RepoJournal
OpenAI OpenAI
123 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-12
stories 112
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

CODEX DECOUPLES SKILLS FROM EXECUTOR, NODE AND PYTHON TIGHTEN CI SECURITY

By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology

jbeckwith-oai anp-oai wiltzius-openai
3 people shipped this
jbeckwith-oai @jbeckwith-oai 3 cited anp-oai @anp-oai 2 cited wiltzius-openai @wiltzius-openai 1 cited

Codex shipped a breaking refactor that makes hosted plugin skills invocable without an executor, while both Node and Python SDKs locked down their CI workflows to use scoped API key environments.

The codex team landed three interconnected changes that fundamentally reshape how skills integrate with the runtime. First, backend plugin skills are now invocable without an executor [1], which means app-server can properly surface hosted skills in the model's catalog and load their metadata through the `$skill` interface. Second, the skills catalog now renders locators by authority [2], telling the model whether a skill lives on disk or must be fetched through a remote source. Third, ThreadStore now owns persistence policy application [3], enabling store-specific projections over raw input. In parallel, ExecutorFileSystem is being migrated to PathUri [4] as the canonical internal path representation, with EnvironmentPathRef removed entirely [5]. On the SDK side, both openai-node and openai-python tightened their CI workflows to use scoped GitHub environments for API key access [6] [8], and the Node team bumped CI coverage to Node 20, 22, 24, and 26 [7], moving the default test line to Node 24 LTS. These aren't cosmetic updates: the codex changes fix a real gap where hosted skills were described as local files, and the SDK CI changes prevent API keys from being accessible to untrusted workflow contexts.

Action items

References

  1. [1] skills: make backend plugin skills invocable without an executor (#27387) openai/codex ↗
  2. [2] skills: render catalog locators by authority (#27591) openai/codex ↗
  3. [3] [codex] Move persistence policy application into ThreadStore ↗ openai/codex
  4. [4] [codex] migrate ExecutorFileSystem paths to PathUri ↗ openai/codex
  5. [5] [codex] remove EnvironmentPathRef ↗ openai/codex
  6. [6] test: Use CI environment for OpenAI API key workflows ↗ openai/openai-node
  7. [7] test: Update CI Node version coverage ↗ openai/openai-node
  8. [8] test: Use CI environment for examples API key ↗ openai/openai-python

$ ls openai/reviews/ # the step-back reads

the week in review openai-python 3.14.0 and WebSocket sessions land the month in review August: Codex hardens, SDKs consolidate security, GPT-5.5 lands
Topics: AI / ML Full archive → Weekly reviews →

Quick answers

What shipped in OpenAI on June 12, 2026?
Codex shipped a breaking refactor that makes hosted plugin skills invocable without an executor, while both Node and Python SDKs locked down their CI workflows to use scoped API key environments. In total, 53 commits, 53 pull requests, and 6 releases landed.
Who contributed to OpenAI on June 12, 2026?
3 developers shipped this update, including wiltzius-openai, anp-oai, and jbeckwith-oai.
What were the notable OpenAI updates?
skills: make backend plugin skills invocable without an executor (#27387), skills: render catalog locators by authority (#27591), and [codex] Move persistence policy application into ThreadStore.
♥

$ log OpenAI --recent

Codex consolidates PTY spawning, openai-node restores options-only GET calls 87 shipped Codex grows a backend-independent agent control contract as the SDKs land vault credentials and deprecate MCP connector_id 140 shipped openai-node and openai-python ship managed Responses WebSocket sessions 124 shipped Codex enforces managed residency, openai-node fixes streaming and abort paths 142 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.