rreichel3-oai 02a7205250 [codex] Support multiple forced ChatGPT workspaces (#18161) ...

## Summary

This change lets `forced_chatgpt_workspace_id` accept multiple workspace
IDs instead of a single value.

It keeps the existing config key name, adds backward-compatible parsing
for a single string in `config.toml`, and normalizes the setting into an
allowed workspace list across login enforcement, app-server config
surfaces, and local ChatGPT auth helpers.

## Why

Workspace-restricted deployments may need to allow more than one ChatGPT
workspace without dropping the guardrail entirely.

## Server-side impact

Codex's local server and app-server protocol needed changes because they
previously assumed a single workspace ID. The local login flow now
matches the auth backend interface by sending the allowed workspace list
as a single comma-separated `allowed_workspace_id` query parameter.

## Validation

This was tested with:

- A single workspace config
- With multi-workspace configs
- With multiple workspaces in the config
- The user only being a part of a subset of them

All were successful.

Automated coverage:

- `cargo test -p codex-login`
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-tui local_chatgpt_auth`
- `cargo test --locked -p codex-app-server
login_account_chatgpt_includes_forced_workspace_allowlist_query_param`

2026-05-14 17:11:36 -04:00

..

AccountLoginCompletedNotification.json

…

AccountRateLimitsUpdatedNotification.json

[codex] Propagate rate limit reached type (#18227)

2026-04-17 13:37:25 -07:00

AccountUpdatedNotification.json

feat: add explicit AgentIdentity auth mode (#18785)

2026-04-21 22:33:24 -07:00

AgentMessageDeltaNotification.json

…

AppListUpdatedNotification.json

add @plugin mentions (#13510)

2026-03-06 00:03:39 +00:00

AppsListParams.json

…

AppsListResponse.json

add @plugin mentions (#13510)

2026-03-06 00:03:39 +00:00

CancelLoginAccountParams.json

…

CancelLoginAccountResponse.json

…

CommandExecOutputDeltaNotification.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecParams.json

app-server-protocol: mark permission profiles experimental (#19899)

2026-04-28 06:08:34 +00:00

CommandExecResizeParams.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecResizeResponse.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecResponse.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecTerminateParams.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecTerminateResponse.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecutionOutputDeltaNotification.json

…

CommandExecWriteParams.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

CommandExecWriteResponse.json

app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

2026-03-06 17:30:17 -08:00

ConfigBatchWriteParams.json

[app-server] Support hot-reload user config when batch writing config. (#13839)

2026-03-08 17:38:01 -07:00

ConfigReadParams.json

…

ConfigReadResponse.json

[codex] Support multiple forced ChatGPT workspaces (#18161)

2026-05-14 17:11:36 -04:00

ConfigRequirementsReadResponse.json

Add allow_managed_hooks_only hook requirement (#20319)

2026-05-12 19:05:25 -07:00

ConfigValueWriteParams.json

…

ConfigWarningNotification.json

…

ConfigWriteResponse.json

feat: add layered --profile-v2 config files (#17141)

2026-05-14 15:16:15 +02:00

ContextCompactedNotification.json

…

DeprecationNoticeNotification.json

…

ErrorNotification.json

Add safety check notification and error handling (#19055)

2026-04-22 22:24:12 -07:00

ExperimentalFeatureEnablementSetParams.json

[app-server] Add a method to override feature flags. (#15601)

2026-03-25 02:27:00 +00:00

ExperimentalFeatureEnablementSetResponse.json

[app-server] Add a method to override feature flags. (#15601)

2026-03-25 02:27:00 +00:00

ExperimentalFeatureListParams.json

…

ExperimentalFeatureListResponse.json

…

ExternalAgentConfigDetectParams.json

Support external agent config detect and import (#12660)

2026-02-25 02:11:51 -08:00

ExternalAgentConfigDetectResponse.json

Support detect and import MCP, Subagents, hooks, commands from external (#19949)

2026-04-29 00:45:24 +00:00

ExternalAgentConfigImportCompletedNotification.json

Sync local plugin imports, async remote imports, refresh caches after… (#18246)

2026-04-17 09:34:55 +00:00

ExternalAgentConfigImportParams.json

Support detect and import MCP, Subagents, hooks, commands from external (#19949)

2026-04-29 00:45:24 +00:00

ExternalAgentConfigImportResponse.json

Support external agent config detect and import (#12660)

2026-02-25 02:11:51 -08:00

FeedbackUploadParams.json

Pass turn id with feedback uploads (#17314)

2026-04-11 00:23:50 -07:00

FeedbackUploadResponse.json

…

FileChangeOutputDeltaNotification.json

Stop emitting item/fileChange/outputDelta output delta notifications (#20471)

2026-04-30 11:42:07 -07:00

FileChangePatchUpdatedNotification.json

Wire the PatchUpdated events through app_server (#18289)

2026-04-20 10:44:03 -07:00

FsChangedNotification.json

app-server: Move watch_id to request of fs/watch (#17026)

2026-04-07 11:22:28 -07:00

FsCopyParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsCopyResponse.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsCreateDirectoryParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsCreateDirectoryResponse.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsGetMetadataParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsGetMetadataResponse.json

[codex] Add symlink flag to fs metadata (#17719)

2026-04-13 17:46:56 -07:00

FsReadDirectoryParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsReadDirectoryResponse.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsReadFileParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsReadFileResponse.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsRemoveParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsRemoveResponse.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsUnwatchParams.json

app-server: Move watch_id to request of fs/watch (#17026)

2026-04-07 11:22:28 -07:00

FsUnwatchResponse.json

app-server: add filesystem watch support (#14533)

2026-03-24 15:52:13 -07:00

FsWatchParams.json

app-server: Move watch_id to request of fs/watch (#17026)

2026-04-07 11:22:28 -07:00

FsWatchResponse.json

app-server: Move watch_id to request of fs/watch (#17026)

2026-04-07 11:22:28 -07:00

FsWriteFileParams.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

FsWriteFileResponse.json

app-server: add v2 filesystem APIs (#14245)

2026-03-13 14:42:20 -07:00

GetAccountParams.json

…

GetAccountRateLimitsResponse.json

[codex] Propagate rate limit reached type (#18227)

2026-04-17 13:37:25 -07:00

GetAccountResponse.json

feat: expose AWS account state from account/read (#19048)

2026-04-24 01:53:13 +00:00

GuardianWarningNotification.json

feat(auto-review) short-circuit (#18890)

2026-04-22 20:34:15 +00:00

HookCompletedNotification.json

Add compact lifecycle hooks (started by vincentkoc - external contrib) (#19905)

2026-05-06 18:08:31 -07:00

HooksListParams.json

Add hooks/list app-server RPC (#19778)

2026-04-29 23:39:57 +00:00

HooksListResponse.json

Add compact lifecycle hooks (started by vincentkoc - external contrib) (#19905)

2026-05-06 18:08:31 -07:00

HookStartedNotification.json

Add compact lifecycle hooks (started by vincentkoc - external contrib) (#19905)

2026-05-06 18:08:31 -07:00

ItemCompletedNotification.json

chore(app-server-protocol): split v2 API definitions into modules (#21251)

2026-05-05 16:46:51 -07:00

ItemGuardianApprovalReviewCompletedNotification.json

[codex-analytics] plumb protocol-native review timing (#21434)

2026-05-07 20:31:41 -07:00

ItemGuardianApprovalReviewStartedNotification.json

[codex-analytics] plumb protocol-native review timing (#21434)

2026-05-07 20:31:41 -07:00

ItemStartedNotification.json

chore(app-server-protocol): split v2 API definitions into modules (#21251)

2026-05-05 16:46:51 -07:00

ListMcpServerStatusParams.json

Speed up /mcp inventory listing (#16831)

2026-04-06 16:27:02 -07:00

ListMcpServerStatusResponse.json

…

LoginAccountParams.json

Update Codex login success page UX (#20136)

2026-04-29 19:14:53 -04:00

LoginAccountResponse.json

Add ChatGPT device-code login to app server (#15525)

2026-03-27 00:27:15 -07:00

LogoutAccountResponse.json

…

MarketplaceAddParams.json

[codex] Refactor marketplace add into shared core flow (#17717)

2026-04-13 20:37:11 -07:00

MarketplaceAddResponse.json

[codex] Refactor marketplace add into shared core flow (#17717)

2026-04-13 20:37:11 -07:00

MarketplaceRemoveParams.json

[codex] Add marketplace/remove app-server RPC (#17751)

2026-04-19 23:22:49 -07:00

MarketplaceRemoveResponse.json

[codex] Add marketplace/remove app-server RPC (#17751)

2026-04-19 23:22:49 -07:00

MarketplaceUpgradeParams.json

Add app-server marketplace upgrade RPC (#19074)

2026-04-23 13:00:46 -07:00

MarketplaceUpgradeResponse.json

Add app-server marketplace upgrade RPC (#19074)

2026-04-23 13:00:46 -07:00

McpResourceReadParams.json

Make MCP resource read threadless (#18292)

2026-04-20 19:59:36 -07:00

McpResourceReadResponse.json

[mcp] Support MCP Apps part 1. (#16082)

2026-04-06 19:17:14 -07:00

McpServerOauthLoginCompletedNotification.json

…

McpServerOauthLoginParams.json

…

McpServerOauthLoginResponse.json

…

McpServerRefreshResponse.json

…

McpServerStatusUpdatedNotification.json

feat(app-server): add mcpServer/startupStatus/updated notification (#15220)

2026-03-19 15:09:59 -07:00

McpServerToolCallParams.json

[mcp] Support MCP Apps part 3 - Add mcp tool call support. (#17364)

2026-04-11 04:39:19 +00:00

McpServerToolCallResponse.json

[mcp] Support MCP Apps part 3 - Add mcp tool call support. (#17364)

2026-04-11 04:39:19 +00:00

McpToolCallProgressNotification.json

…

ModelListParams.json

fix: send unfiltered models over model/list (#11793)

2026-02-13 16:26:32 -08:00

ModelListResponse.json

1- Add model service tiers metadata (#20969)

2026-05-05 09:51:18 +03:00

ModelProviderCapabilitiesReadParams.json

feat: expose provider capability bounds to app server clients (#20049)

2026-04-29 01:36:19 +00:00

ModelProviderCapabilitiesReadResponse.json

feat: expose provider capability bounds to app server clients (#20049)

2026-04-29 01:36:19 +00:00

ModelReroutedNotification.json

Feat: add model reroute notification (#12001)

2026-02-17 11:02:23 -08:00

ModelVerificationNotification.json

Add safety check notification and error handling (#19055)

2026-04-22 22:24:12 -07:00

PlanDeltaNotification.json

…

PluginInstallParams.json

feat: Add remote plugin fields to plugin API (#17277)

2026-04-17 16:47:58 -07:00

PluginInstallResponse.json

feat: expose needs_auth for plugin/read. (#15217)

2026-03-19 15:02:45 -07:00

PluginListParams.json

feat: Add marketplace source filtering and plugin share context (#21419)

2026-05-06 16:12:23 -07:00

PluginListResponse.json

feat: Expose plugin versions and gate plugin sharing (#22397)

2026-05-12 17:56:30 -07:00

PluginReadParams.json

feat: Add remote plugin fields to plugin API (#17277)

2026-04-17 16:47:58 -07:00

PluginReadResponse.json

feat: Expose plugin versions and gate plugin sharing (#22397)

2026-05-12 17:56:30 -07:00

PluginShareCheckoutParams.json

feat: Add plugin share checkout (#22435)

2026-05-13 00:50:29 -07:00

PluginShareCheckoutResponse.json

feat: Add plugin share checkout (#22435)

2026-05-13 00:50:29 -07:00

PluginShareDeleteParams.json

feat: Add workspace plugin sharing APIs (#20278)

2026-04-29 23:49:20 -07:00

PluginShareDeleteResponse.json

feat: Add workspace plugin sharing APIs (#20278)

2026-04-29 23:49:20 -07:00

PluginShareListParams.json

feat: Add workspace plugin sharing APIs (#20278)

2026-04-29 23:49:20 -07:00

PluginShareListResponse.json

feat: Expose plugin versions and gate plugin sharing (#22397)

2026-05-12 17:56:30 -07:00

PluginShareSaveParams.json

feat: Add role-aware plugin share context APIs (#21867)

2026-05-08 20:46:39 -07:00

PluginShareSaveResponse.json

feat: Add workspace plugin sharing APIs (#20278)

2026-04-29 23:49:20 -07:00

PluginShareUpdateTargetsParams.json

feat: Add role-aware plugin share context APIs (#21867)

2026-05-08 20:46:39 -07:00

PluginShareUpdateTargetsResponse.json

feat: Add role-aware plugin share context APIs (#21867)

2026-05-08 20:46:39 -07:00

PluginSkillReadParams.json

Add remote plugin skill read API (#20150)

2026-05-01 00:16:25 -07:00

PluginSkillReadResponse.json

Add remote plugin skill read API (#20150)

2026-05-01 00:16:25 -07:00

PluginUninstallParams.json

feat: Add remote plugin fields to plugin API (#17277)

2026-04-17 16:47:58 -07:00

PluginUninstallResponse.json

chore: plugin/uninstall endpoint (#14111)

2026-03-09 12:40:25 -07:00

ProcessExitedNotification.json

[codex] Add unsandboxed process exec API (#19040)

2026-05-04 16:43:58 -07:00

ProcessOutputDeltaNotification.json

[codex] Add unsandboxed process exec API (#19040)

2026-05-04 16:43:58 -07:00

RawResponseItemCompletedNotification.json

feat: add remote compaction v2 Responses client path (#20773)

2026-05-04 14:15:01 +02:00

ReasoningSummaryPartAddedNotification.json

…

ReasoningSummaryTextDeltaNotification.json

…

ReasoningTextDeltaNotification.json

…

RemoteControlStatusChangedNotification.json

feat: Use installation ID in remote enrollments (#21662)

2026-05-08 17:54:01 +00:00

ReviewStartParams.json

…

ReviewStartResponse.json

add turn items view to app-server turns (#21063)

2026-05-05 19:17:16 +00:00

SendAddCreditsNudgeEmailParams.json

[codex] Add owner nudge app-server API (#18220)

2026-04-17 21:41:57 -07:00

SendAddCreditsNudgeEmailResponse.json

[codex] Add owner nudge app-server API (#18220)

2026-04-17 21:41:57 -07:00

ServerRequestResolvedNotification.json

app-server: Replay pending item requests on thread/resume (#12560)

2026-02-27 12:45:59 -08:00

SkillsChangedNotification.json

feat(app-server): add a skills/changed v2 notification (#13414)

2026-03-03 17:01:00 -08:00

SkillsConfigWriteParams.json

feat: support disable skills by name. (#15378)

2026-03-23 12:57:40 -07:00

SkillsConfigWriteResponse.json

…

SkillsListParams.json

Remove skills list extra roots (#21485)

2026-05-07 20:56:42 -07:00

SkillsListResponse.json

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

TerminalInteractionNotification.json

…

ThreadApproveGuardianDeniedActionParams.json

Add plumbing to approve stored Auto-Review denials (#18955)

2026-04-22 10:38:19 -07:00

ThreadApproveGuardianDeniedActionResponse.json

Add plumbing to approve stored Auto-Review denials (#18955)

2026-04-22 10:38:19 -07:00

ThreadArchivedNotification.json

app-server: Emit thread archive/unarchive notifications (#12030)

2026-02-17 14:53:58 -08:00

ThreadArchiveParams.json

…

ThreadArchiveResponse.json

…

ThreadClosedNotification.json

feat(app-server): thread/unsubscribe API (#10954)

2026-02-25 13:14:30 -08:00

ThreadCompactStartParams.json

…

ThreadCompactStartResponse.json

…

ThreadForkParams.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

ThreadForkResponse.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

ThreadGoalClearedNotification.json

Add goal app-server API (2 / 5) (#18074)

2026-04-24 20:53:41 -07:00

ThreadGoalUpdatedNotification.json

Add goal app-server API (2 / 5) (#18074)

2026-04-24 20:53:41 -07:00

ThreadInjectItemsParams.json

Add turn item injection API (#17703)

2026-04-13 16:11:05 -07:00

ThreadInjectItemsResponse.json

Add turn item injection API (#17703)

2026-04-13 16:11:05 -07:00

ThreadListParams.json

Support multiple cwd filters for thread list (#18502)

2026-04-22 06:10:09 -04:00

ThreadListResponse.json

feat(app-server): move v2 sessionId onto Thread (#21336)

2026-05-06 15:23:25 +02:00

ThreadLoadedListParams.json

…

ThreadLoadedListResponse.json

…

ThreadMetadataUpdateParams.json

Add thread metadata update endpoint to app server (#13280)

2026-03-03 15:56:11 -08:00

ThreadMetadataUpdateResponse.json

feat(app-server): move v2 sessionId onto Thread (#21336)

2026-05-06 15:23:25 +02:00

ThreadNameUpdatedNotification.json

…

ThreadReadParams.json

…

ThreadReadResponse.json

feat(app-server): move v2 sessionId onto Thread (#21336)

2026-05-06 15:23:25 +02:00

ThreadRealtimeClosedNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeErrorNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeItemAddedNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeOutputAudioDeltaNotification.json

[stack 2/4] Align main realtime v2 wire and runtime flow (#14830)

2026-03-16 21:38:07 -07:00

ThreadRealtimeSdpNotification.json

Add WebRTC transport to realtime start (#16960)

2026-04-07 15:43:38 -07:00

ThreadRealtimeStartedNotification.json

realtime: rename provider session ids (#20361)

2026-04-30 13:39:48 +03:00

ThreadRealtimeTranscriptDeltaNotification.json

Add realtime output modality and transcript events (#17701)

2026-04-14 00:13:13 -07:00

ThreadRealtimeTranscriptDoneNotification.json

Add realtime output modality and transcript events (#17701)

2026-04-14 00:13:13 -07:00

ThreadResumeParams.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

ThreadResumeResponse.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

ThreadRollbackParams.json

…

ThreadRollbackResponse.json

feat(app-server): move v2 sessionId onto Thread (#21336)

2026-05-06 15:23:25 +02:00

ThreadSetNameParams.json

…

ThreadSetNameResponse.json

…

ThreadShellCommandParams.json

Add thread/shellCommand to app server API surface (#14988)

2026-03-18 23:42:40 -06:00

ThreadShellCommandResponse.json

Add thread/shellCommand to app server API surface (#14988)

2026-03-18 23:42:40 -06:00

ThreadStartedNotification.json

feat(app-server): move v2 sessionId onto Thread (#21336)

2026-05-06 15:23:25 +02:00

ThreadStartParams.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

ThreadStartResponse.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

ThreadStatusChangedNotification.json

app-server: expose loaded thread status via read/list and notifications (#11786)

2026-02-18 15:20:03 -08:00

ThreadTokenUsageUpdatedNotification.json

…

ThreadUnarchivedNotification.json

app-server: Emit thread archive/unarchive notifications (#12030)

2026-02-17 14:53:58 -08:00

ThreadUnarchiveParams.json

…

ThreadUnarchiveResponse.json

feat(app-server): move v2 sessionId onto Thread (#21336)

2026-05-06 15:23:25 +02:00

ThreadUnsubscribeParams.json

feat(app-server): thread/unsubscribe API (#10954)

2026-02-25 13:14:30 -08:00

ThreadUnsubscribeResponse.json

feat(app-server): thread/unsubscribe API (#10954)

2026-02-25 13:14:30 -08:00

TurnCompletedNotification.json

add turn items view to app-server turns (#21063)

2026-05-05 19:17:16 +00:00

TurnDiffUpdatedNotification.json

…

TurnInterruptParams.json

…

TurnInterruptResponse.json

…

TurnPlanUpdatedNotification.json

…

TurnStartedNotification.json

add turn items view to app-server turns (#21063)

2026-05-05 19:17:16 +00:00

TurnStartParams.json

2- Use string service tiers in session protocol (#20971)

2026-05-06 18:00:21 +03:00

TurnStartResponse.json

add turn items view to app-server turns (#21063)

2026-05-05 19:17:16 +00:00

TurnSteerParams.json

…

TurnSteerResponse.json

…

WarningNotification.json

feat: Budget skill metadata and surface trimming as a warning (#18298)

2026-04-17 18:11:47 -07:00

WindowsSandboxReadinessResponse.json

Add Windows sandbox readiness RPC (#20708)

2026-05-05 09:58:23 -07:00

WindowsSandboxSetupCompletedNotification.json

app-server support for Windows sandbox setup. (#12025)

2026-02-18 13:03:16 -08:00

WindowsSandboxSetupStartParams.json

app-server: include experimental skill metadata in exec approval requests (#13929)

2026-03-08 18:07:46 -07:00

WindowsSandboxSetupStartResponse.json

app-server support for Windows sandbox setup. (#12025)

2026-02-18 13:03:16 -08:00

WindowsWorldWritableWarningNotification.json

…