add(core): safety check downgrade warning (#11964)

Add per-turn notice when a request is downgraded to a fallback model due
to cyber safety checks.

**Changes**

- codex-api: Emit a ServerModel event based on the openai-model response
header and/or response payload (SSE + WebSocket), including when the
model changes mid-stream.
- core: When the server-reported model differs from the requested model,
emit a single per-turn warning explaining the reroute to gpt-5.2 and
directing users to Trusted
    Access verification and the cyber safety explainer.
- app-server (v2): Surface these cyber model-routing warnings as
synthetic userMessage items with text prefixed by Warning: (and document
this behavior).

codex-rs/app-server/README.md

@@ -557,7 +557,7 @@ Today both notifications carry an empty `items` array even when item events were
 
 `ThreadItem` is the tagged union carried in turn responses and `item/*` notifications. Currently we support events for the following items:
 
-- `userMessage` — `{id, content}` where `content` is a list of user inputs (`text`, `image`, or `localImage`).
+- `userMessage` — `{id, content}` where `content` is a list of user inputs (`text`, `image`, or `localImage`). Cyber model-routing warnings are surfaced as synthetic `userMessage` items with `text` prefixed by `Warning:`.
 - `agentMessage` — `{id, text}` containing the accumulated agent reply.
 - `plan` — `{id, text}` emitted for plan-mode turns; plan text can stream via `item/plan/delta` (experimental).
 - `reasoning` — `{id, summary, content}` where `summary` holds streamed reasoning summaries (applicable for most OpenAI models) and `content` holds raw reasoning blocks (applicable for e.g. open source models).

codex-rs/app-server/src/bespoke_event_handling.rs

@@ -68,6 +68,7 @@ use codex_app_server_protocol::TurnInterruptResponse;
 use codex_app_server_protocol::TurnPlanStep;
 use codex_app_server_protocol::TurnPlanUpdatedNotification;
 use codex_app_server_protocol::TurnStatus;
+use codex_app_server_protocol::UserInput as V2UserInput;
 use codex_app_server_protocol::build_turns_from_rollout_items;
 use codex_core::CodexThread;
 use codex_core::parse_command::shlex_join;
@@ -95,6 +96,8 @@ use codex_protocol::request_user_input::RequestUserInputAnswer as CoreRequestUse
 use codex_protocol::request_user_input::RequestUserInputResponse as CoreRequestUserInputResponse;
 use std::collections::HashMap;
 use std::convert::TryFrom;
+use std::hash::Hash;
+use std::hash::Hasher;
 use std::path::PathBuf;
 use std::sync::Arc;
 use tokio::sync::Mutex;
@@ -122,6 +125,35 @@ pub(crate) async fn apply_bespoke_event_handling(
         EventMsg::TurnComplete(_ev) => {
             handle_turn_complete(conversation_id, event_turn_id, &outgoing, &thread_state).await;
         }
+        EventMsg::Warning(warning_event) => {
+            if matches!(api_version, ApiVersion::V2)
+                && is_safety_check_downgrade_warning(&warning_event.message)
+            {
+                let item = ThreadItem::UserMessage {
+                    id: warning_item_id(&event_turn_id, &warning_event.message),
+                    content: vec![V2UserInput::Text {
+                        text: format!("Warning: {}", warning_event.message),
+                        text_elements: Vec::new(),
+                    }],
+                };
+                let started = ItemStartedNotification {
+                    thread_id: conversation_id.to_string(),
+                    turn_id: event_turn_id.clone(),
+                    item: item.clone(),
+                };
+                outgoing
+                    .send_server_notification(ServerNotification::ItemStarted(started))
+                    .await;
+                let completed = ItemCompletedNotification {
+                    thread_id: conversation_id.to_string(),
+                    turn_id: event_turn_id.clone(),
+                    item,
+                };
+                outgoing
+                    .send_server_notification(ServerNotification::ItemCompleted(completed))
+                    .await;
+            }
+        }
         EventMsg::ApplyPatchApprovalRequest(ApplyPatchApprovalRequestEvent {
             call_id,
             turn_id,
@@ -1286,6 +1318,18 @@ async fn complete_command_execution_item(
         .await;
 }
 
+fn is_safety_check_downgrade_warning(message: &str) -> bool {
+    message.contains("Your account was flagged for potentially high-risk cyber activity")
+        && message.contains("apply for trusted access: https://chatgpt.com/cyber")
+}
+
+fn warning_item_id(turn_id: &str, message: &str) -> String {
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    message.hash(&mut hasher);
+    let digest = hasher.finish();
+    format!("{turn_id}-warning-{digest:x}")
+}
+
 async fn maybe_emit_raw_response_item_completed(
     api_version: ApiVersion,
     conversation_id: ThreadId,
@@ -2016,6 +2060,18 @@ mod tests {
         assert_eq!(item, expected);
     }
 
+    #[test]
+    fn safety_check_downgrade_warning_detection_matches_expected_message() {
+        let warning = "Your account was flagged for potentially high-risk cyber activity and this request was routed to gpt-5.2 as a fallback. To regain access to gpt-5.3-codex, apply for trusted access: https://chatgpt.com/cyber\nLearn more: https://developers.openai.com/codex/concepts/cyber-safety";
+        assert!(is_safety_check_downgrade_warning(warning));
+    }
+
+    #[test]
+    fn safety_check_downgrade_warning_detection_ignores_other_warnings() {
+        let warning = "Model metadata for `mock-model` not found. Defaulting to fallback metadata; this can degrade performance and cause issues.";
+        assert!(!is_safety_check_downgrade_warning(warning));
+    }
+
     #[tokio::test]
     async fn test_handle_error_records_message() -> Result<()> {
         let conversation_id = ThreadId::new();

codex-rs/app-server/tests/suite/v2/mod.rs

@@ -15,6 +15,7 @@ mod plan_item;
 mod rate_limits;
 mod request_user_input;
 mod review;
+mod safety_check_downgrade;
 mod skills_list;
 mod thread_archive;
 mod thread_fork;

codex-rs/app-server/tests/suite/v2/safety_check_downgrade.rs

@@ -0,0 +1,266 @@
+use anyhow::Result;
+use app_test_support::McpProcess;
+use app_test_support::to_response;
+use codex_app_server_protocol::ItemCompletedNotification;
+use codex_app_server_protocol::ItemStartedNotification;
+use codex_app_server_protocol::JSONRPCNotification;
+use codex_app_server_protocol::JSONRPCResponse;
+use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::ThreadItem;
+use codex_app_server_protocol::ThreadStartParams;
+use codex_app_server_protocol::ThreadStartResponse;
+use codex_app_server_protocol::TurnStartParams;
+use codex_app_server_protocol::TurnStartResponse;
+use codex_app_server_protocol::UserInput;
+use core_test_support::responses;
+use core_test_support::skip_if_no_network;
+use pretty_assertions::assert_eq;
+use tempfile::TempDir;
+use tokio::time::timeout;
+
+const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
+const REQUESTED_MODEL: &str = "gpt-5.1-codex-max";
+const SERVER_MODEL: &str = "gpt-5.2-codex";
+
+#[tokio::test]
+async fn openai_model_header_mismatch_emits_warning_item_v2() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = responses::start_mock_server().await;
+    let body = responses::sse(vec![
+        responses::ev_response_created("resp-1"),
+        responses::ev_assistant_message("msg-1", "Done"),
+        responses::ev_completed("resp-1"),
+    ]);
+    let response = responses::sse_response(body).insert_header("OpenAI-Model", SERVER_MODEL);
+    let _response_mock = responses::mount_response_once(&server, response).await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri())?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_req = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some(REQUESTED_MODEL.to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let thread_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(thread_req)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(thread_resp)?;
+
+    let turn_req = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![UserInput::Text {
+                text: "trigger safeguard".to_string(),
+                text_elements: Vec::new(),
+            }],
+            ..Default::default()
+        })
+        .await?;
+    let _turn_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_req)),
+    )
+    .await??;
+    let _turn_start: TurnStartResponse = to_response(_turn_resp)?;
+
+    let warning_started = timeout(DEFAULT_READ_TIMEOUT, async {
+        loop {
+            let notification: JSONRPCNotification = mcp
+                .read_stream_until_notification_message("item/started")
+                .await?;
+            let params = notification.params.expect("item/started params");
+            let started: ItemStartedNotification =
+                serde_json::from_value(params).expect("deserialize item/started");
+            if warning_text_from_item(&started.item).is_some_and(is_cyber_model_warning_text) {
+                return Ok::<ItemStartedNotification, anyhow::Error>(started);
+            }
+        }
+    })
+    .await??;
+
+    let warning_text =
+        warning_text_from_item(&warning_started.item).expect("expected warning user message item");
+    assert!(warning_text.contains("Warning:"));
+    assert!(warning_text.contains("gpt-5.2 as a fallback"));
+    assert!(warning_text.contains("regain access to gpt-5.3-codex"));
+
+    let warning_completed = timeout(DEFAULT_READ_TIMEOUT, async {
+        loop {
+            let notification: JSONRPCNotification = mcp
+                .read_stream_until_notification_message("item/completed")
+                .await?;
+            let params = notification.params.expect("item/completed params");
+            let completed: ItemCompletedNotification =
+                serde_json::from_value(params).expect("deserialize item/completed");
+            if warning_text_from_item(&completed.item).is_some_and(is_cyber_model_warning_text) {
+                return Ok::<ItemCompletedNotification, anyhow::Error>(completed);
+            }
+        }
+    })
+    .await??;
+    assert_eq!(
+        warning_text_from_item(&warning_completed.item),
+        warning_text_from_item(&warning_started.item)
+    );
+
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn response_model_field_mismatch_emits_warning_item_v2_when_header_matches_requested()
+-> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = responses::start_mock_server().await;
+    let body = responses::sse(vec![
+        serde_json::json!({
+            "type": "response.created",
+            "response": {
+                "id": "resp-1",
+                "model": SERVER_MODEL,
+            }
+        }),
+        responses::ev_assistant_message("msg-1", "Done"),
+        responses::ev_completed("resp-1"),
+    ]);
+    let response = responses::sse_response(body).insert_header("OpenAI-Model", REQUESTED_MODEL);
+    let _response_mock = responses::mount_response_once(&server, response).await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri())?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_req = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some(REQUESTED_MODEL.to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let thread_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(thread_req)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(thread_resp)?;
+
+    let turn_req = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![UserInput::Text {
+                text: "trigger response model check".to_string(),
+                text_elements: Vec::new(),
+            }],
+            ..Default::default()
+        })
+        .await?;
+    let turn_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_req)),
+    )
+    .await??;
+    let _turn_start: TurnStartResponse = to_response(turn_resp)?;
+
+    let warning_started = timeout(DEFAULT_READ_TIMEOUT, async {
+        loop {
+            let notification: JSONRPCNotification = mcp
+                .read_stream_until_notification_message("item/started")
+                .await?;
+            let params = notification.params.expect("item/started params");
+            let started: ItemStartedNotification =
+                serde_json::from_value(params).expect("deserialize item/started");
+            if warning_text_from_item(&started.item).is_some_and(is_cyber_model_warning_text) {
+                return Ok::<ItemStartedNotification, anyhow::Error>(started);
+            }
+        }
+    })
+    .await??;
+    let warning_text =
+        warning_text_from_item(&warning_started.item).expect("expected warning user message item");
+    assert!(warning_text.contains("gpt-5.2 as a fallback"));
+
+    let warning_completed = timeout(DEFAULT_READ_TIMEOUT, async {
+        loop {
+            let notification: JSONRPCNotification = mcp
+                .read_stream_until_notification_message("item/completed")
+                .await?;
+            let params = notification.params.expect("item/completed params");
+            let completed: ItemCompletedNotification =
+                serde_json::from_value(params).expect("deserialize item/completed");
+            if warning_text_from_item(&completed.item).is_some_and(is_cyber_model_warning_text) {
+                return Ok::<ItemCompletedNotification, anyhow::Error>(completed);
+            }
+        }
+    })
+    .await??;
+    assert_eq!(
+        warning_text_from_item(&warning_completed.item),
+        warning_text_from_item(&warning_started.item)
+    );
+
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    Ok(())
+}
+
+fn warning_text_from_item(item: &ThreadItem) -> Option<&str> {
+    let ThreadItem::UserMessage { content, .. } = item else {
+        return None;
+    };
+
+    content.iter().find_map(|input| match input {
+        UserInput::Text { text, .. } if text.starts_with("Warning: ") => Some(text.as_str()),
+        _ => None,
+    })
+}
+
+fn is_cyber_model_warning_text(text: &str) -> bool {
+    text.contains("flagged for potentially high-risk cyber activity")
+        && text.contains("apply for trusted access: https://chatgpt.com/cyber")
+}
+
+fn create_config_toml(codex_home: &std::path::Path, server_uri: &str) -> std::io::Result<()> {
+    let config_toml = codex_home.join("config.toml");
+    std::fs::write(
+        config_toml,
+        format!(
+            r#"
+model = "{REQUESTED_MODEL}"
+approval_policy = "never"
+sandbox_mode = "read-only"
+
+model_provider = "mock_provider"
+
+[features]
+remote_models = false
+personality = true
+
+[model_providers.mock_provider]
+name = "Mock provider for test"
+base_url = "{server_uri}/v1"
+wire_api = "responses"
+request_max_retries = 0
+stream_max_retries = 0
+"#
+        ),
+    )
+}