3 Commits

• Discover stdio MCP servers from selected executor plugins (#27870)

  ## Why
  
  **In short:** this PR discovers MCP registrations by reading a selected
  plugin's `.mcp.json` on its executor. #27884 then resolves those
  registrations in the shared catalog.
  
  `thread/start.selectedCapabilityRoots` can select a plugin root owned by
  an executor, and Codex can resolve that package through the executor
  filesystem. MCP declarations inside the selected plugin are still
  ignored.
  
  This PR adds the source-specific discovery layer on top of the
  selected-plugin catalog boundary in #27884:
  
  ```text
  selected capability root
          |
          v
  resolve the plugin through its executor filesystem
          |
          v
  read and normalize its MCP config through the same filesystem
          |
          v
  contribute stdio registrations bound to that environment ID
  ```
  
  The existing MCP launcher and connection manager remain unchanged. MCP
  config parsing is shared with local plugins through #27863.
  
  ## What changed
  
  - Added an executor plugin MCP provider in the MCP extension.
  - Retained only the exact filesystem capability used for package
  resolution and reused it for the selected plugin's MCP config, with no
  host-filesystem fallback or unrelated process/HTTP authority.
  - Read either the manifest-declared MCP config or the default
  `.mcp.json`; a missing default file means the plugin has no MCP servers.
  - Accepted stdio servers only for this first vertical. Executor-owned
  HTTP declarations are skipped with a warning until their placement
  semantics are defined.
  - Normalized stdio registrations with the owning environment's stable
  logical ID and plugin-root working directory.
  - Resolved environment-variable names on the owning executor and
  rejected explicit local forwarding for non-local plugins.
  - Froze discovered declarations once per active thread runtime, then
  applied current managed plugin and MCP requirements when contributing
  them.
  - Carried the selected root ID, display name, and selection order into
  the catalog contribution defined by #27884.
  
  ## Behavior and scope
  
  There is intentionally no production behavior change yet. This PR
  provides the executor provider and contribution boundary, but app-server
  does not install it in this change. Existing local plugin MCP loading is
  unchanged, and no MCP process is launched by this PR alone.
  
  ## Assumptions
  
  - The selected root ID is the plugin policy identity; the manifest
  display name is presentation metadata.
  - An environment ID is a stable logical authority. Reconnection or
  replacement under the same ID does not change ownership.
  - Selected plugin packages and their manifests are trusted inputs.
  - The selected package and MCP discovery snapshot remain frozen for the
  active thread runtime.
  
  ## Follow-up
  
  The next PR installs this contributor in app-server and adds an
  end-to-end test proving that a selected plugin MCP tool launches on its
  owning executor, can be called by the model, survives an explicit MCP
  refresh, and is invisible when its root was not selected.
  
  Resume, fork, environment removal or ID changes, dynamic catalog reload,
  and executor-owned HTTP MCP placement remain separate lifecycle
  decisions.
  
  ## Verification
  
  Focused tests cover executor-only filesystem reads, missing and
  malformed config, stdio filtering and normalization, managed
  requirements, package attribution, and selection order. CI owns
  execution of the test suite.

  jif · 2026-06-15 11:52:05 +02:00
  b3c423e475
• Remove async-trait from extension contributors (#27383)

  ## Why
  
  Extension contributors are registered behind `dyn Trait` objects, so
  native `async fn`/RPITIT methods would make these traits
  non-object-safe. Spell out the boxed, `Send` future contract directly so
  `extension-api` no longer needs `async-trait` while retaining the
  existing runtime model.
  
  ## What changed
  
  - add a shared `ExtensionFuture` alias and use it for asynchronous
  contributor methods
  - migrate production and test implementations to return `Box::pin(async
  move { ... })`
  - remove `async-trait` dependencies where they are no longer used,
  keeping it dev-only where unrelated test executors still require it
  
  ## Behavior
  
  No behavior change is intended. Contributor futures remain boxed,
  `Send`, dynamically dispatched, and lazily executed; cancellation and
  callback ordering stay unchanged.
  
  ## Testing
  
  - `just test -p codex-extension-api` (11 passed)
  - affected extension crates (64 passed)
  - targeted `codex-core` contributor tests (14 passed)
  - `just fmt`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  
  A broad local `codex-core` run compiled successfully but encountered
  unrelated sandbox and missing test-binary fixture failures; CI will run
  the full checks.

  jif · 2026-06-10 14:31:09 +02:00
  d2f6d23c6c
• Route hosted Apps MCP through extensions (#27191)

  ## Stack
  
  - Base: #27184
  - This PR is the second vertical and should be reviewed against
  `jif/external-plugins-1`, not `main`.
  
  ## Why
  
  CCA is moving toward a split runtime where the orchestrator may have no
  filesystem or executor, but it still needs to activate remotely hosted
  plugin components. HTTP MCP servers are the simplest complete example:
  they need configuration and host authentication, but they do not need an
  executor process.
  
  The Apps MCP endpoint is currently synthesized by a special-purpose
  loader inside the MCP runtime. That works locally, but it leaves hosted
  MCP activation outside the extension model being established in #27184.
  It also makes the Apps path a poor foundation for plugins whose skills,
  MCP servers, connectors, and hooks may come from different sources or
  execute in different places.
  
  This PR moves that one behavior behind an extension-owned contribution
  while preserving the existing local fallback. It deliberately does not
  introduce a generic plugin activation framework.
  
  ## What changed
  
  ### MCP extension contribution
  
  `codex-extension-api` gains an ordered `McpServerContributor` contract.
  A contributor returns typed `Set` or `Remove` overlays for MCP server
  configuration; later contributors win for the names they own.
  
  The contract stays at the existing MCP configuration boundary.
  Extensions do not create a second connection manager or transport
  abstraction.
  
  ### Hosted Apps MCP extension
  
  A new `codex-mcp-extension` contributes the reserved `codex_apps` server
  from the existing Apps feature, ChatGPT base URL, path override, and
  product SKU configuration.
  
  When `apps_mcp_path_override` is enabled for `https://chatgpt.com`, the
  resulting streamable HTTP endpoint is
  `https://chatgpt.com/backend-api/ps/mcp`. The existing ChatGPT-auth gate
  remains authoritative, so this server can run in an orchestrator-only
  process without being exposed for API-key sessions.
  
  ### One resolved runtime view
  
  `McpManager` now distinguishes three views:
  
  - **configured:** config- and plugin-backed servers before extension
  overlays;
  - **runtime:** configured servers plus host-installed extension
  contributions;
  - **effective:** runtime servers after auth gating and compatibility
  built-ins.
  
  App-server installs the hosted MCP extension and uses the runtime view
  for thread startup, refresh, status, threadless resource reads,
  connector discovery, and MCP OAuth lookup. This keeps
  `mcpServer/oauth/login` consistent with the servers exposed by the other
  MCP APIs. The hosted Apps server itself continues to use existing
  ChatGPT host authentication rather than MCP OAuth.
  
  ## Compatibility
  
  Hosts that do not install the MCP extension retain the existing Apps MCP
  synthesis path. This preserves current local-only, CLI, and
  standalone-host behavior while app-server exercises the extension path.
  
  Disabling Apps removes the reserved `codex_apps` entry, and losing
  ChatGPT auth removes it from the effective runtime view. Executor
  availability is not consulted for this HTTP transport.
  
  ## Follow-ups
  
  The next vertical will resolve a manifest-declared stdio MCP server from
  an executor-selected plugin root and execute it in the environment that
  owns that root. Later verticals can add backend-owned skills, connector
  metadata, hooks, durable selection semantics, and incremental local
  convergence without changing the component-specific runtime boundaries
  introduced here.
  
  ## Verification
  
  Focused coverage was added for:
  
  - contributing the hosted Apps MCP at `/backend-api/ps/mcp` without an
  executor;
  - requiring ChatGPT auth in the effective runtime view;
  - removing a reserved configured Apps server when the Apps feature is
  disabled.
  
  `cargo check -p codex-app-server -p codex-mcp-extension -p
  codex-extension-api -p codex-mcp` passed. Tests and Clippy were not run
  locally under the current development instruction; CI provides the full
  validation pass.

  jif · 2026-06-09 22:44:16 +02:00
  4ec3b8eeea