refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering#101221
Conversation
|
Codex review: needs maintainer review before merge. Reviewed July 6, 2026, 11:06 PM ET / 03:06 UTC. Summary PR surface: Source -214, Tests -119, Docs 0. Total -333 across 36 files. Reproducibility: yes. for a source-level path: current main lacks the Review metrics: 1 noteworthy metric.
Stored data model Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review detailsBest possible solution: Land the single 0.142-aligned Codex app-server path after the merge conflict is resolved and maintainers explicitly accept the custom-binary floor change. Do we have a high-confidence way to reproduce the issue? Yes for a source-level path: current main lacks the Is this the best way to solve the issue? Mostly yes: matching the runtime to the managed 0.142.5 app-server train is the cleanest way to delete stale protocol shims, provided maintainers accept the custom-binary compatibility break and the branch is rebased cleanly. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against ad833d788305. Label changesLabel justifications:
Evidence reviewedPR surface: Source -214, Tests -119, Docs 0. Total -333 across 36 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (1 earlier review cycle)
|
9e8e9fe to
e885d12
Compare
|
Merged via squash.
|
What Problem This Solves
The Codex app-server integration accumulated compat paths for app-server versions OpenClaw no longer runs, plus protocol-drift defenses that never matched the wire format. The declared floor was
0.125.0while the managed binary pin is0.142.5, so every OpenClaw install runs a 0.142-train server, yet runtime code still carried pre-0.131/0.137 branches and speculative snake_case/alias fallbacks. Separately, the Codex-native subagent bridge was broken live: models asked to use nativespawn_agentused OpenClawsessions_spawninstead, socodex-nativetask records were never created (the live bridge probe failed 3/3 onmain).This partially supersedes #93313, which is closed; its remaining pieces (SQLite binding store, turn router/client-runtime) continue as dedicated follow-ups.
Why This Change Was Made
Every deletion was verified against the pinned upstream source (
openai/codexatorigin/release/0.142):0.142.0(extensions/codex/src/app-server/version.ts); the sandbox exec-server 0.132 gate is now always-true and removed.persistExtendedHistorysenders/fields removed — retired upstream in 0.137.id↔sessionIdalias normalizer removed —sessionIdis required onThreadsince 0.131 (thread_data.rs); a missingsessionIdnow fails validation loudly.dynamicToolsdowngrade removed —normalize_dynamic_tool_specsaccepts canonical typed specs at the floor, sothread/startsends them.ThreadTokenUsageis{total, last, modelContextWindow}since at least 0.121),turn_id/will_retrysnake_case fallbacks (all v2 serde is camelCase),itemId ?? idlegs,phase/itemreads on delta notifications (fields never on the wire), and theitem/fileChange/outputDeltahandler (upstream: "server no longer emits").conversationIdfallback in the approval bridge and anidalias in the conversation turn collector removed (v1-era).CodexAppServerVersionErrorreplaces string-matched version-error detection; unreachable approval branch indefaultServerRequestResponsedeleted.Sets folded into oneMap<threadId, "mirrored" | "failed">.spawn_agent) behindtool_searchon search-capable models (spec_plan.rsadd_collaboration_tools, upstream fix(ui): strip reply directive tags from assistant messages in WebChat (#23053) #23144, since 0.133). OpenClaw's developer instructions demanded nativespawn_agentwithout teaching the retrieval path, whilesessions_spawnstayed always-direct — so models used the visible tool. The instructions now say: whenspawn_agentis not directly listed, load it withtool_searchfirst;sessions_spawnis never a substitute. Prompt snapshot fixtures regenerated on Linux.Docs floors updated in
docs/plugins/codex-harness.md,codex-harness-reference.md,codex-harness-runtime.md, andsdk-agent-harness.md.User Impact
appServer.commandbinaries older than0.142.0are now rejected at initialize with a clear error; the managed default binary (0.142.5) is unaffected. Requirements docs updated accordingly.spawn_agentgets loaded viatool_searchand child results are delivered ascodex-nativetask records.Evidence
codex-rs/app-server-protocol/src/protocol/v2/{thread,turn,item,thread_data,notification,model,shared,config,account}.rs,protocol/common.rs,codex-rs/protocol/src/dynamic_tools.rs,codex-rs/core/src/tools/spec_plan.rs,codex-rs/features/src/lib.rs,codex-rs/model-provider/src/provider.rsatorigin/release/0.142; deferral provenance upstream commitb3ae3de405(fix(ui): strip reply directive tags from assistant messages in WebChat (#23053) #23144).extensions/codexsuite green — 91 files / 1911 tests (rerun after each rebase); prepared oxlint 0 errors;tsgoextensions lane green; fullpnpm buildgreen;prompt:snapshots:checkcurrent (regenerated on Linux); changed files oxfmt-clean.@openai/codex0.142.5, api-key auth):gateway-codex-harness.live.test.tsgreen including image/MCP/guardian probes; the native subagent bridge probe failed 3/3 before this branch (including twice on cleanmain) and passes 2/2 after thespawn_agentinstruction fix.Follow-ups tracked separately: SQLite session-binding store + doctor sidecar migration, and the turn-router/client-runtime/rate-limit-cache port (both re-implementations of the remaining #93313 design on current
main).