sayan-oai

Honor per-environment login shell policy (#36811) ## What changed - Store the effective `allow_login_shell` setting on each turn environment, including inherited environments whose child thread has a different policy. - Expose the `login` argument for shell tools when any selected environment permits login shells. - Validate each command against the policy of its selected environment instead of the turn-wide configuration. ## Testing - Cover tool schema generation for single and multiple environments. - Cover login-shell rejection by both the command handler and the unified exec integration. GitOrigin-RevId: 5a93149a5c86f4087f2b92d663ebc33feff8a57c

standalone websearch extension (#23823) ## Summary Add the extension-backed standalone `web.run` tool so Codex can call the standalone search endpoint through the `codex-api` search client and return its encrypted output to Responses. - gate the new tool behind `standalone_web_search` - install the extension in the app-server thread registry and hide hosted `web_search` when standalone search is enabled for OpenAI providers so the two paths stay mutually exclusive - build search context from persisted history using a small tail heuristic: previous user message, assistant text between the last two user turns capped at about 1k tokens, and current user message ## Test Plan - `cargo test -p codex-web-search-extension` - `cargo test -p codex-api` - `cargo test -p codex-core hosted_tools_follow_provider_auth_model_and_config_gates`

Use turn environment permissions for tool execution (#37038) ## What changed - Derive sandboxing, approval, and permission-profile environment variables from the selected turn environment for shell, unified exec, `apply_patch`, image viewing, and network approval flows. - Materialize project-root permissions against every workspace root in that environment, allowing `apply_patch` to write to secondary workspace roots while preserving protected paths. - Carry the selected environment's permission profile into spawned or resumed agents and Guardian permission context. ## Testing - Add an integration test covering `apply_patch` writes in a secondary workspace root. - Extend tool, Guardian, and multi-agent tests to distinguish environment permissions from thread-level permissions. GitOrigin-RevId: e22da8974bcd3de1e724978b1a7790307a51e4bc

Use step environments for Guardian approval reviews (#37618) ## Why Deferred environments can become ready after a turn starts. Guardian approval reviews must use the environment selected for the current step so their working directory and permission context are not taken from the stale turn snapshot. ## What changed - Carry `StepContext` through tool execution and approval handling. - Add a Guardian review context that pairs the parent turn with the current step's environment snapshot. - Use that snapshot for Guardian prompts, reviewer sessions, and delegated reviewer threads while retaining turn-level fallbacks for callers without a step context. ## Testing Added an integration test that makes a deferred remote environment ready before an escalated command and verifies Guardian receives that environment's working directory and denied-read policy instead of the initial local environment's. GitOrigin-RevId: 779096bc7d0e0c7453a009c02141029714b9b407

core: use current step environments for tools (#29547) ## Why With deferred executors, an environment can become ready between two sampling requests in the same turn. The model-visible environment update, advertised tools, and eventual tool execution must all describe the same request-time view. Otherwise, a request built while only environment B is ready can advertise a tool without an `environment_id`; if higher-priority environment A becomes ready before execution, that call could silently run in A instead. This PR is stacked on #29527. ## Design `run_turn` captures one `Arc<StepContext>` at each sampling-request boundary. That step owns the request's `TurnContext` and environment snapshot. - World-state environment updates and tool planning borrow that same step. - `ToolCallRuntime` retains the `Arc` while asynchronous tool calls execute. - `ToolInvocation` carries the step to handlers; its temporary `turn` compatibility field is derived from the same object. - `ToolRouter` does not retain `StepContext`; it only uses it while constructing the request's tool set. - With `DeferredExecutor` disabled, step capture keeps using the environments frozen at turn start. Simply: every sampling request gets one consistent picture of its environments, from what the model sees through where its tool calls run. ## What changed - Build environment-dependent tool specs from the current request's `StepContext`. - Use that same step for unified exec, legacy shell, `apply_patch`, `view_image`, and `request_permissions` execution. - Hide environment-backed tools, including `request_permissions`, while no environment is attached. - Resolve legacy shell paths and metadata from the selected step environment instead of the stale turn-start environment. - Capture explicit steps at non-turn-loop boundaries such as compaction, prompt debug, and startup prewarm. - Reconcile prompt-debug history from the same step used to build its tools. ## Follow-up - Bind yielded code-mode cells to the tool runtime that created them, so nested calls made after yielding continue to use the originating request's `StepContext`. ## Test plan - `just test -p codex-core deferred_executor_updates_context_and_tools_after_startup` - `just test -p codex-core environment_count_controls_environment_backed_tools` - `just test -p codex-core build_prompt_input_includes_context_and_user_message`

core: make AGENTS.md react to environment changes (#29810) ## Why With deferred executors, a turn can begin before a remote environment attaches. AGENTS.md discovery previously ran only during session setup, so instructions from a later environment never reached the model or the session instruction sources. WorldState persistence has now landed, so this uses the durable model-visible baseline directly instead of carrying a temporary resume/fork compatibility path. ## What - Add an `AgentsMdManager` in `SessionServices` to own host instructions, loaded state, and refresh caching. - When `DeferredExecutor` is enabled, refresh AGENTS.md when attached environment selections change and freeze the result in the corresponding `StepContext`. - Represent AGENTS.md as a persisted WorldState section for every session, with bounded initial, replacement, and removal updates. - Remove duplicate AGENTS.md state and rendering from `SessionConfiguration` and `TurnContext`. - Build initial context, per-request updates, and compaction context from the same step-scoped value. - On resume and fork, compare current instructions with the restored WorldState baseline and inject a replacement exactly once when they differ. Builds on #29833, #29835, and #29837. ## Tests - Covers a remote environment becoming ready mid-turn, with AGENTS.md appearing on the next request exactly once and updating canonical instruction sources. - Covers full, unchanged, replaced, and removed AGENTS.md WorldState rendering. - Covers changed instructions across cold resume and fork without duplicate reinjection. - Covers remote-v2 compaction retaining creation-time instructions in the live session and cold resume appending one replacement when the source changed. - Ran focused `codex-core` AGENTS.md, WorldState, and context-update test suites.

core: use turn-owned world state for inline compaction (#29527) ## Why Follow-up to #29249 and its [compaction review thread](https://github.com/openai/codex/pull/29249#discussion_r3455055101). During a turn, environment readiness can change between sampling requests. Inline compaction must render the same model-visible `WorldState` used by the request it follows. Rebuilding that state during compaction can observe a newer environment, make replacement history disagree with what the model saw, and suppress the next environment update. ## What changed - Make `run_turn` own the current `Arc<WorldState>` and replace it only between sampling requests. - Build each state from an explicitly chosen environment snapshot, diff deferred-executor steps against the turn-owned state, and retain the latest state in `ContextManager` only for cross-turn and resume tracking. - Pass the exact turn-owned state into inline compaction and explicit new-context-window replacement. - Carry that state with `InitialContextInjection::BeforeLastUserMessage`, so replacement context and its stored baseline cannot come from different snapshots. - Remove obsolete state-recapture helpers and ambiguous TurnContext-only WorldState builders. - Add an integration test that moves an environment from starting to ready during a paused turn, triggers compaction, and verifies the next request receives the readiness update exactly once. ## Test plan - `just test -p codex-core deferred_executor_compaction_preserves_then_updates_environment_once` - `just test -p codex-core process_compacted_history` - `just test -p codex-core mid_turn_continuation_compaction` - `just test -p codex-core build_initial_context` - `just test -p codex-core ignores_session_prefix_messages_when_truncating`

Add a loader for executor-local config layers (#37406) ## What changed - Add `load_local_config_layers` to return raw configuration and requirements layers with their sources, base directories, precedence order, and cloud insertion positions. - Support projecting layer stacks to selected TOML paths while preserving non-table override blockers and adjusting cloud insertion positions when empty layers are removed. - Reuse project discovery and trust handling for local reads, including linked-worktree hooks, without resolving relative paths or including profiles, session flags, thread layers, or cloud-provided values. ## Testing - Cover layer ordering, raw relative paths, legacy requirements, trust filtering, projection semantics, and untrusted linked-worktree hook handling. GitOrigin-RevId: a1098af5650ac44e5a230ba9a5fe918927986d05

Use step environments for MCP file uploads (#35878) ## Why An MCP tool call can run after its selected environment becomes ready, while the turn context still contains the earlier starting-state snapshot. File argument rewriting must use the environment available to the current step so it can resolve and upload local files in that case. ## What changed - Pass `StepContext` through MCP file argument rewriting. - Resolve the primary environment from the step snapshot while retaining turn-scoped configuration and metadata. - Add coverage for an environment that transitions from starting to ready during a turn. GitOrigin-RevId: 935bea18ee425aabeacf4505eaff90565f9751e9

Expose explicit dynamic tool namespaces in thread start (#27371) Stacked on #27365. ## Stack note [#27365](https://github.com/openai/codex/pull/27365) kept `thread/start` unchanged and converted its input in `thread_processor`. This PR updates `thread/start` to accept explicit functions and namespaces directly. Legacy per-tool arrays are still accepted and converted while reading the request. As a result, `thread_processor` can validate and pass the tools through directly, which is why some code added in #27365 is removed here. ## Why `thread/start.dynamicTools` still repeats namespace data on each function even though core now stores explicit namespace groups. The request API should use the same shape so each namespace has one description and one member list. ## What changed - Accept top-level functions and explicit namespace objects in `dynamicTools`. - Continue accepting fully legacy flat arrays, including `exposeToContext`. - Reject arrays that mix legacy and canonical entries. - Reuse the protocol types directly and remove the temporary app-server adapter. - Update validation, docs, the test client, and generated schemas. ## Test plan - `just test -p codex-app-server-protocol` - `just test -p codex-app-server dynamic_tool_call_round_trip_sends_text_content_items_to_model` - `just test -p codex-app-server thread_start_normalizes_legacy_dynamic_tools_into_model_request` - `just test -p codex-app-server thread_start_rejects_mixed_dynamic_tool_formats` - `just test -p codex-app-server thread_start_rejects_hidden_dynamic_tools_without_namespace`

Make plugin guidance react to environment readiness (#30223) ## Why Generic plugin guidance is currently emitted only with initial context from host plugin state. An executor-selected plugin can become available later in the same turn, making its skills and tools usable without ever telling the model how plugin capabilities should be used. ## What - project every ready selected plugin package, including skill-only plugins - carry plugin availability with the exact MCP runtime projection while preserving MCP manager reuse when servers and connectors are unchanged - move generic plugin guidance from the static initial-context path into persisted World State - recognize legacy and retained plugin fragments so resume and compaction do not duplicate guidance ## Testing - `just test -p codex-mcp-extension` - `just test -p codex-core plugins_instructions` - `just test -p codex-core plugin_availability_change_reuses_the_mcp_manager` - `just test -p codex-app-server --test all selected_capabilit`

Apply permission profile updates to future turn environments (#37031) ## What changed - Include the current permission profile in each turn environment's configuration. - Refresh retained environment configurations when session settings change, while preserving the configuration already captured by active turns. - Keep environment connection and shell snapshot resolution reusable across configuration updates. ## Testing - Cover permission profile updates applied through both session settings updates and per-turn updates. - Verify that pending environment resolutions use the configuration captured by their turn and that configuration-only updates do not retry failed environments. GitOrigin-RevId: 923694f0729b87a118d7635ade3a8ca9bcd4e7b1

Represent dynamic tools with explicit namespaces internally (#27365) Follow-up to #27356. ## Stack note This PR changes Codex's internal dynamic-tool shape while leaving `thread/start` unchanged. App-server therefore converts the existing per-tool input into explicit functions and namespaces before passing it to core. [#27371](https://github.com/openai/codex/pull/27371) updates `thread/start` to use the same explicit shape and removes this temporary conversion. ## Why Dynamic tools repeat namespace metadata on every function. Core should keep one explicit namespace with its member tools so descriptions and membership stay consistent across sessions and runtime planning. ## What changed - Represent dynamic tools as top-level functions or explicit namespaces in protocol and session state. - Read old flat rollout metadata and write the canonical hierarchy. - Flatten namespace members only when registering callable tools. - Keep `thread/start.dynamicTools` flat for now and normalize it at the app-server boundary. New builds can read old rollout metadata. Older builds cannot read newly written hierarchical metadata. ## Test plan - `just test -p codex-app-server thread_start_normalizes_legacy_dynamic_tools_into_model_request` - `just test -p codex-protocol session_meta_normalizes_legacy_dynamic_tools` - `just test -p codex-core resume_restores_dynamic_tools_from_rollout_with_sqlite_enabled` - `just test -p codex-core tool_search_returns_deferred_dynamic_tool_and_routes_follow_up_call` - `just test -p codex-core code_mode_can_call_hidden_dynamic_tools` - `just test -p codex-tools`

Track model and personality in world state (#35530) ## What changed - Add model and personality sections to the persisted world-state snapshot. - Generate model-switch and personality instructions through world-state diffs, including when prior state must be inferred during replay. - Keep those instruction fragments in standalone developer messages instead of merging them with adjacent context updates. ## Testing - Cover initial, unchanged, and changed model and personality states. - Verify that model changes are recorded in rollout world-state items. GitOrigin-RevId: 497e29cf38cac08e992e546df900f6f8b01120f9

Allow omitting MCP tool prefixes per server (#34991) ## What changed - Accept a table form of `features.non_prefixed_mcp_tool_names` with an optional `server_names` list while preserving the existing boolean form. - Omit the legacy `mcp__` namespace prefix only for tools from selected MCP servers. When no server list is provided, the enabled feature continues to omit the prefix for every server. - Cover configuration resolution, tool normalization, and an MCP stdio round trip with selected servers. GitOrigin-RevId: bdfb7ac54226de5051f06610e2c6b78b23912ef0

[1/3] core: make world state snapshots serializable (#29833) ## Why `WorldState` currently keeps its diff baseline as live Rust objects keyed by process-local `TypeId`. That baseline cannot be written to a rollout or restored after resume, so Codex reconstructs an approximation from `TurnContextItem`. This is the first change in the WorldState persistence stack. It gives every section a stable persisted identity and a compact serializable comparison snapshot without changing rollout behavior yet. ## What changed - Require each `WorldStateSection` to define a stable ID and serializable snapshot type. - Reject duplicate section IDs when constructing `WorldState`. - Persist a dedicated environment comparison snapshot using model-visible strings instead of runtime path types. - Store only `WorldStateSnapshot` in `ContextManager`, removing the parallel live-object baseline. - Render diffs by restoring each section's typed snapshot; invalid snapshots fall back to a full section render. - Omit null object fields for future RFC 7386 patches while preserving null values inside arrays. Follow-up PRs will record full snapshots and merge patches, then restore the baseline during resume, fork, and rollback. ## Test plan - WorldState snapshot tests cover stable IDs, duplicate rejection, null omission, and array preservation. - Environment tests cover persistence-safe snapshot values and existing diff rendering. - ContextManager baseline deduplication and session context-update persistence tests. Related: #29249

Report selected environment connection transitions (#33251) ## What changed - Track connected and disconnected states across initial remote exec-server connections and reconnection attempts. - Emit experimental `thread/environment/connected` and `thread/environment/disconnected` app-server notifications for each thread selecting the environment. Each payload identifies the thread and environment; current state is not replayed when a thread starts. - Stop forwarding connection events when an environment selection is removed or replaced. ## Testing - Cover connection, disconnection, reconnection, shared-environment notifications, and replacement of a selected environment. GitOrigin-RevId: 5dd767372363c4a2a8319fc16164be117d5bd20c

Allow custom providers to opt into standalone web search (#34846) ## What changed - Add the `supports_standalone_web_search` model-provider setting, defaulting to `false`, and preserve it in remote thread configuration. - Enable the standalone `web.run` tool for opted-in custom Responses providers when web search is enabled and the runtime provider supports it. - Send standalone search requests through the custom provider's endpoint and authentication. ## Testing - Cover opt-in, default-off, disabled-search, and unsupported-provider behavior. - Verify custom-provider search request routing and authorization through the app server. GitOrigin-RevId: 7c5f96b0ce924ad2b9715c45bfc635e89fc39cff

core: reconcile legacy WorldState sections (#29997) ## Why Older rollouts can retain model-visible context for a WorldState section without having a persisted snapshot for that section. Treating the missing snapshot as definitely absent can duplicate old context or fail to tell the model that it was replaced or removed. This provides a generic migration path for sections moving into WorldState, beginning with AGENTS.md. Builds on #29810. ## What changed - distinguish section state that is absent, known from a persisted snapshot, or unknown because matching legacy context remains in history - let WorldState sections identify their own legacy fragments while `ContextManager` owns history reconciliation and baseline persistence - make AGENTS.md emit one conservative replacement or removal update for legacy history, then deduplicate from the newly persisted baseline - preserve existing environment rendering when persisted section data is missing or malformed ## Testing - `just test -p codex-core world_state` - `just test -p codex-core cold_resume_invalidates_deleted_legacy_agents_md_once -- --exact`

Keep active-turn environments stable across settings updates (#33658) ## Why With deferred execution enabled, rebuilding a step context from the latest thread environment snapshot could apply a settings update to a turn that was already in progress. ## What changed - Preserve each turn's captured environment selections when creating later step contexts. - Refresh only the readiness of environments that were already starting, while retaining their original selection order. - Apply updated environment selections to the next turn. ## Testing Add coverage for changing the selected workspace while a turn is paused, verifying that the active turn keeps its original working directory and the next turn uses the new one. GitOrigin-RevId: c6f4388c843384ef045b7abdbc303dcfca11d230