config.toml reference

chatgpt_base_url

Type: string · Default: "https://chatgpt.com/backend-api/" · Status: documented

Override the base URL used during the ChatGPT login flow.

— docs

Source: codex-rs/config/src/config_toml.rs:410, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model

Type: string · Status: documented

Model to use (e.g., gpt-6-sol).

— docs

Source: codex-rs/config/src/config_toml.rs:168, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_auto_compact_token_limit

Type: integer (int64) · Status: documented

Token threshold that triggers automatic history compaction (unset uses model defaults).

— docs

Source: codex-rs/config/src/config_toml.rs:179, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_auto_compact_token_limit_scope

Type: "total" | "body_after_prefix" · Status: documented

Controls whether the auto-compaction threshold counts the full active context (total, the default) or only growth after the carried compaction-window prefix (body_after_prefix).

— docs

Values:

• total: Count the full active context against the limit.
• body_after_prefix: Count sampled output and later growth after the carried window prefix.

Source: codex-rs/config/src/config_toml.rs:183, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_catalog_json

Type: string · Status: documented

Optional path to a JSON model catalog loaded on startup. A selected $CODEX_HOME/profile-name.config.toml profile file can override this per profile.

— docs

Source: codex-rs/config/src/config_toml.rs:400, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_context_window

Type: integer (int64) · Status: documented

Context window tokens available to the active model.

— docs

Source: codex-rs/config/src/config_toml.rs:176, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_provider

Type: string · Status: documented

Provider id from model_providers (default: openai).

— docs

Source: codex-rs/config/src/config_toml.rs:173, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers

Type: map<string, table> · Default: {} · Status: documented

User-defined provider entries that extend the built-in list. Built-in IDs cannot be overridden.

— codex-rs/config/src/config_toml.rs:327

Source: codex-rs/config/src/config_toml.rs:327, codex-rs/core/config.schema.json · Docs: config-file/config-advanced, config-file/config-sample, web-search · In binary: yes (distinctive match)

model_providers.<id>

Type: table · Status: documented

Custom provider definition. Built-in provider IDs (openai, ollama, and lmstudio) are reserved and cannot be overridden.

— docs

Source: codex-rs/config/src/config_toml.rs:166, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.auth

Type: table · Status: documented

Command-backed bearer token configuration for a custom provider. Do not combine with env_key, experimental_bearer_token, or requires_openai_auth.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:156, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.auth.args

Type: array<string> · Default: [] · Status: documented

Arguments passed to the token command.

— docs

Source: codex-rs/config/src/thread_config/proto/codex.thread_config.v1.rs:94, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.auth.command

Type: string · Status: documented

Command to run when Codex needs a bearer token. The command must print the token to stdout.

— docs

Source: codex-rs/config/src/thread_config/proto/codex.thread_config.v1.rs:92, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.auth.cwd

Type: string · Status: documented

Working directory for the token command.

— docs

Source: codex-rs/config/src/thread_config/proto/codex.thread_config.v1.rs:100, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.auth.refresh_interval_ms

Type: integer (uint64) · Default: 300000 · Status: documented

How often Codex proactively refreshes the token in milliseconds (default: 300000). Set to 0 to refresh only after an authentication retry.

— docs

Source: codex-rs/config/src/thread_config/proto/codex.thread_config.v1.rs:98, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.auth.timeout_ms

Type: integer (uint64) · Default: 5000 · Status: documented

Maximum token command runtime in milliseconds (default: 5000).

— docs

Source: codex-rs/config/src/thread_config/proto/codex.thread_config.v1.rs:96, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.aws

Type: table · Status: undocumented

AWS SigV4 auth configuration for this provider.

— codex-rs/model-provider-info/src/lib.rs:160

Source: codex-rs/model-provider-info/src/lib.rs:160, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.aws.auth_refresh

Type: table · Status: undocumented

Optional command used to reauthenticate after a refreshable AWS auth failure.

— codex-rs/model-provider-info/src/lib.rs:209

Source: codex-rs/model-provider-info/src/lib.rs:209, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.aws.auth_refresh.args

Type: array<string> · Default: [] · Status: undocumented

Arguments passed to the refresh command.

— codex-rs/model-provider-info/src/lib.rs:247

Source: codex-rs/model-provider-info/src/lib.rs:247, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.aws.auth_refresh.command

Type: string · Status: undocumented

Executable to invoke directly, without a shell.

— codex-rs/model-provider-info/src/lib.rs:244

Source: codex-rs/model-provider-info/src/lib.rs:244, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.aws.auth_refresh.timeout_ms

Type: integer (uint64) · Default: 300000 · Status: undocumented

Maximum time to wait for the refresh command to complete.

— codex-rs/model-provider-info/src/lib.rs:250

Source: codex-rs/model-provider-info/src/lib.rs:250, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.aws.credential_export

Type: table · Status: undocumented

Optional command whose exported credentials replace the AWS SDK credential chain.

— codex-rs/model-provider-info/src/lib.rs:207

Source: codex-rs/model-provider-info/src/lib.rs:207, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.aws.credential_export.args

Type: array<string> · Default: [] · Status: undocumented

Arguments passed to the credential export command.

— codex-rs/model-provider-info/src/lib.rs:220

Source: codex-rs/model-provider-info/src/lib.rs:220, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.aws.credential_export.command

Type: string · Status: undocumented

Executable to invoke directly, without a shell.

— codex-rs/model-provider-info/src/lib.rs:217

Source: codex-rs/model-provider-info/src/lib.rs:217, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.aws.credential_export.timeout_ms

Type: integer (uint64) · Default: 30000 · Status: undocumented

Maximum time to wait for the credential export command to complete.

— codex-rs/model-provider-info/src/lib.rs:223

Source: codex-rs/model-provider-info/src/lib.rs:223, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.aws.profile

Type: string · Status: documented

AWS profile name used by the built-in amazon-bedrock provider.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:203, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.aws.region

Type: string · Status: documented

AWS region used by the built-in amazon-bedrock provider.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:205, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.base_url

Type: string · Status: documented

API base URL for the model provider.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:141, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.env_http_headers

Type: map<string, string> · Status: documented

HTTP headers populated from environment variables when present.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:173, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.env_http_headers.<header>

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/lib.rs:136, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.env_key

Type: string · Status: documented

Environment variable supplying the provider API key.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:146, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.env_key_instructions

Type: string · Status: documented

Optional setup guidance for the provider API key.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:150, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.experimental_bearer_token

Type: string · Status: documented

Direct bearer token for the provider (discouraged; use env_key).

— docs

Source: codex-rs/model-provider-info/src/lib.rs:154, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.gateway_oauth

Type: table · Status: undocumented

Secondary OAuth credentials required by the provider's gateway.

— codex-rs/model-provider-info/src/lib.rs:158

Source: codex-rs/model-provider-info/src/lib.rs:158, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.gateway_oauth.authorization_url

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:32, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.gateway_oauth.client_id

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:34, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.gateway_oauth.delivery

Type: table · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:39, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.gateway_oauth.delivery.kind

Type: "header" · Status: undocumented

Values: header

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:52, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.gateway_oauth.delivery.name

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:54, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.gateway_oauth.delivery.scheme

Type: string · Default: "Bearer" · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:56, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.gateway_oauth.redirect_port

Type: integer (uint16) · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:38, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.gateway_oauth.resource

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:35, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.gateway_oauth.scopes

Type: array<string> · Default: [] · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:37, codex-rs/core/config.schema.json · In binary: yes (generic match)

model_providers.<id>.gateway_oauth.token_url

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/gateway_oauth.rs:33, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.http_headers

Type: map<string, string> · Status: documented

Static HTTP headers added to provider requests.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:168, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.http_headers.<header>

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/lib.rs:136, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.model_catalog_url

Type: string · Status: undocumented

Optional full URL for a Codex-native model catalog. When unset, OpenAI discovery uses the Codex backend unless base_url overrides the inference endpoint.

— codex-rs/model-provider-info/src/lib.rs:144

Source: codex-rs/model-provider-info/src/lib.rs:144, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.name

Type: string · Default: "" · Status: documented

Display name for a custom model provider.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:139, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_providers.<id>.query_params

Type: map<string, string> · Status: documented

Extra query parameters appended to provider requests.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:165, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.query_params.<key>

Type: string · Status: undocumented

Source: codex-rs/model-provider-info/src/lib.rs:136, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.request_max_retries

Type: integer (uint64) · Status: documented

Retry count for HTTP requests to the provider (default: 4).

— docs

Source: codex-rs/model-provider-info/src/lib.rs:175, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.requires_openai_auth

Type: boolean · Default: false · Status: documented

The provider uses OpenAI authentication (defaults to false).

— docs

Source: codex-rs/model-provider-info/src/lib.rs:189, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.stream_idle_timeout_ms

Type: integer (uint64) · Status: documented

Idle timeout for SSE streams in milliseconds (default: 300000).

— docs

Source: codex-rs/model-provider-info/src/lib.rs:180, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.stream_max_retries

Type: integer (uint64) · Status: documented

Retry count for SSE streaming interruptions (default: 5).

— docs

Source: codex-rs/model-provider-info/src/lib.rs:177, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.supports_standalone_web_search

Type: boolean · Default: false · Status: documented

Advertise support for a compatible standalone web search endpoint (default: false). Standalone search remains under development and off by default; provider compatibility alone doesn't enable it.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:195, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.supports_websockets

Type: boolean · Default: false · Status: documented

Whether that provider supports the Responses API WebSocket transport.

— docs

Source: codex-rs/model-provider-info/src/lib.rs:192, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_providers.<id>.websocket_connect_timeout_ms

Type: integer (uint64) · Status: undocumented

Maximum time (in milliseconds) to wait for a websocket connection attempt before treating it as failed.

— codex-rs/model-provider-info/src/lib.rs:183

Source: codex-rs/model-provider-info/src/lib.rs:183, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

model_providers.<id>.wire_api

Type: "responses" · Default: "responses" · Status: documented

Protocol used by the provider. responses is the only supported value, and it is the default when omitted.

— docs

Values:

• responses: The Responses API exposed by OpenAI at /v1/responses.

Source: codex-rs/model-provider-info/src/lib.rs:163, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_reasoning_effort

Type: string · Status: documented

Reasoning effort advertised by the selected model, such as low, medium, high, xhigh, max, or ultra. Available levels depend on the model and client.

— docs

Source: codex-rs/config/src/config_toml.rs:392, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_reasoning_summary

Type: "auto" | "concise" | "detailed" | "none" · Status: documented

Select reasoning summary detail or disable summaries entirely.

— docs

Values:

• auto
• concise
• detailed
• none: Option to disable reasoning summaries.

Source: codex-rs/config/src/config_toml.rs:394, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

model_verbosity

Type: "low" | "medium" | "high" · Default: used · Status: documented

Optional GPT-5 Responses API verbosity override; when unset, the selected model/preset default is used.

— docs

Values: low, medium, high

Source: codex-rs/config/src/config_toml.rs:396, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

openai_base_url

Type: string · Status: documented

Base URL override for the built-in openai model provider.

— docs

Source: codex-rs/config/src/config_toml.rs:425, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

oss_provider

Type: string · Default: prompting if unset · Status: documented

Default local provider used when running with --oss (defaults to prompting if unset).

— docs

Source: codex-rs/config/src/config_toml.rs:558, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

personality

Type: "none" | "friendly" | "pragmatic" · Status: deprecated or legacy (per source comment)

Default communication style for models that advertise supportsPersonality; can be overridden per thread/turn or via /personality.

— docs

Values: none, friendly, pragmatic

Source: codex-rs/config/src/config_toml.rs:403, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

plan_mode_reasoning_effort

Type: string · Status: documented

Plan-mode-specific reasoning override using a level supported by the selected model. When unset, Plan mode uses its built-in preset default.

— docs

Source: codex-rs/config/src/config_toml.rs:393, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

responses_api_metadata

Type: map<string, string> · Status: undocumented

Bounded, product-owned metadata attached to every Responses API request.

— codex-rs/config/src/config_toml.rs:416

Source: codex-rs/config/src/config_toml.rs:416, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

responses_api_metadata.<key>

Type: string · Status: undocumented

Source: codex-rs/config/src/config_toml.rs:166, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

review_model

Type: string · Default: the current session model · Status: documented

Optional model override used by /review (defaults to the current session model).

— docs

Source: codex-rs/config/src/config_toml.rs:170, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

service_tier

Type: string · Status: documented

Preferred service tier for new turns. Use fast or another tier advertised by the active model; fast maps to the request value priority.

— docs

Source: codex-rs/config/src/config_toml.rs:407, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

compact_prompt

Type: string · Status: documented

Inline override for the history compaction prompt.

— docs

Source: codex-rs/config/src/config_toml.rs:273, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

developer_instructions

Type: string · Status: documented

Additional developer instructions injected into the session (optional).

— docs

Source: codex-rs/config/src/config_toml.rs:252, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

experimental_compact_prompt_file

Type: string · Status: documented

Load the compaction prompt override from a file (experimental).

— docs

Source: codex-rs/config/src/config_toml.rs:555, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

include_apps_instructions

Type: boolean · Default: true · Status: undocumented

Whether to inject the <apps_instructions> developer block.

— codex-rs/config/src/config_toml.rs:258

Source: codex-rs/config/src/config_toml.rs:258, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

include_collaboration_mode_instructions

Type: boolean · Default: true · Status: undocumented

Whether to inject the <collaboration_mode> developer block.

— codex-rs/config/src/config_toml.rs:261

Source: codex-rs/config/src/config_toml.rs:261, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

include_environment_context

Type: boolean · Default: true · Status: undocumented

Whether to inject the <environment_context> user block.

— codex-rs/config/src/config_toml.rs:264

Source: codex-rs/config/src/config_toml.rs:264, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

include_permissions_instructions

Type: boolean · Default: true · Status: undocumented

Whether to inject the <permissions instructions> developer block.

— codex-rs/config/src/config_toml.rs:255

Source: codex-rs/config/src/config_toml.rs:255, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

instructions

Type: string · Status: documented

Reserved for future use; prefer model_instructions_file or AGENTS.md.

— docs

Source: codex-rs/config/src/config_toml.rs:248, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

model_instructions_file

Type: string · Status: documented

Replacement for built-in instructions instead of AGENTS.md.

— docs

Source: codex-rs/config/src/config_toml.rs:270, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

project_doc_fallback_filenames

Type: array<string> · Default: [] · Status: documented

Additional filenames to try when AGENTS.md is missing.

— docs

Source: codex-rs/config/src/config_toml.rs:335, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

project_doc_max_bytes

Type: integer (uint) · Default: 32768 · Status: documented

Maximum bytes read from AGENTS.md when building project instructions.

— docs

Source: codex-rs/config/src/config_toml.rs:331, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

project_root_markers

Type: array<string> · Default: [".git"] · Status: documented

List of project root marker filenames; used when searching parent directories for the project root.

— docs

Default sources: [".git"] (embedded packaged-defaults layer (lowest-precedence config layer, include_str! in codex-rs/config/src/loader/mod.rs)); [" (stated in source doc comment)

Source: codex-rs/config/src/config_toml.rs:518, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

allow_login_shell

Type: boolean · Default: true · Status: documented

Allow shell-based tools to use login-shell semantics. Defaults to true; when false, login = true requests are rejected and omitted login defaults to non-login shells.

— docs

Source: codex-rs/config/src/config_toml.rs:219, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

approval_policy

Type: "on-request" | table | "never" · Status: documented

Controls when Codex pauses for approval before executing commands. You can also use approval_policy = { granular = { ... } } to allow or auto-reject specific prompt categories while keeping other prompts interactive. untrusted is unsupported, and on-failure is deprecated; use on-request for interactive runs or never for non-interactive runs.

— docs

Values:

• on-request: The model decides when to ask the user for approval.
• { granular = … }: Fine-grained controls for individual approval flows. When a field is true, commands in that category are allowed. When it is false, those requests are automatically rejected instead of shown to the user.
• never: Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.

Source: codex-rs/config/src/config_toml.rs:193, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

approval_policy.granular

Type: table · Status: undocumented

Source: codex-rs/protocol/src/protocol.rs:983, codex-rs/core/config.schema.json · In binary: yes (generic match)

approval_policy.granular.mcp_elicitations

Type: boolean · Status: documented

When true, MCP elicitation prompts are allowed to surface instead of being auto-rejected.

— docs

Source: codex-rs/protocol/src/protocol.rs:1022, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

approval_policy.granular.request_permissions

Type: boolean · Default: false · Status: documented

When true, prompts from the request_permissions tool are allowed to surface.

— docs

Source: codex-rs/protocol/src/protocol.rs:1020, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

approval_policy.granular.rules

Type: boolean · Status: documented

When true, approvals triggered by execpolicy prompt rules are allowed to surface.

— docs

Source: codex-rs/protocol/src/protocol.rs:1014, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

approval_policy.granular.sandbox_approval

Type: boolean · Status: documented

When true, sandbox escalation approval prompts are allowed to surface.

— docs

Source: codex-rs/protocol/src/protocol.rs:1012, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

approval_policy.granular.skill_approval

Type: boolean · Default: false · Status: documented

When true, skill-script approval prompts are allowed to surface.

— docs

Source: codex-rs/protocol/src/protocol.rs:1017, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

approvals_reviewer

Type: "user" | "auto_review" | "guardian_subagent" · Default: user · Status: documented

Who reviews eligible approval prompts under on-request or granular approval policies. Defaults to user; auto_review uses the reviewer subagent. This setting doesn't change sandboxing or review actions already allowed inside the sandbox.

— docs

Values: user, auto_review, guardian_subagent

Source: codex-rs/config/src/config_toml.rs:198, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

auto_review

Type: table · Status: documented

Optional policy instructions for the guardian auto-reviewer.

— codex-rs/config/src/config_toml.rs:202

Source: codex-rs/config/src/config_toml.rs:202, codex-rs/core/config.schema.json · Docs: config-file/config-advanced, config-file/config-sample, enterprise/managed-configuration · In binary: yes (distinctive match)

auto_review.experimental_policy_template

Type: string · Status: undocumented

Experimental full Guardian prompt template containing the tenant policy placeholder.

— codex-rs/config/src/config_toml.rs:578

Source: codex-rs/config/src/config_toml.rs:578, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

auto_review.extra_policy

Type: string · Status: undocumented

Additional policy text inserted into the Guardian template's {{ extra_policy }} slot.

— codex-rs/config/src/config_toml.rs:576

Source: codex-rs/config/src/config_toml.rs:576, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

auto_review.policy

Type: string · Status: documented

Local Markdown policy instructions for automatic review. Managed guardian_policy_config takes precedence. Blank values are ignored.

— docs

Source: codex-rs/config/src/config_toml.rs:574, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

default_permissions

Type: string · Status: documented

Name of the default permissions profile to apply to sandboxed tool calls. Built-ins are :read-only, :workspace, and :danger-full-access; custom profile names require matching [permissions.<name>] tables. Don't combine with sandbox_mode or [sandbox_workspace_write].

— docs

Source: codex-rs/config/src/config_toml.rs:237, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions

Type: table · Status: documented

Named permissions profiles.

— codex-rs/config/src/config_toml.rs:241

Source: codex-rs/config/src/config_toml.rs:241, codex-rs/core/config.schema.json · Docs: config-file/config-basic, config-file/config-sample, enterprise/managed-configuration · In binary: yes (generic match)

permissions.<name>.description

Type: string · Status: documented; schema leaves permissions opaque; field found in config sources

Human-readable description for this named profile. A profile does not inherit its parent's description through extends.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:640

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:640, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.extends

Type: string · Status: documented; schema leaves permissions opaque; field found in config sources

Optional parent profile applied before this named profile. Set it to another named profile, :read-only, or :workspace; :danger-full-access, undefined parents, and cycles are rejected.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:641

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:641, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.filesystem

Type: table · Status: documented; schema leaves permissions opaque; field found in config sources

Named filesystem permission profile. Each key is an absolute path or special token such as :minimal or :workspace_roots.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:197

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:197, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.filesystem.":workspace_roots".<subpath-or-glob>

Type: "read" | "write" | "deny" · Status: documented; schema leaves permissions opaque

Scoped filesystem access relative to each effective workspace root. Use "." for the root itself; glob subpaths such as "**/*.env" can deny reads with "deny".

— docs

Config struct field with this name: none found

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.filesystem.<path-or-glob>

Type: "read" | "write" | "deny" | table · Status: documented; schema leaves permissions opaque; field found in config sources

Grant direct access for a path, glob pattern, or special token, or scope nested entries under that root. Use "deny" to deny reads for matching paths.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:197

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:197, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.filesystem.glob_scan_max_depth

Type: number · Status: documented; schema leaves permissions opaque; field found in config sources

Maximum depth for expanding deny-read glob patterns on platforms that snapshot matches before sandbox startup. Must be at least 1 when set.

— docs

Config struct field with this name: codex-rs/config/src/permissions_toml.rs:228

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/permissions_toml.rs:228, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.allow_local_binding

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Permit broader local/private-network access through sandboxed networking. Exact local IP literal or localhost allow rules can still permit specific local targets when this stays false.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:440

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:440, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.allow_upstream_proxy

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Allow sandboxed networking to chain through another upstream proxy.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:431

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:431, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.dangerously_allow_all_unix_sockets

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Allow arbitrary Unix socket destinations instead of the default restricted set. Use only in tightly controlled environments.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:433

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:433, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.dangerously_allow_non_loopback_proxy

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Permit non-loopback bind addresses for sandboxed networking listeners. Enabling it can expose listeners beyond localhost.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:432

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:432, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.domains

Type: table · Status: documented; schema leaves permissions opaque; field found in config sources

Domain rules for sandboxed commands. Enforced only when features.network_proxy or enabled administrator-managed networking requirements activate the proxy. Supports exact hosts, *.example.com, **.example.com, and global * allow rules; deny wins. Does not restrict web search, apps, or MCP servers.

— docs

Config struct field with this name: codex-rs/config/src/application_requirements.rs:18

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/application_requirements.rs:18, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.network.domains.<pattern>

Type: allow | deny · Status: documented; schema leaves permissions opaque; field found in config sources

Allow or deny an exact host or scoped wildcard pattern such as *.example.com or **.example.com.

— docs

Config struct field with this name: codex-rs/config/src/application_requirements.rs:18

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/application_requirements.rs:18, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.network.enable_socks5

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Expose SOCKS5 support when this permissions profile enables sandboxed networking.

— docs

Config struct field with this name: codex-rs/config/src/permissions_toml.rs:333

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/permissions_toml.rs:333, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.enable_socks5_udp

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Allow UDP over the SOCKS5 listener when enabled.

— docs

Config struct field with this name: codex-rs/config/src/permissions_toml.rs:335

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/permissions_toml.rs:335, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.enabled

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Enable network access for commands in this permission profile. This does not start the network proxy. Without features.network_proxy or enabled administrator-managed networking requirements, command network access is direct and profile domain rules are not enforced.

— docs

Config struct field with this name: codex-rs/config/src/application_requirements.rs:17

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/application_requirements.rs:17, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.network.mode

Type: limited | full · Status: documented; schema leaves permissions opaque; field found in config sources

Network proxy mode used for subprocess traffic.

— docs

Config struct field with this name: codex-rs/config/src/config_toml.rs:779

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_toml.rs:779, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

permissions.<name>.network.proxy_url

Type: string · Status: documented; schema leaves permissions opaque; field found in config sources

HTTP listener URL used when this permissions profile enables sandboxed networking.

— docs

Config struct field with this name: codex-rs/config/src/permissions_toml.rs:332

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/permissions_toml.rs:332, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.socks_url

Type: string · Status: documented; schema leaves permissions opaque; field found in config sources

SOCKS5 proxy endpoint used by this permissions profile.

— docs

Config struct field with this name: codex-rs/config/src/permissions_toml.rs:334

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/permissions_toml.rs:334, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.unix_sockets

Type: table · Status: documented; schema leaves permissions opaque; field found in config sources

Unix socket allowlist overrides for sandboxed networking. Use socket paths as keys; allow adds a path, and deny rejects it.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:438

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:438, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.network.unix_sockets.<path>

Type: allow | deny · Status: documented; schema leaves permissions opaque; field found in config sources

Add an absolute Unix socket path to the effective allowlist with allow, or reject it with deny. Denied entries are omitted from the effective allowlist.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:438

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:438, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.workspace_roots

Type: table · Status: documented; schema leaves permissions opaque; field found in config sources

Profile-defined workspace roots that receive :workspace_roots filesystem rules alongside the session's runtime workspace roots.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:642

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:642, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

permissions.<name>.workspace_roots.<path>

Type: boolean · Status: documented; schema leaves permissions opaque; field found in config sources

Opt a path into the profile's workspace root set when true. Disabled entries remain inactive.

— docs

Config struct field with this name: codex-rs/config/src/config_requirements.rs:642

Binary check (--strict-config): inconclusive: permission profiles accept unknown keys, so a probe cannot confirm this field

Source: codex-rs/config/src/config_requirements.rs:642, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

sandbox_mode

Type: "read-only" | "workspace-write" | "danger-full-access" · Status: documented

Sandbox policy for filesystem and network access during command execution.

— docs

Values: read-only, workspace-write, danger-full-access

Source: codex-rs/config/src/config_toml.rs:222, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

sandbox_workspace_write

Type: table · Status: documented

Sandbox configuration to apply if sandbox is WorkspaceWrite.

— codex-rs/config/src/config_toml.rs:232

Source: codex-rs/config/src/config_toml.rs:232, codex-rs/core/config.schema.json · Docs: config-file/config-advanced, config-file/config-sample, enterprise/managed-configuration · In binary: yes (distinctive match)

sandbox_workspace_write.exclude_slash_tmp

Type: boolean · Default: false · Status: documented

Exclude /tmp from writable roots in workspace-write mode.

— docs

Source: codex-rs/config/src/types.rs:1070, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

sandbox_workspace_write.exclude_tmpdir_env_var

Type: boolean · Default: false · Status: documented

Exclude $TMPDIR from writable roots in workspace-write mode.

— docs

Source: codex-rs/config/src/types.rs:1068, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

sandbox_workspace_write.network_access

Type: boolean · Default: false · Status: documented

Allow outbound network access inside the workspace-write sandbox.

— docs

Source: codex-rs/config/src/types.rs:1066, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

sandbox_workspace_write.writable_roots

Type: array<string> · Default: [] · Status: documented

Additional writable roots when sandbox_mode = "workspace-write".

— docs

Source: codex-rs/config/src/types.rs:1064, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

shell_environment_policy

Type: table · Default: {"exclude": null, "experimental_use_profile": null, "filters": null, "ignore_default_excludes": null, "include_only": null, "inherit": null, "set": null} · Status: documented

Policy for building the env when spawning a process via shell-like tools.

— codex-rs/config/src/config_toml.rs:209

Source: codex-rs/config/src/config_toml.rs:209, codex-rs/core/config.schema.json · Docs: config-file/config-advanced, config-file/config-basic, config-file/config-sample · In binary: yes (distinctive match)

shell_environment_policy.exclude

Type: array<string> · Status: deprecated or legacy (per source comment)

Legacy environment-variable exclusion patterns. Use shell_environment_policy.filters for new configuration; don't combine both forms in the same layer.

— docs

Source: codex-rs/config/src/shell_environment_policy.rs:21, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

shell_environment_policy.experimental_use_profile

Type: boolean · Status: documented

Use the user shell profile when spawning subprocesses.

— docs

Source: codex-rs/config/src/shell_environment_policy.rs:37, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

shell_environment_policy.filters

Type: map<string, "include" | "exclude"> · Status: documented

Canonical case-insensitive environment-variable pattern filters. Include entries create an allowlist and can't restore excluded values. Explicit set values apply after exclusions. Don't combine filters with legacy exclude or include_only arrays in the same layer.

— docs

Source: codex-rs/config/src/shell_environment_policy.rs:35, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

shell_environment_policy.filters.<key>

Type: "include" | "exclude" · Status: undocumented

Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.

— codex-rs/config/src/shell_environment_policy.rs:15

Values: include, exclude

Source: codex-rs/config/src/shell_environment_policy.rs:15, codex-rs/core/config.schema.json · In binary: yes (generic match)

shell_environment_policy.ignore_default_excludes

Type: boolean · Status: documented

Keep variables containing KEY, SECRET, or TOKEN before other filters run (default: true). Set to false to apply automatic secret-name exclusions.

— docs

Source: codex-rs/config/src/shell_environment_policy.rs:18, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

shell_environment_policy.include_only

Type: array<string> · Status: deprecated or legacy (per source comment)

Legacy allowlist of environment-variable patterns. Use shell_environment_policy.filters for new configuration; don't combine both forms in the same layer.

— docs

Source: codex-rs/config/src/shell_environment_policy.rs:26, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

shell_environment_policy.inherit

Type: "core" | "all" | "none" · Status: documented

Baseline environment inheritance when spawning subprocesses.

— docs

Values:

• core: "Core" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.
• all: Inherits the full environment from the parent process.
• none: Do not inherit any environment variables from the parent process.

Source: codex-rs/config/src/shell_environment_policy.rs:16, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

shell_environment_policy.set

Type: map<string, string> · Status: documented

Explicit environment values injected after exclusions; include filters can still remove them.

— docs

Source: codex-rs/config/src/shell_environment_policy.rs:23, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

shell_environment_policy.set.<key>

Type: string · Status: undocumented

Source: codex-rs/config/src/shell_environment_policy.rs:15, codex-rs/core/config.schema.json · In binary: yes (generic match)

windows

Type: table · Status: documented · When: Windows only

Windows-specific configuration.

— codex-rs/config/src/config_toml.rs:549

Source: codex-rs/config/src/config_toml.rs:549, codex-rs/core/config.schema.json · Docs: config-file/config-basic, config-file/config-sample, windows/windows-sandbox · In binary: yes (generic match)

windows.sandbox

Type: "elevated" | "unelevated" | "mxc" · Status: documented · When: Windows only

Windows-only native sandbox mode when running Codex natively on Windows.

— docs

Values: elevated, unelevated, mxc

Source: codex-rs/config/src/types.rs:174, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_enterprise_managed_auth

Type: table · Status: undocumented

Trusted enterprise IdP shared by EMA-enabled MCP servers and plugins.

— codex-rs/config/src/config_toml.rs:298

Source: codex-rs/config/src/config_toml.rs:298, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_enterprise_managed_auth.idp

Type: table · Status: undocumented

Shared enterprise authorization, independent of Codex account credentials.

— codex-rs/config/src/mcp_ema.rs:33

Source: codex-rs/config/src/mcp_ema.rs:33, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_enterprise_managed_auth.idp.client_id

Type: string · Status: undocumented

Public OAuth client registered with that enterprise IdP.

— codex-rs/config/src/mcp_ema.rs:26

Source: codex-rs/config/src/mcp_ema.rs:26, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_enterprise_managed_auth.idp.issuer

Type: string · Status: undocumented

Issuer used for enterprise OAuth discovery and identity validation.

— codex-rs/config/src/mcp_ema.rs:24

Source: codex-rs/config/src/mcp_ema.rs:24, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_oauth_callback_port

Type: integer (uint16) · Status: documented

Optional global fixed port for the local HTTP callback server used during MCP OAuth login. A server-specific oauth.callback_port takes precedence. When neither is set, Codex binds to an ephemeral port chosen by the OS.

— docs

Source: codex-rs/config/src/config_toml.rs:310, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_oauth_callback_url

Type: string · Status: documented

Optional base callback URL for MCP OAuth login, such as a devbox ingress URL. Newly added pre-registered clients use this URL unchanged when the authorization server supports issuer identification; existing clients without a saved callback append a server-specific callback ID.

— docs

Source: codex-rs/config/src/config_toml.rs:316, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_oauth_credentials_store

Type: "auto" | "file" | "keyring" · Default: "auto" · Status: documented

Preferred store for MCP OAuth credentials.

— docs

Values:

• auto: Prefer Keyring and use File when keyring storage is unavailable. Once an MCP client loads credentials from one store, that client keeps the resolved store for its lifetime so refreshes cannot switch to a possibly stale credential source …
• file: CODEX_HOME/.credentials.json This file will be readable to Codex and other applications running as the same user.
• keyring: Keyring when available, otherwise fail.

Source: codex-rs/config/src/config_toml.rs:306, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_optional_startup_grace_ms

Type: integer (uint64) · Default: 1000 · Status: documented

Shared wait for optional MCP servers when building the initial tool catalog. Defaults to 1000. Set to 0 to wait for each server's startup_timeout_sec instead.

— docs

Source: codex-rs/config/src/config_toml.rs:322, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers

Type: map<string, table> · Default: {} · Status: documented

Definition for MCP servers that Codex can reach out to for tool calls.

— codex-rs/config/src/config_toml.rs:294

Source: codex-rs/config/src/config_toml.rs:294, codex-rs/core/config.schema.json · Docs: config-file/config-advanced, config-file/config-sample, enterprise/managed-configuration · In binary: yes (distinctive match)

mcp_servers.<id>

Type: table · Status: undocumented

Raw MCP config shape used for deserialization and supported-field JSON Schema generation. Fields that are accepted only to produce targeted validation errors should be skipped in the generated schema.

— codex-rs/config/src/config_toml.rs:166

Source: codex-rs/config/src/config_toml.rs:166, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.args

Type: array<string> · Status: documented

Arguments passed to the MCP stdio server command.

— docs

Source: codex-rs/config/src/mcp_types.rs:348, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.auth

Type: "oauth" | "chatgpt" | "ema_auth" · Status: documented

Authentication fallback for an MCP HTTP server after configured bearer tokens and authorization headers. oauth (default) uses stored MCP OAuth credentials when available. chatgpt uses the current ChatGPT session for the trusted first-party ChatGPT origin, then falls back to stored OAuth.

— docs

Values:

• oauth: Use stored MCP OAuth credentials when available. Starting an OAuth login is a separate operation.
• chatgpt: Use the current ChatGPT session for servers on the trusted first-party ChatGPT origin. If no ChatGPT session provider is available, startup can still fall back to stored OAuth credentials.
• ema_auth: Exchange an enterprise IdP refresh token for resource-specific authorization. Alternate credentials and ordinary OAuth fallback are not permitted.

Source: codex-rs/config/src/mcp_types.rs:370, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.bearer_token_env_var

Type: string · Status: documented

Environment variable sourcing the bearer token for an MCP HTTP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:363, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.command

Type: string · Status: documented

Launcher command for an MCP stdio server.

— docs

Source: codex-rs/config/src/mcp_types.rs:346, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.cwd

Type: string · Status: documented

Working directory for the MCP stdio server process.

— docs

Source: codex-rs/config/src/mcp_types.rs:354, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.default_tools_approval_mode

Type: "auto" | "prompt" | "writes" | "approve" · Status: documented

Default approval behavior for MCP tools on this server unless a per-tool override exists.

— docs

Values: auto, prompt, writes, approve

Source: codex-rs/config/src/mcp_types.rs:387, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.disabled_tools

Type: array<string> · Status: documented

Deny list applied after enabled_tools for the MCP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:391, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.enabled

Type: boolean · Status: documented

Disable an MCP server without removing its configuration.

— docs

Source: codex-rs/config/src/mcp_types.rs:379, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.enabled_tools

Type: array<string> · Status: documented

Allow list of tool names exposed by the MCP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:389, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.env

Type: map<string, string> · Status: documented

Environment variables forwarded to the MCP stdio server.

— docs

Source: codex-rs/config/src/mcp_types.rs:350, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.env.<VAR>

Type: string · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:344, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.env_http_headers

Type: map<string, string> · Status: documented

HTTP headers populated from environment variables for an MCP HTTP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:357, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.env_http_headers.<header>

Type: string · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:344, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.env_vars

Type: array<string | table> · Default: source = "local" · Status: documented

Additional environment variables to whitelist for an MCP stdio server. String entries default to source = "local"; use source = "remote" only with executor-backed remote stdio.

— docs

Source: codex-rs/config/src/mcp_types.rs:352, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.env_vars[].name

Type: string · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:106, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.env_vars[].source

Type: string · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:108, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.environment_id

Type: string · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:368, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.http_headers

Type: map<string, string> · Status: documented

Static HTTP headers included with each MCP HTTP request.

— docs

Source: codex-rs/config/src/mcp_types.rs:355, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.http_headers.<header>

Type: string · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:344, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.http_headers_helper

Type: string · Status: documented

Local command that prints a JSON object of HTTP header names and values. Supported only for locally connected HTTP MCP servers. Explicit bearer tokens and OAuth credentials take precedence over helper-provided Authorization headers.

— docs

Source: codex-rs/config/src/mcp_types.rs:364, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.name

Type: string · Status: deprecated or legacy (per source comment)

Legacy display-name field accepted for backward compatibility.

— codex-rs/config/src/mcp_types.rs:400

Source: codex-rs/config/src/mcp_types.rs:400, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.oauth

Type: table · Status: undocumented

Client settings for MCP OAuth login or enterprise token exchange.

— codex-rs/config/src/mcp_types.rs:395

Source: codex-rs/config/src/mcp_types.rs:395, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.oauth.authorization_server_issuer

Type: string · Status: undocumented

Expected resource authorization server issuer for EMA token exchange.

— codex-rs/config/src/mcp_types.rs:177

Source: codex-rs/config/src/mcp_types.rs:177, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.oauth.callback_port

Type: integer (uint16) · Status: documented

Fixed OAuth callback listener port for this MCP server. Overrides mcp_oauth_callback_port. For a direct loopback callback with an explicit URL port, configure the same listener port.

— docs

Source: codex-rs/config/src/mcp_types.rs:173, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.oauth.callback_url

Type: string · Status: documented

Server-specific OAuth callback. Pre-registered clients reuse it when issuer identification is supported or the URL already ends in the server-specific callback ID. Otherwise, Codex uses the global or default callback with that ID appended. Clients without a pre-registered ID use this callback during client registration.

— docs

Source: codex-rs/config/src/mcp_types.rs:169, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.oauth.client_id

Type: string · Status: documented

Pre-registered OAuth client ID used for authorization and token exchange with this MCP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:165, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.oauth_resource

Type: string · Status: documented

Optional RFC 8707 OAuth resource parameter to include during MCP login.

— docs

Source: codex-rs/config/src/mcp_types.rs:397, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.omit_tools_from

Type: array<"code_mode" | "deferred" | "direct"> · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:385, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.required

Type: boolean · Status: documented

When true, fail startup/resume if this enabled MCP server cannot initialize.

— docs

Source: codex-rs/config/src/mcp_types.rs:381, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.scopes

Type: array<string> · Status: documented

OAuth scopes to request when authenticating to that MCP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:393, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

mcp_servers.<id>.startup_timeout_ms

Type: integer (uint64) · Status: documented

Alias for startup_timeout_sec in milliseconds.

— docs

Source: codex-rs/config/src/mcp_types.rs:374, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.startup_timeout_sec

Type: number · Status: documented

Override the default 10s startup timeout for an MCP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:372, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.supports_parallel_tool_calls

Type: boolean · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:383, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

mcp_servers.<id>.tool_timeout_sec

Type: number · Status: documented

Override the default 60s per-tool timeout for an MCP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:377, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.tools

Type: map<string, table> · Status: undocumented

Source: codex-rs/config/src/mcp_types.rs:402, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.tools.<tool>

Type: table · Status: undocumented

Per-tool settings for a single MCP server tool.

— codex-rs/config/src/mcp_types.rs:344

Source: codex-rs/config/src/mcp_types.rs:344, codex-rs/core/config.schema.json · In binary: yes (generic match)

mcp_servers.<id>.tools.<tool>.approval_mode

Type: "auto" | "prompt" | "writes" | "approve" · Status: documented

Per-tool approval behavior override for one MCP tool on this server.

— docs

Values: auto, prompt, writes, approve

Source: codex-rs/config/src/mcp_types.rs:87, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.tools.<tool>.output_token_limit

Type: integer (uint) · Status: documented

Token budget for one MCP tool's output, before the standard 20% serialization allowance. Overrides the model's default output truncation budget for that tool.

— docs

Source: codex-rs/config/src/mcp_types.rs:91, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

mcp_servers.<id>.url

Type: string · Status: documented

Endpoint for an MCP streamable HTTP server.

— docs

Source: codex-rs/config/src/mcp_types.rs:360, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

features

Type: table · Status: documented

Centralized feature flags (new). Prefer this over individual toggles.

— codex-rs/config/src/config_toml.rs:505

Source: codex-rs/config/src/config_toml.rs:505, codex-rs/core/config.schema.json · Docs: config-file/config-basic, config-file/config-sample, enterprise/managed-configuration · In binary: yes (generic match)

features.agent_message_board

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable shared discussion tools for an agent tree.

— codex-rs/features/src/lib.rs:1329

Source: codex-rs/features/src/lib.rs:1329 · In binary: yes (distinctive match)

features.analytics_plan_history

Type: boolean · Stage: experimental · Default: false · On here: no · Status: undocumented

Preview five-hour and weekly allowance history for consumer accounts in /analytics.

— codex-rs/features/src/lib.rs:930

Experimental menu: "Analytics plan history"

Source: codex-rs/features/src/lib.rs:930 · In binary: yes (distinctive match)

features.api_key_model_discovery

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Discover model catalogs for OpenAI API-key authentication.

— codex-rs/features/src/lib.rs:1271

Source: codex-rs/features/src/lib.rs:1271 · In binary: yes (distinctive match)

features.apply_patch_freeform

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the deleted apply_patch fallback feature.

— codex-rs/features/src/lib.rs:1181

Source: codex-rs/features/src/lib.rs:1181 · In binary: yes (distinctive match)

features.apply_patch_preserve_line_endings

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Preserve existing line endings when apply_patch updates files.

— codex-rs/features/src/lib.rs:1193

Source: codex-rs/features/src/lib.rs:1193 · In binary: yes (distinctive match)

features.apply_patch_streaming_events

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Stream structured progress while apply_patch input is being generated.

— codex-rs/features/src/lib.rs:1187

Source: codex-rs/features/src/lib.rs:1187 · In binary: yes (distinctive match)

features.apps

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable app (connector) integrations (stable; on by default). App and connector traffic is not controlled by the sandboxed-command network proxy or its domain allowlist.

— docs

Legacy aliases: features.connectors

Source: codex-rs/features/src/lib.rs:1347 · Docs: config-file/config-reference · In binary: yes (generic match)

features.apps_mcp_path_override

Type: boolean | table · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the legacy Apps MCP path override.

— codex-rs/features/src/lib.rs:1389

Source: codex-rs/features/src/lib.rs:1389 · In binary: yes (distinctive match)

features.apps_mcp_path_override.enabled

Type: boolean · Status: undocumented · When: read when features.apps_mcp_path_override is enabled

Source: codex-rs/config/src/config_toml.rs:166, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.apps_mcp_path_override.path

Type: string · Status: undocumented · When: read when features.apps_mcp_path_override is enabled

Source: codex-rs/config/src/config_toml.rs:166, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.artifact

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable native artifact tools.

— codex-rs/features/src/lib.rs:1743

Note: not listed in generated schema (accepted via the flattened boolean map)

Source: codex-rs/features/src/lib.rs:1743 · In binary: yes (generic match)

features.auth_elicitation

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Prompt Codex Apps connector auth failures through MCP URL elicitations.

— codex-rs/features/src/lib.rs:1725

Source: codex-rs/features/src/lib.rs:1725 · In binary: yes (distinctive match)

features.background_paginated_rollout_migration

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Migrate legacy local rollout files to paginated history in the background.

— codex-rs/features/src/lib.rs:1169

Source: codex-rs/features/src/lib.rs:1169 · In binary: yes (distinctive match)

features.bedrock_setup_wizard

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Offer Amazon Bedrock setup during TUI sign-in onboarding.

— codex-rs/features/src/lib.rs:1731

Source: codex-rs/features/src/lib.rs:1731 · In binary: yes (distinctive match)

features.browser_use

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow Browser Use agent integration in desktop apps. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1491

Source: codex-rs/features/src/lib.rs:1491 · In binary: yes (distinctive match)

features.browser_use_external

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow Browser Use integration with external browsers. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1503

Source: codex-rs/features/src/lib.rs:1503 · In binary: yes (distinctive match)

features.browser_use_full_cdp_access

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow Browser Use integration to access the full Chrome DevTools Protocol surface. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1497

Source: codex-rs/features/src/lib.rs:1497 · In binary: yes (distinctive match)

features.chronicle

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable the Chronicle sidecar for passive screen-context memories.

— codex-rs/features/src/lib.rs:1175

Legacy aliases: features.telepathy

Source: codex-rs/features/src/lib.rs:1175 · In binary: yes (generic match)

features.code_mode

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: documented

Enable JavaScript code mode backed by the standalone host process.

— codex-rs/features/src/lib.rs:1055

Source: codex-rs/features/src/lib.rs:1055 · Docs: config-file/config-sample · In binary: yes (distinctive match)

features.code_mode.default_exec_yield_time_ms

Type: integer (uint64) · Status: undocumented · When: read when features.code_mode is enabled

Default yield timeout for code-mode exec calls, in milliseconds.

— codex-rs/features/src/feature_configs.rs:28

Source: codex-rs/features/src/feature_configs.rs:28, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.code_mode.direct_only_tool_namespaces

Type: array<string> · Status: documented · When: read when features.code_mode is enabled

Tool namespaces code mode can use only through direct tool calls.

— docs

Source: codex-rs/features/src/feature_configs.rs:41, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.code_mode.enabled

Type: boolean · Status: documented · When: read when features.code_mode is enabled

Enable code mode feature configuration. This feature is under development and off by default.

— docs

Source: codex-rs/features/src/feature_configs.rs:25, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

features.code_mode.excluded_tool_namespaces

Type: array<string> · Status: documented · When: read when features.code_mode is enabled

Tool namespaces code mode excludes from nested code-mode tool guidance and executor exposure.

— docs

Source: codex-rs/features/src/feature_configs.rs:36, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.code_mode.experimental_show_cell_overhead

Type: boolean · Status: undocumented · When: read when features.code_mode is enabled

Show handler duration, code-mode host duration, and harness overhead in each code-mode cell response. Experimental: this option and the response format may change or be removed.

— codex-rs/features/src/feature_configs.rs:33

Source: codex-rs/features/src/feature_configs.rs:33, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.code_mode_buffered_exec

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the configurable code-mode exec yield timeout.

— codex-rs/features/src/lib.rs:1061

Source: codex-rs/features/src/lib.rs:1061 · In binary: yes (distinctive match)

features.code_mode_host

Type: boolean | table · Stage: stable · Default: true · On here: yes · Status: undocumented

Run JavaScript code mode in the standalone host process.

— codex-rs/features/src/lib.rs:1067

Source: codex-rs/features/src/lib.rs:1067 · In binary: yes (distinctive match)

features.code_mode_host.disable_in_process_fallback

Type: boolean · Status: undocumented · When: read when features.code_mode_host is enabled

Keep code mode fail-closed when the standalone host is unavailable.

— codex-rs/features/src/feature_configs.rs:57

Source: codex-rs/features/src/feature_configs.rs:57, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.code_mode_host.enabled

Type: boolean · Status: undocumented · When: read when features.code_mode_host is enabled

Source: codex-rs/features/src/feature_configs.rs:54, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.code_mode_interrupt

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Terminate active code mode cells when their turn is interrupted.

— codex-rs/features/src/lib.rs:1079

Source: codex-rs/features/src/lib.rs:1079 · In binary: yes (distinctive match)

features.code_mode_only

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Restrict model-visible tools to code mode entrypoints (exec, wait).

— codex-rs/features/src/lib.rs:1085

Source: codex-rs/features/src/lib.rs:1085 · In binary: yes (distinctive match)

features.code_mode_prewarm

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Establish the code-mode host connection during session startup.

— codex-rs/features/src/lib.rs:1073

Source: codex-rs/features/src/lib.rs:1073 · In binary: yes (distinctive match)

features.codex_apps_mcp_2026_07_28

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable MCP protocol version 2026-07-28 for the host-owned Codex Apps server.

— codex-rs/features/src/lib.rs:1371

Source: codex-rs/features/src/lib.rs:1371 · In binary: yes (distinctive match)

features.codex_git_commit

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed legacy git commit attribution guidance flag.

— codex-rs/features/src/lib.rs:1127

Source: codex-rs/features/src/lib.rs:1127 · In binary: yes (distinctive match)

features.codex_hooks

Type: boolean · Status: alias

Legacy alias for features.hooks.

— codex-rs/features/src/legacy.rs:49

Canonical key: features.hooks

Source: codex-rs/features/src/legacy.rs:49, codex-rs/config/src/config_toml.rs:166 · In binary: yes (distinctive match)

features.collab

Type: boolean · Status: alias

Legacy alias for features.multi_agent.

— codex-rs/features/src/legacy.rs:37

Canonical key: features.multi_agent

Source: codex-rs/features/src/legacy.rs:37, codex-rs/config/src/config_toml.rs:166 · In binary: yes (generic match)

features.collaboration_modes

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Enable collaboration modes (Plan, Default). Kept for config backward compatibility; behavior is always collaboration-modes-enabled.

— codex-rs/features/src/lib.rs:1713

Source: codex-rs/features/src/lib.rs:1713 · In binary: yes (distinctive match)

features.compaction_image_budget

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Include retained images in the remote compaction context budget.

— codex-rs/features/src/lib.rs:1827

Source: codex-rs/features/src/lib.rs:1827 · In binary: yes (distinctive match)

features.computer_use

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow Codex Computer Use. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1509

Source: codex-rs/features/src/lib.rs:1509 · In binary: yes (distinctive match)

features.concurrent_reasoning_summaries

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Request sequential cutoff reasoning summary delivery.

— codex-rs/features/src/lib.rs:1569

Source: codex-rs/features/src/lib.rs:1569 · In binary: yes (distinctive match)

features.connectors

Type: boolean · Status: alias

Legacy alias for features.apps.

— codex-rs/features/src/legacy.rs:13

Canonical key: features.apps

Source: codex-rs/features/src/legacy.rs:13, codex-rs/config/src/config_toml.rs:166 · In binary: yes (generic match)

features.content_item_kinds

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Send per-content-entry classifications in internal Responses metadata.

— codex-rs/features/src/lib.rs:1043

Source: codex-rs/features/src/lib.rs:1043 · In binary: yes (distinctive match)

features.context_management

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: undocumented

Enables experimental context management.

— codex-rs/features/src/lib.rs:1683

Source: codex-rs/features/src/lib.rs:1683 · In binary: yes (distinctive match)

features.context_management.experimental_mode

Type: boolean · Status: documented · When: read when features.context_management is enabled

Enable experimental context management (off by default). Rather than repeatedly compressing context into a single summary, it uses notes and searchable history to preserve accumulated details. Requires ChatGPT sign-in on Plus, Pro, or Pro Lite.

— docs

Source: codex-rs/features/src/feature_configs.rs:314, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.current_time_reminder

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: undocumented

Add current-time reminders to model-visible context.

— codex-rs/features/src/lib.rs:1701

Source: codex-rs/features/src/lib.rs:1701 · In binary: yes (distinctive match)

features.current_time_reminder.clock_source

Type: "system" | "external" · Status: undocumented · When: read when features.current_time_reminder is enabled

Values: system, external

Source: codex-rs/features/src/feature_configs.rs:412, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.current_time_reminder.delivery_mode

Type: "any_inference" | "after_user_or_tool_output" · Status: undocumented · When: read when features.current_time_reminder is enabled

Which inference boundaries may receive current-time reminders.

— codex-rs/features/src/feature_configs.rs:414

Values:

• any_inference: Allow a reminder before any inference request once the interval is due.
• after_user_or_tool_output: Allow reminders after user input or tool output; new context windows still force one.

Source: codex-rs/features/src/feature_configs.rs:414, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.current_time_reminder.enabled

Type: boolean · Status: undocumented · When: read when features.current_time_reminder is enabled

Source: codex-rs/features/src/feature_configs.rs:408, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.current_time_reminder.reminder_interval_seconds

Type: integer (uint64) · Status: undocumented · When: read when features.current_time_reminder is enabled

Source: codex-rs/features/src/feature_configs.rs:410, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.current_time_reminder.sleep_tool

Type: boolean · Status: undocumented · When: read when features.current_time_reminder is enabled

Expose the input-interruptible clock.sleep tool.

— codex-rs/features/src/feature_configs.rs:417

Source: codex-rs/features/src/feature_configs.rs:417, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.cwd_relative_turn_diffs

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Use the current working directory for turn diff display paths.

— codex-rs/features/src/lib.rs:1031

Source: codex-rs/features/src/lib.rs:1031 · In binary: yes (distinctive match)

features.daemon_auto_start

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Automatically start the shared local daemon for eligible interactive launches.

— codex-rs/features/src/lib.rs:940

Source: codex-rs/features/src/lib.rs:940 · In binary: yes (distinctive match)

features.default_mode_request_user_input

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Allow request_user_input in Default collaboration mode.

— codex-rs/features/src/lib.rs:1605

Source: codex-rs/features/src/lib.rs:1605 · In binary: yes (distinctive match)

features.deferred_executor

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Allow turns to start while selected executors are still starting.

— codex-rs/features/src/lib.rs:1025

Source: codex-rs/features/src/lib.rs:1025 · In binary: yes (distinctive match)

features.deferred_tool_world_state

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Describe deferred tool namespaces in the model-visible world state.

— codex-rs/features/src/lib.rs:1407

Source: codex-rs/features/src/lib.rs:1407 · In binary: yes (distinctive match)

features.elevated_windows_sandbox

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Use the elevated Windows sandbox pipeline (setup + runner).

— codex-rs/features/src/lib.rs:1247

Source: codex-rs/features/src/lib.rs:1247 · In binary: yes (distinctive match)

features.enable_experimental_windows_sandbox

Type: boolean · Status: alias

Legacy alias for features.experimental_windows_sandbox.

— codex-rs/features/src/legacy.rs:17

Canonical key: features.experimental_windows_sandbox

Source: codex-rs/features/src/legacy.rs:17, codex-rs/config/src/config_toml.rs:166 · In binary: yes (distinctive match)

features.enable_fanout

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the deleted agent-job tools.

— codex-rs/features/src/lib.rs:1341

Source: codex-rs/features/src/lib.rs:1341 · In binary: yes (distinctive match)

features.enable_mcp_apps

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable MCP apps.

— codex-rs/features/src/lib.rs:1359

Source: codex-rs/features/src/lib.rs:1359 · In binary: yes (distinctive match)

features.enable_request_compression

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Compress streaming request bodies with zstd when supported (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1277 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.exec_permission_approvals

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Allow exec tools to request additional permissions while staying sandboxed.

— codex-rs/features/src/lib.rs:1199

Legacy aliases: features.request_permissions

Source: codex-rs/features/src/lib.rs:1199 · In binary: yes (distinctive match)

features.executed_tool_call_metadata

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Record model-attempted tool calls in internal Responses metadata.

— codex-rs/features/src/lib.rs:1049

Source: codex-rs/features/src/lib.rs:1049 · In binary: yes (distinctive match)

features.executor_capability_discovery

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Discover selected-root plugin and skill manifests through one high-level exec-server RPC.

— codex-rs/features/src/lib.rs:1443

Source: codex-rs/features/src/lib.rs:1443 · In binary: yes (distinctive match)

features.experimental_use_unified_exec_tool

Type: boolean · Status: alias

Legacy alias for features.unified_exec.

— codex-rs/features/src/legacy.rs:21

Canonical key: features.unified_exec

Source: codex-rs/features/src/legacy.rs:21, codex-rs/config/src/config_toml.rs:556 · In binary: yes (distinctive match)

features.experimental_windows_sandbox

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Enable Windows sandbox (restricted token) on Windows.

— codex-rs/features/src/lib.rs:1241

Legacy aliases: features.enable_experimental_windows_sandbox

Source: codex-rs/features/src/lib.rs:1241 · In binary: yes (distinctive match)

features.external_agent_memory_import

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable importing project-scoped memory from external agents.

— codex-rs/features/src/lib.rs:1151

Source: codex-rs/features/src/lib.rs:1151 · In binary: yes (distinctive match)

features.external_migration

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag retained as a no-op.

— codex-rs/features/src/lib.rs:1527

Source: codex-rs/features/src/lib.rs:1527 · In binary: yes (distinctive match)

features.fast_mode

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable model-catalog service tier selection in the TUI, including Fast-tier commands when the active model advertises them (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1749 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.goals

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable persisted goals and automatic continuation (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1671 · Docs: config-file/config-reference · In binary: yes (generic match)

features.guardian_approval

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable automatic review for approval prompts.

— codex-rs/features/src/lib.rs:1629

Source: codex-rs/features/src/lib.rs:1629 · In binary: yes (distinctive match)

features.guardian_enhanced_node_repl_transcripts

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Include completed node_repl or cua_repl Code Mode responses in Guardian reviews.

— codex-rs/features/src/lib.rs:1647

Source: codex-rs/features/src/lib.rs:1647 · In binary: yes (distinctive match)

features.guardian_ext

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the unused Guardian extension prototype.

— codex-rs/features/src/lib.rs:1665

Source: codex-rs/features/src/lib.rs:1665 · In binary: yes (distinctive match)

features.guardian_node_repl_transcript_images

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Include completed node_repl or cua_repl Code Mode response images in Guardian reviews.

— codex-rs/features/src/lib.rs:1653

Source: codex-rs/features/src/lib.rs:1653 · In binary: yes (distinctive match)

features.guardian_reuse_parent_compaction

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Reuse encrypted parent compaction when restarting Guardian review sessions.

— codex-rs/features/src/lib.rs:1641

Source: codex-rs/features/src/lib.rs:1641 · In binary: yes (distinctive match)

features.guardianv2

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: undocumented

Enable Guardian V2 automatic approval reviews.

— codex-rs/features/src/lib.rs:1659

Source: codex-rs/features/src/lib.rs:1659 · In binary: yes (generic match)

features.guardianv2.classifier_instructions

Type: string · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:146, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.enabled

Type: boolean · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:134, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.guardianv2.free_guardian

Type: boolean · Status: deprecated or legacy (per source comment) · When: read when features.guardianv2 is enabled

Legacy setting retained for config compatibility; the backend now controls Guardian billing.

— codex-rs/features/src/feature_configs.rs:137

Source: codex-rs/features/src/feature_configs.rs:137, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.max_action_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:156, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.max_classifier_instruction_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:159, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.max_parent_compaction_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:164, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.max_tool_call_lag

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:151, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.persist_scores

Type: boolean · Status: undocumented · When: read when features.guardianv2 is enabled

Persist reviewed actions and risk scores to rollout files for debugging.

— codex-rs/features/src/feature_configs.rs:144

Source: codex-rs/features/src/feature_configs.rs:144, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.reasoning_effort

Type: string · Status: undocumented · When: read when features.guardianv2 is enabled

A non-empty reasoning effort value advertised by the model.

— codex-rs/features/src/feature_configs.rs:153

Source: codex-rs/features/src/feature_configs.rs:153, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.reuse_parent_compaction

Type: boolean · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:161, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.review_scope

Type: table · Status: undocumented · When: read when features.guardianv2 is enabled

Optional tool-call categories available to the Guardian v2 classifier.

— codex-rs/features/src/feature_configs.rs:166

Source: codex-rs/features/src/feature_configs.rs:166, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.review_scope.computer_use_only

Type: boolean · Status: undocumented · When: read when features.guardianv2 is enabled

Restrict asynchronous classification and fast approvals to browser and computer-use tools.

— codex-rs/features/src/feature_configs.rs:123

Source: codex-rs/features/src/feature_configs.rs:123, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.review_scope.sandboxed_exec_commands

Type: boolean · Status: undocumented · When: read when features.guardianv2 is enabled

Include sandboxed shell command calls in Guardian v2 classification.

— codex-rs/features/src/feature_configs.rs:126

Source: codex-rs/features/src/feature_configs.rs:126, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.review_threshold

Type: number · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:149, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.thread_context

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Select thread-owned context for both Guardian reviewers. Read once from the thread's fixed feature set when Guardian evidence is initialized.

— codex-rs/features/src/lib.rs:1635

Note: not listed in generated schema (accepted via the flattened boolean map)

Source: codex-rs/features/src/lib.rs:1635 · In binary: yes (distinctive match)

features.guardianv2.transcript

Type: table · Status: undocumented · When: read when features.guardianv2 is enabled

Bounds and optional sources for the Guardian v2 conversation transcript.

— codex-rs/features/src/feature_configs.rs:168

Source: codex-rs/features/src/feature_configs.rs:168, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.guardianv2.transcript.include_images

Type: boolean · Status: undocumented · When: read when features.guardianv2 is enabled

Include recent screenshots from messages and configured tool outputs.

— codex-rs/features/src/feature_configs.rs:99

Source: codex-rs/features/src/feature_configs.rs:99, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.transcript.max_message_entry_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:102, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.transcript.max_message_transcript_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:108, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.transcript.max_recent_non_user_entries

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:114, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.transcript.max_tool_entry_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:105, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.transcript.max_tool_transcript_tokens

Type: integer (uint) · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:111, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.guardianv2.transcript.sources

Type: array<"tool_calls" | "tool_outputs" | "reasoning"> · Status: undocumented · When: read when features.guardianv2 is enabled

Source: codex-rs/features/src/feature_configs.rs:96, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.hooks

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable lifecycle hooks loaded from hooks.json or inline [hooks] config. features.codex_hooks is a deprecated alias.

— docs

Legacy aliases: features.codex_hooks

Source: codex-rs/features/src/lib.rs:1211 · Docs: config-file/config-reference · In binary: yes (generic match)

features.image_detail_original

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag retained as a no-op so old wrappers can still pass --enable image_detail_original.

— codex-rs/features/src/lib.rs:1773

Source: codex-rs/features/src/lib.rs:1773 · In binary: yes (distinctive match)

features.image_generation

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable extension-backed image generation.

— codex-rs/features/src/lib.rs:1533

Legacy aliases: features.imagegenext

Source: codex-rs/features/src/lib.rs:1533 · In binary: yes (distinctive match)

features.image_resize_notice

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Tell the model when a prompt image was resized and include its dimensions.

— codex-rs/features/src/lib.rs:1545

Source: codex-rs/features/src/lib.rs:1545 · In binary: yes (distinctive match)

features.imagegenext

Type: boolean · Status: alias

Legacy alias for features.image_generation.

— codex-rs/features/src/legacy.rs:33

Canonical key: features.image_generation

Source: codex-rs/features/src/legacy.rs:33, codex-rs/config/src/config_toml.rs:166 · In binary: yes (generic match)

features.in_app_browser

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow the in-app browser pane in desktop apps. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1461

Source: codex-rs/features/src/lib.rs:1461 · In binary: yes (distinctive match)

features.in_app_chat

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow the in-app chat pane in desktop apps. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1467

Source: codex-rs/features/src/lib.rs:1467 · In binary: yes (distinctive match)

features.in_app_dictation

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow in-app dictation in desktop apps. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1473

Source: codex-rs/features/src/lib.rs:1473 · In binary: yes (distinctive match)

features.in_app_local_automation

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow desktop apps to run local automations. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1479

Source: codex-rs/features/src/lib.rs:1479 · In binary: yes (distinctive match)

features.in_app_updates

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow desktop apps to perform in-app updates. Requirements-only gate: this should be set from requirements, not user config.

— codex-rs/features/src/lib.rs:1485

Source: codex-rs/features/src/lib.rs:1485 · In binary: yes (distinctive match)

features.item_ids

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Removed compatibility flag for always-on response item IDs.

— codex-rs/features/src/lib.rs:1563

Source: codex-rs/features/src/lib.rs:1563 · In binary: yes (distinctive match)

features.js_repl

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the deleted JavaScript REPL feature.

— codex-rs/features/src/lib.rs:1037

Source: codex-rs/features/src/lib.rs:1037 · In binary: yes (generic match)

features.js_repl_tools_only

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the deleted JavaScript REPL tool-only mode.

— codex-rs/features/src/lib.rs:1091

Source: codex-rs/features/src/lib.rs:1091 · In binary: yes (distinctive match)

features.local_thread_store_compression

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Compress cold local thread-store rollout files, including shared histories. Requires every reader of the Codex home to support compressed shared histories.

— codex-rs/features/src/lib.rs:1157

Source: codex-rs/features/src/lib.rs:1157 · In binary: yes (distinctive match)

features.local_thread_store_shared_compression

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag; local_thread_store_compression controls all rollout files.

— codex-rs/features/src/lib.rs:1163

Source: codex-rs/features/src/lib.rs:1163 · In binary: yes (distinctive match)

features.mcp_2026_07_28

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable MCP protocol version 2026-07-28 support.

— codex-rs/features/src/lib.rs:1365

Source: codex-rs/features/src/lib.rs:1365 · In binary: yes (distinctive match)

features.mcp_oauth_refresh_coordination

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Let RMCP coordinate OAuth refresh through the configured credential store.

— codex-rs/features/src/lib.rs:1377

Source: codex-rs/features/src/lib.rs:1377 · In binary: yes (distinctive match)

features.memories

Type: boolean · Stage: stable · Default: false · On here: no · Status: documented

Enable Memories (off by default).

— docs

Legacy aliases: features.memory_tool

Source: codex-rs/features/src/lib.rs:1145 · Docs: config-file/config-reference · In binary: yes (generic match)

features.memory_tool

Type: boolean · Status: alias

Legacy alias for features.memories.

— codex-rs/features/src/legacy.rs:41

Canonical key: features.memories

Source: codex-rs/features/src/legacy.rs:41, codex-rs/config/src/config_toml.rs:166 · In binary: yes (distinctive match)

features.mentions_v2

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable the unified mention popup used by default in the TUI.

— codex-rs/features/src/lib.rs:1593

Source: codex-rs/features/src/lib.rs:1593 · In binary: yes (distinctive match)

features.multi_agent

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable multi-agent collaboration tools (spawn_agent, send_input, resume_agent, wait_agent, and close_agent) (stable; on by default).

— docs

Legacy aliases: features.collab

Source: codex-rs/features/src/lib.rs:1317 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.multi_agent_mode

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag retained as a no-op.

— codex-rs/features/src/lib.rs:1335

Source: codex-rs/features/src/lib.rs:1335 · In binary: yes (distinctive match)

features.multi_agent_v2

Type: boolean | table · Stage: stable · Default: false · On here: no · Status: undocumented

Enable task-path-based multi-agent routing.

— codex-rs/features/src/lib.rs:1323

Source: codex-rs/features/src/lib.rs:1323 · In binary: yes (distinctive match)

features.multi_agent_v2.default_wait_timeout_ms

Type: integer (int64) · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:269, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.disable_direct_message

Type: boolean · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Disable the model's direct-message tools; spawning and automatic child results remain available.

— codex-rs/features/src/feature_configs.rs:298

Source: codex-rs/features/src/feature_configs.rs:298, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.enabled

Type: boolean · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:257, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.multi_agent_v2.expose_spawn_agent_model_overrides

Type: boolean · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Exposes model and reasoning_effort on the multi-agent v2 spawn tool and adds corresponding guidance to root and subagent usage hints.

— codex-rs/features/src/feature_configs.rs:292

Source: codex-rs/features/src/feature_configs.rs:292, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.hide_spawn_agent_metadata

Type: boolean · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:288, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.max_concurrent_threads_per_session

Type: integer (uint) · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:260, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.max_wait_timeout_ms

Type: integer (int64) · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:266, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.min_wait_timeout_ms

Type: integer (int64) · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:263, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.multi_agent_mode_hint_text

Type: string · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:283, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.non_code_mode_only

Type: boolean · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:300, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.root_agent_usage_hint_text

Type: string · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:276, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.subagent_developer_instructions

Type: string · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Overrides inherited developer instructions for subagents without role-specific instructions.

— codex-rs/features/src/feature_configs.rs:281

Source: codex-rs/features/src/feature_configs.rs:281, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.subagent_usage_hint_text

Type: string · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:278, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.tool_namespace

Type: string · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:286, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.usage_hint_enabled

Type: boolean · Status: deprecated or legacy (per source comment) · When: read when features.multi_agent_v2 is enabled

Deprecated compatibility field. Its value is ignored.

— codex-rs/features/src/feature_configs.rs:272

Source: codex-rs/features/src/feature_configs.rs:272, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.usage_hint_text

Type: string · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Source: codex-rs/features/src/feature_configs.rs:274, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.multi_agent_v2.wait_agent_enabled

Type: boolean · Status: undocumented · When: read when features.multi_agent_v2 is enabled

Expose the multi-agent v2 wait_agent tool.

— codex-rs/features/src/feature_configs.rs:295

Source: codex-rs/features/src/feature_configs.rs:295, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.network_proxy

Type: boolean | table · Stage: experimental · Default: false · On here: no · Status: documented

Start the network proxy for sandboxed commands (experimental; off by default). Required to enforce permission-profile domain rules unless enabled administrator-managed experimental_network requirements start the proxy. Use a table when setting feature-level policy options such as domains. Does not filter web search, apps, MCP, or other hosted tools.

— docs

Experimental menu: "Network proxy"

Source: codex-rs/features/src/lib.rs:1289 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.allow_local_binding

Type: boolean · Default: false · Status: documented · When: read when features.network_proxy is enabled

Allow broader local/private-network access. Defaults to false; exact local IP literal or localhost allow rules can still permit specific local targets.

— docs

Default sources: false (stated in docs); true for MXC, which cannot enforce false (stated in source doc comment)

Source: codex-rs/features/src/feature_configs.rs:490, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.allow_upstream_proxy

Type: boolean · Default: true · Status: documented · When: read when features.network_proxy is enabled

Allow chaining through an upstream proxy from the environment. Defaults to true.

— docs

Source: codex-rs/features/src/feature_configs.rs:475, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.credential_broker

Type: boolean · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/features/src/feature_configs.rs:492, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.network_proxy.credentials

Type: map<string, table> · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/features/src/feature_configs.rs:494, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>

Type: table · Status: undocumented · When: read when features.network_proxy is enabled

Declarative description of an environment-backed credential family.

— codex-rs/features/src/feature_configs.rs:463

Source: codex-rs/features/src/feature_configs.rs:463, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>.auth

Type: array<"bearer" | "token" | "basic" | "header"> · Default: [] · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:17, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>.env

Type: array<string> · Default: [] · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:9, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>.header

Type: string · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:19, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>.patterns

Type: array<string> · Default: [] · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:10, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>.prefix

Type: string · Status: undocumented · When: read when features.network_proxy is enabled

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:21, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.credentials.<key>.url_prefix_from_env

Type: string · Status: undocumented · When: read when features.network_proxy is enabled

Environment variable containing an additional URL prefix or hostname.

— codex-rs/network-proxy/src/credential_broker/provider_config.rs:16

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:16, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.network_proxy.credentials.<key>.url_prefixes

Type: array<string> · Default: [] · Status: undocumented · When: read when features.network_proxy is enabled

URL prefixes authorized for injection. Bare loopback hosts imply HTTP; other bare hosts imply HTTPS.

— codex-rs/network-proxy/src/credential_broker/provider_config.rs:13

Source: codex-rs/network-proxy/src/credential_broker/provider_config.rs:13, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.network_proxy.dangerously_allow_all_unix_sockets

Type: boolean · Default: false · Status: documented · When: read when features.network_proxy is enabled

Permit arbitrary Unix socket destinations instead of allowlist-only access. Defaults to false; use only in tightly controlled environments.

— docs

Source: codex-rs/features/src/feature_configs.rs:479, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.dangerously_allow_non_loopback_proxy

Type: boolean · Default: false · Status: documented · When: read when features.network_proxy is enabled

Permit non-loopback listener addresses. Defaults to false; enabling it can expose proxy listeners beyond localhost.

— docs

Source: codex-rs/features/src/feature_configs.rs:477, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.domains

Type: map<string, "allow" | "deny"> · Status: documented · When: read when features.network_proxy is enabled

Domain policy for sandboxed networking. Unset by default, which means no external destinations are allowed until you add allow rules. Supports exact hosts, *.example.com for subdomains only, **.example.com for apex plus subdomains, and global * allow rules; prefer scoped rules because * broadly opens public outbound access.

— docs

Source: codex-rs/features/src/feature_configs.rs:483, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

features.network_proxy.domains.<domain>

Type: "allow" | "deny" · Status: undocumented · When: read when features.network_proxy is enabled

Values: allow, deny

Source: codex-rs/features/src/feature_configs.rs:463, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.enable_socks5

Type: boolean · Default: true · Status: documented · When: read when features.network_proxy is enabled

Expose SOCKS5 support. Defaults to true.

— docs

Source: codex-rs/features/src/feature_configs.rs:469, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.enable_socks5_udp

Type: boolean · Default: true · Status: documented · When: read when features.network_proxy is enabled

Allow UDP over SOCKS5. Defaults to true.

— docs

Source: codex-rs/features/src/feature_configs.rs:473, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.enabled

Type: boolean · Default: false · Status: documented · When: read when features.network_proxy is enabled

Start the sandboxed-command network proxy when command network access is enabled. Defaults to false; permission-profile domain rules are not enforced while the proxy is off.

— docs

Source: codex-rs/features/src/feature_configs.rs:465, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

features.network_proxy.mode

Type: "limited" | "full" · Status: undocumented · When: read when features.network_proxy is enabled

Values: limited, full

Source: codex-rs/features/src/feature_configs.rs:481, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.network_proxy.proxy_url

Type: string · Default: "http://127 · Status: documented · When: read when features.network_proxy is enabled

HTTP listener URL for sandboxed networking. Defaults to "http://127.0.0.1:3128".

— docs

Source: codex-rs/features/src/feature_configs.rs:467, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.socks_url

Type: string · Default: "http://127 · Status: documented · When: read when features.network_proxy is enabled

SOCKS5 listener URL. Defaults to "http://127.0.0.1:8081".

— docs

Source: codex-rs/features/src/feature_configs.rs:471, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.unix_sockets

Type: map<string, "allow" | "deny"> · Status: documented · When: read when features.network_proxy is enabled

Unix socket policy for sandboxed networking. Unset by default; add allow entries for permitted sockets.

— docs

Source: codex-rs/features/src/feature_configs.rs:485, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.network_proxy.unix_sockets.<path>

Type: "allow" | "deny" · Status: undocumented · When: read when features.network_proxy is enabled

Values: allow, deny

Source: codex-rs/features/src/feature_configs.rs:463, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.non_prefixed_mcp_tool_names

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: undocumented

Expose MCP model-visible namespaces without the legacy mcp__ prefix.

— codex-rs/features/src/lib.rs:1413

Source: codex-rs/features/src/lib.rs:1413 · In binary: yes (distinctive match)

features.non_prefixed_mcp_tool_names.enabled

Type: boolean · Status: undocumented · When: read when features.non_prefixed_mcp_tool_names is enabled

Source: codex-rs/features/src/feature_configs.rs:70, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.non_prefixed_mcp_tool_names.server_names

Type: array<string> · Status: undocumented · When: read when features.non_prefixed_mcp_tool_names is enabled

MCP servers whose tools should omit the legacy mcp__ namespace prefix.

— codex-rs/features/src/feature_configs.rs:73

Source: codex-rs/features/src/feature_configs.rs:73, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.nonfatal_clock_read_errors

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Report failed clock reads to the model without failing the turn.

— codex-rs/features/src/lib.rs:1707

Source: codex-rs/features/src/lib.rs:1707 · In binary: yes (distinctive match)

features.omit_app_server_notification_media

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Omit inline image and audio content from app-server item notifications.

— codex-rs/features/src/lib.rs:1539

Source: codex-rs/features/src/lib.rs:1539 · In binary: yes (distinctive match)

features.personality

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Enable personality selection controls (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1737 · Docs: config-file/config-reference · In binary: yes (generic match)

features.plugin_hooks

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for plugin-bundled lifecycle hooks.

— codex-rs/features/src/lib.rs:1455

Source: codex-rs/features/src/lib.rs:1455 · In binary: yes (distinctive match)

features.plugin_sharing

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable remote plugin sharing flows.

— codex-rs/features/src/lib.rs:1521

Source: codex-rs/features/src/lib.rs:1521 · In binary: yes (distinctive match)

features.plugins

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable plugins.

— codex-rs/features/src/lib.rs:1437

Source: codex-rs/features/src/lib.rs:1437 · Docs: enterprise/managed-configuration · In binary: yes (generic match)

features.powershell_shell_version

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Expose the selected PowerShell execution host's bounded major/minor version.

— codex-rs/features/src/lib.rs:1013

Source: codex-rs/features/src/lib.rs:1013 · In binary: yes (distinctive match)

features.prefer_mxc

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Prefer the local native Windows sandbox when available, retaining legacy fallback.

— codex-rs/features/src/lib.rs:1259

Source: codex-rs/features/src/lib.rs:1259 · In binary: yes (distinctive match)

features.prevent_idle_sleep

Type: boolean · Stage: experimental · Default: false · On here: no · Status: documented

Prevent the machine from sleeping while a turn is actively running (experimental; off by default).

— docs

Experimental menu: "Prevent sleep while running"

Source: codex-rs/features/src/lib.rs:1785 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.psp

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Route first-party ChatGPT requests through PSP.

— codex-rs/features/src/lib.rs:1353

Source: codex-rs/features/src/lib.rs:1353 · In binary: yes (generic match)

features.realtime_conversation

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable voice conversations in the TUI.

— codex-rs/features/src/lib.rs:1761

Source: codex-rs/features/src/lib.rs:1761 · In binary: yes (distinctive match)

features.reasoning_effort_override

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Append trusted response configuration items when the selected reasoning effort changes.

— codex-rs/features/src/lib.rs:1695

Source: codex-rs/features/src/lib.rs:1695 · In binary: yes (distinctive match)

features.recommended_plugins

Type: boolean · Stage: stable · Default: false · On here: no · Status: undocumented

Include recommended plugins in model-visible context.

— codex-rs/features/src/lib.rs:1431

Source: codex-rs/features/src/lib.rs:1431 · In binary: yes (distinctive match)

features.remote_compaction_v2

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility key, still advertised to the Responses API.

— codex-rs/features/src/lib.rs:1821

Source: codex-rs/features/src/lib.rs:1821 · In binary: yes (distinctive match)

features.remote_control

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the deleted remote control feature.

— codex-rs/features/src/lib.rs:1767

Source: codex-rs/features/src/lib.rs:1767 · In binary: yes (distinctive match)

features.remote_models

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Legacy remote models flag kept for backward compatibility.

— codex-rs/features/src/lib.rs:1265

Source: codex-rs/features/src/lib.rs:1265 · In binary: yes (distinctive match)

features.remote_plugin

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable the remote plugin catalog (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1515 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.request_permissions

Type: boolean · Status: alias

Legacy alias for features.exec_permission_approvals.

— codex-rs/features/src/legacy.rs:25

Canonical key: features.exec_permission_approvals

Source: codex-rs/features/src/legacy.rs:25, codex-rs/config/src/config_toml.rs:166 · In binary: yes (distinctive match)

features.request_permissions_tool

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Expose the built-in request_permissions tool.

— codex-rs/features/src/lib.rs:1217

Source: codex-rs/features/src/lib.rs:1217 · In binary: yes (distinctive match)

features.request_rule

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Allow the model to request approval and propose exec rules.

— codex-rs/features/src/lib.rs:1235

Source: codex-rs/features/src/lib.rs:1235 · In binary: yes (distinctive match)

features.resize_all_images

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Removed compatibility flag for always-on centralized image preparation.

— codex-rs/features/src/lib.rs:1557

Source: codex-rs/features/src/lib.rs:1557 · In binary: yes (distinctive match)

features.respect_system_proxy

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Respect host system proxy settings for Codex-owned network clients.

— codex-rs/features/src/lib.rs:1305

Source: codex-rs/features/src/lib.rs:1305 · In binary: yes (distinctive match)

features.responses_websockets

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Legacy rollout flag for Responses API WebSocket transport experiments.

— codex-rs/features/src/lib.rs:1809

Source: codex-rs/features/src/lib.rs:1809 · In binary: yes (distinctive match)

features.responses_websockets_v2

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Legacy rollout flag for Responses API WebSocket transport v2 experiments.

— codex-rs/features/src/lib.rs:1815

Source: codex-rs/features/src/lib.rs:1815 · In binary: yes (distinctive match)

features.retain_client_developer_messages

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Retain client-authored developer messages across compacted context windows.

— codex-rs/features/src/lib.rs:1833

Source: codex-rs/features/src/lib.rs:1833 · In binary: yes (distinctive match)

features.rollout_budget

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: documented

Track and report a shared token budget across a session's agent threads.

— codex-rs/features/src/lib.rs:1689

Source: codex-rs/features/src/lib.rs:1689 · Docs: config-file/config-sample · In binary: yes (distinctive match)

features.rollout_budget.enabled

Type: boolean · Status: documented · When: read when features.rollout_budget is enabled

Enable rollout budget tracking. This feature is under development and off by default. When enabled, features.rollout_budget.limit_tokens is required.

— docs

Source: codex-rs/features/src/feature_configs.rs:364, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

features.rollout_budget.limit_tokens

Type: integer (int64) · Status: documented · When: read when features.rollout_budget is enabled

Positive token limit for rollout budget tracking. Required when rollout budget is enabled.

— docs

Source: codex-rs/features/src/feature_configs.rs:367, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.rollout_budget.prefill_token_weight

Type: number · Default: 1 · Status: documented · When: read when features.rollout_budget is enabled

Finite non-negative multiplier for prefill tokens in rollout budget accounting. Defaults to 1.0.

— docs

Source: codex-rs/features/src/feature_configs.rs:376, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.rollout_budget.reminder_at_remaining_tokens

Type: array<integer (int64)> · Status: undocumented · When: read when features.rollout_budget is enabled

Remaining weighted-token values that trigger reminders when crossed.

— codex-rs/features/src/feature_configs.rs:370

Source: codex-rs/features/src/feature_configs.rs:370, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.rollout_budget.sampling_token_weight

Type: number · Default: 1 · Status: documented · When: read when features.rollout_budget is enabled

Finite non-negative multiplier for sampled tokens in rollout budget accounting. Defaults to 1.0.

— docs

Source: codex-rs/features/src/feature_configs.rs:373, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.runtime_metrics

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable runtime metrics snapshots via a manual reader.

— codex-rs/features/src/lib.rs:1133

Source: codex-rs/features/src/lib.rs:1133 · In binary: yes (distinctive match)

features.search_tool

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Legacy search-tool feature flag kept for backward compatibility.

— codex-rs/features/src/lib.rs:1121

Source: codex-rs/features/src/lib.rs:1121 · In binary: yes (distinctive match)

features.secret_auth_storage

Type: boolean · Stage: stable · Default: `cfg!(windows)` · On here: no · Status: undocumented

Store CLI auth in the encrypted local secrets backend when keyring storage is selected.

— codex-rs/features/src/lib.rs:977

Source: codex-rs/features/src/lib.rs:977 · In binary: yes (distinctive match)

features.send_async_message

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for model-enabled async user messaging.

— codex-rs/features/src/lib.rs:1611

Source: codex-rs/features/src/lib.rs:1611 · In binary: yes (distinctive match)

features.send_message_to_user_async

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Allow root agents to send async user messages without model catalog support.

— codex-rs/features/src/lib.rs:1617

Source: codex-rs/features/src/lib.rs:1617 · In binary: yes (distinctive match)

features.shell_snapshot

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Snapshot shell environment to speed up repeated commands (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1007 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.shell_snapshot_v2

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Keep policy-filtered shell snapshots entirely in executor memory.

— codex-rs/features/src/lib.rs:1019

Source: codex-rs/features/src/lib.rs:1019 · In binary: yes (distinctive match)

features.shell_tool

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Enable the default shell tool for running commands (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:959 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.shell_zsh_fork

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Route shell tool execution through the zsh exec bridge.

— codex-rs/features/src/lib.rs:995

Source: codex-rs/features/src/lib.rs:995 · In binary: yes (distinctive match)

features.skill_env_var_dependency_prompt

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for deleted skill env var dependency prompting.

— codex-rs/features/src/lib.rs:1587

Source: codex-rs/features/src/lib.rs:1587 · In binary: yes (distinctive match)

features.skill_mcp_dependency_install

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Allow prompting and installing missing MCP dependencies for skills (stable; on by default).

— docs

Source: codex-rs/features/src/lib.rs:1575 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.skill_search

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Run cheap skill-search methods in shadow mode and emit experiment metrics.

— codex-rs/features/src/lib.rs:1581

Source: codex-rs/features/src/lib.rs:1581 · In binary: yes (distinctive match)

features.skip_host_skill_discovery

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Skip host skill snapshots when no registered contributor requires them.

— codex-rs/features/src/lib.rs:1449

Source: codex-rs/features/src/lib.rs:1449 · In binary: yes (distinctive match)

features.sleep_tool

Type: boolean | table · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow registration of the built-in sleep tool.

— codex-rs/features/src/lib.rs:971

Source: codex-rs/features/src/lib.rs:971 · In binary: yes (distinctive match)

features.sleep_tool.enabled

Type: boolean · Status: undocumented · When: read when features.sleep_tool is enabled

Source: codex-rs/features/src/feature_configs.rs:441, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.sleep_tool.mode

Type: "model_driven" | "always_on" · Status: undocumented · When: read when features.sleep_tool is enabled

How the sleep tool is selected when its feature gate is enabled.

— codex-rs/features/src/feature_configs.rs:443

Values:

• model_driven: Preserve the existing model and legacy clock configuration defaults.
• always_on: Register sleep regardless of the model or legacy clock configuration.

Source: codex-rs/features/src/feature_configs.rs:443, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.sqlite

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Persist rollout metadata to a local SQLite database.

— codex-rs/features/src/lib.rs:1139

Source: codex-rs/features/src/lib.rs:1139 · In binary: yes (generic match)

features.standalone_web_search

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Expose the extension-backed standalone web search tool.

— codex-rs/features/src/lib.rs:1115

Source: codex-rs/features/src/lib.rs:1115 · In binary: yes (distinctive match)

features.steer

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Steer feature flag - when enabled, Enter submits immediately instead of queuing. Kept for config backward compatibility; behavior is always steer-enabled.

— codex-rs/features/src/lib.rs:1599

Source: codex-rs/features/src/lib.rs:1599 · In binary: yes (generic match)

features.step_model_switching

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable explicitly requested model changes for later step captures.

— codex-rs/features/src/lib.rs:1755

Source: codex-rs/features/src/lib.rs:1755 · In binary: yes (distinctive match)

features.system_proxy_fallback

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Retry eligible bootstrap requests through the system proxy after normal routing fails.

— codex-rs/features/src/lib.rs:1311

Source: codex-rs/features/src/lib.rs:1311 · In binary: yes (distinctive match)

features.telepathy

Type: boolean · Status: alias

Legacy alias for features.chronicle.

— codex-rs/features/src/legacy.rs:45

Canonical key: features.chronicle

Source: codex-rs/features/src/legacy.rs:45, codex-rs/config/src/config_toml.rs:166 · In binary: yes (generic match)

features.terminal_resize_reflow

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Removed compatibility flag. Transcript scrollback reflow on terminal resize is always on.

— codex-rs/features/src/lib.rs:1097

Source: codex-rs/features/src/lib.rs:1097 · In binary: yes (distinctive match)

features.terminal_visualization_instructions

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Add terminal-specific visualization guidance to TUI developer instructions.

— codex-rs/features/src/lib.rs:1623

Source: codex-rs/features/src/lib.rs:1623 · In binary: yes (distinctive match)

features.token_budget

Type: boolean | table · Stage: under development · Default: false · On here: no · Status: undocumented

Add current context-window metadata to model-visible context.

— codex-rs/features/src/lib.rs:1677

Source: codex-rs/features/src/lib.rs:1677 · In binary: yes (distinctive match)

features.token_budget.auto_compact_fallback_buffer_tokens

Type: integer (int64) · Status: undocumented · When: read when features.token_budget is enabled

Additional tokens available after the compaction threshold for fallback note-taking.

— codex-rs/features/src/feature_configs.rs:351

Source: codex-rs/features/src/feature_configs.rs:351, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.token_budget.auto_compact_fallback_prompt

Type: string · Status: undocumented · When: read when features.token_budget is enabled

Developer message sampled before an automatic context-window rollover.

— codex-rs/features/src/feature_configs.rs:347

Source: codex-rs/features/src/feature_configs.rs:347, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.token_budget.enabled

Type: boolean · Status: undocumented · When: read when features.token_budget is enabled

Source: codex-rs/features/src/feature_configs.rs:327, codex-rs/core/config.schema.json · In binary: yes (generic match)

features.token_budget.guidance_message

Type: string · Status: undocumented · When: read when features.token_budget is enabled

Guidance appended to the context-window metadata in a developer message.

— codex-rs/features/src/feature_configs.rs:343

Source: codex-rs/features/src/feature_configs.rs:343, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.token_budget.reminder_message_template

Type: string · Status: undocumented · When: read when features.token_budget is enabled

Reminder template. {n_remaining} is replaced with the tokens remaining before auto-compaction.

— codex-rs/features/src/feature_configs.rs:339

Source: codex-rs/features/src/feature_configs.rs:339, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.token_budget.reminder_threshold_tokens

Type: integer (int64) · Status: undocumented · When: read when features.token_budget is enabled

Number of tokens remaining before auto-compaction when the wrap-up reminder is emitted.

— codex-rs/features/src/feature_configs.rs:334

Source: codex-rs/features/src/feature_configs.rs:334, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.token_budget.use_history_notes_extension

Type: boolean · Status: undocumented · When: read when features.token_budget is enabled

Whether to expose the built-in history and notes extension.

— codex-rs/features/src/feature_configs.rs:330

Source: codex-rs/features/src/feature_configs.rs:330, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.tool_call_mcp_elicitation

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Route MCP tool approval prompts through the MCP elicitation request path.

— codex-rs/features/src/lib.rs:1719

Source: codex-rs/features/src/lib.rs:1719 · In binary: yes (distinctive match)

features.tool_registry

Type: table · Status: undocumented

Source: codex-rs/config/src/config_toml.rs:166, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.tool_registry.error_on_tool_collisions

Type: boolean · Status: undocumented · When: read when features.tool_registry is enabled

Fail the turn when multiple tools share the same effective name.

— codex-rs/features/src/feature_configs.rs:15

Source: codex-rs/features/src/feature_configs.rs:15, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.tool_registry.turn_metadata_includes_tool_info

Type: boolean · Status: undocumented · When: read when features.tool_registry is enabled

Include authoritative tool information in per-turn request metadata.

— codex-rs/features/src/feature_configs.rs:18

Source: codex-rs/features/src/feature_configs.rs:18, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

features.tool_search

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag retained as a no-op now that tool_search is always enabled.

— codex-rs/features/src/lib.rs:1395

Source: codex-rs/features/src/lib.rs:1395 · In binary: yes (distinctive match)

features.tool_search_always_defer_mcp_tools

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Removed compatibility flag. MCP tools are always deferred when tool_search is available.

— codex-rs/features/src/lib.rs:1401

Source: codex-rs/features/src/lib.rs:1401 · In binary: yes (distinctive match)

features.tool_suggest

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable discoverable tool suggestions for apps.

— codex-rs/features/src/lib.rs:1425

Source: codex-rs/features/src/lib.rs:1425 · In binary: yes (distinctive match)

features.transcript_v2

Type: boolean · Stage: deprecated · Default: false · On here: no · Status: undocumented

Deprecated no-op; use tui.fullscreen_transcript instead.

— codex-rs/features/src/lib.rs:946

Source: codex-rs/features/src/lib.rs:946 · In binary: yes (distinctive match)

features.tui_app_server

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Removed compatibility flag. The TUI now always uses the app-server implementation.

— codex-rs/features/src/lib.rs:1779

Source: codex-rs/features/src/lib.rs:1779 · In binary: yes (distinctive match)

features.unavailable_dummy_tools

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag for the deleted unavailable-tool placeholder backfill.

— codex-rs/features/src/lib.rs:1419

Source: codex-rs/features/src/lib.rs:1419 · In binary: yes (distinctive match)

features.unbounded_connection_retries

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Keep active sampling turns alive until a failed network connection recovers.

— codex-rs/features/src/lib.rs:1283

Source: codex-rs/features/src/lib.rs:1283 · In binary: yes (distinctive match)

features.undo

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag retained as a no-op so old configs can still parse undo.

— codex-rs/features/src/lib.rs:953

Source: codex-rs/features/src/lib.rs:953 · In binary: yes (generic match)

features.unified_exec

Type: boolean · Stage: stable · Default: true · On here: yes · Status: documented

Use the unified PTY-backed exec tool (stable; enabled by default except on Windows).

— docs

Legacy aliases: features.experimental_use_unified_exec_tool

Source: codex-rs/features/src/lib.rs:983 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.unified_exec_tty

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Allow unified exec commands to allocate an interactive terminal.

— codex-rs/features/src/lib.rs:989

Source: codex-rs/features/src/lib.rs:989 · In binary: yes (distinctive match)

features.unified_exec_zsh_fork

Type: boolean · Stage: removed · Default: true · On here: yes · Status: removed (accepted, no effect)

Allow unified exec to compose with the zsh exec bridge. This flag is only a composition gate. Enabling it by itself must not turn on either unified_exec or shell_zsh_fork because those features have separate rollout and enterprise controls.

— codex-rs/features/src/lib.rs:1001

Source: codex-rs/features/src/lib.rs:1001 · In binary: yes (distinctive match)

features.unified_image_budget

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Apply one shared pixel and token budget to every image, regardless of legacy detail hints.

— codex-rs/features/src/lib.rs:1551

Source: codex-rs/features/src/lib.rs:1551 · In binary: yes (distinctive match)

features.use_agent_identity

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Use Agent Identity for ChatGPT-authenticated sessions.

— codex-rs/features/src/lib.rs:1839

Source: codex-rs/features/src/lib.rs:1839 · In binary: yes (distinctive match)

features.use_legacy_landlock

Type: boolean · Stage: deprecated · Default: false · On here: no · Status: undocumented

Use the legacy Landlock Linux sandbox fallback instead of the default bubblewrap pipeline.

— codex-rs/features/src/lib.rs:1229

Source: codex-rs/features/src/lib.rs:1229 · In binary: yes (distinctive match)

features.use_linux_sandbox_bwrap

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed legacy Linux bubblewrap opt-in flag retained as a no-op so old wrappers and config can still parse it.

— codex-rs/features/src/lib.rs:1223

Source: codex-rs/features/src/lib.rs:1223 · In binary: yes (distinctive match)

features.use_xaa

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Enable enterprise refresh-token authorization for configured MCP resources.

— codex-rs/features/src/lib.rs:1383

Source: codex-rs/features/src/lib.rs:1383 · In binary: yes (generic match)

features.view_image

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable the built-in local image viewer.

— codex-rs/features/src/lib.rs:965

Source: codex-rs/features/src/lib.rs:965 · In binary: yes (distinctive match)

features.web_search

Type: boolean · Status: alias

Deprecated legacy toggle; prefer the top-level web_search setting.

— docs

Canonical key: features.web_search_request

Source: codex-rs/features/src/legacy.rs:29, codex-rs/config/src/config_toml.rs:470 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.web_search_cached

Type: boolean · Stage: deprecated · Default: false · On here: no · Status: documented

Deprecated legacy toggle. When web_search is unset, true maps to web_search = "cached".

— docs

Source: codex-rs/features/src/lib.rs:1109 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.web_search_request

Type: boolean · Stage: deprecated · Default: false · On here: no · Status: documented

Deprecated legacy toggle. When web_search is unset, true maps to web_search = "live".

— docs

Legacy aliases: features.web_search

Source: codex-rs/features/src/lib.rs:1103 · Docs: config-file/config-reference · In binary: yes (distinctive match)

features.windows_sandbox_service

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Attempt elevated Windows sandbox provisioning through the installed service.

— codex-rs/features/src/lib.rs:1253

Source: codex-rs/features/src/lib.rs:1253 · In binary: yes (distinctive match)

features.workspace_dependencies

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable workspace dependency support.

— codex-rs/features/src/lib.rs:1845

Source: codex-rs/features/src/lib.rs:1845 · In binary: yes (distinctive match)

features.workspace_owner_usage_nudge

Type: boolean · Stage: removed · Default: false · On here: no · Status: removed (accepted, no effect)

Removed compatibility flag retained as a no-op now that workspace owner usage nudges are always enabled.

— codex-rs/features/src/lib.rs:1803

Source: codex-rs/features/src/lib.rs:1803 · In binary: yes (distinctive match)

features.worktrees

Type: boolean · Stage: stable · Default: true · On here: yes · Status: undocumented

Enable managed worktree creation and repository-aware sessions.

— codex-rs/features/src/lib.rs:1299

Source: codex-rs/features/src/lib.rs:1299 · In binary: yes (generic match)

features.write_stdin_approval

Type: boolean · Stage: under development · Default: false · On here: no · Status: undocumented

Require approval before writing input to escalated unified-exec terminals.

— codex-rs/features/src/lib.rs:1205

Source: codex-rs/features/src/lib.rs:1205 · In binary: yes (distinctive match)

background_terminal_max_timeout

Type: integer (uint64) · Default: 300000 · Status: documented

Maximum poll window in milliseconds for empty write_stdin polls (background terminal polling). Default: 300000 (5 minutes). Replaces the older background_terminal_timeout key.

— docs

Source: codex-rs/config/src/config_toml.rs:342, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

browser_use

Type: table · Status: documented

Source: codex-rs/config/src/config_toml.rs:204, codex-rs/core/config.schema.json · Docs: enterprise/managed-configuration · In binary: yes (distinctive match)

browser_use.allow_history_access

Type: boolean · Status: documented

Set to false to restrict browser-history access. Managed requirements can enforce this restriction.

— docs

Source: codex-rs/config/src/browser_use.rs:10, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

browser_use.default_origin_policy

Type: table · Status: documented

Fallback browser-origin restrictions. Supports access, uploads, downloads, and full_cdp_access, each set to allow or deny.

— docs

Source: codex-rs/config/src/browser_use.rs:11, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

browser_use.default_origin_policy.access

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:18, codex-rs/core/config.schema.json · In binary: yes (generic match)

browser_use.default_origin_policy.downloads

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:19, codex-rs/core/config.schema.json · In binary: yes (generic match)

browser_use.default_origin_policy.full_cdp_access

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:21, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

browser_use.default_origin_policy.uploads

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:20, codex-rs/core/config.schema.json · In binary: yes (generic match)

browser_use.origins

Type: map<string, table> · Status: documented

Source: codex-rs/config/src/browser_use.rs:12, codex-rs/core/config.schema.json · Docs: enterprise/managed-configuration · In binary: yes (generic match)

browser_use.origins.<pattern>

Type: table · Status: documented

Per-origin browser restrictions with the same fields as browser_use.default_origin_policy. Include an HTTP or HTTPS scheme and optional port; omit paths, queries, and fragments. Local values cannot relax managed denies.

— docs

Source: codex-rs/config/src/browser_use.rs:9, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

browser_use.origins.<pattern>.access

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:18, codex-rs/core/config.schema.json · In binary: yes (generic match)

browser_use.origins.<pattern>.downloads

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:19, codex-rs/core/config.schema.json · In binary: yes (generic match)

browser_use.origins.<pattern>.full_cdp_access

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:21, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

browser_use.origins.<pattern>.uploads

Type: "allow" | "deny" · Status: undocumented

Values: allow, deny

Source: codex-rs/config/src/browser_use.rs:20, codex-rs/core/config.schema.json · In binary: yes (generic match)

computer_use

Type: table · Status: documented

Source: codex-rs/config/src/config_toml.rs:206, codex-rs/core/config.schema.json · Docs: enterprise/managed-configuration · In binary: yes (distinctive match)

computer_use.default_app_access

Type: "allow" | "deny" · Status: documented

Fallback native-app access policy for Computer Use. App-specific entries can supply a policy; local configuration cannot relax managed restrictions.

— docs

Values: allow, deny

Source: codex-rs/config/src/computer_use.rs:10, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

computer_use.macos

Type: table · Status: documented · When: macOS only

Source: codex-rs/config/src/computer_use.rs:11, codex-rs/core/config.schema.json · Docs: enterprise/managed-configuration · In binary: yes (generic match)

computer_use.macos.bundle_ids

Type: map<string, "allow" | "deny"> · Status: documented · When: macOS only

Native macOS app access keyed by bundle identifier.

— docs

Source: codex-rs/config/src/computer_use.rs:18, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

computer_use.macos.bundle_ids.<bundle-id>

Type: "allow" | "deny" · Status: undocumented · When: macOS only

Values: allow, deny

Source: codex-rs/config/src/computer_use.rs:17, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

computer_use.windows

Type: table · Status: documented · When: Windows only

Source: codex-rs/config/src/computer_use.rs:12, codex-rs/core/config.schema.json · Docs: enterprise/managed-configuration · In binary: yes (generic match)

computer_use.windows.aumids

Type: map<string, "allow" | "deny"> · Status: documented · When: Windows only

Packaged Windows app access keyed by Application User Model ID (AUMID).

— docs

Source: codex-rs/config/src/computer_use.rs:24, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

computer_use.windows.aumids.<aumid>

Type: "allow" | "deny" · Status: undocumented · When: Windows only

Values: allow, deny

Source: codex-rs/config/src/computer_use.rs:23, codex-rs/core/config.schema.json · In binary: yes (generic match)

computer_use.windows.exes

Type: array<table> · Status: documented · When: Windows only

Windows executable access rules. Each rule requires publisher_name, product_name, and access (allow or deny); binary_name is optional.

— docs

Source: codex-rs/config/src/computer_use.rs:25, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

computer_use.windows.exes[].access

Type: "allow" | "deny" · Status: undocumented · When: Windows only

Values: allow, deny

Source: codex-rs/config/src/computer_use.rs:34, codex-rs/core/config.schema.json · In binary: yes (generic match)

computer_use.windows.exes[].binary_name

Type: string · Status: undocumented · When: Windows only

Source: codex-rs/config/src/computer_use.rs:33, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

computer_use.windows.exes[].product_name

Type: string · Status: undocumented · When: Windows only

Source: codex-rs/config/src/computer_use.rs:32, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

computer_use.windows.exes[].publisher_name

Type: string · Status: undocumented · When: Windows only

Source: codex-rs/config/src/computer_use.rs:31, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

experimental_use_unified_exec_tool

Type: boolean · Status: documented

Legacy name for enabling unified exec; prefer [features].unified_exec or codex --enable unified_exec.

— docs

Source: codex-rs/config/src/config_toml.rs:556, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

tool_output_token_limit

Type: integer (uint) · Status: documented

Token budget for storing individual tool/function outputs in history.

— docs

Source: codex-rs/config/src/config_toml.rs:338, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

tool_suggest

Type: table · Status: documented

Additional discoverable tools that can be suggested for installation.

— codex-rs/config/src/config_toml.rs:476

Source: codex-rs/config/src/config_toml.rs:476, codex-rs/core/config.schema.json · Docs: config-file/config-sample · In binary: yes (distinctive match)

tool_suggest.disabled_tools

Type: array<table> · Default: [] · Status: documented

Disable suggestions for specific discoverable connectors or plugins. Each entry uses type = "connector" or "plugin" and an id.

— docs

Source: codex-rs/config/src/types.rs:289, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

tool_suggest.disabled_tools[].id

Type: string · Status: undocumented

Source: codex-rs/config/src/types.rs:256, codex-rs/core/config.schema.json · In binary: yes (generic match)

tool_suggest.disabled_tools[].type

Type: "connector" | "plugin" · Status: undocumented

Values: connector, plugin

Source: codex-rs/config/src/types.rs:255, codex-rs/core/config.schema.json · In binary: yes (generic match)

tool_suggest.discoverables

Type: array<table> · Default: [] · Status: documented

Allow tool suggestions for additional discoverable connectors or plugins. Each entry uses type = "connector" or "plugin" and an id.

— docs

Source: codex-rs/config/src/types.rs:287, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (generic match)

tool_suggest.discoverables[].id

Type: string · Status: undocumented

Source: codex-rs/config/src/types.rs:248, codex-rs/core/config.schema.json · In binary: yes (generic match)

tool_suggest.discoverables[].type

Type: "connector" | "plugin" · Status: undocumented

Values: connector, plugin

Source: codex-rs/config/src/types.rs:247, codex-rs/core/config.schema.json · In binary: yes (generic match)

tools

Type: table · Status: documented

Nested tools section for feature toggles

— codex-rs/config/src/config_toml.rs:473

Source: codex-rs/config/src/config_toml.rs:473, codex-rs/core/config.schema.json · Docs: config-file/config-sample · In binary: yes (generic match)

tools.experimental_request_user_input

Type: table · Status: undocumented

Source: codex-rs/config/src/config_toml.rs:658, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

tools.experimental_request_user_input.enabled

Type: boolean · Default: true · Status: undocumented

Source: codex-rs/config/src/config_toml.rs:666, codex-rs/core/config.schema.json · In binary: yes (generic match)

tools.update_plan

Type: table · Status: undocumented

Source: codex-rs/config/src/config_toml.rs:659, codex-rs/core/config.schema.json · In binary: yes (distinctive match)

tools.update_plan.enabled

Type: boolean · Default: false · Status: undocumented

Source: codex-rs/config/src/config_toml.rs:673, codex-rs/core/config.schema.json · In binary: yes (generic match)

tools.web_search

Type: table · Status: documented

Optional web search tool configuration. The object form can set search context size, allowed search domains, and approximate user location. These search-domain filters are separate from sandboxed-command network domain rules and do not restrict connectors or MCP servers.

— docs

Source: codex-rs/config/src/config_toml.rs:657, codex-rs/core/config.schema.json · Docs: config-file/config-reference · In binary: yes (distinctive match)

tools.web_search.allowed_domains

Type: array<string> · Status: documented

Source: codex-rs/protocol/src/config_types.rs:442, codex-rs/core/config.schema.json · Docs: permissions, web-search · In binary: yes (distinctive match)

tools.web_search.context_size

Type: "low" | "medium" | "high" · Status: undocumented

Values: low, medium, high