Who contributed to OpenAI on May 12, 2026?

3 developers shipped this update, including mzeng-openai, viyatb-oai, and owenlin0.

What were the notable OpenAI updates?

[7/8] Add Python SDK app-server integration harness (#22014), [elicitation] Advertise new url elicitation capability when auth_elicitation is enabled, and feat(connectors): support managed app tool approval requirements.

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

CODEX HARDENS APP-SERVER INTEGRATION AND TIGHTENS ADMIN CONTROLS

By RepoJournal · Filed 06:03 UTC on May 12, 2026 · About OpenAI

3 people shipped this

viyatb-oai @viyatb-oai 2 cited

mzeng-openai @mzeng-openai 1 cited

owenlin0 @owenlin0 1 cited

Codex shipped deterministic integration tests that prove the SDK, app-server runtime, and public clients work together end-to-end, plus three security and capability wins for managed deployments.

The SDK integration harness [1] closes a critical testing gap — behavioral tests could catch wrapper mistakes, but they never validated that the pinned app-server process, request routing, and sync/async clients actually worked together in production. This PR starts the real app-server and mocks only at the HTTP boundary, giving you the confidence that SDK changes won't break at runtime. On the capability side, auth elicitation now advertises itself properly [2] when enabled behind the feature flag, ensuring backward compatibility and giving servers explicit signal before they send elicitations. Admins got the tool approval win they needed: managed requirements can now enforce per-tool approval rules centrally [3], closing the gap where only normal config could express those constraints. Security-critical: managed filesystem deny-read restrictions now survive escalation paths [4] — explicit escalations, prefix-rule allows, and sandbox-denial retries can no longer rebuild the runtime policy and expose paths an administrator locked down. On the client side, remote iOS and Android clients no longer bloat `thread/resume` responses with MCP tool call payloads and image-generation results [5]; this is a temporary redaction layer while the team builds toward paginated SQLite-backed APIs.

Action items

→ Merge and deploy the integration harness [ref:1] before next SDK release cycle openai/codex [plan]
→ Verify auth_elicitation flag is set correctly in your deployment [ref:2] openai/codex [monitor]
→ Review managed requirements configs — per-tool approval rules are now available [ref:3] openai/codex [plan]
→ Confirm deny-read restrictions are enforced after your next deploy [ref:4] openai/codex [immediate]

References

[1] [7/8] Add Python SDK app-server integration harness (#22014) openai/codex
[2] [elicitation] Advertise new url elicitation capability when auth_elicitation is enabled. ↗ openai/codex
[3] feat(connectors): support managed app tool approval requirements ↗ openai/codex
[4] fix(permissions): preserve managed deny-read during escalation ↗ openai/codex
[5] fix(app-server): thread history redaction for remote clients ↗ openai/codex

Quick answers

What shipped in OpenAI on May 12, 2026?: Codex shipped deterministic integration tests that prove the SDK, app-server runtime, and public clients work together end-to-end, plus three security and capability wins for managed deployments. In total, 50 commits, 50 pull requests, and 3 releases landed.
Who contributed to OpenAI on May 12, 2026?: 3 developers shipped this update, including mzeng-openai, viyatb-oai, and owenlin0.
What were the notable OpenAI updates?: [7/8] Add Python SDK app-server integration harness (#22014), [elicitation] Advertise new url elicitation capability when auth_elicitation is enabled, and feat(connectors): support managed app tool approval requirements.

CODEX HARDENS MCP RUNTIME STABILITY ACROSS FIVE CRITICAL FIXES

OpenAI shipped a coordinated hardening of the Model Context Protocol layer across Codex, patching race conditions in thread startup, resource access, and authority management that could leave stale configurations in production.

ai 66 shipped 1-min read

OpenAI 1 day ago

SDK RELEASES LOCK IN PROMPT CACHING AND SPEND CONTROLS

Both Node and Python clients shipped v6.49.0 and v2.48.0 overnight with admin spend limit APIs and relaxed prompt cache validation.

ai 103 shipped 1-min read

OpenAI 2 days ago

CODEX CONSOLIDATES THREAD STARTUP, NODE SDK ADDS REALTIME AND STANDARD SCHEMA SUPPORT

Codex refactored its threading and database layer for consistency while the Node SDK ships four new schema helpers and fixes audio streaming in a single release push.

ai 120 shipped 1-min read

OpenAI 3 days ago

CODEX FIXES WINDOWS EXECUTION BUGS WHILE TIGHTENING SECURITY REVIEW GATES

Codex shipped critical fixes for Windows process management and terminal navigation that were silently breaking execution sessions on Windows machines.

ai 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.