Skip to content

feat(codex): surface native questions and goals#109724

Merged
steipete merged 12 commits into
mainfrom
feat/codex-native-protocol-bridge
Jul 17, 2026
Merged

feat(codex): surface native questions and goals#109724
steipete merged 12 commits into
mainfrom
feat/codex-native-protocol-bridge

Conversation

@steipete

Copy link
Copy Markdown
Contributor

Related: #102261
Related: #102260

What Problem This Solves

Codex app-server runs could request structured user input or expose a native thread goal, but OpenClaw only surfaced a flattened text prompt and had no native goal command path. Control UI users could not answer the structured request in place, and operators could not read or update the upstream goal without a second state system.

Why This Change Was Made

This is the first, bounded slice of the approved Codex-parity split. It carries native request_user_input questions through the existing typed presentation seam into channels and the Control UI, then routes request-scoped answers back to the waiting app-server request. Secret questions stay on the warned text path and never receive an action token.

It also maps /codex goal read/write commands directly to upstream thread/goal/get, thread/goal/set, and thread/goal/clear. There is no parallel goal store. Per-thread features.goals remains disabled because upstream couples the feature to automatic idle continuation; the app-server RPC gate remains available from its stable process default.

The existing turn/plan/updated projector and Activity/UI display already landed on main, so this PR does not duplicate that implementation.

Upstream contract checked directly at openai/codex@315195492c80fdade38e917c18f9584efd599304:

Thanks @100yenadmin for the original UI/protocol work in #102261. Contributor credit is preserved in the commit history and squash metadata.

User Impact

Control UI users see native Codex questions as structured option/free-form cards and can submit an answer without leaving chat. Supported channels receive typed choice actions. Codex operators can inspect, set, pause, resume, block, complete, or clear the native upstream thread goal through /codex goal.

Automatic goal-driven follow-on turns are deliberately out of scope. Provider-neutral question RPC and autonomous continuation design remain later slices.

Evidence

  • Focused local proof: 35 Control UI tests and 325 Codex extension tests passed.
  • Full changed-surface Testbox gate: run 29559093843, Testbox tbx_01kxqax7egbxg325a8vvqv3jqy, exit 0 after 21m04s. Typecheck, lint, format, API baseline, plugin boundaries, i18n, DB/state guards, and import-cycle checks passed.
  • Source-blind Control UI behavior proof passed: no initial card; native plan shown; structured question shown; scoped exact-label answer emitted; resolved card cleared; secret question produced no card.
  • Sanitized before/question/resolved screenshots and a video were captured from the real Control UI E2E harness. Visual artifacts will be attached to this PR.
  • Fresh full-branch autoreview: no accepted/actionable findings; correctness 0.84.

@steipete steipete self-assigned this Jul 17, 2026
@steipete

Copy link
Copy Markdown
Contributor Author

Visual proof

Sanitized deterministic Control UI fixture. Before, native question + plan, then resolved state.

Before

before

Native question and plan

question-plan

Resolved

resolved

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation app: web-ui App: web-ui agents Agent runtime and tooling extensions: codex size: XL maintainer Maintainer-authored PR labels Jul 17, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ec4925d89c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

onGoalCommand: (command) => void state.handleSendChat(command),
onQuestionSubmit: (actionToken, answers, onRejected) =>
void state.handleSendChat(
`/codex answer ${actionToken} answers:${encodeURIComponent(JSON.stringify(answers))}`,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Send question answers outside the busy-run queue

When a Codex question is pending, the originating run is still active/abortable, so routing the card submit through handleSendChat("/codex answer ...") goes down the normal message path: /codex is not an executeLocal command, and chat-send.ts queues normal messages while isChatBusy()/hasAbortableSessionRun() is true. That means the structured answer is queued/steered and can be consumed as literal text by the existing pending-input path instead of immediately invoking resolveCodexUserInputAction, leaving option-only questions unanswered or the card stuck; send this via an immediate command/RPC path that bypasses the active-run queue.

Useful? React with 👍 / 👎.

@clawsweeper clawsweeper Bot added proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. labels Jul 17, 2026
@clawsweeper

clawsweeper Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 17, 2026, 3:19 AM ET / 07:19 UTC.

Summary
Adds native Codex structured-question presentation and answer routing, native thread-goal commands, Control UI question cards, channel actions, tests, and documentation.

PR surface: Source +719, Tests +665, Docs +8. Total +1392 across 32 files.

Reproducibility: yes. the blockers are source-reproducible: submit the question card while the Codex request is still active, and start a thread with an explicit goals opt-in while checking the model-visible goal tool list.

Review metrics: 3 noteworthy metrics.

  • Goal configuration override: 1 existing upstream feature forced off. The merge changes explicit user-provided thread configuration, so fresh-default and upgrade behavior both require review.
  • Model-visible goal tools: 3 existing tools excluded. The native replacements are unavailable under the same thread configuration, which can leave Codex without any goal tools.
  • Question answer transport: 1 UI path routed through normal chat send. Request-scoped answers must bypass busy-run queueing to resolve the waiting native request reliably.

Stored data model
Persistent data-model change detected: serialized state: ui/src/pages/chat/chat-pane.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: partial_overlap
Canonical: #102260
Summary: The roadmap issue is the canonical parity discussion; this PR implements a narrower Codex-only question and native-goal slice, while the broader open PR covers additional provider-neutral question, plan-mode, and autonomous-goal behavior.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦐 gold shrimp
Patch quality: 🦪 silver shellfish
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Route question-card answers through an immediate request-scoped path and add a regression test proving no chat queue entry is created.
  • Preserve explicit goal opt-ins and retain OpenClaw goal tools whenever native goal tools are unavailable.
  • [P1] Add redacted live evidence showing an active native request resolving and the card clearing without a queued message.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: The screenshots show card rendering and resolved appearance but not a real active Codex request resolving immediately; after fixing the transport, add a redacted recording or logs showing upstream resolution, card clearing, and no queued chat item, then update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

  • [P1] An answer submitted while the originating run is active can be queued or consumed as chat text, leaving the native request unresolved and the question card stuck.
  • [P1] Existing users who explicitly enabled features.goals would have that setting silently overridden during Codex thread start or resume.
  • [P1] Codex runs can lose all model-visible goal tools because OpenClaw's three tools are excluded while the native replacements are disabled.
  • [P1] The screenshots do not establish upgrade behavior or prove the real active-run answer transport.

Maintainer options:

  1. Repair transport and preserve goal compatibility (recommended)
    Add an immediate answer RPC or local-command path, retain explicit goal opt-ins, and conditionally preserve OpenClaw goal tools with focused fresh-install and upgrade coverage.
  2. Accept a fail-closed goal policy
    A maintainer may intentionally force native goals off, but the PR must still preserve a model-visible goal surface and document and prove the upgrade break.
  3. Split questions from goals
    Pause the goal portion and retain only the structured-question slice if the coupled upstream feature cannot meet OpenClaw's compatibility and safety requirements.

Next step before merge

  • [P1] A maintainer must choose the explicit native-goal compatibility policy; after that, the contributor has concrete repairs for immediate answer transport and conditional goal-tool replacement.

Maintainer decision needed

  • Question: Should OpenClaw preserve an explicit features.goals: true opt-in for Codex threads, or intentionally force native goal continuation off for every OpenClaw-managed thread?
  • Rationale: The goals feature currently couples model-visible native tools with autonomous continuation, so source inspection cannot decide whether an explicit user opt-in should be honored or overridden as a product safety policy.
  • Likely owner: steipete — This person owns the current split and has the strongest recent history across the affected Codex runtime and command surfaces.
  • Options:
    • Preserve explicit opt-ins (recommended): Default the feature off when unset, retain an explicit true, and add fresh-default plus upgrade tests while keeping OpenClaw tools available whenever native tools are unavailable.
    • Force goals off: Approve the compatibility break, preserve the OpenClaw goal tools, and document and prove the changed behavior for existing explicit opt-ins.
    • Split goal support: Land the structured-question work separately and pause native goal commands until Codex exposes a narrower tools-without-continuation contract.

Security
Cleared: No concrete security or supply-chain regression was found: the patch adds no dependency or workflow execution surface, uses opaque request tokens, checks mutation authorization, and keeps secret questions off action-token paths.

Review findings

  • [P1] Bypass the busy-run queue for question answers — ui/src/pages/chat/chat-pane.ts:2438-2443
  • [P1] Preserve explicit goal-feature opt-ins — extensions/codex/src/app-server/thread-requests.ts:279-282
  • [P1] Keep OpenClaw goal tools while native goals are disabled — extensions/codex/src/app-server/dynamic-tool-profile.ts:140-143
Review details

Best possible solution:

Route structured answers through an immediate request-scoped gateway command or RPC, preserve explicit goal settings and OpenClaw goal tools unless native replacements are actually enabled, then prove active-run submission and upgrade behavior in a real setup.

Do we have a high-confidence way to reproduce the issue?

Yes, the blockers are source-reproducible: submit the question card while the Codex request is still active, and start a thread with an explicit goals opt-in while checking the model-visible goal tool list.

Is this the best way to solve the issue?

No. Reusing the normal chat-send queue is the wrong boundary for a request-scoped response, and native goal replacement should be conditional rather than removing existing tools and settings unconditionally.

Full review comments:

  • [P1] Bypass the busy-run queue for question answers — ui/src/pages/chat/chat-pane.ts:2438-2443
    onQuestionSubmit still sends /codex answer through handleSendChat. While request_user_input is pending, the originating run remains active, so this command can be queued or steered instead of immediately invoking the request resolver; use a request-scoped command/RPC path and assert that no queued chat item is created.
    Confidence: 0.97
  • [P1] Preserve explicit goal-feature opt-ins — extensions/codex/src/app-server/thread-requests.ts:279-282
    The merge order forces features.goals to false even when an existing caller explicitly supplied true. That silently changes an established user setting on start and resume; preserve explicit opt-ins or obtain and document an intentional compatibility decision with fresh-default and upgrade coverage.
    Confidence: 0.94
  • [P1] Keep OpenClaw goal tools while native goals are disabled — extensions/codex/src/app-server/dynamic-tool-profile.ts:140-143
    This unconditional exclusion removes get_goal, create_goal, and update_goal, but the same patch disables the native Codex goals feature that controls visibility of the replacement tools. Keep the OpenClaw tools unless native goal tools are actually enabled and visible.
    Confidence: 0.97

Overall correctness: patch is incorrect
Overall confidence: 0.96

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b64242a4a99a.

Label changes

Label changes:

  • add mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The typed presentation adds visible Telegram choice buttons, which can be demonstrated in a short Telegram Desktop recording after the answer-transport defect is repaired.

Label justifications:

  • P1: The current patch can break active structured-question resolution and remove established goal behavior from real Codex agent workflows.
  • merge-risk: 🚨 compatibility: The PR overrides explicit features.goals settings and removes three existing model-visible tools without a proven upgrade-safe replacement.
  • merge-risk: 🚨 message-delivery: The Control UI answer command can enter the active-run chat queue instead of resolving the request immediately, causing delayed, misinterpreted, or suppressed answers.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The screenshots show card rendering and resolved appearance but not a real active Codex request resolving immediately; after fixing the transport, add a redacted recording or logs showing upstream resolution, card clearing, and no queued chat item, then update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.
  • proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The screenshots show card rendering and resolved appearance but not a real active Codex request resolving immediately; after fixing the transport, add a redacted recording or logs showing upstream resolution, card clearing, and no queued chat item, then update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.
  • mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The typed presentation adds visible Telegram choice buttons, which can be demonstrated in a short Telegram Desktop recording after the answer-transport defect is repaired.
Evidence reviewed

PR surface:

Source +719, Tests +665, Docs +8. Total +1392 across 32 files.

View PR surface stats
Area Files Added Removed Net
Source 21 731 12 +719
Tests 9 668 3 +665
Docs 2 13 5 +8
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 32 1412 20 +1392

What I checked:

Likely related people:

  • steipete: Recent current-main history includes substantial Codex runtime, command, and documentation work, and this PR is assigned to the same person. (role: recent Codex area contributor and current change owner; confidence: high; commits: 0b4fc26d4add, b4fdd1470b70, 50a2481652b6; files: extensions/codex/src/app-server/thread-requests.ts, extensions/codex/src/command-handlers.ts, docs/plugins/codex-harness.md)
  • 100yenadmin: The PR explicitly credits this person for the original structured-question and protocol/UI work, and the related roadmap and broader implementation define the intended cross-surface behavior. (role: original interactive-parity and UI/protocol contributor; confidence: medium; commits: 2a0350b5b490; files: ui/src/pages/chat/tool-stream.ts, ui/src/pages/chat/components/chat-question-card.ts, extensions/codex/src/app-server/user-input-bridge.ts)
  • Radek Sienkiewicz: The current Codex app-server attempt and runtime structure appears to originate from earlier merged app-server work, making this person relevant to the owner boundary and lifecycle design. (role: app-server runtime introducer; confidence: medium; commits: 52e2d4e16a29; files: extensions/codex/src/app-server/thread-requests.ts, extensions/codex/src/app-server/user-input-bridge.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-07-17T06:54:17.604Z sha ec4925d :: needs real behavior proof before merge. :: [P1] Bypass the active-run queue for question answers | [P1] Preserve explicit goal-feature opt-ins

@steipete
steipete force-pushed the feat/codex-native-protocol-bridge branch from ec4925d to 041de1a Compare July 17, 2026 06:59
@steipete
steipete force-pushed the feat/codex-native-protocol-bridge branch from 041de1a to 9d6c750 Compare July 17, 2026 07:00

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9d6c7508d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +142 to +144
for (const name of CODEX_NATIVE_GOAL_TOOL_EXCLUDES) {
excludes.add(name);
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep OpenClaw goal tools while native goals are disabled

When Codex turns use this PR's thread config, features.goals is forced to false in extensions/codex/src/app-server/thread-requests.ts, and upstream Codex only advertises native goal tools when GoalRuntimeHandle.tools_visible() is true (checked openai/codex@3151954 codex-rs/ext/goal/src/runtime.rs and ext/goal/src/extension.rs). This unconditional exclude removes OpenClaw's existing get_goal/create_goal/update_goal dynamic tools before native Codex can replace them, so Codex runs lose all model-visible goal tools even though they were previously provided by src/agents/openclaw-tools.ts; keep these exclusions conditional on native goal tools actually being enabled/visible.

Useful? React with 👍 / 👎.

@clawsweeper clawsweeper Bot added the mantis: telegram-visible-proof Mantis should capture Telegram visible proof. label Jul 17, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a335277e17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

};

const CODEX_GOAL_CONTINUATION_DISABLED_THREAD_CONFIG: JsonObject = {
"features.goals": false,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep goal feature enabled for /codex goal

For OpenClaw-started/resumed Codex threads this forces the upstream goal feature off, but this commit also exposes /codex goal and routes it to thread/goal/get|set|clear; Codex gates those native goal RPCs on the same feature flag and returns goals feature is disabled when it is false, so status/set/clear fail on the bound threads where the command is now advertised. Fresh evidence beyond the existing tool-exclusion finding is that extensions/codex/src/command-handlers.ts:452 now routes /codex goal to those native RPCs, so keep the feature enabled for threads with native goal controls or hide/disable those controls while the flag is forced off.

Useful? React with 👍 / 👎.

@steipete
steipete merged commit 2b18ef7 into main Jul 17, 2026
123 of 125 checks passed
@steipete
steipete deleted the feat/codex-native-protocol-bridge branch July 17, 2026 07:35
@steipete

Copy link
Copy Markdown
Contributor Author

Merged via squash.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 18, 2026
* feat(codex): bridge native questions and goals

Co-authored-by: EVA <[email protected]>

* fix(ui): preserve native question text encoding

* fix(codex): keep secret answers off action paths

* fix(codex): validate native action keys exactly

* fix(codex): isolate new goals and free-form answers

* style(codex): satisfy extension lint

* fix(codex): keep goal replacement non-destructive

* fix(codex): separate native goals from continuation

* fix(codex): preserve exact native answer labels

* test(codex): assert goal continuation stays disabled

* fix(codex): remove unused bridge exports

* test(codex): refresh goal feature snapshots

---------

Co-authored-by: EVA <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling app: web-ui App: web-ui docs Improvements or additions to documentation extensions: codex maintainer Maintainer-authored PR mantis: telegram-visible-proof Mantis should capture Telegram visible proof. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. P1 High-priority user-facing bug, regression, or broken workflow. proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. size: XL status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant