Add files using upload-large-folder tool

codex-rs/.cargo/audit.toml

@@ -0,0 +1,15 @@
+[advisories]
+# Reviewed 2026-07-02. Keep this list in sync with ../deny.toml.
+ignore = [
+    "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained
+    "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/bm25; upstream crate is unmaintained
+    "RUSTSEC-2024-0436", # paste 1.0.15 via starlark/v8; upstream crate is unmaintained
+    "RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained
+    "RUSTSEC-2024-0320", # yaml-rust via syntect; remove when syntect drops or updates it
+    "RUSTSEC-2025-0141", # bincode via syntect; remove when syntect drops or updates it
+    "RUSTSEC-2026-0118", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net
+    "RUSTSEC-2026-0119", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net
+    "RUSTSEC-2026-0173", # proc-macro-error2 via i18n-embed-fl/age/codex-secrets; remove when local secrets storage migrates off age or age drops i18n-embed-fl
+    "RUSTSEC-2026-0194", # quick-xml via plist/syntect and wayland-scanner; trusted inputs only; remove when rust-plist#191 and wayland-rs#938 are released
+    "RUSTSEC-2026-0195", # quick-xml via plist/syntect and wayland-scanner; trusted inputs only; remove when rust-plist#191 and wayland-rs#938 are released
+]

codex-rs/.cargo/config.toml

@@ -0,0 +1,11 @@
+[target.'cfg(all(windows, target_env = "msvc"))']
+rustflags = ["-C", "link-arg=/STACK:8388608", "-C", "target-feature=+crt-static"]
+
+# MSVC emits a warning about code that may trip "Cortex-A53 MPCore processor bug #843419" (see
+# https://developer.arm.com/documentation/epm048406/latest) which is sometimes emitted by LLVM.
+# Since Arm64 Windows 10+ isn't supported on that processor, it's safe to disable the warning.
+[target.aarch64-pc-windows-msvc]
+rustflags = ["-C", "link-arg=/STACK:8388608", "-C", "link-arg=/arm64hazardfree"]
+
+[target.'cfg(all(windows, target_env = "gnu"))']
+rustflags = ["-C", "link-arg=-Wl,--stack,8388608"]

codex-rs/agent-graph-store/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "agent-graph-store",
+    crate_name = "codex_agent_graph_store",
+)

codex-rs/agent-graph-store/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-agent-graph-store"
+version.workspace = true
+
+[lib]
+name = "codex_agent_graph_store"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-protocol = { workspace = true }
+codex-state = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+codex-utils-absolute-path = { workspace = true }
+pretty_assertions = { workspace = true }
+serde_json = { workspace = true }
+tempfile = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync"] }

codex-rs/agent-roles/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "agent-roles",
+    crate_name = "codex_agent_roles",
+)

codex-rs/agent-roles/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-agent-roles"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "codex_agent_roles"
+path = "src/lib.rs"
+test = false
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-config = { workspace = true }
+codex-file-system = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-path-uri = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+toml = { workspace = true, features = ["preserve_order"] }
+tracing = { workspace = true }

codex-rs/analytics/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "analytics",
+    crate_name = "codex_analytics",
+)

codex-rs/analytics/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-analytics"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "codex_analytics"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-app-server-protocol = { workspace = true }
+codex-git-utils = { workspace = true }
+codex-login = { workspace = true }
+codex-model-provider = { workspace = true }
+codex-plugin = { workspace = true }
+codex-protocol = { workspace = true }
+codex-state = { workspace = true }
+os_info = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+sha1 = { workspace = true }
+tokio = { workspace = true, features = [
+    "macros",
+    "rt-multi-thread",
+] }
+tracing = { workspace = true, features = ["log"] }
+
+[dev-dependencies]
+codex-utils-absolute-path = { workspace = true }
+pretty_assertions = { workspace = true }

codex-rs/app-server-client/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server-client",
+    crate_name = "codex_app_server_client",
+)

codex-rs/app-server-client/Cargo.toml

@@ -0,0 +1,40 @@
+[package]
+name = "codex-app-server-client"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+name = "codex_app_server_client"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-app-server = { workspace = true }
+codex-app-server-protocol = { workspace = true }
+codex-arg0 = { workspace = true }
+codex-config = { workspace = true }
+codex-core = { workspace = true }
+codex-exec-server = { workspace = true }
+codex-feedback = { workspace = true }
+codex-protocol = { workspace = true }
+codex-uds = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-rustls-provider = { workspace = true }
+futures = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["sync", "time", "rt"] }
+tokio-tungstenite = { workspace = true }
+toml = { workspace = true }
+tracing = { workspace = true }
+url = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+serde_json = { workspace = true }
+tempfile = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

codex-rs/app-server-client/README.md

@@ -0,0 +1,66 @@
+# codex-app-server-client
+
+Shared in-process app-server client used by conversational CLI surfaces:
+
+- `codex-exec`
+- `codex-tui`
+
+## Purpose
+
+This crate centralizes startup and lifecycle management for an in-process
+`codex-app-server` runtime, so CLI clients do not need to duplicate:
+
+- app-server bootstrap and initialize handshake
+- in-memory request/event transport wiring
+- lifecycle orchestration around caller-provided startup identity
+- graceful shutdown behavior
+
+## Startup identity
+
+Callers pass both the app-server `SessionSource` and the initialize
+`client_info.name` explicitly when starting the facade.
+
+That keeps thread metadata (for example in `thread/list` and `thread/read`)
+aligned with the originating runtime without baking TUI/exec-specific policy
+into the shared client layer.
+
+## Transport model
+
+The in-process path uses typed channels:
+
+- client -> server: `ClientRequest` / `ClientNotification`
+- server -> client: `InProcessServerEvent`
+  - `ServerRequest`
+  - `ServerNotification`
+  - `LegacyNotification`
+
+JSON serialization is still used at external transport boundaries
+(stdio/websocket), but the in-process hot path is typed.
+
+Typed requests still receive app-server responses through the JSON-RPC
+result envelope internally. That is intentional: the in-process path is
+meant to preserve app-server semantics while removing the process
+boundary, not to introduce a second response contract.
+
+## Bootstrap behavior
+
+The client facade starts an already-initialized in-process runtime, but
+thread bootstrap still follows normal app-server flow:
+
+- caller sends `thread/start` or `thread/resume`
+- app-server returns the immediate typed response
+- richer session metadata may arrive later as a `SessionConfigured`
+  legacy event
+
+Surfaces such as TUI and exec may therefore need a short bootstrap
+phase where they reconcile startup response data with later events.
+
+## Backpressure and shutdown
+
+- Command queues and the embedded runtime remain bounded, using
+  `DEFAULT_IN_PROCESS_CHANNEL_CAPACITY` by default.
+- The facade's local consumer event queue is unbounded and preserves notification
+  order. This keeps the worker draining the bounded runtime while a caller waits
+  for a request, preventing unread notifications from blocking its response.
+- `shutdown()` performs a bounded graceful shutdown and then aborts if timeout
+  is exceeded.

codex-rs/app-server-daemon/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server-daemon",
+    crate_name = "codex_app_server_daemon",
+)

codex-rs/app-server-daemon/Cargo.toml

@@ -0,0 +1,46 @@
+[package]
+name = "codex-app-server-daemon"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+name = "codex_app_server_daemon"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+codex-app-server-protocol = { workspace = true }
+codex-app-server-transport = { workspace = true }
+codex-http-client = { workspace = true }
+codex-install-context = { workspace = true }
+codex-utils-home-dir = { workspace = true }
+codex-uds = { workspace = true }
+futures = { workspace = true }
+libc = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+semver = { workspace = true }
+blake3 = { workspace = true }
+tokio = { workspace = true, features = [
+    "fs",
+    "io-util",
+    "macros",
+    "process",
+    "rt-multi-thread",
+    "signal",
+    "time",
+] }
+tempfile = { workspace = true }
+tokio-tungstenite = { workspace = true }
+tracing = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.52", features = ["Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_IO", "Win32_System_JobObjects", "Win32_Security", "Win32_Security_Authorization", "Win32_System_Threading"] }

codex-rs/app-server-daemon/README.md

@@ -0,0 +1,192 @@
+# codex-app-server-daemon
+
+> `codex-app-server-daemon` is experimental and its lifecycle contract may
+> change while the remote-management flow is still being developed.
+
+`codex-app-server-daemon` backs the machine-readable `codex app-server`
+lifecycle commands used by remote clients such as the desktop and mobile apps.
+It is intended for Codex instances launched over SSH, including fresh developer
+machines that should expose app-server with `remote_control` enabled.
+
+## Platform support
+
+The daemon supports Linux, macOS, and Windows using platform-specific process
+and file-locking primitives. Windows startup requires a non-elevated terminal
+whose host permits detached child processes.
+
+Windows automatic attachment requires the canonical socket address to fit the
+108-byte AF_UNIX limit (including its terminator). A short junction alias whose
+resolved address exceeds that limit falls back to the embedded server. Use a
+shorter `CODEX_HOME` to share the daemon; discovery does not trust a mutable alias.
+
+Shared clients use the environment inherited when the daemon started. Opening a
+new terminal or clearing variables there does not clear the running daemon's
+environment; per-client environment isolation is not provided.
+An invocation that sets `CODEX_EXEC_SERVER_URL` skips implicit daemon attachment
+so its executor selection is preserved. If an implicitly discovered daemon cannot
+initialize the connection, the TUI starts an embedded server instead. Explicit
+`--remote` endpoints remain authoritative and report connection failures.
+
+## Commands
+
+```sh
+codex app-server daemon start
+codex app-server daemon restart
+codex app-server daemon update
+codex app-server daemon enable-remote-control
+codex app-server daemon disable-remote-control
+codex app-server daemon stop
+codex app-server daemon version
+codex app-server daemon bootstrap --remote-control
+```
+
+On success, every command writes exactly one JSON object to stdout. Consumers
+should parse that JSON rather than relying on human-readable text. Lifecycle
+responses report the resolved backend, socket path, local CLI version, and
+running app-server version when applicable.
+
+Eligible managed daemons check for updates after five minutes, then hourly by
+default. Edit `CODEX_HOME/app-server-daemon/settings.json` to change this:
+
+```json
+{"remoteControlEnabled": false,
+ "shutdownGraceSeconds": 60,
+ "updater": {"autoUpdateEnabled": false, "updateIntervalMinutes": 120}}
+```
+
+Positive minute intervals have no configured cap. `daemon restart` applies the
+enabled state; the next updater wait reads a new interval. The preference does
+not affect an explicit `codex update` command or `daemon update`.
+
+`daemon update` selects the latest stable release, even with automatic updates
+disabled. It also returns pinned or local managed packages to production update
+eligibility, preserving the automatic-update preference. Legacy installations
+migrate to the dedicated root once the published installer and release support
+migration. JSON reports `updated`, `noUpdate`, or `unsupported`, with installed
+and running versions. A running daemon restarts, so active or queued work may be
+interrupted; a stopped daemon stays stopped. Installer errors return nonzero.
+The updater uses saved network settings; CLI `-c` overrides do not reach it.
+
+For all managed app-server shutdowns, including explicit stop and restart and
+updater-triggered restarts, `shutdownGraceSeconds` defaults to 60 and accepts
+an integer from 0 through 300. Zero forces shutdown immediately after requesting
+a graceful exit; the five-minute maximum bounds the wait even if a turn is still
+running.
+
+## Bootstrap flow
+
+For a new Linux or macOS machine:
+
+```sh
+curl -fsSL https://chatgpt.com/codex/install.sh | sh
+$HOME/.codex/packages/standalone/current/codex app-server daemon bootstrap --remote-control
+```
+
+On Windows, use a non-elevated PowerShell terminal whose host allows breakaway:
+
+```powershell
+irm https://chatgpt.com/codex/install.ps1 | iex
+$codexHome = if ($env:CODEX_HOME) { $env:CODEX_HOME } else { Join-Path $HOME '.codex' }
+& "$codexHome\packages\standalone\current\bin\codex.exe" app-server daemon bootstrap --remote-control
+```
+
+`bootstrap` can use any complete CLI package. If no daemon package is installed,
+it copies the invoking package into `CODEX_HOME/packages/app-server-daemon` and
+prints an installation message without asking for confirmation. Existing daemon
+packages are reused, including legacy installations; a broken selection is not
+silently replaced. A bare executable cannot supply a new installation.
+
+It records the daemon settings under `CODEX_HOME/app-server-daemon/`, starts app-server as a
+pidfile-backed detached process. It launches a detached updater loop when
+automatic updates are enabled, the installer selected the stable `latest`
+channel, and the managed binary supports the updater command.
+
+## Installation and update cases
+
+New daemons use `CODEX_HOME/packages/app-server-daemon/current/bin/codex`
+(`codex.exe` on Windows). The package contains the executable and its helpers.
+Daemon-only installer updates leave the user's CLI command and shell setup alone.
+
+Previously launched legacy daemons retain `CODEX_HOME/packages/standalone/current`,
+including its flat binary layout when present. Starts and scheduled updates keep
+using that location. An explicit production update prepares and validates a
+compatible dedicated package before stopping the legacy updater and daemon,
+selecting the new package, and restarting only a previously running daemon.
+The old CLI package files and selection remain unchanged.
+
+| Situation | What starts | Does this daemon fetch new binaries? | Does a running app-server eventually move to a newer binary on its own? |
+| --- | --- | --- | --- |
+| Latest-channel installer has run; `start` or `bootstrap` is used with automatic updates enabled | Managed binary and detached updater when supported | When supported, the platform's installer runs on the configured cadence. | When supported, the running server restarts with the new binary before the updater replaces itself. |
+| Installer selected an explicit release; `bootstrap` is used | Managed binary only | No; the selected release stays pinned. | No; an explicit restart uses the selected binary. |
+| Another tool updates the managed binary | A fresh start or explicit restart uses it; a running server is reused. | Yes, when a latest-channel updater is running, on the configured cadence. | An updater that was running through the change compares binary contents on its next successful installer pass and refreshes the server first. |
+
+### Managed packages
+
+For dedicated and retained legacy daemon installations:
+
+- lifecycle commands use the selected daemon package, regardless of the invoking
+  CLI version; they do not implicitly replace an existing package
+- `bootstrap` is supported
+- managed `start`, `restart`, and `bootstrap` ensure a single detached pid-backed
+  updater loop only when automatic updates are enabled for a stable latest-channel
+  release whose managed binary supports the updater command
+- the installer records the latest-channel selection alongside `current`;
+  selecting an explicit release clears it, even if that version is currently
+  latest. The updater checks the selection again while holding the install lock
+  so an in-flight update cannot override a new pin
+- installs made before the installer recorded channel selections need one new
+  `latest` installation to opt into automatic updates; until then the daemon
+  continues to serve app-server without updating the selected release
+- after a successful refresh, if app-server is running and the managed binary
+  contents changed, the updater restarts app-server with that binary first and
+  only then replaces its own process image
+- the updater loop is not reboot-persistent; a managed start after reboot
+  starts it again
+
+### Out-of-band updates
+
+This daemon does not watch arbitrary executable files for replacement. If some
+other tool updates the managed binary path:
+
+- an updater that was already running notices a changed managed
+  binary on its next successful scheduled installer pass; if
+  app-server is running, it refreshes app-server first and then refreshes itself
+  once that replacement starts successfully
+- if the updater was absent during a same-version binary replacement, a later
+  managed start recovers it but cannot infer the running server's previous
+  executable identity; use `codex app-server daemon restart` to refresh the server
+
+## Lifecycle semantics
+
+`start` is idempotent and returns after app-server is ready to answer the normal
+JSON-RPC initialize handshake on the Unix control socket.
+
+`restart` stops any managed daemon and starts it again.
+
+`enable-remote-control` and `disable-remote-control` persist the launch setting
+for future starts. If a managed app-server is already running, they restart it
+so the new setting takes effect immediately.
+
+Top-level `codex remote-control start` enables and persists remote control for
+the managed daemon, overriding a saved disabled value. It starts or bootstraps
+the daemon as needed. Plain `codex remote-control` runs a separate foreground
+server and does not change daemon settings; `codex remote-control stop` stops
+the managed daemon without clearing its saved remote-control preference.
+`daemon start` and `daemon restart` use that saved preference. `daemon bootstrap`
+sets it according to `--remote-control` (disabled when omitted).
+
+`stop` sends a graceful termination request first, then force-terminates the
+process after the configured grace window if it is still alive.
+
+All mutating lifecycle commands are serialized per `CODEX_HOME`, so a concurrent
+`start`, `restart`, `enable-remote-control`, `disable-remote-control`, `stop`,
+or `bootstrap` does not race another in-flight lifecycle operation.
+
+## State
+
+The daemon stores its local state under `CODEX_HOME/app-server-daemon/`:
+
+- `settings.json` for remote-control launch settings and updater preferences
+- `app-server.pid` for the app-server process record
+- `app-server-updater.pid` for the pid-backed standalone updater loop
+- `daemon.lock` for daemon-wide lifecycle serialization

codex-rs/app-server-protocol-noop-macros/BUILD.bazel

@@ -0,0 +1,7 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server-protocol-noop-macros",
+    crate_name = "codex_app_server_protocol_noop_macros",
+    proc_macro = True,
+)

codex-rs/app-server-protocol-noop-macros/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "codex-app-server-protocol-noop-macros"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+proc-macro = true
+test = false
+doctest = false
+
+[lints]
+workspace = true

codex-rs/app-server-protocol/BUILD.bazel

@@ -0,0 +1,19 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server-protocol",
+    compile_data = glob(["schema/precomputed/**"]),
+    crate_name = "codex_app_server_protocol",
+    test_data_extra = glob(
+        ["schema/**"],
+        allow_empty = True,
+    ),
+)
+
+alias(
+    name = "schema-generator",
+    testonly = True,
+    actual = ":app-server-protocol-unit-tests-bin",
+    tags = ["manual"],
+    visibility = ["//bazel/schema:__pkg__"],
+)

codex-rs/app-server-protocol/Cargo.toml

@@ -0,0 +1,56 @@
+[package]
+name = "codex-app-server-protocol"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+name = "codex_app_server_protocol"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+codex-experimental-api-macros = { workspace = true }
+codex-app-server-protocol-noop-macros = { workspace = true }
+codex-extension-items = { workspace = true }
+codex-history = { workspace = true }
+codex-protocol = { workspace = true }
+codex-rollout = { workspace = true }
+codex-secrets = { workspace = true }
+codex-shell-command = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-path-uri = { workspace = true }
+codex-utils-redacted-string = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+serde_with = { workspace = true }
+strum_macros = { workspace = true }
+thiserror = { workspace = true }
+rmcp = { workspace = true, default-features = false, features = [
+    "base64",
+    "macros",
+    "server",
+] }
+inventory = { workspace = true }
+tracing = { workspace = true }
+uuid = { workspace = true, features = ["serde", "v7"] }
+zstd = { workspace = true }
+
+[dev-dependencies]
+anyhow = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
+pretty_assertions = { workspace = true }
+rmcp = { workspace = true, default-features = false, features = [
+    "base64",
+    "macros",
+    "schemars",
+    "server",
+] }
+schemars = { workspace = true }
+similar = { workspace = true }
+tempfile = { workspace = true }
+ts-rs = { workspace = true }

codex-rs/app-server-test-client/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server-test-client",
+    crate_name = "codex_app_server_test_client",
+)

codex-rs/app-server-test-client/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "codex-app-server-test-client"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+clap = { workspace = true, features = ["derive", "env"] }
+codex-app-server-protocol = { workspace = true }
+codex-core = { workspace = true }
+codex-otel = { workspace = true }
+codex-protocol = { workspace = true }
+codex-utils-cli = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["rt"] }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+tungstenite = { workspace = true }
+url = { workspace = true }
+uuid = { workspace = true, features = ["v4"] }
+
+[lib]
+doctest = false
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }

codex-rs/app-server-test-client/README.md

@@ -0,0 +1,184 @@
+# App Server Test Client
+Quickstart for running and hitting `codex app-server`.
+
+## Quickstart
+
+Run from `<reporoot>/codex-rs`.
+
+```bash
+# 1) Build debug codex binary
+cargo build -p codex-cli --bin codex
+
+# 2) Start websocket app-server in background
+cargo run -p codex-app-server-test-client -- \
+  --codex-bin ./target/debug/codex \
+  serve --listen ws://127.0.0.1:4222 --kill
+
+# 3) Call app-server (defaults to ws://127.0.0.1:4222)
+cargo run -p codex-app-server-test-client -- model-list
+```
+
+`send-message` and `send-message-v2` handle `request_user_input` server requests interactively.
+When Codex asks a question, choose a numbered option (or `o` for a free-form answer when offered)
+and the client will send the response and continue streaming the same turn.
+
+## Testing Codex-managed Amazon Bedrock login
+
+`test-login --amazon-bedrock` initializes the experimental app-server API, sends an
+`account/login/start` request with an Amazon Bedrock API key, and waits for the
+`account/login/completed` and `account/updated` notifications. Login replaces the current primary
+credential and sets `model_provider = "amazon-bedrock"`, so use an isolated `CODEX_HOME` when
+testing.
+
+```bash
+export CODEX_HOME="$(mktemp -d)"
+printf 'cli_auth_credentials_store = "file"\n' > "$CODEX_HOME/config.toml"
+
+cargo build -p codex-cli --bin codex
+cargo run -p codex-app-server-test-client -- \
+  --codex-bin ./target/debug/codex \
+  test-login \
+  --amazon-bedrock \
+  --api-key "<BEDROCK_API_KEY>" \
+  --region us-west-2
+```
+
+The test client redacts `apiKey` from its outbound request log. After login, start a fresh Codex
+process with the same `CODEX_HOME` to verify that it uses the persisted managed credential.
+
+## Testing logout
+
+`test-logout` initializes the app-server, sends an `account/logout` request, and waits for the
+resulting `account/updated` notification. It uses the active `CODEX_HOME`, so point it at an
+isolated directory when testing credential cleanup.
+
+```bash
+cargo run -p codex-app-server-test-client -- \
+  --codex-bin ./target/debug/codex \
+  test-logout
+```
+
+## Testing Plugin Analytics
+
+The `plugin-analytics-smoke` command exercises `plugin/installed`, plugin
+enable/disable config writes, and a structured plugin mention through one
+app-server connection. Analytics are captured to a local JSONL file and are
+not sent to the analytics backend. The model turn uses a loopback Responses
+API server.
+
+The selected plugin must already be installed and enabled remotely, and the
+active Codex profile must be authenticated. On a fresh local cache, the command
+retries ephemeral turns while the installed remote bundle finishes syncing.
+
+```bash
+# Build a debug Codex binary; analytics capture is unavailable in release builds.
+cargo build -p codex-cli --bin codex
+
+cargo run -p codex-app-server-test-client -- \
+  --codex-bin ./target/debug/codex \
+  plugin-analytics-smoke \
+  --plugin-id linear@openai-curated-remote
+```
+
+Use `--capture-file /tmp/plugin-analytics.jsonl` to select the output path.
+The command validates one `codex_plugin_disabled`, `codex_plugin_enabled`, and
+`codex_plugin_used` event with the expected local and remote plugin identities
+and capability metadata. Each event includes the local ID in `plugin_id` and the
+backend ID in `remote_plugin_id`. The enabled and disabled events come from
+successful writes to the temporary config; the command does not mutate the
+remote enabled state. It prints the events and leaves the JSONL file in place
+for inspection. It does not install or uninstall plugins and does not modify
+the profile's persistent config.
+
+### Testing remote install and uninstall analytics
+
+`plugin-analytics-mutation-smoke` is a manually invoked live smoke test. It
+contacts the configured remote plugin API and temporarily changes the active
+account's installed-plugin state. It is not run by `cargo test`, `just test`,
+or CI.
+
+Choose a remote plugin that is available to the active account and is not
+currently installed. The command refuses to run when the plugin is already
+installed, installs it, validates `codex_plugin_installed`, uninstalls it, and
+validates `codex_plugin_uninstalled`, and verifies that the original
+uninstalled state was restored.
+
+The mutation events include the local Codex ID in `plugin_id` and the backend ID
+in `remote_plugin_id`.
+
+`--remote-plugin-id` takes the backend ID, such as `plugins~Plugin_...`, not the
+local `<plugin>@<marketplace>` ID.
+
+```bash
+cargo run -p codex-app-server-test-client -- \
+  --codex-bin ./target/debug/codex \
+  plugin-analytics-mutation-smoke \
+  --remote-plugin-id <REMOTE_PLUGIN_ID> \
+  --confirm-account-mutation \
+  --capture-file /tmp/plugin-mutation-analytics.jsonl
+```
+
+Analytics use the normal queue, reduction, batching, and serialization path,
+but the debug capture destination suppresses analytics network delivery. The
+command prints one of these final states:
+
+- `PASS`: the install and uninstall events validated and the plugin is uninstalled.
+- `FAIL-CLEAN`: validation failed, but the original uninstalled state was
+  restored.
+- `FAIL-LOCAL-CACHE`: the backend is uninstalled, but local cleanup reported
+  an error.
+- `FAIL-DIRTY`: cleanup failed and the plugin still appears installed.
+- `FAIL-UNKNOWN`: the command could not verify the final installed state.
+
+For a dirty or uncertain result, retry cleanup with:
+
+```bash
+cargo run -p codex-app-server-test-client -- \
+  --codex-bin ./target/debug/codex \
+  plugin-remote-uninstall \
+  --remote-plugin-id <REMOTE_PLUGIN_ID> \
+  --confirm-account-mutation
+```
+
+Cleanup does not require analytics capture or a debug Codex binary. When the
+smoke uses global `--config` overrides, its printed recovery command preserves
+them so cleanup targets the same backend and account.
+
+## Watching Raw Inbound Traffic
+
+Initialize a connection, then print every inbound JSON-RPC message until you stop it with
+`Ctrl+C`:
+
+```bash
+cargo run -p codex-app-server-test-client -- watch
+```
+
+## Testing Thread Rejoin Behavior
+
+Build and start an app server using commands above. The app-server log is written to `/tmp/codex-app-server-test-client/app-server.log`
+
+### 1) Get a thread id
+
+Create at least one thread, then list threads:
+
+```bash
+cargo run -p codex-app-server-test-client -- send-message-v2 "seed thread for rejoin test"
+cargo run -p codex-app-server-test-client -- thread-list --limit 5
+```
+
+Copy a thread id from the `thread-list` output.
+
+### 2) Rejoin while a turn is in progress (two terminals)
+
+Terminal A:
+
+```bash
+cargo run --bin codex-app-server-test-client -- \
+  resume-message-v2 <THREAD_ID> "respond with thorough docs on the rust core"
+```
+
+Terminal B (while Terminal A is still streaming):
+
+```bash
+cargo run --bin codex-app-server-test-client -- thread-resume <THREAD_ID>
+```

codex-rs/app-server/BUILD.bazel

@@ -0,0 +1,31 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server",
+    crate_name = "codex_app_server",
+    extra_binaries = [
+        "//codex-rs/bwrap:bwrap",
+        "//codex-rs/code-mode-host:codex-code-mode-host",
+        "//codex-rs/rmcp-client:test_stdio_server",
+    ],
+    extra_binaries_non_windows = [
+        "//codex-rs/cli:codex",
+    ],
+    integration_test_timeout = "long",
+    run_tests_with_wine_exec = True,
+    test_shard_counts = {
+        # Note app-server-all-test has a large number of integration tests, so
+        # even a single shard can be quite slow. When there is a legitimate
+        # test failure in a shard, it will still get run 3x in total, which
+        # can cause us to exhaust our CI timeout if the shard happens to run
+        # long. Using a higher shard count for app-server-all-test should help
+        # mitigate this risk.
+        "app-server-all-test": 16,
+        "app-server-unit-tests": 8,
+    },
+    test_tags = ["no-sandbox"],
+    test_threads = select({
+        "@platforms//os:macos": 1,
+        "//conditions:default": 0,
+    }),
+)

codex-rs/app-server/Cargo.toml

@@ -0,0 +1,155 @@
+[package]
+name = "codex-app-server"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[[bin]]
+name = "codex-app-server"
+path = "src/main.rs"
+
+[[bin]]
+name = "codex-app-server-test-notify-capture"
+path = "src/bin/notify_capture.rs"
+
+[[bin]]
+name = "exec-server"
+path = "src/bin/exec_server.rs"
+
+[lib]
+name = "codex_app_server"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+base64 = { workspace = true }
+axum = { workspace = true, default-features = false, features = [
+    "http1",
+    "json",
+    "tokio",
+    "ws",
+] }
+codex-analytics = { workspace = true }
+codex-agent-extension = { workspace = true }
+codex-arg0 = { workspace = true }
+codex-aws-auth = { workspace = true }
+codex-cloud-config = { workspace = true }
+codex-code-mode = { workspace = true }
+codex-config = { workspace = true }
+codex-network-proxy = { workspace = true }
+codex-connectors = { workspace = true }
+codex-core = { workspace = true }
+codex-core-plugins = { workspace = true }
+codex-diagnostics = { workspace = true }
+codex-home = { workspace = true }
+codex-exec-server = { workspace = true }
+codex-extension-api = { workspace = true }
+codex-external-agent-migration = { workspace = true }
+codex-features = { workspace = true }
+codex-goal-extension = { workspace = true }
+codex-git-attribution = { workspace = true }
+codex-guardian-v2 = { workspace = true }
+codex-git-utils = { workspace = true }
+codex-file-watcher = { workspace = true }
+codex-hooks = { workspace = true }
+codex-history-notes-extension = { workspace = true }
+codex-http-client = { workspace = true }
+codex-otel = { workspace = true }
+codex-plugin = { workspace = true }
+codex-shell-command = { workspace = true }
+codex-skills = { workspace = true }
+codex-skills-extension = { workspace = true }
+codex-utils-cli = { workspace = true }
+codex-user-verification = { workspace = true }
+codex-utils-pty = { workspace = true }
+codex-backend-client = { workspace = true }
+codex-file-search = { workspace = true }
+codex-chatgpt = { workspace = true }
+codex-login = { workspace = true }
+codex-image-generation-extension = { workspace = true }
+codex-memories-extension = { workspace = true }
+codex-web-search-extension = { workspace = true }
+codex-memories-write = { workspace = true }
+codex-mcp = { workspace = true }
+codex-mcp-extension = { workspace = true }
+codex-model-provider = { workspace = true }
+codex-model-provider-info = { workspace = true }
+codex-models-manager = { workspace = true }
+codex-protocol = { workspace = true }
+codex-queue-extension = { workspace = true }
+codex-app-server-protocol = { workspace = true }
+codex-app-server-transport = { workspace = true }
+codex-feedback = { workspace = true }
+codex-rmcp-client = { workspace = true }
+codex-rollout = { workspace = true }
+codex-sandboxing = { workspace = true }
+codex-state = { workspace = true }
+codex-thread-store = { workspace = true }
+codex-tools = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-json-to-toml = { workspace = true }
+codex-utils-path-uri = { workspace = true }
+chrono = { workspace = true }
+clap = { workspace = true, features = ["derive"] }
+futures = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+sha2 = { workspace = true }
+tempfile = { workspace = true }
+thiserror = { workspace = true }
+time = { workspace = true }
+toml = { workspace = true }
+toml_edit = { workspace = true }
+tokio = { workspace = true, features = [
+    "io-std",
+    "macros",
+    "process",
+    "rt-multi-thread",
+    "signal",
+] }
+tokio-util = { workspace = true }
+tracing = { workspace = true, features = ["log"] }
+tracing-subscriber = { workspace = true, features = ["env-filter", "fmt", "json"] }
+url = { workspace = true }
+uuid = { workspace = true, features = ["serde", "v7"] }
+
+[target.'cfg(all(target_os = "linux", target_env = "musl", any(target_arch = "x86_64", target_arch = "aarch64")))'.dependencies]
+tikv-jemallocator = { workspace = true }
+
+[target.'cfg(windows)'.dependencies]
+codex-windows-sandbox = { workspace = true }
+
+[dev-dependencies]
+codex-uds = { workspace = true }
+app_test_support = { workspace = true }
+axum = { workspace = true, default-features = false, features = [
+    "http1",
+    "json",
+    "tokio",
+] }
+base64 = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
+core_test_support = { workspace = true }
+flate2 = { workspace = true }
+hmac = { workspace = true }
+http = { workspace = true }
+opentelemetry = { workspace = true }
+opentelemetry_sdk = { workspace = true }
+pretty_assertions = { workspace = true }
+rmcp = { workspace = true, default-features = false, features = [
+    "elicitation",
+    "server",
+    "transport-streamable-http-server",
+] }
+serial_test = { workspace = true }
+shlex = { workspace = true }
+sqlx = { workspace = true }
+tar = { workspace = true }
+test-case = "3.3.1"
+tokio-tungstenite = { workspace = true }
+tracing-opentelemetry = { workspace = true }
+wiremock = { workspace = true }

codex-rs/app-server/README.md

@@ -0,0 +1,285 @@
+# MCP App UI
+
+`mcpToolCall.mcpAppUi` records the invoked descriptor's `resourceUri`
+and `preferredModelDisplayMode` (`inline` or `fullscreen`). Descriptors with a widget
+URI default to `inline` when the preference is missing or unsupported. The
+UI information is preserved in tool-call events and saved history so clients can
+render without waiting for the full MCP catalog.
+
+The field is null for older history and tools that declare widgets only in
+result metadata; clients retain catalog discovery for those calls. Existing
+resource URI fields remain available for older clients.
+
+# Initial Daybreak choice (experimental)
+
+Persistent threads accept `daybreakEnabled` on `thread/start` with the
+`experimentalApi` opt-in. The response and `thread/started` notification both
+include the initial choice in `thread.daybreakEnabled`. The choice is staged
+with the thread's other initial metadata and saved when the thread is persisted.
+An unused thread is not guaranteed to survive restart. Omitted or null leaves
+the choice unset. Ephemeral threads cannot save it.
+Use `thread/metadata/update` for later changes. This preference does not select
+`turn/start.cyberAccessProgram` or grant access to an access program.
+
+# User verification cancellation (experimental)
+
+Local UI clients can cancel a native user-verification RPC by sending
+`userVerification/cancel` with `{requestId}` and the `experimentalApi` opt-in.
+The result is an empty acknowledgment (`{}`). This API does not enable desktop
+verification capability advertisement.
+
+`requestId` is the original status, enroll, delete, or verify RPC's string or
+integer ID on the same connection, not the server elicitation ID. Use fresh IDs
+for each operation and a distinct ID for the cancel RPC. Unknown, finished,
+unrelated, and other-connection requests are no-ops.
+
+The acknowledgment confirms the cancellation signal without waiting for the OS
+prompt to close. The original RPC completes independently, with
+`cancelled/interrupted` when cancellation prevents completion. Cancellation
+cannot roll back completed effects. It remains effective while a proof waits for
+outbound queue capacity, but cannot retract a response already enqueued.
+
+Canceling or resolving an elicitation does not itself stop a separate
+`userVerification/verify` RPC. Clients must cancel that RPC separately and discard
+late proofs after the approval is canceled or resolved. Only one native worker
+runs per app-server; if an OS call remains active after cancellation or timeout,
+subsequent local operations return `failed/providerError` until that worker exits.
+
+# Hosted Codex Apps MCP protocol
+
+The host-owned HTTP `codex_apps` server uses Legacy by default in app-server and
+standalone Codex. To discover the 2026-07-28 protocol, set
+`codex_apps_mcp_2026_07_28 = true` under `[features]`, or send a true runtime
+override via `experimentalFeature/enablement/set`. Discovery falls back to Legacy
+when the server does not support it. Explicit config takes precedence.
+The dedicated setting does not apply to third-party HTTP or local `codex_app`
+stdio servers. The existing `mcp_2026_07_28` flag still governs eligible other
+servers, regardless of whether their names or URLs resemble hosted Apps.
+App-server does not persist this selection.
+
+# Thread removal
+
+`thread/archive` and `thread/delete` reject attempts to remove a live internal
+worker with JSON-RPC error `-32600`. The worker's owner controls its shutdown.
+For example, a Guardian reviewer remains available to its parent conversation
+after a client tries to archive or delete it.
+
+After the owner releases the worker, its saved conversation can be archived or
+deleted normally. Ordinary client-controlled threads keep their existing behavior.
+
+## User verification (experimental)
+
+Codex app-server advertises `openai/elicitation.userVerification` to the
+host-owned plugin service for bundled, in-process TUI sessions (`codex-tui`) and
+local stdio desktop sessions (`Codex Desktop`) on devices with supported biometric
+hardware and the `experimentalApi` opt-in. This is an app-server decision,
+independent of whether a key exists; TUI/Desktop/mobile do not advertise this MCP
+capability. Mobile integration requires a separate rollout. Other clients and
+network connections do not receive this mode, even with a recognized client name.
+Before sending verification requests to desktop sessions, deploy a GUI that
+handles the typed verification request, cancellation, and late proofs. The general
+`experimentalApi` opt-in does not identify a compatible GUI version.
+
+Local UI clients use five methods. They require the existing
+`experimentalApi` opt-in. The local provider reports
+`unavailable/providerUnavailable` on unsupported platforms or without the required
+ChatGPT account identity.
+
+| Method | Params | Result |
+| --- | --- | --- |
+| `userVerification/status` | `{}` | `{credentialId, unavailableReason, unavailableMessage}` |
+| `userVerification/enroll` | `{}` | `{credentialId, algorithm?, publicKey?}` |
+| `userVerification/delete` | `{}` | `{}` |
+| `userVerification/verify` | `{challenge, title, description}` | `{proof: {credentialId, signature}}` |
+| `userVerification/cancel` | `{requestId}` | `{}` |
+
+Status reads local readiness without prompting or contacting a backend. A null
+`unavailableReason` means local checks passed, not that registration is valid.
+Unsupported platforms and missing account identity are reported in the status
+response's `unavailableReason` field.
+Enrollment creates or reuses the local key and returns its public metadata. The
+`publicKey` is unpadded base64url SPKI-DER; `algorithm` is `ecdsaP256Sha256X962`.
+During the experimental rollout, `algorithm` and `publicKey` are optional for
+compatibility with older app-servers. Current servers populate both fields;
+callers must check that both are present and non-null before backend registration.
+The trusted UI host owns backend registration: obtain an enrollment challenge,
+sign it with `userVerification/verify`, check that the proof's `credentialId`
+matches this response, and submit the public metadata and proof to the backend.
+Local success is not server enrollment. The caller must preserve the authenticated
+account across this flow and reconcile uncertain registration before retrying.
+Deletion removes the local key; the caller owns backend revocation.
+Enrollment and deletion coordinate credential lifecycle; callers do not issue
+separate generate or rotate commands. Identity comes from the authenticated
+account; this API exposes no caller-selected scope.
+
+Verify signs 1–4096 decoded challenge bytes using P-256 ECDSA with SHA-256. The
+challenge and DER signature use unpadded base64url. Title is 1–256 UTF-8 bytes;
+description is at most 4096 bytes. The UI obtains approval for that display
+context before calling. Verify does not require a pending elicitation; a UI with
+its own authenticator can return proof directly in elicitation response content.
+The calling flow owns pending-request checks and discards late proofs.
+Native enroll, delete, and verify accept local stdio and in-process connections.
+WebSocket and remote-control peers must use their own device authenticator;
+status remains available for local readiness. Dropping an embedded RPC, disconnecting,
+or changing authentication cancels its native operation. Responses recheck the
+captured identity after waiting for outbound queue capacity.
+Canceling or resolving an elicitation does not itself stop a separate
+`userVerification/verify` RPC. The GUI must use `userVerification/cancel` to
+cancel that RPC and discard late proofs when an approval is canceled or resolved.
+See [User verification cancellation](#user-verification-cancellation-experimental)
+for request ID and acknowledgment semantics.
+Only one native worker runs per app-server. If an OS call remains active after
+cancellation or timeout, subsequent local operations return `failed/providerError`
+until that worker exits.
+
+Failures use the normal JSON-RPC error envelope with closed `{type, reason}` data:
+`invalidRequest`, `unavailable`, `cancelled`, or `failed`. UI clients branch on
+these values rather than message text. Native diagnostic payloads stay private.
+
+## Managed model provider requirements
+
+Existing threads retain their provider configuration. Input RPCs reject requests when managed
+`model_provider` or `model_providers` requirements no longer match that configuration, or cannot
+be loaded. This covers turn start/steer, review, compaction, manual queue start, and active goal
+updates. Realtime connections use separate routing configuration and are not checked here.
+Interrupt, realtime stop, and goal pause/clear remain available. User and project
+configuration changes alone do not invalidate existing threads.
+
+# Amazon Bedrock authentication
+
+If `model_providers.amazon-bedrock.aws.credential_export` is configured, Bedrock setup and
+Bedrock login return an error without changing configuration or saved credentials. Remove the
+exporter configuration before selecting another credential source. `aws.credential_export` and
+`aws.profile` cannot be configured together.
+
+## Stored thread attachments
+
+- `thread/attachment/add` — add a durable resource reference to a stored thread without loading it. Repeated writes with the same attachment type and identity key return the existing attachment.
+- `thread/attachment/list` — list attachments for one stored thread in a cursor-paginated request, including a thread that is not loaded.
+- `thread/attachment/remove` — remove an attachment by its thread, attachment type, and identity key; returns `{}`.
+- `thread/attachment/updated` — notification broadcast after an attachment is created or removed; contains the thread, attachment identity, attachment id, and operation.
+### Example: Manage stored thread attachments
+
+Attachments record the resources currently associated with a thread, independently of conversation history. Clients can add, remove, and list attachments for one stored thread at a time without resuming those threads. Adding or removing an attachment does not create or delete the underlying resource or rewrite history. An attachment is idempotently identified by its thread, `attachmentType`, and `identityKey`. For pull requests, clients should reuse the canonical application identity `JSON.stringify([canonicalHostname, lowercaseOwner, lowercaseRepository, pullRequestNumber])` so addition and removal agree across surfaces.
+
+```json
+{ "method": "thread/attachment/add", "id": 20, "params": {
+    "threadId": "thr_123",
+    "attachmentType": "pull_request",
+    "identityKey": "[\"github.com\",\"openai\",\"codex\",123]",
+    "payload": { "url": "https://github.com/openai/codex/pull/123" }
+} }
+{ "id": 20, "result": {
+    "outcome": "created",
+    "attachment": {
+        "id": "01984de2-8f74-7c91-a3b2-5c5e937cf318",
+        "attachmentType": "pull_request",
+        "identityKey": "[\"github.com\",\"openai\",\"codex\",123]",
+        "payload": { "url": "https://github.com/openai/codex/pull/123" },
+        "createdAt": 1750000000
+    }
+} }
+
+{ "method": "thread/attachment/list", "id": 21, "params": {
+    "threadId": "thr_123",
+    "limit": 100
+} }
+{ "id": 21, "result": {
+    "data": [{
+        "id": "01984de2-8f74-7c91-a3b2-5c5e937cf318",
+        "attachmentType": "pull_request",
+        "identityKey": "[\"github.com\",\"openai\",\"codex\",123]",
+        "payload": { "url": "https://github.com/openai/codex/pull/123" },
+        "createdAt": 1750000000
+    }],
+    "nextCursor": null
+} }
+
+{ "method": "thread/attachment/remove", "id": 22, "params": {
+    "threadId": "thr_123",
+    "attachmentType": "pull_request",
+    "identityKey": "[\"github.com\",\"openai\",\"codex\",123]"
+} }
+{ "id": 22, "result": {} }
+
+{ "method": "thread/attachment/updated", "params": {
+    "threadId": "thr_123",
+    "attachmentType": "pull_request",
+    "identityKey": "[\"github.com\",\"openai\",\"codex\",123]",
+    "attachmentId": "01984de2-8f74-7c91-a3b2-5c5e937cf318",
+    "operation": "deleted"
+} }
+```
+
+`thread/attachment/list` accepts one `threadId` and returns at most 100 attachments per page, ordered by creation time and attachment id. Continue with `nextCursor` and the same `threadId` until the cursor is `null`. Each thread can retain up to 100 attachments. Removing an attachment frees a slot for a new attachment.
+
+A non-ephemeral fork copies the source thread's current attachments, even when forking at an earlier turn. The copies have new attachment IDs and creation timestamps, but retain the same resource identities and payloads. Clients use `forkedFromId` on `thread/started` to detect forks and call `thread/attachment/list` with the new thread ID to load their attachments. Fork copying does not emit per-attachment updates; explicit add/remove operations still do. Copying is awaited before publishing the fork, but is best effort: a copy failure is logged and the conversation fork succeeds without attachments. Membership can then change independently on either thread; the referenced resources themselves are not copied. Resuming a fork does not repeat the copy.
+
+Attachment creation and deletion requests using the same thread ID are serialized across connections. The requesting client receives its response before the compact update is broadcast, and duplicate creates or absent deletes do not emit updates. Deleting the owning thread removes its attachments under the same lifecycle exclusion; queued attachment mutations then report that the thread was not found.
+
+# Thread plugin settings
+
+`thread/settings/update` and `turn/start` accept `disabledPluginIds`, a list of
+`PluginSummary.id` values from `plugin/list`, in the
+`<plugin-name>@<marketplace-name>` format. A supplied list replaces the selection;
+omission or `null` preserves it, and `[]` clears it. Saving this selection does
+not yet filter plugin capabilities.
+
+Read the selection from `threadSettings.disabledPluginIds` in
+`thread/settings/updated` notifications, or from `disabledPluginIds` in
+`thread/start`, `thread/resume`, and `thread/fork` responses. Selections persist
+across resume. Forks restore the selection from the history retained at the
+requested fork boundary.
+
+# Deprecated thread personality setting
+
+`thread/start`, `thread/resume`, `thread/settings/update`, and `turn/start` still
+accept `personality`, but `friendly` and `pragmatic` no longer select a style.
+`model/list` returns `supportsPersonality: false` for every model.
+
+`none` removes the literal `# Personality` section when Codex prepares
+instructions from the model catalog, for example when starting a thread or
+switching models. Setting `friendly` or `pragmatic` can replace a previous
+`none` setting for that purpose. Changing the setting does not rewrite the
+thread's existing instructions or change explicitly supplied base instructions.
+The old `features.personality` flag is ignored.
+
+# MCP server capabilities
+
+`mcpServerStatus/list` returns `serverCapabilities` for each initialized MCP server
+in both `full` and `toolsAndAuthOnly` detail modes, including thread-scoped reads.
+This is the server's advertised MCP capabilities object, including its `extensions`
+map. It is null when the connection has not initialized successfully; capabilities
+are never inferred from tools or copied from a shared catalog cache.
+
+# Thread rollback
+
+`thread/rollback` has been removed from the API, including its request and response
+types. Requests use the generic unknown-method rejection path. Use `thread/revert`
+for paginated threads instead.
+
+Existing rollouts may contain historical `ThreadRolledBack` events. Their replay
+and migration remain supported so resuming, reading, and forking those threads
+preserves the surviving history. This disk compatibility does not require restoring
+support for new `thread/rollback` requests.
+
+# Selected workspace routing
+
+The experimental `account/read.workspaceRouting` response field returns the selected ChatGPT workspace's `chatgptAccountId`, resolved HTTPS `backendOrigin`, and backend-provided `accountRoutingOverride`. The routing value is `us`, `us_cr`, or the explicit `NO_CONSTRAINT` value. API-only and signed-out accounts return `null` and do not need `accounts/check`.
+
+App-server discovers routing for saved ChatGPT logins at startup and for new logins or workspace switches. After requirements and routing are ready, it sends the existing `account/updated` notification. Newly initialized connections also receive this notification once saved-workspace routing is ready, including when discovery finished before the connection initialized. Clients then reread `configRequirements/read` and `account/read`. Saved ChatGPT credentials without a selected workspace ID retain their account information and return `workspaceRouting: null`; app-server does not guess a workspace from the backend's default account. Discovery failures for a selected workspace, including missing or null fields from older backends, return an `account/read` error. They never produce a successful unrestricted result. A later read retries failed discovery. Logout clears the cached routing, and results from earlier authentication owners are discarded. Token refreshes for the same known user and workspace invalidate cached routing without cancelling discovery or failing sign-in. Configuration is reloaded after discovery; a changed backend, model provider, or required backend rejects the result so the next read discovers against current configuration. Account notifications recheck the auth owner generation after waiting for outbound queue capacity. Superseded sign-in attempts emit a failed `account/login/completed` event instead of silently dropping completion. Notifications remain snapshots: clients reread current account and requirements state rather than treating a queued notification as authorization.
+
+The origin of a required `chatgpt_base_url` must match the discovered origin by scheme, host, and effective port. The base URL's API path is not part of this comparison. Either origin alone is sufficient. If requirements specify no base URL and discovery explicitly returns `NO_CONSTRAINT`, the effective `chatgpt_base_url` supplies the origin, including its existing default. `backendOrigin` is always a resolved origin; `accountRoutingOverride` preserves `NO_CONSTRAINT` when the backend explicitly returns it. Discovering an origin does not change API paths or apply routing headers to requests.
+
+## Windows sandbox implementation selection
+
+`windowsSandbox/setupStart` and `windowsSandbox/readiness` apply only to the
+legacy `elevated` and `unelevated` backends. Clients resolve the desired sandbox
+implementation from configuration. When it is `mxc`, they skip both methods;
+`allowedWindowsSandboxImplementations` can allow `mxc` independently of the
+legacy setup modes. Non-Windows hosts report `notConfigured` for the legacy
+readiness API.
+
+MXC uses the standard `command/exec` streaming and process-control path, including
+ConPTY when `tty` is enabled. The buffered legacy Windows sandbox restrictions on
+process control and custom output caps do not apply to MXC.

codex-rs/apply-patch/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "apply-patch",
+    crate_name = "codex_apply_patch",
+)

codex-rs/apply-patch/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "codex-apply-patch"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+name = "codex_apply_patch"
+path = "src/lib.rs"
+doctest = false
+
+[[bin]]
+name = "apply_patch"
+path = "src/main.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+codex-exec-server = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-path-uri = { workspace = true }
+similar = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt"] }
+tree-sitter = { workspace = true }
+tree-sitter-bash = { workspace = true }
+
+[dev-dependencies]
+assert_cmd = { workspace = true }
+assert_matches = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
+pretty_assertions = { workspace = true }
+tempfile = { workspace = true }

codex-rs/arg0/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "arg0",
+    crate_name = "codex_arg0",
+)

codex-rs/arg0/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "codex-arg0"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+name = "codex_arg0"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+codex-apply-patch = { workspace = true }
+codex-async-utils = { workspace = true }
+codex-exec-server = { workspace = true }
+codex-install-context = { workspace = true }
+codex-linux-sandbox = { workspace = true }
+codex-sandboxing = { workspace = true }
+codex-shell-escalation = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-home-dir = { workspace = true }
+dotenvy = { workspace = true }
+tempfile = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread"] }
+
+[target.'cfg(windows)'.dependencies]
+codex-windows-sandbox = { workspace = true }
+pathdiff = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }

codex-rs/async-utils/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "async-utils",
+    crate_name = "codex_async_utils",
+)

codex-rs/async-utils/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "codex-async-utils"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
+tokio-util.workspace = true
+
+[dev-dependencies]
+pretty_assertions.workspace = true
+
+[lib]
+doctest = false

codex-rs/attachment-store/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "attachment-store",
+    crate_name = "codex_attachment_store",
+)

codex-rs/attachment-store/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-attachment-store"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "codex_attachment_store"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+serde = { workspace = true, features = ["derive"] }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt", "sync"] }

codex-rs/aws-auth/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "aws-auth",
+    crate_name = "codex_aws_auth",
+)

codex-rs/aws-auth/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-aws-auth"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "codex_aws_auth"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+aws-config = { workspace = true, features = ["credentials-login"] }
+aws-credential-types = { workspace = true }
+aws-sigv4 = { workspace = true }
+aws-types = { workspace = true }
+bytes = { workspace = true }
+http = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

codex-rs/backend-client/BUILD.bazel

@@ -0,0 +1,7 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "backend-client",
+    compile_data = glob(["tests/fixtures/**"]),
+    crate_name = "codex_backend_client",
+)

codex-rs/backend-client/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "codex-backend-client"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish = false
+
+[lib]
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = "1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+http = { workspace = true }
+url = { workspace = true }
+codex-backend-openapi-models = { path = "../codex-backend-openapi-models" }
+codex-api = { workspace = true }
+codex-http-client = { workspace = true }
+codex-login = { workspace = true }
+codex-model-provider = { workspace = true }
+codex-protocol = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = "1"
+tokio = { workspace = true, features = ["macros", "rt"] }
+wiremock = { workspace = true }

codex-rs/build-info/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "build-info",
+    crate_name = "codex_build_info",
+)

codex-rs/build-info/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-build-info"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "codex_build_info"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-install-context = { workspace = true }
+semver = { workspace = true, features = ["serde"] }
+serde = { workspace = true, features = ["derive"] }
+sha2 = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+serde_json = { workspace = true }
+tempfile = { workspace = true }

codex-rs/build-info/build.rs

@@ -0,0 +1,8 @@
+//! Embed the compilation target, including its architecture and ABI.
+
+fn main() -> Result<(), std::env::VarError> {
+    let target = std::env::var("TARGET")?;
+    println!("cargo:rustc-env=CODEX_BUILD_TARGET={target}");
+    println!("cargo:rerun-if-changed=build.rs");
+    Ok(())
+}

codex-rs/chatgpt/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "chatgpt",
+    crate_name = "codex_chatgpt",
+)

codex-rs/chatgpt/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "codex-chatgpt"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+clap = { workspace = true, features = ["derive"] }
+codex-connectors = { workspace = true }
+codex-core = { workspace = true }
+codex-git-utils = { workspace = true }
+codex-http-client = { workspace = true }
+codex-login = { workspace = true }
+codex-model-provider = { workspace = true }
+codex-plugin = { workspace = true }
+codex-utils-cli = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+tokio = { workspace = true, features = ["full"] }
+
+[dev-dependencies]
+codex-utils-cargo-bin = { workspace = true }
+pretty_assertions = { workspace = true }
+serde_json = { workspace = true }
+tempfile = { workspace = true }
+
+[lib]
+doctest = false

codex-rs/chatgpt/README.md

@@ -0,0 +1,5 @@
+# ChatGPT
+
+This crate pertains to first party ChatGPT APIs and products such as Codex agent.
+
+This crate is built and maintained by OpenAI employees. External code contributions are not accepted; please report bugs and request features in the [Codex issue tracker](https://github.com/openai/codex/issues).

codex-rs/cli/BUILD.bazel

@@ -0,0 +1,23 @@
+load("//:defs.bzl", "MACOS_WEBRTC_RUSTC_LINK_FLAGS", "codex_rust_crate")
+load("//bazel/platforms:release_binaries.bzl", "multiplatform_binaries")
+load("//bazel/rules:e2e_benchmark.bzl", "codex_e2e_benchmark")
+
+codex_rust_crate(
+    name = "cli",
+    binaries_with_build_commit = ["codex"],
+    crate_name = "codex_cli",
+    extra_binaries = [
+        "//codex-rs/bwrap:bwrap",
+    ],
+    rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
+    test_data_extra = glob(["src/**/snapshots/**"]),
+)
+
+multiplatform_binaries(
+    name = "codex",
+)
+
+codex_e2e_benchmark(
+    name = "codex-help",
+    binaries = [":codex"],
+)

codex-rs/cli/Cargo.toml

@@ -0,0 +1,138 @@
+[package]
+name = "codex-cli"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+build = "build.rs"
+default-run = "codex"
+
+[[bin]]
+name = "codex"
+path = "src/main.rs"
+
+[[bin]]
+name = "logs_client"
+path = "src/bin/logs_client.rs"
+
+[lib]
+name = "codex_cli"
+path = "src/lib.rs"
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+chrono = { workspace = true }
+clap = { workspace = true, features = ["derive", "env"] }
+clap_complete = { workspace = true }
+codex-app-server = { workspace = true }
+codex-app-server-daemon = { workspace = true }
+codex-app-server-protocol = { workspace = true }
+codex-app-server-test-client = { workspace = true }
+codex-arg0 = { workspace = true }
+codex-build-info = { workspace = true }
+codex-api = { workspace = true }
+codex-aws-auth = { workspace = true }
+codex-chatgpt = { workspace = true }
+codex-cloud-config = { workspace = true }
+codex-cloud-tasks = { path = "../cloud-tasks" }
+codex-utils-cli = { workspace = true }
+codex-config = { workspace = true }
+codex-core = { workspace = true }
+codex-core-plugins = { workspace = true }
+codex-history = { workspace = true }
+codex-home = { workspace = true }
+codex-http-client = { workspace = true }
+codex-exec = { workspace = true }
+codex-exec-server = { workspace = true }
+codex-execpolicy = { workspace = true }
+codex-extension-api = { workspace = true }
+codex-features = { workspace = true }
+codex-git-attribution = { workspace = true }
+codex-git-utils = { workspace = true }
+codex-install-context = { workspace = true }
+codex-login = { workspace = true }
+codex-memories-write = { workspace = true }
+codex-mcp = { workspace = true }
+codex-model-provider = { workspace = true }
+codex-models-manager = { workspace = true }
+codex-plugin = { workspace = true }
+codex-protocol = { workspace = true }
+codex-responses-api-proxy = { workspace = true }
+codex-tcp-tunnel = { workspace = true }
+codex-rmcp-client = { workspace = true }
+codex-rollout = { workspace = true }
+codex-rollout-trace = { workspace = true }
+codex-sandboxing = { workspace = true }
+codex-skills-extension = { workspace = true }
+codex-state = { workspace = true }
+codex-stdio-to-uds = { workspace = true }
+codex-terminal-detection = { workspace = true }
+codex-thread-store = { workspace = true }
+codex-tui = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
+codex-utils-path = { workspace = true }
+codex-utils-path-uri = { workspace = true }
+crossterm = { workspace = true, features = ["event-stream"] }
+futures = { workspace = true }
+http = { workspace = true }
+libc = { workspace = true }
+os_info = { workspace = true }
+owo-colors = { workspace = true }
+regex-lite = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+supports-color = { workspace = true }
+sys-locale = { workspace = true }
+tempfile = { workspace = true }
+tokio = { workspace = true, features = [
+    "io-std",
+    "macros",
+    "net",
+    "process",
+    "rt-multi-thread",
+    "signal",
+    "time",
+] }
+toml = { workspace = true }
+tracing = { workspace = true }
+tracing-appender = { workspace = true }
+tracing-subscriber = { workspace = true }
+unicode-segmentation = { workspace = true }
+url = { workspace = true }
+which = { workspace = true }
+
+[target.'cfg(all(target_os = "linux", target_env = "musl", any(target_arch = "x86_64", target_arch = "aarch64")))'.dependencies]
+tikv-jemallocator = { workspace = true }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+codex_windows_sandbox = { package = "codex-windows-sandbox", path = "../windows-sandbox-rs" }
+windows-sys = { version = "0.52", features = [
+    "Win32_Foundation",
+    "Win32_Storage_Packaging_Appx",
+    "Win32_System_Console",
+    "Win32_System_Threading",
+] }
+
+[dev-dependencies]
+app_test_support = { workspace = true }
+assert_cmd = { workspace = true }
+assert_matches = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
+codex-utils-pty = { workspace = true }
+flate2 = { workspace = true }
+insta = { workspace = true }
+predicates = { workspace = true }
+pretty_assertions = { workspace = true }
+sqlx = { workspace = true }
+tar = { workspace = true }
+tokio-tungstenite = { workspace = true }
+wiremock = { workspace = true }
+zstd = { workspace = true }
+
+[package.metadata.cargo-shear]
+# These Rust sources are intentionally Bazel-only macrobenchmarks rather than
+# Cargo targets.
+ignored-paths = ["e2e_benches/*.rs"]

codex-rs/cli/build.rs

@@ -0,0 +1,5 @@
+fn main() {
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() == Ok("macos") {
+        println!("cargo:rustc-link-arg=-ObjC");
+    }
+}

codex-rs/cloud-tasks-client/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "cloud-tasks-client",
+    crate_name = "codex_cloud_tasks_client",
+)

codex-rs/cloud-tasks-client/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-cloud-tasks-client"
+version.workspace = true
+
+[lib]
+name = "codex_cloud_tasks_client"
+path = "src/lib.rs"
+test = false
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+chrono = { workspace = true, features = ["serde"] }
+codex-api = { workspace = true }
+codex-backend-client = { workspace = true }
+codex-git-utils = { workspace = true }
+codex-http-client = { workspace = true }
+serde = { version = "1", features = ["derive"] }
+serde_json = { workspace = true }
+thiserror = { workspace = true }

codex-rs/cloud-tasks-mock-client/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "cloud-tasks-mock-client",
+    crate_name = "codex_cloud_tasks_mock_client",
+)

codex-rs/cloud-tasks-mock-client/Cargo.toml

@@ -0,0 +1,20 @@
+
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-cloud-tasks-mock-client"
+version.workspace = true
+
+[lib]
+name = "codex_cloud_tasks_mock_client"
+path = "src/lib.rs"
+test = false
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+chrono = { workspace = true }
+codex-cloud-tasks-client = { workspace = true }
+diffy = { workspace = true }

codex-rs/cloud-tasks/BUILD.bazel

@@ -0,0 +1,7 @@
+load("//:defs.bzl", "MACOS_WEBRTC_RUSTC_LINK_FLAGS", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "cloud-tasks",
+    crate_name = "codex_cloud_tasks",
+    rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
+)