OpenAI Codex: who decides what

Code: start_or_steer hands inter-agent communication input to agent::submit (codex-rs/core/src/session/turn_input.rs:368-373); for other input it first tries to append the input to the active turn (steer_input); only on NoActiveTurn does it admit and spawn a new RegularTask; any other refusal reason is returned as NotSubmitted (codex-rs/core/src/session/turn_input.rs:414-491).

codex-rs/core/src/session/turn_input.rs:363

Code: steer_input refuses when the active task is a Review or Compact task, when the caller's expected turn id differs, when the input is empty, or when the caller requires a different final-output JSON schema than the running turn has (codex-rs/core/src/session/turn_input.rs:908-941).

codex-rs/core/src/session/turn_input.rs:917

Code: automatic starts (mailbox, response-item continuations) are refused if the current or proposed collaboration mode is Plan; user and recovery starts are always permitted (codex-rs/core/src/session/turn_input.rs:79-94, checked again before reservation at codex-rs/core/src/session/turn_input.rs:525-531).

codex-rs/core/src/session/turn_input.rs:82

Code: every new turn takes an admission token from the extension host (admit_turn_start); during a drain the input is refused as ServerDraining, except explicit input delegated by a parent to a thread-spawned sub-agent (codex-rs/core/src/session/turn_input.rs:436-455) and a one-shot review delegate finishing its parent's work (codex-rs/core/src/session/turn_input.rs:533-552).

codex-rs/core/src/session/turn_input.rs:449

Code: before (and again after) reserving an idle turn, start_if_idle refuses with PendingTriggerTurn if the mailbox holds trigger-turn items, and hands the start to the pending-work scheduler instead (codex-rs/core/src/session/turn_input.rs:518-522, 572-578).

codex-rs/core/src/session/turn_input.rs:518

Code: if a turn is active the command runs as an auxiliary of that turn (UserShellCommandMode::ActiveTurnAuxiliary) on a spawned task; otherwise a fresh turn context with default settings runs a UserShellCommandTask (codex-rs/core/src/session/handlers.rs:109-135).

codex-rs/core/src/session/handlers.rs:110

Code: review_prompt maps the target to the reviewer's instruction text: uncommitted changes, base branch and commit each get a fixed built-in prompt (a commit's title is embedded when supplied), while a custom target's own text, trimmed, IS the prompt; for a base branch it computes the merge base and embeds the SHA, falling back to a prompt that tells the reviewer to compute it with git when none is found (codex-rs/prompts/src/review_request.rs:18-40, 59-99).

codex-rs/prompts/src/review_request.rs:59

External with code: with no model given, code takes the catalog entry flagged is_default, else the first entry (codex-rs/models-manager/src/manager.rs:951-958); when provider fallback is allowed, a requested model absent from the catalog is replaced by that default (codex-rs/models-manager/src/manager.rs:900-907). The catalog itself comes from the provider's models endpoint or the bundled models.json.

codex-rs/models-manager/src/manager.rs:951

Code: the longest catalog slug that is a prefix of the requested name wins; if none matches, one leading namespace/ segment is stripped and the match retried; if still none, a hard-coded fallback descriptor is used (272,000-token window, bundled base prompt, unified-exec shell) (codex-rs/models-manager/src/manager.rs:1008-1042, codex-rs/models-manager/src/model_info.rs:98-148).

codex-rs/models-manager/src/manager.rs:1022

Code: the selected effort (collaboration mode setting, else the model default) is sent unchanged unless the model client has reasoning-effort overrides enabled for that model; only then is it resolved against the model (Ultra maps to the model's multi-agent effort when that is a supported non-Ultra level, else Max if supported, else the last non-Ultra supported level, else Medium; Persistent becomes disabled) and pinned per context window so sampling and compaction share it (codex-rs/core/src/session/reasoning_effort.rs:94-157; codex-rs/protocol/src/openai_models/reasoning_effort.rs:10-40).

codex-rs/core/src/session/reasoning_effort.rs:94

Code: StepSettings::apply checks each requested change against the managed ConfigRequirements; changing the model to one that requires auto-review forces the AutoReview reviewer unless the caller chose one; validate refuses a model that requires auto-review when the guardian is off or the turn has full-disk write access (codex-rs/core/src/session/step_settings.rs:253-337).

codex-rs/core/src/session/step_settings.rs:253

Code: only for an update that touches model settings (model, effort, summary, service tier) or that names neither a reviewer nor environments, and only with the step_model_switching feature on (otherwise the update is rejected outright), check_legacy_turn_safety refuses a destination that changes the admitted approval policy, the model-required review authority or the prefix-rule policy, or (via check_legacy_model_safety) uses fallback model metadata or changes the Cyber classification, node-REPL review requirement or availability, Guardian coverage, the explicit reviewer model, the Guardian V2 classification settings, or (with no reviewer override) the Guardian parent-fallback policies (codex-rs/core/src/session/step_activation.rs:32-221, called at :365-372 inside apply_turn_settings, gate at :243-250). The authors label these checks temporary: 'Remove these restrictions as their consumers migrate to captured step settings' (:29-31).

codex-rs/core/src/session/step_activation.rs:32

Code: update_selections keeps the first selection for each environment id, reuses a still-healthy previous environment with the same workspace, restarts failed ones, and silently skips ids the environment manager does not know; the first resolved selection is primary (codex-rs/core/src/environment_selection.rs:484-486, :540-697, :1338). Request-boundary validation refuses unknown or duplicate ids and over-long cwds (codex-rs/core/src/environment_selection.rs:138-161).

codex-rs/core/src/environment_selection.rs:484

The hosted realtime voice model decides, by calling its background_agent function; code accepts only a function_call item with that name, takes the transcript from known argument keys (else the raw arguments string), wraps it and submits it as a user turn with trigger realtime through StartOrSteer (codex-rs/codex-api/src/endpoint/realtime_websocket/protocol_v2.rs:142-166, :191-210; codex-rs/core/src/realtime_conversation.rs:1843-1854; codex-rs/core/src/session/turn_input.rs:816-834).

codex-rs/codex-api/src/endpoint/realtime_websocket/protocol_v2.rs:142

Code: the model catalog entry's instructions_template (or the config base_instructions override, codex-rs/models-manager/src/model_info.rs:46-48) is rendered by render_model_instructions; in incremental-tools windows custom base instructions are used as given (codex-rs/core/src/session/world_state.rs:97-136).

codex-rs/core/src/session/world_state.rs:81

Code: when the update_plan tool is off, no custom model catalog is set, and the instructions are Codex-owned (an incremental-tools window, no config base_instructions, or base instructions whose provenance is the model), without_update_plan_instructions deletes sections whose heading is exactly ## Planning (only if a line in it starts with one of two fixed sentences about the tool), ## `update_plan`, ## Plan tool or ## Plan Mode vs update_plan tool, plus a two-line Progress visibility: block and two bullet patterns with their indented continuations (codex-rs/prompts/src/update_plan_instructions.rs:4-58; trigger codex-rs/core/src/session/world_state.rs:81-96).

codex-rs/prompts/src/update_plan_instructions.rs:4

Code: when the personality setting is None, strip_personality_section removes the text from a line exactly # Personality to the next H1 heading (codex-rs/models-manager/src/model_info.rs:49-56, :61-88).

codex-rs/models-manager/src/model_info.rs:61

Code: in ordinary windows, when the previous model (the saved snapshot, else the previous turn's model) differs from the current one AND the new model's instructions are non-empty, the model section emits a ModelSwitchInstructions fragment carrying them; a switch to a model with empty instructions produces no notice. In incremental-tools windows it emits a ModelInstructions update naming the new model (unless the SuppressModelChangeAnnouncements feature is on, codex-rs/core/src/session/world_state.rs:106-109) and/or carrying changed instructions, and re-asserts the full base instructions when no prior snapshot is known. The initial-context builder puts a model-switch fragment first among developer sections (codex-rs/core/src/context/world_state/model.rs:38-143; codex-rs/core/src/session/mod.rs:4950-4956).

codex-rs/core/src/context/world_state/model.rs:119

Code: for each world-state section, render_history_diff decides what the model already saw: a persisted snapshot counts as Known unless the section requires its fragment to survive in history and it no longer does; with no snapshot, a text match of a legacy fragment in history counts as Unknown; otherwise Absent. Each section then renders only its change (codex-rs/core/src/context/world_state/mod.rs:534-577). The baseline is cleared on compaction, history replacement and front-trimming (codex-rs/core/src/context_manager/history.rs:737, :760, :801).

codex-rs/core/src/context/world_state/mod.rs:534

Code: if the active project is untrusted, project AGENTS.md discovery is skipped and only host-supplied user instructions remain (codex-rs/core/src/agents_md.rs:64-66); the cached snapshot is dropped when the trust level or environment selection changes (codex-rs/core/src/agents_md_manager.rs:89-95).

codex-rs/core/src/agents_md.rs:64

Code: walk up from the cwd to the nearest directory with a project-root marker (default .git; project-scoped config layers are not allowed to set the markers), then in each directory from root down to cwd take the FIRST existing candidate among AGENTS.override.md, AGENTS.md, then configured fallback names; files below the cwd and above the root are never read (codex-rs/core/src/agents_md.rs:192-296).

codex-rs/core/src/agents_md.rs:192

Code: one shared byte budget (project_doc_max_bytes, default 32 KiB, codex-rs/core/src/config/mod.rs:259, :4607) is spent in discovery order, root first and cwd last, across all environments; the file that crosses the budget is truncated and later files are dropped (codex-rs/core/src/agents_md.rs:68-95, :145-180). The section is re-sent with a replacement notice when the text changes (codex-rs/core/src/context/world_state/agents_md.rs:44-80).

codex-rs/core/src/agents_md.rs:156

Code: in CODEX_HOME, the first non-empty of AGENTS.override.md then AGENTS.md is used, trimmed; a failed read keeps the last good value and reports each warning once (codex-rs/codex-home/src/instructions/mod.rs:41-109).

codex-rs/codex-home/src/instructions/mod.rs:41

Code: thread-scoped instructions from the host provider over 10,000 estimated tokens fail the refresh with InvalidRequest; repository instructions are re-discovered only when the environment selection or trust level changed (codex-rs/core/src/agents_md_manager.rs:68-149, :187-199).

codex-rs/core/src/agents_md_manager.rs:192

Code: from_permission_profile derives a sandbox label from the permission profile (full write → danger-full-access, no writable roots → read-only, else workspace-write), picks the approval text by policy and reviewer, appends request-permission and approved-prefix sections, and lists writable roots and denied reads within a 32 KiB path budget (codex-rs/prompts/src/permissions_instructions.rs:184-279, :311-385, :49, :121-142). Later steps send only newly approved prefixes as a delta (codex-rs/core/src/context/world_state/permissions.rs:111-129).

codex-rs/prompts/src/permissions_instructions.rs:184

Code: the catalog's mode text wins, else the mode settings' non-empty developer instructions; when the update_plan tool is off, update_plan guidance is stripped from text counted as built-in, which is catalog text from a non-custom catalog, or settings text equal as a whole string to a bundled preset; custom text is left unchanged (codex-rs/core/src/context/world_state/collaboration_mode.rs:28-81).

codex-rs/core/src/context/world_state/collaboration_mode.rs:28

Code: EnvironmentsState collects per-environment cwd/status/shell, the PowerShell version (only with the PowerShellShellVersion feature and a single local PowerShell environment), the date, the timezone when include_environment_context_time is on, the network and filesystem summary of the primary environment, and, for multi-agent V2, a sub-agent list capped at 8 names and 1,024 bytes (V1 uses a legacy formatter). A fragment is sent only when an environment entry changed or the shell version, date, timezone, network or filesystem changed; it then carries the changed environment entries plus the current shell version, date, timezone, network, filesystem and sub-agent list. A change to the sub-agent list alone sends nothing (codex-rs/core/src/context/world_state/environment.rs:45-202; codex-rs/core/src/session/world_state.rs:40-41, :137-170).

codex-rs/core/src/context/world_state/environment.rs:45

Code: app instructions appear only when the config's include_apps_instructions is on, apps are enabled, at least one connector is accessible and enabled after app policy, and the model opts in (include_apps_usage_instructions); plugin instructions when plugins are available and the model opts in (codex-rs/core/src/session/world_state.rs:327-353).

codex-rs/core/src/session/world_state.rs:327

Code: build_initial_context_with_world_state gathers config developer instructions, extension thread/turn context, token-budget context, then world-state fragments; model-switch text goes first, multi-agent mode after the usage hint, managed developer instructions in their own trailing message, and for guardian sub-agents the developer instructions are emitted as a separate guardian-policy message (codex-rs/core/src/session/mod.rs:4781-5059).

codex-rs/core/src/session/mod.rs:4781

External: when the token-budget feature is on and the history-notes extension is not used, core calls the MCP tool notes/thread_hint and pastes its text into the context-window block (codex-rs/core/src/session/mod.rs:4879-4919).

codex-rs/core/src/session/mod.rs:4887

External with code: the recommendations endpoint supplies a plugin list; code removes installed, remotely installed and user-disabled ones (codex-rs/core-plugins/src/manager.rs:2066-2126); the result becomes RecommendedPluginsInstructions (codex-rs/core/src/session/mod.rs:4815-4834, :4983-4995).

codex-rs/core-plugins/src/manager.rs:2066

Code: build_tool_router registers core tools (shell, apply-patch, utilities, collaboration), MCP tools after exposure policy, extension tools, dynamic tools and hosted tools, filtered by the session tool policy and code-mode rules (codex-rs/core/src/tools/spec_plan.rs:122-189, :371-402).

codex-rs/core/src/tools/spec_plan.rs:122

Code: non-app MCP tools that are model-visible, plus app tools allowed by app policy, are registered; agent-plugin tools are admitted in discovery order while each spec is at most 8,000 bytes and the running total at most 64,000 bytes, and the rest are registered Hidden (codex-rs/core/src/mcp_tool_exposure.rs:19-20, :136-240).

codex-rs/core/src/mcp_tool_exposure.rs:136

Code: when the model supports the search tool, an eligible tool is deferred (reachable only via tool_search); otherwise it is direct; server and app omit_tools_from lists and direct-only namespaces narrow the choice, and in Code-Mode-only mode a tool is deferred only if it keeps its Code Mode exposure. With the CodeModeOnlyStrictThirdPartyTools feature in Code-Mode-only mode, this policy is skipped entirely: the operator's omit_tools_from lists are ignored (a conflict is logged with warn! only) and the tool keeps the exposure it was registered with (codex-rs/core/src/tools/spec_plan.rs:191-292).

codex-rs/core/src/tools/spec_plan.rs:200

Code: BM25 over each deferred tool's search text, embedder fitted to that corpus; the top limit (default 8) are returned and loaded for the next call (codex-rs/core/src/tools/handlers/tool_search.rs:166-175, :237, :334-348).

codex-rs/core/src/tools/handlers/tool_search.rs:342

Code: the catalog gets a budget of 2% of the context window in tokens (or a configured cap up to 10,000 tokens, or 8,000 characters when the window is unknown); if every full line fits it is shown whole; else, if every skill fits at its minimum, the remaining budget is shared out as shortened descriptions; else every description is removed and skills are kept in list order while their minimum lines still fit, the rest omitted (codex-rs/ext/skills/src/render.rs:23-26, :169-195, :380-421).

codex-rs/ext/skills/src/render.rs:380

Code: structured skill inputs resolve by path first; text mentions resolve by path, then by plain name only when exactly one enabled skill has that name and no connector shares the slug (codex-rs/skills/src/selection.rs:44-200, ambiguity check :181-193). Called from codex-rs/core/src/session/turn.rs:1153, :1230; guardian sub-agents never interpret mentions (codex-rs/core/src/session/turn.rs:1186-1190).

codex-rs/skills/src/selection.rs:44

Code: the extension's own collect_explicit_skill_mentions resolves structured and path mentions, then for a plain name takes the FIRST enabled catalog entry with that name, with no ambiguity check and no connector check (codex-rs/ext/skills/src/selection.rs:21-80, plain-name branch :65-76); its main prompt is read and truncated with a warning if too long (codex-rs/ext/skills/src/extension.rs:380, :436-460).

codex-rs/ext/skills/src/selection.rs:21

Code: when the memory tool feature and use_memories are on, the extension reads memory_summary.md from the memory root, truncates it to 2,500 tokens, renders it into the read-path template and adds it as a developer-policy fragment (v2: split into 8,900-byte fragments) (codex-rs/ext/memories/src/prompts.rs:35-64; codex-rs/ext/memories/src/extension.rs:46-53, :56-104; limit codex-rs/ext/memories/src/lib.rs:16).

codex-rs/ext/memories/src/prompts.rs:35

External: hook commands configured by the user or admin return additionalContext; core records each as a developer-role message (codex-rs/core/src/hook_runtime.rs:886-910; role codex-rs/core/src/context/hook_additional_context.rs:24-26), from prompt-submit hooks (codex-rs/core/src/session/turn.rs:1006-1034) and tool hooks (codex-rs/core/src/tools/registry.rs:973-976).

codex-rs/core/src/hook_runtime.rs:886

Code: each keyed entry is re-sent only when its value changed; Untrusted entries become a user-role fragment (or, with the UntrustedAsToolOutput feature on, a tool-output item) and Application entries a developer-role fragment (codex-rs/core/src/state/additional_context.rs:50-99), merged at every start or steer (codex-rs/core/src/session/turn_input.rs:985-1006).

codex-rs/core/src/state/additional_context.rs:50

Code: before each prompt the history is normalized: a call with no recorded output gets a synthetic output aborted; a function, custom-tool or client tool-search output whose call id matches no call is removed (named outputs with no call id, and server-executed tool-search outputs, are kept); and image/audio content is stripped when the model lacks the modality (codex-rs/core/src/context_manager/history.rs:1036-1055; codex-rs/core/src/context_manager/normalize.rs:21-155, :197-227, :346, :394).

codex-rs/core/src/context_manager/history.rs:1036

Code: inline images are resized/encoded per the model's detail or unified budget mode; remote URLs, low detail where unsupported, oversized and unprocessable images are replaced by fixed placeholder text that says why; user-message resizes can add a resize notice (codex-rs/core/src/image_preparation.rs:126-164, :33-39, :111-123).

codex-rs/core/src/image_preparation.rs:126

Code: the command, exit code, duration and output are recorded as a <user_shell_command> user-role fragment: as a conversation item for a standalone command, or injected into the running turn without starting a new one (codex-rs/core/src/tasks/user_shell.rs:440-468; fragment codex-rs/core/src/context/user_shell_command.rs:32-54).

codex-rs/core/src/tasks/user_shell.rs:440

Code: with the reminder feature on, a reminder is recorded on a new context window, when the interval is zero or has elapsed, and (in after-output mode) only after a user message or tool output (codex-rs/core/src/session/time_reminder.rs:63-96, :156-202).

codex-rs/core/src/session/time_reminder.rs:63

Code: a startup blob with token-budgeted sections: current thread (1,200), recent work from up to 40 recent threads grouped by cwd including other workspaces (2,200), a two-level workspace tree (1,600) and notes (300) (codex-rs/core/src/realtime_context.rs:30-45, :59).

codex-rs/core/src/realtime_context.rs:59

Code: managed additional_developer_instructions over 10,000 estimated tokens (including markers and the replacement notice) are rejected; accepted text is sent as its own developer message and replaced or withdrawn with an explicit notice when it changes (codex-rs/core/src/context/world_state/managed_developer_instructions.rs:59-85, :19-21).

codex-rs/core/src/context/world_state/managed_developer_instructions.rs:59

The main model answers it in one streamed Responses call per step (tool_choice: "auto"; parallel calls only when the prompt allows them and the model is not a Responses Lite model, codex-rs/core/src/client.rs:1161); the code only parses what comes back.

codex-rs/core/src/session/turn.rs:2833

Code: it continues when the response held any tool call (dispatched, or answered directly), when the server marked end_turn: false, or when user or mailbox input is pending; otherwise it runs the stop hooks and ends.

codex-rs/core/src/session/turn.rs:636

Code: build_tool_call maps FunctionCall to a Function payload, a client-executed ToolSearchCall to a ToolSearch payload and CustomToolCall to a Custom (freeform) payload, normalising the namespace; anything else is not a call.

codex-rs/core/src/tools/router.rs:271

Code: the registry looks the name up (unknown: "unsupported call: <name>" goes back to the model), checks the payload kind (mismatch: a FATAL error that ends the turn), then each handler parses the JSON arguments with serde (failure: "failed to parse function arguments" goes back to the model).

codex-rs/core/src/tools/registry.rs:768

Code: a Tree-sitter Bash query accepts exactly two whole-script shapes (apply_patch <<'EOF' ... EOF and cd <path> && apply_patch <<'EOF' ... EOF, or the direct argv form apply_patch <patch>); a match is verified and applied as a patch; a raw patch passed as the whole command is refused as "implicit invocation"; anything else runs in the shell unchanged.

codex-rs/core/src/tools/handlers/apply_patch.rs:459

Code: parse_patch checks the grammar; verify_apply_patch_args resolves every path, refuses two operations on one path, reads deleted files, and computes each update's new content by locating its old lines (C7).

codex-rs/core/src/tools/handlers/apply_patch.rs:483

Code: seek_sequence searches from the end of the previous hunk (not the file start) and tries four passes in decreasing strictness (exact, trailing whitespace ignored, both-side whitespace ignored, then Unicode dashes, quotes and spaces folded to ASCII), returning the FIRST position that matches in the earliest pass that matches; it never checks whether the context occurs more than once. For an end-of-file hunk it searches only from the last possible position onward; its doc comment says it falls back to searching from start, but the code has no such fallback. If no match is found and the hunk ends in a blank line, the caller retries once without that line (codex-rs/apply-patch/src/seek_sequence.rs:1-110; caller codex-rs/apply-patch/src/file_update.rs:68-120).

codex-rs/apply-patch/src/seek_sequence.rs:12

Code: each call starts as soon as its item finishes streaming; a tool that declares supports_parallel_tool_calls takes a shared (read) lock and runs alongside others, any other tool takes the exclusive (write) lock. Outputs are recorded back in call order.

codex-rs/core/src/tools/parallel.rs:286

Code: after a completed reasoning, commentary or partial-answer item, if mailbox items are pending and the DeferMailboxPreemption feature is off, sampling stops and the turn follows up; final answers and tool calls never trigger it.

codex-rs/core/src/session/turn.rs:3146

Code: a streaming parser splits deltas into normal text and plan segments as they arrive (handle_plan_segments); when the item completes, a second extractor pulls the plan text from the whole message and strips citations; citations are stripped from every visible message.

codex-rs/core/src/session/turn.rs:2543

Code: a watcher cancels the step's preempt token when user input arrives; the stream loop then either asks a Responses Lite server to drain the response and continues reading, or drops the stream at once and marks the step for follow-up; if the step is already draining a Responses Lite response for queued mailbox items, the cut only resets the token and reading continues (codex-rs/core/src/session/turn.rs:2934-2937). Tool calls already started keep running and are collected.

codex-rs/core/src/session/turn.rs:2938

Code: an empty patch is rejected; under UnlessTrusted it always asks; otherwise a patch whose every target (and move destination) is writable under the configured filesystem policy, with a sandbox available or a Disabled/External profile, is auto-approved; else it is rejected when the policy forbids sandbox prompts (Never, or Granular without sandbox_approval) and asks otherwise.

codex-rs/core/src/safety.rs:67

Code: the command is split into plain commands (bash -lc / PowerShell parsing, codex-rs/core/src/exec_policy.rs:913-943), unfamiliar executables are evaluated by executable alone (codex-rs/core/src/exec_policy/executable_identity.rs:62-101), then the merged Starlark-style .rules policy is checked with the D3 fallback for unmatched segments; Forbidden forbids, Prompt asks unless the approval policy disallows that prompt (then forbids), Allow skips approval and bypasses the sandbox only if every segment matched an explicit allow rule (codex-rs/core/src/exec_policy.rs:466-480).

codex-rs/core/src/exec_policy.rs:358

Code: if D4 flags it dangerous (or Windows has managed filesystem limits but no sandbox backend) it prompts, or is forbidden under Never; otherwise Never allows (relying on the sandbox), UnlessTrusted prompts, and OnRequest/Granular allow unless the call asks for a sandbox override, in which case they prompt; an unrestricted or external sandbox allows.

codex-rs/core/src/exec_policy.rs:807

Code: on POSIX only rm with a force flag matches, looked through sudo, env and trap wrappers and through literal commands inside a bash -lc script, up to 8 wrapper levels (deeper nesting is itself treated as dangerous); Windows adds its own word lists for cmd and PowerShell.

codex-rs/shell-command/src/command_safety/is_dangerous_command.rs:43

Code: the model's own prefix_rule suggestion is used if it is non-empty, not on a banned list, no policy rule already matched, and adding it as an allow rule would approve every parsed segment of the command; otherwise the first heuristic Prompt (or, for the sandbox-retry case, Allow) segment is proposed.

codex-rs/core/src/exec_policy.rs:1007

Code: if the filesystem policy has denied-read paths, only an approved explicit escalation widens it, and then still inside a sandbox (EscalatedSandboxWithRestrictions); otherwise an exec-policy Allow with bypass_sandbox or a request for escalated permissions bypasses the sandbox on the first attempt; else no override.

codex-rs/core/src/tools/sandboxing.rs:253

Code: if the profile needs sandboxing (or the tool requires it) the host's platform sandbox is chosen; on Windows with the sandbox disabled there is none, and the call then runs as SandboxType::None even though the policy asked for one.

codex-rs/sandboxing/src/manager.rs:313

Code: with no sandbox or exit 0 the answer is no; otherwise ANY non-zero exit whose stdout, stderr or aggregated output contains one of seven keywords ("operation not permitted", "permission denied", "read-only file system", "seccomp", "sandbox", "landlock", "failed to write file") is a denial; only after that check are exit codes 2/126/127 quick-rejected, and Linux seccomp's SIGSYS exit (128+SIGSYS) is a denial.

codex-rs/sandboxing/src/denial.rs:13

Code: no if the denial carried a network-policy decision that cannot be turned into a network approval, if the tool does not escalate on failure, if the approval policy does not want no-sandbox approvals (Never, OnRequest; OnRequest is let through only for a network denial that would itself need approval), or if denied-read restrictions forbid unsandboxed execution and the denial was not a network one; otherwise yes, with or without a fresh approval (D10).

codex-rs/core/src/tools/orchestrator.rs:449

Code: the retry skips approval when the first approval was not a human-required checkpoint (NeedsHumanApproval), strict auto-review is off, the denial was not a network one, and the tool's should_bypass_approval says so, which is true whenever the first attempt was approved by the person or a PermissionRequest hook (or the policy is Never); an approval given by the automatic reviewer does not carry over; otherwise it asks again with the retry reason (D32 when a person answers).

codex-rs/core/src/tools/orchestrator.rs:498

Code: depending on the request, a configured PermissionRequest hook, the automatic reviewer (D15) or the person answers it, and some requests are rejected before any of them is asked (codex-rs/core/src/tools/approvals.rs:520-699).

codex-rs/core/src/tools/approvals.rs:596

External: each trusted (D14) matching hook command receives the action as JSON on stdin and may answer by JSON decision or by exit 2 with a stderr reason (a deny); any Deny among the matching hooks wins, otherwise any Allow allows, except that an Allow from an environment-sourced hook is ignored (codex-rs/hooks/src/events/permission_request.rs:232-238); no decision falls through to D15 or the person (codex-rs/hooks/src/events/permission_request.rs:134-173), and for a human-required checkpoint an Allow also goes on to the person (D11).

codex-rs/core/src/hook_runtime.rs:274

External: trusted (D14) matching hook commands run before the handler; a hook blocks by exit code 2 with a reason on stderr, or by JSON decision: block with a reason; it may instead return an updated input, and the latest-finishing rewrite wins.

codex-rs/core/src/hook_runtime.rs:196

Code: built-in and managed hooks are trusted; any other hook runs only if its stored trusted hash equals the hash of its current normalized config (else Modified or Untrusted, and it is listed but not run), unless bypass_hook_trust is set; for a plugin hook with a content fingerprint the compared hash also covers the plugin's contents (codex-rs/hooks/src/engine/discovery.rs:836-841, :863-879), and a plugin hook with no fingerprint but a stored trusted hash is admitted with its trust record attached for a later check this card did not read (codex-rs/hooks/src/engine/discovery.rs:844-862, :917-919); with the managed-only requirement, non-managed sources are skipped entirely.

codex-rs/hooks/src/engine/discovery.rs:1000

Code: with full access the reviewer approves after only validating the action; otherwise registered approval contributors (the guardian-v2 extension, D16) answer first; with no contributor answer the review runs when guardian is required or when the policy is OnRequest/Granular with reviewer AutoReview, else the request goes to the person; a fresh review is forced by synchronous mode, a mandatory-review model without async scoring, cancellation, a retry, or an escalated exec.

codex-rs/ext/guardian-reviewer/src/routing.rs:127

Code (guardian-v2 contributor): with full access it allows; if the reviewer is the person or the policy is not on-request/granular it hands back; per the model policy's review mode, in Adaptive mode, when the host passed a serving assessment for the action it allows if that assessment needs no review and otherwise asks for a synchronous review (codex-rs/ext/guardian-v2/src/async_scorer/approval.rs:111-115); without one it reuses the newest score when the action fits the size budget, compaction is compatible, authorization evidence is unchanged, the score is within max_tool_call_lag tool calls, no unscored failure intervened, and action_risk < review_threshold; the first node-REPL computer-use js call is approved without a score when the policy allows it; anything else asks for a synchronous review (D18), which a newly published low score can still release early (not on the serving-assessment path, codex-rs/ext/guardian-v2/src/async_scorer/approval.rs:181-185).

codex-rs/ext/guardian-v2/src/async_scorer/approval.rs:318

LLM: a "Luna" sampler call returns its first output token, which must be exactly high or low; that becomes action_risk 1.0 or 0.0, published only if authorization and history generation are still current.

codex-rs/ext/guardian-v2/src/async_scorer/classification.rs:364

LLM: a separate reviewer session (model codex-auto-review by default, low reasoning effort when supported, else the parent model) receives the policy as base instructions and the transcript plus the exact action JSON, may make read-only tool checks, and must end with JSON whose outcome is allow or deny; up to 3 attempts within an overall deadline that defaults to 90 s when auto_review.timeout_ms is omitted (codex-rs/ext/guardian-reviewer/src/lib.rs:85-87).

codex-rs/ext/guardian-reviewer/src/review.rs:141

Code: per turn, 3 consecutive completed denials or 10 denials in the last 50 reviews (1 and 1 for a cyber-specialty model) interrupt the turn once with a TooManyDenials error. A review that runs and does not end in Deny, including a failed review, resets the consecutive count; a cached approval returns before any of this accounting (codex-rs/ext/guardian-reviewer/src/review.rs:218-246).

codex-rs/ext/guardian-reviewer/src/circuit_breaker.rs:53

Code: an in-memory map keyed by the serialized approval key: for commands the environment, executable, canonicalized command, cwd, tty, sandbox permissions, additional permissions and the exec-policy fingerprint; for patches each file path; if every key holds ApprovedForSession, skip; a new ApprovedForSession is stored per key.

codex-rs/core/src/tools/sandboxing.rs:72

Code: an unparseable host is blocked; an explicit deny entry always wins; unless local binding is allowed, loopback and non-public IP literals are blocked unless explicitly allowlisted, and allowlisted hostnames that resolve to non-public IPs are blocked (a failed or timed-out DNS lookup counts as non-public); otherwise the host must match the allowlist without matching a managed review selector, or (D23) be approved (codex-rs/network-proxy/src/runtime.rs:892-894).

codex-rs/network-proxy/src/runtime.rs:848

Code: session-denied hosts are denied and session-approved hosts allowed at once; with no active turn, an unattributable request, a non-Managed permission profile, or approval policy Never the request is denied; otherwise one pending approval per host/turn/execution is raised through D11, and the answer becomes allow-once, allow-for-session, or a persisted allow/deny network rule.

codex-rs/core/src/tools/network_approval.rs:717

Code: under Never, or Granular without request-permissions allowed, it returns an empty grant at once; otherwise it goes straight to the automatic reviewer (D15/D18) and, if no reviewer claims it, to the person (D30); an approval grants the requested profile for the turn (or the session for ApprovedForSession), normalized against the environment.

codex-rs/core/src/session/mod.rs:3287

Code: looks up the trust map by the directory, then the discovered project root, then the git repository root (so a linked worktree inherits its main repository's trust); only Trusted loads; Untrusted or no entry disables the project layer with a reason telling the person how to trust it.

codex-rs/config/src/loader/mod.rs:1083

Human: the person at the TUI approval overlay picks one of the options the core offered (available_decisions); "Yes, proceed" is the first option and uses the approve key.

codex-rs/tui/src/bottom_pane/approval_overlay.rs:859 (role: the person at the TUI approval overlay)

Human: the same overlay, with network-specific labels ("Yes, just this once", "Yes, and allow this host for this conversation", "Yes, and allow this host in the future", "No, and block this host in the future").

codex-rs/tui/src/bottom_pane/approval_overlay.rs:869 (role: the person at the TUI approval overlay)

Human: the person picks "Yes, proceed", "Yes, and don't ask again for these files", or "No, and tell Codex what to do differently".

codex-rs/tui/src/bottom_pane/approval_overlay.rs:1042 (role: the person at the TUI approval overlay)

Human: the person at the permissions overlay picks a grant scope or denies.

codex-rs/tui/src/bottom_pane/approval_overlay.rs:1062 (role: the person at the TUI approval overlay)

Human: the person sees the ordinary command overlay (D27's options) with the fixed reason "command failed; retry without sandbox?" and decides; reached only when D9 allows a retry and D10 requires a fresh approval. Like every approval it goes through request_approval, where a PermissionRequest hook (D12) deny always wins; otherwise a hook allow, or, when strict auto-review or the automatic reviewer is configured, the reviewer (D15), answers instead of the person, except that for a human-required checkpoint (NeedsHumanApproval) a hook allow is not enough and the reviewer is skipped (codex-rs/core/src/tools/approvals.rs:594-621, :681-699); the person decides only when neither answers.

codex-rs/core/src/tools/orchestrator.rs:536 (role: the person at the TUI approval overlay; reason text set here, built at codex-rs/core/src/tools/orchestrator.rs:661-665)

Code: no approval when the input is empty, a Ctrl-C to a non-TTY process, or the WriteStdinApproval feature is off. Otherwise approval is needed whenever the terminal runs with more than the baseline permissions (it was launched escalated, holds a filesystem escalation, its policy differs from the current one, or it carries additional permissions), or strict auto-review is on. Only on that path is input containing a NUL byte refused (codex-rs/core/src/unified_exec/stdin_approval.rs:125-148, :197-236).

codex-rs/core/src/unified_exec/stdin_approval.rs:191

Human: the person answers a blocking "Install MCP servers?" question with Install or Skip; Skip also stops the question for those servers this session. Code skips the question when the permission prompt is auto-approved (then installs) or the approval policy is Never (then does not).

codex-rs/core/src/mcp_skill_dependencies.rs:266 (role: the person answering the request_user_input question)

Code: the model may name any shell path (shell argument), otherwise the environment's reported shell (or the session shell) is used; a login shell is used unless config disables it; derive_exec_args builds the argv. In a remote environment the requested shell must match the environment's shell type.

codex-rs/core/src/tools/handlers/unified_exec.rs:151

Code: the model's yield_time_ms (default 10 s) is clamped to 250 ms .. 30 s (with a 10 s floor on Windows); at the deadline the tool returns the output so far plus a session ID and the process keeps running, reachable through write_stdin; the one-shot variant instead kills the process at timeout_ms (default 10 s).

codex-rs/core/src/unified_exec/mod.rs:206

Code: a head-and-tail buffer keeps the first 512 KiB and the last 512 KiB of a 1 MiB cap and counts the bytes dropped from the middle; the count is shown as an omission marker.

codex-rs/utils/head-tail-buffer/src/lib.rs:41

Code: the budget is the smaller of the model's max_output_tokens (default 10,000) and the model catalog's truncation policy; text over budget is cut from the middle with a "Warning: truncated output (original token count: N)" header, then trimmed again so header plus body fit the serialisation budget.

codex-rs/core/src/tools/context.rs:527

Code: the eight most recently used are protected; of the rest, the least recently used process that has already exited goes first, else the least recently used live one; it is terminated without telling the model.

codex-rs/core/src/unified_exec/process_manager.rs:1775

Code: the process manager looks up the session ID, writes the characters (an empty write is a poll), waits up to the clamped yield time (empty polls at least 5 s, at most the background cap), and returns new output shaped as in E4.

codex-rs/core/src/unified_exec/process_manager.rs:892

Code: the runtime re-parses the patch text and applies hunks one file at a time; on failure it returns exit code 1 with stderr, and the files already written stay written (the delta of committed changes is kept for the turn diff). A sandbox denial on an on-request-style policy can be retried without the sandbox after approval, which runs the whole patch again.

codex-rs/core/src/tools/runtimes/apply_patch.rs:183

Code: if any content block carries Codex encrypted content (_meta key codex/encryptedContent), the content blocks are passed through and structuredContent is ignored (codex-rs/protocol/src/models.rs:2485-2494, key at :2529); otherwise, if structuredContent is present and not null, the model sees ONLY its JSON serialisation and every content block (text, images) is dropped (:2496-2513); otherwise the content blocks are converted item by item (:2515-2518). A "Wall time ... Output:" header is prepended and the whole payload is truncated to the model's token budget.

codex-rs/protocol/src/models.rs:2496

Code: normalize_history inserts a synthetic output after any call with none ("aborted" for function, custom and local-shell calls; an empty "completed" result for tool_search), and removes unmatched function and custom outputs and client-executed tool-search outputs that carry a call id; call-less outputs and server-executed tool-search outputs are kept. Both run on every for_prompt.

codex-rs/core/src/context_manager/normalize.rs:21

Code: a handler error becomes a failed output carrying the error text (success: false); a cancelled call that had not finished is aborted and answered "aborted by user after N s" (for exec_command: "Wall time: N seconds / aborted by user"), with any output produced so far discarded; a deferred call cancelled before it was dispatched is answered "aborted before dispatch"; a failed or cancelled tool_search is answered as "completed" with zero tools, with no error text.

codex-rs/core/src/tools/parallel.rs:454

Code: three places substitute text: history normalisation replaces images and audio with an "unsupported media" fragment; MCP results replace image and audio blocks with "<image content omitted because you do not support image input>" and the audio equivalent; image preparation resizes images at record time and can add an image-resize notice, or a placeholder when an image cannot be processed.

codex-rs/core/src/context_manager/normalize.rs:346

External: Codex emits a DynamicToolCall item to the client and waits for the client's response (content items plus a success flag), which becomes the tool result.

codex-rs/core/src/tools/handlers/dynamic.rs:239

Code: the error's kind decides if it is retryable at all (retry_delay); retryable errors wait for server advice or exponential backoff and retry up to the provider's stream_max_retries (default 5, cap 100); when the budget is spent, a WebSocket session falls back to HTTPS (after waiting out any server retry deadline) and the count restarts; with UnboundedConnectionRetries, connection failures on sampling requests retry forever with 5 s .. 60 s backoff, except for internal sessions and Amazon Bedrock providers, which keep the bounded budget (codex-rs/core/src/responses_retry.rs:58-177).

codex-rs/core/src/responses_retry.rs:58

Code: for sampling requests, a guidance message is recorded into history ("Your previous response was blocked by a content filter. Do not treat this as a transient failure ... Briefly explain the limitation and offer a permitted alternative") and then the normal retry seat (E14) retries, since ContentFilter is classed retryable.

codex-rs/core/src/responses_retry.rs:69

The person, in the TUI's question overlay (or an app-server client), picks options or types answers and submits; sub-agents may not ask; codex exec refuses the request because no person is present. The core waits for the answer in every mode (codex-rs/core/src/tools/handlers/request_user_input.rs:87-94). Outside Plan mode the request is marked non-blocking (:83), and the TUI then answers for a silent person: after a 60 s hidden grace and a 60 s visible countdown with no key press or paste, it submits an empty answer set (codex-rs/tui/src/bottom_pane/request_user_input/mod.rs:73-74, :270-312, :917-939); any key or paste stops the countdown (:264-268, :1208, :1488). In Plan mode there is no countdown.

codex-rs/tui/src/bottom_pane/request_user_input/mod.rs:862

Code: yes. The command runs unsandboxed with a one-hour default timeout and no managed proxy; its exit code, duration and output (truncated to the model's policy) are recorded as a user-shell-command fragment, either as its own turn or injected into the active turn.

codex-rs/core/src/tasks/user_shell.rs:440

Code: a BM25 lexical index over each deferred tool's search text ranks matches for the query; the top limit (model-chosen, default TOOL_SEARCH_DEFAULT_LIMIT) are returned as loadable specs; in Code Mode, results are filtered to tools the current step allows.

codex-rs/core/src/tools/handlers/tool_search.rs:342

External: Codex sends the model's search commands, the model name and the recent conversation input to the provider's search endpoint (SearchClient) and returns its output, capped by the model's truncation budget.

codex-rs/ext/web-search/src/tool.rs:151

Code: any case-insensitive mismatch is reported once per turn as a model reroute with reason HighRiskCyberActivity, plus a fixed warning that the account "was flagged for potentially high-risk cyber activity and this request was routed to gpt-5.2 ... To regain access to gpt-5.3-codex", whatever models were actually involved.

codex-rs/core/src/session/turn.rs:3269

Code: the cell's output items are truncated to the script's max_output_tokens (default 10,000) with the text-only or mixed-content truncator; nested tool results inside the script are passed raw to the script (code_mode_result), not truncated.

codex-rs/core/src/tools/code_mode/mod.rs:328

Code: only changes made through the patch path (the apply_patch tool, or a shell command intercepted as a patch, C5) are tracked; edits a shell command makes directly (sed, scripts, the apply_patch executable reached through the shell) are not in the diff.

codex-rs/core/src/turn_diff_tracker.rs:92

Model: the configured Images client generates (or edits) the image from the request; the bytes are saved as an artifact and returned to the model as an image in the tool output, for its follow-up.

codex-rs/ext/image-generation/src/tool.rs:154 (handle_call: generate :188, edit :193)

Code compares the active context tokens (or, in BodyAfterPrefix scope, the tokens added after the window's prefill) against the auto-compact limit plus an optional fallback buffer, and against the model's full usable window; either crossing sets token_limit_reached.

codex-rs/core/src/session/context_window.rs:108

Code compacts pre-turn with the previous turn's model when both turns declare compaction-compatibility hashes and they differ, or when switching to a model with a smaller context window while the current usage already exceeds the new model's limit.

codex-rs/core/src/session/turn.rs:1511

A language model is sent the whole history plus a synthesized user message carrying the compaction prompt, and its last assistant message becomes the summary that replaces the history.

codex-rs/core/src/compact.rs:125

Code walks the user messages newest first, keeping each whole while a 20,000-token budget lasts, truncates the one that crosses it, and drops everything older; summaries from earlier compactions are excluded. A message that carries an image or audio keeps only its text parts even when it fits the budget, so media in the user's own messages is dropped at compaction (codex-rs/core/src/compact.rs:63, :714-803).

codex-rs/core/src/compact.rs:63

Code removes the single oldest history item and retries, repeatedly, until the request fits or one item is left; at one item it marks the token count full and raises.

codex-rs/core/src/compact.rs:368

The OpenAI Responses backend returns exactly one opaque Compaction item that stands for the dropped history; client code then decides which visible items are kept alongside it (user messages, hook prompts, small non-final agent messages, optionally client tool outputs and client developer messages) within a 64,000-token newest-first budget.

codex-rs/core/src/compact_remote_v2.rs:464

Code starts a background remote compaction once usage passes async_compaction_threshold_percent of the full window (and before the hard limit), at most once per history version/model/hash/auth generation, and later adopts the candidate only if the history version it was built from is still current.

codex-rs/core/src/session/async_compaction.rs:172

Code compacts after a turn with no follow-up only when auto-summarization is enabled and model_post_turn_compact_threshold_percent is above 0; then, provided no input is pending and the turn was not cancelled, it compacts when usage is at or above that percent of the usable window (or the hard limit is reached), or when a ready background candidate exists. A threshold of 0 turns off turn-end compaction entirely, including adoption of a ready candidate (codex-rs/core/src/session/turn.rs:810-856; codex-rs/core/src/session/context_window.rs:111-117).

codex-rs/core/src/session/context_window.rs:112

The model decides: it is told its remaining tokens (a reminder once below a threshold, and get_context_remaining on demand) and may call new_context to request a fresh window; with the history-notes extension it can write and read notes through backend tools before and after the reset.

codex-rs/core/src/tools/handlers/new_context_window.rs:61

Code installs a fresh window holding only the rebuilt initial context plus (when their features are on) retained client tool outputs and client developer messages, newest first within 64,000 tokens; every user and assistant message of the old window is dropped and nothing is summarized.

codex-rs/core/src/session/mod.rs:5136

Code adds each response's weighted usage (server-provided codex_rollout_budget_units, or output tokens and non-cached input tokens times configured weights) to one counter shared by the root thread and every sub-agent, and once it reaches limit_tokens every later usage report raises SessionBudgetExceeded unless the config sets enforce_limit to false (default true); reminders are injected as thresholds are crossed.

codex-rs/core/src/rollout_budget.rs:67

Code truncates every function and custom-tool output to the model's truncation policy (tokens or bytes, plus a serialization allowance) or to a per-item override when the tool supplied one, at the moment it is recorded in live history; the rollout keeps the full payload.

codex-rs/core/src/context_manager/history.rs:600

The state database adds each accounted token delta to the goal and, in the same UPDATE, flips an active goal to budget_limited once tokens used reach the goal's budget; the goal extension then injects a one-time budget-limit steering message into the running turn.

codex-rs/state/src/runtime/goals.rs:564

The person at the TUI (or an app-server client) sends Op::Interrupt; the session aborts the active task and its tools.

codex-rs/core/src/session/handlers.rs:514

The model decides by what it emits: a sampling step whose output contains no tool call leaves needs_follow_up false, and unless user input is pending the loop runs the Stop hooks and ends the turn with that last assistant message.

codex-rs/core/src/session/turn.rs:636

User-configured hook commands (external) are run with the last assistant message and a stop_hook_active flag; if any asks to stop, the turn ends; if any blocks with a continuation prompt, that prompt is recorded as a hook message and the turn continues.

codex-rs/core/src/hook_runtime.rs:449

A one-shot sub-agent thread running the review model (review_model, else the session model) with the review rubric as its base instructions and the target-specific review request as its user message explores the repository and returns findings plus an overall correctness verdict.

codex-rs/core/src/tasks/review.rs:119

Code tries strict JSON, then the substring from the first { to the last }, and otherwise wraps the whole reply as overall_explanation with zero findings and an empty correctness verdict.

codex-rs/core/src/tasks/review.rs:193

The model decides by calling update_goal with complete or blocked; code accepts any of complete, blocked, paused from the model, charges final usage, and stops automatic continuation.

codex-rs/ext/goal/src/tool.rs:254

When the thread goes idle and its goal is still active, code starts a new turn whose only input is the continuation steering message, unless continuation was deferred or the thread or tools are unavailable.

codex-rs/ext/goal/src/runtime.rs:476

Code marks an active goal blocked after three consecutive automatic goal turns with no activity (empty final or interrupted), after three consecutive turns whose executions failed with no successful tool, or on any turn error; usage limits mark it usage_limited.

codex-rs/ext/goal/src/accounting.rs:245

The model decides by calling spawn_agent (V1 namespace) with a message or items, an optional agent_type role, model, reasoning effort and fork_context; code validates the arguments and starts a child thread.

codex-rs/core/src/tools/handlers/multi_agents/spawn.rs:65

The model calls spawn_agent (V2) with a required task_name and message plus optional role, model, reasoning effort and fork_turns (all or none); a missing or blank fork_turns means all, so the child inherits the full parent history unless the model asks for none (codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs:221-233); code starts a child at a task path under the caller.

codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs:115

For V1 only, code computes the child's depth from the caller's session source and refuses when it exceeds agent_max_depth, telling the model "Agent depth limit reached. Solve the task yourself."; V1 also hides the spawn tool at that depth.

codex-rs/core/src/agent/registry.rs:94

Code reserves a spawn slot against a cap: V1 counts spawned threads against agent_max_threads (default DEFAULT_AGENT_MAX_THREADS); V2 counts resident threads against max_concurrent_threads_per_session - 1 and, when full, first tries to unload an idle resident (H5) before refusing with AgentLimitReached.

codex-rs/core/src/agent/registry.rs:103

Code walks residents oldest-touched first, skips the protected thread and unstarted (PendingInit) agents, and evicts the first one that is not busy; an evicted agent's mail is transferred and it can be reloaded later.

codex-rs/core/src/agent/control/residency.rs:239

Code builds the child config from the parent's live turn (model, reasoning, base and developer instructions, token budget preference), layers the requested role and model overrides, and then re-applies the parent turn's approval policy, approvals reviewer, cwd and permission profile last, so a role cannot widen them.

codex-rs/core/src/agent/child_config.rs:180

The model calls send_message with a target task path and message; code resolves the target in the caller's tree and queues the message on the recipient's mailbox.

codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs:40

The model calls followup_task with a non-root target and message; code delivers it and triggers a turn if the target is idle.

codex-rs/core/src/tools/handlers/multi_agents_v2/followup_task.rs:40

The model calls send_input with an agent id, a message or items, and an interrupt flag; code loads the target if needed, interrupts it first when asked, and delivers the input.

codex-rs/core/src/tools/handlers/multi_agents/send_input.rs:48

The model calls interrupt_agent (V2); code refuses the root and the caller itself, interrupts the target's current turn (the agent stays available), and returns its previous status.

codex-rs/core/src/tools/handlers/multi_agents_v2/interrupt_agent.rs:45

The model picks timeout_ms when calling wait_agent. V1: code rejects zero or negative values and clamps the rest between fixed constants (codex-rs/core/src/tools/handlers/multi_agents/wait.rs:95-103). V2: code reads configurable minimum, maximum and default, REJECTS a value above the maximum, raises a smaller one to the minimum, and uses the default when none is given (codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs:54-66).

codex-rs/core/src/tools/handlers/multi_agents/wait.rs:102

Code turns the child's terminal status into one inter-agent message: the child's last assistant message verbatim on completion (an empty message when it had none), an error truncated to 900 tokens with a fixed next-action line on error, "Agent shut down." / "Agent was not found.", and nothing at all for an interrupted child. A child stopped after repeated Guardian denials gets a separate message whose fixed line tells the parent to tell the user and not resume or retry until the user confirms (codex-rs/core/src/session_prefix.rs:9-55).

codex-rs/core/src/session_prefix.rs:26

Code checks that the actor belongs to this board and owns its tree path, and drops a remote board notice whose content plus paths exceed 1,024 bytes (the post stays readable through the board tools).

codex-rs/core/src/agent_message_board.rs:274

The model calls close_agent (V1) with any agent id; code shuts down that thread and every live descendant and returns the target's previous status. No root, self or ancestry check.

codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs:42

Code starts it only for a non-ephemeral root session with Feature::MemoryTool on and a state DB, and then runs phases 1 and 2 only if the Codex rate-limit windows still have at least min_rate_limit_remaining_percent headroom.

codex-rs/memories/write/src/start.rs:80

The state DB claims, per startup, a bounded set of threads whose memory_mode is enabled, from allowed sources, inside the age window, idle at least min_rollout_idle_hours, not the current thread, and not already claimed by another worker.

codex-rs/state/src/runtime/memories.rs:244

When memories.disable_on_external_context is on, code marks the thread polluted (and queues forgetting) when a response item is a web search, tool search or a call-less function output, when a tool output declares external context, or when an MCP server is flagged as polluting.

codex-rs/core/src/stream_events_utils.rs:157

A language model reads the thread's filtered, secret-redacted rollout and returns a structured memory (raw_memory, rollout_summary, optional rollout_slug); an empty memory or summary is stored as "no output".

codex-rs/memories/write/src/phase1.rs:311

Code keeps non-empty memories used (or created) within max_unused_days, ranks them by usage count, then recency, and passes the top max_raw_memories_for_consolidation to phase 2; anything not selected is deleted from the workspace by the sync.

codex-rs/state/src/runtime/memories.rs:484

An internal sub-agent (consolidation model) is pointed at the memories root and a git-style workspace diff, and edits MEMORY.md, memory_summary.md, skills/ and related files itself, with approvals Never, collab off, no MCP servers, and (under a managed profile) write access to the memories root only, no network.

codex-rs/memories/write/src/phase2.rs:177

The model decides by emitting a memory citation block in its answer; code parses <citation_entries> / <rollout_ids> blocks and increments usage_count for each cited thread, which then ranks memories in I5.

codex-rs/core/src/stream_events_utils.rs:204

Code removes any symlinks (and fails if there were any), requires MEMORY.md to be a file (V1), requires memory_summary.md to start with v1, and for V2 requires four section headers and under 10,000 bytes; only then is the git baseline reset and the job marked successful.

codex-rs/memories/write/src/workspace.rs:76

The model decides to call add_ad_hoc_note with a timestamped filename and verbatim Markdown; the backend appends it to the ad-hoc notes, which phase 2 later consolidates.

codex-rs/ext/memories/src/tools/ad_hoc_note.rs:77

The person picks bug, bad result, good result, safety check or other in the TUI feedback picker; the category goes to OpenAI with the report.

codex-rs/tui/src/bottom_pane/feedback_view.rs:148

The person answers "Upload logs?" after seeing the list of files that would be sent (the header starts with codex-logs.log, client-logs.txt (if available) and the doctor report, codex-rs/tui/src/bottom_pane/feedback_view.rs:251-259; the function also takes the rollout path and an optional sandbox log, :222-224); yes and no both continue to a note.

codex-rs/tui/src/bottom_pane/feedback_view.rs:219