mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
jif
4ec3b8eeea
## Stack - Base: #27184 - This PR is the second vertical and should be reviewed against `jif/external-plugins-1`, not `main`. ## Why CCA is moving toward a split runtime where the orchestrator may have no filesystem or executor, but it still needs to activate remotely hosted plugin components. HTTP MCP servers are the simplest complete example: they need configuration and host authentication, but they do not need an executor process. The Apps MCP endpoint is currently synthesized by a special-purpose loader inside the MCP runtime. That works locally, but it leaves hosted MCP activation outside the extension model being established in #27184. It also makes the Apps path a poor foundation for plugins whose skills, MCP servers, connectors, and hooks may come from different sources or execute in different places. This PR moves that one behavior behind an extension-owned contribution while preserving the existing local fallback. It deliberately does not introduce a generic plugin activation framework. ## What changed ### MCP extension contribution `codex-extension-api` gains an ordered `McpServerContributor` contract. A contributor returns typed `Set` or `Remove` overlays for MCP server configuration; later contributors win for the names they own. The contract stays at the existing MCP configuration boundary. Extensions do not create a second connection manager or transport abstraction. ### Hosted Apps MCP extension A new `codex-mcp-extension` contributes the reserved `codex_apps` server from the existing Apps feature, ChatGPT base URL, path override, and product SKU configuration. When `apps_mcp_path_override` is enabled for `https://chatgpt.com`, the resulting streamable HTTP endpoint is `https://chatgpt.com/backend-api/ps/mcp`. The existing ChatGPT-auth gate remains authoritative, so this server can run in an orchestrator-only process without being exposed for API-key sessions. ### One resolved runtime view `McpManager` now distinguishes three views: - **configured:** config- and plugin-backed servers before extension overlays; - **runtime:** configured servers plus host-installed extension contributions; - **effective:** runtime servers after auth gating and compatibility built-ins. App-server installs the hosted MCP extension and uses the runtime view for thread startup, refresh, status, threadless resource reads, connector discovery, and MCP OAuth lookup. This keeps `mcpServer/oauth/login` consistent with the servers exposed by the other MCP APIs. The hosted Apps server itself continues to use existing ChatGPT host authentication rather than MCP OAuth. ## Compatibility Hosts that do not install the MCP extension retain the existing Apps MCP synthesis path. This preserves current local-only, CLI, and standalone-host behavior while app-server exercises the extension path. Disabling Apps removes the reserved `codex_apps` entry, and losing ChatGPT auth removes it from the effective runtime view. Executor availability is not consulted for this HTTP transport. ## Follow-ups The next vertical will resolve a manifest-declared stdio MCP server from an executor-selected plugin root and execute it in the environment that owns that root. Later verticals can add backend-owned skills, connector metadata, hooks, durable selection semantics, and incremental local convergence without changing the component-specific runtime boundaries introduced here. ## Verification Focused coverage was added for: - contributing the hosted Apps MCP at `/backend-api/ps/mcp` without an executor; - requiring ChatGPT auth in the effective runtime view; - removing a reserved configured Apps server when the Apps feature is disabled. `cargo check -p codex-app-server -p codex-mcp-extension -p codex-extension-api -p codex-mcp` passed. Tests and Clippy were not run locally under the current development instruction; CI provides the full validation pass.
134 lines
4.2 KiB
TOML
134 lines
4.2 KiB
TOML
[package]
|
|
name = "codex-app-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "codex-app-server"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "codex-app-server-test-notify-capture"
|
|
path = "src/bin/notify_capture.rs"
|
|
|
|
[lib]
|
|
name = "codex_app_server"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
base64 = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
"ws",
|
|
] }
|
|
codex-analytics = { workspace = true }
|
|
codex-arg0 = { workspace = true }
|
|
codex-cloud-config = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-core = { workspace = true }
|
|
codex-core-plugins = { workspace = true }
|
|
codex-exec-server = { workspace = true }
|
|
codex-extension-api = { workspace = true }
|
|
codex-external-agent-migration = { workspace = true }
|
|
codex-external-agent-sessions = { workspace = true }
|
|
codex-features = { workspace = true }
|
|
codex-goal-extension = { workspace = true }
|
|
codex-guardian = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-file-watcher = { workspace = true }
|
|
codex-hooks = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-plugin = { workspace = true }
|
|
codex-shell-command = { workspace = true }
|
|
codex-skills-extension = { workspace = true }
|
|
codex-utils-cli = { workspace = true }
|
|
codex-utils-pty = { workspace = true }
|
|
codex-backend-client = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-chatgpt = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-image-generation-extension = { workspace = true }
|
|
codex-memories-extension = { workspace = true }
|
|
codex-web-search-extension = { workspace = true }
|
|
codex-memories-write = { workspace = true }
|
|
codex-mcp = { workspace = true }
|
|
codex-mcp-extension = { workspace = true }
|
|
codex-model-provider = { workspace = true }
|
|
codex-models-manager = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-app-server-transport = { workspace = true }
|
|
codex-feedback = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-rollout = { workspace = true }
|
|
codex-sandboxing = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-thread-store = { workspace = true }
|
|
codex-tools = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-json-to-toml = { workspace = true }
|
|
chrono = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
futures = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true }
|
|
toml = { workspace = true }
|
|
toml_edit = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tokio-util = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
tracing-subscriber = { workspace = true, features = ["env-filter", "fmt", "json"] }
|
|
uuid = { workspace = true, features = ["serde", "v7"] }
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
codex-windows-sandbox = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
app_test_support = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
] }
|
|
base64 = { workspace = true }
|
|
codex-model-provider-info = { workspace = true }
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
flate2 = { workspace = true }
|
|
hmac = { workspace = true }
|
|
opentelemetry = { workspace = true }
|
|
opentelemetry_sdk = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
reqwest = { workspace = true, features = ["rustls-tls"] }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"elicitation",
|
|
"server",
|
|
"transport-streamable-http-server",
|
|
] }
|
|
serial_test = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
shlex = { workspace = true }
|
|
tar = { workspace = true }
|
|
tokio-tungstenite = { workspace = true }
|
|
tracing-opentelemetry = { workspace = true }
|
|
url = { workspace = true }
|
|
wiremock = { workspace = true }
|