex_core::protocol::RolloutItem;
 use codex_core::protocol::RolloutLine;
 use core_test_support::load_default_config_for_test;
 use core_test_support::load_sse_fixture_with_id_from_str;
-use core_test_support::skip_if_no_network;
+use core_test_support::non_sandbox_test;
 use core_test_support::wait_for_event;
 use pretty_assertions::assert_eq;
 use std::path::PathBuf;
@@ -42,7 +42,7 @@ use wiremock::matchers::path;
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn review_op_emits_lifecycle_and_review_output() {
    // Skip under Codex sandbox network restrictions.
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Start mock Responses API server. Return a single assistant message whose
    // text is a JSON-encoded ReviewOutputEvent.
@@ -167,7 +167,7 @@ async fn review_op_emits_lifecycle_and_review_output() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn review_op_with_plain_text_emits_review_fallback() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let sse_raw = r#"[
        {"type":"response.output_item.done", "item":{
@@ -216,7 +216,7 @@ async fn review_op_with_plain_text_emits_review_fallback() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn review_does_not_emit_agent_message_on_structured_output() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let review_json = serde_json::json!({
        "findings": [
@@ -288,7 +288,7 @@ async fn review_does_not_emit_agent_message_on_structured_output() {
 /// request uses that model (and not the main chat model).
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn review_uses_custom_review_model_from_config() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Minimal stream: just a completed event
    let sse_raw = r#"[
@@ -341,7 +341,7 @@ async fn review_uses_custom_review_model_from_config() {
 #[cfg_attr(windows, tokio::test(flavor = "multi_thread", worker_threads = 4))]
 #[cfg_attr(not(windows), tokio::test(flavor = "multi_thread", worker_threads = 2))]
 async fn review_input_isolated_from_parent_history() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Mock server for the single review request
    let sse_raw = r#"[
@@ -517,7 +517,7 @@ async fn review_input_isolated_from_parent_history() {
 /// messages in its request `input`.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn review_history_does_not_leak_into_parent_session() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    // Respond to both the review request and the subsequent parent request.
    let sse_raw = r#"[
--- a/codex-rs/core/tests/suite/rmcp_client.rs
+++ b/codex-rs/core/tests/suite/rmcp_client.rs
@@ -1,371 +0,0 @@
-use std::collections::HashMap;
-use std::net::TcpListener;
-use std::time::Duration;
-
-use codex_core::config_types::McpServerConfig;
-use codex_core::config_types::McpServerTransportConfig;
-
-use codex_core::protocol::AskForApproval;
-use codex_core::protocol::EventMsg;
-use codex_core::protocol::InputItem;
-use codex_core::protocol::Op;
-use codex_core::protocol::SandboxPolicy;
-use codex_protocol::config_types::ReasoningSummary;
-use core_test_support::responses;
-use core_test_support::responses::mount_sse_once;
-use core_test_support::skip_if_no_network;
-use core_test_support::test_codex::test_codex;
-use core_test_support::wait_for_event;
-use core_test_support::wait_for_event_with_timeout;
-use escargot::CargoBuild;
-use serde_json::Value;
-use tokio::net::TcpStream;
-use tokio::process::Child;
-use tokio::process::Command;
-use tokio::time::Instant;
-use tokio::time::sleep;
-use wiremock::matchers::any;
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
-async fn stdio_server_round_trip() -> anyhow::Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = responses::start_mock_server().await;
-
-    let call_id = "call-123";
-    let server_name = "rmcp";
-    let tool_name = format!("{server_name}__echo");
-
-    mount_sse_once(
-        &server,
-        any(),
-        responses::sse(vec![
-            serde_json::json!({
-                "type": "response.created",
-                "response": {"id": "resp-1"}
-            }),
-            responses::ev_function_call(call_id, &tool_name, "{\"message\":\"ping\"}"),
-            responses::ev_completed("resp-1"),
-        ]),
-    )
-    .await;
-    mount_sse_once(
-        &server,
-        any(),
-        responses::sse(vec![
-            responses::ev_assistant_message("msg-1", "rmcp echo tool completed successfully."),
-            responses::ev_completed("resp-2"),
-        ]),
-    )
-    .await;
-
-    let expected_env_value = "propagated-env";
-    let rmcp_test_server_bin = CargoBuild::new()
-        .package("codex-rmcp-client")
-        .bin("test_stdio_server")
-        .run()?
-        .path()
-        .to_string_lossy()
-        .into_owned();
-
-    let fixture = test_codex()
-        .with_config(move |config| {
-            config.use_experimental_use_rmcp_client = true;
-            config.mcp_servers.insert(
-                server_name.to_string(),
-                McpServerConfig {
-                    transport: McpServerTransportConfig::Stdio {
-                        command: rmcp_test_server_bin.clone(),
-                        args: Vec::new(),
-                        env: Some(HashMap::from([(
-                            "MCP_TEST_VALUE".to_string(),
-                            expected_env_value.to_string(),
-                        )])),
-                    },
-                    startup_timeout_sec: Some(Duration::from_secs(10)),
-                    tool_timeout_sec: None,
-                },
-            );
-        })
-        .build(&server)
-        .await?;
-    let session_model = fixture.session_configured.model.clone();
-
-    fixture
-        .codex
-        .submit(Op::UserTurn {
-            items: vec![InputItem::Text {
-                text: "call the rmcp echo tool".into(),
-            }],
-            final_output_json_schema: None,
-            cwd: fixture.cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            model: session_model,
-            effort: None,
-            summary: ReasoningSummary::Auto,
-        })
-        .await?;
-
-    let begin_event = wait_for_event_with_timeout(
-        &fixture.codex,
-        |ev| matches!(ev, EventMsg::McpToolCallBegin(_)),
-        Duration::from_secs(10),
-    )
-    .await;
-
-    let EventMsg::McpToolCallBegin(begin) = begin_event else {
-        unreachable!("event guard guarantees McpToolCallBegin");
-    };
-    assert_eq!(begin.invocation.server, server_name);
-    assert_eq!(begin.invocation.tool, "echo");
-
-    let end_event = wait_for_event(&fixture.codex, |ev| {
-        matches!(ev, EventMsg::McpToolCallEnd(_))
-    })
-    .await;
-    let EventMsg::McpToolCallEnd(end) = end_event else {
-        unreachable!("event guard guarantees McpToolCallEnd");
-    };
-
-    let result = end
-        .result
-        .as_ref()
-        .expect("rmcp echo tool should return success");
-    assert_eq!(result.is_error, Some(false));
-    assert!(
-        result.content.is_empty(),
-        "content should default to an empty array"
-    );
-
-    let structured = result
-        .structured_content
-        .as_ref()
-        .expect("structured content");
-    let Value::Object(map) = structured else {
-        panic!("structured content should be an object: {structured:?}");
-    };
-    let echo_value = map
-        .get("echo")
-        .and_then(Value::as_str)
-        .expect("echo payload present");
-    assert_eq!(echo_value, "ECHOING: ping");
-    let env_value = map
-        .get("env")
-        .and_then(Value::as_str)
-        .expect("env snapshot inserted");
-    assert_eq!(env_value, expected_env_value);
-
-    wait_for_event(&fixture.codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    server.verify().await;
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
-async fn streamable_http_tool_call_round_trip() -> anyhow::Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = responses::start_mock_server().await;
-
-    let call_id = "call-456";
-    let server_name = "rmcp_http";
-    let tool_name = format!("{server_name}__echo");
-
-    mount_sse_once(
-        &server,
-        any(),
-        responses::sse(vec![
-            serde_json::json!({
-                "type": "response.created",
-                "response": {"id": "resp-1"}
-            }),
-            responses::ev_function_call(call_id, &tool_name, "{\"message\":\"ping\"}"),
-            responses::ev_completed("resp-1"),
-        ]),
-    )
-    .await;
-    mount_sse_once(
-        &server,
-        any(),
-        responses::sse(vec![
-            responses::ev_assistant_message(
-                "msg-1",
-                "rmcp streamable http echo tool completed successfully.",
-            ),
-            responses::ev_completed("resp-2"),
-        ]),
-    )
-    .await;
-
-    let expected_env_value = "propagated-env-http";
-    let rmcp_http_server_bin = CargoBuild::new()
-        .package("codex-rmcp-client")
-        .bin("test_streamable_http_server")
-        .run()?
-        .path()
-        .to_string_lossy()
-        .into_owned();
-
-    let listener = TcpListener::bind("127.0.0.1:0")?;
-    let port = listener.local_addr()?.port();
-    drop(listener);
-    let bind_addr = format!("127.0.0.1:{port}");
-    let server_url = format!("http://{bind_addr}/mcp");
-
-    let mut http_server_child = Command::new(&rmcp_http_server_bin)
-        .kill_on_drop(true)
-        .env("MCP_STREAMABLE_HTTP_BIND_ADDR", &bind_addr)
-        .env("MCP_TEST_VALUE", expected_env_value)
-        .spawn()?;
-
-    wait_for_streamable_http_server(&mut http_server_child, &bind_addr, Duration::from_secs(5))
-        .await?;
-
-    let fixture = test_codex()
-        .with_config(move |config| {
-            config.use_experimental_use_rmcp_client = true;
-            config.mcp_servers.insert(
-                server_name.to_string(),
-                McpServerConfig {
-                    transport: McpServerTransportConfig::StreamableHttp {
-                        url: server_url,
-                        bearer_token: None,
-                    },
-                    startup_timeout_sec: Some(Duration::from_secs(10)),
-                    tool_timeout_sec: None,
-                },
-            );
-        })
-        .build(&server)
-        .await?;
-    let session_model = fixture.session_configured.model.clone();
-
-    fixture
-        .codex
-        .submit(Op::UserTurn {
-            items: vec![InputItem::Text {
-                text: "call the rmcp streamable http echo tool".into(),
-            }],
-            final_output_json_schema: None,
-            cwd: fixture.cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            model: session_model,
-            effort: None,
-            summary: ReasoningSummary::Auto,
-        })
-        .await?;
-
-    let begin_event = wait_for_event_with_timeout(
-        &fixture.codex,
-        |ev| matches!(ev, EventMsg::McpToolCallBegin(_)),
-        Duration::from_secs(10),
-    )
-    .await;
-
-    let EventMsg::McpToolCallBegin(begin) = begin_event else {
-        unreachable!("event guard guarantees McpToolCallBegin");
-    };
-    assert_eq!(begin.invocation.server, server_name);
-    assert_eq!(begin.invocation.tool, "echo");
-
-    let end_event = wait_for_event(&fixture.codex, |ev| {
-        matches!(ev, EventMsg::McpToolCallEnd(_))
-    })
-    .await;
-    let EventMsg::McpToolCallEnd(end) = end_event else {
-        unreachable!("event guard guarantees McpToolCallEnd");
-    };
-
-    let result = end
-        .result
-        .as_ref()
-        .expect("rmcp echo tool should return success");
-    assert_eq!(result.is_error, Some(false));
-    assert!(
-        result.content.is_empty(),
-        "content should default to an empty array"
-    );
-
-    let structured = result
-        .structured_content
-        .as_ref()
-        .expect("structured content");
-    let Value::Object(map) = structured else {
-        panic!("structured content should be an object: {structured:?}");
-    };
-    let echo_value = map
-        .get("echo")
-        .and_then(Value::as_str)
-        .expect("echo payload present");
-    assert_eq!(echo_value, "ECHOING: ping");
-    let env_value = map
-        .get("env")
-        .and_then(Value::as_str)
-        .expect("env snapshot inserted");
-    assert_eq!(env_value, expected_env_value);
-
-    wait_for_event(&fixture.codex, |ev| matches!(ev, EventMsg::TaskComplete(_))).await;
-
-    server.verify().await;
-
-    match http_server_child.try_wait() {
-        Ok(Some(_)) => {}
-        Ok(None) => {
-            let _ = http_server_child.kill().await;
-        }
-        Err(error) => {
-            eprintln!("failed to check streamable http server status: {error}");
-            let _ = http_server_child.kill().await;
-        }
-    }
-    if let Err(error) = http_server_child.wait().await {
-        eprintln!("failed to await streamable http server shutdown: {error}");
-    }
-
-    Ok(())
-}
-
-async fn wait_for_streamable_http_server(
-    server_child: &mut Child,
-    address: &str,
-    timeout: Duration,
-) -> anyhow::Result<()> {
-    let deadline = Instant::now() + timeout;
-
-    loop {
-        if let Some(status) = server_child.try_wait()? {
-            return Err(anyhow::anyhow!(
-                "streamable HTTP server exited early with status {status}"
-            ));
-        }
-
-        let remaining = deadline.saturating_duration_since(Instant::now());
-
-        if remaining.is_zero() {
-            return Err(anyhow::anyhow!(
-                "timed out waiting for streamable HTTP server at {address}: deadline reached"
-            ));
-        }
-
-        match tokio::time::timeout(remaining, TcpStream::connect(address)).await {
-            Ok(Ok(_)) => return Ok(()),
-            Ok(Err(error)) => {
-                if Instant::now() >= deadline {
-                    return Err(anyhow::anyhow!(
-                        "timed out waiting for streamable HTTP server at {address}: {error}"
-                    ));
-                }
-            }
-            Err(_) => {
-                return Err(anyhow::anyhow!(
-                    "timed out waiting for streamable HTTP server at {address}: connect call timed out"
-                ));
-            }
-        }
-
-        sleep(Duration::from_millis(50)).await;
-    }
-}
--- a/codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
+++ b/codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
@@ -6,7 +6,7 @@ use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use core_test_support::load_sse_fixture_with_id;
-use core_test_support::skip_if_no_network;
+use core_test_support::non_sandbox_test;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event_with_timeout;
@@ -23,7 +23,7 @@ fn sse_completed(id: &str) -> String {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn continue_after_stream_error() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = MockServer::start().await;

--- a/codex-rs/core/tests/suite/stream_no_completed.rs
+++ b/codex-rs/core/tests/suite/stream_no_completed.rs
@@ -10,7 +10,7 @@ use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use core_test_support::load_sse_fixture;
 use core_test_support::load_sse_fixture_with_id;
-use core_test_support::skip_if_no_network;
+use core_test_support::non_sandbox_test;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
 use tokio::time::timeout;
@@ -32,7 +32,7 @@ fn sse_completed(id: &str) -> String {

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retries_on_early_close() {
-    skip_if_no_network!();
+    non_sandbox_test!();

    let server = MockServer::start().await;

--- a/codex-rs/core/tests/suite/user_notification.rs
+++ b/codex-rs/core/tests/suite/user_notification.rs
@@ -5,8 +5,8 @@ use std::os::unix::fs::PermissionsExt;
 use codex_core::protocol::EventMsg;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
+use core_test_support::non_sandbox_test;
 use core_test_support::responses;
-use core_test_support::skip_if_no_network;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
@@ -22,7 +22,7 @@ use tokio::time::sleep;

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn summarize_context_three_requests_and_instructions() -> anyhow::Result<()> {
-    skip_if_no_network!(Ok(()));
+    non_sandbox_test!(result);

    let server = start_mock_server().await;

--- a/codex-rs/exec/Cargo.toml
+++ b/codex-rs/exec/Cargo.toml
@@ -28,7 +28,6 @@ codex-core = { workspace = true }
 codex-ollama = { workspace = true }
 codex-protocol = { workspace = true }
 owo-colors = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 shlex = { workspace = true }
 tokio = { workspace = true, features = [
@@ -40,18 +39,12 @@ tokio = { workspace = true, features = [
 ] }
 tracing = { workspace = true, features = ["log"] }
 tracing-subscriber = { workspace = true, features = ["env-filter"] }
-ts-rs = { workspace = true, features = [
-    "uuid-impl",
-    "serde-json-impl",
-    "no-serde-warnings",
-] }

 [dev-dependencies]
 assert_cmd = { workspace = true }
 core_test_support = { workspace = true }
 libc = { workspace = true }
 predicates = { workspace = true }
-pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 uuid = { workspace = true }
 walkdir = { workspace = true }
--- a/codex-rs/exec/src/cli.rs
+++ b/codex-rs/exec/src/cli.rs
@@ -64,20 +64,9 @@ pub struct Cli {
    pub color: Color,

    /// Print events to stdout as JSONL.
-    #[arg(
-        long = "json",
-        default_value_t = false,
-        conflicts_with = "experimental_json"
-    )]
+    #[arg(long = "json", default_value_t = false)]
    pub json: bool,

-    #[arg(
-        long = "experimental-json",
-        default_value_t = false,
-        conflicts_with = "json"
-    )]
-    pub experimental_json: bool,
-
    /// Whether to include the plan tool in the conversation.
    #[arg(long = "include-plan-tool", default_value_t = false)]
    pub include_plan_tool: bool,
--- a/codex-rs/exec/src/event_processor.rs
+++ b/codex-rs/exec/src/event_processor.rs
@@ -2,7 +2,6 @@ use std::path::Path;

 use codex_core::config::Config;
 use codex_core::protocol::Event;
-use codex_core::protocol::SessionConfiguredEvent;

 pub(crate) enum CodexStatus {
    Running,
@@ -12,12 +11,7 @@ pub(crate) enum CodexStatus {

 pub(crate) trait EventProcessor {
    /// Print summary of effective configuration and user prompt.
-    fn print_config_summary(
-        &mut self,
-        config: &Config,
-        prompt: &str,
-        session_configured: &SessionConfiguredEvent,
-    );
+    fn print_config_summary(&mut self, config: &Config, prompt: &str);

    /// Handle a single event emitted by the agent.
    fn process_event(&mut self, event: Event) -> CodexStatus;
--- a/codex-rs/exec/src/event_processor_with_human_output.rs
+++ b/codex-rs/exec/src/event_processor_with_human_output.rs
@@ -26,7 +26,6 @@ use codex_core::protocol::TurnAbortReason;
 use codex_core::protocol::TurnDiffEvent;
 use codex_core::protocol::WebSearchBeginEvent;
 use codex_core::protocol::WebSearchEndEvent;
-use codex_core::protocol::WorktreeRemovedEvent;
 use codex_protocol::num_format::format_with_separators;
 use owo_colors::OwoColorize;
 use owo_colors::Style;
@@ -142,7 +141,7 @@ impl EventProcessor for EventProcessorWithHumanOutput {
    /// Print a concise summary of the effective configuration that will be used
    /// for the session. This mirrors the information shown in the TUI welcome
    /// screen.
-    fn print_config_summary(&mut self, config: &Config, prompt: &str, _: &SessionConfiguredEvent) {
+    fn print_config_summary(&mut self, config: &Config, prompt: &str) {
        const VERSION: &str = env!("CARGO_PKG_VERSION");
        ts_println!(
            self,
@@ -200,14 +199,6 @@ impl EventProcessor for EventProcessorWithHumanOutput {
                    );
                }
            }
-            EventMsg::WorktreeRemoved(WorktreeRemovedEvent { path }) => {
-                ts_println!(
-                    self,
-                    "{} {}",
-                    "git worktree removed:".style(self.cyan),
-                    path.display()
-                );
-            }
            EventMsg::AgentMessageDelta(AgentMessageDeltaEvent { delta }) => {
                if !self.answer_started {
                    ts_println!(self, "{}\n", "codex".style(self.italic).style(self.magenta));
@@ -534,7 +525,6 @@ impl EventProcessor for EventProcessorWithHumanOutput {
                    history_entry_count: _,
                    initial_messages: _,
                    rollout_path: _,
-                    worktree_path,
                } = session_configured_event;

                ts_println!(
@@ -545,9 +535,6 @@ impl EventProcessor for EventProcessorWithHumanOutput {
                );

                ts_println!(self, "model: {}", model);
-                if let Some(path) = worktree_path {
-                    ts_println!(self, "git worktree: {}", path.display());
-                }
                println!();
            }
            EventMsg::PlanUpdate(plan_update_event) => {
--- a/codex-rs/exec/src/event_processor_with_json_output.rs
+++ b/codex-rs/exec/src/event_processor_with_json_output.rs
@@ -4,7 +4,6 @@ use std::path::PathBuf;
 use codex_core::config::Config;
 use codex_core::protocol::Event;
 use codex_core::protocol::EventMsg;
-use codex_core::protocol::SessionConfiguredEvent;
 use codex_core::protocol::TaskCompleteEvent;
 use serde_json::json;

@@ -24,7 +23,7 @@ impl EventProcessorWithJsonOutput {
 }

 impl EventProcessor for EventProcessorWithJsonOutput {
-    fn print_config_summary(&mut self, config: &Config, prompt: &str, _: &SessionConfiguredEvent) {
+    fn print_config_summary(&mut self, config: &Config, prompt: &str) {
        let entries = create_config_summary_entries(config)
            .into_iter()
            .map(|(key, value)| (key.to_string(), value))
--- a/codex-rs/exec/src/exec_events.rs
+++ b/codex-rs/exec/src/exec_events.rs
@@ -1,191 +0,0 @@
-use serde::Deserialize;
-use serde::Serialize;
-use ts_rs::TS;
-
-/// Top-level events emitted on the Codex Exec conversation stream.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-#[serde(tag = "type")]
-pub enum ConversationEvent {
-    #[serde(rename = "session.created")]
-    SessionCreated(SessionCreatedEvent),
-    #[serde(rename = "turn.started")]
-    TurnStarted(TurnStartedEvent),
-    #[serde(rename = "turn.completed")]
-    TurnCompleted(TurnCompletedEvent),
-    #[serde(rename = "item.started")]
-    ItemStarted(ItemStartedEvent),
-    #[serde(rename = "item.updated")]
-    ItemUpdated(ItemUpdatedEvent),
-    #[serde(rename = "item.completed")]
-    ItemCompleted(ItemCompletedEvent),
-    #[serde(rename = "error")]
-    Error(ConversationErrorEvent),
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct SessionCreatedEvent {
-    pub session_id: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS, Default)]
-pub struct TurnStartedEvent {}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct TurnCompletedEvent {
-    pub usage: Usage,
-}
-
-/// Minimal usage summary for a turn.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS, Default)]
-pub struct Usage {
-    pub input_tokens: u64,
-    pub cached_input_tokens: u64,
-    pub output_tokens: u64,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ItemStartedEvent {
-    pub item: ConversationItem,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ItemCompletedEvent {
-    pub item: ConversationItem,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ItemUpdatedEvent {
-    pub item: ConversationItem,
-}
-
-/// Fatal error emitted by the stream.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ConversationErrorEvent {
-    pub message: String,
-}
-
-/// Canonical representation of a conversation item and its domain-specific payload.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ConversationItem {
-    pub id: String,
-    #[serde(flatten)]
-    pub details: ConversationItemDetails,
-}
-
-/// Typed payloads for each supported conversation item type.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-#[serde(tag = "item_type", rename_all = "snake_case")]
-pub enum ConversationItemDetails {
-    AssistantMessage(AssistantMessageItem),
-    Reasoning(ReasoningItem),
-    CommandExecution(CommandExecutionItem),
-    FileChange(FileChangeItem),
-    McpToolCall(McpToolCallItem),
-    WebSearch(WebSearchItem),
-    TodoList(TodoListItem),
-    Error(ErrorItem),
-}
-
-/// Session conversation metadata.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct SessionItem {
-    pub session_id: String,
-}
-
-/// Assistant message payload.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct AssistantMessageItem {
-    pub text: String,
-}
-
-/// Model reasoning summary payload.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ReasoningItem {
-    pub text: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default, TS)]
-#[serde(rename_all = "snake_case")]
-pub enum CommandExecutionStatus {
-    #[default]
-    InProgress,
-    Completed,
-    Failed,
-}
-
-/// Local shell command execution payload.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct CommandExecutionItem {
-    pub command: String,
-    pub aggregated_output: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i32>,
-    pub status: CommandExecutionStatus,
-}
-
-/// Single file change summary for a patch.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct FileUpdateChange {
-    pub path: String,
-    pub kind: PatchChangeKind,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-#[serde(rename_all = "snake_case")]
-pub enum PatchApplyStatus {
-    Completed,
-    Failed,
-}
-
-/// Patch application payload.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct FileChangeItem {
-    pub changes: Vec<FileUpdateChange>,
-    pub status: PatchApplyStatus,
-}
-
-/// Known change kinds for a patch.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-#[serde(rename_all = "snake_case")]
-pub enum PatchChangeKind {
-    Add,
-    Delete,
-    Update,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default, TS)]
-#[serde(rename_all = "snake_case")]
-pub enum McpToolCallStatus {
-    #[default]
-    InProgress,
-    Completed,
-    Failed,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct McpToolCallItem {
-    pub server: String,
-    pub tool: String,
-    pub status: McpToolCallStatus,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct WebSearchItem {
-    pub query: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct ErrorItem {
-    pub message: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct TodoItem {
-    pub text: String,
-    pub completed: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, TS)]
-pub struct TodoListItem {
-    pub items: Vec<TodoItem>,
-}
--- a/codex-rs/exec/src/experimental_event_processor_with_json_output.rs
+++ b/codex-rs/exec/src/experimental_event_processor_with_json_output.rs
@@ -1,368 +0,0 @@
-use std::collections::HashMap;
-use std::path::PathBuf;
-use std::sync::atomic::AtomicU64;
-
-use crate::event_processor::CodexStatus;
-use crate::event_processor::EventProcessor;
-use crate::event_processor::handle_last_message;
-use crate::exec_events::AssistantMessageItem;
-use crate::exec_events::CommandExecutionItem;
-use crate::exec_events::CommandExecutionStatus;
-use crate::exec_events::ConversationErrorEvent;
-use crate::exec_events::ConversationEvent;
-use crate::exec_events::ConversationItem;
-use crate::exec_events::ConversationItemDetails;
-use crate::exec_events::FileChangeItem;
-use crate::exec_events::FileUpdateChange;
-use crate::exec_events::ItemCompletedEvent;
-use crate::exec_events::ItemStartedEvent;
-use crate::exec_events::ItemUpdatedEvent;
-use crate::exec_events::PatchApplyStatus;
-use crate::exec_events::PatchChangeKind;
-use crate::exec_events::ReasoningItem;
-use crate::exec_events::SessionCreatedEvent;
-use crate::exec_events::TodoItem;
-use crate::exec_events::TodoListItem;
-use crate::exec_events::TurnCompletedEvent;
-use crate::exec_events::TurnStartedEvent;
-use crate::exec_events::Usage;
-use codex_core::config::Config;
-use codex_core::plan_tool::StepStatus;
-use codex_core::plan_tool::UpdatePlanArgs;
-use codex_core::protocol::AgentMessageEvent;
-use codex_core::protocol::AgentReasoningEvent;
-use codex_core::protocol::Event;
-use codex_core::protocol::EventMsg;
-use codex_core::protocol::ExecCommandBeginEvent;
-use codex_core::protocol::ExecCommandEndEvent;
-use codex_core::protocol::FileChange;
-use codex_core::protocol::PatchApplyBeginEvent;
-use codex_core::protocol::PatchApplyEndEvent;
-use codex_core::protocol::SessionConfiguredEvent;
-use codex_core::protocol::TaskCompleteEvent;
-use codex_core::protocol::TaskStartedEvent;
-use tracing::error;
-use tracing::warn;
-
-pub struct ExperimentalEventProcessorWithJsonOutput {
-    last_message_path: Option<PathBuf>,
-    next_event_id: AtomicU64,
-    // Tracks running commands by call_id, including the associated item id.
-    running_commands: HashMap<String, RunningCommand>,
-    running_patch_applies: HashMap<String, PatchApplyBeginEvent>,
-    // Tracks the todo list for the current turn (at most one per turn).
-    running_todo_list: Option<RunningTodoList>,
-    last_total_token_usage: Option<codex_core::protocol::TokenUsage>,
-}
-
-#[derive(Debug, Clone)]
-struct RunningCommand {
-    command: String,
-    item_id: String,
-}
-
-#[derive(Debug, Clone)]
-struct RunningTodoList {
-    item_id: String,
-    items: Vec<TodoItem>,
-}
-
-impl ExperimentalEventProcessorWithJsonOutput {
-    pub fn new(last_message_path: Option<PathBuf>) -> Self {
-        Self {
-            last_message_path,
-            next_event_id: AtomicU64::new(0),
-            running_commands: HashMap::new(),
-            running_patch_applies: HashMap::new(),
-            running_todo_list: None,
-            last_total_token_usage: None,
-        }
-    }
-
-    pub fn collect_conversation_events(&mut self, event: &Event) -> Vec<ConversationEvent> {
-        match &event.msg {
-            EventMsg::SessionConfigured(ev) => self.handle_session_configured(ev),
-            EventMsg::AgentMessage(ev) => self.handle_agent_message(ev),
-            EventMsg::AgentReasoning(ev) => self.handle_reasoning_event(ev),
-            EventMsg::ExecCommandBegin(ev) => self.handle_exec_command_begin(ev),
-            EventMsg::ExecCommandEnd(ev) => self.handle_exec_command_end(ev),
-            EventMsg::PatchApplyBegin(ev) => self.handle_patch_apply_begin(ev),
-            EventMsg::PatchApplyEnd(ev) => self.handle_patch_apply_end(ev),
-            EventMsg::TokenCount(ev) => {
-                if let Some(info) = &ev.info {
-                    self.last_total_token_usage = Some(info.total_token_usage.clone());
-                }
-                Vec::new()
-            }
-            EventMsg::TaskStarted(ev) => self.handle_task_started(ev),
-            EventMsg::TaskComplete(_) => self.handle_task_complete(),
-            EventMsg::Error(ev) => vec![ConversationEvent::Error(ConversationErrorEvent {
-                message: ev.message.clone(),
-            })],
-            EventMsg::StreamError(ev) => vec![ConversationEvent::Error(ConversationErrorEvent {
-                message: ev.message.clone(),
-            })],
-            EventMsg::PlanUpdate(ev) => self.handle_plan_update(ev),
-            _ => Vec::new(),
-        }
-    }
-
-    fn get_next_item_id(&self) -> String {
-        format!(
-            "item_{}",
-            self.next_event_id
-                .fetch_add(1, std::sync::atomic::Ordering::SeqCst)
-        )
-    }
-
-    fn handle_session_configured(
-        &self,
-        payload: &SessionConfiguredEvent,
-    ) -> Vec<ConversationEvent> {
-        vec![ConversationEvent::SessionCreated(SessionCreatedEvent {
-            session_id: payload.session_id.to_string(),
-        })]
-    }
-
-    fn handle_agent_message(&self, payload: &AgentMessageEvent) -> Vec<ConversationEvent> {
-        let item = ConversationItem {
-            id: self.get_next_item_id(),
-
-            details: ConversationItemDetails::AssistantMessage(AssistantMessageItem {
-                text: payload.message.clone(),
-            }),
-        };
-
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item,
-        })]
-    }
-
-    fn handle_reasoning_event(&self, ev: &AgentReasoningEvent) -> Vec<ConversationEvent> {
-        let item = ConversationItem {
-            id: self.get_next_item_id(),
-
-            details: ConversationItemDetails::Reasoning(ReasoningItem {
-                text: ev.text.clone(),
-            }),
-        };
-
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item,
-        })]
-    }
-    fn handle_exec_command_begin(&mut self, ev: &ExecCommandBeginEvent) -> Vec<ConversationEvent> {
-        let item_id = self.get_next_item_id();
-
-        let command_string = match shlex::try_join(ev.command.iter().map(String::as_str)) {
-            Ok(command_string) => command_string,
-            Err(e) => {
-                warn!(
-                    call_id = ev.call_id,
-                    "Failed to stringify command: {e:?}; skipping item.started"
-                );
-                ev.command.join(" ")
-            }
-        };
-
-        self.running_commands.insert(
-            ev.call_id.clone(),
-            RunningCommand {
-                command: command_string.clone(),
-                item_id: item_id.clone(),
-            },
-        );
-
-        let item = ConversationItem {
-            id: item_id,
-            details: ConversationItemDetails::CommandExecution(CommandExecutionItem {
-                command: command_string,
-                aggregated_output: String::new(),
-                exit_code: None,
-                status: CommandExecutionStatus::InProgress,
-            }),
-        };
-
-        vec![ConversationEvent::ItemStarted(ItemStartedEvent { item })]
-    }
-
-    fn handle_patch_apply_begin(&mut self, ev: &PatchApplyBeginEvent) -> Vec<ConversationEvent> {
-        self.running_patch_applies
-            .insert(ev.call_id.clone(), ev.clone());
-
-        Vec::new()
-    }
-
-    fn map_change_kind(&self, kind: &FileChange) -> PatchChangeKind {
-        match kind {
-            FileChange::Add { .. } => PatchChangeKind::Add,
-            FileChange::Delete { .. } => PatchChangeKind::Delete,
-            FileChange::Update { .. } => PatchChangeKind::Update,
-        }
-    }
-
-    fn handle_patch_apply_end(&mut self, ev: &PatchApplyEndEvent) -> Vec<ConversationEvent> {
-        if let Some(running_patch_apply) = self.running_patch_applies.remove(&ev.call_id) {
-            let status = if ev.success {
-                PatchApplyStatus::Completed
-            } else {
-                PatchApplyStatus::Failed
-            };
-            let item = ConversationItem {
-                id: self.get_next_item_id(),
-
-                details: ConversationItemDetails::FileChange(FileChangeItem {
-                    changes: running_patch_apply
-                        .changes
-                        .iter()
-                        .map(|(path, change)| FileUpdateChange {
-                            path: path.to_str().unwrap_or("").to_string(),
-                            kind: self.map_change_kind(change),
-                        })
-                        .collect(),
-                    status,
-                }),
-            };
-
-            return vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-                item,
-            })];
-        }
-
-        Vec::new()
-    }
-
-    fn handle_exec_command_end(&mut self, ev: &ExecCommandEndEvent) -> Vec<ConversationEvent> {
-        let Some(RunningCommand { command, item_id }) = self.running_commands.remove(&ev.call_id)
-        else {
-            warn!(
-                call_id = ev.call_id,
-                "ExecCommandEnd without matching ExecCommandBegin; skipping item.completed"
-            );
-            return Vec::new();
-        };
-        let status = if ev.exit_code == 0 {
-            CommandExecutionStatus::Completed
-        } else {
-            CommandExecutionStatus::Failed
-        };
-        let item = ConversationItem {
-            id: item_id,
-
-            details: ConversationItemDetails::CommandExecution(CommandExecutionItem {
-                command,
-                aggregated_output: ev.aggregated_output.clone(),
-                exit_code: Some(ev.exit_code),
-                status,
-            }),
-        };
-
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item,
-        })]
-    }
-
-    fn todo_items_from_plan(&self, args: &UpdatePlanArgs) -> Vec<TodoItem> {
-        args.plan
-            .iter()
-            .map(|p| TodoItem {
-                text: p.step.clone(),
-                completed: matches!(p.status, StepStatus::Completed),
-            })
-            .collect()
-    }
-
-    fn handle_plan_update(&mut self, args: &UpdatePlanArgs) -> Vec<ConversationEvent> {
-        let items = self.todo_items_from_plan(args);
-
-        if let Some(running) = &mut self.running_todo_list {
-            running.items = items.clone();
-            let item = ConversationItem {
-                id: running.item_id.clone(),
-                details: ConversationItemDetails::TodoList(TodoListItem { items }),
-            };
-            return vec![ConversationEvent::ItemUpdated(ItemUpdatedEvent { item })];
-        }
-
-        let item_id = self.get_next_item_id();
-        self.running_todo_list = Some(RunningTodoList {
-            item_id: item_id.clone(),
-            items: items.clone(),
-        });
-        let item = ConversationItem {
-            id: item_id,
-            details: ConversationItemDetails::TodoList(TodoListItem { items }),
-        };
-        vec![ConversationEvent::ItemStarted(ItemStartedEvent { item })]
-    }
-
-    fn handle_task_started(&self, _: &TaskStartedEvent) -> Vec<ConversationEvent> {
-        vec![ConversationEvent::TurnStarted(TurnStartedEvent {})]
-    }
-
-    fn handle_task_complete(&mut self) -> Vec<ConversationEvent> {
-        let usage = if let Some(u) = &self.last_total_token_usage {
-            Usage {
-                input_tokens: u.input_tokens,
-                cached_input_tokens: u.cached_input_tokens,
-                output_tokens: u.output_tokens,
-            }
-        } else {
-            Usage::default()
-        };
-
-        let mut items = Vec::new();
-
-        if let Some(running) = self.running_todo_list.take() {
-            let item = ConversationItem {
-                id: running.item_id,
-                details: ConversationItemDetails::TodoList(TodoListItem {
-                    items: running.items,
-                }),
-            };
-            items.push(ConversationEvent::ItemCompleted(ItemCompletedEvent {
-                item,
-            }));
-        }
-
-        items.push(ConversationEvent::TurnCompleted(TurnCompletedEvent {
-            usage,
-        }));
-
-        items
-    }
-}
-
-impl EventProcessor for ExperimentalEventProcessorWithJsonOutput {
-    fn print_config_summary(&mut self, _: &Config, _: &str, ev: &SessionConfiguredEvent) {
-        self.process_event(Event {
-            id: "".to_string(),
-            msg: EventMsg::SessionConfigured(ev.clone()),
-        });
-    }
-
-    fn process_event(&mut self, event: Event) -> CodexStatus {
-        let aggregated = self.collect_conversation_events(&event);
-        for conv_event in aggregated {
-            match serde_json::to_string(&conv_event) {
-                Ok(line) => {
-                    println!("{line}");
-                }
-                Err(e) => {
-                    error!("Failed to serialize event: {e:?}");
-                }
-            }
-        }
-
-        let Event { msg, .. } = event;
-
-        if let EventMsg::TaskComplete(TaskCompleteEvent { last_agent_message }) = msg {
-            if let Some(output_file) = self.last_message_path.as_deref() {
-                handle_last_message(last_agent_message.as_deref(), output_file);
-            }
-            CodexStatus::InitiateShutdown
-        } else {
-            CodexStatus::Running
-        }
-    }
-}
--- a/codex-rs/exec/src/lib.rs
+++ b/codex-rs/exec/src/lib.rs
@@ -1,9 +1,7 @@
 mod cli;
 mod event_processor;
 mod event_processor_with_human_output;
-pub mod event_processor_with_json_output;
-pub mod exec_events;
-pub mod experimental_event_processor_with_json_output;
+mod event_processor_with_json_output;

 use std::io::IsTerminal;
 use std::io::Read;
@@ -26,7 +24,7 @@ use codex_core::protocol::TaskCompleteEvent;
 use codex_ollama::DEFAULT_OSS_MODEL;
 use codex_protocol::config_types::SandboxMode;
 use event_processor_with_human_output::EventProcessorWithHumanOutput;
-use experimental_event_processor_with_json_output::ExperimentalEventProcessorWithJsonOutput;
+use event_processor_with_json_output::EventProcessorWithJsonOutput;
 use serde_json::Value;
 use tracing::debug;
 use tracing::error;
@@ -36,7 +34,6 @@ use tracing_subscriber::EnvFilter;
 use crate::cli::Command as ExecCommand;
 use crate::event_processor::CodexStatus;
 use crate::event_processor::EventProcessor;
-use crate::event_processor_with_json_output::EventProcessorWithJsonOutput;
 use codex_core::find_conversation_path_by_id_str;

 pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()> {
@@ -53,7 +50,6 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
        color,
        last_message_file,
        json: json_mode,
-        experimental_json,
        sandbox_mode: sandbox_mode_cli_arg,
        prompt,
        output_schema: output_schema_path,
@@ -171,7 +167,6 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
        include_view_image_tool: None,
        show_raw_agent_reasoning: oss.then_some(true),
        tools_web_search_request: None,
-        enable_git_worktree: None,
    };
    // Parse `-c` overrides.
    let cli_kv_overrides = match config_overrides.parse_overrides() {
@@ -183,22 +178,14 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
    };

    let config = Config::load_with_cli_overrides(cli_kv_overrides, overrides)?;
-    let mut event_processor: Box<dyn EventProcessor> = match (json_mode, experimental_json) {
-        (_, true) => Box::new(ExperimentalEventProcessorWithJsonOutput::new(
-            last_message_file.clone(),
-        )),
-        (true, _) => {
-            eprintln!(
-                "The existing `--json` output format is being deprecated. Please try the new format using `--experimental-json`."
-            );
-
-            Box::new(EventProcessorWithJsonOutput::new(last_message_file.clone()))
-        }
-        _ => Box::new(EventProcessorWithHumanOutput::create_with_ansi(
+    let mut event_processor: Box<dyn EventProcessor> = if json_mode {
+        Box::new(EventProcessorWithJsonOutput::new(last_message_file.clone()))
+    } else {
+        Box::new(EventProcessorWithHumanOutput::create_with_ansi(
            stdout_with_ansi,
            &config,
            last_message_file.clone(),
-        )),
+        ))
    };

    if oss {
@@ -207,6 +194,10 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
            .map_err(|e| anyhow::anyhow!("OSS setup failed: {e}"))?;
    }

+    // Print the effective configuration and prompt so users can see what Codex
+    // is using.
+    event_processor.print_config_summary(&config, &prompt);
+
    let default_cwd = config.cwd.to_path_buf();
    let default_approval_policy = config.approval_policy;
    let default_sandbox_policy = config.sandbox_policy.clone();
@@ -239,19 +230,11 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
                )
                .await?
        } else {
-            conversation_manager
-                .new_conversation(config.clone())
-                .await?
+            conversation_manager.new_conversation(config).await?
        }
    } else {
-        conversation_manager
-            .new_conversation(config.clone())
-            .await?
+        conversation_manager.new_conversation(config).await?
    };
-    // Print the effective configuration and prompt so users can see what Codex
-    // is using.
-    event_processor.print_config_summary(&config, &prompt, &session_configured);
-
    info!("Codex initialized with event: {session_configured:?}");

    let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel::<Event>();
@@ -332,13 +315,7 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
    info!("Sent prompt with event ID: {initial_prompt_task_id}");

    // Run the loop until the task is complete.
-    // Track whether a fatal error was reported by the server so we can
-    // exit with a non-zero status for automation-friendly signaling.
-    let mut error_seen = false;
    while let Some(event) = rx.recv().await {
-        if matches!(event.msg, EventMsg::Error(_)) {
-            error_seen = true;
-        }
        let shutdown: CodexStatus = event_processor.process_event(event);
        match shutdown {
            CodexStatus::Running => continue,
@@ -350,9 +327,6 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
            }
        }
    }
-    if error_seen {
-        std::process::exit(1);
-    }

    Ok(())
 }
--- a/codex-rs/exec/tests/all.rs
+++ b/codex-rs/exec/tests/all.rs
@@ -1,5 +1,3 @@
 // Single integration test binary that aggregates all test modules.
 // The submodules live in `tests/suite/`.
 mod suite;
-
-mod event_processor_with_json_output;
--- a/codex-rs/exec/tests/event_processor_with_json_output.rs
+++ b/codex-rs/exec/tests/event_processor_with_json_output.rs
@@ -1,661 +0,0 @@
-use codex_core::protocol::AgentMessageEvent;
-use codex_core::protocol::AgentReasoningEvent;
-use codex_core::protocol::Event;
-use codex_core::protocol::EventMsg;
-use codex_core::protocol::ExecCommandBeginEvent;
-use codex_core::protocol::ExecCommandEndEvent;
-use codex_core::protocol::FileChange;
-use codex_core::protocol::PatchApplyBeginEvent;
-use codex_core::protocol::PatchApplyEndEvent;
-use codex_core::protocol::SessionConfiguredEvent;
-use codex_exec::exec_events::AssistantMessageItem;
-use codex_exec::exec_events::CommandExecutionItem;
-use codex_exec::exec_events::CommandExecutionStatus;
-use codex_exec::exec_events::ConversationErrorEvent;
-use codex_exec::exec_events::ConversationEvent;
-use codex_exec::exec_events::ConversationItem;
-use codex_exec::exec_events::ConversationItemDetails;
-use codex_exec::exec_events::ItemCompletedEvent;
-use codex_exec::exec_events::ItemStartedEvent;
-use codex_exec::exec_events::ItemUpdatedEvent;
-use codex_exec::exec_events::PatchApplyStatus;
-use codex_exec::exec_events::PatchChangeKind;
-use codex_exec::exec_events::ReasoningItem;
-use codex_exec::exec_events::SessionCreatedEvent;
-use codex_exec::exec_events::TodoItem as ExecTodoItem;
-use codex_exec::exec_events::TodoListItem as ExecTodoListItem;
-use codex_exec::exec_events::TurnCompletedEvent;
-use codex_exec::exec_events::TurnStartedEvent;
-use codex_exec::exec_events::Usage;
-use codex_exec::experimental_event_processor_with_json_output::ExperimentalEventProcessorWithJsonOutput;
-use pretty_assertions::assert_eq;
-use std::path::PathBuf;
-use std::time::Duration;
-
-fn event(id: &str, msg: EventMsg) -> Event {
-    Event {
-        id: id.to_string(),
-        msg,
-    }
-}
-
-#[test]
-fn session_configured_produces_session_created_event() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-    let session_id = codex_protocol::mcp_protocol::ConversationId::from_string(
-        "67e55044-10b1-426f-9247-bb680e5fe0c8",
-    )
-    .unwrap();
-    let rollout_path = PathBuf::from("/tmp/rollout.json");
-    let ev = event(
-        "e1",
-        EventMsg::SessionConfigured(SessionConfiguredEvent {
-            session_id,
-            model: "codex-mini-latest".to_string(),
-            reasoning_effort: None,
-            history_log_id: 0,
-            history_entry_count: 0,
-            initial_messages: None,
-            rollout_path,
-            worktree_path: None,
-        }),
-    );
-    let out = ep.collect_conversation_events(&ev);
-    assert_eq!(
-        out,
-        vec![ConversationEvent::SessionCreated(SessionCreatedEvent {
-            session_id: "67e55044-10b1-426f-9247-bb680e5fe0c8".to_string(),
-        })]
-    );
-}
-
-#[test]
-fn task_started_produces_turn_started_event() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-    let out = ep.collect_conversation_events(&event(
-        "t1",
-        EventMsg::TaskStarted(codex_core::protocol::TaskStartedEvent {
-            model_context_window: Some(32_000),
-        }),
-    ));
-
-    assert_eq!(
-        out,
-        vec![ConversationEvent::TurnStarted(TurnStartedEvent {})]
-    );
-}
-
-#[test]
-fn plan_update_emits_todo_list_started_updated_and_completed() {
-    use codex_core::plan_tool::PlanItemArg;
-    use codex_core::plan_tool::StepStatus;
-    use codex_core::plan_tool::UpdatePlanArgs;
-
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // First plan update => item.started (todo_list)
-    let first = event(
-        "p1",
-        EventMsg::PlanUpdate(UpdatePlanArgs {
-            explanation: None,
-            plan: vec![
-                PlanItemArg {
-                    step: "step one".to_string(),
-                    status: StepStatus::Pending,
-                },
-                PlanItemArg {
-                    step: "step two".to_string(),
-                    status: StepStatus::InProgress,
-                },
-            ],
-        }),
-    );
-    let out_first = ep.collect_conversation_events(&first);
-    assert_eq!(
-        out_first,
-        vec![ConversationEvent::ItemStarted(ItemStartedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::TodoList(ExecTodoListItem {
-                    items: vec![
-                        ExecTodoItem {
-                            text: "step one".to_string(),
-                            completed: false
-                        },
-                        ExecTodoItem {
-                            text: "step two".to_string(),
-                            completed: false
-                        },
-                    ],
-                }),
-            },
-        })]
-    );
-
-    // Second plan update in same turn => item.updated (same id)
-    let second = event(
-        "p2",
-        EventMsg::PlanUpdate(UpdatePlanArgs {
-            explanation: None,
-            plan: vec![
-                PlanItemArg {
-                    step: "step one".to_string(),
-                    status: StepStatus::Completed,
-                },
-                PlanItemArg {
-                    step: "step two".to_string(),
-                    status: StepStatus::InProgress,
-                },
-            ],
-        }),
-    );
-    let out_second = ep.collect_conversation_events(&second);
-    assert_eq!(
-        out_second,
-        vec![ConversationEvent::ItemUpdated(ItemUpdatedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::TodoList(ExecTodoListItem {
-                    items: vec![
-                        ExecTodoItem {
-                            text: "step one".to_string(),
-                            completed: true
-                        },
-                        ExecTodoItem {
-                            text: "step two".to_string(),
-                            completed: false
-                        },
-                    ],
-                }),
-            },
-        })]
-    );
-
-    // Task completes => item.completed (same id, latest state)
-    let complete = event(
-        "p3",
-        EventMsg::TaskComplete(codex_core::protocol::TaskCompleteEvent {
-            last_agent_message: None,
-        }),
-    );
-    let out_complete = ep.collect_conversation_events(&complete);
-    assert_eq!(
-        out_complete,
-        vec![
-            ConversationEvent::ItemCompleted(ItemCompletedEvent {
-                item: ConversationItem {
-                    id: "item_0".to_string(),
-                    details: ConversationItemDetails::TodoList(ExecTodoListItem {
-                        items: vec![
-                            ExecTodoItem {
-                                text: "step one".to_string(),
-                                completed: true
-                            },
-                            ExecTodoItem {
-                                text: "step two".to_string(),
-                                completed: false
-                            },
-                        ],
-                    }),
-                },
-            }),
-            ConversationEvent::TurnCompleted(TurnCompletedEvent {
-                usage: Usage::default(),
-            }),
-        ]
-    );
-}
-
-#[test]
-fn plan_update_after_complete_starts_new_todo_list_with_new_id() {
-    use codex_core::plan_tool::PlanItemArg;
-    use codex_core::plan_tool::StepStatus;
-    use codex_core::plan_tool::UpdatePlanArgs;
-
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // First turn: start + complete
-    let start = event(
-        "t1",
-        EventMsg::PlanUpdate(UpdatePlanArgs {
-            explanation: None,
-            plan: vec![PlanItemArg {
-                step: "only".to_string(),
-                status: StepStatus::Pending,
-            }],
-        }),
-    );
-    let _ = ep.collect_conversation_events(&start);
-    let complete = event(
-        "t2",
-        EventMsg::TaskComplete(codex_core::protocol::TaskCompleteEvent {
-            last_agent_message: None,
-        }),
-    );
-    let _ = ep.collect_conversation_events(&complete);
-
-    // Second turn: a new todo list should have a new id
-    let start_again = event(
-        "t3",
-        EventMsg::PlanUpdate(UpdatePlanArgs {
-            explanation: None,
-            plan: vec![PlanItemArg {
-                step: "again".to_string(),
-                status: StepStatus::Pending,
-            }],
-        }),
-    );
-    let out = ep.collect_conversation_events(&start_again);
-
-    match &out[0] {
-        ConversationEvent::ItemStarted(ItemStartedEvent { item }) => {
-            assert_eq!(&item.id, "item_1");
-        }
-        other => panic!("unexpected event: {other:?}"),
-    }
-}
-
-#[test]
-fn agent_reasoning_produces_item_completed_reasoning() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-    let ev = event(
-        "e1",
-        EventMsg::AgentReasoning(AgentReasoningEvent {
-            text: "thinking...".to_string(),
-        }),
-    );
-    let out = ep.collect_conversation_events(&ev);
-    assert_eq!(
-        out,
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::Reasoning(ReasoningItem {
-                    text: "thinking...".to_string(),
-                }),
-            },
-        })]
-    );
-}
-
-#[test]
-fn agent_message_produces_item_completed_assistant_message() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-    let ev = event(
-        "e1",
-        EventMsg::AgentMessage(AgentMessageEvent {
-            message: "hello".to_string(),
-        }),
-    );
-    let out = ep.collect_conversation_events(&ev);
-    assert_eq!(
-        out,
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::AssistantMessage(AssistantMessageItem {
-                    text: "hello".to_string(),
-                }),
-            },
-        })]
-    );
-}
-
-#[test]
-fn error_event_produces_error() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-    let out = ep.collect_conversation_events(&event(
-        "e1",
-        EventMsg::Error(codex_core::protocol::ErrorEvent {
-            message: "boom".to_string(),
-        }),
-    ));
-    assert_eq!(
-        out,
-        vec![ConversationEvent::Error(ConversationErrorEvent {
-            message: "boom".to_string(),
-        })]
-    );
-}
-
-#[test]
-fn stream_error_event_produces_error() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-    let out = ep.collect_conversation_events(&event(
-        "e1",
-        EventMsg::StreamError(codex_core::protocol::StreamErrorEvent {
-            message: "retrying".to_string(),
-        }),
-    ));
-    assert_eq!(
-        out,
-        vec![ConversationEvent::Error(ConversationErrorEvent {
-            message: "retrying".to_string(),
-        })]
-    );
-}
-
-#[test]
-fn exec_command_end_success_produces_completed_command_item() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // Begin -> no output
-    let begin = event(
-        "c1",
-        EventMsg::ExecCommandBegin(ExecCommandBeginEvent {
-            call_id: "1".to_string(),
-            command: vec!["bash".to_string(), "-lc".to_string(), "echo hi".to_string()],
-            cwd: std::env::current_dir().unwrap(),
-            parsed_cmd: Vec::new(),
-        }),
-    );
-    let out_begin = ep.collect_conversation_events(&begin);
-    assert_eq!(
-        out_begin,
-        vec![ConversationEvent::ItemStarted(ItemStartedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::CommandExecution(CommandExecutionItem {
-                    command: "bash -lc 'echo hi'".to_string(),
-                    aggregated_output: String::new(),
-                    exit_code: None,
-                    status: CommandExecutionStatus::InProgress,
-                }),
-            },
-        })]
-    );
-
-    // End (success) -> item.completed (item_0)
-    let end_ok = event(
-        "c2",
-        EventMsg::ExecCommandEnd(ExecCommandEndEvent {
-            call_id: "1".to_string(),
-            stdout: String::new(),
-            stderr: String::new(),
-            aggregated_output: "hi\n".to_string(),
-            exit_code: 0,
-            duration: Duration::from_millis(5),
-            formatted_output: String::new(),
-        }),
-    );
-    let out_ok = ep.collect_conversation_events(&end_ok);
-    assert_eq!(
-        out_ok,
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::CommandExecution(CommandExecutionItem {
-                    command: "bash -lc 'echo hi'".to_string(),
-                    aggregated_output: "hi\n".to_string(),
-                    exit_code: Some(0),
-                    status: CommandExecutionStatus::Completed,
-                }),
-            },
-        })]
-    );
-}
-
-#[test]
-fn exec_command_end_failure_produces_failed_command_item() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // Begin -> no output
-    let begin = event(
-        "c1",
-        EventMsg::ExecCommandBegin(ExecCommandBeginEvent {
-            call_id: "2".to_string(),
-            command: vec!["sh".to_string(), "-c".to_string(), "exit 1".to_string()],
-            cwd: std::env::current_dir().unwrap(),
-            parsed_cmd: Vec::new(),
-        }),
-    );
-    assert_eq!(
-        ep.collect_conversation_events(&begin),
-        vec![ConversationEvent::ItemStarted(ItemStartedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::CommandExecution(CommandExecutionItem {
-                    command: "sh -c 'exit 1'".to_string(),
-                    aggregated_output: String::new(),
-                    exit_code: None,
-                    status: CommandExecutionStatus::InProgress,
-                }),
-            },
-        })]
-    );
-
-    // End (failure) -> item.completed (item_0)
-    let end_fail = event(
-        "c2",
-        EventMsg::ExecCommandEnd(ExecCommandEndEvent {
-            call_id: "2".to_string(),
-            stdout: String::new(),
-            stderr: String::new(),
-            aggregated_output: String::new(),
-            exit_code: 1,
-            duration: Duration::from_millis(2),
-            formatted_output: String::new(),
-        }),
-    );
-    let out_fail = ep.collect_conversation_events(&end_fail);
-    assert_eq!(
-        out_fail,
-        vec![ConversationEvent::ItemCompleted(ItemCompletedEvent {
-            item: ConversationItem {
-                id: "item_0".to_string(),
-                details: ConversationItemDetails::CommandExecution(CommandExecutionItem {
-                    command: "sh -c 'exit 1'".to_string(),
-                    aggregated_output: String::new(),
-                    exit_code: Some(1),
-                    status: CommandExecutionStatus::Failed,
-                }),
-            },
-        })]
-    );
-}
-
-#[test]
-fn exec_command_end_without_begin_is_ignored() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // End event arrives without a prior Begin; should produce no conversation events.
-    let end_only = event(
-        "c1",
-        EventMsg::ExecCommandEnd(ExecCommandEndEvent {
-            call_id: "no-begin".to_string(),
-            stdout: String::new(),
-            stderr: String::new(),
-            aggregated_output: String::new(),
-            exit_code: 0,
-            duration: Duration::from_millis(1),
-            formatted_output: String::new(),
-        }),
-    );
-    let out = ep.collect_conversation_events(&end_only);
-    assert!(out.is_empty());
-}
-
-#[test]
-fn patch_apply_success_produces_item_completed_patchapply() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // Prepare a patch with multiple kinds of changes
-    let mut changes = std::collections::HashMap::new();
-    changes.insert(
-        PathBuf::from("a/added.txt"),
-        FileChange::Add {
-            content: "+hello".to_string(),
-        },
-    );
-    changes.insert(
-        PathBuf::from("b/deleted.txt"),
-        FileChange::Delete {
-            content: "-goodbye".to_string(),
-        },
-    );
-    changes.insert(
-        PathBuf::from("c/modified.txt"),
-        FileChange::Update {
-            unified_diff: "--- c/modified.txt\n+++ c/modified.txt\n@@\n-old\n+new\n".to_string(),
-            move_path: Some(PathBuf::from("c/renamed.txt")),
-        },
-    );
-
-    // Begin -> no output
-    let begin = event(
-        "p1",
-        EventMsg::PatchApplyBegin(PatchApplyBeginEvent {
-            call_id: "call-1".to_string(),
-            auto_approved: true,
-            changes: changes.clone(),
-        }),
-    );
-    let out_begin = ep.collect_conversation_events(&begin);
-    assert!(out_begin.is_empty());
-
-    // End (success) -> item.completed (item_0)
-    let end = event(
-        "p2",
-        EventMsg::PatchApplyEnd(PatchApplyEndEvent {
-            call_id: "call-1".to_string(),
-            stdout: "applied 3 changes".to_string(),
-            stderr: String::new(),
-            success: true,
-        }),
-    );
-    let out_end = ep.collect_conversation_events(&end);
-    assert_eq!(out_end.len(), 1);
-
-    // Validate structure without relying on HashMap iteration order
-    match &out_end[0] {
-        ConversationEvent::ItemCompleted(ItemCompletedEvent { item }) => {
-            assert_eq!(&item.id, "item_0");
-            match &item.details {
-                ConversationItemDetails::FileChange(file_update) => {
-                    assert_eq!(file_update.status, PatchApplyStatus::Completed);
-
-                    let mut actual: Vec<(String, PatchChangeKind)> = file_update
-                        .changes
-                        .iter()
-                        .map(|c| (c.path.clone(), c.kind.clone()))
-                        .collect();
-                    actual.sort_by(|a, b| a.0.cmp(&b.0));
-
-                    let mut expected = vec![
-                        ("a/added.txt".to_string(), PatchChangeKind::Add),
-                        ("b/deleted.txt".to_string(), PatchChangeKind::Delete),
-                        ("c/modified.txt".to_string(), PatchChangeKind::Update),
-                    ];
-                    expected.sort_by(|a, b| a.0.cmp(&b.0));
-
-                    assert_eq!(actual, expected);
-                }
-                other => panic!("unexpected details: {other:?}"),
-            }
-        }
-        other => panic!("unexpected event: {other:?}"),
-    }
-}
-
-#[test]
-fn patch_apply_failure_produces_item_completed_patchapply_failed() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    let mut changes = std::collections::HashMap::new();
-    changes.insert(
-        PathBuf::from("file.txt"),
-        FileChange::Update {
-            unified_diff: "--- file.txt\n+++ file.txt\n@@\n-old\n+new\n".to_string(),
-            move_path: None,
-        },
-    );
-
-    // Begin -> no output
-    let begin = event(
-        "p1",
-        EventMsg::PatchApplyBegin(PatchApplyBeginEvent {
-            call_id: "call-2".to_string(),
-            auto_approved: false,
-            changes: changes.clone(),
-        }),
-    );
-    assert!(ep.collect_conversation_events(&begin).is_empty());
-
-    // End (failure) -> item.completed (item_0) with Failed status
-    let end = event(
-        "p2",
-        EventMsg::PatchApplyEnd(PatchApplyEndEvent {
-            call_id: "call-2".to_string(),
-            stdout: String::new(),
-            stderr: "failed to apply".to_string(),
-            success: false,
-        }),
-    );
-    let out_end = ep.collect_conversation_events(&end);
-    assert_eq!(out_end.len(), 1);
-
-    match &out_end[0] {
-        ConversationEvent::ItemCompleted(ItemCompletedEvent { item }) => {
-            assert_eq!(&item.id, "item_0");
-            match &item.details {
-                ConversationItemDetails::FileChange(file_update) => {
-                    assert_eq!(file_update.status, PatchApplyStatus::Failed);
-                    assert_eq!(file_update.changes.len(), 1);
-                    assert_eq!(file_update.changes[0].path, "file.txt".to_string());
-                    assert_eq!(file_update.changes[0].kind, PatchChangeKind::Update);
-                }
-                other => panic!("unexpected details: {other:?}"),
-            }
-        }
-        other => panic!("unexpected event: {other:?}"),
-    }
-}
-
-#[test]
-fn task_complete_produces_turn_completed_with_usage() {
-    let mut ep = ExperimentalEventProcessorWithJsonOutput::new(None);
-
-    // First, feed a TokenCount event with known totals.
-    let usage = codex_core::protocol::TokenUsage {
-        input_tokens: 1200,
-        cached_input_tokens: 200,
-        output_tokens: 345,
-        reasoning_output_tokens: 0,
-        total_tokens: 0,
-    };
-    let info = codex_core::protocol::TokenUsageInfo {
-        total_token_usage: usage.clone(),
-        last_token_usage: usage,
-        model_context_window: None,
-    };
-    let token_count_event = event(
-        "e1",
-        EventMsg::TokenCount(codex_core::protocol::TokenCountEvent {
-            info: Some(info),
-            rate_limits: None,
-        }),
-    );
-    assert!(
-        ep.collect_conversation_events(&token_count_event)
-            .is_empty()
-    );
-
-    // Then TaskComplete should produce turn.completed with the captured usage.
-    let complete_event = event(
-        "e2",
-        EventMsg::TaskComplete(codex_core::protocol::TaskCompleteEvent {
-            last_agent_message: Some("done".to_string()),
-        }),
-    );
-    let out = ep.collect_conversation_events(&complete_event);
-    assert_eq!(
-        out,
-        vec![ConversationEvent::TurnCompleted(TurnCompletedEvent {
-            usage: Usage {
-                input_tokens: 1200,
-                cached_input_tokens: 200,
-                output_tokens: 345,
-            },
-        })]
-    );
-}
--- a/codex-rs/exec/tests/suite/apply_patch.rs
+++ b/codex-rs/exec/tests/suite/apply_patch.rs
@@ -6,9 +6,7 @@ use codex_core::CODEX_APPLY_PATCH_ARG1;
 use core_test_support::responses::ev_apply_patch_custom_tool_call;
 use core_test_support::responses::ev_apply_patch_function_call;
 use core_test_support::responses::ev_completed;
-use core_test_support::responses::mount_sse_sequence;
 use core_test_support::responses::sse;
-use core_test_support::responses::start_mock_server;
 use std::fs;
 use std::process::Command;
 use tempfile::tempdir;
@@ -49,13 +47,13 @@ fn test_standalone_exec_cli_can_use_apply_patch() -> anyhow::Result<()> {
 #[cfg(not(target_os = "windows"))]
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn test_apply_patch_tool() -> anyhow::Result<()> {
-    use core_test_support::skip_if_no_network;
-    use core_test_support::test_codex_exec::test_codex_exec;
+    use crate::suite::common::run_e2e_exec_test;
+    use core_test_support::non_sandbox_test;

-    skip_if_no_network!(Ok(()));
+    non_sandbox_test!(result);

-    let test = test_codex_exec();
-    let tmp_path = test.cwd_path().to_path_buf();
+    let tmp_cwd = tempdir().expect("failed to create temp dir");
+    let tmp_path = tmp_cwd.path().to_path_buf();
    let add_patch = r#"*** Begin Patch
 *** Add File: test.md
 +Hello world
@@ -77,16 +75,7 @@ async fn test_apply_patch_tool() -> anyhow::Result<()> {
        ]),
        sse(vec![ev_completed("request_2")]),
    ];
-    let server = start_mock_server().await;
-    mount_sse_sequence(&server, response_streams).await;
-
-    test.cmd_with_server(&server)
-        .arg("--skip-git-repo-check")
-        .arg("-s")
-        .arg("danger-full-access")
-        .arg("foo")
-        .assert()
-        .success();
+    run_e2e_exec_test(tmp_cwd.path(), response_streams).await;

    let final_path = tmp_path.join("test.md");
    let contents = std::fs::read_to_string(&final_path)
@@ -98,12 +87,12 @@ async fn test_apply_patch_tool() -> anyhow::Result<()> {
 #[cfg(not(target_os = "windows"))]
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn test_apply_patch_freeform_tool() -> anyhow::Result<()> {
-    use core_test_support::skip_if_no_network;
-    use core_test_support::test_codex_exec::test_codex_exec;
+    use crate::suite::common::run_e2e_exec_test;
+    use core_test_support::non_sandbox_test;

-    skip_if_no_network!(Ok(()));
+    non_sandbox_test!(result);

-    let test = test_codex_exec();
+    let tmp_cwd = tempdir().expect("failed to create temp dir");
    let freeform_add_patch = r#"*** Begin Patch
 *** Add File: app.py
 +class BaseClass:
@@ -128,19 +117,10 @@ async fn test_apply_patch_freeform_tool() -> anyhow::Result<()> {
        ]),
        sse(vec![ev_completed("request_2")]),
    ];
-    let server = start_mock_server().await;
-    mount_sse_sequence(&server, response_streams).await;
-
-    test.cmd_with_server(&server)
-        .arg("--skip-git-repo-check")
-        .arg("-s")
-        .arg("danger-full-access")
-        .arg("foo")
-        .assert()
-        .success();
+    run_e2e_exec_test(tmp_cwd.path(), response_streams).await;

    // Verify final file contents
-    let final_path = test.cwd_path().join("app.py");
+    let final_path = tmp_cwd.path().join("app.py");
    let contents = std::fs::read_to_string(&final_path)
        .unwrap_or_else(|e| panic!("failed reading {}: {e}", final_path.display()));
    assert_eq!(
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ahmed Ibrahim	c626bbaa26	rate-limit-error	2025-09-23 22:27:28 -07:00
Ahmed Ibrahim	c2a1d81fc9	rate-limit-error	2025-09-23 21:39:13 -07:00
Ahmed Ibrahim	25c16af3e9	rate-limit-error	2025-09-23 21:35:02 -07:00
Ahmed Ibrahim	a071e72a6c	rebase	2025-09-23 21:28:18 -07:00
Ahmed Ibrahim	69ebfcfa14	rebase	2025-09-23 21:16:14 -07:00
Ahmed Ibrahim	86d45ed0dd	reset-in	2025-09-23 21:14:31 -07:00