Skip to content

refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering#101221

Merged
steipete merged 8 commits into
mainfrom
claude/great-mendeleev-de4d3b
Jul 7, 2026
Merged

refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering#101221
steipete merged 8 commits into
mainfrom
claude/great-mendeleev-de4d3b

Conversation

@steipete

@steipete steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

The Codex app-server integration accumulated compat paths for app-server versions OpenClaw no longer runs, plus protocol-drift defenses that never matched the wire format. The declared floor was 0.125.0 while the managed binary pin is 0.142.5, so every OpenClaw install runs a 0.142-train server, yet runtime code still carried pre-0.131/0.137 branches and speculative snake_case/alias fallbacks. Separately, the Codex-native subagent bridge was broken live: models asked to use native spawn_agent used OpenClaw sessions_spawn instead, so codex-native task records were never created (the live bridge probe failed 3/3 on main).

This partially supersedes #93313, which is closed; its remaining pieces (SQLite binding store, turn router/client-runtime) continue as dedicated follow-ups.

Why This Change Was Made

Every deletion was verified against the pinned upstream source (openai/codex at origin/release/0.142):

  • Floor raised to 0.142.0 (extensions/codex/src/app-server/version.ts); the sandbox exec-server 0.132 gate is now always-true and removed.
  • persistExtendedHistory senders/fields removed — retired upstream in 0.137.
  • Thread idsessionId alias normalizer removed — sessionId is required on Thread since 0.131 (thread_data.rs); a missing sessionId now fails validation loudly.
  • Legacy flat dynamicTools downgrade removed — normalize_dynamic_tool_specs accepts canonical typed specs at the floor, so thread/start sends them.
  • Event-projector drift debris removed: six token-usage key variants (v2 ThreadTokenUsage is {total, last, modelContextWindow} since at least 0.121), turn_id/will_retry snake_case fallbacks (all v2 serde is camelCase), itemId ?? id legs, phase/item reads on delta notifications (fields never on the wire), and the item/fileChange/outputDelta handler (upstream: "server no longer emits").
  • conversationId fallback in the approval bridge and an id alias in the conversation turn collector removed (v1-era).
  • Typed CodexAppServerVersionError replaces string-matched version-error detection; unreachable approval branch in defaultServerRequestResponse deleted.
  • Shared-client legacy in-memory global-state migration deleted (plugin updates restart the gateway; state is process-stable).
  • Subagent task mirror's two parallel Sets folded into one Map<threadId, "mirrored" | "failed">.
  • Native subagent bridge fix: codex-rs defers V1 collab tools (including spawn_agent) behind tool_search on search-capable models (spec_plan.rs add_collaboration_tools, upstream fix(ui): strip reply directive tags from assistant messages in WebChat (#23053) #23144, since 0.133). OpenClaw's developer instructions demanded native spawn_agent without teaching the retrieval path, while sessions_spawn stayed always-direct — so models used the visible tool. The instructions now say: when spawn_agent is not directly listed, load it with tool_search first; sessions_spawn is never a substitute. Prompt snapshot fixtures regenerated on Linux.

Docs floors updated in docs/plugins/codex-harness.md, codex-harness-reference.md, codex-harness-runtime.md, and sdk-agent-harness.md.

User Impact

  • Custom appServer.command binaries older than 0.142.0 are now rejected at initialize with a clear error; the managed default binary (0.142.5) is unaffected. Requirements docs updated accordingly.
  • Codex-native subagents work again from OpenClaw threads on search-capable models: spawn_agent gets loaded via tool_search and child results are delivered as codex-native task records.
  • No other user-visible behavior change; net −333 lines with the protocol paths now matching the wire format exactly.

Evidence

  • Codex source checked (mandatory gate): codex-rs/app-server-protocol/src/protocol/v2/{thread,turn,item,thread_data,notification,model,shared,config,account}.rs, protocol/common.rs, codex-rs/protocol/src/dynamic_tools.rs, codex-rs/core/src/tools/spec_plan.rs, codex-rs/features/src/lib.rs, codex-rs/model-provider/src/provider.rs at origin/release/0.142; deferral provenance upstream commit b3ae3de405 (fix(ui): strip reply directive tags from assistant messages in WebChat (#23053) #23144).
  • Remote (Blacksmith Testbox): extensions/codex suite green — 91 files / 1911 tests (rerun after each rebase); prepared oxlint 0 errors; tsgo extensions lane green; full pnpm build green; prompt:snapshots:check current (regenerated on Linux); changed files oxfmt-clean.
  • Live (real OpenAI API key, docker gateway, @openai/codex 0.142.5, api-key auth): gateway-codex-harness.live.test.ts green including image/MCP/guardian probes; the native subagent bridge probe failed 3/3 before this branch (including twice on clean main) and passes 2/2 after the spawn_agent instruction fix.
  • Review: Codex CLI autoreview (gpt-5.5) clean on the branch bundle ("patch is correct", 0.83) plus scoped clean reviews of the alias-removal commit (0.88) and the spawn_agent fix commit (0.86).

Follow-ups tracked separately: SQLite session-binding store + doctor sidecar migration, and the turn-router/client-runtime/rate-limit-cache port (both re-implementations of the remaining #93313 design on current main).

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: codex size: L maintainer Maintainer-authored PR labels Jul 6, 2026
@clawsweeper

clawsweeper Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 6, 2026, 11:06 PM ET / 03:06 UTC.

Summary
The PR raises the bundled Codex app-server floor to 0.142.0, removes older protocol compatibility paths, updates Codex developer instructions for deferred native spawn_agent, refreshes tests/snapshots, and updates Codex harness docs.

PR surface: Source -214, Tests -119, Docs 0. Total -333 across 36 files.

Reproducibility: yes. for a source-level path: current main lacks the tool_search hint for native spawn_agent, while Codex release/0.142 defers V1 collaboration tools when search tools are enabled. I did not rerun the live OpenAI probe in this read-only review.

Review metrics: 1 noteworthy metric.

  • App-server compatibility floor: 0.125.0 -> 0.142.0. The minimum supported custom Codex app-server version is an upgrade-sensitive operator contract, not only an internal refactor.

Stored data model
Persistent data-model change detected: serialized state: extensions/codex/src/app-server/shared-client.ts, serialized state: extensions/codex/src/app-server/transport-websocket.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Resolve the current dirty merge state against main.
  • Get maintainer acceptance for rejecting custom app-server binaries below 0.142.0.

Risk before merge

  • [P1] Existing operators using a custom appServer.command below Codex app-server 0.142.0 would now fail at initialize instead of running through older compatibility paths.
  • [P1] The live PR is currently merge-conflicting against main, so the exact merge result still needs a rebase or conflict resolution before landing.

Maintainer options:

  1. Accept 0.142 after conflict resolution (recommended)
    Resolve the dirty merge state, then merge if maintainers accept that older custom app-server commands now fail at initialize.
  2. Keep older custom app-server support
    Restore the older compatibility paths or lower the floor if those custom binaries remain a supported operator path.
  3. Pause this refactor
    Leave this PR open or close it if maintainers want the related runtime-ownership follow-ups handled before changing the compatibility floor.

Next step before merge

  • [P2] The remaining blockers are maintainer acceptance of the compatibility floor and conflict resolution on a protected maintainer-labeled PR, not an automation-safe code repair from this review.

Maintainer decision needed

  • Question: Should this PR intentionally reject custom Codex app-server binaries older than 0.142.0 during initialize?
  • Rationale: The upstream source and managed package pin support the cleanup, but removing the older floor is an operator compatibility break that can stop existing custom app-server setups at startup.
  • Likely owner: steipete — steipete is the strongest history signal for the Codex app-server lifecycle surface and authored this compatibility-floor proposal.
  • Options:
    • Accept the 0.142 floor (recommended): Resolve the current merge conflict and land the PR with the documented startup rejection for custom binaries below 0.142.0.
    • Preserve older custom binaries: Restore the removed compatibility paths or keep the lower floor until a deprecation or migration path is chosen.
    • Pause for broader design: Hold this PR until the remaining runtime-ownership and remote-execution follow-ups settle the long-term app-server direction.

Security
Cleared: No concrete security or supply-chain regression was found; the diff does not change dependencies, lockfiles, workflows, secrets, or permissions, and known approval defaults remain fail-closed.

Review details

Best possible solution:

Land the single 0.142-aligned Codex app-server path after the merge conflict is resolved and maintainers explicitly accept the custom-binary floor change.

Do we have a high-confidence way to reproduce the issue?

Yes for a source-level path: current main lacks the tool_search hint for native spawn_agent, while Codex release/0.142 defers V1 collaboration tools when search tools are enabled. I did not rerun the live OpenAI probe in this read-only review.

Is this the best way to solve the issue?

Mostly yes: matching the runtime to the managed 0.142.5 app-server train is the cleanest way to delete stale protocol shims, provided maintainers accept the custom-binary compatibility break and the branch is rebased cleanly.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ad833d788305.

Label changes

Label justifications:

  • P2: This is a bounded Codex plugin refactor/fix with real compatibility impact but no emergency user-wide outage evidence.
  • merge-risk: 🚨 compatibility: Merging the PR can break existing custom appServer.command setups running Codex app-server versions below 0.142.0.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body reports real Docker gateway/live OpenAI API proof with @openai/codex 0.142.5, including before-failing and after-passing native subagent bridge probes.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body reports real Docker gateway/live OpenAI API proof with @openai/codex 0.142.5, including before-failing and after-passing native subagent bridge probes.
Evidence reviewed

PR surface:

Source -214, Tests -119, Docs 0. Total -333 across 36 files.

View PR surface stats
Area Files Added Removed Net
Source 15 96 310 -214
Tests 17 88 207 -119
Docs 4 10 10 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 36 194 527 -333

What I checked:

Likely related people:

  • steipete: Peter Steinberger authored the original Codex app-server controls/split, recent SQLite binding work on the same app-server lifecycle area, and the current PR head. (role: recent area contributor and likely follow-up owner; confidence: high; commits: 31a0b7bd42a5, 8d72aafdbb8d, 0d981095d430; files: extensions/codex/src/app-server/client.ts, extensions/codex/src/app-server/thread-lifecycle.ts, extensions/codex/src/app-server/version.ts)
  • cyrusaf: Cyrus Forbes authored the merged token-usage/current-context fix in the Codex event projector, one of the protocol areas this PR simplifies. (role: adjacent contributor; confidence: medium; commits: 9a94194329de; files: extensions/codex/src/app-server/event-projector.ts)
  • vincentkoc: Vincent Koc authored adjacent Codex runtime/auth changes in the shared-client area touched by the PR. (role: adjacent runtime/auth contributor; confidence: low; commits: 859eb0666282, 4a4f52b09730; files: extensions/codex/src/app-server/shared-client.ts, extensions/codex/src/app-server/client.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-07-06T23:38:47.944Z sha 63e5095 :: needs changes before merge. :: [P3] Run docs formatter on changed Codex docs

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jul 6, 2026
@steipete steipete self-assigned this Jul 7, 2026
@steipete
steipete requested review from a team as code owners July 7, 2026 04:17
@openclaw-barnacle openclaw-barnacle Bot added channel: discord Channel integration: discord channel: imessage Channel integration: imessage channel: msteams Channel integration: msteams channel: signal Channel integration: signal channel: voice-call Channel integration: voice-call channel: whatsapp-web Channel integration: whatsapp-web app: android App: android app: ios App: ios app: macos App: macos app: web-ui App: web-ui gateway Gateway runtime extensions: diagnostics-otel Extension: diagnostics-otel extensions: memory-core Extension: memory-core cli CLI command changes scripts Repository scripts labels Jul 7, 2026
@steipete
steipete force-pushed the claude/great-mendeleev-de4d3b branch from 9e8e9fe to e885d12 Compare July 7, 2026 04:37
@openclaw-barnacle openclaw-barnacle Bot removed channel: discord Channel integration: discord channel: imessage Channel integration: imessage channel: msteams Channel integration: msteams channel: signal Channel integration: signal channel: voice-call Channel integration: voice-call channel: whatsapp-web Channel integration: whatsapp-web app: android App: android app: ios App: ios app: macos App: macos app: web-ui App: web-ui gateway Gateway runtime extensions: diagnostics-otel Extension: diagnostics-otel extensions: memory-core Extension: memory-core cli CLI command changes scripts Repository scripts commands Command implementations docker Docker and sandbox tooling agents Agent runtime and tooling extensions: anthropic extensions: openai extensions: qa-lab extensions: tencent plugin: file-transfer extensions: amazon-bedrock extensions: anthropic-vertex labels Jul 7, 2026
@steipete

steipete commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs Improvements or additions to documentation extensions: codex maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: L status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant