From 43a7290f110fc7b410e425a452c06317f6d1a56b Mon Sep 17 00:00:00 2001
From: xl-openai <xl@openai.com>
Date: Thu, 5 Feb 2026 14:43:31 -0800
Subject: [PATCH] Sync app-server requirements API with refreshed cloud loader
 (#10815)

configRequirements/read now returns updated cloud requirements after
login.
---
 .../app-server/src/codex_message_processor.rs |  4 +-
 codex-rs/app-server/src/config_api.rs         | 47 ++++++++++++++-----
 codex-rs/app-server/src/message_processor.rs  |  2 +
 3 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/codex-rs/app-server/src/codex_message_processor.rs b/codex-rs/app-server/src/codex_message_processor.rs
index afcee13af..9ffd38fa8 100644
--- a/codex-rs/app-server/src/codex_message_processor.rs
+++ b/codex-rs/app-server/src/codex_message_processor.rs
@@ -314,7 +314,7 @@ pub(crate) struct CodexMessageProcessorArgs {
     pub(crate) codex_linux_sandbox_exe: Option<PathBuf>,
     pub(crate) config: Arc<Config>,
     pub(crate) cli_overrides: Vec<(String, TomlValue)>,
-    pub(crate) cloud_requirements: CloudRequirementsLoader,
+    pub(crate) cloud_requirements: Arc<RwLock<CloudRequirementsLoader>>,
     pub(crate) feedback: CodexFeedback,
 }
 
@@ -360,7 +360,7 @@ impl CodexMessageProcessor {
             codex_linux_sandbox_exe,
             config,
             cli_overrides,
-            cloud_requirements: Arc::new(RwLock::new(cloud_requirements)),
+            cloud_requirements,
             conversation_listeners: HashMap::new(),
             listener_thread_ids_by_subscription: HashMap::new(),
             active_login: Arc::new(Mutex::new(None)),
diff --git a/codex-rs/app-server/src/config_api.rs b/codex-rs/app-server/src/config_api.rs
index 5a43d6e52..e1f27be0b 100644
--- a/codex-rs/app-server/src/config_api.rs
+++ b/codex-rs/app-server/src/config_api.rs
@@ -19,11 +19,16 @@ use codex_core::config_loader::ResidencyRequirement as CoreResidencyRequirement;
 use codex_core::config_loader::SandboxModeRequirement as CoreSandboxModeRequirement;
 use serde_json::json;
 use std::path::PathBuf;
+use std::sync::Arc;
+use std::sync::RwLock;
 use toml::Value as TomlValue;
 
 #[derive(Clone)]
 pub(crate) struct ConfigApi {
-    service: ConfigService,
+    codex_home: PathBuf,
+    cli_overrides: Vec<(String, TomlValue)>,
+    loader_overrides: LoaderOverrides,
+    cloud_requirements: Arc<RwLock<CloudRequirementsLoader>>,
 }
 
 impl ConfigApi {
@@ -31,30 +36,42 @@ impl ConfigApi {
         codex_home: PathBuf,
         cli_overrides: Vec<(String, TomlValue)>,
         loader_overrides: LoaderOverrides,
-        cloud_requirements: CloudRequirementsLoader,
+        cloud_requirements: Arc<RwLock<CloudRequirementsLoader>>,
     ) -> Self {
         Self {
-            service: ConfigService::new(
-                codex_home,
-                cli_overrides,
-                loader_overrides,
-                cloud_requirements,
-            ),
+            codex_home,
+            cli_overrides,
+            loader_overrides,
+            cloud_requirements,
         }
     }
 
+    fn config_service(&self) -> ConfigService {
+        let cloud_requirements = self
+            .cloud_requirements
+            .read()
+            .map(|guard| guard.clone())
+            .unwrap_or_default();
+        ConfigService::new(
+            self.codex_home.clone(),
+            self.cli_overrides.clone(),
+            self.loader_overrides.clone(),
+            cloud_requirements,
+        )
+    }
+
     pub(crate) async fn read(
         &self,
         params: ConfigReadParams,
     ) -> Result<ConfigReadResponse, JSONRPCErrorError> {
-        self.service.read(params).await.map_err(map_error)
+        self.config_service().read(params).await.map_err(map_error)
     }
 
     pub(crate) async fn config_requirements_read(
         &self,
     ) -> Result<ConfigRequirementsReadResponse, JSONRPCErrorError> {
         let requirements = self
-            .service
+            .config_service()
             .read_requirements()
             .await
             .map_err(map_error)?
@@ -67,14 +84,20 @@ impl ConfigApi {
         &self,
         params: ConfigValueWriteParams,
     ) -> Result<ConfigWriteResponse, JSONRPCErrorError> {
-        self.service.write_value(params).await.map_err(map_error)
+        self.config_service()
+            .write_value(params)
+            .await
+            .map_err(map_error)
     }
 
     pub(crate) async fn batch_write(
         &self,
         params: ConfigBatchWriteParams,
     ) -> Result<ConfigWriteResponse, JSONRPCErrorError> {
-        self.service.batch_write(params).await.map_err(map_error)
+        self.config_service()
+            .batch_write(params)
+            .await
+            .map_err(map_error)
     }
 }
 
diff --git a/codex-rs/app-server/src/message_processor.rs b/codex-rs/app-server/src/message_processor.rs
index 7d8da6c1b..2646e5f0a 100644
--- a/codex-rs/app-server/src/message_processor.rs
+++ b/codex-rs/app-server/src/message_processor.rs
@@ -1,5 +1,6 @@
 use std::path::PathBuf;
 use std::sync::Arc;
+use std::sync::RwLock;
 
 use crate::codex_message_processor::CodexMessageProcessor;
 use crate::codex_message_processor::CodexMessageProcessorArgs;
@@ -157,6 +158,7 @@ impl MessageProcessor {
             auth_manager.clone(),
             SessionSource::VSCode,
         ));
+        let cloud_requirements = Arc::new(RwLock::new(cloud_requirements));
         let codex_message_processor = CodexMessageProcessor::new(CodexMessageProcessorArgs {
             auth_manager,
             thread_manager,