[codex-app-server] add native integrity state bridge [ci changed_files]

codex-rs/app-server-protocol/src/protocol/common.rs

@@ -849,6 +849,24 @@ client_request_definitions! {
         serialization: global("remote-control-pairing"),
         response: v2::RemoteControlPairingStartResponse,
     },
+    #[experimental("nativeIntegrityState/read")]
+    NativeIntegrityStateRead => "nativeIntegrityState/read" {
+        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        serialization: global_shared_read("native-integrity-state"),
+        response: v2::NativeIntegrityStateReadResponse,
+    },
+    #[experimental("nativeIntegrityState/write")]
+    NativeIntegrityStateWrite => "nativeIntegrityState/write" {
+        params: v2::NativeIntegrityStateWriteParams,
+        serialization: global("native-integrity-state"),
+        response: v2::NativeIntegrityStateWriteResponse,
+    },
+    #[experimental("nativeIntegrityState/clear")]
+    NativeIntegrityStateClear => "nativeIntegrityState/clear" {
+        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        serialization: global("native-integrity-state"),
+        response: v2::NativeIntegrityStateClearResponse,
+    },
     #[experimental("collaborationMode/list")]
     /// Lists collaboration mode presets.
     CollaborationModeList => "collaborationMode/list" {

codex-rs/app-server-protocol/src/protocol/v2/mod.rs

@@ -14,6 +14,7 @@ mod hook;
 mod item;
 mod mcp;
 mod model;
+mod native_integrity_state;
 mod notification;
 mod permissions;
 mod plugin;
@@ -40,6 +41,7 @@ pub use hook::*;
 pub use item::*;
 pub use mcp::*;
 pub use model::*;
+pub use native_integrity_state::*;
 pub use notification::*;
 pub use permissions::*;
 pub use plugin::*;

codex-rs/app-server-protocol/src/protocol/v2/native_integrity_state.rs

@@ -0,0 +1,33 @@
+use schemars::JsonSchema;
+use serde::Deserialize;
+use serde::Serialize;
+use ts_rs::TS;
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct NativeIntegrityStateReadResponse {
+    pub state: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct NativeIntegrityStateWriteParams {
+    pub state: String,
+    /// When present, write only if the calling surface still stores this state.
+    #[ts(optional = nullable)]
+    pub expected_state: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct NativeIntegrityStateWriteResponse {
+    pub written: bool,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct NativeIntegrityStateClearResponse {}