OpenAI - Codex Docs Changes 2026-02-19 20:37 UTC → 2026-05-13 00:57 UTC

1# Agent approvals & security

2 

3Codex helps protect your code and data and reduces the risk of misuse.

4 

5This page covers how to operate Codex safely, including sandboxing, approvals,

6 and network access. If you are looking for Codex Security, the product for

7 scanning connected GitHub repositories, see [Codex Security](https://developers.openai.com/codex/security).

8 

9By default, the agent runs with network access turned off. Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace), plus an approval policy that controls when it must stop and ask you before acting.

10 

11For a high-level explanation of how sandboxing works across the Codex app, IDE

12extension, and CLI, see [sandboxing](https://developers.openai.com/codex/concepts/sandboxing).

13For a broader enterprise security overview, see the [Codex security white paper](https://trust.openai.com/?itemUid=382f924d-54f3-43a8-a9df-c39e6c959958&source=click).

14 

15## Sandbox and approvals

16 

17Codex security controls come from two layers that work together:

18 

19- **Sandbox mode**: What Codex can do technically (for example, where it can write and whether it can reach the network) when it executes model-generated commands.

20- **Approval policy**: When Codex must ask you before it executes an action (for example, leaving the sandbox, using the network, or running commands outside a trusted set).

21 

22Codex uses different sandbox modes depending on where you run it:

23 

24- **Codex cloud**: Runs in isolated OpenAI-managed containers, preventing access to your host system or unrelated data. Uses a two-phase runtime model: setup runs before the agent phase and can access the network to install specified dependencies, then the agent phase runs offline by default unless you enable internet access for that environment. Secrets configured for cloud environments are available only during setup and are removed before the agent phase starts.

25- **Codex CLI / IDE extension**: OS-level mechanisms enforce sandbox policies. Defaults include no network access and write permissions limited to the active workspace. You can configure the sandbox, approval policy, and network settings based on your risk tolerance.

26 

27In the `Auto` preset (for example, `--sandbox workspace-write --ask-for-approval on-request`), Codex can read files, make edits, and run commands in the working directory automatically.

28 

29Codex asks for approval to edit files outside the workspace or to run commands that require network access. If you want to chat or plan without making changes, switch to `read-only` mode with the `/permissions` command.

30 

31Codex can also elicit approval for app (connector) tool calls that advertise side effects, even when the action isn't a shell command or file change. Destructive app/MCP tool calls always require approval when the tool advertises a destructive annotation, even if it also advertises other hints (for example, read-only hints).

32 

33## Network access <ElevatedRiskBadge class="ml-2" />

34 

35For Codex cloud, see [agent internet access](https://developers.openai.com/codex/cloud/internet-access) to enable full internet access or a domain allow list.

36 

37For the Codex app, CLI, or IDE Extension, the default `workspace-write` sandbox mode keeps network access turned off unless you enable it in your configuration:

38 

39```toml

40[sandbox_workspace_write]

41network_access = true

42```

43 

44You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:

45 

46```toml

47web_search = "cached" # default

48# web_search = "disabled"

49# web_search = "live" # same as --search

50```

51 

52Use caution when enabling network access or web search in Codex. Prompt injection can cause the agent to fetch and follow untrusted instructions.

53 

54## Defaults and recommendations

55 

56- On launch, Codex detects whether the folder is version-controlled and recommends:

57 - Version-controlled folders: `Auto` (workspace write + on-request approvals)

58 - Non-version-controlled folders: `read-only`

59- Depending on your setup, Codex may also start in `read-only` until you explicitly trust the working directory (for example, via an onboarding prompt or `/permissions`).

60- The workspace includes the current directory and temporary directories like `/tmp`. Use the `/status` command to see which directories are in the workspace.

61- To accept the defaults, run `codex`.

62- You can set these explicitly:

63 - `codex --sandbox workspace-write --ask-for-approval on-request`

64 - `codex --sandbox read-only --ask-for-approval on-request`

65 

66### Protected paths in writable roots

67 

68In the default `workspace-write` sandbox policy, writable roots still include protected paths:

69 

70- `<writable_root>/.git` is protected as read-only whether it appears as a directory or file.

71- If `<writable_root>/.git` is a pointer file (`gitdir: ...`), the resolved Git directory path is also protected as read-only.

72- `<writable_root>/.agents` is protected as read-only when it exists as a directory.

73- `<writable_root>/.codex` is protected as read-only when it exists as a directory.

74- Protection is recursive, so everything under those paths is read-only.

75 

76### Deny reads with filesystem profiles

77 

78Named permission profiles can also deny reads for exact paths or glob patterns.

79This is useful when a workspace should stay writable but specific sensitive

80files, such as local environment files, must stay unreadable:

81 

82```toml

83default_permissions = "workspace"

84 

85[permissions.workspace.filesystem]

86":project_roots" = { "." = "write", "**/*.env" = "none" }

87glob_scan_max_depth = 3

88```

89 

90Use `"none"` for paths or globs that Codex shouldn't read. The sandbox policy

91evaluates globs for local macOS and Linux command execution. On platforms that

92pre-expand glob matches before the sandbox starts, set `glob_scan_max_depth` for

93unbounded `**` patterns, or list explicit depths such as `*.env`, `*/*.env`, and

94`*/*/*.env`.

95 

96### Run without approval prompts

97 

98You can disable approval prompts with `--ask-for-approval never` or `-a never` (shorthand).

99 

100This option works with all `--sandbox` modes, so you still control Codex's level of autonomy. Codex makes a best effort within the constraints you set.

101 

102If you need Codex to read files, make edits, and run commands with network access without approval prompts, use `--sandbox danger-full-access` (or the `--dangerously-bypass-approvals-and-sandbox` flag). Use caution before doing so.

103 

104For a middle ground, `approval_policy = { granular = { ... } }` lets you keep specific approval prompt categories interactive while automatically rejecting others. The granular policy covers sandbox approvals, execpolicy-rule prompts, MCP prompts, `request_permissions` prompts, and skill-script approvals.

105 

106### Automatic approval reviews

107 

108By default, approval requests route to you:

109 

110```toml

111approvals_reviewer = "user"

112```

113 

114Automatic approval reviews apply when approvals are interactive, such as

115`approval_policy = "on-request"` or a granular approval policy. Set

116`approvals_reviewer = "auto_review"` to route eligible approval requests

117through a reviewer agent before Codex runs the request:

118 

119```toml

120approval_policy = "on-request"

121approvals_reviewer = "auto_review"

122```

123 

124For the full reviewer lifecycle, trigger conditions, configuration precedence,

125and failure behavior, see

126[Auto-review](https://developers.openai.com/codex/concepts/sandboxing/auto-review).

127 

128The reviewer evaluates only actions that already need approval, such as sandbox

129escalations, blocked network requests, `request_permissions` prompts, or

130side-effecting app and MCP tool calls. Actions that stay inside the sandbox

131continue without an extra review step.

132 

133The reviewer policy checks for data exfiltration, credential probing, persistent

134security weakening, and destructive actions. Low-risk and medium-risk actions

135can proceed when policy allows them. The policy denies critical-risk actions.

136High-risk actions require enough user authorization and no matching deny rule.

137Prompt-build, review-session, and parse failures fail closed. Timeouts are

138surfaced separately, but the action still does not run.

139 

140The [default reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md)

141is in the open-source Codex repository. Enterprises can replace its

142tenant-specific section with `guardian_policy_config` in managed requirements.

143Local `[auto_review].policy` text is also supported, but managed requirements

144take precedence. For setup details, see

145[Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration#configure-automatic-review-policy).

146 

147In the Codex app, these reviews appear as automatic review items with a status

148such as Reviewing, Approved, Denied, Aborted, or Timed out. They can also

149include a risk level and user-authorization assessment for the reviewed

150request.

151 

152Automatic review uses extra model calls, so it can add to Codex usage. Admins

153can constrain it with `allowed_approvals_reviewers`.

154 

155### Common sandbox and approval combinations

156 

157| Intent | Flags / config | Effect |

158| ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |

159| Auto (preset) | _no flags needed_ or `--sandbox workspace-write --ask-for-approval on-request` | Codex can read files, make edits, and run commands in the workspace. Codex requires approval to edit outside the workspace or to access network. |

160| Safe read-only browsing | `--sandbox read-only --ask-for-approval on-request` | Codex can read files and answer questions. Codex requires approval to make edits, run commands, or access network. |

161| Read-only non-interactive (CI) | `--sandbox read-only --ask-for-approval never` | Codex can only read files; never asks for approval. |

162| Automatically edit but ask for approval to run untrusted commands | `--sandbox workspace-write --ask-for-approval untrusted` | Codex can read and edit files but asks for approval before running untrusted commands. |

163| Auto-review mode | `--sandbox workspace-write --ask-for-approval on-request -c approvals_reviewer=auto_review` or `approvals_reviewer = "auto_review"` | Same sandbox boundary as standard on-request mode, but eligible approval requests are reviewed by Auto-review instead of surfacing to the user. |

164| Dangerous full access | `--dangerously-bypass-approvals-and-sandbox` (alias: `--yolo`) | <ElevatedRiskBadge /> No sandbox; no approvals _(not recommended)_ |

165 

166For non-interactive runs, use `codex exec --sandbox workspace-write`; Codex keeps older `codex exec --full-auto` invocations as a deprecated compatibility path and prints a warning.

167 

168With `--ask-for-approval untrusted`, Codex runs only known-safe read operations automatically. Commands that can mutate state or trigger external execution paths (for example, destructive Git operations or Git output/config-override flags) require approval.

169 

170#### Configuration in `config.toml`

171 

172For the broader configuration workflow, see [Config basics](https://developers.openai.com/codex/config-basic), [Advanced Config](https://developers.openai.com/codex/config-advanced#approval-policies-and-sandbox-modes), and the [Configuration Reference](https://developers.openai.com/codex/config-reference).

173 

174```toml

175# Always ask for approval mode

176approval_policy = "untrusted"

177sandbox_mode = "read-only"

178allow_login_shell = false # optional hardening: disallow login shells for shell-based tools

179 

180# Optional: Allow network in workspace-write mode

181[sandbox_workspace_write]

182network_access = true

183 

184# Optional: granular approval policy

185# approval_policy = { granular = {

186# sandbox_approval = true,

187# rules = true,

188# mcp_elicitations = true,

189# request_permissions = false,

190# skill_approval = false

191# } }

192```

193 

194You can also save presets as profiles, then select them with `codex --profile <name>`:

195 

196```toml

197[profiles.full_auto]

198approval_policy = "on-request"

199sandbox_mode = "workspace-write"

200 

201[profiles.readonly_quiet]

202approval_policy = "never"

203sandbox_mode = "read-only"

204```

205 

206### Test the sandbox locally

207 

208To see what happens when a command runs under the Codex sandbox, use these Codex CLI commands:

209 

210```bash

211# macOS

212codex sandbox macos [--permissions-profile <name>] [--log-denials] [COMMAND]...

213# Linux

214codex sandbox linux [--permissions-profile <name>] [COMMAND]...

215# Windows

216codex sandbox windows [--permissions-profile <name>] [COMMAND]...

217```

218 

219The `sandbox` command is also available as `codex debug`, and the platform helpers have aliases (for example `codex sandbox seatbelt` and `codex sandbox landlock`).

220 

221## OS-level sandbox

222 

223Codex enforces the sandbox differently depending on your OS:

224 

225- **macOS** uses Seatbelt policies and runs commands using `sandbox-exec` with a profile (`-p`) that corresponds to the `--sandbox` mode you selected. When restricted read access enables platform defaults, Codex appends a curated macOS platform policy (instead of broadly allowing `/System`) to preserve common tool compatibility.

226- **Linux** uses `bwrap` plus `seccomp` by default.

227- **Windows** uses the Linux sandbox implementation when running in [Windows Subsystem for Linux 2 (WSL2)](https://developers.openai.com/codex/windows#windows-subsystem-for-linux). WSL1 was supported through Codex `0.114`; starting in `0.115`, the Linux sandbox moved to `bwrap`, so WSL1 is no longer supported. When running natively on Windows, Codex uses a [Windows sandbox](https://developers.openai.com/codex/windows#windows-sandbox) implementation.

228 

229If you use the Codex IDE extension on Windows, it supports WSL2 directly. Set the following in your VS Code settings to keep the agent inside WSL2 whenever it's available:

230 

231```json

232{

233 "chatgpt.runCodexInWindowsSubsystemForLinux": true

234}

235```

236 

237This ensures the IDE extension inherits Linux sandbox semantics for commands, approvals, and filesystem access even when the host OS is Windows. Learn more in the [Windows setup guide](https://developers.openai.com/codex/windows).

238 

239When running natively on Windows, configure the native sandbox mode in `config.toml`:

240 

241```toml

242[windows]

243sandbox = "unelevated" # or "elevated"

244# sandbox_private_desktop = true # default; set false only for compatibility

245```

246 

247See the [Windows setup guide](https://developers.openai.com/codex/windows#windows-sandbox) for details.

248 

249When you run Linux in a containerized environment such as Docker, the sandbox may not work if the host or container configuration blocks the namespace, setuid `bwrap`, or `seccomp` operations that Codex needs.

250 

251In that case, configure your Docker container to provide the isolation you need, then run `codex` with `--sandbox danger-full-access` (or the `--dangerously-bypass-approvals-and-sandbox` flag) inside the container.

252 

253### Run Codex in Dev Containers

254 

255If your host cannot run the Linux sandbox directly, or if your organization already standardizes on containerized development, run Codex with Dev Containers and let Docker provide the outer isolation boundary. This works with Visual Studio Code Dev Containers and compatible tools.

256 

257Use the [Codex secure devcontainer example](https://github.com/openai/codex/tree/main/.devcontainer) as a reference implementation. The example installs Codex, common development tools, `bubblewrap`, and firewall-based outbound controls.

258 

259Devcontainers provide substantial protection, but they do not prevent every

260 attack. If you run Codex with `--sandbox danger-full-access` or

261 `--dangerously-bypass-approvals-and-sandbox` inside the container, a malicious

262 project can exfiltrate anything available inside the devcontainer, including

263 Codex credentials. Use this pattern only with trusted repositories, and

264 monitor Codex activity as you would in any other elevated environment.

265 

266The reference implementation includes:

267 

268- an Ubuntu 24.04 base image with Codex and common development tools installed;

269- an allowlist-driven firewall profile for outbound access;

270- VS Code settings and extension recommendations for reopening the workspace in a container;

271- persistent mounts for command history and Codex configuration;

272- `bubblewrap`, so Codex can still use its Linux sandbox when the container grants the needed capabilities.

273 

274To try it:

275 

2761. Install Visual Studio Code and the [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers).

2772. Copy the Codex example `.devcontainer` setup into your repository, or start from the Codex repository directly.

2783. In VS Code, run **Dev Containers: Open Folder in Container...** and select `.devcontainer/devcontainer.secure.json`.

2794. After the container starts, open a terminal and run `codex`.

280 

281You can also start the container from the CLI:

282 

283```bash

284devcontainer up --workspace-folder . --config .devcontainer/devcontainer.secure.json

285```

286 

287The example has three main pieces:

288 

289- `.devcontainer/devcontainer.secure.json` controls container settings, capabilities, mounts, environment variables, and VS Code extensions.

290- `.devcontainer/Dockerfile.secure` defines the Ubuntu-based image and installed tools.

291- `.devcontainer/init-firewall.sh` applies the outbound network policy.

292 

293The reference firewall is intentionally a starting point. If you depend on domain allowlisting for isolation, implement DNS rebinding and DNS refresh protections that fit your environment, such as TTL-aware refreshes or a DNS-aware firewall.

294 

295Inside the container, choose one of these modes:

296 

297- Keep Codex's Linux sandbox enabled if the Dev Container profile grants the capabilities needed for `bwrap` to create the inner sandbox.

298- If the container is your intended security boundary, run Codex with `--sandbox danger-full-access` inside the container so Codex does not try to create a second sandbox layer.

299 

300## Version control

301 

302Codex works best with a version control workflow:

303 

304- Work on a feature branch and keep `git status` clean before delegating. This keeps Codex patches easier to isolate and revert.

305- Prefer patch-based workflows (for example, `git diff`/`git apply`) over editing tracked files directly. Commit frequently so you can roll back in small increments.

306- Treat Codex suggestions like any other PR: run targeted verification, review diffs, and document decisions in commit messages for auditing.

307 

308## Monitoring and telemetry

309 

310Codex supports opt-in monitoring via OpenTelemetry (OTel) to help teams audit usage, investigate issues, and meet compliance requirements without weakening local security defaults. Telemetry is off by default; enable it explicitly in your configuration.

311 

312### Overview

313 

314- Codex turns off OTel export by default to keep local runs self-contained.

315- When enabled, Codex emits structured log events covering conversations, API requests, SSE/WebSocket stream activity, user prompts (redacted by default), tool approval decisions, and tool results.

316- Codex tags exported events with `service.name` (originator), CLI version, and an environment label to separate dev/staging/prod traffic.

317 

318### Enable OTel (opt-in)

319 

320Add an `[otel]` block to your Codex configuration (typically `~/.codex/config.toml`), choosing an exporter and whether to log prompt text.

321 

322```toml

323[otel]

324environment = "staging" # dev | staging | prod

325exporter = "none" # none | otlp-http | otlp-grpc

326log_user_prompt = false # redact prompt text unless policy allows

327```

328 

329- `exporter = "none"` leaves instrumentation active but doesn't send data anywhere.

330- To send events to your own collector, pick one of:

331 

332```toml

333[otel]

334exporter = { otlp-http = {

335 endpoint = "https://otel.example.com/v1/logs",

336 protocol = "binary",

337 headers = { "x-otlp-api-key" = "${OTLP_TOKEN}" }

338}}

339```

340 

341```toml

342[otel]

343exporter = { otlp-grpc = {

344 endpoint = "https://otel.example.com:4317",

345 headers = { "x-otlp-meta" = "abc123" }

346}}

347```

348 

349Codex batches events and flushes them on shutdown. Codex exports only telemetry produced by its OTel module.

350 

351### Event categories

352 

353Representative event types include:

354 

355- `codex.conversation_starts` (model, reasoning settings, sandbox/approval policy)

356- `codex.api_request` (attempt, status/success, duration, and error details)

357- `codex.sse_event` (stream event kind, success/failure, duration, plus token counts on `response.completed`)

358- `codex.websocket_request` and `codex.websocket_event` (request duration plus per-message kind/success/error)

359- `codex.user_prompt` (length; content redacted unless explicitly enabled)

360- `codex.tool_decision` (approved/denied, source: configuration vs. user)

361- `codex.tool_result` (duration, success, output snippet)

362 

363Associated OTel metrics (counter plus duration histogram pairs) include `codex.api_request`, `codex.sse_event`, `codex.websocket.request`, `codex.websocket.event`, and `codex.tool.call` (with corresponding `.duration_ms` instruments).

364 

365For the full event catalog and configuration reference, see the [Codex configuration documentation on GitHub](https://github.com/openai/codex/blob/main/docs/config.md#otel).

366 

367### Security and privacy guidance

368 

369- Keep `log_user_prompt = false` unless policy explicitly permits storing prompt contents. Prompts can include source code and sensitive data.

370- Route telemetry only to collectors you control; apply retention limits and access controls aligned with your compliance requirements.

371- Treat tool arguments and outputs as sensitive. Favor redaction at the collector or SIEM when possible.

372- Review local data retention settings (for example, `history.persistence` / `history.max_bytes`) if you don't want Codex to save session transcripts under `CODEX_HOME`. See [Advanced Config](https://developers.openai.com/codex/config-advanced#history-persistence) and [Configuration Reference](https://developers.openai.com/codex/config-reference).

373- If you run the CLI with network access turned off, OTel export can't reach your collector. To export, allow network access in `workspace-write` mode for the OTel endpoint, or export from Codex cloud with the collector domain on your approved list.

374- Review events periodically for approval/sandbox changes and unexpected tool executions.

375 

376OTel is optional and designed to complement, not replace, the sandbox and approval protections described above.

377 

378## Managed configuration

379 

380Enterprise admins can configure Codex security settings for their workspace in [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration). See that page for setup and policy details.

1# Codex app1# Codex app

2 2 

3Your Codex command center

4 

5The Codex app is a focused desktop experience for working on Codex threads in parallel, with built-in worktree support, automations, and Git functionality.3The Codex app is a focused desktop experience for working on Codex threads in parallel, with built-in worktree support, automations, and Git functionality.

6 4 

7ChatGPT Plus, Pro, Business, Edu, and Enterprise plans include Codex. Learn more about [what's included](https://developers.openai.com/codex/pricing).5ChatGPT Plus, Pro, Business, Edu, and Enterprise plans include Codex. Learn more about [what's included](https://developers.openai.com/codex/pricing).

8 6 

9![Codex app window with a project sidebar, active thread, and review pane](/images/codex/app/app-screenshot-light.webp) ![Codex app window with a project sidebar, active thread, and review pane](/images/codex/app/app-screenshot-dark.webp)7<PlatformSpecificContent>

10 8 <CodexScreenshot

11![Codex app window with a project sidebar, active thread, and review pane](/images/codex/app/app-screenshot-light.webp) ![Codex app window with a project sidebar, active thread, and review pane](/images/codex/app/app-screenshot-dark.webp)9 slot="windows"

10 alt="Codex app for Windows showing a project sidebar, active thread, and review pane"

11 lightSrc="/images/codex/windows/codex-windows-light.webp"

12 darkSrc="/images/codex/windows/codex-windows-dark.webp"

13 variant="no-wallpaper"

14 maxHeight="300px"

15 />

16 <CodexScreenshot

17 alt="Codex app window with a project sidebar, active thread, and review pane"

18 lightSrc="/images/codex/app/app-screenshot-light.webp"

19 darkSrc="/images/codex/app/app-screenshot-dark.webp"

20 variant="no-wallpaper"

21 maxHeight="300px"

22 />

23</PlatformSpecificContent>

12 24 

13## Getting started25## Getting started

14 26 

15The Codex app is available on macOS (Apple Silicon).27The Codex app is available on macOS and Windows.

28 

29Most Codex app features are available on both platforms. Platform-specific

30exceptions are noted in the relevant docs.

16 31 

32<WorkflowSteps variant="headings">

171. Download and install the Codex app331. Download and install the Codex app

18 34 

19 The Codex app is currently only available for macOS.35 Download the Codex app for macOS or Windows. Choose the Intel build if you're using an Intel-based Mac.

20 36 

21 [Download for macOS](https://persistent.oaistatic.com/codex-app-prod/Codex.dmg)37 <CodexAppDownloadCta client:load className="mb-4" />

38 

39 <div class="text-sm">

40 [Get notified for Linux](https://openai.com/form/codex-app/)

41 </div>

22 42 

23 [Get notified for Windows and Linux](https://openai.com/form/codex-app/)

242. Open Codex and sign in432. Open Codex and sign in

25 44 

26 Once you downloaded and installed the Codex app, open it and sign in with your ChatGPT account or an OpenAI API key.45 Once you downloaded and installed the Codex app, open it and sign in with your ChatGPT account or an OpenAI API key.

38 58 

39 You can ask Codex anything about the project or your computer in general. Here are some examples:59 You can ask Codex anything about the project or your computer in general. Here are some examples:

40 60 

41 ![](https://developers.openai.com/codex/colorcons/brain.png)Tell me about this projectCopied![](https://developers.openai.com/codex/colorcons/gamepad.png)Build a classic Snake game in this repo.Copied![](https://developers.openai.com/codex/colorcons/search.png)Find and fix bugs in my codebase with minimal, high-confidence changes.Copied61 <ExampleGallery>

42 62 <ExampleTask

43 If you need more inspiration, check out the [explore section](https://developers.openai.com/codex/explore).63 client:load

64 id="intro"

65 prompt="Tell me about this project"

66 iconName="brain"

67 />

68 <ExampleTask

69 client:load

70 id="snake-game"

71 shortDescription="Build a classic Snake game in this repo."

72 prompt={[

73 "Build a classic Snake game in this repo.",

74 "",

75 "Scope & constraints:",

76 "- Implement ONLY the classic Snake loop: grid movement, growing snake, food spawn, score, game-over, restart.",

77 "- Reuse existing project tooling/frameworks; do NOT add new dependencies unless truly required.",

78 "- Keep UI minimal and consistent with the repo’s existing styles (no new design systems, no extra animations).",

79 "",

80 "Implementation plan:",

81 "1) Inspect the repo to find the right place to add a small interactive game (existing pages/routes/components).",

82 "2) Implement game state (snake positions, direction, food, score, tick timer) with deterministic, testable logic.",

83 "3) Render: simple grid + snake + food; support keyboard controls (arrow keys/WASD) and on-screen controls if mobile is present in the repo.",

84 "4) Add basic tests for the core game logic (movement, collisions, growth, food placement) if the repo has a test runner.",

85 "",

86 "Deliverables:",

87 "- A small set of files/changes with clear names.",

88 "- Short run instructions (how to start dev server + where to navigate).",

89 "- A brief checklist of what to manually verify (controls, pause/restart, boundaries).",

90 ].join("\n")}

91 iconName="gamepad"

92 />

93 <ExampleTask

94 client:load

95 id="fix-bugs"

96 shortDescription="Find and fix bugs in my codebase with minimal, high-confidence changes."

97 prompt={[

98 "Find and fix bugs in my codebase with minimal, high-confidence changes.",

99 "",

100 "Method (grounded + disciplined):",

101 "1) Reproduce: run tests/lint/build (or follow the existing repo scripts). If I provided an error, reproduce that exact failure.",

102 "2) Localize: identify the smallest set of files/lines involved (stack traces, failing tests, logs).",

103 "3) Fix: implement the minimal change that resolves the issue without refactors or unrelated cleanup.",

104 "4) Prove: add/update a focused test (or a tight repro) that fails before and passes after.",

105 "",

106 "Constraints:",

107 "- Do NOT invent errors or pretend to run commands you cannot run.",

108 "- No scope drift: no new features, no UI embellishments, no style overhauls.",

109 "- If information is missing, state what you can confirm from the repo and what remains unknown.",

110 "",

111 "Output:",

112 "- Summary (3–6 sentences max): what was broken, why, and the fix.",

113 "- Then ≤5 bullets: What changed, Where (paths), Evidence (tests/logs), Risks, Next steps.",

114 ].join("\n")}

115 iconName="search"

116 />

117 </ExampleGallery>

118 

119 If you need more inspiration, explore [Codex use cases](https://developers.openai.com/codex/use-cases).

120 If you're new to Codex, read the [best practices guide](https://developers.openai.com/codex/learn/best-practices).

121 

122</WorkflowSteps>

44 123 

45---124---

46 125 

47## Work with the Codex app126## Work with the Codex app

48 127 

49[### Multitask across projects128<BentoContainer class="mt-6">

129 <BentoContent href="/codex/app/features#multitask-across-projects">

50 130 

51Run multiple tasks in parallel and switch quickly between them.](https://developers.openai.com/codex/app/features#multitask-across-projects)[### Built-in Git tools131### Multitask across projects

52 132 

53Review diffs, comment inline, stage or revert chunks, and commit without leaving the app.](https://developers.openai.com/codex/app/features#built-in-git-tools)[### Worktrees for parallel tasks133Run project threads side by side and switch between them quickly.

54 134 

55Isolate changes of multiple Codex threads using built-in Git worktree support.](https://developers.openai.com/codex/app/worktrees)[### Skills support135 </BentoContent>

136 <BentoContent href="/codex/app/worktrees">

56 137 

57Give your Codex agent additional capabilities and reuse skills across App, CLI, and IDE Extension.](https://developers.openai.com/codex/app/features#skills-support)[### Automations138### Worktrees

58 139 

59Pair skills with automations to automate recurring tasks in the background. Codex adds findings to the inbox, or automatically archives runs if there’s nothing to report.](https://developers.openai.com/codex/app/automations)[### Built-in terminal140Keep parallel code changes isolated with built-in Git worktree support.

60 141 

61Open a terminal per thread to test your changes, run dev servers, scripts, and custom commands.](https://developers.openai.com/codex/app/features#integrated-terminal)[### Local environments142 </BentoContent>

143 <BentoContent href="/codex/app/computer-use">

62 144 

63Define worktree setup scripts and common project actions for easy access.](https://developers.openai.com/codex/app/local-environments)[### Sync with the IDE extension145### Computer use

64 146 

65Share Auto Context and active threads across app and IDE sessions.](https://developers.openai.com/codex/app/features#sync-with-the-ide-extension)[### MCP support147Let Codex use macOS apps for GUI tasks, browser flows, and native app testing.

66 148 

67Connect your Codex agent to additional services using MCP.](https://developers.openai.com/codex/app/features#mcp-support)149 </BentoContent>

150 <BentoContent href="/codex/app/review">

68 151 

152### Review and ship changes

69 153 

70Need help? Visit the [troubleshooting guide](https://developers.openai.com/codex/app/troubleshooting).154Inspect diffs, address PR feedback, stage files, commit, and push.

155 

156 </BentoContent>

157 <BentoContent href="/codex/app/features#integrated-terminal">

158 

159### Terminal and actions

160 

161Run commands in each thread and launch repeatable project actions.

162 

163 </BentoContent>

164 <BentoContent href="/codex/app/browser">

165 

166### In-app browser

167 

168Open rendered pages, leave comments, or let Codex operate local browser flows.

169 

170 </BentoContent>

171 <BentoContent href="/codex/app/chrome-extension">

172 

173### Chrome extension

174 

175Add the Chrome plugin so Codex can use Chrome for signed-in browser tasks while you manage website approvals.

176 

177 </BentoContent>

178 <BentoContent href="/codex/app/features#image-generation">

179 

180### Image generation

71 181 

72[Next182Generate or edit images in a thread while you work on the surrounding code and assets.

73 183 

74Features](https://developers.openai.com/codex/app/features)184 </BentoContent>

185 <BentoContent href="/codex/app/automations">

186 

187### Automations

188 

189Schedule recurring tasks, or wake up the same thread for ongoing checks.

190 

191 </BentoContent>

192 <BentoContent href="/codex/app/features#skills-support">

193 

194### Skills

195 

196Reuse instructions and workflows across the app, CLI, and IDE Extension.

197 

198 </BentoContent>

199 <BentoContent href="/codex/app/features#richer-outputs-and-artifacts">

200 

201### Sidebar and artifacts

202 

203Follow plans, sources, task summaries, and generated file previews.

204 

205 </BentoContent>

206 <BentoContent href="/codex/plugins">

207 

208### Plugins

209 

210Connect apps, skills, and MCP servers to extend what Codex can do.

211 

212 </BentoContent>

213 <BentoContent href="/codex/app/features#sync-with-the-ide-extension">

214 

215### IDE Extension sync

216 

217Share Auto Context and active threads across app and IDE sessions.

218 

219 </BentoContent>

220</BentoContainer>

221 

222---

223 

224Need help? Visit the [troubleshooting guide](https://developers.openai.com/codex/app/troubleshooting).

1# Codex App Server1# Codex App Server

2 2 

3Embed Codex into your product with the app-server protocol

4 

5Codex app-server is the interface Codex uses to power rich clients (for example, the Codex VS Code extension). Use it when you want a deep integration inside your own product: authentication, conversation history, approvals, and streamed agent events. The app-server implementation is open source in the Codex GitHub repository ([openai/codex/codex-rs/app-server](https://github.com/openai/codex/tree/main/codex-rs/app-server)). See the [Open Source](https://developers.openai.com/codex/open-source) page for the full list of open-source Codex components.3Codex app-server is the interface Codex uses to power rich clients (for example, the Codex VS Code extension). Use it when you want a deep integration inside your own product: authentication, conversation history, approvals, and streamed agent events. The app-server implementation is open source in the Codex GitHub repository ([openai/codex/codex-rs/app-server](https://github.com/openai/codex/tree/main/codex-rs/app-server)). See the [Open Source](https://developers.openai.com/codex/open-source) page for the full list of open-source Codex components.

6 4 

7If you are automating jobs or running Codex in CI, use the5If you are automating jobs or running Codex in CI, use the

8[Codex SDK](https://developers.openai.com/codex/sdk) instead.6 <a href="/codex/sdk">Codex SDK</a> instead.

9 7 

10## Protocol8## Protocol

11 9 

14Supported transports:12Supported transports:

15 13 

16- `stdio` (`--listen stdio://`, default): newline-delimited JSON (JSONL).14- `stdio` (`--listen stdio://`, default): newline-delimited JSON (JSONL).

17- `websocket` (`--listen ws://IP:PORT`, experimental): one JSON-RPC message per WebSocket text frame.15- `websocket` (`--listen ws://IP:PORT`, experimental and unsupported): one JSON-RPC message per WebSocket text frame.

16- `off` (`--listen off`): don't expose a local transport.

17 

18When you run with `--listen ws://IP:PORT`, the same listener also serves basic HTTP health probes:

19 

20- `GET /readyz` returns `200 OK` once the listener accepts new connections.

21- `GET /healthz` returns `200 OK` when the request doesn't include an `Origin` header.

22- Requests with an `Origin` header are rejected with `403 Forbidden`.

23 

24WebSocket transport is experimental and unsupported. Loopback listeners such as `ws://127.0.0.1:PORT` are appropriate for localhost and SSH port-forwarding workflows. Non-loopback WebSocket listeners currently allow unauthenticated connections by default during rollout, so configure WebSocket auth before exposing one remotely.

25 

26Supported WebSocket auth flags:

27 

28- `--ws-auth capability-token --ws-token-file /absolute/path`

29- `--ws-auth capability-token --ws-token-sha256 HEX`

30- `--ws-auth signed-bearer-token --ws-shared-secret-file /absolute/path`

31 

32For signed bearer tokens, you can also set `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds`. Clients present the credential as `Authorization: Bearer <token>` during the WebSocket handshake, and app-server enforces auth before JSON-RPC `initialize`.

33 

34Prefer `--ws-token-file` over passing raw bearer tokens on the command line. Use `--ws-token-sha256` only when the client keeps the raw high-entropy token in a separate local secret store; the hash is only a verifier, and clients still need the original token.

18 35 

19In WebSocket mode, app-server uses bounded queues. When request ingress is full, the server rejects new requests with JSON-RPC error code `-32001` and message `"Server overloaded; retry later."` Clients should retry with an exponentially increasing delay and jitter.36In WebSocket mode, app-server uses bounded queues. When request ingress is full, the server rejects new requests with JSON-RPC error code `-32001` and message `"Server overloaded; retry later."` Clients should retry with an exponentially increasing delay and jitter.

20 37 

23Requests include `method`, `params`, and `id`:40Requests include `method`, `params`, and `id`:

24 41 

25```json42```json

26{ "method": "thread/start", "id": 10, "params": { "model": "gpt-5.1-codex" } }43{ "method": "thread/start", "id": 10, "params": { "model": "gpt-5.4" } }

27```44```

28 45 

29Responses echo the `id` with either `result` or `error`:46Responses echo the `id` with either `result` or `error`:

58Example (Node.js / TypeScript):75Example (Node.js / TypeScript):

59 76 

60```ts77```ts

61import { spawn } from "node:child_process";78 

62import readline from "node:readline";79 

63 80 

64const proc = spawn("codex", ["app-server"], {81const proc = spawn("codex", ["app-server"], {

65 stdio: ["pipe", "pipe", "inherit"],82 stdio: ["pipe", "pipe", "inherit"],

101 },118 },

102});119});

103send({ method: "initialized", params: {} });120send({ method: "initialized", params: {} });

104send({ method: "thread/start", id: 1, params: { model: "gpt-5.1-codex" } });121send({ method: "thread/start", id: 1, params: { model: "gpt-5.4" } });

105```122```

106 123 

107## Core primitives124## Core primitives

118- **Start (or resume) a thread**: Call `thread/start` for a new conversation, `thread/resume` to continue an existing one, or `thread/fork` to branch history into a new thread id.135- **Start (or resume) a thread**: Call `thread/start` for a new conversation, `thread/resume` to continue an existing one, or `thread/fork` to branch history into a new thread id.

119- **Begin a turn**: Call `turn/start` with the target `threadId` and user input. Optional fields override model, personality, `cwd`, sandbox policy, and more.136- **Begin a turn**: Call `turn/start` with the target `threadId` and user input. Optional fields override model, personality, `cwd`, sandbox policy, and more.

120- **Steer an active turn**: Call `turn/steer` to append user input to the currently in-flight turn without creating a new turn.137- **Steer an active turn**: Call `turn/steer` to append user input to the currently in-flight turn without creating a new turn.

121- **Stream events**: After `turn/start`, keep reading notifications on stdout: `item/started`, `item/completed`, `item/agentMessage/delta`, tool progress, and other updates.138- **Stream events**: After `turn/start`, keep reading notifications on stdout: `thread/archived`, `thread/unarchived`, `item/started`, `item/completed`, `item/agentMessage/delta`, tool progress, and other updates.

122- **Finish the turn**: The server emits `turn/completed` with final status when the model finishes or after a `turn/interrupt` cancellation.139- **Finish the turn**: The server emits `turn/completed` with final status when the model finishes or after a `turn/interrupt` cancellation.

123 140 

124## Initialization141## Initialization

125 142 

126Clients must send a single `initialize` request per transport connection before invoking any other method on that connection, then acknowledge with an `initialized` notification. Requests sent before initialization receive a `Not initialized` error, and repeated `initialize` calls on the same connection return `Already initialized`.143Clients must send a single `initialize` request per transport connection before invoking any other method on that connection, then acknowledge with an `initialized` notification. Requests sent before initialization receive a `Not initialized` error, and repeated `initialize` calls on the same connection return `Already initialized`.

127 144 

128The server returns the user agent string it will present to upstream services. Set `clientInfo` to identify your integration.145The server returns the user agent string it will present to upstream services plus `platformFamily` and `platformOs` values that describe the runtime target. Set `clientInfo` to identify your integration.

129 146 

130`initialize.params.capabilities` also supports per-connection notification opt-out via `optOutNotificationMethods`, which is a list of exact method names to suppress for that connection. Matching is exact (no wildcards/prefixes). Unknown method names are accepted and ignored.147`initialize.params.capabilities` also supports per-connection notification opt-out via `optOutNotificationMethods`, which is a list of exact method names to suppress for that connection. Matching is exact (no wildcards/prefixes). Unknown method names are accepted and ignored.

131 148 

161 },178 },

162 "capabilities": {179 "capabilities": {

163 "experimentalApi": true,180 "experimentalApi": true,

164 "optOutNotificationMethods": [181 "optOutNotificationMethods": ["thread/started", "item/agentMessage/delta"]

165 "codex/event/session_configured",

166 "item/agentMessage/delta"

167 ]

168 }182 }

169 }183 }

170}184}

203- `thread/start` - create a new thread; emits `thread/started` and automatically subscribes you to turn/item events for that thread.217- `thread/start` - create a new thread; emits `thread/started` and automatically subscribes you to turn/item events for that thread.

204- `thread/resume` - reopen an existing thread by id so later `turn/start` calls append to it.218- `thread/resume` - reopen an existing thread by id so later `turn/start` calls append to it.

205- `thread/fork` - fork a thread into a new thread id by copying stored history; emits `thread/started` for the new thread.219- `thread/fork` - fork a thread into a new thread id by copying stored history; emits `thread/started` for the new thread.

206- `thread/read` - read a stored thread by id without resuming it; set `includeTurns` to return full turn history.220- `thread/read` - read a stored thread by id without resuming it; set `includeTurns` to return full turn history. Returned `thread` objects include runtime `status`.

207- `thread/list` - page through stored thread logs; supports cursor-based pagination plus `modelProviders`, `sourceKinds`, `archived`, and `cwd` filters.221- `thread/list` - page through stored thread logs; supports cursor-based pagination plus `modelProviders`, `sourceKinds`, `archived`, `cwd`, and `searchTerm` filters. Returned `thread` objects include runtime `status`.

222- `thread/turns/list` - page through a stored thread's turn history without resuming it.

208- `thread/loaded/list` - list the thread ids currently loaded in memory.223- `thread/loaded/list` - list the thread ids currently loaded in memory.

209- `thread/archive` - move a thread’s log file into the archived directory; returns `{}` on success.224- `thread/name/set` - set or update a thread's user-facing name for a loaded thread or a persisted rollout; emits `thread/name/updated`.

210- `thread/unarchive` - restore an archived thread rollout back into the active sessions directory; returns the restored `thread`.225- `thread/goal/set` - set the goal for a loaded thread (experimental; requires `capabilities.experimentalApi`); emits `thread/goal/updated`.

226- `thread/goal/get` - read the current goal for a loaded thread (experimental; requires `capabilities.experimentalApi`).

227- `thread/goal/clear` - clear the goal for a loaded thread (experimental; requires `capabilities.experimentalApi`); emits `thread/goal/cleared`.

228- `thread/metadata/update` - patch SQLite-backed stored thread metadata; currently supports persisted `gitInfo`.

229- `thread/archive` - move a thread's log file into the archived directory; returns `{}` on success and emits `thread/archived`.

230- `thread/unsubscribe` - unsubscribe this connection from thread turn/item events. If this was the last subscriber, the server unloads the thread after a no-subscriber inactivity grace period and emits `thread/closed`.

231- `thread/unarchive` - restore an archived thread rollout back into the active sessions directory; returns the restored `thread` and emits `thread/unarchived`.

232- `thread/status/changed` - notification emitted when a loaded thread's runtime `status` changes.

211- `thread/compact/start` - trigger conversation history compaction for a thread; returns `{}` immediately while progress streams via `turn/*` and `item/*` notifications.233- `thread/compact/start` - trigger conversation history compaction for a thread; returns `{}` immediately while progress streams via `turn/*` and `item/*` notifications.

234- `thread/shellCommand` - run a user-initiated shell command against a thread. This runs outside the sandbox with full access and doesn't inherit the thread sandbox policy.

235- `thread/backgroundTerminals/clean` - stop all running background terminals for a thread (experimental; requires `capabilities.experimentalApi`).

212- `thread/rollback` - drop the last N turns from the in-memory context and persist a rollback marker; returns the updated `thread`.236- `thread/rollback` - drop the last N turns from the in-memory context and persist a rollback marker; returns the updated `thread`.

213- `turn/start` - add user input to a thread and begin Codex generation; responds with the initial `turn` and streams events. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode."237- `turn/start` - add user input to a thread and begin Codex generation; responds with the initial `turn` and streams events. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode."

238- `thread/inject_items` - append raw Responses API items to a loaded thread's model-visible history without starting a user turn.

214- `turn/steer` - append user input to the active in-flight turn for a thread; returns the accepted `turnId`.239- `turn/steer` - append user input to the active in-flight turn for a thread; returns the accepted `turnId`.

215- `turn/interrupt` - request cancellation of an in-flight turn; success is `{}` and the turn ends with `status: "interrupted"`.240- `turn/interrupt` - request cancellation of an in-flight turn; success is `{}` and the turn ends with `status: "interrupted"`.

216- `review/start` - kick off the Codex reviewer for a thread; emits `enteredReviewMode` and `exitedReviewMode` items.241- `review/start` - kick off the Codex reviewer for a thread; emits `enteredReviewMode` and `exitedReviewMode` items.

217- `command/exec` - run a single command under the server sandbox without starting a thread/turn.242- `command/exec` - run a single command under the server sandbox without starting a thread/turn.

243- `command/exec/write` - write `stdin` bytes to a running `command/exec` session or close `stdin`.

244- `command/exec/resize` - resize a running PTY-backed `command/exec` session.

245- `command/exec/terminate` - stop a running `command/exec` session.

246- `command/exec/outputDelta` (notify) - emitted for base64-encoded stdout/stderr chunks from a streaming `command/exec` session.

218- `model/list` - list available models (set `includeHidden: true` to include entries with `hidden: true`) with effort options, optional `upgrade`, and `inputModalities`.247- `model/list` - list available models (set `includeHidden: true` to include entries with `hidden: true`) with effort options, optional `upgrade`, and `inputModalities`.

248- `modelProvider/capabilities/read` - read provider capability bounds for model/provider combinations (experimental; requires `capabilities.experimentalApi`).

219- `experimentalFeature/list` - list feature flags with lifecycle stage metadata and cursor pagination.249- `experimentalFeature/list` - list feature flags with lifecycle stage metadata and cursor pagination.

250- `experimentalFeature/enablement/set` - patch in-memory runtime enablement for supported feature keys such as `apps` and `plugins`.

220- `collaborationMode/list` - list collaboration mode presets (experimental, no pagination).251- `collaborationMode/list` - list collaboration mode presets (experimental, no pagination).

221- `skills/list` - list skills for one or more `cwd` values (supports `forceReload` and optional `perCwdExtraUserRoots`).252- `skills/list` - list skills for one or more `cwd` values (supports `forceReload` and optional `perCwdExtraUserRoots`).

253- `skills/changed` (notify) - emitted when watched local skill files change.

254- `marketplace/add` - add a remote plugin marketplace and persist it into the user's marketplace config.

255- `marketplace/upgrade` - refresh a configured Git marketplace, or all configured Git marketplaces when you omit the marketplace name.

256- `plugin/list` - list discovered plugin marketplaces and plugin state, including install/auth policy metadata, marketplace load errors, featured plugin ids, and local, Git, or remote plugin source metadata.

257- `plugin/read` - read one plugin by marketplace path or remote marketplace name and plugin name, including bundled skills, apps, and MCP server names when those details are available.

258- `plugin/install` - install a plugin from a marketplace path or remote marketplace name.

259- `plugin/uninstall` - uninstall an installed plugin.

222- `app/list` - list available apps (connectors) with pagination plus accessibility/enabled metadata.260- `app/list` - list available apps (connectors) with pagination plus accessibility/enabled metadata.

223- `skills/config/write` - enable or disable skills by path.261- `skills/config/write` - enable or disable skills by path.

224- `mcpServer/oauth/login` - start an OAuth login for a configured MCP server; returns an authorization URL and emits `mcpServer/oauthLogin/completed` on completion.262- `mcpServer/oauth/login` - start an OAuth login for a configured MCP server; returns an authorization URL and emits `mcpServer/oauthLogin/completed` on completion.

225- `tool/requestUserInput` - prompt the user with 1-3 short questions for a tool call (experimental); questions can set `isOther` for a free-form option.263- `tool/requestUserInput` - prompt the user with 1-3 short questions for a tool call (experimental); questions can set `isOther` for a free-form option.

226- `config/mcpServer/reload` - reload MCP server configuration from disk and queue a refresh for loaded threads.264- `config/mcpServer/reload` - reload MCP server configuration from disk and queue a refresh for loaded threads.

227- `mcpServerStatus/list` - list MCP servers, tools, resources, and auth status (cursor + limit pagination).265- `mcpServerStatus/list` - list MCP servers, tools, resources, and auth status (cursor + limit pagination). Use `detail: "full"` for full data or `detail: "toolsAndAuthOnly"` to omit resources.

228- `feedback/upload` - submit a feedback report (classification + optional reason/logs + conversation id).266- `mcpServer/resource/read` - read a single MCP resource through an initialized MCP server.

267- `mcpServer/tool/call` - call a tool on a thread's configured MCP server.

268- `mcpServer/startupStatus/updated` (notify) - emitted when a configured MCP server's startup status changes for a loaded thread.

269- `windowsSandbox/setupStart` - start Windows sandbox setup for `elevated` or `unelevated` mode; returns quickly and later emits `windowsSandbox/setupCompleted`.

270- `feedback/upload` - submit a feedback report (classification + optional reason/logs + conversation id, plus optional `extraLogFiles` attachments).

229- `config/read` - fetch the effective configuration on disk after resolving configuration layering.271- `config/read` - fetch the effective configuration on disk after resolving configuration layering.

272- `externalAgentConfig/detect` - detect external-agent artifacts that can be migrated with `includeHome` and optional `cwds`; each detected item includes `cwd` (`null` for home).

273- `externalAgentConfig/import` - apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home). Supported item types include config, skills, `AGENTS.md`, plugins, MCP server config, subagents, hooks, commands, and sessions; plugin imports emit `externalAgentConfig/import/completed`.

230- `config/value/write` - write a single configuration key/value to the user's `config.toml` on disk.274- `config/value/write` - write a single configuration key/value to the user's `config.toml` on disk.

231- `config/batchWrite` - apply configuration edits atomically to the user's `config.toml` on disk.275- `config/batchWrite` - apply configuration edits atomically to the user's `config.toml` on disk.

232- `configRequirements/read` - fetch requirements from `requirements.toml` and/or MDM, including allow-lists and residency requirements (or `null` if you haven’t set any up).276- `configRequirements/read` - fetch requirements from `requirements.toml` and/or MDM, including allow-lists, pinned `featureRequirements`, and residency/network requirements (or `null` if you haven't set any up).

277- `fs/readFile`, `fs/writeFile`, `fs/createDirectory`, `fs/getMetadata`, `fs/readDirectory`, `fs/remove`, `fs/copy`, `fs/watch`, `fs/unwatch`, and `fs/changed` (notify) - operate on absolute filesystem paths through the app-server v2 filesystem API.

278 

279Plugin summaries include a `source` union. Local plugins return

280`{ "type": "local", "path": ... }`, Git-backed marketplace entries return

281`{ "type": "git", "url": ..., "path": ..., "refName": ..., "sha": ... }`,

282and remote catalog entries return `{ "type": "remote" }`. For remote-only

283catalog entries, `PluginMarketplaceEntry.path` can be `null`; pass

284`remoteMarketplaceName` instead of `marketplacePath` when reading or installing

285those plugins.

233 286 

234## Models287## Models

235 288 

241{ "method": "model/list", "id": 6, "params": { "limit": 20, "includeHidden": false } }294{ "method": "model/list", "id": 6, "params": { "limit": 20, "includeHidden": false } }

242{ "id": 6, "result": {295{ "id": 6, "result": {

243 "data": [{296 "data": [{

244 "id": "gpt-5.2-codex",297 "id": "gpt-5.4",

245 "model": "gpt-5.2-codex",298 "model": "gpt-5.4",

246 "upgrade": "gpt-5.3-codex",299 "displayName": "GPT-5.4",

247 "displayName": "GPT-5.2 Codex",

248 "hidden": false,300 "hidden": false,

249 "defaultReasoningEffort": "medium",301 "defaultReasoningEffort": "medium",

250 "reasoningEffort": [{302 "supportedReasoningEfforts": [{

251 "effort": "low",303 "reasoningEffort": "low",

252 "description": "Lower latency"304 "description": "Lower latency"

253 }],305 }],

254 "inputModalities": ["text", "image"],306 "inputModalities": ["text", "image"],

261 313 

262Each model entry can include:314Each model entry can include:

263 315 

264- `reasoningEffort` - supported effort options for the model.316- `supportedReasoningEfforts` - supported effort options for the model.

265- `defaultReasoningEffort` - suggested default effort for clients.317- `defaultReasoningEffort` - suggested default effort for clients.

266- `upgrade` - optional recommended upgrade model id for migration prompts in clients.318- `upgrade` - optional recommended upgrade model id for migration prompts in clients.

319- `upgradeInfo` - optional upgrade metadata for migration prompts in clients.

267- `hidden` - whether the model is hidden from the default picker list.320- `hidden` - whether the model is hidden from the default picker list.

268- `inputModalities` - supported input types for the model (for example `text`, `image`).321- `inputModalities` - supported input types for the model (for example `text`, `image`).

269- `supportsPersonality` - whether the model supports personality-specific instructions such as `/personality`.322- `supportsPersonality` - whether the model supports personality-specific instructions such as `/personality`.

298## Threads351## Threads

299 352 

300- `thread/read` reads a stored thread without subscribing to it; set `includeTurns` to include turns.353- `thread/read` reads a stored thread without subscribing to it; set `includeTurns` to include turns.

301- `thread/list` supports cursor pagination plus `modelProviders`, `sourceKinds`, `archived`, and `cwd` filtering.354- `thread/turns/list` pages through a stored thread's turn history without resuming it.

355- `thread/list` supports cursor pagination plus `modelProviders`, `sourceKinds`, `archived`, `cwd`, and `searchTerm` filtering.

302- `thread/loaded/list` returns the thread IDs currently in memory.356- `thread/loaded/list` returns the thread IDs currently in memory.

303- `thread/archive` moves the thread's persisted JSONL log into the archived directory.357- `thread/archive` moves the thread's persisted JSONL log into the archived directory.

358- `thread/metadata/update` patches stored thread metadata, currently including persisted `gitInfo`.

359- `thread/unsubscribe` unsubscribes the current connection from a loaded thread and can trigger `thread/closed` after an inactivity grace period.

304- `thread/unarchive` restores an archived thread rollout back into the active sessions directory.360- `thread/unarchive` restores an archived thread rollout back into the active sessions directory.

305- `thread/compact/start` triggers compaction and returns `{}` immediately.361- `thread/compact/start` triggers compaction and returns `{}` immediately.

306- `thread/rollback` drops the last N turns from the in-memory context and records a rollback marker in the thread's persisted JSONL log.362- `thread/rollback` drops the last N turns from the in-memory context and records a rollback marker in the thread's persisted JSONL log.

363- `thread/inject_items` appends raw Responses API items to a loaded thread's model-visible history without starting a user turn.

307 364 

308### Start or resume a thread365### Start or resume a thread

309 366 

311 368 

312```json369```json

313{ "method": "thread/start", "id": 10, "params": {370{ "method": "thread/start", "id": 10, "params": {

314 "model": "gpt-5.1-codex",371 "model": "gpt-5.4",

315 "cwd": "/Users/me/project",372 "cwd": "/Users/me/project",

316 "approvalPolicy": "never",373 "approvalPolicy": "never",

317 "sandbox": "workspaceWrite",374 "sandbox": "workspaceWrite",

318 "personality": "friendly"375 "personality": "friendly",

376 "serviceName": "my_app_server_client"

319} }377} }

320{ "id": 10, "result": {378{ "id": 10, "result": {

321 "thread": {379 "thread": {

322 "id": "thr_123",380 "id": "thr_123",

323 "preview": "",381 "preview": "",

382 "ephemeral": false,

324 "modelProvider": "openai",383 "modelProvider": "openai",

325 "createdAt": 1730910000384 "createdAt": 1730910000

326 }385 }

328{ "method": "thread/started", "params": { "thread": { "id": "thr_123" } } }387{ "method": "thread/started", "params": { "thread": { "id": "thr_123" } } }

329```388```

330 389 

390`serviceName` is optional. Set it when you want app-server to tag thread-level metrics with your integration's service name.

391 

331To continue a stored session, call `thread/resume` with the `thread.id` you recorded earlier. The response shape matches `thread/start`. You can also pass the same configuration overrides supported by `thread/start`, such as `personality`:392To continue a stored session, call `thread/resume` with the `thread.id` you recorded earlier. The response shape matches `thread/start`. You can also pass the same configuration overrides supported by `thread/start`, such as `personality`:

332 393 

333```json394```json

335 "threadId": "thr_123",396 "threadId": "thr_123",

336 "personality": "friendly"397 "personality": "friendly"

337} }398} }

338{ "id": 11, "result": { "thread": { "id": "thr_123" } } }399{ "id": 11, "result": { "thread": { "id": "thr_123", "name": "Bug bash notes", "ephemeral": false } } }

339```400```

340 401 

341Resuming a thread doesn't update `thread.updatedAt` (or the rollout file's modified time) by itself. The timestamp updates when you start a turn.402Resuming a thread doesn't update `thread.updatedAt` (or the rollout file's modified time) by itself. The timestamp updates when you start a turn.

354{ "method": "thread/started", "params": { "thread": { "id": "thr_456" } } }415{ "method": "thread/started", "params": { "thread": { "id": "thr_456" } } }

355```416```

356 417 

418When a user-facing thread title has been set, app-server hydrates `thread.name` on `thread/list`, `thread/read`, `thread/resume`, `thread/unarchive`, and `thread/rollback` responses. `thread/start` and `thread/fork` may omit `name` (or return `null`) until a title is set later.

419 

357### Read a stored thread (without resuming)420### Read a stored thread (without resuming)

358 421 

359Use `thread/read` when you want stored thread data but don't want to resume the thread or subscribe to its events.422Use `thread/read` when you want stored thread data but don't want to resume the thread or subscribe to its events.

360 423 

361- `includeTurns` - when `true`, the response includes the thread's turns; when `false` or omitted, you get the thread summary only.424- `includeTurns` - when `true`, the response includes the thread's turns; when `false` or omitted, you get the thread summary only.

425- Returned `thread` objects include runtime `status` (`notLoaded`, `idle`, `systemError`, or `active` with `activeFlags`).

362 426 

363```json427```json

364{ "method": "thread/read", "id": 19, "params": { "threadId": "thr_123", "includeTurns": true } }428{ "method": "thread/read", "id": 19, "params": { "threadId": "thr_123", "includeTurns": true } }

365{ "id": 19, "result": { "thread": { "id": "thr_123", "turns": [] } } }429{ "id": 19, "result": { "thread": { "id": "thr_123", "name": "Bug bash notes", "ephemeral": false, "status": { "type": "notLoaded" }, "turns": [] } } }

366```430```

367 431 

368Unlike `thread/resume`, `thread/read` doesn't load the thread into memory or emit `thread/started`.432Unlike `thread/resume`, `thread/read` doesn't load the thread into memory or emit `thread/started`.

369 433 

434### List thread turns

435 

436Use `thread/turns/list` to page a stored thread's turn history without resuming it. Results default to newest-first so clients can fetch older turns with `nextCursor`. The response also includes `backwardsCursor`; pass it as `cursor` with `sortDirection: "asc"` to fetch turns newer than the first item from the earlier page.

437 

438```json

439{ "method": "thread/turns/list", "id": 20, "params": {

440 "threadId": "thr_123",

441 "limit": 50,

442 "sortDirection": "desc"

443} }

444{ "id": 20, "result": {

445 "data": [],

446 "nextCursor": "older-turns-cursor-or-null",

447 "backwardsCursor": "newer-turns-cursor-or-null"

448} }

449```

450 

370### List threads (with pagination & filters)451### List threads (with pagination & filters)

371 452 

372`thread/list` lets you render a history UI. Results default to newest-first by `createdAt`. Filters apply before pagination. Pass any combination of:453`thread/list` lets you render a history UI. Results default to newest-first by `createdAt`. Filters apply before pagination. Pass any combination of:

378- `sourceKinds` - restrict results to specific thread sources. When omitted or `[]`, the server defaults to interactive sources only: `cli` and `vscode`.459- `sourceKinds` - restrict results to specific thread sources. When omitted or `[]`, the server defaults to interactive sources only: `cli` and `vscode`.

379- `archived` - when `true`, list archived threads only. When `false` or omitted, list non-archived threads (default).460- `archived` - when `true`, list archived threads only. When `false` or omitted, list non-archived threads (default).

380- `cwd` - restrict results to threads whose session current working directory exactly matches this path.461- `cwd` - restrict results to threads whose session current working directory exactly matches this path.

462- `searchTerm` - search stored thread summaries and metadata before pagination.

381 463 

382`sourceKinds` accepts the following values:464`sourceKinds` accepts the following values:

383 465 

402} }484} }

403{ "id": 20, "result": {485{ "id": 20, "result": {

404 "data": [486 "data": [

405 { "id": "thr_a", "preview": "Create a TUI", "modelProvider": "openai", "createdAt": 1730831111, "updatedAt": 1730831111 },487 { "id": "thr_a", "preview": "Create a TUI", "ephemeral": false, "modelProvider": "openai", "createdAt": 1730831111, "updatedAt": 1730831111, "name": "TUI prototype", "status": { "type": "notLoaded" } },

406 { "id": "thr_b", "preview": "Fix tests", "modelProvider": "openai", "createdAt": 1730750000, "updatedAt": 1730750000 }488 { "id": "thr_b", "preview": "Fix tests", "ephemeral": true, "modelProvider": "openai", "createdAt": 1730750000, "updatedAt": 1730750000, "status": { "type": "notLoaded" } }

407 ],489 ],

408 "nextCursor": "opaque-token-or-null"490 "nextCursor": "opaque-token-or-null"

409} }491} }

411 493 

412When `nextCursor` is `null`, you have reached the final page.494When `nextCursor` is `null`, you have reached the final page.

413 495 

496### Update stored thread metadata

497 

498Use `thread/metadata/update` to patch stored thread metadata without resuming the thread. Today this supports persisted `gitInfo`; omitted fields are left unchanged, and explicit `null` clears a stored value.

499 

500```json

501{ "method": "thread/metadata/update", "id": 21, "params": {

502 "threadId": "thr_123",

503 "gitInfo": { "branch": "feature/sidebar-pr" }

504} }

505{ "id": 21, "result": {

506 "thread": {

507 "id": "thr_123",

508 "gitInfo": { "sha": null, "branch": "feature/sidebar-pr", "originUrl": null }

509 }

510} }

511```

512 

513### Track thread status changes

514 

515`thread/status/changed` is emitted whenever a loaded thread's runtime status changes. The payload includes `threadId` and the new `status`.

516 

517```json

518{

519 "method": "thread/status/changed",

520 "params": {

521 "threadId": "thr_123",

522 "status": { "type": "active", "activeFlags": ["waitingOnApproval"] }

523 }

524}

525```

526 

414### List loaded threads527### List loaded threads

415 528 

416`thread/loaded/list` returns thread IDs currently loaded in memory.529`thread/loaded/list` returns thread IDs currently loaded in memory.

420{ "id": 21, "result": { "data": ["thr_123", "thr_456"] } }533{ "id": 21, "result": { "data": ["thr_123", "thr_456"] } }

421```534```

422 535 

536### Unsubscribe from a loaded thread

537 

538`thread/unsubscribe` removes the current connection's subscription to a thread. The response status is one of:

539 

540- `unsubscribed` when the connection was subscribed and is now removed.

541- `notSubscribed` when the connection wasn't subscribed to that thread.

542- `notLoaded` when the thread isn't loaded.

543 

544If this was the last subscriber, the server keeps the thread loaded until it has no subscribers and no thread activity for 30 minutes. When the grace period expires, app-server unloads the thread and emits a `thread/status/changed` transition to `notLoaded` plus `thread/closed`.

545 

546```json

547{ "method": "thread/unsubscribe", "id": 22, "params": { "threadId": "thr_123" } }

548{ "id": 22, "result": { "status": "unsubscribed" } }

549```

550 

551If the thread later expires:

552 

553```json

554{ "method": "thread/status/changed", "params": {

555 "threadId": "thr_123",

556 "status": { "type": "notLoaded" }

557} }

558{ "method": "thread/closed", "params": { "threadId": "thr_123" } }

559```

560 

423### Archive a thread561### Archive a thread

424 562 

425Use `thread/archive` to move the persisted thread log (stored as a JSONL file on disk) into the archived sessions directory.563Use `thread/archive` to move the persisted thread log (stored as a JSONL file on disk) into the archived sessions directory.

427```json565```json

428{ "method": "thread/archive", "id": 22, "params": { "threadId": "thr_b" } }566{ "method": "thread/archive", "id": 22, "params": { "threadId": "thr_b" } }

429{ "id": 22, "result": {} }567{ "id": 22, "result": {} }

568{ "method": "thread/archived", "params": { "threadId": "thr_b" } }

430```569```

431 570 

432Archived threads won't appear in future calls to `thread/list` unless you pass `archived: true`.571Archived threads won't appear in future calls to `thread/list` unless you pass `archived: true`.

437 576 

438```json577```json

439{ "method": "thread/unarchive", "id": 24, "params": { "threadId": "thr_b" } }578{ "method": "thread/unarchive", "id": 24, "params": { "threadId": "thr_b" } }

440{ "id": 24, "result": { "thread": { "id": "thr_b" } } }579{ "id": 24, "result": { "thread": { "id": "thr_b", "name": "Bug bash notes" } } }

580{ "method": "thread/unarchived", "params": { "threadId": "thr_b" } }

441```581```

442 582 

443### Trigger thread compaction583### Trigger thread compaction

451{ "id": 25, "result": {} }591{ "id": 25, "result": {} }

452```592```

453 593 

594### Run a thread shell command

595 

596Use `thread/shellCommand` for user-initiated shell commands that belong to a thread. The request returns immediately with `{}` while progress streams through standard `turn/*` and `item/*` notifications.

597 

598This API runs outside the sandbox with full access and doesn't inherit the thread sandbox policy. Clients should expose it only for explicit user-initiated commands.

599 

600If the thread already has an active turn, the command runs as an auxiliary action on that turn and its formatted output is injected into the turn's message stream. If the thread is idle, app-server starts a standalone turn for the shell command.

601 

602```json

603{ "method": "thread/shellCommand", "id": 26, "params": { "threadId": "thr_b", "command": "git status --short" } }

604{ "id": 26, "result": {} }

605```

606 

607### Clean background terminals

608 

609Use `thread/backgroundTerminals/clean` to stop all running background terminals associated with a thread. This method is experimental and requires `capabilities.experimentalApi = true`.

610 

611```json

612{ "method": "thread/backgroundTerminals/clean", "id": 27, "params": { "threadId": "thr_b" } }

613{ "id": 27, "result": {} }

614```

615 

616### Roll back recent turns

617 

618Use `thread/rollback` to remove the last `numTurns` entries from the in-memory context and persist a rollback marker in the rollout log. The returned `thread` includes `turns` populated after the rollback.

619 

620```json

621{ "method": "thread/rollback", "id": 28, "params": { "threadId": "thr_b", "numTurns": 1 } }

622{ "id": 28, "result": { "thread": { "id": "thr_b", "name": "Bug bash notes", "ephemeral": false } } }

623```

624 

454## Turns625## Turns

455 626 

456The `input` field accepts a list of items:627The `input` field accepts a list of items:

480}651}

481```652```

482 653 

654On macOS, `includePlatformDefaults: true` appends a curated platform-default Seatbelt policy for restricted-read sessions. This improves tool compatibility without broadly allowing all of `/System`.

655 

483Examples:656Examples:

484 657 

485```json658```json

512 "writableRoots": ["/Users/me/project"],685 "writableRoots": ["/Users/me/project"],

513 "networkAccess": true686 "networkAccess": true

514 },687 },

515 "model": "gpt-5.1-codex",688 "model": "gpt-5.4",

516 "effort": "medium",689 "effort": "medium",

517 "summary": "concise",690 "summary": "concise",

518 "personality": "friendly",691 "personality": "friendly",

526{ "id": 30, "result": { "turn": { "id": "turn_456", "status": "inProgress", "items": [], "error": null } } }699{ "id": 30, "result": { "turn": { "id": "turn_456", "status": "inProgress", "items": [], "error": null } } }

527```700```

528 701 

702### Inject items into a thread

703 

704Use `thread/inject_items` to append prebuilt Responses API items to a loaded thread's prompt history without starting a user turn. These items are persisted to the rollout and included in subsequent model requests.

705 

706```json

707{ "method": "thread/inject_items", "id": 31, "params": {

708 "threadId": "thr_123",

709 "items": [

710 {

711 "type": "message",

712 "role": "assistant",

713 "content": [{ "type": "output_text", "text": "Previously computed context." }]

714 }

715 ]

716} }

717{ "id": 31, "result": {} }

718```

719 

529### Steer an active turn720### Steer an active turn

530 721 

531Use `turn/steer` to append more user input to the active in-flight turn.722Use `turn/steer` to append more user input to the active in-flight turn.

655- The server rejects empty `command` arrays.846- The server rejects empty `command` arrays.

656- `sandboxPolicy` accepts the same shape used by `turn/start` (for example, `dangerFullAccess`, `readOnly`, `workspaceWrite`, `externalSandbox`).847- `sandboxPolicy` accepts the same shape used by `turn/start` (for example, `dangerFullAccess`, `readOnly`, `workspaceWrite`, `externalSandbox`).

657- When omitted, `timeoutMs` falls back to the server default.848- When omitted, `timeoutMs` falls back to the server default.

849- Set `tty: true` for PTY-backed sessions, and use `processId` when you plan to follow up with `command/exec/write`, `command/exec/resize`, or `command/exec/terminate`.

850- Set `streamStdoutStderr: true` to receive `command/exec/outputDelta` notifications while the command is running.

851 

852### Read admin requirements (`configRequirements/read`)

853 

854Use `configRequirements/read` to inspect the effective admin requirements loaded from `requirements.toml` and/or MDM.

855 

856```json

857{ "method": "configRequirements/read", "id": 52, "params": {} }

858{ "id": 52, "result": {

859 "requirements": {

860 "allowedApprovalPolicies": ["onRequest", "unlessTrusted"],

861 "allowedSandboxModes": ["readOnly", "workspaceWrite"],

862 "featureRequirements": {

863 "personality": true,

864 "unified_exec": false

865 },

866 "network": {

867 "enabled": true,

868 "allowedDomains": ["api.openai.com"],

869 "allowUnixSockets": ["/tmp/example.sock"],

870 "dangerouslyAllowAllUnixSockets": false

871 }

872 }

873} }

874```

875 

876`result.requirements` is `null` when no requirements are configured. See the docs on [`requirements.toml`](https://developers.openai.com/codex/config-reference#requirementstoml) for details on supported keys and values.

877 

878### Windows sandbox setup (`windowsSandbox/setupStart`)

879 

880Custom Windows clients can trigger sandbox setup asynchronously instead of blocking on startup checks.

881 

882```json

883{ "method": "windowsSandbox/setupStart", "id": 53, "params": { "mode": "elevated" } }

884{ "id": 53, "result": { "started": true } }

885```

886 

887App-server starts setup in the background and later emits a completion notification:

888 

889```json

890{

891 "method": "windowsSandbox/setupCompleted",

892 "params": { "mode": "elevated", "success": true, "error": null }

893}

894```

895 

896Modes:

897 

898- `elevated` - run the elevated Windows sandbox setup path.

899- `unelevated` - run the legacy setup/preflight path.

900 

901## Filesystem

902 

903The v2 filesystem APIs operate on absolute paths. Use `fs/watch` when a client needs to invalidate UI state after a file or directory changes.

904 

905```json

906{ "method": "fs/watch", "id": 54, "params": {

907 "watchId": "0195ec6b-1d6f-7c2e-8c7a-56f2c4a8b9d1",

908 "path": "/Users/me/project/.git/HEAD"

909} }

910{ "id": 54, "result": { "path": "/Users/me/project/.git/HEAD" } }

911{ "method": "fs/changed", "params": {

912 "watchId": "0195ec6b-1d6f-7c2e-8c7a-56f2c4a8b9d1",

913 "changedPaths": ["/Users/me/project/.git/HEAD"]

914} }

915{ "method": "fs/unwatch", "id": 55, "params": {

916 "watchId": "0195ec6b-1d6f-7c2e-8c7a-56f2c4a8b9d1"

917} }

918{ "id": 55, "result": {} }

919```

920 

921Watching a file emits `fs/changed` for that file path, including updates delivered by replace or rename operations.

658 922 

659## Events923## Events

660 924 

661Event notifications are the server-initiated stream for thread lifecycles, turn lifecycles, and the items within them. After you start or resume a thread, keep reading the active transport stream for `thread/started`, `turn/*`, and `item/*` notifications.925Event notifications are the server-initiated stream for thread lifecycles, turn lifecycles, and the items within them. After you start or resume a thread, keep reading the active transport stream for `thread/started`, `thread/archived`, `thread/unarchived`, `thread/closed`, `thread/status/changed`, `turn/*`, `item/*`, and `serverRequest/resolved` notifications.

662 926 

663### Notification opt-out927### Notification opt-out

664 928 

666 930 

667- Exact-match only: `item/agentMessage/delta` suppresses only that method.931- Exact-match only: `item/agentMessage/delta` suppresses only that method.

668- Unknown method names are ignored.932- Unknown method names are ignored.

669- Applies to both legacy (`codex/event/*`) and v2 (`thread/*`, `turn/*`, `item/*`, etc.) notifications.933- Applies to the current `thread/*`, `turn/*`, `item/*`, and related v2 notifications.

670- Doesn't apply to requests, responses, or errors.934- Doesn't apply to requests, responses, or errors.

671 935 

672### Fuzzy file search events (experimental)936### Fuzzy file search events (experimental)

676- `fuzzyFileSearch/sessionUpdated` - `{ sessionId, query, files }` with the current matches for the active query.940- `fuzzyFileSearch/sessionUpdated` - `{ sessionId, query, files }` with the current matches for the active query.

677- `fuzzyFileSearch/sessionCompleted` - `{ sessionId }` once indexing and matching for that query completes.941- `fuzzyFileSearch/sessionCompleted` - `{ sessionId }` once indexing and matching for that query completes.

678 942 

943### Windows sandbox setup events

944 

945- `windowsSandbox/setupCompleted` - `{ mode, success, error }` emitted after a `windowsSandbox/setupStart` request finishes.

946 

679### Turn events947### Turn events

680 948 

681- `turn/started` - `{ turn }` with the turn id, empty `items`, and `status: "inProgress"`.949- `turn/started` - `{ turn }` with the turn id, empty `items`, and `status: "inProgress"`.

691`ThreadItem` is the tagged union carried in turn responses and `item/*` notifications. Common item types include:959`ThreadItem` is the tagged union carried in turn responses and `item/*` notifications. Common item types include:

692 960 

693- `userMessage` - `{id, content}` where `content` is a list of user inputs (`text`, `image`, or `localImage`).961- `userMessage` - `{id, content}` where `content` is a list of user inputs (`text`, `image`, or `localImage`).

694- `agentMessage` - `{id, text}` containing the accumulated agent reply.962- `agentMessage` - `{id, text, phase?}` containing the accumulated agent reply. When present, `phase` uses Responses API wire values (`commentary`, `final_answer`).

695- `plan` - `{id, text}` containing proposed plan text in plan mode. Treat the final `plan` item from `item/completed` as authoritative.963- `plan` - `{id, text}` containing proposed plan text in plan mode. Treat the final `plan` item from `item/completed` as authoritative.

696- `reasoning` - `{id, summary, content}` where `summary` holds streamed reasoning summaries and `content` holds raw reasoning blocks.964- `reasoning` - `{id, summary, content}` where `summary` holds streamed reasoning summaries and `content` holds raw reasoning blocks.

697- `commandExecution` - `{id, command, cwd, status, commandActions, aggregatedOutput?, exitCode?, durationMs?}`.965- `commandExecution` - `{id, command, cwd, status, commandActions, aggregatedOutput?, exitCode?, durationMs?}`.

698- `fileChange` - `{id, changes, status}` describing proposed edits; `changes` list `{path, kind, diff}`.966- `fileChange` - `{id, changes, status}` describing proposed edits; `changes` list `{path, kind, diff}`.

699- `mcpToolCall` - `{id, server, tool, status, arguments, result?, error?}`.967- `mcpToolCall` - `{id, server, tool, status, arguments, result?, error?}`.

968- `dynamicToolCall` - `{id, tool, arguments, status, contentItems?, success?, durationMs?}` for client-executed dynamic tool invocations.

700- `collabToolCall` - `{id, tool, status, senderThreadId, receiverThreadId?, newThreadId?, prompt?, agentStatus?}`.969- `collabToolCall` - `{id, tool, status, senderThreadId, receiverThreadId?, newThreadId?, prompt?, agentStatus?}`.

701- `webSearch` - `{id, query, action?}` for web search requests issued by the agent.970- `webSearch` - `{id, query, action?}` for web search requests issued by the agent.

702- `imageView` - `{id, path}` emitted when the agent invokes the image viewer tool.971- `imageView` - `{id, path}` emitted when the agent invokes the image viewer tool.

753Order of messages:1023Order of messages:

754 1024 

7551. `item/started` shows the pending `commandExecution` item with `command`, `cwd`, and other fields.10251. `item/started` shows the pending `commandExecution` item with `command`, `cwd`, and other fields.

7562. `item/commandExecution/requestApproval` includes `itemId`, `threadId`, `turnId`, optional `reason`, optional `command`, optional `cwd`, optional `commandActions`, and optional `proposedExecpolicyAmendment`.10262. `item/commandExecution/requestApproval` includes `itemId`, `threadId`, `turnId`, optional `reason`, optional `command`, optional `cwd`, optional `commandActions`, optional `proposedExecpolicyAmendment`, optional `networkApprovalContext`, and optional `availableDecisions`. When `initialize.params.capabilities.experimentalApi = true`, the payload can also include experimental `additionalPermissions` describing requested per-command sandbox access. Any filesystem paths inside `additionalPermissions` are absolute on the wire.

7573. Client responds with one of the command execution approval decisions above.10273. Client responds with one of the command execution approval decisions above.

7584. `item/completed` returns the final `commandExecution` item with `status: completed | failed | declined`.10284. `serverRequest/resolved` confirms that the pending request has been answered or cleared.

10295. `item/completed` returns the final `commandExecution` item with `status: completed | failed | declined`.

1030 

1031When `networkApprovalContext` is present, the prompt is for managed network access (not a general shell-command approval). The current v2 schema exposes the target `host` and `protocol`; clients should render a network-specific prompt and not rely on `command` being a user-meaningful shell command preview.

1032 

1033Codex groups concurrent network approval prompts by destination (`host`, protocol, and port). The app-server may therefore send one prompt that unblocks multiple queued requests to the same destination, while different ports on the same host are treated separately.

759 1034 

760### File change approvals1035### File change approvals

761 1036 

7641. `item/started` emits a `fileChange` item with proposed `changes` and `status: "inProgress"`.10391. `item/started` emits a `fileChange` item with proposed `changes` and `status: "inProgress"`.

7652. `item/fileChange/requestApproval` includes `itemId`, `threadId`, `turnId`, optional `reason`, and optional `grantRoot`.10402. `item/fileChange/requestApproval` includes `itemId`, `threadId`, `turnId`, optional `reason`, and optional `grantRoot`.

7663. Client responds with one of the file change approval decisions above.10413. Client responds with one of the file change approval decisions above.

7674. `item/completed` returns the final `fileChange` item with `status: completed | failed | declined`.10424. `serverRequest/resolved` confirms that the pending request has been answered or cleared.

10435. `item/completed` returns the final `fileChange` item with `status: completed | failed | declined`.

1044 

1045### `tool/requestUserInput`

1046 

1047When the client responds to `item/tool/requestUserInput`, app-server emits `serverRequest/resolved` with `{ threadId, requestId }`. If the pending request is cleared by turn start, turn completion, or turn interruption before the client answers, the server emits the same notification for that cleanup.

1048 

1049### Dynamic tool calls (experimental)

1050 

1051`dynamicTools` on `thread/start` and the corresponding `item/tool/call` request or response flow are experimental APIs.

1052 

1053When a dynamic tool is invoked during a turn, app-server emits:

1054 

10551. `item/started` with `item.type = "dynamicToolCall"`, `status = "inProgress"`, plus `tool` and `arguments`.

10562. `item/tool/call` as a server request to the client.

10573. The client response payload with returned content items.

10584. `item/completed` with `item.type = "dynamicToolCall"`, the final `status`, and any returned `contentItems` or `success` value.

768 1059 

769### MCP tool-call approvals (apps)1060### MCP tool-call approvals (apps)

770 1061 

771App (connector) tool calls can also require approval. When an app tool call has side effects, the server may elicit approval with `tool/requestUserInput` and options such as **Accept**, **Decline**, and **Cancel**. If the user declines or cancels, the related `mcpToolCall` item completes with an error instead of running the tool.1062App (connector) tool calls can also require approval. When an app tool call has side effects, the server may elicit approval with `tool/requestUserInput` and options such as **Accept**, **Decline**, and **Cancel**. Destructive tool annotations always trigger approval even when the tool also advertises less-privileged hints. If the user declines or cancels, the related `mcpToolCall` item completes with an error instead of running the tool.

772 1063 

773## Skills1064## Skills

774 1065 

850} }1141} }

851```1142```

852 1143 

1144The server also emits `skills/changed` notifications when watched local skill files change. Treat this as an invalidation signal and rerun `skills/list` with your current params when needed.

1145 

853To enable or disable a skill by path:1146To enable or disable a skill by path:

854 1147 

855```json1148```json

865 1158 

866## Apps (connectors)1159## Apps (connectors)

867 1160 

868Use `app/list` to fetch available apps. In the CLI/TUI, `/apps` is the user-facing picker; in custom clients, call `app/list` directly. Each entry includes both `isAccessible` (available to the user) and `isEnabled` (enabled in `config.toml`) so clients can distinguish install/access from local enabled state.1161Use `app/list` to fetch available apps. In the CLI/TUI, `/apps` is the user-facing picker; in custom clients, call `app/list` directly. Each entry includes both `isAccessible` (available to the user) and `isEnabled` (enabled in `config.toml`) so clients can distinguish install/access from local enabled state. App entries can also include optional `branding`, `appMetadata`, and `labels` fields.

869 1162 

870```json1163```json

871{ "method": "app/list", "id": 50, "params": {1164{ "method": "app/list", "id": 50, "params": {

881 "name": "Demo App",1174 "name": "Demo App",

882 "description": "Example connector for documentation.",1175 "description": "Example connector for documentation.",

883 "logoUrl": "https://example.com/demo-app.png",1176 "logoUrl": "https://example.com/demo-app.png",

1177 "logoUrlDark": null,

1178 "distributionChannel": null,

1179 "branding": null,

1180 "appMetadata": null,

1181 "labels": null,

884 "installUrl": "https://chatgpt.com/apps/demo-app/demo-app",1182 "installUrl": "https://chatgpt.com/apps/demo-app/demo-app",

885 "isAccessible": true,1183 "isAccessible": true,

886 "isEnabled": true1184 "isEnabled": true

906 "name": "Demo App",1204 "name": "Demo App",

907 "description": "Example connector for documentation.",1205 "description": "Example connector for documentation.",

908 "logoUrl": "https://example.com/demo-app.png",1206 "logoUrl": "https://example.com/demo-app.png",

1207 "logoUrlDark": null,

1208 "distributionChannel": null,

1209 "branding": null,

1210 "appMetadata": null,

1211 "labels": null,

909 "installUrl": "https://chatgpt.com/apps/demo-app/demo-app",1212 "installUrl": "https://chatgpt.com/apps/demo-app/demo-app",

910 "isAccessible": true,1213 "isAccessible": true,

911 "isEnabled": true1214 "isEnabled": true

938}1241}

939```1242```

940 1243 

1244### Config RPC examples for app settings

1245 

1246Use `config/read`, `config/value/write`, and `config/batchWrite` to inspect or update app controls in `config.toml`.

1247 

1248Read the effective app config shape (including `_default` and per-tool overrides):

1249 

1250```json

1251{ "method": "config/read", "id": 60, "params": { "includeLayers": false } }

1252{ "id": 60, "result": {

1253 "config": {

1254 "apps": {

1255 "_default": {

1256 "enabled": true,

1257 "destructive_enabled": true,

1258 "open_world_enabled": true

1259 },

1260 "google_drive": {

1261 "enabled": true,

1262 "destructive_enabled": false,

1263 "default_tools_approval_mode": "prompt",

1264 "tools": {

1265 "files/delete": { "enabled": false, "approval_mode": "approve" }

1266 }

1267 }

1268 }

1269 }

1270} }

1271```

1272 

1273Update a single app setting:

1274 

1275```json

1276{

1277 "method": "config/value/write",

1278 "id": 61,

1279 "params": {

1280 "keyPath": "apps.google_drive.default_tools_approval_mode",

1281 "value": "prompt",

1282 "mergeStrategy": "replace"

1283 }

1284}

1285```

1286 

1287Apply multiple app edits atomically:

1288 

1289```json

1290{

1291 "method": "config/batchWrite",

1292 "id": 62,

1293 "params": {

1294 "edits": [

1295 {

1296 "keyPath": "apps._default.destructive_enabled",

1297 "value": false,

1298 "mergeStrategy": "upsert"

1299 },

1300 {

1301 "keyPath": "apps.google_drive.tools.files/delete.approval_mode",

1302 "value": "approve",

1303 "mergeStrategy": "upsert"

1304 }

1305 ]

1306 }

1307}

1308```

1309 

1310### Detect and import external agent config

1311 

1312Use `externalAgentConfig/detect` to discover external-agent artifacts that can be migrated, then pass the selected entries to `externalAgentConfig/import`.

1313 

1314Detection example:

1315 

1316```json

1317{ "method": "externalAgentConfig/detect", "id": 63, "params": {

1318 "includeHome": true,

1319 "cwds": ["/Users/me/project"]

1320} }

1321{ "id": 63, "result": {

1322 "items": [

1323 {

1324 "itemType": "AGENTS_MD",

1325 "description": "Import /Users/me/project/CLAUDE.md to /Users/me/project/AGENTS.md.",

1326 "cwd": "/Users/me/project"

1327 },

1328 {

1329 "itemType": "SKILLS",

1330 "description": "Copy skill folders from /Users/me/.claude/skills to /Users/me/.agents/skills.",

1331 "cwd": null

1332 }

1333 ]

1334} }

1335```

1336 

1337Import example:

1338 

1339```json

1340{ "method": "externalAgentConfig/import", "id": 64, "params": {

1341 "migrationItems": [

1342 {

1343 "itemType": "AGENTS_MD",

1344 "description": "Import /Users/me/project/CLAUDE.md to /Users/me/project/AGENTS.md.",

1345 "cwd": "/Users/me/project"

1346 }

1347 ]

1348} }

1349{ "id": 64, "result": {} }

1350```

1351 

1352When a request includes plugin imports, the server emits `externalAgentConfig/import/completed` after the import finishes. This notification may arrive immediately after the response or after background remote imports complete.

1353 

1354Supported `itemType` values are `AGENTS_MD`, `CONFIG`, `SKILLS`, `PLUGINS`,

1355and `MCP_SERVER_CONFIG`. For `PLUGINS` items, `details.plugins` lists each

1356`marketplaceName` and the `pluginNames` Codex can try to migrate. Detection

1357returns only items that still have work to do. For example, Codex skips AGENTS

1358migration when `AGENTS.md` already exists and is non-empty, and skill imports

1359don't overwrite existing skill directories.

1360 

1361When detecting plugins from `.claude/settings.json`, Codex reads configured

1362marketplace sources from `extraKnownMarketplaces`. If `enabledPlugins` contains

1363plugins from `claude-plugins-official` but the marketplace source is missing,

1364Codex infers `anthropics/claude-plugins-official` as the source.

1365 

941## Auth endpoints1366## Auth endpoints

942 1367 

943The JSON-RPC auth/account surface exposes request/response methods plus server-initiated notifications (no `id`). Use these to determine auth state, start or cancel logins, logout, and inspect ChatGPT rate limits.1368The JSON-RPC auth/account surface exposes request/response methods plus server-initiated notifications (no `id`). Use these to determine auth state, start or cancel logins, logout, inspect ChatGPT rate limits, and notify workspace owners about depleted credits or usage limits.

944 1369 

945### Authentication modes1370### Authentication modes

946 1371 

947Codex supports three authentication modes. `account/updated.authMode` shows the active mode, and `account/read` also reports it.1372Codex supports these authentication modes. `account/updated.authMode` shows the active mode and includes the current ChatGPT `planType` when available. `account/read` also reports account and plan details.

948 1373 

949- **API key (`apikey`)** - the caller supplies an OpenAI API key and Codex stores it for API requests.1374- **API key (`apikey`)** - the caller supplies an OpenAI API key with `type: "apiKey"`, and Codex stores it for API requests.

950- **ChatGPT managed (`chatgpt`)** - Codex owns the ChatGPT OAuth flow, persists tokens, and refreshes them automatically.1375- **ChatGPT managed (`chatgpt`)** - Codex owns the ChatGPT OAuth flow, persists tokens, and refreshes them automatically. Start with `type: "chatgpt"` for the browser flow or `type: "chatgptDeviceCode"` for the device-code flow.

951- **ChatGPT external tokens (`chatgptAuthTokens`)** - a host app supplies `idToken` and `accessToken` directly. Codex stores these tokens in memory, and the host app must refresh them when asked.1376- **ChatGPT external tokens (`chatgptAuthTokens`)** - experimental and intended for host apps that already own the user's ChatGPT auth lifecycle. The host app supplies an `accessToken`, `chatgptAccountId`, and optional `chatgptPlanType` directly, and must refresh the token when asked.

952 1377 

953### API overview1378### API overview

954 1379 

955- `account/read` - fetch current account info; optionally refresh tokens.1380- `account/read` - fetch current account info; optionally refresh tokens.

956- `account/login/start` - begin login (`apiKey`, `chatgpt`, or `chatgptAuthTokens`).1381- `account/login/start` - begin login (`apiKey`, `chatgpt`, `chatgptDeviceCode`, or experimental `chatgptAuthTokens`).

957- `account/login/completed` (notify) - emitted when a login attempt finishes (success or error).1382- `account/login/completed` (notify) - emitted when a login attempt finishes (success or error).

958- `account/login/cancel` - cancel a pending ChatGPT login by `loginId`.1383- `account/login/cancel` - cancel a pending managed ChatGPT login by `loginId`.

959- `account/logout` - sign out; triggers `account/updated`.1384- `account/logout` - sign out; triggers `account/updated`.

960- `account/updated` (notify) - emitted whenever auth mode changes (`authMode`: `apikey`, `chatgpt`, `chatgptAuthTokens`, or `null`).1385- `account/updated` (notify) - emitted whenever auth mode changes (`authMode`: `apikey`, `chatgpt`, `chatgptAuthTokens`, or `null`) and includes `planType` when available.

961- `account/chatgptAuthTokens/refresh` (server request) - request fresh externally managed ChatGPT tokens after an authorization error.1386- `account/chatgptAuthTokens/refresh` (server request) - request fresh externally managed ChatGPT tokens after an authorization error.

962- `account/rateLimits/read` - fetch ChatGPT rate limits.1387- `account/rateLimits/read` - fetch ChatGPT rate limits.

963- `account/rateLimits/updated` (notify) - emitted whenever a user's ChatGPT rate limits change.1388- `account/rateLimits/updated` (notify) - emitted whenever a user's ChatGPT rate limits change.

1389- `account/sendAddCreditsNudgeEmail` - ask ChatGPT to email a workspace owner about depleted credits or a reached usage limit.

964- `mcpServer/oauthLogin/completed` (notify) - emitted after a `mcpServer/oauth/login` flow finishes; payload includes `{ name, success, error? }`.1390- `mcpServer/oauthLogin/completed` (notify) - emitted after a `mcpServer/oauth/login` flow finishes; payload includes `{ name, success, error? }`.

1391- `mcpServer/startupStatus/updated` (notify) - emitted when a configured MCP server's startup status changes for a loaded thread; payload includes `{ name, status, error }`.

965 1392 

966### 1) Check auth state1393### 1) Check auth state

967 1394 

1033 ```1462 ```

1034 1463 

1035 ```json1464 ```json

1036 { "method": "account/updated", "params": { "authMode": "apikey" } }1465 {

1466 "method": "account/updated",

1467 "params": { "authMode": "apikey", "planType": null }

1468 }

1037 ```1469 ```

1038 1470 

1039### 3) Log in with ChatGPT (browser flow)1471### 3) Log in with ChatGPT (browser flow)

1065 ```1498 ```

1066 1499 

1067 ```json1500 ```json

1068 { "method": "account/updated", "params": { "authMode": "chatgpt" } }1501 {

1502 "method": "account/updated",

1503 "params": { "authMode": "chatgpt", "planType": "plus" }

1504 }

1069 ```1505 ```

1070 1506 

1071### 3b) Log in with externally managed ChatGPT tokens (`chatgptAuthTokens`)1507### 3b) Log in with ChatGPT (device-code flow)

1072 1508 

1073Use this mode when a host application owns the user’s ChatGPT auth lifecycle and supplies tokens directly.1509Use this flow when your client owns the sign-in ceremony or when a browser callback is brittle.

1510 

15111. Start:

1512 

1513 ```json

1514 {

1515 "method": "account/login/start",

1516 "id": 4,

1517 "params": { "type": "chatgptDeviceCode" }

1518 }

1519 ```

1520 

1521 ```json

1522 {

1523 "id": 4,

1524 "result": {

1525 "type": "chatgptDeviceCode",

1526 "loginId": "<uuid>",

1527 "verificationUrl": "https://auth.openai.com/codex/device",

1528 "userCode": "ABCD-1234"

1529 }

1530 }

1531 ```

1532 

15332. Show `verificationUrl` and `userCode` to the user; the frontend owns the UX.

15343. Wait for notifications:

1535 

1536 ```json

1537 {

1538 "method": "account/login/completed",

1539 "params": { "loginId": "<uuid>", "success": true, "error": null }

1540 }

1541 ```

1542 

1543 ```json

1544 {

1545 "method": "account/updated",

1546 "params": { "authMode": "chatgpt", "planType": "plus" }

1547 }

1548 ```

1549 

1550### 3c) Log in with externally managed ChatGPT tokens (`chatgptAuthTokens`)

1551 

1552Use this experimental mode only when a host application owns the user's ChatGPT auth lifecycle and supplies tokens directly. Clients must set `capabilities.experimentalApi = true` during `initialize` before using this login type.

1074 1553 

10751. Send:15541. Send:

1076 1555 

1080 "id": 7,1559 "id": 7,

1081 "params": {1560 "params": {

1082 "type": "chatgptAuthTokens",1561 "type": "chatgptAuthTokens",

1083 "idToken": "<jwt>",1562 "accessToken": "<jwt>",

1084 "accessToken": "<jwt>"1563 "chatgptAccountId": "org-123",

1564 "chatgptPlanType": "business"

1085 }1565 }

1086 }1566 }

1087 ```1567 ```

1102 ```json1584 ```json

1103 {1585 {

1104 "method": "account/updated",1586 "method": "account/updated",

1105 "params": { "authMode": "chatgptAuthTokens" }1587 "params": { "authMode": "chatgptAuthTokens", "planType": "business" }

1106 }1588 }

1107 ```1589 ```

1108 1590 

1114 "id": 8,1596 "id": 8,

1115 "params": { "reason": "unauthorized", "previousAccountId": "org-123" }1597 "params": { "reason": "unauthorized", "previousAccountId": "org-123" }

1116}1598}

1117{ "id": 8, "result": { "idToken": "<jwt>", "accessToken": "<jwt>" } }1599{ "id": 8, "result": { "accessToken": "<jwt>", "chatgptAccountId": "org-123", "chatgptPlanType": "business" } }

1118```1600```