19 Commits

• Expose thread-level multi-agent mode (#28792)

  ## Why
  
  Once multi-agent mode can be selected per turn, clients also need to
  choose the initial selection when creating a thread and observe that
  selection through lifecycle and settings APIs.
  
  The selected value is intentionally distinct from the effective
  model-visible value: no client selection is represented as `null`, even
  though an eligible multi-agent v2 turn derives `explicitRequestOnly` as
  its effective default.
  
  ## What changed
  
  - Add the optional experimental `thread/start.multiAgentMode` parameter
  and pass it through thread creation.
  - Preserve an omitted initial value as an unset selection rather than
  eagerly storing `explicitRequestOnly`.
  - Apply an explicit `thread/start` selection to the first turn through
  the session configuration established at thread creation.
  - Restore the latest persisted effective mode as the selected baseline
  on cold resume when rollout history contains one.
  - Inherit the optional selected mode from a loaded parent when creating
  related runtime threads.
  - Return the current selected `multiAgentMode` from `thread/start`,
  `thread/resume`, `thread/fork`, and thread settings, using `null` when
  no mode is selected.
  - Keep lifecycle reporting independent from model capability and feature
  eligibility; core turn construction remains responsible for calculating
  and persisting the effective mode.
  
  ## Not covered
  
  - Clearing an existing loaded-session selection back to unset through
  `turn/start`; omitted or `null` currently retains the session's
  selection.
  - A TUI control, slash command, or `config.toml` preference.
  
  ## Verification
  
  - `CARGO_INCREMENTAL=0 just test -p codex-app-server-protocol`
  - `CARGO_INCREMENTAL=0 just test -p codex-app-server multi_agent_mode`
  
  The focused app-server coverage verifies explicit `thread/start`
  initialization, first-turn prompting, nullable reporting for an omitted
  selection, and retention of selections that are not currently
  runtime-eligible.
  
  ## Stack
  
  Stacked on #28685. This PR contains only the thread initialization and
  lifecycle/settings API layer.

  Shijie Rao · 2026-06-19 10:50:44 +02:00
  7abfcf220b
• Pair thread environment settings (#26687)

  ## Why
  
  Thread cwd and environment selections are a single logical setting in
  core: updating one without the other can silently desynchronize the
  next-turn execution context. This change makes that relationship
  explicit in the internal thread settings flow while preserving the
  existing app-server public API shape.
  
  ## What changed
  
  - Moved the cwd/environment pair through internal
  `ThreadSettingsOverrides.environment_settings` instead of a top-level
  internal `cwd` field.
  - Kept `thread/settings/update` public params unchanged, with app-server
  translating top-level `cwd` into the paired internal settings shape.
  - Moved `Op::UserInput` environment overrides into thread settings so
  user turns and settings updates use the same core path.
  - Updated core, app-server, MCP, memories, sample, and test callsites to
  construct the paired settings shape.
  
  ## Verification
  
  - `git diff --check`
  - Local test run starting after PR creation.

  pakrym-oai · 2026-06-08 13:55:15 -07:00
  f3c1283411
• [2 of 2] Finish moving goal runtime to extension (#26548)

  ## Stack
  
  1. [#26547](https://github.com/openai/codex/pull/26547) - [1 of 2] Align
  goal extension with core behavior
  2. [#26548](https://github.com/openai/codex/pull/26548) - [2 of 2] Move
  goal runtime to extension
  
  ## Why
  
  This PR completes the switch of the goal behavior to the
  extension-backed runtime and removes the old core goal implementation.
  
  ## What Changed
  
  - Installs the goal extension for app-server `ThreadManager` sessions.
  - Routes app-server thread goal `get`, `set`, and `clear` through
  `GoalService`.
  - Uses thread-idle lifecycle emission after goal resume and snapshot
  ordering so the extension can decide whether to continue the goal.
  - Forwards extension goal updates through a FIFO async app-server
  notification path so backpressure does not drop them or reorder updates.
  - Keeps review turns from enabling goal runtime behavior.
  - Plans extension tools before dynamic tools so built-in goal tool names
  keep their old precedence when goals are enabled.
  - Removes the old core goal runtime, core goal tool handlers, and core
  goal tool specs.
  - Updates tests that were coupled to the core-owned goal runtime while
  leaving the legacy `<goal_context>` compatibility path in core for old
  threads.
  - Removes the stale cargo-shear ignore now that `codex-goal-extension`
  is used by the workspace.
  - Keeps realtime event matching exhaustive after removing the old
  goal-specific realtime text path.
  
  
  ## Validation
  
  - Ran manual `/goal` runs in TUI. Validated time accounting matched
  wall-clock time and goal lifecycle state transitions.

  Eric Traut · 2026-06-05 14:17:30 -07:00
  479a14cf59
• feat(app-server): include turns page on thread resume (#23534)

  ## Summary
  
  The client currently calls `thread/resume` to establish live updates and
  immediately follows it with `thread/turns/list` to hydrate recent turns.
  This lets `thread/resume` return that page directly, eliminating a round
  trip and the ordering/deduplication gap between the two calls.
  
  Experimental clients opt in with `initialTurnsPage: { limit,
  sortDirection, itemsView }`. The response returns `initialTurnsPage` as
  a `TurnsPage`, including cursors for paging further back in history.
  Keeping the controls in a nested opt-in object provides the useful
  `thread/turns/list` knobs without spreading page-specific parameters
  across `thread/resume`.
  
  ## Verification
  
  - `just fmt`
  - `just write-app-server-schema --experimental`
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-app-server
  thread_resume_initial_turns_page_matches_requested_turns_list_page
  --tests`
  - `cargo test -p codex-app-server
  thread_resume_rejoins_running_thread_even_with_override_mismatch
  --tests`
  - `just fix -p codex-app-server-protocol -p codex-app-server`

  Brent Traut · 2026-05-28 09:18:13 -07:00
  2a1158b8e2
• Add thread/settings/update app-server API (#23502)

  ## Why
  
  App-server clients need a way to update a thread's next-turn settings
  without starting a turn, adding transcript content, or waiting for turn
  lifecycle events. This gives settings UI a direct path for durable
  thread settings while clients observe the eventual effective state
  through a notification.
  
  This is a simplified rework of PR
  https://github.com/openai/codex/pull/22509. In particular, it changes
  the `thread/settings/update` api to return immediately rather than
  waiting and returning the effective (updated) thread settings. This
  makes the new api consistent with `turn/start` and greatly reduces the
  complexity of the implementation relative to the earlier attempt.
  
  ## What Changed
  
  - Adds experimental `thread/settings/update` with partial-update request
  fields and an empty acknowledgment response.
  - Adds experimental `thread/settings/updated`, carrying full effective
  `ThreadSettings` and scoped by `threadId` to subscribed clients for the
  affected thread.
  - Shares durable settings validation with `turn/start`, including
  `sandboxPolicy` plus `permissions` rejection and `serviceTier: null`
  clearing.
  - Emits the same settings notification when `turn/start` overrides
  change the stored effective thread settings.
  - Regenerates app-server protocol schema fixtures and updates
  `app-server/README.md`.

  Eric Traut · 2026-05-20 11:03:20 -07:00
  771a4e74ac
• chore: isolate thread goal storage behind GoalStore (#23295)

  ## Why
  
  Thread goal persistence is being prepared for a dedicated storage
  boundary. Before that split, goal-specific reads, writes, accounting,
  and cleanup were exposed directly on `StateRuntime`, so core and
  app-server callsites stayed coupled to the full runtime instead of a
  goal-specific store.
  
  This PR introduces that boundary without changing the goal wire API or
  current persistence behavior. Callers now go through
  `StateRuntime::thread_goals()` and the new `GoalStore`, while
  `GoalStore` still uses the existing state DB pool underneath.
  
  ## What changed
  
  - Added `GoalStore` in `state/src/runtime/goals.rs` and exposed it from
  `StateRuntime` via `thread_goals()`.
  - Moved thread-goal reads, writes, status updates, pause, delete, and
  usage accounting onto `GoalStore`.
  - Updated core session goal handling, app-server goal RPCs, resume
  snapshots, and goal tests to use the store boundary.
  - Kept thread deletion responsible for cascading goal cleanup by
  deleting the goal through the store only after a thread row is removed.
  
  ## Testing
  
  - Existing goal persistence, resume, and accounting tests were updated
  to exercise the new `GoalStore` access path.

  jif-oai · 2026-05-18 14:47:05 +02:00
  7ee7fe239f
• app-server: stop returning thread permission profiles (#22792)

  ## Why
  
  The app-server thread lifecycle API should no longer expose the full
  `PermissionProfile` value. After the permissions-profile migration,
  clients should round-trip only the active profile identity through
  `activePermissionProfile` and `permissions` when that identity is known.
  
  The full profile is server-side config. Treating a response-derived
  legacy sandbox projection as a new local profile can lose named-profile
  restrictions and accidentally widen permissions on the next turn. The
  legacy `sandbox` response field remains only as the
  compatibility/display fallback.
  
  ## What Changed
  
  - Removed `permissionProfile` from `ThreadStartResponse`,
  `ThreadResumeResponse`, and `ThreadForkResponse`.
  - Stopped populating that field in app-server thread start/resume/fork
  responses.
  - Updated embedded exec/TUI response mapping to derive display
  permission state from local config or the legacy sandbox fallback
  instead of a response profile value.
  - Added a TUI turn override shape that distinguishes preserving server
  permissions, selecting an active profile id, and sending a legacy
  sandbox for an explicit local override.
  - Preserved remote app-server permissions across turns by sending
  `permissions` only when an `activePermissionProfile` id is known, and
  otherwise sending no sandbox override unless the user selected a local
  override.
  - Kept embedded `thread/resume` hydration server-authored when
  `activePermissionProfile` is absent, which matches the live-thread
  attach path where the server ignores requested overrides.
  - Updated the app-server README to remove the obsolete lifecycle
  response `permissionProfile` reference. The remaining
  `permissionProfile` README references are request-side permission
  overrides.
  - Regenerated app-server JSON schema and TypeScript fixtures.
  - Kept the generated typed response enum exempt from
  `large_enum_variant`, matching the existing payload enum exemption after
  the lifecycle response variants shrank.
  
  ## How To Review
  
  Start with `codex-rs/app-server-protocol/src/protocol/v2/thread.rs` to
  confirm the response shape, then check the response construction in
  `codex-rs/app-server/src/request_processors`. The generated schema and
  TypeScript fixture changes are mechanical follow-through from the
  protocol removal.
  
  The TUI behavior is the delicate part: review
  `codex-rs/tui/src/app_server_session.rs` for response hydration and
  turn-start override projection, then
  `codex-rs/tui/src/app/thread_routing.rs` for the decision about whether
  the next turn should preserve the server snapshot, send an active
  profile id, or send a legacy sandbox for an explicit local override.
  
  ## Verification
  
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol
  thread_lifecycle_responses_default_missing_optional_fields`
  - `cargo test -p codex-exec
  session_configured_from_thread_response_uses_permission_profile_from_config`
  - `cargo test -p codex-tui --lib thread_response`
  - `cargo test -p codex-tui turn_permissions_`
  - `cargo test -p codex-tui
  resume_response_restores_turns_from_thread_items`
  - `cargo test -p codex-analytics
  track_response_only_enqueues_analytics_relevant_responses`
  - `just fix -p codex-analytics`
  - `just fix -p codex-app-server-protocol`
  - `just fix -p codex-tui`
  - `just argument-comment-lint`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/22792).
  * #22795
  * __->__ #22792

  Michael Bolin · 2026-05-15 12:45:48 -07:00
  83bbb4f326
• app-server: use permission ids and runtime workspace roots (#22611)

  ## Why
  
  This PR builds on [#22610](https://github.com/openai/codex/pull/22610)
  and is the app-server side of the migration from mutable per-turn
  `SandboxPolicy` replacement toward selecting immutable permission
  profiles by id plus mutable runtime workspace roots.
  
  Once permission profiles can carry their own immutable
  `workspace_roots`, app-server no longer needs to mutate the selected
  `PermissionProfile` just to represent thread-specific filesystem
  context. The mutable part now lives on the thread as explicit
  `runtimeWorkspaceRoots`, while `:workspace_roots` remains symbolic until
  the sandbox is realized for a turn.
  
  ## What Changed
  
  - Replaced the v2 permission-selection wrapper surface with plain
  profile ids for `thread/start`, `thread/resume`, `thread/fork`, and
  `turn/start`.
  - Removed the API surface for profile modifications
  (`PermissionProfileSelectionParams`,
  `PermissionProfileModificationParams`,
  `ActivePermissionProfileModification`).
  - Added experimental `runtimeWorkspaceRoots` fields to the thread
  lifecycle and turn-start APIs.
  - Threaded runtime workspace roots through core session/thread
  snapshots, turn overrides, app-server request handling, and command
  execution permission resolution.
  - Kept session permission state symbolic so later runtime root updates
  and cwd-only implicit-root retargeting rebind `:workspace_roots`
  correctly.
  - Updated the embedded clients just enough to send and restore the new
  thread state.
  - Refreshed the generated schema/TypeScript artifacts and the app-server
  README to match the new contract.
  
  ## Verification
  
  Targeted coverage for this layer lives in:
  
  - `codex-rs/app-server-protocol/src/protocol/v2/tests.rs`
  - `codex-rs/app-server/tests/suite/v2/thread_start.rs`
  - `codex-rs/app-server/tests/suite/v2/thread_resume.rs`
  - `codex-rs/app-server/tests/suite/v2/turn_start.rs`
  - `codex-rs/core/src/session/tests.rs`
  
  The key regression checks exercise that:
  
  - `runtimeWorkspaceRoots` resolve against the effective cwd on thread
  start.
  - Profile-declared workspace roots are excluded from the runtime
  workspace roots returned by app-server.
  - A turn-level runtime workspace-root update persists onto the thread
  and is returned by `thread/resume`.
  - A named permission profile selected on one turn remains symbolic so a
  later runtime-root-only turn update changes the actual sandbox writes.
  - A cwd-only turn update retargets the implicit runtime cwd root while
  preserving additional runtime roots.
  - The protocol fixtures and generated client artifacts stay in sync with
  the string-based permission selection contract.
  
  
  
  
  
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/22611).
  * #22612
  * __->__ #22611

  Michael Bolin · 2026-05-14 23:00:05 -07:00
  8a5306ff88
• fix(app-server): thread history redaction for remote clients (#22178)

  ## Summary
  
  Remote clients can still receive large `thread/resume` histories when
  prior turns include MCP tool call payloads or image-generation results.
  This adds a temporary response-only redaction path for the known remote
  client names.
  
  Longer term we will move towards fully paginated APIs backed by SQLite.
  
  ## Changes
  
  - Redact MCP tool call payload-bearing fields in `thread/resume`
  responses for `codex_chatgpt_android_remote` and
  `codex_chatgpt_ios_remote`.
  - Drop `imageGeneration` items from those `thread/resume` responses.
  - Keep redaction out of persisted rollout files, `thread/read`,
  `thread/turns/list`, live notifications, and token usage replay.
  - Cover the behavior with app-server helper tests and a v2 resume
  integration test that checks both remote clients plus a non-target
  control client.
  
  ## Testing
  
  - `cargo test -p codex-app-server thread_resume_redaction`
  - `cargo test -p codex-app-server
  thread_resume_redacts_payloads_for_chatgpt_remote_clients`

  Owen Lin · 2026-05-11 11:45:25 -07:00
  7bddb3083d
• Reapply "Move skills watcher to app-server" (#21652)

  ## Why
  
  PR #21460 reverted the earlier move of skills change watching from
  `codex-core` into app-server. This reapplies that boundary change so
  app-server owns client-facing `skills/changed` notifications and core no
  longer carries the watcher.
  
  ## What
  
  - Restore the app-server `SkillsWatcher` and register it from thread
  listener setup.
  - Remove the core-owned skills watcher and its core live-reload
  integration surface.
  - Restore app-server coverage for `skills/changed` notifications after a
  watched skill file changes.
  
  ## Validation
  
  - `cargo test -p codex-app-server --test all
  suite::v2::skills_list::skills_changed_notification_is_emitted_after_skill_change
  -- --exact --nocapture`
  - `cargo test -p codex-core --lib --no-run`

  pakrym-oai · 2026-05-08 17:41:15 -07:00
  408e6218ab
• Revert "Move skills watcher to app-server" (#21460)

  Reverts openai/codex#21287

  pakrym-oai · 2026-05-07 02:24:20 +00:00
  103dc2b6ae
• Move skills watcher to app-server (#21287)

  ## Why
  
  Skills update notifications are app-server API behavior, but the watcher
  lived in `codex-core` and surfaced through
  `EventMsg::SkillsUpdateAvailable`. Moving the watcher out keeps core
  focused on thread execution and lets app-server own both cache
  invalidation and the `skills/changed` notification.
  
  ## What changed
  
  - Added an app-server-owned skills watcher that watches local skill
  roots, clears the shared skills cache, and emits `skills/changed`
  directly.
  - Registers skill watches from the common app-server thread listener
  attach path, including direct starts, resumes, and app-server-observed
  child or forked threads.
  - Stores the `WatchRegistration` on `ThreadState`, so listener
  replacement, thread teardown, idle unload, and app-server shutdown
  deregister by dropping the RAII guard.
  - Removed `EventMsg::SkillsUpdateAvailable`, the core watcher, and the
  old core live-reload test.
  - Extended the app-server skills change test to verify a cached skills
  list is refreshed after a filesystem change without forcing reload.
  
  ## Validation
  
  - `cargo check -p codex-core -p codex-app-server -p codex-mcp-server -p
  codex-rollout -p codex-rollout-trace`
  - `cargo test -p codex-app-server
  skills_changed_notification_is_emitted_after_skill_change`

  pakrym-oai · 2026-05-06 15:38:11 -07:00
  d5eea229cc
• [codex-analytics] emit tool item events from item lifecycle (#17090)

  ## Why
  
  After the tool-item schemas are in place, analytics needs to emit them
  from the app-server item lifecycle rather than requiring bespoke
  tracking at each callsite. The reducer should also reuse the shared
  thread analytics context introduced below it in the stack so later event
  families do not repeat the same reducer joins or missing-state ladder.
  
  ## What changed
  
  - Tracks tool-item completion notifications and emits the matching tool
  analytics event when a terminal item arrives.
  - Derives event-specific payload details for command execution, file
  changes, MCP calls, dynamic tools, collaboration tools, web search, and
  image generation.
  - Denormalizes thread, app-server client, runtime, and subagent
  provenance metadata through the shared thread analytics context.
  - Adds reducer coverage for item lifecycle emission and subagent
  metadata inheritance.
  
  ## Duration semantics
  
  `duration_ms` is computed from the app-server item lifecycle timestamps:
  `completed_at_ms - started_at_ms`. That makes it the duration of the
  lifecycle Codex observed locally, not necessarily the upstream
  provider's full execution time.
  
  - Web search usually has a meaningful observed lifecycle because
  Responses can send `response.output_item.added` before
  `response.output_item.done`; in that case `started_at_ms` comes from the
  added event and `completed_at_ms` comes from the done event.
  - Image generation can be much less precise. In the current observed
  stream, image generation often arrives only as a completed
  `response.output_item.done`; when there is no earlier added event, Codex
  synthesizes the started item immediately before completion, so
  `duration_ms` can be `0` even though upstream image generation took
  longer.
  - Standalone web search and standalone image generation work is expected
  to land after this stack. Those paths may introduce more direct
  lifecycle events or timing points, so the current
  web-search/image-generation duration semantics should be treated as the
  best available item-lifecycle approximation, not the final latency
  contract for those tool families.
  - `execution_duration_ms` is populated only where the completed item
  already carries a native execution duration; otherwise it remains `null`
  while `duration_ms` still reflects the local lifecycle interval.
  
  ## Currently placeholder / partial fields
  
  Some fields are included in the schema for the intended steady-state
  contract, but this PR does not yet populate them from real
  approval/review state:
  
  - `review_count`, `guardian_review_count`, and `user_review_count`
  currently default to `0`.
  - `final_approval_outcome` currently defaults to `unknown`.
  - `requested_additional_permissions` and `requested_network_access`
  currently default to `false`.
  
  ## Verification
  
  - `cargo test -p codex-analytics`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/17090).
  * #18748
  * #18747
  * __->__ #17090
  * #17089
  * #20514

  rhan-oai · 2026-05-06 20:27:41 +00:00
  fbdbc6b2fe
• feat(app-server): move v2 sessionId onto Thread (#21336)

  ## Why
  
  `session_id` and `thread_id` are separate identities after #20437, but
  app-server only surfaced `sessionId` on the `thread/start`,
  `thread/resume`, and `thread/fork` response envelopes. Other
  thread-bearing surfaces such as `thread/list`, `thread/read`,
  `thread/started`, `thread/rollback`, `thread/metadata/update`, and
  `thread/unarchive` either lacked the grouping key or forced clients to
  special-case those three responses.
  
  Making `sessionId` part of the reusable `Thread` payload gives every v2
  API surface one place to expose session-tree identity.
  
  ## Mental model
    1. thread.sessionId lives on `Thread`
  2. It is a view/runtime identity for the current live session tree, not
  durable stored lineage metadata
  3. When app-server has a live loaded thread, it copies the real value
  from core’s session_configured.session_id
  4. When it only has stored/unloaded data, it falls back to
  thread.sessionId = thread.id
  
  ## What changed
  
  - Added `sessionId` to the v2
  [`Thread`](https://github.com/openai/codex/blob/8fc9e9b4cf81b6f61d432e71f1eb266f6f104b63/codex-rs/app-server-protocol/src/protocol/v2/thread_data.rs#L105-L109).
  - Removed the duplicate top-level `sessionId` fields from
  `thread/start`, `thread/resume`, and `thread/fork`; clients should now
  read `response.thread.sessionId`.
  - Populated `thread.sessionId` when building live thread responses,
  replaying loaded threads, and returning stored-thread summaries so the
  field is present across start, resume, fork, list, read, rollback,
  metadata-update, unarchive, and `thread/started` paths. See
  [`load_thread_from_resume_source_or_send_internal`](https://github.com/openai/codex/blob/8fc9e9b4cf81b6f61d432e71f1eb266f6f104b63/codex-rs/app-server/src/request_processors/thread_processor.rs#L2824-L2918)
  and
  [`thread_from_stored_thread`](https://github.com/openai/codex/blob/8fc9e9b4cf81b6f61d432e71f1eb266f6f104b63/codex-rs/app-server/src/request_processors/thread_processor.rs#L3671-L3719).
  - Preserved the stored-thread fallback: if a thread has not been loaded
  into a live session tree yet, `thread.sessionId` falls back to
  `thread.id`; once the thread is live again, the field reports the active
  session tree root.
  - Regenerated the JSON/TypeScript schemas and updated the app-server
  README examples to show
  [`thread.sessionId`](https://github.com/openai/codex/blob/8fc9e9b4cf81b6f61d432e71f1eb266f6f104b63/codex-rs/app-server/README.md#L306-L310)
  on the thread object.

  jif-oai · 2026-05-06 15:23:25 +02:00
  5ecff05196
• feat: add session_id (#20437)

  ## Summary
  
  Related to
  https://openai.slack.com/archives/C095U48JNL9/p1777537279707449
  TLDR:
  We update the meaning of session ids and thread ids:
  * thread_id stays as now
  * session_id become a shared id between every thread under a /root
  thread (i.e. every sub-agent share the same session id)
  
  This PR introduces an explicit `SessionId` and threads it through the
  protocol/client boundary so `session_id` and `thread_id` can diverge
  when they need to, while preserving compatibility for older serialized
  `session_configured` events.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-05-06 10:48:37 +02:00
  a98623511b
• [codex] Use shared app-server JSON-RPC error helpers (#21221)

  ## Why
  
  App-server had repeated hand-built JSON-RPC error objects for standard
  error shapes. Using the shared helpers keeps the common
  `invalid_request`, `invalid_params`, and `internal_error` construction
  in one place and reduces the chance of new call sites drifting from the
  common error payload shape.
  
  ## What changed
  
  - Replaced manual standard JSON-RPC error object creation with
  `internal_error(...)`, `invalid_request(...)`, and `invalid_params(...)`
  across app-server request processors and runtime paths.
  - Removed local duplicate helper definitions from search and review
  request handling.
  - Preserved existing structured `data` payloads by creating the shared
  helper error first and then attaching the existing metadata.
  - Left custom non-standard errors and raw error-code assertions intact.
  
  ## Validation
  
  - `cargo test -p codex-app-server`

  pakrym-oai · 2026-05-05 12:13:59 -07:00
  b6d4c4ea6b
• codex: migrate (more) app-server thread history reads to ThreadStore (#20575)

  Migrate token usage replay, rollback responses, and detached review
  setup (a special case of forking) to be served from ThreadStore reads
  rather direct rollout files.
  
  - replay restored token usage from already-loaded `RolloutItem` history
  instead of reopening `Thread.path`
  - rebuild rollback responses from loaded `ThreadStore` snapshots and
  history
  - start detached reviews from store-backed parent history and stored
  review-thread metadata
  - remove obsolete app-server rollout-summary helper code that became
  dead after the store-backed migration
  - preserve response/notification ordering for resume, fork, rollback,
  and detached review flows
  - add integration test coverage for the affected paths

  Tom · 2026-05-04 21:16:50 -07:00
  33d24b0df5
• feat(app-server): always return limited thread history (#20682)

  ## Why
  
  Whenever we return a thread's history (turns and items) over app-server,
  always return the limited form as specified by the rollout policy
  `EventPersistenceMode::Limited`, even if the thread was previously
  started with `EventPersistenceMode::Extended`.
  
  We're finding it is quite unscalable to be returning the extended
  history, so let's apply the same filtering logic of the rollout policy
  when we load and return the thread's history.
  
  ## What Changed
  
  - Reuse the rollout persistence policy when reconstructing app-server
  `ThreadItem` history so only `EventPersistenceMode::Limited` rollout
  items are replayed into API turns.
  - Route `thread/read`, `thread/resume`, `thread/fork`,
  `thread/turns/list`, and rollback responses through the same filtered
  app-server history projection.
  - Keep live active turns intact when composing a response for a
  currently running thread.
  - Update command execution coverage so persisted extended command events
  are excluded from returned history for `thread/read`, `thread/fork`, and
  `thread/turns/list`.
  
  ## Test Plan
  
  - `cargo test -p codex-app-server limited`
  - `cargo test -p codex-app-server thread_shell_command`
  - `cargo test -p codex-app-server thread_read`
  - `cargo test -p codex-app-server thread_rollback`
  - `cargo test -p codex-app-server thread_fork`
  - `cargo test -p codex-app-server-protocol`

  Owen Lin · 2026-05-04 10:37:35 -07:00
  541e99cf09
• [codex] Split app-server request processors (#20940)

  ## Why
  
  The app-server request path had grown around a large
  `CodexMessageProcessor` plus separate API wrapper/helper modules. That
  made the dependency graph hard to see and forced unrelated request
  families to share broad processor state.
  
  This PR makes the split mechanical and command-prefix oriented so
  request families own only the dependencies they use.
  
  ## What changed
  
  - Replaced `CodexMessageProcessor` with command-prefix request
  processors under `app-server/src/request_processors/`.
  - Removed the old config, device-key, external-agent-config, and fs API
  wrapper files by moving their API handling into processors.
  - Split apps, plugins, marketplace, catalog, account, MCP, command exec,
  fs, git, feedback, thread, turn, thread goals, and Windows sandbox
  handling into dedicated processors.
  - Kept shared lifecycle, summary conversion, token usage replay, and
  shared error mapping only where multiple processors use them; single-use
  helpers were inlined into their owning processor.
  - Removed the fallback processor path and moved processor tests to
  `_tests` files.
  
  ## Validation
  
  - `cargo test -p codex-app-server`
  - `cargo check -p codex-app-server`
  - `just fix -p codex-app-server`

  pakrym-oai · 2026-05-04 09:34:11 -07:00
  33b19bcfde