Merge origin/main into codex/viyatb/deny-read-requirements-only

BUILD.bazel

@@ -28,4 +28,8 @@ alias(
     actual = "@rbe_platform",
 )
 
-exports_files(["AGENTS.md"])
+exports_files([
+    "AGENTS.md",
+    "workspace_root_test_launcher.bat.tpl",
+    "workspace_root_test_launcher.sh.tpl",
+])

codex-rs/.config/nextest.toml

@@ -2,6 +2,12 @@
 # Do not increase, fix your test instead
 slow-timeout = { period = "15s", terminate-after = 2 }
 
+[test-groups.app_server_protocol_codegen]
+max-threads = 1
+
+[test-groups.app_server_integration]
+max-threads = 1
+
 
 [[profile.default.overrides]]
 # Do not add new tests here
@@ -11,3 +17,13 @@ slow-timeout = { period = "1m", terminate-after = 4 }
 [[profile.default.overrides]]
 filter = 'test(approval_matrix_covers_all_modes)'
 slow-timeout = { period = "30s", terminate-after = 2 }
+
+[[profile.default.overrides]]
+filter = 'package(codex-app-server-protocol) & (test(typescript_schema_fixtures_match_generated) | test(json_schema_fixtures_match_generated) | test(generate_ts_with_experimental_api_retains_experimental_entries) | test(generated_ts_optional_nullable_fields_only_in_params) | test(generate_json_filters_experimental_fields_and_methods))'
+test-group = 'app_server_protocol_codegen'
+
+[[profile.default.overrides]]
+# These integration tests spawn a fresh app-server subprocess per case.
+# Keep the library unit tests parallel.
+filter = 'package(codex-app-server) & kind(test)'
+test-group = 'app_server_integration'

codex-rs/Cargo.lock

@@ -827,6 +827,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
 dependencies = [
  "axum-core",
+ "base64 0.22.1",
  "bytes",
  "form_urlencoded",
  "futures-util",
@@ -845,8 +846,10 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
+ "sha1",
  "sync_wrapper",
  "tokio",
+ "tokio-tungstenite",
  "tower",
  "tower-layer",
  "tower-service",
@@ -1441,6 +1444,7 @@ dependencies = [
  "futures",
  "owo-colors",
  "pretty_assertions",
+ "reqwest",
  "rmcp",
  "serde",
  "serde_json",
@@ -1458,6 +1462,24 @@ dependencies = [
  "wiremock",
 ]
 
+[[package]]
+name = "codex-app-server-client"
+version = "0.0.0"
+dependencies = [
+ "codex-app-server",
+ "codex-app-server-protocol",
+ "codex-arg0",
+ "codex-core",
+ "codex-feedback",
+ "codex-protocol",
+ "pretty_assertions",
+ "serde",
+ "serde_json",
+ "tokio",
+ "toml 0.9.11+spec-1.1.0",
+ "tracing",
+]
+
 [[package]]
 name = "codex-app-server-protocol"
 version = "0.0.0"
@@ -1900,10 +1922,13 @@ dependencies = [
  "anyhow",
  "assert_cmd",
  "clap",
+ "codex-app-server-client",
+ "codex-app-server-protocol",
  "codex-apply-patch",
  "codex-arg0",
  "codex-cloud-requirements",
  "codex-core",
+ "codex-feedback",
  "codex-otel",
  "codex-protocol",
  "codex-utils-absolute-path",

codex-rs/Cargo.toml

@@ -4,6 +4,7 @@ members = [
     "ansi-escape",
     "async-utils",
     "app-server",
+    "app-server-client",
     "app-server-protocol",
     "app-server-test-client",
     "debug-client",
@@ -86,6 +87,7 @@ codex-api = { path = "codex-api" }
 codex-artifacts = { path = "artifacts" }
 codex-package-manager = { path = "package-manager" }
 codex-app-server = { path = "app-server" }
+codex-app-server-client = { path = "app-server-client" }
 codex-app-server-protocol = { path = "app-server-protocol" }
 codex-app-server-test-client = { path = "app-server-test-client" }
 codex-apply-patch = { path = "apply-patch" }

codex-rs/app-server-client/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "app-server-client",
+    crate_name = "codex_app_server_client",
+)

codex-rs/app-server-client/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "codex-app-server-client"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+name = "codex_app_server_client"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-app-server = { workspace = true }
+codex-app-server-protocol = { workspace = true }
+codex-arg0 = { workspace = true }
+codex-core = { workspace = true }
+codex-feedback = { workspace = true }
+codex-protocol = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["sync", "time", "rt"] }
+toml = { workspace = true }
+tracing = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

codex-rs/app-server-client/README.md

@@ -0,0 +1,67 @@
+# codex-app-server-client
+
+Shared in-process app-server client used by conversational CLI surfaces:
+
+- `codex-exec`
+- `codex-tui`
+
+## Purpose
+
+This crate centralizes startup and lifecycle management for an in-process
+`codex-app-server` runtime, so CLI clients do not need to duplicate:
+
+- app-server bootstrap and initialize handshake
+- in-memory request/event transport wiring
+- lifecycle orchestration around caller-provided startup identity
+- graceful shutdown behavior
+
+## Startup identity
+
+Callers pass both the app-server `SessionSource` and the initialize
+`client_info.name` explicitly when starting the facade.
+
+That keeps thread metadata (for example in `thread/list` and `thread/read`)
+aligned with the originating runtime without baking TUI/exec-specific policy
+into the shared client layer.
+
+## Transport model
+
+The in-process path uses typed channels:
+
+- client -> server: `ClientRequest` / `ClientNotification`
+- server -> client: `InProcessServerEvent`
+  - `ServerRequest`
+  - `ServerNotification`
+  - `LegacyNotification`
+
+JSON serialization is still used at external transport boundaries
+(stdio/websocket), but the in-process hot path is typed.
+
+Typed requests still receive app-server responses through the JSON-RPC
+result envelope internally. That is intentional: the in-process path is
+meant to preserve app-server semantics while removing the process
+boundary, not to introduce a second response contract.
+
+## Bootstrap behavior
+
+The client facade starts an already-initialized in-process runtime, but
+thread bootstrap still follows normal app-server flow:
+
+- caller sends `thread/start` or `thread/resume`
+- app-server returns the immediate typed response
+- richer session metadata may arrive later as a `SessionConfigured`
+  legacy event
+
+Surfaces such as TUI and exec may therefore need a short bootstrap
+phase where they reconcile startup response data with later events.
+
+## Backpressure and shutdown
+
+- Queues are bounded and use `DEFAULT_IN_PROCESS_CHANNEL_CAPACITY` by default.
+- Full queues return explicit overload behavior instead of unbounded growth.
+- `shutdown()` performs a bounded graceful shutdown and then aborts if timeout
+  is exceeded.
+
+If the client falls behind on event consumption, the worker emits
+`InProcessServerEvent::Lagged` and may reject pending server requests so
+approval flows do not hang indefinitely behind a saturated queue.

codex-rs/app-server-client/src/lib.rs

@@ -0,0 +1,801 @@
+//! Shared in-process app-server client facade for CLI surfaces.
+//!
+//! This crate wraps [`codex_app_server::in_process`] behind a single async API
+//! used by surfaces like TUI and exec. It centralizes:
+//!
+//! - Runtime startup and initialize-capabilities handshake.
+//! - Typed caller-provided startup identity (`SessionSource` + client name).
+//! - Typed and raw request/notification dispatch.
+//! - Server request resolution and rejection.
+//! - Event consumption with backpressure signaling ([`InProcessServerEvent::Lagged`]).
+//! - Bounded graceful shutdown with abort fallback.
+//!
+//! The facade interposes a worker task between the caller and the underlying
+//! [`InProcessClientHandle`](codex_app_server::in_process::InProcessClientHandle),
+//! bridging async `mpsc` channels on both sides. Queues are bounded so overload
+//! surfaces as channel-full errors rather than unbounded memory growth.
+
+use std::error::Error;
+use std::fmt;
+use std::io::Error as IoError;
+use std::io::ErrorKind;
+use std::io::Result as IoResult;
+use std::sync::Arc;
+use std::time::Duration;
+
+pub use codex_app_server::in_process::DEFAULT_IN_PROCESS_CHANNEL_CAPACITY;
+pub use codex_app_server::in_process::InProcessServerEvent;
+use codex_app_server::in_process::InProcessStartArgs;
+use codex_app_server_protocol::ClientInfo;
+use codex_app_server_protocol::ClientNotification;
+use codex_app_server_protocol::ClientRequest;
+use codex_app_server_protocol::ConfigWarningNotification;
+use codex_app_server_protocol::InitializeCapabilities;
+use codex_app_server_protocol::InitializeParams;
+use codex_app_server_protocol::JSONRPCErrorError;
+use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::Result as JsonRpcResult;
+use codex_arg0::Arg0DispatchPaths;
+use codex_core::config::Config;
+use codex_core::config_loader::CloudRequirementsLoader;
+use codex_core::config_loader::LoaderOverrides;
+use codex_feedback::CodexFeedback;
+use codex_protocol::protocol::SessionSource;
+use serde::de::DeserializeOwned;
+use tokio::sync::mpsc;
+use tokio::sync::oneshot;
+use tokio::time::timeout;
+use toml::Value as TomlValue;
+use tracing::warn;
+
+const SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// Raw app-server request result for typed in-process requests.
+///
+/// Even on the in-process path, successful responses still travel back through
+/// the same JSON-RPC result envelope used by socket/stdio transports because
+/// `MessageProcessor` continues to produce that shape internally.
+pub type RequestResult = std::result::Result<JsonRpcResult, JSONRPCErrorError>;
+
+fn event_requires_delivery(event: &InProcessServerEvent) -> bool {
+    // These terminal events drive surface shutdown/completion state. Dropping
+    // them under backpressure can leave exec/TUI waiting forever even though
+    // the underlying turn has already ended.
+    match event {
+        InProcessServerEvent::ServerNotification(
+            codex_app_server_protocol::ServerNotification::TurnCompleted(_),
+        ) => true,
+        InProcessServerEvent::LegacyNotification(notification) => matches!(
+            notification
+                .method
+                .strip_prefix("codex/event/")
+                .unwrap_or(&notification.method),
+            "task_complete" | "turn_aborted" | "shutdown_complete"
+        ),
+        _ => false,
+    }
+}
+
+/// Layered error for [`InProcessAppServerClient::request_typed`].
+///
+/// This keeps transport failures, server-side JSON-RPC failures, and response
+/// decode failures distinct so callers can decide whether to retry, surface a
+/// server error, or treat the response as an internal request/response mismatch.
+#[derive(Debug)]
+pub enum TypedRequestError {
+    Transport {
+        method: String,
+        source: IoError,
+    },
+    Server {
+        method: String,
+        source: JSONRPCErrorError,
+    },
+    Deserialize {
+        method: String,
+        source: serde_json::Error,
+    },
+}
+
+impl fmt::Display for TypedRequestError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Transport { method, source } => {
+                write!(f, "{method} transport error: {source}")
+            }
+            Self::Server { method, source } => {
+                write!(f, "{method} failed: {}", source.message)
+            }
+            Self::Deserialize { method, source } => {
+                write!(f, "{method} response decode error: {source}")
+            }
+        }
+    }
+}
+
+impl Error for TypedRequestError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::Transport { source, .. } => Some(source),
+            Self::Server { .. } => None,
+            Self::Deserialize { source, .. } => Some(source),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct InProcessClientStartArgs {
+    /// Resolved argv0 dispatch paths used by command execution internals.
+    pub arg0_paths: Arg0DispatchPaths,
+    /// Shared config used to initialize app-server runtime.
+    pub config: Arc<Config>,
+    /// CLI config overrides that are already parsed into TOML values.
+    pub cli_overrides: Vec<(String, TomlValue)>,
+    /// Loader override knobs used by config API paths.
+    pub loader_overrides: LoaderOverrides,
+    /// Preloaded cloud requirements provider.
+    pub cloud_requirements: CloudRequirementsLoader,
+    /// Feedback sink used by app-server/core telemetry and logs.
+    pub feedback: CodexFeedback,
+    /// Startup warnings emitted after initialize succeeds.
+    pub config_warnings: Vec<ConfigWarningNotification>,
+    /// Session source recorded in app-server thread metadata.
+    pub session_source: SessionSource,
+    /// Whether auth loading should honor the `CODEX_API_KEY` environment variable.
+    pub enable_codex_api_key_env: bool,
+    /// Client name reported during initialize.
+    pub client_name: String,
+    /// Client version reported during initialize.
+    pub client_version: String,
+    /// Whether experimental APIs are requested at initialize time.
+    pub experimental_api: bool,
+    /// Notification methods this client opts out of receiving.
+    pub opt_out_notification_methods: Vec<String>,
+    /// Queue capacity for command/event channels (clamped to at least 1).
+    pub channel_capacity: usize,
+}
+
+impl InProcessClientStartArgs {
+    /// Builds initialize params from caller-provided metadata.
+    pub fn initialize_params(&self) -> InitializeParams {
+        let capabilities = InitializeCapabilities {
+            experimental_api: self.experimental_api,
+            opt_out_notification_methods: if self.opt_out_notification_methods.is_empty() {
+                None
+            } else {
+                Some(self.opt_out_notification_methods.clone())
+            },
+        };
+
+        InitializeParams {
+            client_info: ClientInfo {
+                name: self.client_name.clone(),
+                title: None,
+                version: self.client_version.clone(),
+            },
+            capabilities: Some(capabilities),
+        }
+    }
+
+    fn into_runtime_start_args(self) -> InProcessStartArgs {
+        let initialize = self.initialize_params();
+        InProcessStartArgs {
+            arg0_paths: self.arg0_paths,
+            config: self.config,
+            cli_overrides: self.cli_overrides,
+            loader_overrides: self.loader_overrides,
+            cloud_requirements: self.cloud_requirements,
+            feedback: self.feedback,
+            config_warnings: self.config_warnings,
+            session_source: self.session_source,
+            enable_codex_api_key_env: self.enable_codex_api_key_env,
+            initialize,
+            channel_capacity: self.channel_capacity,
+        }
+    }
+}
+
+/// Internal command sent from public facade methods to the worker task.
+///
+/// Each variant carries a oneshot sender so the caller can `await` the
+/// result without holding a mutable reference to the client.
+enum ClientCommand {
+    Request {
+        request: Box<ClientRequest>,
+        response_tx: oneshot::Sender<IoResult<RequestResult>>,
+    },
+    Notify {
+        notification: ClientNotification,
+        response_tx: oneshot::Sender<IoResult<()>>,
+    },
+    ResolveServerRequest {
+        request_id: RequestId,
+        result: JsonRpcResult,
+        response_tx: oneshot::Sender<IoResult<()>>,
+    },
+    RejectServerRequest {
+        request_id: RequestId,
+        error: JSONRPCErrorError,
+        response_tx: oneshot::Sender<IoResult<()>>,
+    },
+    Shutdown {
+        response_tx: oneshot::Sender<IoResult<()>>,
+    },
+}
+
+/// Async facade over the in-process app-server runtime.
+///
+/// This type owns a worker task that bridges between:
+/// - caller-facing async `mpsc` channels used by TUI/exec
+/// - [`codex_app_server::in_process::InProcessClientHandle`], which speaks to
+///   the embedded `MessageProcessor`
+///
+/// The facade intentionally preserves the server's request/notification/event
+/// model instead of exposing direct core runtime handles. That keeps in-process
+/// callers aligned with app-server behavior while still avoiding a process
+/// boundary.
+pub struct InProcessAppServerClient {
+    command_tx: mpsc::Sender<ClientCommand>,
+    event_rx: mpsc::Receiver<InProcessServerEvent>,
+    worker_handle: tokio::task::JoinHandle<()>,
+}
+
+impl InProcessAppServerClient {
+    /// Starts the in-process runtime and facade worker task.
+    ///
+    /// The returned client is ready for requests and event consumption. If the
+    /// internal event queue is saturated later, server requests are rejected
+    /// with overload error instead of being silently dropped.
+    pub async fn start(args: InProcessClientStartArgs) -> IoResult<Self> {
+        let channel_capacity = args.channel_capacity.max(1);
+        let mut handle =
+            codex_app_server::in_process::start(args.into_runtime_start_args()).await?;
+        let request_sender = handle.sender();
+        let (command_tx, mut command_rx) = mpsc::channel::<ClientCommand>(channel_capacity);
+        let (event_tx, event_rx) = mpsc::channel::<InProcessServerEvent>(channel_capacity);
+
+        let worker_handle = tokio::spawn(async move {
+            let mut event_stream_enabled = true;
+            let mut skipped_events = 0usize;
+            loop {
+                tokio::select! {
+                    command = command_rx.recv() => {
+                        match command {
+                            Some(ClientCommand::Request { request, response_tx }) => {
+                                let request_sender = request_sender.clone();
+                                // Request waits happen on a detached task so
+                                // this loop can keep draining runtime events
+                                // while the request is blocked on client input.
+                                tokio::spawn(async move {
+                                    let result = request_sender.request(*request).await;
+                                    let _ = response_tx.send(result);
+                                });
+                            }
+                            Some(ClientCommand::Notify {
+                                notification,
+                                response_tx,
+                            }) => {
+                                let result = request_sender.notify(notification);
+                                let _ = response_tx.send(result);
+                            }
+                            Some(ClientCommand::ResolveServerRequest {
+                                request_id,
+                                result,
+                                response_tx,
+                            }) => {
+                                let send_result =
+                                    request_sender.respond_to_server_request(request_id, result);
+                                let _ = response_tx.send(send_result);
+                            }
+                            Some(ClientCommand::RejectServerRequest {
+                                request_id,
+                                error,
+                                response_tx,
+                            }) => {
+                                let send_result = request_sender.fail_server_request(request_id, error);
+                                let _ = response_tx.send(send_result);
+                            }
+                            Some(ClientCommand::Shutdown { response_tx }) => {
+                                let shutdown_result = handle.shutdown().await;
+                                let _ = response_tx.send(shutdown_result);
+                                break;
+                            }
+                            None => {
+                                let _ = handle.shutdown().await;
+                                break;
+                            }
+                        }
+                    }
+                    event = handle.next_event(), if event_stream_enabled => {
+                        let Some(event) = event else {
+                            break;
+                        };
+
+                        if skipped_events > 0 {
+                            if event_requires_delivery(&event) {
+                                // Surface lag before the terminal event, but
+                                // do not let the lag marker itself cause us to
+                                // drop the completion/abort notification that
+                                // the caller is blocked on.
+                                if event_tx
+                                    .send(InProcessServerEvent::Lagged {
+                                        skipped: skipped_events,
+                                    })
+                                    .await
+                                    .is_err()
+                                {
+                                    event_stream_enabled = false;
+                                    continue;
+                                }
+                                skipped_events = 0;
+                            } else {
+                                match event_tx.try_send(InProcessServerEvent::Lagged {
+                                    skipped: skipped_events,
+                                }) {
+                                    Ok(()) => {
+                                        skipped_events = 0;
+                                    }
+                                    Err(mpsc::error::TrySendError::Full(_)) => {
+                                        skipped_events = skipped_events.saturating_add(1);
+                                        warn!(
+                                            "dropping in-process app-server event because consumer queue is full"
+                                        );
+                                        if let InProcessServerEvent::ServerRequest(request) = event {
+                                            let _ = request_sender.fail_server_request(
+                                                request.id().clone(),
+                                                JSONRPCErrorError {
+                                                    code: -32001,
+                                                    message: "in-process app-server event queue is full".to_string(),
+                                                    data: None,
+                                                },
+                                            );
+                                        }
+                                        continue;
+                                    }
+                                    Err(mpsc::error::TrySendError::Closed(_)) => {
+                                        event_stream_enabled = false;
+                                        continue;
+                                    }
+                                }
+                            }
+                        }
+
+                        if event_requires_delivery(&event) {
+                            // Block until the consumer catches up for
+                            // terminal notifications; this preserves the
+                            // completion signal even when the queue is
+                            // otherwise saturated.
+                            if event_tx.send(event).await.is_err() {
+                                event_stream_enabled = false;
+                            }
+                            continue;
+                        }
+
+                        match event_tx.try_send(event) {
+                            Ok(()) => {}
+                            Err(mpsc::error::TrySendError::Full(event)) => {
+                                skipped_events = skipped_events.saturating_add(1);
+                                warn!("dropping in-process app-server event because consumer queue is full");
+                                if let InProcessServerEvent::ServerRequest(request) = event {
+                                    let _ = request_sender.fail_server_request(
+                                        request.id().clone(),
+                                        JSONRPCErrorError {
+                                            code: -32001,
+                                            message: "in-process app-server event queue is full".to_string(),
+                                            data: None,
+                                        },
+                                    );
+                                }
+                            }
+                            Err(mpsc::error::TrySendError::Closed(_)) => {
+                                event_stream_enabled = false;
+                            }
+                        }
+                    }
+                }
+            }
+        });
+
+        Ok(Self {
+            command_tx,
+            event_rx,
+            worker_handle,
+        })
+    }
+
+    /// Sends a typed client request and returns raw JSON-RPC result.
+    ///
+    /// Callers that expect a concrete response type should usually prefer
+    /// [`request_typed`](Self::request_typed).
+    pub async fn request(&self, request: ClientRequest) -> IoResult<RequestResult> {
+        let (response_tx, response_rx) = oneshot::channel();
+        self.command_tx
+            .send(ClientCommand::Request {
+                request: Box::new(request),
+                response_tx,
+            })
+            .await
+            .map_err(|_| {
+                IoError::new(
+                    ErrorKind::BrokenPipe,
+                    "in-process app-server worker channel is closed",
+                )
+            })?;
+        response_rx.await.map_err(|_| {
+            IoError::new(
+                ErrorKind::BrokenPipe,
+                "in-process app-server request channel is closed",
+            )
+        })?
+    }
+
+    /// Sends a typed client request and decodes the successful response body.
+    ///
+    /// This still deserializes from a JSON value produced by app-server's
+    /// JSON-RPC result envelope. Because the caller chooses `T`, `Deserialize`
+    /// failures indicate an internal request/response mismatch at the call site
+    /// (or an in-process bug), not transport skew from an external client.
+    pub async fn request_typed<T>(&self, request: ClientRequest) -> Result<T, TypedRequestError>
+    where
+        T: DeserializeOwned,
+    {
+        let method = request_method_name(&request);
+        let response =
+            self.request(request)
+                .await
+                .map_err(|source| TypedRequestError::Transport {
+                    method: method.clone(),
+                    source,
+                })?;
+        let result = response.map_err(|source| TypedRequestError::Server {
+            method: method.clone(),
+            source,
+        })?;
+        serde_json::from_value(result)
+            .map_err(|source| TypedRequestError::Deserialize { method, source })
+    }
+
+    /// Sends a typed client notification.
+    pub async fn notify(&self, notification: ClientNotification) -> IoResult<()> {
+        let (response_tx, response_rx) = oneshot::channel();
+        self.command_tx
+            .send(ClientCommand::Notify {
+                notification,
+                response_tx,
+            })
+            .await
+            .map_err(|_| {
+                IoError::new(
+                    ErrorKind::BrokenPipe,
+                    "in-process app-server worker channel is closed",
+                )
+            })?;
+        response_rx.await.map_err(|_| {
+            IoError::new(
+                ErrorKind::BrokenPipe,
+                "in-process app-server notify channel is closed",
+            )
+        })?
+    }
+
+    /// Resolves a pending server request.
+    ///
+    /// This should only be called with request IDs obtained from the current
+    /// client's event stream.
+    pub async fn resolve_server_request(
+        &self,
+        request_id: RequestId,
+        result: JsonRpcResult,
+    ) -> IoResult<()> {
+        let (response_tx, response_rx) = oneshot::channel();
+        self.command_tx
+            .send(ClientCommand::ResolveServerRequest {
+                request_id,
+                result,
+                response_tx,
+            })
+            .await
+            .map_err(|_| {
+                IoError::new(
+                    ErrorKind::BrokenPipe,
+                    "in-process app-server worker channel is closed",
+                )
+            })?;
+        response_rx.await.map_err(|_| {
+            IoError::new(
+                ErrorKind::BrokenPipe,
+                "in-process app-server resolve channel is closed",
+            )
+        })?
+    }
+
+    /// Rejects a pending server request with JSON-RPC error payload.
+    pub async fn reject_server_request(
+        &self,
+        request_id: RequestId,
+        error: JSONRPCErrorError,
+    ) -> IoResult<()> {
+        let (response_tx, response_rx) = oneshot::channel();
+        self.command_tx
+            .send(ClientCommand::RejectServerRequest {
+                request_id,
+                error,
+                response_tx,
+            })
+            .await
+            .map_err(|_| {
+                IoError::new(
+                    ErrorKind::BrokenPipe,
+                    "in-process app-server worker channel is closed",
+                )
+            })?;
+        response_rx.await.map_err(|_| {
+            IoError::new(
+                ErrorKind::BrokenPipe,
+                "in-process app-server reject channel is closed",
+            )
+        })?
+    }
+
+    /// Returns the next in-process event, or `None` when worker exits.
+    ///
+    /// Callers are expected to drain this stream promptly. If they fall behind,
+    /// the worker emits [`InProcessServerEvent::Lagged`] markers and may reject
+    /// pending server requests rather than letting approval flows hang.
+    pub async fn next_event(&mut self) -> Option<InProcessServerEvent> {
+        self.event_rx.recv().await
+    }
+
+    /// Shuts down worker and in-process runtime with bounded wait.
+    ///
+    /// If graceful shutdown exceeds timeout, the worker task is aborted to
+    /// avoid leaking background tasks in embedding callers.
+    pub async fn shutdown(self) -> IoResult<()> {
+        let Self {
+            command_tx,
+            event_rx,
+            worker_handle,
+        } = self;
+        let mut worker_handle = worker_handle;
+        // Drop the caller-facing receiver before asking the worker to shut
+        // down. That unblocks any pending must-deliver `event_tx.send(..)`
+        // so the worker can reach `handle.shutdown()` instead of timing out
+        // and getting aborted with the runtime still attached.
+        drop(event_rx);
+        let (response_tx, response_rx) = oneshot::channel();
+        if command_tx
+            .send(ClientCommand::Shutdown { response_tx })
+            .await
+            .is_ok()
+            && let Ok(command_result) = timeout(SHUTDOWN_TIMEOUT, response_rx).await
+        {
+            command_result.map_err(|_| {
+                IoError::new(
+                    ErrorKind::BrokenPipe,
+                    "in-process app-server shutdown channel is closed",
+                )
+            })??;
+        }
+
+        if let Err(_elapsed) = timeout(SHUTDOWN_TIMEOUT, &mut worker_handle).await {
+            worker_handle.abort();
+            let _ = worker_handle.await;
+        }
+        Ok(())
+    }
+}
+
+/// Extracts the JSON-RPC method name for diagnostics without extending the
+/// protocol crate with in-process-only helpers.
+fn request_method_name(request: &ClientRequest) -> String {
+    serde_json::to_value(request)
+        .ok()
+        .and_then(|value| {
+            value
+                .get("method")
+                .and_then(serde_json::Value::as_str)
+                .map(ToOwned::to_owned)
+        })
+        .unwrap_or_else(|| "<unknown>".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use codex_app_server_protocol::ConfigRequirementsReadResponse;
+    use codex_app_server_protocol::SessionSource as ApiSessionSource;
+    use codex_app_server_protocol::ThreadStartParams;
+    use codex_app_server_protocol::ThreadStartResponse;
+    use codex_core::config::ConfigBuilder;
+    use pretty_assertions::assert_eq;
+    use tokio::time::Duration;
+    use tokio::time::timeout;
+
+    async fn build_test_config() -> Config {
+        match ConfigBuilder::default().build().await {
+            Ok(config) => config,
+            Err(_) => Config::load_default_with_cli_overrides(Vec::new())
+                .expect("default config should load"),
+        }
+    }
+
+    async fn start_test_client_with_capacity(
+        session_source: SessionSource,
+        channel_capacity: usize,
+    ) -> InProcessAppServerClient {
+        InProcessAppServerClient::start(InProcessClientStartArgs {
+            arg0_paths: Arg0DispatchPaths::default(),
+            config: Arc::new(build_test_config().await),
+            cli_overrides: Vec::new(),
+            loader_overrides: LoaderOverrides::default(),
+            cloud_requirements: CloudRequirementsLoader::default(),
+            feedback: CodexFeedback::new(),
+            config_warnings: Vec::new(),
+            session_source,
+            enable_codex_api_key_env: false,
+            client_name: "codex-app-server-client-test".to_string(),
+            client_version: "0.0.0-test".to_string(),
+            experimental_api: true,
+            opt_out_notification_methods: Vec::new(),
+            channel_capacity,
+        })
+        .await
+        .expect("in-process app-server client should start")
+    }
+
+    async fn start_test_client(session_source: SessionSource) -> InProcessAppServerClient {
+        start_test_client_with_capacity(session_source, DEFAULT_IN_PROCESS_CHANNEL_CAPACITY).await
+    }
+
+    #[tokio::test]
+    async fn typed_request_roundtrip_works() {
+        let client = start_test_client(SessionSource::Exec).await;
+        let _response: ConfigRequirementsReadResponse = client
+            .request_typed(ClientRequest::ConfigRequirementsRead {
+                request_id: RequestId::Integer(1),
+                params: None,
+            })
+            .await
+            .expect("typed request should succeed");
+        client.shutdown().await.expect("shutdown should complete");
+    }
+
+    #[tokio::test]
+    async fn typed_request_reports_json_rpc_errors() {
+        let client = start_test_client(SessionSource::Exec).await;
+        let err = client
+            .request_typed::<ConfigRequirementsReadResponse>(ClientRequest::ThreadRead {
+                request_id: RequestId::Integer(99),
+                params: codex_app_server_protocol::ThreadReadParams {
+                    thread_id: "missing-thread".to_string(),
+                    include_turns: false,
+                },
+            })
+            .await
+            .expect_err("missing thread should return a JSON-RPC error");
+        assert!(
+            err.to_string().starts_with("thread/read failed:"),
+            "expected method-qualified JSON-RPC failure message"
+        );
+        client.shutdown().await.expect("shutdown should complete");
+    }
+
+    #[tokio::test]
+    async fn caller_provided_session_source_is_applied() {
+        for (session_source, expected_source) in [
+            (SessionSource::Exec, ApiSessionSource::Exec),
+            (SessionSource::Cli, ApiSessionSource::Cli),
+        ] {
+            let client = start_test_client(session_source).await;
+            let parsed: ThreadStartResponse = client
+                .request_typed(ClientRequest::ThreadStart {
+                    request_id: RequestId::Integer(2),
+                    params: ThreadStartParams {
+                        ephemeral: Some(true),
+                        ..ThreadStartParams::default()
+                    },
+                })
+                .await
+                .expect("thread/start should succeed");
+            assert_eq!(parsed.thread.source, expected_source);
+            client.shutdown().await.expect("shutdown should complete");
+        }
+    }
+
+    #[tokio::test]
+    async fn tiny_channel_capacity_still_supports_request_roundtrip() {
+        let client = start_test_client_with_capacity(SessionSource::Exec, 1).await;
+        let _response: ConfigRequirementsReadResponse = client
+            .request_typed(ClientRequest::ConfigRequirementsRead {
+                request_id: RequestId::Integer(1),
+                params: None,
+            })
+            .await
+            .expect("typed request should succeed");
+        client.shutdown().await.expect("shutdown should complete");
+    }
+
+    #[test]
+    fn typed_request_error_exposes_sources() {
+        let transport = TypedRequestError::Transport {
+            method: "config/read".to_string(),
+            source: IoError::new(ErrorKind::BrokenPipe, "closed"),
+        };
+        assert_eq!(std::error::Error::source(&transport).is_some(), true);
+
+        let server = TypedRequestError::Server {
+            method: "thread/read".to_string(),
+            source: JSONRPCErrorError {
+                code: -32603,
+                data: None,
+                message: "internal".to_string(),
+            },
+        };
+        assert_eq!(std::error::Error::source(&server).is_some(), false);
+
+        let deserialize = TypedRequestError::Deserialize {
+            method: "thread/start".to_string(),
+            source: serde_json::from_str::<u32>("\"nope\"")
+                .expect_err("invalid integer should return deserialize error"),
+        };
+        assert_eq!(std::error::Error::source(&deserialize).is_some(), true);
+    }
+
+    #[tokio::test]
+    async fn next_event_surfaces_lagged_markers() {
+        let (command_tx, _command_rx) = mpsc::channel(1);
+        let (event_tx, event_rx) = mpsc::channel(1);
+        let worker_handle = tokio::spawn(async {});
+        event_tx
+            .send(InProcessServerEvent::Lagged { skipped: 3 })
+            .await
+            .expect("lagged marker should enqueue");
+        drop(event_tx);
+
+        let mut client = InProcessAppServerClient {
+            command_tx,
+            event_rx,
+            worker_handle,
+        };
+
+        let event = timeout(Duration::from_secs(2), client.next_event())
+            .await
+            .expect("lagged marker should arrive before timeout");
+        assert!(matches!(
+            event,
+            Some(InProcessServerEvent::Lagged { skipped: 3 })
+        ));
+
+        client.shutdown().await.expect("shutdown should complete");
+    }
+
+    #[test]
+    fn event_requires_delivery_marks_terminal_events() {
+        assert!(event_requires_delivery(
+            &InProcessServerEvent::ServerNotification(
+                codex_app_server_protocol::ServerNotification::TurnCompleted(
+                    codex_app_server_protocol::TurnCompletedNotification {
+                        thread_id: "thread".to_string(),
+                        turn: codex_app_server_protocol::Turn {
+                            id: "turn".to_string(),
+                            items: Vec::new(),
+                            status: codex_app_server_protocol::TurnStatus::Completed,
+                            error: None,
+                        },
+                    }
+                )
+            )
+        ));
+        assert!(event_requires_delivery(
+            &InProcessServerEvent::LegacyNotification(
+                codex_app_server_protocol::JSONRPCNotification {
+                    method: "codex/event/turn_aborted".to_string(),
+                    params: None,
+                }
+            )
+        ));
+        assert!(!event_requires_delivery(&InProcessServerEvent::Lagged {
+            skipped: 1
+        }));
+    }
+}

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -57,6 +57,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -66,6 +69,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],
@@ -350,6 +354,10 @@
             "string",
             "null"
           ]
+        },
+        "reloadUserConfig": {
+          "description": "When true, hot-reload the updated user config into all loaded threads after writing.",
+          "type": "boolean"
         }
       },
       "required": [
@@ -1127,6 +1135,17 @@
       },
       "type": "object"
     },
+    "PluginUninstallParams": {
+      "properties": {
+        "pluginId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "pluginId"
+      ],
+      "type": "object"
+    },
     "ProductSurface": {
       "enum": [
         "chatgpt",
@@ -3567,6 +3586,30 @@
       "title": "Plugin/installRequest",
       "type": "object"
     },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "plugin/uninstall"
+          ],
+          "title": "Plugin/uninstallRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/PluginUninstallParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "Plugin/uninstallRequest",
+      "type": "object"
+    },
     {
       "properties": {
         "id": {

codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json

@@ -286,6 +286,17 @@
         }
       ]
     },
+    "CommandExecutionRequestApprovalSkillMetadata": {
+      "properties": {
+        "pathToSkillsMd": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "pathToSkillsMd"
+      ],
+      "type": "object"
+    },
     "MacOsAutomationPermission": {
       "oneOf": [
         {

codex-rs/app-server-protocol/schema/json/EventMsg.json

@@ -1866,6 +1866,17 @@
                 "null"
               ]
             },
+            "skill_metadata": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ExecApprovalRequestSkillMetadata"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional skill metadata when the approval was triggered by a skill script."
+            },
             "turn_id": {
               "default": "",
               "description": "Turn ID that this command belongs to. Uses `#[serde(default)]` for backwards compatibility.",
@@ -1889,6 +1900,42 @@
           "title": "ExecApprovalRequestEventMsg",
           "type": "object"
         },
+        {
+          "properties": {
+            "call_id": {
+              "description": "Responses API call id for the associated tool call, if available.",
+              "type": "string"
+            },
+            "permissions": {
+              "$ref": "#/definitions/PermissionProfile"
+            },
+            "reason": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "turn_id": {
+              "default": "",
+              "description": "Turn ID that this request belongs to. Uses `#[serde(default)]` for backwards compatibility.",
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "request_permissions"
+              ],
+              "title": "RequestPermissionsEventMsgType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "call_id",
+            "permissions",
+            "type"
+          ],
+          "title": "RequestPermissionsEventMsg",
+          "type": "object"
+        },
         {
           "properties": {
             "call_id": {
@@ -3442,6 +3489,17 @@
         }
       ]
     },
+    "ExecApprovalRequestSkillMetadata": {
+      "properties": {
+        "path_to_skills_md": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "path_to_skills_md"
+      ],
+      "type": "object"
+    },
     "ExecCommandSource": {
       "enum": [
         "agent",
@@ -4625,6 +4683,10 @@
           "description": "Reject MCP elicitation prompts.",
           "type": "boolean"
         },
+        "request_permissions": {
+          "description": "Reject approval prompts related to built-in permission requests.",
+          "type": "boolean"
+        },
         "rules": {
           "description": "Reject prompts triggered by execpolicy `prompt` rules.",
           "type": "boolean"
@@ -4636,6 +4698,7 @@
       },
       "required": [
         "mcp_elicitations",
+        "request_permissions",
         "rules",
         "sandbox_approval"
       ],
@@ -7678,6 +7741,17 @@
             "null"
           ]
         },
+        "skill_metadata": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ExecApprovalRequestSkillMetadata"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Optional skill metadata when the approval was triggered by a skill script."
+        },
         "turn_id": {
           "default": "",
           "description": "Turn ID that this command belongs to. Uses `#[serde(default)]` for backwards compatibility.",
@@ -7701,6 +7775,42 @@
       "title": "ExecApprovalRequestEventMsg",
       "type": "object"
     },
+    {
+      "properties": {
+        "call_id": {
+          "description": "Responses API call id for the associated tool call, if available.",
+          "type": "string"
+        },
+        "permissions": {
+          "$ref": "#/definitions/PermissionProfile"
+        },
+        "reason": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "turn_id": {
+          "default": "",
+          "description": "Turn ID that this request belongs to. Uses `#[serde(default)]` for backwards compatibility.",
+          "type": "string"
+        },
+        "type": {
+          "enum": [
+            "request_permissions"
+          ],
+          "title": "RequestPermissionsEventMsgType",
+          "type": "string"
+        }
+      },
+      "required": [
+        "call_id",
+        "permissions",
+        "type"
+      ],
+      "title": "RequestPermissionsEventMsg",
+      "type": "object"
+    },
     {
       "properties": {
         "call_id": {

codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json

@@ -0,0 +1,164 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbsolutePathBuf": {
+      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
+      "type": "string"
+    },
+    "AdditionalFileSystemPermissions": {
+      "properties": {
+        "read": {
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "write": {
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "AdditionalMacOsPermissions": {
+      "properties": {
+        "accessibility": {
+          "type": "boolean"
+        },
+        "automations": {
+          "$ref": "#/definitions/MacOsAutomationPermission"
+        },
+        "calendar": {
+          "type": "boolean"
+        },
+        "preferences": {
+          "$ref": "#/definitions/MacOsPreferencesPermission"
+        }
+      },
+      "required": [
+        "accessibility",
+        "automations",
+        "calendar",
+        "preferences"
+      ],
+      "type": "object"
+    },
+    "AdditionalNetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "AdditionalPermissionProfile": {
+      "properties": {
+        "fileSystem": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalFileSystemPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "macos": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalMacOsPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "network": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalNetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "MacOsAutomationPermission": {
+      "oneOf": [
+        {
+          "enum": [
+            "none",
+            "all"
+          ],
+          "type": "string"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "bundle_ids": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "bundle_ids"
+          ],
+          "title": "BundleIdsMacOsAutomationPermission",
+          "type": "object"
+        }
+      ]
+    },
+    "MacOsPreferencesPermission": {
+      "enum": [
+        "none",
+        "read_only",
+        "read_write"
+      ],
+      "type": "string"
+    }
+  },
+  "properties": {
+    "itemId": {
+      "type": "string"
+    },
+    "permissions": {
+      "$ref": "#/definitions/AdditionalPermissionProfile"
+    },
+    "reason": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "threadId": {
+      "type": "string"
+    },
+    "turnId": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "itemId",
+    "permissions",
+    "threadId",
+    "turnId"
+  ],
+  "title": "PermissionsRequestApprovalParams",
+  "type": "object"
+}

codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalResponse.json

@@ -0,0 +1,175 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbsolutePathBuf": {
+      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
+      "type": "string"
+    },
+    "AdditionalFileSystemPermissions": {
+      "properties": {
+        "read": {
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "write": {
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "AdditionalNetworkPermissions": {
+      "properties": {
+        "enabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "GrantedMacOsPermissions": {
+      "properties": {
+        "accessibility": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "automations": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/MacOsAutomationPermission"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "calendar": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "preferences": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/MacOsPreferencesPermission"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "GrantedPermissionProfile": {
+      "properties": {
+        "fileSystem": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalFileSystemPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "macos": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/GrantedMacOsPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "network": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalNetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "MacOsAutomationPermission": {
+      "oneOf": [
+        {
+          "enum": [
+            "none",
+            "all"
+          ],
+          "type": "string"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "bundle_ids": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "bundle_ids"
+          ],
+          "title": "BundleIdsMacOsAutomationPermission",
+          "type": "object"
+        }
+      ]
+    },
+    "MacOsPreferencesPermission": {
+      "enum": [
+        "none",
+        "read_only",
+        "read_write"
+      ],
+      "type": "string"
+    },
+    "PermissionGrantScope": {
+      "enum": [
+        "turn",
+        "session"
+      ],
+      "type": "string"
+    }
+  },
+  "properties": {
+    "permissions": {
+      "$ref": "#/definitions/GrantedPermissionProfile"
+    },
+    "scope": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/PermissionGrantScope"
+        }
+      ],
+      "default": "turn"
+    }
+  },
+  "required": [
+    "permissions"
+  ],
+  "title": "PermissionsRequestApprovalResponse",
+  "type": "object"
+}

codex-rs/app-server-protocol/schema/json/ServerRequest.json

@@ -440,6 +440,17 @@
       ],
       "type": "object"
     },
+    "CommandExecutionRequestApprovalSkillMetadata": {
+      "properties": {
+        "pathToSkillsMd": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "pathToSkillsMd"
+      ],
+      "type": "object"
+    },
     "DynamicToolCallParams": {
       "properties": {
         "arguments": true,
@@ -1412,6 +1423,35 @@
         }
       ]
     },
+    "PermissionsRequestApprovalParams": {
+      "properties": {
+        "itemId": {
+          "type": "string"
+        },
+        "permissions": {
+          "$ref": "#/definitions/AdditionalPermissionProfile"
+        },
+        "reason": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "threadId": {
+          "type": "string"
+        },
+        "turnId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "itemId",
+        "permissions",
+        "threadId",
+        "turnId"
+      ],
+      "type": "object"
+    },
     "RequestId": {
       "anyOf": [
         {
@@ -1609,6 +1649,31 @@
       "title": "McpServer/elicitation/requestRequest",
       "type": "object"
     },
+    {
+      "description": "Request approval for additional permissions from the user.",
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "item/permissions/requestApproval"
+          ],
+          "title": "Item/permissions/requestApprovalRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/PermissionsRequestApprovalParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "Item/permissions/requestApprovalRequest",
+      "type": "object"
+    },
     {
       "description": "Execute a dynamic tool call on the client.",
       "properties": {

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -860,6 +860,30 @@
           "title": "Plugin/installRequest",
           "type": "object"
         },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "plugin/uninstall"
+              ],
+              "title": "Plugin/uninstallRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/PluginUninstallParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Plugin/uninstallRequest",
+          "type": "object"
+        },
         {
           "properties": {
             "id": {
@@ -1762,6 +1786,17 @@
       "title": "CommandExecutionRequestApprovalResponse",
       "type": "object"
     },
+    "CommandExecutionRequestApprovalSkillMetadata": {
+      "properties": {
+        "pathToSkillsMd": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "pathToSkillsMd"
+      ],
+      "type": "object"
+    },
     "CustomPrompt": {
       "properties": {
         "argument_hint": {
@@ -3182,6 +3217,17 @@
                 "null"
               ]
             },
+            "skill_metadata": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ExecApprovalRequestSkillMetadata"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional skill metadata when the approval was triggered by a skill script."
+            },
             "turn_id": {
               "default": "",
               "description": "Turn ID that this command belongs to. Uses `#[serde(default)]` for backwards compatibility.",
@@ -3205,6 +3251,42 @@
           "title": "ExecApprovalRequestEventMsg",
           "type": "object"
         },
+        {
+          "properties": {
+            "call_id": {
+              "description": "Responses API call id for the associated tool call, if available.",
+              "type": "string"
+            },
+            "permissions": {
+              "$ref": "#/definitions/PermissionProfile"
+            },
+            "reason": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "turn_id": {
+              "default": "",
+              "description": "Turn ID that this request belongs to. Uses `#[serde(default)]` for backwards compatibility.",
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "request_permissions"
+              ],
+              "title": "RequestPermissionsEventMsgType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "call_id",
+            "permissions",
+            "type"
+          ],
+          "title": "RequestPermissionsEventMsg",
+          "type": "object"
+        },
         {
           "properties": {
             "call_id": {
@@ -4759,6 +4841,17 @@
       ],
       "title": "EventMsg"
     },
+    "ExecApprovalRequestSkillMetadata": {
+      "properties": {
+        "path_to_skills_md": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "path_to_skills_md"
+      ],
+      "type": "object"
+    },
     "ExecCommandApprovalParams": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
@@ -5134,6 +5227,78 @@
       "title": "FuzzyFileSearchSessionUpdatedNotification",
       "type": "object"
     },
+    "GrantedMacOsPermissions": {
+      "properties": {
+        "accessibility": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "automations": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/MacOsAutomationPermission"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "calendar": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "preferences": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/MacOsPreferencesPermission"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "GrantedPermissionProfile": {
+      "properties": {
+        "fileSystem": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalFileSystemPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "macos": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/GrantedMacOsPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "network": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AdditionalNetworkPermissions"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "type": "object"
+    },
     "HistoryEntry": {
       "properties": {
         "conversation_id": {
@@ -6297,6 +6462,13 @@
         }
       ]
     },
+    "PermissionGrantScope": {
+      "enum": [
+        "turn",
+        "session"
+      ],
+      "type": "string"
+    },
     "PermissionProfile": {
       "properties": {
         "file_system": {
@@ -6332,6 +6504,58 @@
       },
       "type": "object"
     },
+    "PermissionsRequestApprovalParams": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "itemId": {
+          "type": "string"
+        },
+        "permissions": {
+          "$ref": "#/definitions/AdditionalPermissionProfile"
+        },
+        "reason": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "threadId": {
+          "type": "string"
+        },
+        "turnId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "itemId",
+        "permissions",
+        "threadId",
+        "turnId"
+      ],
+      "title": "PermissionsRequestApprovalParams",
+      "type": "object"
+    },
+    "PermissionsRequestApprovalResponse": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "permissions": {
+          "$ref": "#/definitions/GrantedPermissionProfile"
+        },
+        "scope": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PermissionGrantScope"
+            }
+          ],
+          "default": "turn"
+        }
+      },
+      "required": [
+        "permissions"
+      ],
+      "title": "PermissionsRequestApprovalResponse",
+      "type": "object"
+    },
     "PlanItemArg": {
       "additionalProperties": false,
       "properties": {
@@ -6528,6 +6752,10 @@
           "description": "Reject MCP elicitation prompts.",
           "type": "boolean"
         },
+        "request_permissions": {
+          "description": "Reject approval prompts related to built-in permission requests.",
+          "type": "boolean"
+        },
         "rules": {
           "description": "Reject prompts triggered by execpolicy `prompt` rules.",
           "type": "boolean"
@@ -6539,6 +6767,7 @@
       },
       "required": [
         "mcp_elicitations",
+        "request_permissions",
         "rules",
         "sandbox_approval"
       ],
@@ -7806,6 +8035,31 @@
           "title": "McpServer/elicitation/requestRequest",
           "type": "object"
         },
+        {
+          "description": "Request approval for additional permissions from the user.",
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "item/permissions/requestApproval"
+              ],
+              "title": "Item/permissions/requestApprovalRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/PermissionsRequestApprovalParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Item/permissions/requestApprovalRequest",
+          "type": "object"
+        },
         {
           "description": "Execute a dynamic tool call on the client.",
           "properties": {
@@ -8983,6 +9237,9 @@
                   "mcp_elicitations": {
                     "type": "boolean"
                   },
+                  "request_permissions": {
+                    "type": "boolean"
+                  },
                   "rules": {
                     "type": "boolean"
                   },
@@ -8992,6 +9249,7 @@
                 },
                 "required": [
                   "mcp_elicitations",
+                  "request_permissions",
                   "rules",
                   "sandbox_approval"
                 ],
@@ -9943,6 +10201,10 @@
               "string",
               "null"
             ]
+          },
+          "reloadUserConfig": {
+            "description": "When true, hot-reload the updated user config into all loaded threads after writing.",
+            "type": "boolean"
           }
         },
         "required": [
@@ -12351,6 +12613,24 @@
         ],
         "type": "object"
       },
+      "PluginUninstallParams": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "pluginId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "pluginId"
+        ],
+        "title": "PluginUninstallParams",
+        "type": "object"
+      },
+      "PluginUninstallResponse": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "title": "PluginUninstallResponse",
+        "type": "object"
+      },
       "ProductSurface": {
         "enum": [
           "chatgpt",

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -731,6 +731,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -740,6 +743,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],
@@ -1383,6 +1387,30 @@
           "title": "Plugin/installRequest",
           "type": "object"
         },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/RequestId"
+            },
+            "method": {
+              "enum": [
+                "plugin/uninstall"
+              ],
+              "title": "Plugin/uninstallRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/PluginUninstallParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Plugin/uninstallRequest",
+          "type": "object"
+        },
         {
           "properties": {
             "id": {
@@ -2962,6 +2990,10 @@
             "string",
             "null"
           ]
+        },
+        "reloadUserConfig": {
+          "description": "When true, hot-reload the updated user config into all loaded threads after writing.",
+          "type": "boolean"
         }
       },
       "required": [
@@ -4995,6 +5027,17 @@
                 "null"
               ]
             },
+            "skill_metadata": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ExecApprovalRequestSkillMetadata"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional skill metadata when the approval was triggered by a skill script."
+            },
             "turn_id": {
               "default": "",
               "description": "Turn ID that this command belongs to. Uses `#[serde(default)]` for backwards compatibility.",
@@ -5018,6 +5061,42 @@
           "title": "ExecApprovalRequestEventMsg",
           "type": "object"
         },
+        {
+          "properties": {
+            "call_id": {
+              "description": "Responses API call id for the associated tool call, if available.",
+              "type": "string"
+            },
+            "permissions": {
+              "$ref": "#/definitions/PermissionProfile"
+            },
+            "reason": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "turn_id": {
+              "default": "",
+              "description": "Turn ID that this request belongs to. Uses `#[serde(default)]` for backwards compatibility.",
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "request_permissions"
+              ],
+              "title": "RequestPermissionsEventMsgType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "call_id",
+            "permissions",
+            "type"
+          ],
+          "title": "RequestPermissionsEventMsg",
+          "type": "object"
+        },
         {
           "properties": {
             "call_id": {
@@ -6572,6 +6651,17 @@
       ],
       "title": "EventMsg"
     },
+    "ExecApprovalRequestSkillMetadata": {
+      "properties": {
+        "path_to_skills_md": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "path_to_skills_md"
+      ],
+      "type": "object"
+    },
     "ExecCommandSource": {
       "enum": [
         "agent",
@@ -8987,6 +9077,24 @@
       ],
       "type": "object"
     },
+    "PluginUninstallParams": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "pluginId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "pluginId"
+      ],
+      "title": "PluginUninstallParams",
+      "type": "object"
+    },
+    "PluginUninstallResponse": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "title": "PluginUninstallResponse",
+      "type": "object"
+    },
     "ProductSurface": {
       "enum": [
         "chatgpt",

codex-rs/app-server-protocol/schema/json/v2/ConfigBatchWriteParams.json

@@ -45,6 +45,10 @@
         "string",
         "null"
       ]
+    },
+    "reloadUserConfig": {
+      "description": "When true, hot-reload the updated user config into all loaded threads after writing.",
+      "type": "boolean"
     }
   },
   "required": [

codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json

@@ -148,6 +148,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -157,6 +160,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

@@ -20,6 +20,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -29,6 +32,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/PluginUninstallParams.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "pluginId": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "pluginId"
+  ],
+  "title": "PluginUninstallParams",
+  "type": "object"
+}

codex-rs/app-server-protocol/schema/json/v2/PluginUninstallResponse.json

@@ -0,0 +1,5 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "PluginUninstallResponse",
+  "type": "object"
+}

codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json

@@ -20,6 +20,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -29,6 +32,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json

@@ -24,6 +24,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -33,6 +36,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json

@@ -20,6 +20,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -29,6 +32,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json

@@ -24,6 +24,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -33,6 +36,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json

@@ -20,6 +20,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -29,6 +32,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json

@@ -24,6 +24,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -33,6 +36,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json

@@ -24,6 +24,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -33,6 +36,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],

codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts

@@ -27,6 +27,7 @@ import type { McpServerOauthLoginParams } from "./v2/McpServerOauthLoginParams";
 import type { ModelListParams } from "./v2/ModelListParams";
 import type { PluginInstallParams } from "./v2/PluginInstallParams";
 import type { PluginListParams } from "./v2/PluginListParams";
+import type { PluginUninstallParams } from "./v2/PluginUninstallParams";
 import type { ReviewStartParams } from "./v2/ReviewStartParams";
 import type { SkillsConfigWriteParams } from "./v2/SkillsConfigWriteParams";
 import type { SkillsListParams } from "./v2/SkillsListParams";
@@ -53,4 +54,4 @@ import type { WindowsSandboxSetupStartParams } from "./v2/WindowsSandboxSetupSta
 /**
  * Request from the client to the server.
  */
-export type ClientRequest ={ "method": "initialize", id: RequestId, params: InitializeParams, } | { "method": "thread/start", id: RequestId, params: ThreadStartParams, } | { "method": "thread/resume", id: RequestId, params: ThreadResumeParams, } | { "method": "thread/fork", id: RequestId, params: ThreadForkParams, } | { "method": "thread/archive", id: RequestId, params: ThreadArchiveParams, } | { "method": "thread/unsubscribe", id: RequestId, params: ThreadUnsubscribeParams, } | { "method": "thread/name/set", id: RequestId, params: ThreadSetNameParams, } | { "method": "thread/metadata/update", id: RequestId, params: ThreadMetadataUpdateParams, } | { "method": "thread/unarchive", id: RequestId, params: ThreadUnarchiveParams, } | { "method": "thread/compact/start", id: RequestId, params: ThreadCompactStartParams, } | { "method": "thread/rollback", id: RequestId, params: ThreadRollbackParams, } | { "method": "thread/list", id: RequestId, params: ThreadListParams, } | { "method": "thread/loaded/list", id: RequestId, params: ThreadLoadedListParams, } | { "method": "thread/read", id: RequestId, params: ThreadReadParams, } | { "method": "skills/list", id: RequestId, params: SkillsListParams, } | { "method": "plugin/list", id: RequestId, params: PluginListParams, } | { "method": "skills/remote/list", id: RequestId, params: SkillsRemoteReadParams, } | { "method": "skills/remote/export", id: RequestId, params: SkillsRemoteWriteParams, } | { "method": "app/list", id: RequestId, params: AppsListParams, } | { "method": "skills/config/write", id: RequestId, params: SkillsConfigWriteParams, } | { "method": "plugin/install", id: RequestId, params: PluginInstallParams, } | { "method": "turn/start", id: RequestId, params: TurnStartParams, } | { "method": "turn/steer", id: RequestId, params: TurnSteerParams, } | { "method": "turn/interrupt", id: RequestId, params: TurnInterruptParams, } | { "method": "review/start", id: RequestId, params: ReviewStartParams, } | { "method": "model/list", id: RequestId, params: ModelListParams, } | { "method": "experimentalFeature/list", id: RequestId, params: ExperimentalFeatureListParams, } | { "method": "mcpServer/oauth/login", id: RequestId, params: McpServerOauthLoginParams, } | { "method": "config/mcpServer/reload", id: RequestId, params: undefined, } | { "method": "mcpServerStatus/list", id: RequestId, params: ListMcpServerStatusParams, } | { "method": "windowsSandbox/setupStart", id: RequestId, params: WindowsSandboxSetupStartParams, } | { "method": "account/login/start", id: RequestId, params: LoginAccountParams, } | { "method": "account/login/cancel", id: RequestId, params: CancelLoginAccountParams, } | { "method": "account/logout", id: RequestId, params: undefined, } | { "method": "account/rateLimits/read", id: RequestId, params: undefined, } | { "method": "feedback/upload", id: RequestId, params: FeedbackUploadParams, } | { "method": "command/exec", id: RequestId, params: CommandExecParams, } | { "method": "command/exec/write", id: RequestId, params: CommandExecWriteParams, } | { "method": "command/exec/terminate", id: RequestId, params: CommandExecTerminateParams, } | { "method": "command/exec/resize", id: RequestId, params: CommandExecResizeParams, } | { "method": "config/read", id: RequestId, params: ConfigReadParams, } | { "method": "externalAgentConfig/detect", id: RequestId, params: ExternalAgentConfigDetectParams, } | { "method": "externalAgentConfig/import", id: RequestId, params: ExternalAgentConfigImportParams, } | { "method": "config/value/write", id: RequestId, params: ConfigValueWriteParams, } | { "method": "config/batchWrite", id: RequestId, params: ConfigBatchWriteParams, } | { "method": "configRequirements/read", id: RequestId, params: undefined, } | { "method": "account/read", id: RequestId, params: GetAccountParams, } | { "method": "getConversationSummary", id: RequestId, params: GetConversationSummaryParams, } | { "method": "gitDiffToRemote", id: RequestId, params: GitDiffToRemoteParams, } | { "method": "getAuthStatus", id: RequestId, params: GetAuthStatusParams, } | { "method": "fuzzyFileSearch", id: RequestId, params: FuzzyFileSearchParams, };
+export type ClientRequest ={ "method": "initialize", id: RequestId, params: InitializeParams, } | { "method": "thread/start", id: RequestId, params: ThreadStartParams, } | { "method": "thread/resume", id: RequestId, params: ThreadResumeParams, } | { "method": "thread/fork", id: RequestId, params: ThreadForkParams, } | { "method": "thread/archive", id: RequestId, params: ThreadArchiveParams, } | { "method": "thread/unsubscribe", id: RequestId, params: ThreadUnsubscribeParams, } | { "method": "thread/name/set", id: RequestId, params: ThreadSetNameParams, } | { "method": "thread/metadata/update", id: RequestId, params: ThreadMetadataUpdateParams, } | { "method": "thread/unarchive", id: RequestId, params: ThreadUnarchiveParams, } | { "method": "thread/compact/start", id: RequestId, params: ThreadCompactStartParams, } | { "method": "thread/rollback", id: RequestId, params: ThreadRollbackParams, } | { "method": "thread/list", id: RequestId, params: ThreadListParams, } | { "method": "thread/loaded/list", id: RequestId, params: ThreadLoadedListParams, } | { "method": "thread/read", id: RequestId, params: ThreadReadParams, } | { "method": "skills/list", id: RequestId, params: SkillsListParams, } | { "method": "plugin/list", id: RequestId, params: PluginListParams, } | { "method": "skills/remote/list", id: RequestId, params: SkillsRemoteReadParams, } | { "method": "skills/remote/export", id: RequestId, params: SkillsRemoteWriteParams, } | { "method": "app/list", id: RequestId, params: AppsListParams, } | { "method": "skills/config/write", id: RequestId, params: SkillsConfigWriteParams, } | { "method": "plugin/install", id: RequestId, params: PluginInstallParams, } | { "method": "plugin/uninstall", id: RequestId, params: PluginUninstallParams, } | { "method": "turn/start", id: RequestId, params: TurnStartParams, } | { "method": "turn/steer", id: RequestId, params: TurnSteerParams, } | { "method": "turn/interrupt", id: RequestId, params: TurnInterruptParams, } | { "method": "review/start", id: RequestId, params: ReviewStartParams, } | { "method": "model/list", id: RequestId, params: ModelListParams, } | { "method": "experimentalFeature/list", id: RequestId, params: ExperimentalFeatureListParams, } | { "method": "mcpServer/oauth/login", id: RequestId, params: McpServerOauthLoginParams, } | { "method": "config/mcpServer/reload", id: RequestId, params: undefined, } | { "method": "mcpServerStatus/list", id: RequestId, params: ListMcpServerStatusParams, } | { "method": "windowsSandbox/setupStart", id: RequestId, params: WindowsSandboxSetupStartParams, } | { "method": "account/login/start", id: RequestId, params: LoginAccountParams, } | { "method": "account/login/cancel", id: RequestId, params: CancelLoginAccountParams, } | { "method": "account/logout", id: RequestId, params: undefined, } | { "method": "account/rateLimits/read", id: RequestId, params: undefined, } | { "method": "feedback/upload", id: RequestId, params: FeedbackUploadParams, } | { "method": "command/exec", id: RequestId, params: CommandExecParams, } | { "method": "command/exec/write", id: RequestId, params: CommandExecWriteParams, } | { "method": "command/exec/terminate", id: RequestId, params: CommandExecTerminateParams, } | { "method": "command/exec/resize", id: RequestId, params: CommandExecResizeParams, } | { "method": "config/read", id: RequestId, params: ConfigReadParams, } | { "method": "externalAgentConfig/detect", id: RequestId, params: ExternalAgentConfigDetectParams, } | { "method": "externalAgentConfig/import", id: RequestId, params: ExternalAgentConfigImportParams, } | { "method": "config/value/write", id: RequestId, params: ConfigValueWriteParams, } | { "method": "config/batchWrite", id: RequestId, params: ConfigBatchWriteParams, } | { "method": "configRequirements/read", id: RequestId, params: undefined, } | { "method": "account/read", id: RequestId, params: GetAccountParams, } | { "method": "getConversationSummary", id: RequestId, params: GetConversationSummaryParams, } | { "method": "gitDiffToRemote", id: RequestId, params: GitDiffToRemoteParams, } | { "method": "getAuthStatus", id: RequestId, params: GetAuthStatusParams, } | { "method": "fuzzyFileSearch", id: RequestId, params: FuzzyFileSearchParams, };

codex-rs/app-server-protocol/schema/typescript/EventMsg.ts

@@ -56,6 +56,7 @@ import type { RealtimeConversationStartedEvent } from "./RealtimeConversationSta
 import type { ReasoningContentDeltaEvent } from "./ReasoningContentDeltaEvent";
 import type { ReasoningRawContentDeltaEvent } from "./ReasoningRawContentDeltaEvent";
 import type { RemoteSkillDownloadedEvent } from "./RemoteSkillDownloadedEvent";
+import type { RequestPermissionsEvent } from "./RequestPermissionsEvent";
 import type { RequestUserInputEvent } from "./RequestUserInputEvent";
 import type { ReviewRequest } from "./ReviewRequest";
 import type { SessionConfiguredEvent } from "./SessionConfiguredEvent";
@@ -81,4 +82,4 @@ import type { WebSearchEndEvent } from "./WebSearchEndEvent";
  * Response event from the agent
  * NOTE: Make sure none of these values have optional types, as it will mess up the extension code-gen.
  */
-export type EventMsg = { "type": "error" } & ErrorEvent | { "type": "warning" } & WarningEvent | { "type": "realtime_conversation_started" } & RealtimeConversationStartedEvent | { "type": "realtime_conversation_realtime" } & RealtimeConversationRealtimeEvent | { "type": "realtime_conversation_closed" } & RealtimeConversationClosedEvent | { "type": "model_reroute" } & ModelRerouteEvent | { "type": "context_compacted" } & ContextCompactedEvent | { "type": "thread_rolled_back" } & ThreadRolledBackEvent | { "type": "task_started" } & TurnStartedEvent | { "type": "task_complete" } & TurnCompleteEvent | { "type": "token_count" } & TokenCountEvent | { "type": "agent_message" } & AgentMessageEvent | { "type": "user_message" } & UserMessageEvent | { "type": "agent_message_delta" } & AgentMessageDeltaEvent | { "type": "agent_reasoning" } & AgentReasoningEvent | { "type": "agent_reasoning_delta" } & AgentReasoningDeltaEvent | { "type": "agent_reasoning_raw_content" } & AgentReasoningRawContentEvent | { "type": "agent_reasoning_raw_content_delta" } & AgentReasoningRawContentDeltaEvent | { "type": "agent_reasoning_section_break" } & AgentReasoningSectionBreakEvent | { "type": "session_configured" } & SessionConfiguredEvent | { "type": "thread_name_updated" } & ThreadNameUpdatedEvent | { "type": "mcp_startup_update" } & McpStartupUpdateEvent | { "type": "mcp_startup_complete" } & McpStartupCompleteEvent | { "type": "mcp_tool_call_begin" } & McpToolCallBeginEvent | { "type": "mcp_tool_call_end" } & McpToolCallEndEvent | { "type": "web_search_begin" } & WebSearchBeginEvent | { "type": "web_search_end" } & WebSearchEndEvent | { "type": "image_generation_begin" } & ImageGenerationBeginEvent | { "type": "image_generation_end" } & ImageGenerationEndEvent | { "type": "exec_command_begin" } & ExecCommandBeginEvent | { "type": "exec_command_output_delta" } & ExecCommandOutputDeltaEvent | { "type": "terminal_interaction" } & TerminalInteractionEvent | { "type": "exec_command_end" } & ExecCommandEndEvent | { "type": "view_image_tool_call" } & ViewImageToolCallEvent | { "type": "exec_approval_request" } & ExecApprovalRequestEvent | { "type": "request_user_input" } & RequestUserInputEvent | { "type": "dynamic_tool_call_request" } & DynamicToolCallRequest | { "type": "dynamic_tool_call_response" } & DynamicToolCallResponseEvent | { "type": "elicitation_request" } & ElicitationRequestEvent | { "type": "apply_patch_approval_request" } & ApplyPatchApprovalRequestEvent | { "type": "deprecation_notice" } & DeprecationNoticeEvent | { "type": "background_event" } & BackgroundEventEvent | { "type": "undo_started" } & UndoStartedEvent | { "type": "undo_completed" } & UndoCompletedEvent | { "type": "stream_error" } & StreamErrorEvent | { "type": "patch_apply_begin" } & PatchApplyBeginEvent | { "type": "patch_apply_end" } & PatchApplyEndEvent | { "type": "turn_diff" } & TurnDiffEvent | { "type": "get_history_entry_response" } & GetHistoryEntryResponseEvent | { "type": "mcp_list_tools_response" } & McpListToolsResponseEvent | { "type": "list_custom_prompts_response" } & ListCustomPromptsResponseEvent | { "type": "list_skills_response" } & ListSkillsResponseEvent | { "type": "list_remote_skills_response" } & ListRemoteSkillsResponseEvent | { "type": "remote_skill_downloaded" } & RemoteSkillDownloadedEvent | { "type": "skills_update_available" } | { "type": "plan_update" } & UpdatePlanArgs | { "type": "turn_aborted" } & TurnAbortedEvent | { "type": "shutdown_complete" } | { "type": "entered_review_mode" } & ReviewRequest | { "type": "exited_review_mode" } & ExitedReviewModeEvent | { "type": "raw_response_item" } & RawResponseItemEvent | { "type": "item_started" } & ItemStartedEvent | { "type": "item_completed" } & ItemCompletedEvent | { "type": "agent_message_content_delta" } & AgentMessageContentDeltaEvent | { "type": "plan_delta" } & PlanDeltaEvent | { "type": "reasoning_content_delta" } & ReasoningContentDeltaEvent | { "type": "reasoning_raw_content_delta" } & ReasoningRawContentDeltaEvent | { "type": "collab_agent_spawn_begin" } & CollabAgentSpawnBeginEvent | { "type": "collab_agent_spawn_end" } & CollabAgentSpawnEndEvent | { "type": "collab_agent_interaction_begin" } & CollabAgentInteractionBeginEvent | { "type": "collab_agent_interaction_end" } & CollabAgentInteractionEndEvent | { "type": "collab_waiting_begin" } & CollabWaitingBeginEvent | { "type": "collab_waiting_end" } & CollabWaitingEndEvent | { "type": "collab_close_begin" } & CollabCloseBeginEvent | { "type": "collab_close_end" } & CollabCloseEndEvent | { "type": "collab_resume_begin" } & CollabResumeBeginEvent | { "type": "collab_resume_end" } & CollabResumeEndEvent;
+export type EventMsg = { "type": "error" } & ErrorEvent | { "type": "warning" } & WarningEvent | { "type": "realtime_conversation_started" } & RealtimeConversationStartedEvent | { "type": "realtime_conversation_realtime" } & RealtimeConversationRealtimeEvent | { "type": "realtime_conversation_closed" } & RealtimeConversationClosedEvent | { "type": "model_reroute" } & ModelRerouteEvent | { "type": "context_compacted" } & ContextCompactedEvent | { "type": "thread_rolled_back" } & ThreadRolledBackEvent | { "type": "task_started" } & TurnStartedEvent | { "type": "task_complete" } & TurnCompleteEvent | { "type": "token_count" } & TokenCountEvent | { "type": "agent_message" } & AgentMessageEvent | { "type": "user_message" } & UserMessageEvent | { "type": "agent_message_delta" } & AgentMessageDeltaEvent | { "type": "agent_reasoning" } & AgentReasoningEvent | { "type": "agent_reasoning_delta" } & AgentReasoningDeltaEvent | { "type": "agent_reasoning_raw_content" } & AgentReasoningRawContentEvent | { "type": "agent_reasoning_raw_content_delta" } & AgentReasoningRawContentDeltaEvent | { "type": "agent_reasoning_section_break" } & AgentReasoningSectionBreakEvent | { "type": "session_configured" } & SessionConfiguredEvent | { "type": "thread_name_updated" } & ThreadNameUpdatedEvent | { "type": "mcp_startup_update" } & McpStartupUpdateEvent | { "type": "mcp_startup_complete" } & McpStartupCompleteEvent | { "type": "mcp_tool_call_begin" } & McpToolCallBeginEvent | { "type": "mcp_tool_call_end" } & McpToolCallEndEvent | { "type": "web_search_begin" } & WebSearchBeginEvent | { "type": "web_search_end" } & WebSearchEndEvent | { "type": "image_generation_begin" } & ImageGenerationBeginEvent | { "type": "image_generation_end" } & ImageGenerationEndEvent | { "type": "exec_command_begin" } & ExecCommandBeginEvent | { "type": "exec_command_output_delta" } & ExecCommandOutputDeltaEvent | { "type": "terminal_interaction" } & TerminalInteractionEvent | { "type": "exec_command_end" } & ExecCommandEndEvent | { "type": "view_image_tool_call" } & ViewImageToolCallEvent | { "type": "exec_approval_request" } & ExecApprovalRequestEvent | { "type": "request_permissions" } & RequestPermissionsEvent | { "type": "request_user_input" } & RequestUserInputEvent | { "type": "dynamic_tool_call_request" } & DynamicToolCallRequest | { "type": "dynamic_tool_call_response" } & DynamicToolCallResponseEvent | { "type": "elicitation_request" } & ElicitationRequestEvent | { "type": "apply_patch_approval_request" } & ApplyPatchApprovalRequestEvent | { "type": "deprecation_notice" } & DeprecationNoticeEvent | { "type": "background_event" } & BackgroundEventEvent | { "type": "undo_started" } & UndoStartedEvent | { "type": "undo_completed" } & UndoCompletedEvent | { "type": "stream_error" } & StreamErrorEvent | { "type": "patch_apply_begin" } & PatchApplyBeginEvent | { "type": "patch_apply_end" } & PatchApplyEndEvent | { "type": "turn_diff" } & TurnDiffEvent | { "type": "get_history_entry_response" } & GetHistoryEntryResponseEvent | { "type": "mcp_list_tools_response" } & McpListToolsResponseEvent | { "type": "list_custom_prompts_response" } & ListCustomPromptsResponseEvent | { "type": "list_skills_response" } & ListSkillsResponseEvent | { "type": "list_remote_skills_response" } & ListRemoteSkillsResponseEvent | { "type": "remote_skill_downloaded" } & RemoteSkillDownloadedEvent | { "type": "skills_update_available" } | { "type": "plan_update" } & UpdatePlanArgs | { "type": "turn_aborted" } & TurnAbortedEvent | { "type": "shutdown_complete" } | { "type": "entered_review_mode" } & ReviewRequest | { "type": "exited_review_mode" } & ExitedReviewModeEvent | { "type": "raw_response_item" } & RawResponseItemEvent | { "type": "item_started" } & ItemStartedEvent | { "type": "item_completed" } & ItemCompletedEvent | { "type": "agent_message_content_delta" } & AgentMessageContentDeltaEvent | { "type": "plan_delta" } & PlanDeltaEvent | { "type": "reasoning_content_delta" } & ReasoningContentDeltaEvent | { "type": "reasoning_raw_content_delta" } & ReasoningRawContentDeltaEvent | { "type": "collab_agent_spawn_begin" } & CollabAgentSpawnBeginEvent | { "type": "collab_agent_spawn_end" } & CollabAgentSpawnEndEvent | { "type": "collab_agent_interaction_begin" } & CollabAgentInteractionBeginEvent | { "type": "collab_agent_interaction_end" } & CollabAgentInteractionEndEvent | { "type": "collab_waiting_begin" } & CollabWaitingBeginEvent | { "type": "collab_waiting_end" } & CollabWaitingEndEvent | { "type": "collab_close_begin" } & CollabCloseBeginEvent | { "type": "collab_close_end" } & CollabCloseEndEvent | { "type": "collab_resume_begin" } & CollabResumeBeginEvent | { "type": "collab_resume_end" } & CollabResumeEndEvent;

codex-rs/app-server-protocol/schema/typescript/ExecApprovalRequestEvent.ts

@@ -1,6 +1,7 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ExecApprovalRequestSkillMetadata } from "./ExecApprovalRequestSkillMetadata";
 import type { ExecPolicyAmendment } from "./ExecPolicyAmendment";
 import type { NetworkApprovalContext } from "./NetworkApprovalContext";
 import type { NetworkPolicyAmendment } from "./NetworkPolicyAmendment";
@@ -53,6 +54,10 @@ proposed_network_policy_amendments?: Array<NetworkPolicyAmendment>,
  * Optional additional filesystem permissions requested for this command.
  */
 additional_permissions?: PermissionProfile, 
+/**
+ * Optional skill metadata when the approval was triggered by a skill script.
+ */
+skill_metadata?: ExecApprovalRequestSkillMetadata, 
 /**
  * Ordered list of decisions the client may present for this prompt.
  *

codex-rs/app-server-protocol/schema/typescript/ExecApprovalRequestSkillMetadata.ts

@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ExecApprovalRequestSkillMetadata = { path_to_skills_md: string, };

codex-rs/app-server-protocol/schema/typescript/RejectConfig.ts

@@ -11,6 +11,10 @@ sandbox_approval: boolean,
  * Reject prompts triggered by execpolicy `prompt` rules.
  */
 rules: boolean, 
+/**
+ * Reject approval prompts related to built-in permission requests.
+ */
+request_permissions: boolean, 
 /**
  * Reject MCP elicitation prompts.
  */

codex-rs/app-server-protocol/schema/typescript/RequestPermissionsEvent.ts

@@ -0,0 +1,15 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { PermissionProfile } from "./PermissionProfile";
+
+export type RequestPermissionsEvent = { 
+/**
+ * Responses API call id for the associated tool call, if available.
+ */
+call_id: string, 
+/**
+ * Turn ID that this request belongs to.
+ * Uses `#[serde(default)]` for backwards compatibility.
+ */
+turn_id: string, reason: string | null, permissions: PermissionProfile, };

codex-rs/app-server-protocol/schema/typescript/ServerRequest.ts

@@ -9,9 +9,10 @@ import type { CommandExecutionRequestApprovalParams } from "./v2/CommandExecutio
 import type { DynamicToolCallParams } from "./v2/DynamicToolCallParams";
 import type { FileChangeRequestApprovalParams } from "./v2/FileChangeRequestApprovalParams";
 import type { McpServerElicitationRequestParams } from "./v2/McpServerElicitationRequestParams";
+import type { PermissionsRequestApprovalParams } from "./v2/PermissionsRequestApprovalParams";
 import type { ToolRequestUserInputParams } from "./v2/ToolRequestUserInputParams";
 
 /**
  * Request initiated from the server and sent to the client.
  */
-export type ServerRequest = { "method": "item/commandExecution/requestApproval", id: RequestId, params: CommandExecutionRequestApprovalParams, } | { "method": "item/fileChange/requestApproval", id: RequestId, params: FileChangeRequestApprovalParams, } | { "method": "item/tool/requestUserInput", id: RequestId, params: ToolRequestUserInputParams, } | { "method": "mcpServer/elicitation/request", id: RequestId, params: McpServerElicitationRequestParams, } | { "method": "item/tool/call", id: RequestId, params: DynamicToolCallParams, } | { "method": "account/chatgptAuthTokens/refresh", id: RequestId, params: ChatgptAuthTokensRefreshParams, } | { "method": "applyPatchApproval", id: RequestId, params: ApplyPatchApprovalParams, } | { "method": "execCommandApproval", id: RequestId, params: ExecCommandApprovalParams, };
+export type ServerRequest = { "method": "item/commandExecution/requestApproval", id: RequestId, params: CommandExecutionRequestApprovalParams, } | { "method": "item/fileChange/requestApproval", id: RequestId, params: FileChangeRequestApprovalParams, } | { "method": "item/tool/requestUserInput", id: RequestId, params: ToolRequestUserInputParams, } | { "method": "mcpServer/elicitation/request", id: RequestId, params: McpServerElicitationRequestParams, } | { "method": "item/permissions/requestApproval", id: RequestId, params: PermissionsRequestApprovalParams, } | { "method": "item/tool/call", id: RequestId, params: DynamicToolCallParams, } | { "method": "account/chatgptAuthTokens/refresh", id: RequestId, params: ChatgptAuthTokensRefreshParams, } | { "method": "applyPatchApproval", id: RequestId, params: ApplyPatchApprovalParams, } | { "method": "execCommandApproval", id: RequestId, params: ExecCommandApprovalParams, };

codex-rs/app-server-protocol/schema/typescript/index.ts

@@ -53,6 +53,7 @@ export type { ElicitationRequestEvent } from "./ElicitationRequestEvent";
 export type { ErrorEvent } from "./ErrorEvent";
 export type { EventMsg } from "./EventMsg";
 export type { ExecApprovalRequestEvent } from "./ExecApprovalRequestEvent";
+export type { ExecApprovalRequestSkillMetadata } from "./ExecApprovalRequestSkillMetadata";
 export type { ExecCommandApprovalParams } from "./ExecCommandApprovalParams";
 export type { ExecCommandApprovalResponse } from "./ExecCommandApprovalResponse";
 export type { ExecCommandBeginEvent } from "./ExecCommandBeginEvent";
@@ -154,6 +155,7 @@ export type { RejectConfig } from "./RejectConfig";
 export type { RemoteSkillDownloadedEvent } from "./RemoteSkillDownloadedEvent";
 export type { RemoteSkillSummary } from "./RemoteSkillSummary";
 export type { RequestId } from "./RequestId";
+export type { RequestPermissionsEvent } from "./RequestPermissionsEvent";
 export type { RequestUserInputEvent } from "./RequestUserInputEvent";
 export type { RequestUserInputQuestion } from "./RequestUserInputQuestion";
 export type { RequestUserInputQuestionOption } from "./RequestUserInputQuestionOption";

codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts

@@ -2,4 +2,4 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": { sandbox_approval: boolean, rules: boolean, mcp_elicitations: boolean, } } | "never";
+export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": { sandbox_approval: boolean, rules: boolean, request_permissions: boolean, mcp_elicitations: boolean, } } | "never";

codex-rs/app-server-protocol/schema/typescript/v2/CommandExecutionRequestApprovalParams.ts

@@ -4,6 +4,7 @@
 import type { AdditionalPermissionProfile } from "./AdditionalPermissionProfile";
 import type { CommandAction } from "./CommandAction";
 import type { CommandExecutionApprovalDecision } from "./CommandExecutionApprovalDecision";
+import type { CommandExecutionRequestApprovalSkillMetadata } from "./CommandExecutionRequestApprovalSkillMetadata";
 import type { ExecPolicyAmendment } from "./ExecPolicyAmendment";
 import type { NetworkApprovalContext } from "./NetworkApprovalContext";
 import type { NetworkPolicyAmendment } from "./NetworkPolicyAmendment";
@@ -43,6 +44,10 @@ commandActions?: Array<CommandAction> | null,
  * Optional additional permissions requested for this command.
  */
 additionalPermissions?: AdditionalPermissionProfile | null, 
+/**
+ * Optional skill metadata when the approval was triggered by a skill script.
+ */
+skillMetadata?: CommandExecutionRequestApprovalSkillMetadata | null, 
 /**
  * Optional proposed execpolicy amendment to allow similar commands without prompting.
  */

codex-rs/app-server-protocol/schema/typescript/v2/CommandExecutionRequestApprovalSkillMetadata.ts

@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type CommandExecutionRequestApprovalSkillMetadata = { pathToSkillsMd: string, };

codex-rs/app-server-protocol/schema/typescript/v2/ConfigBatchWriteParams.ts

@@ -7,4 +7,8 @@ export type ConfigBatchWriteParams = { edits: Array<ConfigEdit>,
 /**
  * Path to the config file to write; defaults to the user's `config.toml` when omitted.
  */
-filePath?: string | null, expectedVersion?: string | null, };
+filePath?: string | null, expectedVersion?: string | null, 
+/**
+ * When true, hot-reload the updated user config into all loaded threads after writing.
+ */
+reloadUserConfig?: boolean, };

codex-rs/app-server-protocol/schema/typescript/v2/GrantedMacOsPermissions.ts

@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { MacOsAutomationPermission } from "../MacOsAutomationPermission";
+import type { MacOsPreferencesPermission } from "../MacOsPreferencesPermission";
+
+export type GrantedMacOsPermissions = { preferences?: MacOsPreferencesPermission, automations?: MacOsAutomationPermission, accessibility?: boolean, calendar?: boolean, };

codex-rs/app-server-protocol/schema/typescript/v2/GrantedPermissionProfile.ts

@@ -0,0 +1,8 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AdditionalFileSystemPermissions } from "./AdditionalFileSystemPermissions";
+import type { AdditionalNetworkPermissions } from "./AdditionalNetworkPermissions";
+import type { GrantedMacOsPermissions } from "./GrantedMacOsPermissions";
+
+export type GrantedPermissionProfile = { network?: AdditionalNetworkPermissions, fileSystem?: AdditionalFileSystemPermissions, macos?: GrantedMacOsPermissions, };

codex-rs/app-server-protocol/schema/typescript/v2/PermissionGrantScope.ts

@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type PermissionGrantScope = "turn" | "session";

codex-rs/app-server-protocol/schema/typescript/v2/PermissionsRequestApprovalParams.ts

@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AdditionalPermissionProfile } from "./AdditionalPermissionProfile";
+
+export type PermissionsRequestApprovalParams = { threadId: string, turnId: string, itemId: string, reason: string | null, permissions: AdditionalPermissionProfile, };

codex-rs/app-server-protocol/schema/typescript/v2/PermissionsRequestApprovalResponse.ts

@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { GrantedPermissionProfile } from "./GrantedPermissionProfile";
+import type { PermissionGrantScope } from "./PermissionGrantScope";
+
+export type PermissionsRequestApprovalResponse = { permissions: GrantedPermissionProfile, scope: PermissionGrantScope, };

codex-rs/app-server-protocol/schema/typescript/v2/PluginUninstallParams.ts

@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type PluginUninstallParams = { pluginId: string, };

codex-rs/app-server-protocol/schema/typescript/v2/PluginUninstallResponse.ts

@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type PluginUninstallResponse = Record<string, never>;

codex-rs/app-server-protocol/schema/typescript/v2/index.ts

@@ -53,6 +53,7 @@ export type { CommandExecutionApprovalDecision } from "./CommandExecutionApprova
 export type { CommandExecutionOutputDeltaNotification } from "./CommandExecutionOutputDeltaNotification";
 export type { CommandExecutionRequestApprovalParams } from "./CommandExecutionRequestApprovalParams";
 export type { CommandExecutionRequestApprovalResponse } from "./CommandExecutionRequestApprovalResponse";
+export type { CommandExecutionRequestApprovalSkillMetadata } from "./CommandExecutionRequestApprovalSkillMetadata";
 export type { CommandExecutionStatus } from "./CommandExecutionStatus";
 export type { Config } from "./Config";
 export type { ConfigBatchWriteParams } from "./ConfigBatchWriteParams";
@@ -98,6 +99,8 @@ export type { GetAccountParams } from "./GetAccountParams";
 export type { GetAccountRateLimitsResponse } from "./GetAccountRateLimitsResponse";
 export type { GetAccountResponse } from "./GetAccountResponse";
 export type { GitInfo } from "./GitInfo";
+export type { GrantedMacOsPermissions } from "./GrantedMacOsPermissions";
+export type { GrantedPermissionProfile } from "./GrantedPermissionProfile";
 export type { HazelnutScope } from "./HazelnutScope";
 export type { ItemCompletedNotification } from "./ItemCompletedNotification";
 export type { ItemStartedNotification } from "./ItemStartedNotification";
@@ -158,6 +161,9 @@ export type { NetworkRequirements } from "./NetworkRequirements";
 export type { OverriddenMetadata } from "./OverriddenMetadata";
 export type { PatchApplyStatus } from "./PatchApplyStatus";
 export type { PatchChangeKind } from "./PatchChangeKind";
+export type { PermissionGrantScope } from "./PermissionGrantScope";
+export type { PermissionsRequestApprovalParams } from "./PermissionsRequestApprovalParams";
+export type { PermissionsRequestApprovalResponse } from "./PermissionsRequestApprovalResponse";
 export type { PlanDeltaNotification } from "./PlanDeltaNotification";
 export type { PluginInstallParams } from "./PluginInstallParams";
 export type { PluginInstallResponse } from "./PluginInstallResponse";
@@ -167,6 +173,8 @@ export type { PluginListResponse } from "./PluginListResponse";
 export type { PluginMarketplaceEntry } from "./PluginMarketplaceEntry";
 export type { PluginSource } from "./PluginSource";
 export type { PluginSummary } from "./PluginSummary";
+export type { PluginUninstallParams } from "./PluginUninstallParams";
+export type { PluginUninstallResponse } from "./PluginUninstallResponse";
 export type { ProductSurface } from "./ProductSurface";
 export type { ProfileV2 } from "./ProfileV2";
 export type { RateLimitSnapshot } from "./RateLimitSnapshot";

codex-rs/app-server-protocol/src/export.rs

@@ -23,6 +23,7 @@ use schemars::schema_for;
 use serde::Serialize;
 use serde_json::Map;
 use serde_json::Value;
+use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::collections::HashSet;
 use std::ffi::OsStr;
@@ -32,9 +33,10 @@ use std::io::Write;
 use std::path::Path;
 use std::path::PathBuf;
 use std::process::Command;
+use std::thread;
 use ts_rs::TS;
 
-const HEADER: &str = "// GENERATED CODE! DO NOT MODIFY BY HAND!\n\n";
+pub(crate) const GENERATED_TS_HEADER: &str = "// GENERATED CODE! DO NOT MODIFY BY HAND!\n\n";
 const IGNORED_DEFINITIONS: &[&str] = &["Option<()>"];
 const JSON_V1_ALLOWLIST: &[&str] = &["InitializeParams", "InitializeResponse"];
 const SPECIAL_DEFINITIONS: &[&str] = &[
@@ -137,9 +139,29 @@ pub fn generate_ts_with_options(
     }
 
     if options.ensure_headers {
-        for file in &ts_files {
-            prepend_header_if_missing(file)?;
-        }
+        let worker_count = thread::available_parallelism()
+            .map_or(1, usize::from)
+            .min(ts_files.len().max(1));
+        let chunk_size = ts_files.len().div_ceil(worker_count);
+        thread::scope(|scope| -> Result<()> {
+            let mut workers = Vec::new();
+            for chunk in ts_files.chunks(chunk_size.max(1)) {
+                workers.push(scope.spawn(move || -> Result<()> {
+                    for file in chunk {
+                        prepend_header_if_missing(file)?;
+                    }
+                    Ok(())
+                }));
+            }
+
+            for worker in workers {
+                worker
+                    .join()
+                    .map_err(|_| anyhow!("TypeScript header worker panicked"))??;
+            }
+
+            Ok(())
+        })?;
     }
 
     // Optionally run Prettier on all generated TS files.
@@ -231,6 +253,41 @@ fn filter_experimental_ts(out_dir: &Path) -> Result<()> {
     Ok(())
 }
 
+pub(crate) fn filter_experimental_ts_tree(tree: &mut BTreeMap<PathBuf, String>) -> Result<()> {
+    let registered_fields = experimental_fields();
+    let experimental_method_types = experimental_method_types();
+    if let Some(content) = tree.get_mut(Path::new("ClientRequest.ts")) {
+        let filtered =
+            filter_client_request_ts_contents(std::mem::take(content), EXPERIMENTAL_CLIENT_METHODS);
+        *content = filtered;
+    }
+
+    let mut fields_by_type_name: HashMap<String, HashSet<String>> = HashMap::new();
+    for field in registered_fields {
+        fields_by_type_name
+            .entry(field.type_name.to_string())
+            .or_default()
+            .insert(field.field_name.to_string());
+    }
+
+    for (path, content) in tree.iter_mut() {
+        let Some(type_name) = path.file_stem().and_then(|stem| stem.to_str()) else {
+            continue;
+        };
+        let Some(experimental_field_names) = fields_by_type_name.get(type_name) else {
+            continue;
+        };
+        let filtered = filter_experimental_type_fields_ts_contents(
+            std::mem::take(content),
+            experimental_field_names,
+        );
+        *content = filtered;
+    }
+
+    remove_generated_type_entries(tree, &experimental_method_types, "ts");
+    Ok(())
+}
+
 /// Removes union arms from `ClientRequest.ts` for methods marked experimental.
 fn filter_client_request_ts(out_dir: &Path, experimental_methods: &[&str]) -> Result<()> {
     let path = out_dir.join("ClientRequest.ts");
@@ -239,9 +296,15 @@ fn filter_client_request_ts(out_dir: &Path, experimental_methods: &[&str]) -> Re
     }
     let mut content =
         fs::read_to_string(&path).with_context(|| format!("Failed to read {}", path.display()))?;
+    content = filter_client_request_ts_contents(content, experimental_methods);
 
+    fs::write(&path, content).with_context(|| format!("Failed to write {}", path.display()))?;
+    Ok(())
+}
+
+fn filter_client_request_ts_contents(mut content: String, experimental_methods: &[&str]) -> String {
     let Some((prefix, body, suffix)) = split_type_alias(&content) else {
-        return Ok(());
+        return content;
     };
     let experimental_methods: HashSet<&str> = experimental_methods
         .iter()
@@ -259,12 +322,9 @@ fn filter_client_request_ts(out_dir: &Path, experimental_methods: &[&str]) -> Re
     let new_body = filtered_arms.join(" | ");
     content = format!("{prefix}{new_body}{suffix}");
     let import_usage_scope = split_type_alias(&content)
-        .map(|(_, body, _)| body)
+        .map(|(_, filtered_body, _)| filtered_body)
         .unwrap_or_else(|| new_body.clone());
-    content = prune_unused_type_imports(content, &import_usage_scope);
-
-    fs::write(&path, content).with_context(|| format!("Failed to write {}", path.display()))?;
-    Ok(())
+    prune_unused_type_imports(content, &import_usage_scope)
 }
 
 /// Removes experimental properties from generated TypeScript type files.
@@ -302,8 +362,17 @@ fn filter_experimental_fields_in_ts_file(
 ) -> Result<()> {
     let mut content =
         fs::read_to_string(path).with_context(|| format!("Failed to read {}", path.display()))?;
+    content = filter_experimental_type_fields_ts_contents(content, experimental_field_names);
+    fs::write(path, content).with_context(|| format!("Failed to write {}", path.display()))?;
+    Ok(())
+}
+
+fn filter_experimental_type_fields_ts_contents(
+    mut content: String,
+    experimental_field_names: &HashSet<String>,
+) -> String {
     let Some((open_brace, close_brace)) = type_body_brace_span(&content) else {
-        return Ok(());
+        return content;
     };
     let inner = &content[open_brace + 1..close_brace];
     let fields = split_top_level_multi(inner, &[',', ';']);
@@ -322,9 +391,7 @@ fn filter_experimental_fields_in_ts_file(
     let import_usage_scope = split_type_alias(&content)
         .map(|(_, body, _)| body)
         .unwrap_or_else(|| new_inner.clone());
-    content = prune_unused_type_imports(content, &import_usage_scope);
-    fs::write(path, content).with_context(|| format!("Failed to write {}", path.display()))?;
-    Ok(())
+    prune_unused_type_imports(content, &import_usage_scope)
 }
 
 fn filter_experimental_schema(bundle: &mut Value) -> Result<()> {
@@ -526,6 +593,23 @@ fn remove_generated_type_files(
     Ok(())
 }
 
+fn remove_generated_type_entries(
+    tree: &mut BTreeMap<PathBuf, String>,
+    type_names: &HashSet<String>,
+    extension: &str,
+) {
+    for type_name in type_names {
+        for subdir in ["", "v1", "v2"] {
+            let path = if subdir.is_empty() {
+                PathBuf::from(format!("{type_name}.{extension}"))
+            } else {
+                PathBuf::from(subdir).join(format!("{type_name}.{extension}"))
+            };
+            tree.remove(&path);
+        }
+    }
+}
+
 fn remove_experimental_method_type_definitions(bundle: &mut Value) {
     let type_names = experimental_method_types();
     let Some(definitions) = bundle.get_mut("definitions").and_then(Value::as_object_mut) else {
@@ -1807,13 +1891,13 @@ fn prepend_header_if_missing(path: &Path) -> Result<()> {
             .with_context(|| format!("Failed to read {}", path.display()))?;
     }
 
-    if content.starts_with(HEADER) {
+    if content.starts_with(GENERATED_TS_HEADER) {
         return Ok(());
     }
 
     let mut f = fs::File::create(path)
         .with_context(|| format!("Failed to open {} for writing", path.display()))?;
-    f.write_all(HEADER.as_bytes())
+    f.write_all(GENERATED_TS_HEADER.as_bytes())
         .with_context(|| format!("Failed to write header to {}", path.display()))?;
     f.write_all(content.as_bytes())
         .with_context(|| format!("Failed to write content to {}", path.display()))?;
@@ -1858,35 +1942,15 @@ fn ts_files_in_recursive(dir: &Path) -> Result<Vec<PathBuf>> {
 /// Generate an index.ts file that re-exports all generated types.
 /// This allows consumers to import all types from a single file.
 fn generate_index_ts(out_dir: &Path) -> Result<PathBuf> {
-    let mut entries: Vec<String> = Vec::new();
-    let mut stems: Vec<String> = ts_files_in(out_dir)?
-        .into_iter()
-        .filter_map(|p| {
-            let stem = p.file_stem()?.to_string_lossy().into_owned();
-            if stem == "index" { None } else { Some(stem) }
-        })
-        .collect();
-    stems.sort();
-    stems.dedup();
-
-    for name in stems {
-        entries.push(format!("export type {{ {name} }} from \"./{name}\";\n"));
-    }
-
-    // If this is the root out_dir and a ./v2 folder exists with TS files,
-    // expose it as a namespace to avoid symbol collisions at the root.
-    let v2_dir = out_dir.join("v2");
-    let has_v2_ts = ts_files_in(&v2_dir).map(|v| !v.is_empty()).unwrap_or(false);
-    if has_v2_ts {
-        entries.push("export * as v2 from \"./v2\";\n".to_string());
-    }
-
-    let mut content =
-        String::with_capacity(HEADER.len() + entries.iter().map(String::len).sum::<usize>());
-    content.push_str(HEADER);
-    for line in &entries {
-        content.push_str(line);
-    }
+    let content = generated_index_ts_with_header(index_ts_entries(
+        &ts_files_in(out_dir)?
+            .iter()
+            .map(PathBuf::as_path)
+            .collect::<Vec<_>>(),
+        ts_files_in(&out_dir.join("v2"))
+            .map(|v| !v.is_empty())
+            .unwrap_or(false),
+    ));
 
     let index_path = out_dir.join("index.ts");
     let mut f = fs::File::create(&index_path)
@@ -1896,244 +1960,278 @@ fn generate_index_ts(out_dir: &Path) -> Result<PathBuf> {
     Ok(index_path)
 }
 
+pub(crate) fn generate_index_ts_tree(tree: &mut BTreeMap<PathBuf, String>) {
+    let root_entries = tree
+        .keys()
+        .filter(|path| path.components().count() == 1)
+        .map(PathBuf::as_path)
+        .collect::<Vec<_>>();
+    let has_v2_ts = tree.keys().any(|path| {
+        path.parent()
+            .is_some_and(|parent| parent == Path::new("v2"))
+            && path.extension() == Some(OsStr::new("ts"))
+            && path.file_stem().is_some_and(|stem| stem != "index")
+    });
+    tree.insert(
+        PathBuf::from("index.ts"),
+        index_ts_entries(&root_entries, has_v2_ts),
+    );
+
+    let v2_entries = tree
+        .keys()
+        .filter(|path| {
+            path.parent()
+                .is_some_and(|parent| parent == Path::new("v2"))
+        })
+        .map(PathBuf::as_path)
+        .collect::<Vec<_>>();
+    if !v2_entries.is_empty() {
+        tree.insert(
+            PathBuf::from("v2").join("index.ts"),
+            index_ts_entries(&v2_entries, false),
+        );
+    }
+}
+
+fn generated_index_ts_with_header(content: String) -> String {
+    let mut with_header = String::with_capacity(GENERATED_TS_HEADER.len() + content.len());
+    with_header.push_str(GENERATED_TS_HEADER);
+    with_header.push_str(&content);
+    with_header
+}
+
+fn index_ts_entries(paths: &[&Path], has_v2_ts: bool) -> String {
+    let mut stems: Vec<String> = paths
+        .iter()
+        .filter(|path| path.extension() == Some(OsStr::new("ts")))
+        .filter_map(|path| {
+            let stem = path.file_stem()?.to_string_lossy().into_owned();
+            if stem == "index" { None } else { Some(stem) }
+        })
+        .collect();
+    stems.sort();
+    stems.dedup();
+
+    let mut entries = String::new();
+    for name in stems {
+        entries.push_str(&format!("export type {{ {name} }} from \"./{name}\";\n"));
+    }
+    if has_v2_ts {
+        entries.push_str("export * as v2 from \"./v2\";\n");
+    }
+    entries
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::protocol::v2;
+    use crate::schema_fixtures::read_schema_fixture_subtree;
+    use anyhow::Context;
     use anyhow::Result;
     use pretty_assertions::assert_eq;
     use std::collections::BTreeSet;
-    use std::fs;
+    use std::path::Path;
     use std::path::PathBuf;
     use uuid::Uuid;
 
     #[test]
     fn generated_ts_optional_nullable_fields_only_in_params() -> Result<()> {
         // Assert that "?: T | null" only appears in generated *Params types.
-        let output_dir = std::env::temp_dir().join(format!("codex_ts_types_{}", Uuid::now_v7()));
-        fs::create_dir(&output_dir)?;
+        let fixture_tree = read_schema_fixture_subtree(&schema_root()?, "typescript")?;
 
-        struct TempDirGuard(PathBuf);
-
-        impl Drop for TempDirGuard {
-            fn drop(&mut self) {
-                let _ = fs::remove_dir_all(&self.0);
-            }
-        }
-
-        let _guard = TempDirGuard(output_dir.clone());
-
-        // Avoid doing more work than necessary to keep the test from timing out.
-        let options = GenerateTsOptions {
-            generate_indices: false,
-            ensure_headers: false,
-            run_prettier: false,
-            experimental_api: false,
-        };
-        generate_ts_with_options(&output_dir, None, options)?;
-
-        let client_request_ts = fs::read_to_string(output_dir.join("ClientRequest.ts"))?;
+        let client_request_ts = std::str::from_utf8(
+            fixture_tree
+                .get(Path::new("ClientRequest.ts"))
+                .ok_or_else(|| anyhow::anyhow!("missing ClientRequest.ts fixture"))?,
+        )?;
         assert_eq!(client_request_ts.contains("mock/experimentalMethod"), false);
         assert_eq!(
             client_request_ts.contains("MockExperimentalMethodParams"),
             false
         );
-        assert_eq!(output_dir.join("EventMsg.ts").exists(), true);
-        let thread_start_ts =
-            fs::read_to_string(output_dir.join("v2").join("ThreadStartParams.ts"))?;
+        assert_eq!(fixture_tree.contains_key(Path::new("EventMsg.ts")), true);
+        let thread_start_ts = std::str::from_utf8(
+            fixture_tree
+                .get(Path::new("v2/ThreadStartParams.ts"))
+                .ok_or_else(|| anyhow::anyhow!("missing v2/ThreadStartParams.ts fixture"))?,
+        )?;
         assert_eq!(thread_start_ts.contains("mockExperimentalField"), false);
         assert_eq!(
-            output_dir
-                .join("v2")
-                .join("MockExperimentalMethodParams.ts")
-                .exists(),
+            fixture_tree.contains_key(Path::new("v2/MockExperimentalMethodParams.ts")),
             false
         );
         assert_eq!(
-            output_dir
-                .join("v2")
-                .join("MockExperimentalMethodResponse.ts")
-                .exists(),
+            fixture_tree.contains_key(Path::new("v2/MockExperimentalMethodResponse.ts")),
             false
         );
 
         let mut undefined_offenders = Vec::new();
         let mut optional_nullable_offenders = BTreeSet::new();
-        let mut stack = vec![output_dir];
-        while let Some(dir) = stack.pop() {
-            for entry in fs::read_dir(&dir)? {
-                let entry = entry?;
-                let path = entry.path();
-                if path.is_dir() {
-                    stack.push(path);
+        for (path, contents) in &fixture_tree {
+            if !matches!(path.extension().and_then(|ext| ext.to_str()), Some("ts")) {
+                continue;
+            }
+
+            // Only allow "?: T | null" in objects representing JSON-RPC requests,
+            // which we assume are called "*Params".
+            let allow_optional_nullable = path
+                .file_stem()
+                .and_then(|stem| stem.to_str())
+                .is_some_and(|stem| {
+                    stem.ends_with("Params")
+                        || stem == "InitializeCapabilities"
+                        || matches!(
+                            stem,
+                            "CollabAgentRef"
+                                | "CollabAgentStatusEntry"
+                                | "CollabAgentSpawnEndEvent"
+                                | "CollabAgentInteractionEndEvent"
+                                | "CollabCloseEndEvent"
+                                | "CollabResumeBeginEvent"
+                                | "CollabResumeEndEvent"
+                        )
+                });
+
+            let contents = std::str::from_utf8(contents)?;
+            if contents.contains("| undefined") {
+                undefined_offenders.push(path.clone());
+            }
+
+            const SKIP_PREFIXES: &[&str] = &[
+                "const ",
+                "let ",
+                "var ",
+                "export const ",
+                "export let ",
+                "export var ",
+            ];
+
+            let mut search_start = 0;
+            while let Some(idx) = contents[search_start..].find("| null") {
+                let abs_idx = search_start + idx;
+                // Find the property-colon for this field by scanning forward
+                // from the start of the segment and ignoring nested braces,
+                // brackets, and parens. This avoids colons inside nested
+                // type literals like `{ [k in string]?: string }`.
+
+                let line_start_idx = contents[..abs_idx].rfind('\n').map(|i| i + 1).unwrap_or(0);
+
+                let mut segment_start_idx = line_start_idx;
+                if let Some(rel_idx) = contents[line_start_idx..abs_idx].rfind(',') {
+                    segment_start_idx = segment_start_idx.max(line_start_idx + rel_idx + 1);
+                }
+                if let Some(rel_idx) = contents[line_start_idx..abs_idx].rfind('{') {
+                    segment_start_idx = segment_start_idx.max(line_start_idx + rel_idx + 1);
+                }
+                if let Some(rel_idx) = contents[line_start_idx..abs_idx].rfind('}') {
+                    segment_start_idx = segment_start_idx.max(line_start_idx + rel_idx + 1);
+                }
+
+                // Scan forward for the colon that separates the field name from its type.
+                let mut level_brace = 0_i32;
+                let mut level_brack = 0_i32;
+                let mut level_paren = 0_i32;
+                let mut in_single = false;
+                let mut in_double = false;
+                let mut escape = false;
+                let mut prop_colon_idx = None;
+                for (i, ch) in contents[segment_start_idx..abs_idx].char_indices() {
+                    let idx_abs = segment_start_idx + i;
+                    if escape {
+                        escape = false;
+                        continue;
+                    }
+                    match ch {
+                        '\\' => {
+                            if in_single || in_double {
+                                escape = true;
+                            }
+                        }
+                        '\'' => {
+                            if !in_double {
+                                in_single = !in_single;
+                            }
+                        }
+                        '"' => {
+                            if !in_single {
+                                in_double = !in_double;
+                            }
+                        }
+                        '{' if !in_single && !in_double => level_brace += 1,
+                        '}' if !in_single && !in_double => level_brace -= 1,
+                        '[' if !in_single && !in_double => level_brack += 1,
+                        ']' if !in_single && !in_double => level_brack -= 1,
+                        '(' if !in_single && !in_double => level_paren += 1,
+                        ')' if !in_single && !in_double => level_paren -= 1,
+                        ':' if !in_single
+                            && !in_double
+                            && level_brace == 0
+                            && level_brack == 0
+                            && level_paren == 0 =>
+                        {
+                            prop_colon_idx = Some(idx_abs);
+                            break;
+                        }
+                        _ => {}
+                    }
+                }
+
+                let Some(colon_idx) = prop_colon_idx else {
+                    search_start = abs_idx + 5;
+                    continue;
+                };
+
+                let mut field_prefix = contents[segment_start_idx..colon_idx].trim();
+                if field_prefix.is_empty() {
+                    search_start = abs_idx + 5;
                     continue;
                 }
 
-                if matches!(path.extension().and_then(|ext| ext.to_str()), Some("ts")) {
-                    // Only allow "?: T | null" in objects representing JSON-RPC requests,
-                    // which we assume are called "*Params".
-                    let allow_optional_nullable = path
-                        .file_stem()
-                        .and_then(|stem| stem.to_str())
-                        .is_some_and(|stem| {
-                            stem.ends_with("Params")
-                                || stem == "InitializeCapabilities"
-                                || matches!(
-                                    stem,
-                                    "CollabAgentRef"
-                                        | "CollabAgentStatusEntry"
-                                        | "CollabAgentSpawnEndEvent"
-                                        | "CollabAgentInteractionEndEvent"
-                                        | "CollabCloseEndEvent"
-                                        | "CollabResumeBeginEvent"
-                                        | "CollabResumeEndEvent"
-                                )
-                        });
-
-                    let contents = fs::read_to_string(&path)?;
-                    if contents.contains("| undefined") {
-                        undefined_offenders.push(path.clone());
-                    }
-
-                    const SKIP_PREFIXES: &[&str] = &[
-                        "const ",
-                        "let ",
-                        "var ",
-                        "export const ",
-                        "export let ",
-                        "export var ",
-                    ];
-
-                    let mut search_start = 0;
-                    while let Some(idx) = contents[search_start..].find("| null") {
-                        let abs_idx = search_start + idx;
-                        // Find the property-colon for this field by scanning forward
-                        // from the start of the segment and ignoring nested braces,
-                        // brackets, and parens. This avoids colons inside nested
-                        // type literals like `{ [k in string]?: string }`.
-
-                        let line_start_idx =
-                            contents[..abs_idx].rfind('\n').map(|i| i + 1).unwrap_or(0);
-
-                        let mut segment_start_idx = line_start_idx;
-                        if let Some(rel_idx) = contents[line_start_idx..abs_idx].rfind(',') {
-                            segment_start_idx = segment_start_idx.max(line_start_idx + rel_idx + 1);
-                        }
-                        if let Some(rel_idx) = contents[line_start_idx..abs_idx].rfind('{') {
-                            segment_start_idx = segment_start_idx.max(line_start_idx + rel_idx + 1);
-                        }
-                        if let Some(rel_idx) = contents[line_start_idx..abs_idx].rfind('}') {
-                            segment_start_idx = segment_start_idx.max(line_start_idx + rel_idx + 1);
-                        }
-
-                        // Scan forward for the colon that separates the field name from its type.
-                        let mut level_brace = 0_i32;
-                        let mut level_brack = 0_i32;
-                        let mut level_paren = 0_i32;
-                        let mut in_single = false;
-                        let mut in_double = false;
-                        let mut escape = false;
-                        let mut prop_colon_idx = None;
-                        for (i, ch) in contents[segment_start_idx..abs_idx].char_indices() {
-                            let idx_abs = segment_start_idx + i;
-                            if escape {
-                                escape = false;
-                                continue;
-                            }
-                            match ch {
-                                '\\' => {
-                                    // Only treat as escape when inside a string.
-                                    if in_single || in_double {
-                                        escape = true;
-                                    }
-                                }
-                                '\'' => {
-                                    if !in_double {
-                                        in_single = !in_single;
-                                    }
-                                }
-                                '"' => {
-                                    if !in_single {
-                                        in_double = !in_double;
-                                    }
-                                }
-                                '{' if !in_single && !in_double => level_brace += 1,
-                                '}' if !in_single && !in_double => level_brace -= 1,
-                                '[' if !in_single && !in_double => level_brack += 1,
-                                ']' if !in_single && !in_double => level_brack -= 1,
-                                '(' if !in_single && !in_double => level_paren += 1,
-                                ')' if !in_single && !in_double => level_paren -= 1,
-                                ':' if !in_single
-                                    && !in_double
-                                    && level_brace == 0
-                                    && level_brack == 0
-                                    && level_paren == 0 =>
-                                {
-                                    prop_colon_idx = Some(idx_abs);
-                                    break;
-                                }
-                                _ => {}
-                            }
-                        }
-
-                        let Some(colon_idx) = prop_colon_idx else {
-                            search_start = abs_idx + 5;
-                            continue;
-                        };
-
-                        let mut field_prefix = contents[segment_start_idx..colon_idx].trim();
-                        if field_prefix.is_empty() {
-                            search_start = abs_idx + 5;
-                            continue;
-                        }
-
-                        if let Some(comment_idx) = field_prefix.rfind("*/") {
-                            field_prefix = field_prefix[comment_idx + 2..].trim_start();
-                        }
-
-                        if field_prefix.is_empty() {
-                            search_start = abs_idx + 5;
-                            continue;
-                        }
-
-                        if SKIP_PREFIXES
-                            .iter()
-                            .any(|prefix| field_prefix.starts_with(prefix))
-                        {
-                            search_start = abs_idx + 5;
-                            continue;
-                        }
-
-                        if field_prefix.contains('(') {
-                            search_start = abs_idx + 5;
-                            continue;
-                        }
-
-                        // If the last non-whitespace before ':' is '?', then this is an
-                        // optional field with a nullable type (i.e., "?: T | null").
-                        // These are only allowed in *Params types.
-                        if field_prefix.chars().rev().find(|c| !c.is_whitespace()) == Some('?')
-                            && !allow_optional_nullable
-                        {
-                            let line_number =
-                                contents[..abs_idx].chars().filter(|c| *c == '\n').count() + 1;
-                            let offending_line_end = contents[line_start_idx..]
-                                .find('\n')
-                                .map(|i| line_start_idx + i)
-                                .unwrap_or(contents.len());
-                            let offending_snippet =
-                                contents[line_start_idx..offending_line_end].trim();
-
-                            optional_nullable_offenders.insert(format!(
-                                "{}:{}: {offending_snippet}",
-                                path.display(),
-                                line_number
-                            ));
-                        }
-
-                        search_start = abs_idx + 5;
-                    }
+                if let Some(comment_idx) = field_prefix.rfind("*/") {
+                    field_prefix = field_prefix[comment_idx + 2..].trim_start();
                 }
+
+                if field_prefix.is_empty() {
+                    search_start = abs_idx + 5;
+                    continue;
+                }
+
+                if SKIP_PREFIXES
+                    .iter()
+                    .any(|prefix| field_prefix.starts_with(prefix))
+                {
+                    search_start = abs_idx + 5;
+                    continue;
+                }
+
+                if field_prefix.contains('(') {
+                    search_start = abs_idx + 5;
+                    continue;
+                }
+
+                // If the last non-whitespace before ':' is '?', then this is an
+                // optional field with a nullable type (i.e., "?: T | null").
+                // These are only allowed in *Params types.
+                if field_prefix.chars().rev().find(|c| !c.is_whitespace()) == Some('?')
+                    && !allow_optional_nullable
+                {
+                    let line_number =
+                        contents[..abs_idx].chars().filter(|c| *c == '\n').count() + 1;
+                    let offending_line_end = contents[line_start_idx..]
+                        .find('\n')
+                        .map(|i| line_start_idx + i)
+                        .unwrap_or(contents.len());
+                    let offending_snippet = contents[line_start_idx..offending_line_end].trim();
+
+                    optional_nullable_offenders.insert(format!(
+                        "{}:{}: {offending_snippet}",
+                        path.display(),
+                        line_number
+                    ));
+                }
+
+                search_start = abs_idx + 5;
             }
         }
 
@@ -2153,59 +2251,48 @@ mod tests {
         Ok(())
     }
 
+    fn schema_root() -> Result<PathBuf> {
+        let typescript_index = codex_utils_cargo_bin::find_resource!("schema/typescript/index.ts")
+            .context("resolve TypeScript schema index.ts")?;
+        let schema_root = typescript_index
+            .parent()
+            .and_then(|parent| parent.parent())
+            .context("derive schema root from schema/typescript/index.ts")?
+            .to_path_buf();
+        Ok(schema_root)
+    }
+
     #[test]
     fn generate_ts_with_experimental_api_retains_experimental_entries() -> Result<()> {
-        let output_dir =
-            std::env::temp_dir().join(format!("codex_ts_types_experimental_{}", Uuid::now_v7()));
-        fs::create_dir(&output_dir)?;
-
-        struct TempDirGuard(PathBuf);
-
-        impl Drop for TempDirGuard {
-            fn drop(&mut self) {
-                let _ = fs::remove_dir_all(&self.0);
-            }
-        }
-
-        let _guard = TempDirGuard(output_dir.clone());
-
-        let options = GenerateTsOptions {
-            generate_indices: false,
-            ensure_headers: false,
-            run_prettier: false,
-            experimental_api: true,
-        };
-        generate_ts_with_options(&output_dir, None, options)?;
-
-        let client_request_ts = fs::read_to_string(output_dir.join("ClientRequest.ts"))?;
+        let client_request_ts = ClientRequest::export_to_string()?;
         assert_eq!(client_request_ts.contains("mock/experimentalMethod"), true);
         assert_eq!(
-            output_dir
-                .join("v2")
-                .join("MockExperimentalMethodParams.ts")
-                .exists(),
+            client_request_ts.contains("MockExperimentalMethodParams"),
             true
         );
         assert_eq!(
-            output_dir
-                .join("v2")
-                .join("MockExperimentalMethodResponse.ts")
-                .exists(),
+            v2::MockExperimentalMethodParams::export_to_string()?
+                .contains("MockExperimentalMethodParams"),
+            true
+        );
+        assert_eq!(
+            v2::MockExperimentalMethodResponse::export_to_string()?
+                .contains("MockExperimentalMethodResponse"),
             true
         );
 
-        let thread_start_ts =
-            fs::read_to_string(output_dir.join("v2").join("ThreadStartParams.ts"))?;
+        let thread_start_ts = v2::ThreadStartParams::export_to_string()?;
         assert_eq!(thread_start_ts.contains("mockExperimentalField"), true);
-        let command_execution_request_approval_ts = fs::read_to_string(
-            output_dir
-                .join("v2")
-                .join("CommandExecutionRequestApprovalParams.ts"),
-        )?;
+        let command_execution_request_approval_ts =
+            v2::CommandExecutionRequestApprovalParams::export_to_string()?;
         assert_eq!(
             command_execution_request_approval_ts.contains("additionalPermissions"),
             true
         );
+        assert_eq!(
+            command_execution_request_approval_ts.contains("skillMetadata"),
+            true
+        );
 
         Ok(())
     }
@@ -2318,48 +2405,6 @@ mod tests {
         Ok(())
     }
 
-    #[test]
-    fn build_schema_bundle_rejects_conflicting_duplicate_definitions() {
-        let err = build_schema_bundle(vec![
-            GeneratedSchema {
-                namespace: Some("v2".to_string()),
-                logical_name: "First".to_string(),
-                in_v1_dir: false,
-                value: serde_json::json!({
-                    "title": "First",
-                    "type": "object",
-                    "definitions": {
-                        "Shared": {
-                            "title": "SharedString",
-                            "type": "string"
-                        }
-                    }
-                }),
-            },
-            GeneratedSchema {
-                namespace: Some("v2".to_string()),
-                logical_name: "Second".to_string(),
-                in_v1_dir: false,
-                value: serde_json::json!({
-                    "title": "Second",
-                    "type": "object",
-                    "definitions": {
-                        "Shared": {
-                            "title": "SharedInteger",
-                            "type": "integer"
-                        }
-                    }
-                }),
-            },
-        ])
-        .expect_err("conflicting schema definitions should be rejected");
-
-        assert_eq!(
-            err.to_string(),
-            "schema definition collision in namespace `v2`: Shared (existing title: SharedString, new title: SharedInteger); use #[schemars(rename = \"...\")] to rename one of the conflicting schema definitions"
-        );
-    }
-
     #[test]
     fn build_flat_v2_schema_keeps_shared_root_schemas_and_dependencies() -> Result<()> {
         let bundle = serde_json::json!({
@@ -2668,6 +2713,10 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k
             command_execution_request_approval_json.contains("additionalPermissions"),
             false
         );
+        assert_eq!(
+            command_execution_request_approval_json.contains("skillMetadata"),
+            false
+        );
 
         let client_request_json = fs::read_to_string(output_dir.join("ClientRequest.json"))?;
         assert_eq!(
@@ -2679,6 +2728,7 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k
             fs::read_to_string(output_dir.join("codex_app_server_protocol.schemas.json"))?;
         assert_eq!(bundle_json.contains("mockExperimentalField"), false);
         assert_eq!(bundle_json.contains("additionalPermissions"), false);
+        assert_eq!(bundle_json.contains("skillMetadata"), false);
         assert_eq!(bundle_json.contains("MockExperimentalMethodParams"), false);
         assert_eq!(
             bundle_json.contains("MockExperimentalMethodResponse"),
@@ -2688,6 +2738,7 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k
             fs::read_to_string(output_dir.join("codex_app_server_protocol.v2.schemas.json"))?;
         assert_eq!(flat_v2_bundle_json.contains("mockExperimentalField"), false);
         assert_eq!(flat_v2_bundle_json.contains("additionalPermissions"), false);
+        assert_eq!(flat_v2_bundle_json.contains("skillMetadata"), false);
         assert_eq!(
             flat_v2_bundle_json.contains("MockExperimentalMethodParams"),
             false

codex-rs/app-server-protocol/src/lib.rs

@@ -17,6 +17,9 @@ pub use protocol::thread_history::*;
 pub use protocol::v1::*;
 pub use protocol::v2::*;
 pub use schema_fixtures::SchemaFixtureOptions;
+#[doc(hidden)]
+pub use schema_fixtures::generate_typescript_schema_fixture_subtree_for_tests;
+pub use schema_fixtures::read_schema_fixture_subtree;
 pub use schema_fixtures::read_schema_fixture_tree;
 pub use schema_fixtures::write_schema_fixtures;
 pub use schema_fixtures::write_schema_fixtures_with_options;

codex-rs/app-server-protocol/src/protocol/common.rs

@@ -110,6 +110,26 @@ macro_rules! client_request_definitions {
             )*
         }
 
+        impl ClientRequest {
+            pub fn id(&self) -> &RequestId {
+                match self {
+                    $(Self::$variant { request_id, .. } => request_id,)*
+                }
+            }
+
+            pub fn method(&self) -> String {
+                serde_json::to_value(self)
+                    .ok()
+                    .and_then(|value| {
+                        value
+                            .get("method")
+                            .and_then(serde_json::Value::as_str)
+                            .map(str::to_owned)
+                    })
+                    .unwrap_or_else(|| "<unknown>".to_string())
+            }
+        }
+
         impl crate::experimental_api::ExperimentalApi for ClientRequest {
             fn experimental_reason(&self) -> Option<&'static str> {
                 match self {
@@ -151,6 +171,12 @@ macro_rules! client_request_definitions {
             Ok(())
         }
 
+        pub(crate) fn visit_client_response_types(v: &mut impl ::ts_rs::TypeVisitor) {
+            $(
+                v.visit::<$response>();
+            )*
+        }
+
         #[allow(clippy::vec_init_then_push)]
         pub fn export_client_response_schemas(
             out_dir: &::std::path::Path,
@@ -272,6 +298,10 @@ client_request_definitions! {
         params: v2::PluginInstallParams,
         response: v2::PluginInstallResponse,
     },
+    PluginUninstall => "plugin/uninstall" {
+        params: v2::PluginUninstallParams,
+        response: v2::PluginUninstallResponse,
+    },
     TurnStart => "turn/start" {
         params: v2::TurnStartParams,
         inspect_params: true,
@@ -525,6 +555,12 @@ macro_rules! server_request_definitions {
             Ok(())
         }
 
+        pub(crate) fn visit_server_response_types(v: &mut impl ::ts_rs::TypeVisitor) {
+            $(
+                v.visit::<$response>();
+            )*
+        }
+
         #[allow(clippy::vec_init_then_push)]
         pub fn export_server_response_schemas(
             out_dir: &Path,
@@ -675,6 +711,12 @@ server_request_definitions! {
         response: v2::McpServerElicitationRequestResponse,
     },
 
+    /// Request approval for additional permissions from the user.
+    PermissionsRequestApproval => "item/permissions/requestApproval" {
+        params: v2::PermissionsRequestApprovalParams,
+        response: v2::PermissionsRequestApprovalResponse,
+    },
+
     /// Execute a dynamic tool call on the client.
     DynamicToolCall => "item/tool/call" {
         params: v2::DynamicToolCallParams,
@@ -1136,6 +1178,8 @@ mod tests {
             request_id: RequestId::Integer(1),
             params: None,
         };
+        assert_eq!(request.id(), &RequestId::Integer(1));
+        assert_eq!(request.method(), "account/rateLimits/read");
         assert_eq!(
             json!({
                 "method": "account/rateLimits/read",
@@ -1540,6 +1584,7 @@ mod tests {
                 }),
                 macos: None,
             }),
+            skill_metadata: None,
             proposed_execpolicy_amendment: None,
             proposed_network_policy_amendments: None,
             available_decisions: None,
@@ -1550,4 +1595,31 @@ mod tests {
             Some("item/commandExecution/requestApproval.additionalPermissions")
         );
     }
+
+    #[test]
+    fn command_execution_request_approval_skill_metadata_is_marked_experimental() {
+        let params = v2::CommandExecutionRequestApprovalParams {
+            thread_id: "thr_123".to_string(),
+            turn_id: "turn_123".to_string(),
+            item_id: "call_123".to_string(),
+            approval_id: None,
+            reason: None,
+            network_approval_context: None,
+            command: Some("cat file".to_string()),
+            cwd: None,
+            command_actions: None,
+            additional_permissions: None,
+            skill_metadata: Some(v2::CommandExecutionRequestApprovalSkillMetadata {
+                path_to_skills_md: PathBuf::from("/tmp/SKILLS.md"),
+            }),
+            proposed_execpolicy_amendment: None,
+            proposed_network_policy_amendments: None,
+            available_decisions: None,
+        };
+        let reason = crate::experimental_api::ExperimentalApi::experimental_reason(&params);
+        assert_eq!(
+            reason,
+            Some("item/commandExecution/requestApproval.skillMetadata")
+        );
+    }
 }

codex-rs/app-server-protocol/src/protocol/v2.rs

@@ -7,6 +7,7 @@ use crate::protocol::common::AuthMode;
 use codex_experimental_api_macros::ExperimentalApi;
 use codex_protocol::account::PlanType;
 use codex_protocol::approvals::ElicitationRequest as CoreElicitationRequest;
+use codex_protocol::approvals::ExecApprovalRequestSkillMetadata as CoreExecApprovalRequestSkillMetadata;
 use codex_protocol::approvals::ExecPolicyAmendment as CoreExecPolicyAmendment;
 use codex_protocol::approvals::NetworkApprovalContext as CoreNetworkApprovalContext;
 use codex_protocol::approvals::NetworkApprovalProtocol as CoreNetworkApprovalProtocol;
@@ -67,6 +68,7 @@ use codex_protocol::protocol::SkillToolDependency as CoreSkillToolDependency;
 use codex_protocol::protocol::SubAgentSource as CoreSubAgentSource;
 use codex_protocol::protocol::TokenUsage as CoreTokenUsage;
 use codex_protocol::protocol::TokenUsageInfo as CoreTokenUsageInfo;
+use codex_protocol::request_permissions::PermissionGrantScope as CorePermissionGrantScope;
 use codex_protocol::user_input::ByteRange as CoreByteRange;
 use codex_protocol::user_input::TextElement as CoreTextElement;
 use codex_protocol::user_input::UserInput as CoreUserInput;
@@ -82,12 +84,18 @@ use ts_rs::TS;
 // tends to use either snake_case or kebab-case.
 macro_rules! v2_enum_from_core {
     (
-        pub enum $Name:ident from $Src:path { $( $Variant:ident ),+ $(,)? }
+        $(#[$enum_meta:meta])*
+        pub enum $Name:ident from $Src:path {
+            $( $(#[$variant_meta:meta])* $Variant:ident ),+ $(,)?
+        }
     ) => {
         #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, JsonSchema, TS)]
+        $(#[$enum_meta])*
         #[serde(rename_all = "camelCase")]
         #[ts(export_to = "v2/")]
-        pub enum $Name { $( $Variant ),+ }
+        pub enum $Name {
+            $( $(#[$variant_meta])* $Variant ),+
+        }
 
         impl $Name {
             pub fn to_core(self) -> $Src {
@@ -185,6 +193,7 @@ pub enum AskForApproval {
     Reject {
         sandbox_approval: bool,
         rules: bool,
+        request_permissions: bool,
         mcp_elicitations: bool,
     },
     Never,
@@ -199,10 +208,12 @@ impl AskForApproval {
             AskForApproval::Reject {
                 sandbox_approval,
                 rules,
+                request_permissions,
                 mcp_elicitations,
             } => CoreAskForApproval::Reject(CoreRejectConfig {
                 sandbox_approval,
                 rules,
+                request_permissions,
                 mcp_elicitations,
             }),
             AskForApproval::Never => CoreAskForApproval::Never,
@@ -219,6 +230,7 @@ impl From<CoreAskForApproval> for AskForApproval {
             CoreAskForApproval::Reject(reject_config) => AskForApproval::Reject {
                 sandbox_approval: reject_config.sandbox_approval,
                 rules: reject_config.rules,
+                request_permissions: reject_config.request_permissions,
                 mcp_elicitations: reject_config.mcp_elicitations,
             },
             CoreAskForApproval::Never => AskForApproval::Never,
@@ -734,6 +746,9 @@ pub struct ConfigBatchWriteParams {
     pub file_path: Option<String>,
     #[ts(optional = nullable)]
     pub expected_version: Option<String>,
+    /// When true, hot-reload the updated user config into all loaded threads after writing.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub reload_user_config: bool,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
@@ -833,6 +848,15 @@ impl From<CoreFileSystemPermissions> for AdditionalFileSystemPermissions {
     }
 }
 
+impl From<AdditionalFileSystemPermissions> for CoreFileSystemPermissions {
+    fn from(value: AdditionalFileSystemPermissions) -> Self {
+        Self {
+            read: value.read,
+            write: value.write,
+        }
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -854,6 +878,17 @@ impl From<CoreMacOsSeatbeltProfileExtensions> for AdditionalMacOsPermissions {
     }
 }
 
+impl From<AdditionalMacOsPermissions> for CoreMacOsSeatbeltProfileExtensions {
+    fn from(value: AdditionalMacOsPermissions) -> Self {
+        Self {
+            macos_preferences: value.preferences,
+            macos_automation: value.automations,
+            macos_accessibility: value.accessibility,
+            macos_calendar: value.calendar,
+        }
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -869,6 +904,14 @@ impl From<CoreNetworkPermissions> for AdditionalNetworkPermissions {
     }
 }
 
+impl From<AdditionalNetworkPermissions> for CoreNetworkPermissions {
+    fn from(value: AdditionalNetworkPermissions) -> Self {
+        Self {
+            enabled: value.enabled,
+        }
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -888,6 +931,86 @@ impl From<CorePermissionProfile> for AdditionalPermissionProfile {
     }
 }
 
+impl From<AdditionalPermissionProfile> for CorePermissionProfile {
+    fn from(value: AdditionalPermissionProfile) -> Self {
+        Self {
+            network: value.network.map(CoreNetworkPermissions::from),
+            file_system: value.file_system.map(CoreFileSystemPermissions::from),
+            macos: value.macos.map(CoreMacOsSeatbeltProfileExtensions::from),
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct GrantedMacOsPermissions {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub preferences: Option<CoreMacOsPreferencesPermission>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub automations: Option<CoreMacOsAutomationPermission>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub accessibility: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub calendar: Option<bool>,
+}
+
+impl From<GrantedMacOsPermissions> for CoreMacOsSeatbeltProfileExtensions {
+    fn from(value: GrantedMacOsPermissions) -> Self {
+        Self {
+            macos_preferences: value
+                .preferences
+                .unwrap_or(CoreMacOsPreferencesPermission::None),
+            macos_automation: value
+                .automations
+                .unwrap_or(CoreMacOsAutomationPermission::None),
+            macos_accessibility: value.accessibility.unwrap_or(false),
+            macos_calendar: value.calendar.unwrap_or(false),
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct GrantedPermissionProfile {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub network: Option<AdditionalNetworkPermissions>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub file_system: Option<AdditionalFileSystemPermissions>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub macos: Option<GrantedMacOsPermissions>,
+}
+
+impl From<GrantedPermissionProfile> for CorePermissionProfile {
+    fn from(value: GrantedPermissionProfile) -> Self {
+        let macos = value.macos.and_then(|macos| {
+            if macos.preferences.is_none()
+                && macos.automations.is_none()
+                && macos.accessibility.is_none()
+                && macos.calendar.is_none()
+            {
+                None
+            } else {
+                Some(CoreMacOsSeatbeltProfileExtensions::from(macos))
+            }
+        });
+
+        Self {
+            network: value.network.map(CoreNetworkPermissions::from),
+            file_system: value.file_system.map(CoreFileSystemPermissions::from),
+            macos,
+        }
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -2809,6 +2932,18 @@ pub struct PluginInstallResponse {
     pub apps_needing_auth: Vec<AppSummary>,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct PluginUninstallParams {
+    pub plugin_id: String,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct PluginUninstallResponse {}
+
 impl From<CoreSkillMetadata> for SkillMetadata {
     fn from(value: CoreSkillMetadata) -> Self {
         Self {
@@ -2824,6 +2959,14 @@ impl From<CoreSkillMetadata> for SkillMetadata {
     }
 }
 
+impl From<CoreExecApprovalRequestSkillMetadata> for CommandExecutionRequestApprovalSkillMetadata {
+    fn from(value: CoreExecApprovalRequestSkillMetadata) -> Self {
+        Self {
+            path_to_skills_md: value.path_to_skills_md,
+        }
+    }
+}
+
 impl From<CoreSkillInterface> for SkillInterface {
     fn from(value: CoreSkillInterface) -> Self {
         Self {
@@ -4297,6 +4440,11 @@ pub struct CommandExecutionRequestApprovalParams {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[ts(optional = nullable)]
     pub additional_permissions: Option<AdditionalPermissionProfile>,
+    /// Optional skill metadata when the approval was triggered by a skill script.
+    #[experimental("item/commandExecution/requestApproval.skillMetadata")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional = nullable)]
+    pub skill_metadata: Option<CommandExecutionRequestApprovalSkillMetadata>,
     /// Optional proposed execpolicy amendment to allow similar commands without prompting.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[ts(optional = nullable)]
@@ -4318,9 +4466,17 @@ impl CommandExecutionRequestApprovalParams {
         // We need a generic outbound compatibility design for stripping or
         // otherwise handling experimental server->client payloads.
         self.additional_permissions = None;
+        self.skill_metadata = None;
     }
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct CommandExecutionRequestApprovalSkillMetadata {
+    pub path_to_skills_md: PathBuf,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -4827,6 +4983,35 @@ pub struct DynamicToolCallParams {
     pub arguments: JsonValue,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct PermissionsRequestApprovalParams {
+    pub thread_id: String,
+    pub turn_id: String,
+    pub item_id: String,
+    pub reason: Option<String>,
+    pub permissions: AdditionalPermissionProfile,
+}
+
+v2_enum_from_core!(
+    #[derive(Default)]
+    pub enum PermissionGrantScope from CorePermissionGrantScope {
+        #[default]
+        Turn,
+        Session
+    }
+);
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct PermissionsRequestApprovalResponse {
+    pub permissions: GrantedPermissionProfile,
+    #[serde(default)]
+    pub scope: PermissionGrantScope,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -5095,6 +5280,7 @@ mod tests {
                 },
                 "macos": null
             },
+            "skillMetadata": null,
             "proposedExecpolicyAmendment": null,
             "proposedNetworkPolicyAmendments": null,
             "availableDecisions": null
@@ -5130,6 +5316,7 @@ mod tests {
                     "calendar": false
                 }
             },
+            "skillMetadata": null,
             "proposedExecpolicyAmendment": null,
             "proposedNetworkPolicyAmendments": null,
             "availableDecisions": null
@@ -5147,6 +5334,169 @@ mod tests {
         );
     }
 
+    #[test]
+    fn command_execution_request_approval_accepts_skill_metadata() {
+        let params = serde_json::from_value::<CommandExecutionRequestApprovalParams>(json!({
+            "threadId": "thr_123",
+            "turnId": "turn_123",
+            "itemId": "call_123",
+            "command": "cat file",
+            "cwd": "/tmp",
+            "commandActions": null,
+            "reason": null,
+            "networkApprovalContext": null,
+            "additionalPermissions": null,
+            "skillMetadata": {
+                "pathToSkillsMd": "/tmp/SKILLS.md"
+            },
+            "proposedExecpolicyAmendment": null,
+            "proposedNetworkPolicyAmendments": null,
+            "availableDecisions": null
+        }))
+        .expect("skill metadata should deserialize");
+
+        assert_eq!(
+            params.skill_metadata,
+            Some(CommandExecutionRequestApprovalSkillMetadata {
+                path_to_skills_md: PathBuf::from("/tmp/SKILLS.md"),
+            })
+        );
+    }
+
+    #[test]
+    fn permissions_request_approval_response_accepts_partial_macos_grants() {
+        let cases = vec![
+            (json!({}), Some(GrantedMacOsPermissions::default()), None),
+            (
+                json!({
+                    "preferences": "read_only",
+                }),
+                Some(GrantedMacOsPermissions {
+                    preferences: Some(CoreMacOsPreferencesPermission::ReadOnly),
+                    ..Default::default()
+                }),
+                Some(CoreMacOsSeatbeltProfileExtensions {
+                    macos_preferences: CoreMacOsPreferencesPermission::ReadOnly,
+                    macos_automation: CoreMacOsAutomationPermission::None,
+                    macos_accessibility: false,
+                    macos_calendar: false,
+                }),
+            ),
+            (
+                json!({
+                    "automations": {
+                        "bundle_ids": ["com.apple.Notes"],
+                    },
+                }),
+                Some(GrantedMacOsPermissions {
+                    automations: Some(CoreMacOsAutomationPermission::BundleIds(vec![
+                        "com.apple.Notes".to_string(),
+                    ])),
+                    ..Default::default()
+                }),
+                Some(CoreMacOsSeatbeltProfileExtensions {
+                    macos_preferences: CoreMacOsPreferencesPermission::None,
+                    macos_automation: CoreMacOsAutomationPermission::BundleIds(vec![
+                        "com.apple.Notes".to_string(),
+                    ]),
+                    macos_accessibility: false,
+                    macos_calendar: false,
+                }),
+            ),
+            (
+                json!({
+                    "accessibility": true,
+                }),
+                Some(GrantedMacOsPermissions {
+                    accessibility: Some(true),
+                    ..Default::default()
+                }),
+                Some(CoreMacOsSeatbeltProfileExtensions {
+                    macos_preferences: CoreMacOsPreferencesPermission::None,
+                    macos_automation: CoreMacOsAutomationPermission::None,
+                    macos_accessibility: true,
+                    macos_calendar: false,
+                }),
+            ),
+            (
+                json!({
+                    "calendar": true,
+                }),
+                Some(GrantedMacOsPermissions {
+                    calendar: Some(true),
+                    ..Default::default()
+                }),
+                Some(CoreMacOsSeatbeltProfileExtensions {
+                    macos_preferences: CoreMacOsPreferencesPermission::None,
+                    macos_automation: CoreMacOsAutomationPermission::None,
+                    macos_accessibility: false,
+                    macos_calendar: true,
+                }),
+            ),
+        ];
+
+        for (macos_json, expected_granted_macos, expected_core_macos) in cases {
+            let response = serde_json::from_value::<PermissionsRequestApprovalResponse>(json!({
+                "permissions": {
+                    "macos": macos_json,
+                },
+            }))
+            .expect("partial macos permissions response should deserialize");
+
+            assert_eq!(
+                response.permissions,
+                GrantedPermissionProfile {
+                    macos: expected_granted_macos,
+                    ..Default::default()
+                }
+            );
+
+            assert_eq!(
+                CorePermissionProfile::from(response.permissions),
+                CorePermissionProfile {
+                    macos: expected_core_macos,
+                    ..Default::default()
+                }
+            );
+        }
+    }
+
+    #[test]
+    fn permissions_request_approval_response_omits_ungranted_macos_keys_when_serialized() {
+        let response = PermissionsRequestApprovalResponse {
+            permissions: GrantedPermissionProfile {
+                macos: Some(GrantedMacOsPermissions {
+                    accessibility: Some(true),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            },
+            scope: PermissionGrantScope::Turn,
+        };
+
+        assert_eq!(
+            serde_json::to_value(response).expect("response should serialize"),
+            json!({
+                "permissions": {
+                    "macos": {
+                        "accessibility": true,
+                    },
+                },
+                "scope": "turn",
+            })
+        );
+    }
+
+    #[test]
+    fn permissions_request_approval_response_defaults_scope_to_turn() {
+        let response = serde_json::from_value::<PermissionsRequestApprovalResponse>(json!({
+            "permissions": {},
+        }))
+        .expect("response should deserialize");
+
+        assert_eq!(response.scope, PermissionGrantScope::Turn);
+    }
+
     #[test]
     fn command_exec_params_default_optional_streaming_flags() {
         let params = serde_json::from_value::<CommandExecParams>(json!({
@@ -5486,6 +5836,30 @@ mod tests {
         assert_eq!(back_to_v2, v2_policy);
     }
 
+    #[test]
+    fn ask_for_approval_reject_round_trips_request_permissions_flag() {
+        let v2_policy = AskForApproval::Reject {
+            sandbox_approval: true,
+            rules: false,
+            request_permissions: true,
+            mcp_elicitations: false,
+        };
+
+        let core_policy = v2_policy.to_core();
+        assert_eq!(
+            core_policy,
+            CoreAskForApproval::Reject(CoreRejectConfig {
+                sandbox_approval: true,
+                rules: false,
+                request_permissions: true,
+                mcp_elicitations: false,
+            })
+        );
+
+        let back_to_v2 = AskForApproval::from(core_policy);
+        assert_eq!(back_to_v2, v2_policy);
+    }
+
     #[test]
     fn mcp_server_elicitation_response_round_trips_rmcp_result() {
         let rmcp_result = rmcp::model::CreateElicitationResult {

codex-rs/app-server-protocol/src/schema_fixtures.rs

@@ -1,11 +1,25 @@
+use crate::ClientNotification;
+use crate::ClientRequest;
+use crate::ServerNotification;
+use crate::ServerRequest;
+use crate::export::GENERATED_TS_HEADER;
+use crate::export::filter_experimental_ts_tree;
+use crate::export::generate_index_ts_tree;
+use crate::protocol::common::visit_client_response_types;
+use crate::protocol::common::visit_server_response_types;
 use anyhow::Context;
 use anyhow::Result;
+use codex_protocol::protocol::EventMsg;
 use serde_json::Map;
 use serde_json::Value;
+use std::any::TypeId;
 use std::cmp::Ordering;
 use std::collections::BTreeMap;
+use std::collections::HashSet;
 use std::path::Path;
 use std::path::PathBuf;
+use ts_rs::TS;
+use ts_rs::TypeVisitor;
 
 #[derive(Clone, Copy, Debug, Default)]
 pub struct SchemaFixtureOptions {
@@ -27,6 +41,42 @@ pub fn read_schema_fixture_tree(schema_root: &Path) -> Result<BTreeMap<PathBuf,
     Ok(all)
 }
 
+pub fn read_schema_fixture_subtree(
+    schema_root: &Path,
+    label: &str,
+) -> Result<BTreeMap<PathBuf, Vec<u8>>> {
+    let subtree_root = schema_root.join(label);
+    collect_files_recursive(&subtree_root)
+        .with_context(|| format!("read schema fixture subtree {}", subtree_root.display()))
+}
+
+#[doc(hidden)]
+pub fn generate_typescript_schema_fixture_subtree_for_tests() -> Result<BTreeMap<PathBuf, Vec<u8>>>
+{
+    let mut files = BTreeMap::new();
+    let mut seen = HashSet::new();
+
+    collect_typescript_fixture_file::<ClientRequest>(&mut files, &mut seen)?;
+    visit_typescript_fixture_dependencies(&mut files, &mut seen, |visitor| {
+        visit_client_response_types(visitor);
+    })?;
+    collect_typescript_fixture_file::<ClientNotification>(&mut files, &mut seen)?;
+    collect_typescript_fixture_file::<ServerRequest>(&mut files, &mut seen)?;
+    visit_typescript_fixture_dependencies(&mut files, &mut seen, |visitor| {
+        visit_server_response_types(visitor);
+    })?;
+    collect_typescript_fixture_file::<ServerNotification>(&mut files, &mut seen)?;
+    collect_typescript_fixture_file::<EventMsg>(&mut files, &mut seen)?;
+
+    filter_experimental_ts_tree(&mut files)?;
+    generate_index_ts_tree(&mut files);
+
+    Ok(files
+        .into_iter()
+        .map(|(path, content)| (path, content.into_bytes()))
+        .collect())
+}
+
 /// Regenerates `schema/typescript/` and `schema/json/`.
 ///
 /// This is intended to be used by tooling (e.g., `just write-app-server-schema`).
@@ -86,6 +136,12 @@ fn read_file_bytes(path: &Path) -> Result<Vec<u8>> {
         let text = String::from_utf8(bytes)
             .with_context(|| format!("expected UTF-8 TypeScript in {}", path.display()))?;
         let text = text.replace("\r\n", "\n").replace('\r', "\n");
+        // Fixture comparisons care about schema content, not whether the generator
+        // re-prepended the standard banner to every TypeScript file.
+        let text = text
+            .strip_prefix(GENERATED_TS_HEADER)
+            .unwrap_or(&text)
+            .to_string();
         return Ok(text.into_bytes());
     }
     Ok(bytes)
@@ -209,6 +265,73 @@ fn collect_files_recursive(root: &Path) -> Result<BTreeMap<PathBuf, Vec<u8>>> {
     Ok(files)
 }
 
+fn collect_typescript_fixture_file<T: TS + 'static + ?Sized>(
+    files: &mut BTreeMap<PathBuf, String>,
+    seen: &mut HashSet<TypeId>,
+) -> Result<()> {
+    let Some(output_path) = T::output_path() else {
+        return Ok(());
+    };
+    if !seen.insert(TypeId::of::<T>()) {
+        return Ok(());
+    }
+
+    let contents = T::export_to_string().context("export TypeScript fixture content")?;
+    let output_path = normalize_relative_fixture_path(&output_path);
+    files.insert(
+        output_path,
+        contents.replace("\r\n", "\n").replace('\r', "\n"),
+    );
+
+    let mut visitor = TypeScriptFixtureCollector {
+        files,
+        seen,
+        error: None,
+    };
+    T::visit_dependencies(&mut visitor);
+    if let Some(error) = visitor.error {
+        return Err(error);
+    }
+
+    Ok(())
+}
+
+fn normalize_relative_fixture_path(path: &Path) -> PathBuf {
+    path.components().collect()
+}
+
+fn visit_typescript_fixture_dependencies(
+    files: &mut BTreeMap<PathBuf, String>,
+    seen: &mut HashSet<TypeId>,
+    visit: impl FnOnce(&mut TypeScriptFixtureCollector<'_>),
+) -> Result<()> {
+    let mut visitor = TypeScriptFixtureCollector {
+        files,
+        seen,
+        error: None,
+    };
+    visit(&mut visitor);
+    if let Some(error) = visitor.error {
+        return Err(error);
+    }
+    Ok(())
+}
+
+struct TypeScriptFixtureCollector<'a> {
+    files: &'a mut BTreeMap<PathBuf, String>,
+    seen: &'a mut HashSet<TypeId>,
+    error: Option<anyhow::Error>,
+}
+
+impl TypeVisitor for TypeScriptFixtureCollector<'_> {
+    fn visit<T: TS + 'static + ?Sized>(&mut self) {
+        if self.error.is_some() {
+            return;
+        }
+        self.error = collect_typescript_fixture_file::<T>(self.files, self.seen).err();
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

codex-rs/app-server-protocol/tests/schema_fixtures.rs

@@ -1,19 +1,60 @@
 use anyhow::Context;
 use anyhow::Result;
-use codex_app_server_protocol::read_schema_fixture_tree;
-use codex_app_server_protocol::write_schema_fixtures;
+use codex_app_server_protocol::generate_json_with_experimental;
+use codex_app_server_protocol::generate_typescript_schema_fixture_subtree_for_tests;
+use codex_app_server_protocol::read_schema_fixture_subtree;
 use similar::TextDiff;
+use std::collections::BTreeMap;
 use std::path::Path;
+use std::path::PathBuf;
 
 #[test]
-fn schema_fixtures_match_generated() -> Result<()> {
+fn typescript_schema_fixtures_match_generated() -> Result<()> {
     let schema_root = schema_root()?;
-    let fixture_tree = read_tree(&schema_root)?;
+    let fixture_tree = read_tree(&schema_root, "typescript")?;
+    let generated_tree = generate_typescript_schema_fixture_subtree_for_tests()
+        .context("generate in-memory typescript schema fixtures")?;
+
+    assert_schema_trees_match("typescript", &fixture_tree, &generated_tree)?;
+
+    Ok(())
+}
+
+#[test]
+fn json_schema_fixtures_match_generated() -> Result<()> {
+    assert_schema_fixtures_match_generated("json", |output_dir| {
+        generate_json_with_experimental(output_dir, false)
+    })
+}
+
+fn assert_schema_fixtures_match_generated(
+    label: &'static str,
+    generate: impl FnOnce(&Path) -> Result<()>,
+) -> Result<()> {
+    let schema_root = schema_root()?;
+    let fixture_tree = read_tree(&schema_root, label)?;
 
     let temp_dir = tempfile::tempdir().context("create temp dir")?;
-    write_schema_fixtures(temp_dir.path(), None).context("generate schema fixtures")?;
-    let generated_tree = read_tree(temp_dir.path())?;
+    let generated_root = temp_dir.path().join(label);
+    generate(&generated_root).with_context(|| {
+        format!(
+            "generate {label} schema fixtures into {}",
+            generated_root.display()
+        )
+    })?;
 
+    let generated_tree = read_tree(temp_dir.path(), label)?;
+
+    assert_schema_trees_match(label, &fixture_tree, &generated_tree)?;
+
+    Ok(())
+}
+
+fn assert_schema_trees_match(
+    label: &str,
+    fixture_tree: &BTreeMap<PathBuf, Vec<u8>>,
+    generated_tree: &BTreeMap<PathBuf, Vec<u8>>,
+) -> Result<()> {
     let fixture_paths = fixture_tree
         .keys()
         .map(|p| p.display().to_string())
@@ -32,13 +73,13 @@ fn schema_fixtures_match_generated() -> Result<()> {
             .to_string();
 
         panic!(
-            "Vendored app-server schema fixture file set doesn't match freshly generated output. \
+            "Vendored {label} app-server schema fixture file set doesn't match freshly generated output. \
 Run `just write-app-server-schema` to overwrite with your changes.\n\n{diff}"
         );
     }
 
     // If the file sets match, diff contents for each file for a nicer error.
-    for (path, expected) in &fixture_tree {
+    for (path, expected) in fixture_tree {
         let actual = generated_tree
             .get(path)
             .ok_or_else(|| anyhow::anyhow!("missing generated file: {}", path.display()))?;
@@ -54,7 +95,7 @@ Run `just write-app-server-schema` to overwrite with your changes.\n\n{diff}"
             .header("fixture", "generated")
             .to_string();
         panic!(
-            "Vendored app-server schema fixture {} differs from generated output. \
+            "Vendored {label} app-server schema fixture {} differs from generated output. \
 Run `just write-app-server-schema` to overwrite with your changes.\n\n{diff}",
             path.display()
         );
@@ -63,7 +104,7 @@ Run `just write-app-server-schema` to overwrite with your changes.\n\n{diff}",
     Ok(())
 }
 
-fn schema_root() -> Result<std::path::PathBuf> {
+fn schema_root() -> Result<PathBuf> {
     // In Bazel runfiles (especially manifest-only mode), resolving directories is not
     // reliable. Resolve a known file, then walk up to the schema root.
     let typescript_index = codex_utils_cargo_bin::find_resource!("schema/typescript/index.ts")
@@ -92,6 +133,11 @@ fn schema_root() -> Result<std::path::PathBuf> {
     Ok(schema_root)
 }
 
-fn read_tree(root: &Path) -> Result<std::collections::BTreeMap<std::path::PathBuf, Vec<u8>>> {
-    read_schema_fixture_tree(root).context("read schema fixture tree")
+fn read_tree(root: &Path, label: &str) -> Result<BTreeMap<PathBuf, Vec<u8>>> {
+    read_schema_fixture_subtree(root, label).with_context(|| {
+        format!(
+            "read {label} schema fixture subtree from {}",
+            root.display()
+        )
+    })
 }

codex-rs/app-server-test-client/src/lib.rs

@@ -1507,6 +1507,7 @@ impl CodexClient {
             cwd,
             command_actions,
             additional_permissions,
+            skill_metadata,
             proposed_execpolicy_amendment,
             proposed_network_policy_amendments,
             available_decisions,
@@ -1541,6 +1542,9 @@ impl CodexClient {
         if let Some(additional_permissions) = additional_permissions.as_ref() {
             println!("< additional permissions: {additional_permissions:?}");
         }
+        if let Some(skill_metadata) = skill_metadata.as_ref() {
+            println!("< skill metadata: {skill_metadata:?}");
+        }
         if let Some(execpolicy_amendment) = proposed_execpolicy_amendment.as_ref() {
             println!("< proposed execpolicy amendment: {execpolicy_amendment:?}");
         }

codex-rs/app-server/Cargo.toml

@@ -19,6 +19,12 @@ workspace = true
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 base64 = { workspace = true }
+axum = { workspace = true, default-features = false, features = [
+    "http1",
+    "json",
+    "tokio",
+    "ws",
+] }
 codex-arg0 = { workspace = true }
 codex-cloud-requirements = { workspace = true }
 codex-core = { workspace = true }
@@ -61,6 +67,7 @@ uuid = { workspace = true, features = ["serde", "v7"] }
 
 [dev-dependencies]
 app_test_support = { workspace = true }
+base64 = { workspace = true }
 axum = { workspace = true, default-features = false, features = [
     "http1",
     "json",
@@ -69,6 +76,7 @@ axum = { workspace = true, default-features = false, features = [
 core_test_support = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
 pretty_assertions = { workspace = true }
+reqwest = { workspace = true, features = ["rustls-tls"] }
 rmcp = { workspace = true, default-features = false, features = [
     "elicitation",
     "server",

codex-rs/app-server/README.md

@@ -26,6 +26,11 @@ Supported transports:
 - stdio (`--listen stdio://`, default): newline-delimited JSON (JSONL)
 - websocket (`--listen ws://IP:PORT`): one JSON-RPC message per websocket text frame (**experimental / unsupported**)
 
+When running with `--listen ws://IP:PORT`, the same listener also serves basic HTTP health probes:
+
+- `GET /readyz` returns `200 OK` once the listener is accepting new connections.
+- `GET /healthz` currently always returns `200 OK`.
+
 Websocket transport is currently experimental and unsupported. Do not rely on it for production workloads.
 
 Tracing/log output:
@@ -159,6 +164,7 @@ Example with notification opt-out:
 - `app/list` — list available apps.
 - `skills/config/write` — write user-level skill config by path.
 - `plugin/install` — install a plugin from a discovered marketplace entry and return any apps that still need auth (**under development; do not call from production clients yet**).
+- `plugin/uninstall` — uninstall a plugin by id by removing its cached files and clearing its user-level config entry (**under development; do not call from production clients yet**).
 - `mcpServer/oauth/login` — start an OAuth login for a configured MCP server; returns an `authorization_url` and later emits `mcpServer/oauthLogin/completed` once the browser flow finishes.
 - `tool/requestUserInput` — prompt the user with 1–3 short questions for a tool call and return their answers (experimental).
 - `config/mcpServer/reload` — reload MCP server config from disk and queue a refresh for loaded threads (applied on each thread's next active turn); returns `{}`. Use this after editing `config.toml` without restarting the server.
@@ -169,7 +175,7 @@ Example with notification opt-out:
 - `externalAgentConfig/detect` — detect migratable external-agent artifacts with `includeHome` and optional `cwds`; each detected item includes `cwd` (`null` for home).
 - `externalAgentConfig/import` — apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home).
 - `config/value/write` — write a single config key/value to the user's config.toml on disk.
-- `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk.
+- `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads.
 - `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), pinned feature values (`featureRequirements`), `enforceResidency`, and `network` constraints.
 
 ### Example: Start or resume a thread
@@ -850,8 +856,8 @@ Order of messages:
 Order of messages:
 
 1. `item/started` — emits a `fileChange` item with `changes` (diff chunk summaries) and `status: "inProgress"`. Show the proposed edits and paths to the user.
-2. `item/fileChange/requestApproval` (request) — includes `itemId`, `threadId`, `turnId`, and an optional `reason`.
-3. Client response — `{ "decision": "accept" }` or `{ "decision": "decline" }`.
+2. `item/fileChange/requestApproval` (request) — includes `itemId`, `threadId`, `turnId`, an optional `reason`, and may include unstable `grantRoot` when the agent is asking for session-scoped write access under a specific root.
+3. Client response — `{ "decision": "accept" }`, `{ "decision": "acceptForSession" }`, `{ "decision": "decline" }`, or `{ "decision": "cancel" }`.
 4. `serverRequest/resolved` — `{ threadId, requestId }` confirms the pending request has been resolved or cleared, including lifecycle cleanup on turn start/complete/interrupt.
 5. `item/completed` — returns the same `fileChange` item with `status` updated to `completed`, `failed`, or `declined` after the patch attempt. Rely on this to show success/failure and finalize the diff state in your UI.
 
@@ -875,6 +881,55 @@ Order of messages:
 
 `turnId` is best-effort. When the elicitation is correlated with an active turn, the request includes that turn id; otherwise it is `null`.
 
+### Permission requests
+
+The built-in `request_permissions` tool sends an `item/permissions/requestApproval` JSON-RPC request to the client with the requested permission profile. Today that commonly means additional filesystem access, but the payload is intentionally general so future requests can include non-filesystem permissions too. This request is part of the v2 protocol surface.
+
+```json
+{
+  "method": "item/permissions/requestApproval",
+  "id": 61,
+  "params": {
+    "threadId": "thr_123",
+    "turnId": "turn_123",
+    "itemId": "call_123",
+    "reason": "Select a workspace root",
+    "permissions": {
+      "fileSystem": {
+        "write": [
+          "/Users/me/project",
+          "/Users/me/shared"
+        ]
+      }
+    }
+  }
+}
+```
+
+The client responds with `result.permissions`, which should be the granted subset of the requested permission profile. It may also set `result.scope` to `"session"` to make the grant persist for later turns in the same session; omitted or `"turn"` keeps the existing turn-scoped behavior:
+
+```json
+{
+  "id": 61,
+  "result": {
+    "scope": "session",
+    "permissions": {
+      "fileSystem": {
+        "write": [
+          "/Users/me/project"
+        ]
+      }
+    }
+  }
+}
+```
+
+Only the granted subset matters on the wire. Any permissions omitted from `result.permissions` are treated as denied, including omitted nested keys inside `result.permissions.macos`, so a sparse response like `{ "permissions": { "macos": { "accessibility": true } } }` grants only accessibility. Any permissions not present in the original request are ignored by the server.
+
+Within the same turn, granted permissions are sticky: later shell-like tool calls can automatically reuse the granted subset without reissuing a separate permission request.
+
+If the session approval policy uses `Reject` with `request_permissions: true`, the server does not send `item/permissions/requestApproval` to the client. Instead, the tool is auto-denied and resolves with an empty granted-permissions payload.
+
 ### Dynamic tool calls (experimental)
 
 `dynamicTools` on `thread/start` and the corresponding `item/tool/call` request/response flow are experimental APIs. To enable them, set `initialize.params.capabilities.experimentalApi = true`.

codex-rs/app-server/src/app_server_tracing.rs

@@ -1,6 +1,16 @@
+//! Tracing helpers shared by socket and in-process app-server entry points.
+//!
+//! The in-process path intentionally reuses the same span shape as JSON-RPC
+//! transports so request telemetry stays comparable across stdio, websocket,
+//! and embedded callers. [`typed_request_span`] is the in-process counterpart
+//! of [`request_span`] and stamps `rpc.transport` as `"in-process"` while
+//! deriving client identity from the typed [`ClientRequest`] rather than
+//! from a parsed JSON envelope.
+
 use crate::message_processor::ConnectionSessionState;
 use crate::outgoing_message::ConnectionId;
 use crate::transport::AppServerTransport;
+use codex_app_server_protocol::ClientRequest;
 use codex_app_server_protocol::InitializeParams;
 use codex_app_server_protocol::JSONRPCRequest;
 use codex_otel::set_parent_from_context;
@@ -65,6 +75,51 @@ pub(crate) fn request_span(
     span
 }
 
+/// Builds tracing span metadata for typed in-process requests.
+///
+/// This mirrors `request_span` semantics while stamping transport as
+/// `in-process` and deriving client info either from initialize params or
+/// from existing connection session state.
+pub(crate) fn typed_request_span(
+    request: &ClientRequest,
+    connection_id: ConnectionId,
+    session: &ConnectionSessionState,
+) -> Span {
+    let method = request.method();
+    let span = info_span!(
+        "app_server.request",
+        otel.kind = "server",
+        otel.name = method,
+        rpc.system = "jsonrpc",
+        rpc.method = method,
+        rpc.transport = "in-process",
+        rpc.request_id = ?request.id(),
+        app_server.connection_id = ?connection_id,
+        app_server.api_version = "v2",
+        app_server.client_name = field::Empty,
+        app_server.client_version = field::Empty,
+    );
+
+    if let Some((client_name, client_version)) = initialize_client_info_from_typed_request(request)
+    {
+        span.record("app_server.client_name", client_name);
+        span.record("app_server.client_version", client_version);
+    } else {
+        if let Some(client_name) = session.app_server_client_name.as_deref() {
+            span.record("app_server.client_name", client_name);
+        }
+        if let Some(client_version) = session.client_version.as_deref() {
+            span.record("app_server.client_version", client_version);
+        }
+    }
+
+    if let Some(context) = traceparent_context_from_env() {
+        set_parent_from_context(&span, context);
+    }
+
+    span
+}
+
 fn transport_name(transport: AppServerTransport) -> &'static str {
     match transport {
         AppServerTransport::Stdio => "stdio",
@@ -99,3 +154,13 @@ fn initialize_client_info(request: &JSONRPCRequest) -> Option<InitializeParams>
     let params = request.params.clone()?;
     serde_json::from_value(params).ok()
 }
+
+fn initialize_client_info_from_typed_request(request: &ClientRequest) -> Option<(&str, &str)> {
+    match request {
+        ClientRequest::Initialize { params, .. } => Some((
+            params.client_info.name.as_str(),
+            params.client_info.version.as_str(),
+        )),
+        _ => None,
+    }
+}

codex-rs/app-server/src/bespoke_event_handling.rs

@@ -26,6 +26,7 @@ use codex_app_server_protocol::CommandExecutionApprovalDecision;
 use codex_app_server_protocol::CommandExecutionOutputDeltaNotification;
 use codex_app_server_protocol::CommandExecutionRequestApprovalParams;
 use codex_app_server_protocol::CommandExecutionRequestApprovalResponse;
+use codex_app_server_protocol::CommandExecutionRequestApprovalSkillMetadata;
 use codex_app_server_protocol::CommandExecutionStatus;
 use codex_app_server_protocol::ContextCompactedNotification;
 use codex_app_server_protocol::DeprecationNoticeNotification;
@@ -41,6 +42,7 @@ use codex_app_server_protocol::FileChangeOutputDeltaNotification;
 use codex_app_server_protocol::FileChangeRequestApprovalParams;
 use codex_app_server_protocol::FileChangeRequestApprovalResponse;
 use codex_app_server_protocol::FileUpdateChange;
+use codex_app_server_protocol::GrantedPermissionProfile as V2GrantedPermissionProfile;
 use codex_app_server_protocol::InterruptConversationResponse;
 use codex_app_server_protocol::ItemCompletedNotification;
 use codex_app_server_protocol::ItemStartedNotification;
@@ -56,6 +58,8 @@ use codex_app_server_protocol::NetworkApprovalContext as V2NetworkApprovalContex
 use codex_app_server_protocol::NetworkPolicyAmendment as V2NetworkPolicyAmendment;
 use codex_app_server_protocol::NetworkPolicyRuleAction as V2NetworkPolicyRuleAction;
 use codex_app_server_protocol::PatchApplyStatus;
+use codex_app_server_protocol::PermissionsRequestApprovalParams;
+use codex_app_server_protocol::PermissionsRequestApprovalResponse;
 use codex_app_server_protocol::PlanDeltaNotification;
 use codex_app_server_protocol::RawResponseItemCompletedNotification;
 use codex_app_server_protocol::ReasoningSummaryPartAddedNotification;
@@ -96,9 +100,11 @@ use codex_core::ThreadManager;
 use codex_core::find_thread_name_by_id;
 use codex_core::review_format::format_review_findings_block;
 use codex_core::review_prompts;
+use codex_core::sandboxing::intersect_permission_profiles;
 use codex_protocol::ThreadId;
 use codex_protocol::dynamic_tools::DynamicToolCallOutputContentItem as CoreDynamicToolCallOutputContentItem;
 use codex_protocol::dynamic_tools::DynamicToolResponse as CoreDynamicToolResponse;
+use codex_protocol::models::PermissionProfile as CorePermissionProfile;
 use codex_protocol::plan_tool::UpdatePlanArgs;
 use codex_protocol::protocol::ApplyPatchApprovalRequestEvent;
 use codex_protocol::protocol::CodexErrorInfo as CoreCodexErrorInfo;
@@ -114,6 +120,8 @@ use codex_protocol::protocol::ReviewDecision;
 use codex_protocol::protocol::ReviewOutputEvent;
 use codex_protocol::protocol::TokenCountEvent;
 use codex_protocol::protocol::TurnDiffEvent;
+use codex_protocol::request_permissions::PermissionGrantScope as CorePermissionGrantScope;
+use codex_protocol::request_permissions::RequestPermissionsResponse as CoreRequestPermissionsResponse;
 use codex_protocol::request_user_input::RequestUserInputAnswer as CoreRequestUserInputAnswer;
 use codex_protocol::request_user_input::RequestUserInputResponse as CoreRequestUserInputResponse;
 use codex_shell_command::parse_command::shlex_join;
@@ -437,6 +445,7 @@ pub(crate) async fn apply_bespoke_event_handling(
                 proposed_execpolicy_amendment,
                 proposed_network_policy_amendments,
                 additional_permissions,
+                skill_metadata,
                 parsed_cmd,
                 ..
             } = ev;
@@ -508,6 +517,8 @@ pub(crate) async fn apply_bespoke_event_handling(
                         });
                     let additional_permissions =
                         additional_permissions.map(V2AdditionalPermissionProfile::from);
+                    let skill_metadata =
+                        skill_metadata.map(CommandExecutionRequestApprovalSkillMetadata::from);
 
                     let params = CommandExecutionRequestApprovalParams {
                         thread_id: conversation_id.to_string(),
@@ -520,6 +531,7 @@ pub(crate) async fn apply_bespoke_event_handling(
                         cwd,
                         command_actions,
                         additional_permissions,
+                        skill_metadata,
                         proposed_execpolicy_amendment: proposed_execpolicy_amendment_v2,
                         proposed_network_policy_amendments: proposed_network_policy_amendments_v2,
                         available_decisions: Some(available_decisions),
@@ -672,6 +684,54 @@ pub(crate) async fn apply_bespoke_event_handling(
                 });
             }
         }
+        EventMsg::RequestPermissions(request) => {
+            if matches!(api_version, ApiVersion::V2) {
+                let permission_guard = thread_watch_manager
+                    .note_permission_requested(&conversation_id.to_string())
+                    .await;
+                let requested_permissions = request.permissions.clone();
+                let params = PermissionsRequestApprovalParams {
+                    thread_id: conversation_id.to_string(),
+                    turn_id: request.turn_id.clone(),
+                    item_id: request.call_id.clone(),
+                    reason: request.reason,
+                    permissions: request.permissions.into(),
+                };
+                let (pending_request_id, rx) = outgoing
+                    .send_request(ServerRequestPayload::PermissionsRequestApproval(params))
+                    .await;
+                tokio::spawn(async move {
+                    on_request_permissions_response(
+                        request.call_id,
+                        requested_permissions,
+                        pending_request_id,
+                        rx,
+                        conversation,
+                        thread_state,
+                        permission_guard,
+                    )
+                    .await;
+                });
+            } else {
+                error!(
+                    "request_permissions is only supported on api v2 (call_id: {})",
+                    request.call_id
+                );
+                let empty = CoreRequestPermissionsResponse {
+                    permissions: Default::default(),
+                    scope: CorePermissionGrantScope::Turn,
+                };
+                if let Err(err) = conversation
+                    .submit(Op::RequestPermissionsResponse {
+                        id: request.call_id,
+                        response: empty,
+                    })
+                    .await
+                {
+                    error!("failed to submit RequestPermissionsResponse: {err}");
+                }
+            }
+        }
         EventMsg::DynamicToolCallRequest(request) => {
             if matches!(api_version, ApiVersion::V2) {
                 let call_id = request.call_id;
@@ -2121,6 +2181,75 @@ fn mcp_server_elicitation_response_from_client_result(
     }
 }
 
+async fn on_request_permissions_response(
+    call_id: String,
+    requested_permissions: CorePermissionProfile,
+    pending_request_id: RequestId,
+    receiver: oneshot::Receiver<ClientRequestResult>,
+    conversation: Arc<CodexThread>,
+    thread_state: Arc<Mutex<ThreadState>>,
+    request_permissions_guard: ThreadWatchActiveGuard,
+) {
+    let response = receiver.await;
+    resolve_server_request_on_thread_listener(&thread_state, pending_request_id).await;
+    drop(request_permissions_guard);
+    let Some(response) =
+        request_permissions_response_from_client_result(requested_permissions, response)
+    else {
+        return;
+    };
+
+    if let Err(err) = conversation
+        .submit(Op::RequestPermissionsResponse {
+            id: call_id,
+            response,
+        })
+        .await
+    {
+        error!("failed to submit RequestPermissionsResponse: {err}");
+    }
+}
+
+fn request_permissions_response_from_client_result(
+    requested_permissions: CorePermissionProfile,
+    response: std::result::Result<ClientRequestResult, oneshot::error::RecvError>,
+) -> Option<CoreRequestPermissionsResponse> {
+    let value = match response {
+        Ok(Ok(value)) => value,
+        Ok(Err(err)) if is_turn_transition_server_request_error(&err) => return None,
+        Ok(Err(err)) => {
+            error!("request failed with client error: {err:?}");
+            return Some(CoreRequestPermissionsResponse {
+                permissions: Default::default(),
+                scope: CorePermissionGrantScope::Turn,
+            });
+        }
+        Err(err) => {
+            error!("request failed: {err:?}");
+            return Some(CoreRequestPermissionsResponse {
+                permissions: Default::default(),
+                scope: CorePermissionGrantScope::Turn,
+            });
+        }
+    };
+
+    let response = serde_json::from_value::<PermissionsRequestApprovalResponse>(value)
+        .unwrap_or_else(|err| {
+            error!("failed to deserialize PermissionsRequestApprovalResponse: {err}");
+            PermissionsRequestApprovalResponse {
+                permissions: V2GrantedPermissionProfile::default(),
+                scope: codex_app_server_protocol::PermissionGrantScope::Turn,
+            }
+        });
+    Some(CoreRequestPermissionsResponse {
+        permissions: intersect_permission_profiles(
+            requested_permissions,
+            response.permissions.into(),
+        ),
+        scope: response.scope.to_core(),
+    })
+}
+
 const REVIEW_FALLBACK_MESSAGE: &str = "Reviewer failed to output a response.";
 
 fn render_review_output_text(output: &ReviewOutputEvent) -> String {
@@ -2469,6 +2598,9 @@ mod tests {
     use codex_app_server_protocol::JSONRPCErrorError;
     use codex_app_server_protocol::TurnPlanStepStatus;
     use codex_protocol::mcp::CallToolResult;
+    use codex_protocol::models::MacOsAutomationPermission;
+    use codex_protocol::models::MacOsPreferencesPermission;
+    use codex_protocol::models::MacOsSeatbeltProfileExtensions;
     use codex_protocol::plan_tool::PlanItemArg;
     use codex_protocol::plan_tool::StepStatus;
     use codex_protocol::protocol::CollabResumeBeginEvent;
@@ -2531,6 +2663,141 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_permissions_turn_transition_error_is_ignored() {
+        let error = JSONRPCErrorError {
+            code: -1,
+            message: "client request resolved because the turn state was changed".to_string(),
+            data: Some(serde_json::json!({ "reason": "turnTransition" })),
+        };
+
+        let response = request_permissions_response_from_client_result(
+            CorePermissionProfile::default(),
+            Ok(Err(error)),
+        );
+
+        assert_eq!(response, None);
+    }
+
+    #[test]
+    fn request_permissions_response_accepts_partial_macos_grants() {
+        let requested_permissions = CorePermissionProfile {
+            macos: Some(MacOsSeatbeltProfileExtensions {
+                macos_preferences: MacOsPreferencesPermission::ReadWrite,
+                macos_automation: MacOsAutomationPermission::BundleIds(vec![
+                    "com.apple.Notes".to_string(),
+                    "com.apple.Reminders".to_string(),
+                ]),
+                macos_accessibility: true,
+                macos_calendar: true,
+            }),
+            ..Default::default()
+        };
+        let cases = vec![
+            (serde_json::json!({}), CorePermissionProfile::default()),
+            (
+                serde_json::json!({
+                    "preferences": "read_only",
+                }),
+                CorePermissionProfile {
+                    macos: Some(MacOsSeatbeltProfileExtensions {
+                        macos_preferences: MacOsPreferencesPermission::ReadOnly,
+                        macos_automation: MacOsAutomationPermission::None,
+                        macos_accessibility: false,
+                        macos_calendar: false,
+                    }),
+                    ..Default::default()
+                },
+            ),
+            (
+                serde_json::json!({
+                    "automations": {
+                        "bundle_ids": ["com.apple.Notes"],
+                    },
+                }),
+                CorePermissionProfile {
+                    macos: Some(MacOsSeatbeltProfileExtensions {
+                        macos_preferences: MacOsPreferencesPermission::None,
+                        macos_automation: MacOsAutomationPermission::BundleIds(vec![
+                            "com.apple.Notes".to_string(),
+                        ]),
+                        macos_accessibility: false,
+                        macos_calendar: false,
+                    }),
+                    ..Default::default()
+                },
+            ),
+            (
+                serde_json::json!({
+                    "accessibility": true,
+                }),
+                CorePermissionProfile {
+                    macos: Some(MacOsSeatbeltProfileExtensions {
+                        macos_preferences: MacOsPreferencesPermission::None,
+                        macos_automation: MacOsAutomationPermission::None,
+                        macos_accessibility: true,
+                        macos_calendar: false,
+                    }),
+                    ..Default::default()
+                },
+            ),
+            (
+                serde_json::json!({
+                    "calendar": true,
+                }),
+                CorePermissionProfile {
+                    macos: Some(MacOsSeatbeltProfileExtensions {
+                        macos_preferences: MacOsPreferencesPermission::None,
+                        macos_automation: MacOsAutomationPermission::None,
+                        macos_accessibility: false,
+                        macos_calendar: true,
+                    }),
+                    ..Default::default()
+                },
+            ),
+        ];
+
+        for (granted_macos, expected_permissions) in cases {
+            let response = request_permissions_response_from_client_result(
+                requested_permissions.clone(),
+                Ok(Ok(serde_json::json!({
+                    "permissions": {
+                        "macos": granted_macos,
+                    },
+                }))),
+            )
+            .expect("response should be accepted");
+
+            assert_eq!(
+                response,
+                CoreRequestPermissionsResponse {
+                    permissions: expected_permissions,
+                    scope: CorePermissionGrantScope::Turn,
+                }
+            );
+        }
+    }
+
+    #[test]
+    fn request_permissions_response_preserves_session_scope() {
+        let response = request_permissions_response_from_client_result(
+            CorePermissionProfile::default(),
+            Ok(Ok(serde_json::json!({
+                "scope": "session",
+                "permissions": {},
+            }))),
+        )
+        .expect("response should be accepted");
+
+        assert_eq!(
+            response,
+            CoreRequestPermissionsResponse {
+                permissions: CorePermissionProfile::default(),
+                scope: CorePermissionGrantScope::Session,
+            }
+        );
+    }
+
     #[test]
     fn collab_resume_begin_maps_to_item_started_resume_agent() {
         let event = CollabResumeBeginEvent {

codex-rs/app-server/src/codex_message_processor.rs

@@ -90,6 +90,8 @@ use codex_app_server_protocol::PluginListResponse;
 use codex_app_server_protocol::PluginMarketplaceEntry;
 use codex_app_server_protocol::PluginSource;
 use codex_app_server_protocol::PluginSummary;
+use codex_app_server_protocol::PluginUninstallParams;
+use codex_app_server_protocol::PluginUninstallResponse;
 use codex_app_server_protocol::ProductSurface as ApiProductSurface;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::ReviewDelivery as ApiReviewDelivery;
@@ -217,6 +219,7 @@ use codex_core::plugins::MarketplaceError;
 use codex_core::plugins::MarketplacePluginSourceSummary;
 use codex_core::plugins::PluginInstallError as CorePluginInstallError;
 use codex_core::plugins::PluginInstallRequest;
+use codex_core::plugins::PluginUninstallError as CorePluginUninstallError;
 use codex_core::plugins::load_plugin_apps;
 use codex_core::read_head_for_summary;
 use codex_core::read_session_meta_line;
@@ -711,6 +714,10 @@ impl CodexMessageProcessor {
                 self.plugin_install(to_connection_request_id(request_id), params)
                     .await;
             }
+            ClientRequest::PluginUninstall { request_id, params } => {
+                self.plugin_uninstall(to_connection_request_id(request_id), params)
+                    .await;
+            }
             ClientRequest::TurnStart { request_id, params } => {
                 self.turn_start(
                     to_connection_request_id(request_id),
@@ -1642,9 +1649,10 @@ impl CodexMessageProcessor {
                 None => ExecExpiration::DefaultTimeout,
             }
         };
+        let sandbox_cwd = self.config.cwd.clone();
         let exec_params = ExecParams {
             command,
-            cwd,
+            cwd: cwd.clone(),
             expiration,
             env,
             network: started_network_proxy
@@ -1665,7 +1673,7 @@ impl CodexMessageProcessor {
             Some(policy) => match self.config.permissions.sandbox_policy.can_set(&policy) {
                 Ok(()) => {
                     let file_system_sandbox_policy =
-                        codex_protocol::permissions::FileSystemSandboxPolicy::from(&policy);
+                        codex_protocol::permissions::FileSystemSandboxPolicy::from_legacy_sandbox_policy(&policy, &sandbox_cwd);
                     let network_sandbox_policy =
                         codex_protocol::permissions::NetworkSandboxPolicy::from(&policy);
                     (policy, file_system_sandbox_policy, network_sandbox_policy)
@@ -1690,7 +1698,6 @@ impl CodexMessageProcessor {
         let codex_linux_sandbox_exe = self.arg0_paths.codex_linux_sandbox_exe.clone();
         let outgoing = self.outgoing.clone();
         let request_for_task = request.clone();
-        let sandbox_cwd = self.config.cwd.clone();
         let started_network_proxy_for_task = started_network_proxy;
         let use_linux_sandbox_bwrap = self.config.features.enabled(Feature::UseLinuxSandboxBwrap);
         let size = match size.map(crate::command_exec::terminal_size_from_protocol) {
@@ -5516,6 +5523,57 @@ impl CodexMessageProcessor {
         }
     }
 
+    async fn plugin_uninstall(
+        &self,
+        request_id: ConnectionRequestId,
+        params: PluginUninstallParams,
+    ) {
+        let plugins_manager = self.thread_manager.plugins_manager();
+
+        match plugins_manager.uninstall_plugin(params.plugin_id).await {
+            Ok(()) => {
+                self.clear_plugin_related_caches();
+                self.outgoing
+                    .send_response(request_id, PluginUninstallResponse {})
+                    .await;
+            }
+            Err(err) => {
+                if err.is_invalid_request() {
+                    self.send_invalid_request_error(request_id, err.to_string())
+                        .await;
+                    return;
+                }
+
+                match err {
+                    CorePluginUninstallError::Config(err) => {
+                        self.send_internal_error(
+                            request_id,
+                            format!("failed to clear plugin config: {err}"),
+                        )
+                        .await;
+                    }
+                    CorePluginUninstallError::Join(err) => {
+                        self.send_internal_error(
+                            request_id,
+                            format!("failed to uninstall plugin: {err}"),
+                        )
+                        .await;
+                    }
+                    CorePluginUninstallError::Store(err) => {
+                        self.send_internal_error(
+                            request_id,
+                            format!("failed to uninstall plugin: {err}"),
+                        )
+                        .await;
+                    }
+                    CorePluginUninstallError::InvalidPluginId(_) => {
+                        unreachable!("invalid plugin ids are handled above");
+                    }
+                }
+            }
+        }
+    }
+
     async fn turn_start(
         &self,
         request_id: ConnectionRequestId,

codex-rs/app-server/src/config_api.rs

@@ -1,5 +1,6 @@
 use crate::error_code::INTERNAL_ERROR_CODE;
 use crate::error_code::INVALID_REQUEST_ERROR_CODE;
+use async_trait::async_trait;
 use codex_app_server_protocol::ConfigBatchWriteParams;
 use codex_app_server_protocol::ConfigReadParams;
 use codex_app_server_protocol::ConfigReadResponse;
@@ -11,6 +12,7 @@ use codex_app_server_protocol::ConfigWriteResponse;
 use codex_app_server_protocol::JSONRPCErrorError;
 use codex_app_server_protocol::NetworkRequirements;
 use codex_app_server_protocol::SandboxMode;
+use codex_core::ThreadManager;
 use codex_core::config::ConfigService;
 use codex_core::config::ConfigServiceError;
 use codex_core::config_loader::CloudRequirementsLoader;
@@ -19,11 +21,33 @@ use codex_core::config_loader::LoaderOverrides;
 use codex_core::config_loader::ResidencyRequirement as CoreResidencyRequirement;
 use codex_core::config_loader::SandboxModeRequirement as CoreSandboxModeRequirement;
 use codex_protocol::config_types::WebSearchMode;
+use codex_protocol::protocol::Op;
 use serde_json::json;
 use std::path::PathBuf;
 use std::sync::Arc;
 use std::sync::RwLock;
 use toml::Value as TomlValue;
+use tracing::warn;
+
+#[async_trait]
+pub(crate) trait UserConfigReloader: Send + Sync {
+    async fn reload_user_config(&self);
+}
+
+#[async_trait]
+impl UserConfigReloader for ThreadManager {
+    async fn reload_user_config(&self) {
+        let thread_ids = self.list_thread_ids().await;
+        for thread_id in thread_ids {
+            let Ok(thread) = self.get_thread(thread_id).await else {
+                continue;
+            };
+            if let Err(err) = thread.submit(Op::ReloadUserConfig).await {
+                warn!("failed to request user config reload: {err}");
+            }
+        }
+    }
+}
 
 #[derive(Clone)]
 pub(crate) struct ConfigApi {
@@ -31,6 +55,7 @@ pub(crate) struct ConfigApi {
     cli_overrides: Vec<(String, TomlValue)>,
     loader_overrides: LoaderOverrides,
     cloud_requirements: Arc<RwLock<CloudRequirementsLoader>>,
+    user_config_reloader: Arc<dyn UserConfigReloader>,
 }
 
 impl ConfigApi {
@@ -39,12 +64,14 @@ impl ConfigApi {
         cli_overrides: Vec<(String, TomlValue)>,
         loader_overrides: LoaderOverrides,
         cloud_requirements: Arc<RwLock<CloudRequirementsLoader>>,
+        user_config_reloader: Arc<dyn UserConfigReloader>,
     ) -> Self {
         Self {
             codex_home,
             cli_overrides,
             loader_overrides,
             cloud_requirements,
+            user_config_reloader,
         }
     }
 
@@ -96,10 +123,16 @@ impl ConfigApi {
         &self,
         params: ConfigBatchWriteParams,
     ) -> Result<ConfigWriteResponse, JSONRPCErrorError> {
-        self.config_service()
+        let reload_user_config = params.reload_user_config;
+        let response = self
+            .config_service()
             .batch_write(params)
             .await
-            .map_err(map_error)
+            .map_err(map_error)?;
+        if reload_user_config {
+            self.user_config_reloader.reload_user_config().await;
+        }
+        Ok(response)
     }
 }
 
@@ -199,6 +232,22 @@ mod tests {
     use codex_core::config_loader::NetworkRequirementsToml as CoreNetworkRequirementsToml;
     use codex_protocol::protocol::AskForApproval as CoreAskForApproval;
     use pretty_assertions::assert_eq;
+    use serde_json::json;
+    use std::sync::atomic::AtomicUsize;
+    use std::sync::atomic::Ordering;
+    use tempfile::TempDir;
+
+    #[derive(Default)]
+    struct RecordingUserConfigReloader {
+        call_count: AtomicUsize,
+    }
+
+    #[async_trait]
+    impl UserConfigReloader for RecordingUserConfigReloader {
+        async fn reload_user_config(&self) {
+            self.call_count.fetch_add(1, Ordering::Relaxed);
+        }
+    }
 
     #[test]
     fn map_requirements_toml_to_api_converts_core_enums() {
@@ -305,4 +354,51 @@ mod tests {
             Some(vec![WebSearchMode::Disabled])
         );
     }
+
+    #[tokio::test]
+    async fn batch_write_reloads_user_config_when_requested() {
+        let codex_home = TempDir::new().expect("create temp dir");
+        let user_config_path = codex_home.path().join("config.toml");
+        std::fs::write(&user_config_path, "").expect("write config");
+        let reloader = Arc::new(RecordingUserConfigReloader::default());
+        let config_api = ConfigApi::new(
+            codex_home.path().to_path_buf(),
+            Vec::new(),
+            LoaderOverrides::default(),
+            Arc::new(RwLock::new(CloudRequirementsLoader::default())),
+            reloader.clone(),
+        );
+
+        let response = config_api
+            .batch_write(ConfigBatchWriteParams {
+                edits: vec![codex_app_server_protocol::ConfigEdit {
+                    key_path: "model".to_string(),
+                    value: json!("gpt-5"),
+                    merge_strategy: codex_app_server_protocol::MergeStrategy::Replace,
+                }],
+                file_path: Some(user_config_path.display().to_string()),
+                expected_version: None,
+                reload_user_config: true,
+            })
+            .await
+            .expect("batch write should succeed");
+
+        assert_eq!(
+            response,
+            ConfigWriteResponse {
+                status: codex_app_server_protocol::WriteStatus::Ok,
+                version: response.version.clone(),
+                file_path: codex_utils_absolute_path::AbsolutePathBuf::try_from(
+                    user_config_path.clone()
+                )
+                .expect("absolute config path"),
+                overridden_metadata: None,
+            }
+        );
+        assert_eq!(
+            std::fs::read_to_string(user_config_path).unwrap(),
+            "model = \"gpt-5\"\n"
+        );
+        assert_eq!(reloader.call_count.load(Ordering::Relaxed), 1);
+    }
 }

codex-rs/app-server/src/in_process.rs

@@ -0,0 +1,884 @@
+//! In-process app-server runtime host for local embedders.
+//!
+//! This module runs the existing [`MessageProcessor`] and outbound routing logic
+//! on Tokio tasks, but replaces socket/stdio transports with bounded in-memory
+//! channels. The intent is to preserve app-server semantics while avoiding a
+//! process boundary for CLI surfaces that run in the same process.
+//!
+//! # Lifecycle
+//!
+//! 1. Construct runtime state with [`InProcessStartArgs`].
+//! 2. Call [`start`], which performs the `initialize` / `initialized` handshake
+//!    internally and returns a ready-to-use [`InProcessClientHandle`].
+//! 3. Send requests via [`InProcessClientHandle::request`], notifications via
+//!    [`InProcessClientHandle::notify`], and consume events via
+//!    [`InProcessClientHandle::next_event`].
+//! 4. Terminate with [`InProcessClientHandle::shutdown`].
+//!
+//! # Transport model
+//!
+//! The runtime is transport-local but not protocol-free. Incoming requests are
+//! typed [`ClientRequest`] values, yet responses still come back through the
+//! same JSON-RPC result envelope that `MessageProcessor` uses for stdio and
+//! websocket transports. This keeps in-process behavior aligned with
+//! app-server rather than creating a second execution contract.
+//!
+//! # Backpressure
+//!
+//! Command submission uses `try_send` and can return `WouldBlock`, while event
+//! fanout may drop notifications under saturation. Server requests are never
+//! silently abandoned: if they cannot be queued they are failed back into
+//! `MessageProcessor` with overload or internal errors so approval flows do
+//! not hang indefinitely.
+//!
+//! # Relationship to `codex-app-server-client`
+//!
+//! This module provides the low-level runtime handle ([`InProcessClientHandle`]).
+//! Higher-level callers (TUI, exec) should go through `codex-app-server-client`,
+//! which wraps this module behind a worker task with async request/response
+//! helpers, surface-specific startup policy, and bounded shutdown.
+
+use std::collections::HashMap;
+use std::collections::HashSet;
+use std::collections::hash_map::Entry;
+use std::io::Error as IoError;
+use std::io::ErrorKind;
+use std::io::Result as IoResult;
+use std::sync::Arc;
+use std::sync::RwLock;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
+use std::time::Duration;
+
+use crate::error_code::INTERNAL_ERROR_CODE;
+use crate::error_code::INVALID_REQUEST_ERROR_CODE;
+use crate::error_code::OVERLOADED_ERROR_CODE;
+use crate::message_processor::ConnectionSessionState;
+use crate::message_processor::MessageProcessor;
+use crate::message_processor::MessageProcessorArgs;
+use crate::outgoing_message::ConnectionId;
+use crate::outgoing_message::OutgoingEnvelope;
+use crate::outgoing_message::OutgoingMessage;
+use crate::outgoing_message::OutgoingMessageSender;
+use crate::transport::CHANNEL_CAPACITY;
+use crate::transport::OutboundConnectionState;
+use crate::transport::route_outgoing_envelope;
+use codex_app_server_protocol::ClientNotification;
+use codex_app_server_protocol::ClientRequest;
+use codex_app_server_protocol::ConfigWarningNotification;
+use codex_app_server_protocol::InitializeParams;
+use codex_app_server_protocol::JSONRPCErrorError;
+use codex_app_server_protocol::JSONRPCNotification;
+use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::Result;
+use codex_app_server_protocol::ServerNotification;
+use codex_app_server_protocol::ServerRequest;
+use codex_arg0::Arg0DispatchPaths;
+use codex_core::config::Config;
+use codex_core::config_loader::CloudRequirementsLoader;
+use codex_core::config_loader::LoaderOverrides;
+use codex_feedback::CodexFeedback;
+use codex_protocol::protocol::SessionSource;
+use tokio::sync::mpsc;
+use tokio::sync::oneshot;
+use tokio::time::timeout;
+use toml::Value as TomlValue;
+use tracing::warn;
+
+const IN_PROCESS_CONNECTION_ID: ConnectionId = ConnectionId(0);
+const SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(5);
+/// Default bounded channel capacity for in-process runtime queues.
+pub const DEFAULT_IN_PROCESS_CHANNEL_CAPACITY: usize = CHANNEL_CAPACITY;
+
+type PendingClientRequestResponse = std::result::Result<Result, JSONRPCErrorError>;
+
+fn server_notification_requires_delivery(notification: &ServerNotification) -> bool {
+    matches!(notification, ServerNotification::TurnCompleted(_))
+}
+
+fn legacy_notification_requires_delivery(notification: &JSONRPCNotification) -> bool {
+    matches!(
+        notification
+            .method
+            .strip_prefix("codex/event/")
+            .unwrap_or(&notification.method),
+        "task_complete" | "turn_aborted" | "shutdown_complete"
+    )
+}
+
+/// Input needed to start an in-process app-server runtime.
+///
+/// These fields mirror the pieces of ambient process state that stdio and
+/// websocket transports normally assemble before `MessageProcessor` starts.
+#[derive(Clone)]
+pub struct InProcessStartArgs {
+    /// Resolved argv0 dispatch paths used by command execution internals.
+    pub arg0_paths: Arg0DispatchPaths,
+    /// Shared base config used to initialize core components.
+    pub config: Arc<Config>,
+    /// CLI config overrides that are already parsed into TOML values.
+    pub cli_overrides: Vec<(String, TomlValue)>,
+    /// Loader override knobs used by config API paths.
+    pub loader_overrides: LoaderOverrides,
+    /// Preloaded cloud requirements provider.
+    pub cloud_requirements: CloudRequirementsLoader,
+    /// Feedback sink used by app-server/core telemetry and logs.
+    pub feedback: CodexFeedback,
+    /// Startup warnings emitted after initialize succeeds.
+    pub config_warnings: Vec<ConfigWarningNotification>,
+    /// Session source stamped into thread/session metadata.
+    pub session_source: SessionSource,
+    /// Whether auth loading should honor the `CODEX_API_KEY` environment variable.
+    pub enable_codex_api_key_env: bool,
+    /// Initialize params used for initial handshake.
+    pub initialize: InitializeParams,
+    /// Capacity used for all runtime queues (clamped to at least 1).
+    pub channel_capacity: usize,
+}
+
+/// Event emitted from the app-server to the in-process client.
+///
+/// The stream carries three event families because CLI surfaces are mid-migration
+/// from the legacy `codex_protocol::Event` model to the typed app-server
+/// notification model. Once all surfaces consume only [`ServerNotification`],
+/// [`LegacyNotification`](Self::LegacyNotification) can be removed.
+///
+/// [`Lagged`](Self::Lagged) is a transport health marker, not an application
+/// event — it signals that the consumer fell behind and some events were dropped.
+#[derive(Debug, Clone)]
+pub enum InProcessServerEvent {
+    /// Server request that requires client response/rejection.
+    ServerRequest(ServerRequest),
+    /// App-server notification directed to the embedded client.
+    ServerNotification(ServerNotification),
+    /// Legacy JSON-RPC notification from core event bridge.
+    LegacyNotification(JSONRPCNotification),
+    /// Indicates one or more events were dropped due to backpressure.
+    Lagged { skipped: usize },
+}
+
+/// Internal message sent from [`InProcessClientHandle`] methods to the runtime task.
+///
+/// Requests carry a oneshot sender for the response; notifications and server-request
+/// replies are fire-and-forget from the caller's perspective (transport errors are
+/// caught by `try_send` on the outer channel).
+enum InProcessClientMessage {
+    Request {
+        request: Box<ClientRequest>,
+        response_tx: oneshot::Sender<PendingClientRequestResponse>,
+    },
+    Notification {
+        notification: ClientNotification,
+    },
+    ServerRequestResponse {
+        request_id: RequestId,
+        result: Result,
+    },
+    ServerRequestError {
+        request_id: RequestId,
+        error: JSONRPCErrorError,
+    },
+    Shutdown {
+        done_tx: oneshot::Sender<()>,
+    },
+}
+
+enum ProcessorCommand {
+    Request(Box<ClientRequest>),
+    Notification(ClientNotification),
+}
+
+#[derive(Clone)]
+pub struct InProcessClientSender {
+    client_tx: mpsc::Sender<InProcessClientMessage>,
+}
+
+impl InProcessClientSender {
+    pub async fn request(&self, request: ClientRequest) -> IoResult<PendingClientRequestResponse> {
+        let (response_tx, response_rx) = oneshot::channel();
+        self.try_send_client_message(InProcessClientMessage::Request {
+            request: Box::new(request),
+            response_tx,
+        })?;
+        response_rx.await.map_err(|err| {
+            IoError::new(
+                ErrorKind::BrokenPipe,
+                format!("in-process request response channel closed: {err}"),
+            )
+        })
+    }
+
+    pub fn notify(&self, notification: ClientNotification) -> IoResult<()> {
+        self.try_send_client_message(InProcessClientMessage::Notification { notification })
+    }
+
+    pub fn respond_to_server_request(&self, request_id: RequestId, result: Result) -> IoResult<()> {
+        self.try_send_client_message(InProcessClientMessage::ServerRequestResponse {
+            request_id,
+            result,
+        })
+    }
+
+    pub fn fail_server_request(
+        &self,
+        request_id: RequestId,
+        error: JSONRPCErrorError,
+    ) -> IoResult<()> {
+        self.try_send_client_message(InProcessClientMessage::ServerRequestError {
+            request_id,
+            error,
+        })
+    }
+
+    fn try_send_client_message(&self, message: InProcessClientMessage) -> IoResult<()> {
+        match self.client_tx.try_send(message) {
+            Ok(()) => Ok(()),
+            Err(mpsc::error::TrySendError::Full(_)) => Err(IoError::new(
+                ErrorKind::WouldBlock,
+                "in-process app-server client queue is full",
+            )),
+            Err(mpsc::error::TrySendError::Closed(_)) => Err(IoError::new(
+                ErrorKind::BrokenPipe,
+                "in-process app-server runtime is closed",
+            )),
+        }
+    }
+}
+
+/// Handle used by an in-process client to call app-server and consume events.
+///
+/// This is the low-level runtime handle. Higher-level callers should usually go
+/// through `codex-app-server-client`, which adds worker-task buffering,
+/// request/response helpers, and surface-specific startup policy.
+pub struct InProcessClientHandle {
+    client: InProcessClientSender,
+    event_rx: mpsc::Receiver<InProcessServerEvent>,
+    runtime_handle: tokio::task::JoinHandle<()>,
+}
+
+impl InProcessClientHandle {
+    /// Sends a typed client request into the in-process runtime.
+    ///
+    /// The returned value is a transport-level `IoResult` containing either a
+    /// JSON-RPC success payload or JSON-RPC error payload. Callers must keep
+    /// request IDs unique among concurrent requests; reusing an in-flight ID
+    /// produces an `INVALID_REQUEST` response and can make request routing
+    /// ambiguous in the caller.
+    pub async fn request(&self, request: ClientRequest) -> IoResult<PendingClientRequestResponse> {
+        self.client.request(request).await
+    }
+
+    /// Sends a typed client notification into the in-process runtime.
+    ///
+    /// Notifications do not have an application-level response. Transport
+    /// errors indicate queue saturation or closed runtime.
+    pub fn notify(&self, notification: ClientNotification) -> IoResult<()> {
+        self.client.notify(notification)
+    }
+
+    /// Resolves a pending [`ServerRequest`](InProcessServerEvent::ServerRequest).
+    ///
+    /// This should be used only with request IDs received from the current
+    /// runtime event stream; sending arbitrary IDs has no effect on app-server
+    /// state and can mask a stuck approval flow in the caller.
+    pub fn respond_to_server_request(&self, request_id: RequestId, result: Result) -> IoResult<()> {
+        self.client.respond_to_server_request(request_id, result)
+    }
+
+    /// Rejects a pending [`ServerRequest`](InProcessServerEvent::ServerRequest).
+    ///
+    /// Use this when the embedder cannot satisfy a server request; leaving
+    /// requests unanswered can stall turn progress.
+    pub fn fail_server_request(
+        &self,
+        request_id: RequestId,
+        error: JSONRPCErrorError,
+    ) -> IoResult<()> {
+        self.client.fail_server_request(request_id, error)
+    }
+
+    /// Receives the next server event from the in-process runtime.
+    ///
+    /// Returns `None` when the runtime task exits and no more events are
+    /// available.
+    pub async fn next_event(&mut self) -> Option<InProcessServerEvent> {
+        self.event_rx.recv().await
+    }
+
+    /// Requests runtime shutdown and waits for worker termination.
+    ///
+    /// Shutdown is bounded by internal timeouts and may abort background tasks
+    /// if graceful drain does not complete in time.
+    pub async fn shutdown(self) -> IoResult<()> {
+        let mut runtime_handle = self.runtime_handle;
+        let (done_tx, done_rx) = oneshot::channel();
+
+        if self
+            .client
+            .client_tx
+            .send(InProcessClientMessage::Shutdown { done_tx })
+            .await
+            .is_ok()
+        {
+            let _ = timeout(SHUTDOWN_TIMEOUT, done_rx).await;
+        }
+
+        if let Err(_elapsed) = timeout(SHUTDOWN_TIMEOUT, &mut runtime_handle).await {
+            runtime_handle.abort();
+            let _ = runtime_handle.await;
+        }
+        Ok(())
+    }
+
+    pub fn sender(&self) -> InProcessClientSender {
+        self.client.clone()
+    }
+}
+
+/// Starts an in-process app-server runtime and performs initialize handshake.
+///
+/// This function sends `initialize` followed by `initialized` before returning
+/// the handle, so callers receive a ready-to-use runtime. If initialize fails,
+/// the runtime is shut down and an `InvalidData` error is returned.
+pub async fn start(args: InProcessStartArgs) -> IoResult<InProcessClientHandle> {
+    let initialize = args.initialize.clone();
+    let client = start_uninitialized(args);
+
+    let initialize_response = client
+        .request(ClientRequest::Initialize {
+            request_id: RequestId::Integer(0),
+            params: initialize,
+        })
+        .await?;
+    if let Err(error) = initialize_response {
+        let _ = client.shutdown().await;
+        return Err(IoError::new(
+            ErrorKind::InvalidData,
+            format!("in-process initialize failed: {}", error.message),
+        ));
+    }
+    client.notify(ClientNotification::Initialized)?;
+
+    Ok(client)
+}
+
+fn start_uninitialized(args: InProcessStartArgs) -> InProcessClientHandle {
+    let channel_capacity = args.channel_capacity.max(1);
+    let (client_tx, mut client_rx) = mpsc::channel::<InProcessClientMessage>(channel_capacity);
+    let (event_tx, event_rx) = mpsc::channel::<InProcessServerEvent>(channel_capacity);
+
+    let runtime_handle = tokio::spawn(async move {
+        let (outgoing_tx, mut outgoing_rx) = mpsc::channel::<OutgoingEnvelope>(channel_capacity);
+        let outgoing_message_sender = Arc::new(OutgoingMessageSender::new(outgoing_tx));
+
+        let (writer_tx, mut writer_rx) = mpsc::channel::<OutgoingMessage>(channel_capacity);
+        let outbound_initialized = Arc::new(AtomicBool::new(false));
+        let outbound_experimental_api_enabled = Arc::new(AtomicBool::new(false));
+        let outbound_opted_out_notification_methods = Arc::new(RwLock::new(HashSet::new()));
+
+        let mut outbound_connections = HashMap::<ConnectionId, OutboundConnectionState>::new();
+        outbound_connections.insert(
+            IN_PROCESS_CONNECTION_ID,
+            OutboundConnectionState::new(
+                writer_tx,
+                Arc::clone(&outbound_initialized),
+                Arc::clone(&outbound_experimental_api_enabled),
+                Arc::clone(&outbound_opted_out_notification_methods),
+                None,
+            ),
+        );
+        let mut outbound_handle = tokio::spawn(async move {
+            while let Some(envelope) = outgoing_rx.recv().await {
+                route_outgoing_envelope(&mut outbound_connections, envelope).await;
+            }
+        });
+
+        let processor_outgoing = Arc::clone(&outgoing_message_sender);
+        let (processor_tx, mut processor_rx) = mpsc::channel::<ProcessorCommand>(channel_capacity);
+        let mut processor_handle = tokio::spawn(async move {
+            let mut processor = MessageProcessor::new(MessageProcessorArgs {
+                outgoing: Arc::clone(&processor_outgoing),
+                arg0_paths: args.arg0_paths,
+                config: args.config,
+                cli_overrides: args.cli_overrides,
+                loader_overrides: args.loader_overrides,
+                cloud_requirements: args.cloud_requirements,
+                feedback: args.feedback,
+                log_db: None,
+                config_warnings: args.config_warnings,
+                session_source: args.session_source,
+                enable_codex_api_key_env: args.enable_codex_api_key_env,
+            });
+            let mut thread_created_rx = processor.thread_created_receiver();
+            let mut session = ConnectionSessionState::default();
+            let mut listen_for_threads = true;
+
+            loop {
+                tokio::select! {
+                    command = processor_rx.recv() => {
+                        match command {
+                            Some(ProcessorCommand::Request(request)) => {
+                                let was_initialized = session.initialized;
+                                processor
+                                    .process_client_request(
+                                        IN_PROCESS_CONNECTION_ID,
+                                        *request,
+                                        &mut session,
+                                        &outbound_initialized,
+                                    )
+                                    .await;
+                                if let Ok(mut opted_out_notification_methods) =
+                                    outbound_opted_out_notification_methods.write()
+                                {
+                                    *opted_out_notification_methods =
+                                        session.opted_out_notification_methods.clone();
+                                } else {
+                                    warn!("failed to update outbound opted-out notifications");
+                                }
+                                outbound_experimental_api_enabled.store(
+                                    session.experimental_api_enabled,
+                                    Ordering::Release,
+                                );
+                                if !was_initialized && session.initialized {
+                                    processor.send_initialize_notifications().await;
+                                }
+                            }
+                            Some(ProcessorCommand::Notification(notification)) => {
+                                processor.process_client_notification(notification).await;
+                            }
+                            None => {
+                                break;
+                            }
+                        }
+                    }
+                    created = thread_created_rx.recv(), if listen_for_threads => {
+                        match created {
+                            Ok(thread_id) => {
+                                let connection_ids = if session.initialized {
+                                    vec![IN_PROCESS_CONNECTION_ID]
+                                } else {
+                                    Vec::<ConnectionId>::new()
+                                };
+                                processor
+                                    .try_attach_thread_listener(thread_id, connection_ids)
+                                    .await;
+                            }
+                            Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                                warn!("thread_created receiver lagged; skipping resync");
+                            }
+                            Err(tokio::sync::broadcast::error::RecvError::Closed) => {
+                                listen_for_threads = false;
+                            }
+                        }
+                    }
+                }
+            }
+
+            processor.connection_closed(IN_PROCESS_CONNECTION_ID).await;
+        });
+        let mut pending_request_responses =
+            HashMap::<RequestId, oneshot::Sender<PendingClientRequestResponse>>::new();
+        let mut shutdown_ack = None;
+
+        loop {
+            tokio::select! {
+                message = client_rx.recv() => {
+                    match message {
+                        Some(InProcessClientMessage::Request { request, response_tx }) => {
+                            let request = *request;
+                            let request_id = request.id().clone();
+                            match pending_request_responses.entry(request_id.clone()) {
+                                Entry::Vacant(entry) => {
+                                    entry.insert(response_tx);
+                                }
+                                Entry::Occupied(_) => {
+                                    let _ = response_tx.send(Err(JSONRPCErrorError {
+                                        code: INVALID_REQUEST_ERROR_CODE,
+                                        message: format!("duplicate request id: {request_id:?}"),
+                                        data: None,
+                                    }));
+                                    continue;
+                                }
+                            }
+
+                            match processor_tx.try_send(ProcessorCommand::Request(Box::new(request))) {
+                                Ok(()) => {}
+                                Err(mpsc::error::TrySendError::Full(_)) => {
+                                    if let Some(response_tx) =
+                                        pending_request_responses.remove(&request_id)
+                                    {
+                                        let _ = response_tx.send(Err(JSONRPCErrorError {
+                                            code: OVERLOADED_ERROR_CODE,
+                                            message: "in-process app-server request queue is full"
+                                                .to_string(),
+                                            data: None,
+                                        }));
+                                    }
+                                }
+                                Err(mpsc::error::TrySendError::Closed(_)) => {
+                                    if let Some(response_tx) =
+                                        pending_request_responses.remove(&request_id)
+                                    {
+                                        let _ = response_tx.send(Err(JSONRPCErrorError {
+                                            code: INTERNAL_ERROR_CODE,
+                                            message:
+                                                "in-process app-server request processor is closed"
+                                                    .to_string(),
+                                            data: None,
+                                        }));
+                                    }
+                                    break;
+                                }
+                            }
+                        }
+                        Some(InProcessClientMessage::Notification { notification }) => {
+                            match processor_tx.try_send(ProcessorCommand::Notification(notification)) {
+                                Ok(()) => {}
+                                Err(mpsc::error::TrySendError::Full(_)) => {
+                                    warn!("dropping in-process client notification (queue full)");
+                                }
+                                Err(mpsc::error::TrySendError::Closed(_)) => {
+                                    break;
+                                }
+                            }
+                        }
+                        Some(InProcessClientMessage::ServerRequestResponse { request_id, result }) => {
+                            outgoing_message_sender
+                                .notify_client_response(request_id, result)
+                                .await;
+                        }
+                        Some(InProcessClientMessage::ServerRequestError { request_id, error }) => {
+                            outgoing_message_sender
+                                .notify_client_error(request_id, error)
+                                .await;
+                        }
+                        Some(InProcessClientMessage::Shutdown { done_tx }) => {
+                            shutdown_ack = Some(done_tx);
+                            break;
+                        }
+                        None => {
+                            break;
+                        }
+                    }
+                }
+                outgoing_message = writer_rx.recv() => {
+                    let Some(outgoing_message) = outgoing_message else {
+                        break;
+                    };
+                    match outgoing_message {
+                        OutgoingMessage::Response(response) => {
+                            if let Some(response_tx) = pending_request_responses.remove(&response.id) {
+                                let _ = response_tx.send(Ok(response.result));
+                            } else {
+                                warn!(
+                                    request_id = ?response.id,
+                                    "dropping unmatched in-process response"
+                                );
+                            }
+                        }
+                        OutgoingMessage::Error(error) => {
+                            if let Some(response_tx) = pending_request_responses.remove(&error.id) {
+                                let _ = response_tx.send(Err(error.error));
+                            } else {
+                                warn!(
+                                    request_id = ?error.id,
+                                    "dropping unmatched in-process error response"
+                                );
+                            }
+                        }
+                        OutgoingMessage::Request(request) => {
+                            // Send directly to avoid cloning; on failure the
+                            // original value is returned inside the error.
+                            if let Err(send_error) = event_tx
+                                .try_send(InProcessServerEvent::ServerRequest(request))
+                            {
+                                let (code, message, inner) = match send_error {
+                                    mpsc::error::TrySendError::Full(inner) => (
+                                        OVERLOADED_ERROR_CODE,
+                                        "in-process server request queue is full",
+                                        inner,
+                                    ),
+                                    mpsc::error::TrySendError::Closed(inner) => (
+                                        INTERNAL_ERROR_CODE,
+                                        "in-process server request consumer is closed",
+                                        inner,
+                                    ),
+                                };
+                                let request_id = match inner {
+                                    InProcessServerEvent::ServerRequest(req) => req.id().clone(),
+                                    _ => unreachable!("we just sent a ServerRequest variant"),
+                                };
+                                outgoing_message_sender
+                                    .notify_client_error(
+                                        request_id,
+                                        JSONRPCErrorError {
+                                            code,
+                                            message: message.to_string(),
+                                            data: None,
+                                        },
+                                    )
+                                    .await;
+                            }
+                        }
+                        OutgoingMessage::AppServerNotification(notification) => {
+                            if server_notification_requires_delivery(&notification) {
+                                if event_tx
+                                    .send(InProcessServerEvent::ServerNotification(notification))
+                                    .await
+                                    .is_err()
+                                {
+                                    break;
+                                }
+                            } else if let Err(send_error) =
+                                event_tx.try_send(InProcessServerEvent::ServerNotification(notification))
+                            {
+                                match send_error {
+                                    mpsc::error::TrySendError::Full(_) => {
+                                        warn!("dropping in-process server notification (queue full)");
+                                    }
+                                    mpsc::error::TrySendError::Closed(_) => {
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                        OutgoingMessage::Notification(notification) => {
+                            let notification = JSONRPCNotification {
+                                method: notification.method,
+                                params: notification.params,
+                            };
+                            if legacy_notification_requires_delivery(&notification) {
+                                if event_tx
+                                    .send(InProcessServerEvent::LegacyNotification(notification))
+                                    .await
+                                    .is_err()
+                                {
+                                    break;
+                                }
+                            } else if let Err(send_error) =
+                                event_tx.try_send(InProcessServerEvent::LegacyNotification(notification))
+                            {
+                                match send_error {
+                                    mpsc::error::TrySendError::Full(_) => {
+                                        warn!("dropping in-process legacy notification (queue full)");
+                                    }
+                                    mpsc::error::TrySendError::Closed(_) => {
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        drop(writer_rx);
+        drop(processor_tx);
+        outgoing_message_sender
+            .cancel_all_requests(Some(JSONRPCErrorError {
+                code: INTERNAL_ERROR_CODE,
+                message: "in-process app-server runtime is shutting down".to_string(),
+                data: None,
+            }))
+            .await;
+        // Drop the runtime's last sender before awaiting the router task so
+        // `outgoing_rx.recv()` can observe channel closure and exit cleanly.
+        drop(outgoing_message_sender);
+        for (_, response_tx) in pending_request_responses {
+            let _ = response_tx.send(Err(JSONRPCErrorError {
+                code: INTERNAL_ERROR_CODE,
+                message: "in-process app-server runtime is shutting down".to_string(),
+                data: None,
+            }));
+        }
+
+        if let Err(_elapsed) = timeout(SHUTDOWN_TIMEOUT, &mut processor_handle).await {
+            processor_handle.abort();
+            let _ = processor_handle.await;
+        }
+        if let Err(_elapsed) = timeout(SHUTDOWN_TIMEOUT, &mut outbound_handle).await {
+            outbound_handle.abort();
+            let _ = outbound_handle.await;
+        }
+
+        if let Some(done_tx) = shutdown_ack {
+            let _ = done_tx.send(());
+        }
+    });
+
+    InProcessClientHandle {
+        client: InProcessClientSender { client_tx },
+        event_rx,
+        runtime_handle,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use codex_app_server_protocol::ClientInfo;
+    use codex_app_server_protocol::ConfigRequirementsReadResponse;
+    use codex_app_server_protocol::SessionSource as ApiSessionSource;
+    use codex_app_server_protocol::ThreadStartParams;
+    use codex_app_server_protocol::ThreadStartResponse;
+    use codex_app_server_protocol::Turn;
+    use codex_app_server_protocol::TurnCompletedNotification;
+    use codex_app_server_protocol::TurnStatus;
+    use codex_core::config::ConfigBuilder;
+    use pretty_assertions::assert_eq;
+
+    async fn build_test_config() -> Config {
+        match ConfigBuilder::default().build().await {
+            Ok(config) => config,
+            Err(_) => Config::load_default_with_cli_overrides(Vec::new())
+                .expect("default config should load"),
+        }
+    }
+
+    async fn start_test_client_with_capacity(
+        session_source: SessionSource,
+        channel_capacity: usize,
+    ) -> InProcessClientHandle {
+        let args = InProcessStartArgs {
+            arg0_paths: Arg0DispatchPaths::default(),
+            config: Arc::new(build_test_config().await),
+            cli_overrides: Vec::new(),
+            loader_overrides: LoaderOverrides::default(),
+            cloud_requirements: CloudRequirementsLoader::default(),
+            feedback: CodexFeedback::new(),
+            config_warnings: Vec::new(),
+            session_source,
+            enable_codex_api_key_env: false,
+            initialize: InitializeParams {
+                client_info: ClientInfo {
+                    name: "codex-in-process-test".to_string(),
+                    title: None,
+                    version: "0.0.0".to_string(),
+                },
+                capabilities: None,
+            },
+            channel_capacity,
+        };
+        start(args).await.expect("in-process runtime should start")
+    }
+
+    async fn start_test_client(session_source: SessionSource) -> InProcessClientHandle {
+        start_test_client_with_capacity(session_source, DEFAULT_IN_PROCESS_CHANNEL_CAPACITY).await
+    }
+
+    #[tokio::test]
+    async fn in_process_start_initializes_and_handles_typed_v2_request() {
+        let client = start_test_client(SessionSource::Cli).await;
+        let response = client
+            .request(ClientRequest::ConfigRequirementsRead {
+                request_id: RequestId::Integer(1),
+                params: None,
+            })
+            .await
+            .expect("request transport should work")
+            .expect("request should succeed");
+        assert!(response.is_object());
+
+        let _parsed: ConfigRequirementsReadResponse =
+            serde_json::from_value(response).expect("response should match v2 schema");
+        client
+            .shutdown()
+            .await
+            .expect("in-process runtime should shutdown cleanly");
+    }
+
+    #[tokio::test]
+    async fn in_process_start_uses_requested_session_source_for_thread_start() {
+        for (requested_source, expected_source) in [
+            (SessionSource::Cli, ApiSessionSource::Cli),
+            (SessionSource::Exec, ApiSessionSource::Exec),
+        ] {
+            let client = start_test_client(requested_source).await;
+            let response = client
+                .request(ClientRequest::ThreadStart {
+                    request_id: RequestId::Integer(2),
+                    params: ThreadStartParams {
+                        ephemeral: Some(true),
+                        ..ThreadStartParams::default()
+                    },
+                })
+                .await
+                .expect("request transport should work")
+                .expect("thread/start should succeed");
+            let parsed: ThreadStartResponse =
+                serde_json::from_value(response).expect("thread/start response should parse");
+            assert_eq!(parsed.thread.source, expected_source);
+            client
+                .shutdown()
+                .await
+                .expect("in-process runtime should shutdown cleanly");
+        }
+    }
+
+    #[tokio::test]
+    async fn in_process_start_clamps_zero_channel_capacity() {
+        let client = start_test_client_with_capacity(SessionSource::Cli, 0).await;
+        let response = loop {
+            match client
+                .request(ClientRequest::ConfigRequirementsRead {
+                    request_id: RequestId::Integer(4),
+                    params: None,
+                })
+                .await
+            {
+                Ok(response) => break response.expect("request should succeed"),
+                Err(err) if err.kind() == std::io::ErrorKind::WouldBlock => {
+                    tokio::task::yield_now().await;
+                }
+                Err(err) => panic!("request transport should work: {err}"),
+            }
+        };
+        let _parsed: ConfigRequirementsReadResponse =
+            serde_json::from_value(response).expect("response should match v2 schema");
+        client
+            .shutdown()
+            .await
+            .expect("in-process runtime should shutdown cleanly");
+    }
+
+    #[test]
+    fn guaranteed_delivery_helpers_cover_terminal_notifications() {
+        assert!(server_notification_requires_delivery(
+            &ServerNotification::TurnCompleted(TurnCompletedNotification {
+                thread_id: "thread-1".to_string(),
+                turn: Turn {
+                    id: "turn-1".to_string(),
+                    items: Vec::new(),
+                    status: TurnStatus::Completed,
+                    error: None,
+                },
+            })
+        ));
+
+        assert!(legacy_notification_requires_delivery(
+            &JSONRPCNotification {
+                method: "codex/event/task_complete".to_string(),
+                params: None,
+            }
+        ));
+        assert!(legacy_notification_requires_delivery(
+            &JSONRPCNotification {
+                method: "codex/event/turn_aborted".to_string(),
+                params: None,
+            }
+        ));
+        assert!(legacy_notification_requires_delivery(
+            &JSONRPCNotification {
+                method: "codex/event/shutdown_complete".to_string(),
+                params: None,
+            }
+        ));
+        assert!(!legacy_notification_requires_delivery(
+            &JSONRPCNotification {
+                method: "codex/event/item_started".to_string(),
+                params: None,
+            }
+        ));
+    }
+}

codex-rs/app-server/src/lib.rs

@@ -39,6 +39,7 @@ use codex_core::check_execpolicy_for_warnings;
 use codex_core::config_loader::ConfigLoadError;
 use codex_core::config_loader::TextRange as CoreTextRange;
 use codex_feedback::CodexFeedback;
+use codex_protocol::protocol::SessionSource;
 use codex_state::log_db;
 use tokio::sync::mpsc;
 use tokio::task::JoinHandle;
@@ -65,6 +66,7 @@ mod error_code;
 mod external_agent_config_api;
 mod filters;
 mod fuzzy_file_search;
+pub mod in_process;
 mod message_processor;
 mod models;
 mod outgoing_message;
@@ -597,6 +599,8 @@ pub async fn run_main_with_transport(
             feedback: feedback.clone(),
             log_db,
             config_warnings,
+            session_source: SessionSource::VSCode,
+            enable_codex_api_key_env: false,
         });
         let mut thread_created_rx = processor.thread_created_receiver();
         let mut running_turn_count_rx = processor.subscribe_running_assistant_turn_count();
@@ -711,7 +715,6 @@ pub async fn run_main_with_transport(
                                                 request,
                                                 transport,
                                                 &mut connection_state.session,
-                                                &connection_state.outbound_initialized,
                                             )
                                             .await;
                                         if let Ok(mut opted_out_notification_methods) = connection_state
@@ -734,7 +737,15 @@ pub async fn run_main_with_transport(
                                                 std::sync::atomic::Ordering::Release,
                                             );
                                         if !was_initialized && connection_state.session.initialized {
-                                            processor.send_initialize_notifications().await;
+                                            processor
+                                                .send_initialize_notifications_to_connection(
+                                                    connection_id,
+                                                )
+                                                .await;
+                                            processor.connection_initialized(connection_id).await;
+                                            connection_state
+                                                .outbound_initialized
+                                                .store(true, std::sync::atomic::Ordering::Release);
                                         }
                                     }
                                     JSONRPCMessage::Response(response) => {

codex-rs/app-server/src/message_processor.rs

@@ -18,6 +18,7 @@ use codex_app_server_protocol::ChatgptAuthTokensRefreshParams;
 use codex_app_server_protocol::ChatgptAuthTokensRefreshReason;
 use codex_app_server_protocol::ChatgptAuthTokensRefreshResponse;
 use codex_app_server_protocol::ClientInfo;
+use codex_app_server_protocol::ClientNotification;
 use codex_app_server_protocol::ClientRequest;
 use codex_app_server_protocol::ConfigBatchWriteParams;
 use codex_app_server_protocol::ConfigReadParams;
@@ -157,6 +158,8 @@ pub(crate) struct MessageProcessorArgs {
     pub(crate) feedback: CodexFeedback,
     pub(crate) log_db: Option<LogDbLayer>,
     pub(crate) config_warnings: Vec<ConfigWarningNotification>,
+    pub(crate) session_source: SessionSource,
+    pub(crate) enable_codex_api_key_env: bool,
 }
 
 impl MessageProcessor {
@@ -173,10 +176,12 @@ impl MessageProcessor {
             feedback,
             log_db,
             config_warnings,
+            session_source,
+            enable_codex_api_key_env,
         } = args;
         let auth_manager = AuthManager::shared(
             config.codex_home.clone(),
-            false,
+            enable_codex_api_key_env,
             config.cli_auth_credentials_store_mode,
         );
         auth_manager.set_forced_chatgpt_workspace_id(config.forced_chatgpt_workspace_id.clone());
@@ -186,7 +191,7 @@ impl MessageProcessor {
         let thread_manager = Arc::new(ThreadManager::new(
             config.codex_home.clone(),
             auth_manager.clone(),
-            SessionSource::VSCode,
+            session_source,
             config.model_catalog.clone(),
             CollaborationModesConfig {
                 default_mode_request_user_input: config
@@ -194,13 +199,14 @@ impl MessageProcessor {
                     .enabled(codex_core::features::Feature::DefaultModeRequestUserInput),
             },
         ));
+        // TODO(xl): Move into PluginManager once this no longer depends on config feature gating.
         thread_manager
             .plugins_manager()
             .maybe_start_curated_repo_sync_for_config(&config);
         let cloud_requirements = Arc::new(RwLock::new(cloud_requirements));
         let codex_message_processor = CodexMessageProcessor::new(CodexMessageProcessorArgs {
             auth_manager,
-            thread_manager,
+            thread_manager: Arc::clone(&thread_manager),
             outgoing: outgoing.clone(),
             arg0_paths,
             config: Arc::clone(&config),
@@ -214,6 +220,7 @@ impl MessageProcessor {
             cli_overrides,
             loader_overrides,
             cloud_requirements,
+            thread_manager,
         );
         let external_agent_config_api = ExternalAgentConfigApi::new(config.codex_home.clone());
 
@@ -233,7 +240,6 @@ impl MessageProcessor {
         request: JSONRPCRequest,
         transport: AppServerTransport,
         session: &mut ConnectionSessionState,
-        outbound_initialized: &AtomicBool,
     ) {
         let request_span =
             crate::app_server_tracing::request_span(&request, transport, connection_id, session);
@@ -274,187 +280,51 @@ impl MessageProcessor {
                 }
             };
 
-            match codex_request {
-            // Handle Initialize internally so CodexMessageProcessor does not have to concern
-            // itself with the `initialized` bool.
-            ClientRequest::Initialize { request_id, params } => {
-                let request_id = ConnectionRequestId {
-                    connection_id,
-                    request_id,
-                };
-                if session.initialized {
-                    let error = JSONRPCErrorError {
-                        code: INVALID_REQUEST_ERROR_CODE,
-                        message: "Already initialized".to_string(),
-                        data: None,
-                    };
-                    self.outgoing.send_error(request_id, error).await;
-                    return;
-                } else {
-                    // TODO(maxj): Revisit capability scoping for `experimental_api_enabled`.
-                    // Current behavior is per-connection. Reviewer feedback notes this can
-                    // create odd cross-client behavior (for example dynamic tool calls on a
-                    // shared thread when another connected client did not opt into
-                    // experimental API). Proposed direction is instance-global first-write-wins
-                    // with initialize-time mismatch rejection.
-                    let (experimental_api_enabled, opt_out_notification_methods) =
-                        match params.capabilities {
-                            Some(capabilities) => (
-                                capabilities.experimental_api,
-                                capabilities
-                                    .opt_out_notification_methods
-                                    .unwrap_or_default(),
-                            ),
-                            None => (false, Vec::new()),
-                        };
-                    session.experimental_api_enabled = experimental_api_enabled;
-                    session.opted_out_notification_methods =
-                        opt_out_notification_methods.into_iter().collect();
-                    let ClientInfo {
-                        name,
-                        title: _title,
-                        version,
-                    } = params.client_info;
-                    session.app_server_client_name = Some(name.clone());
-                    session.client_version = Some(version.clone());
-                    if let Err(error) = set_default_originator(name.clone()) {
-                        match error {
-                            SetOriginatorError::InvalidHeaderValue => {
-                                let error = JSONRPCErrorError {
-                                    code: INVALID_REQUEST_ERROR_CODE,
-                                    message: format!(
-                                        "Invalid clientInfo.name: '{name}'. Must be a valid HTTP header value."
-                                    ),
-                                    data: None,
-                                };
-                                self.outgoing.send_error(request_id.clone(), error).await;
-                                return;
-                            }
-                            SetOriginatorError::AlreadyInitialized => {
-                                // No-op. This is expected to happen if the originator is already set via env var.
-                                // TODO(owen): Once we remove support for CODEX_INTERNAL_ORIGINATOR_OVERRIDE,
-                                // this will be an unexpected state and we can return a JSON-RPC error indicating
-                                // internal server error.
-                            }
-                        }
-                    }
-                    set_default_client_residency_requirement(self.config.enforce_residency.value());
-                    let user_agent_suffix = format!("{name}; {version}");
-                    if let Ok(mut suffix) = USER_AGENT_SUFFIX.lock() {
-                        *suffix = Some(user_agent_suffix);
-                    }
+            // Websocket callers finalize outbound readiness in lib.rs after mirroring
+            // session state into outbound state and sending initialize notifications to
+            // this specific connection. Passing `None` avoids marking the connection
+            // ready too early from inside the shared request handler.
+            self.handle_client_request(connection_id, request_id, codex_request, session, None)
+                .await;
+        }
+        .instrument(request_span)
+        .await;
+    }
 
-                    let user_agent = get_codex_user_agent();
-                    let response = InitializeResponse { user_agent };
-                    self.outgoing.send_response(request_id, response).await;
-
-                    session.initialized = true;
-                    outbound_initialized.store(true, Ordering::Release);
-                    self.codex_message_processor
-                        .connection_initialized(connection_id)
-                        .await;
-                    return;
-                }
-            }
-            _ => {
-                if !session.initialized {
-                    let error = JSONRPCErrorError {
-                        code: INVALID_REQUEST_ERROR_CODE,
-                        message: "Not initialized".to_string(),
-                        data: None,
-                    };
-                    self.outgoing.send_error(request_id, error).await;
-                    return;
-                }
-            }
-            }
-            if let Some(reason) = codex_request.experimental_reason()
-                && !session.experimental_api_enabled
-            {
-                let error = JSONRPCErrorError {
-                    code: INVALID_REQUEST_ERROR_CODE,
-                    message: experimental_required_message(reason),
-                    data: None,
-                };
-                self.outgoing.send_error(request_id, error).await;
-                return;
-            }
-
-            match codex_request {
-                ClientRequest::ConfigRead { request_id, params } => {
-                    self.handle_config_read(
-                        ConnectionRequestId {
-                            connection_id,
-                            request_id,
-                        },
-                        params,
-                    )
-                    .await;
-                }
-                ClientRequest::ExternalAgentConfigDetect { request_id, params } => {
-                    self.handle_external_agent_config_detect(
-                        ConnectionRequestId {
-                            connection_id,
-                            request_id,
-                        },
-                        params,
-                    )
-                    .await;
-                }
-                ClientRequest::ExternalAgentConfigImport { request_id, params } => {
-                    self.handle_external_agent_config_import(
-                        ConnectionRequestId {
-                            connection_id,
-                            request_id,
-                        },
-                        params,
-                    )
-                    .await;
-                }
-                ClientRequest::ConfigValueWrite { request_id, params } => {
-                    self.handle_config_value_write(
-                        ConnectionRequestId {
-                            connection_id,
-                            request_id,
-                        },
-                        params,
-                    )
-                    .await;
-                }
-                ClientRequest::ConfigBatchWrite { request_id, params } => {
-                    self.handle_config_batch_write(
-                        ConnectionRequestId {
-                            connection_id,
-                            request_id,
-                        },
-                        params,
-                    )
-                    .await;
-                }
-                ClientRequest::ConfigRequirementsRead {
-                    request_id,
-                    params: _,
-                } => {
-                    self.handle_config_requirements_read(ConnectionRequestId {
-                        connection_id,
-                        request_id,
-                    })
-                    .await;
-                }
-                other => {
-                    // Box the delegated future so this wrapper's async state machine does not
-                    // inline the full `CodexMessageProcessor::process_request` future, which
-                    // can otherwise push worker-thread stack usage over the edge.
-                    self.codex_message_processor
-                        .process_request(
-                            connection_id,
-                            other,
-                            session.app_server_client_name.clone(),
-                        )
-                        .boxed()
-                        .await;
-                }
-            }
+    /// Handles a typed request path used by in-process embedders.
+    ///
+    /// This bypasses JSON request deserialization but keeps identical request
+    /// semantics by delegating to `handle_client_request`.
+    pub(crate) async fn process_client_request(
+        &mut self,
+        connection_id: ConnectionId,
+        request: ClientRequest,
+        session: &mut ConnectionSessionState,
+        outbound_initialized: &AtomicBool,
+    ) {
+        let request_span =
+            crate::app_server_tracing::typed_request_span(&request, connection_id, session);
+        async {
+            let request_id = ConnectionRequestId {
+                connection_id,
+                request_id: request.id().clone(),
+            };
+            tracing::trace!(
+                ?connection_id,
+                request_id = ?request_id.request_id,
+                "app-server typed request"
+            );
+            // In-process clients do not have the websocket transport loop that performs
+            // post-initialize bookkeeping, so they still finalize outbound readiness in
+            // the shared request handler.
+            self.handle_client_request(
+                connection_id,
+                request_id,
+                request,
+                session,
+                Some(outbound_initialized),
+            )
+            .await;
         }
         .instrument(request_span)
         .await;
@@ -466,10 +336,37 @@ impl MessageProcessor {
         tracing::info!("<- notification: {:?}", notification);
     }
 
+    /// Handles typed notifications from in-process clients.
+    pub(crate) async fn process_client_notification(&self, notification: ClientNotification) {
+        // Currently, we do not expect to receive any typed notifications from
+        // in-process clients, so we just log them.
+        tracing::info!("<- typed notification: {:?}", notification);
+    }
+
     pub(crate) fn thread_created_receiver(&self) -> broadcast::Receiver<ThreadId> {
         self.codex_message_processor.thread_created_receiver()
     }
 
+    pub(crate) async fn send_initialize_notifications_to_connection(
+        &self,
+        connection_id: ConnectionId,
+    ) {
+        for notification in self.config_warnings.iter().cloned() {
+            self.outgoing
+                .send_server_notification_to_connections(
+                    &[connection_id],
+                    ServerNotification::ConfigWarning(notification),
+                )
+                .await;
+        }
+    }
+
+    pub(crate) async fn connection_initialized(&self, connection_id: ConnectionId) {
+        self.codex_message_processor
+            .connection_initialized(connection_id)
+            .await;
+    }
+
     pub(crate) async fn send_initialize_notifications(&self) {
         for notification in self.config_warnings.iter().cloned() {
             self.outgoing
@@ -512,6 +409,201 @@ impl MessageProcessor {
         self.outgoing.notify_client_error(err.id, err.error).await;
     }
 
+    async fn handle_client_request(
+        &mut self,
+        connection_id: ConnectionId,
+        request_id: ConnectionRequestId,
+        codex_request: ClientRequest,
+        session: &mut ConnectionSessionState,
+        // `Some(...)` means the caller wants initialize to immediately mark the
+        // connection outbound-ready. Websocket JSON-RPC calls pass `None` so
+        // lib.rs can deliver connection-scoped initialize notifications first.
+        outbound_initialized: Option<&AtomicBool>,
+    ) {
+        match codex_request {
+            // Handle Initialize internally so CodexMessageProcessor does not have to concern
+            // itself with the `initialized` bool.
+            ClientRequest::Initialize { request_id, params } => {
+                let request_id = ConnectionRequestId {
+                    connection_id,
+                    request_id,
+                };
+                if session.initialized {
+                    let error = JSONRPCErrorError {
+                        code: INVALID_REQUEST_ERROR_CODE,
+                        message: "Already initialized".to_string(),
+                        data: None,
+                    };
+                    self.outgoing.send_error(request_id, error).await;
+                    return;
+                }
+
+                // TODO(maxj): Revisit capability scoping for `experimental_api_enabled`.
+                // Current behavior is per-connection. Reviewer feedback notes this can
+                // create odd cross-client behavior (for example dynamic tool calls on a
+                // shared thread when another connected client did not opt into
+                // experimental API). Proposed direction is instance-global first-write-wins
+                // with initialize-time mismatch rejection.
+                let (experimental_api_enabled, opt_out_notification_methods) =
+                    match params.capabilities {
+                        Some(capabilities) => (
+                            capabilities.experimental_api,
+                            capabilities
+                                .opt_out_notification_methods
+                                .unwrap_or_default(),
+                        ),
+                        None => (false, Vec::new()),
+                    };
+                session.experimental_api_enabled = experimental_api_enabled;
+                session.opted_out_notification_methods =
+                    opt_out_notification_methods.into_iter().collect();
+                let ClientInfo {
+                    name,
+                    title: _title,
+                    version,
+                } = params.client_info;
+                session.app_server_client_name = Some(name.clone());
+                session.client_version = Some(version.clone());
+                if let Err(error) = set_default_originator(name.clone()) {
+                    match error {
+                        SetOriginatorError::InvalidHeaderValue => {
+                            let error = JSONRPCErrorError {
+                                code: INVALID_REQUEST_ERROR_CODE,
+                                message: format!(
+                                    "Invalid clientInfo.name: '{name}'. Must be a valid HTTP header value."
+                                ),
+                                data: None,
+                            };
+                            self.outgoing.send_error(request_id.clone(), error).await;
+                            return;
+                        }
+                        SetOriginatorError::AlreadyInitialized => {
+                            // No-op. This is expected to happen if the originator is already set via env var.
+                            // TODO(owen): Once we remove support for CODEX_INTERNAL_ORIGINATOR_OVERRIDE,
+                            // this will be an unexpected state and we can return a JSON-RPC error indicating
+                            // internal server error.
+                        }
+                    }
+                }
+                set_default_client_residency_requirement(self.config.enforce_residency.value());
+                let user_agent_suffix = format!("{name}; {version}");
+                if let Ok(mut suffix) = USER_AGENT_SUFFIX.lock() {
+                    *suffix = Some(user_agent_suffix);
+                }
+
+                let user_agent = get_codex_user_agent();
+                let response = InitializeResponse { user_agent };
+                self.outgoing.send_response(request_id, response).await;
+
+                session.initialized = true;
+                if let Some(outbound_initialized) = outbound_initialized {
+                    // In-process clients can complete readiness immediately here. The
+                    // websocket path defers this until lib.rs finishes transport-layer
+                    // initialize handling for the specific connection.
+                    outbound_initialized.store(true, Ordering::Release);
+                    self.codex_message_processor
+                        .connection_initialized(connection_id)
+                        .await;
+                }
+                return;
+            }
+            _ => {
+                if !session.initialized {
+                    let error = JSONRPCErrorError {
+                        code: INVALID_REQUEST_ERROR_CODE,
+                        message: "Not initialized".to_string(),
+                        data: None,
+                    };
+                    self.outgoing.send_error(request_id, error).await;
+                    return;
+                }
+            }
+        }
+        if let Some(reason) = codex_request.experimental_reason()
+            && !session.experimental_api_enabled
+        {
+            let error = JSONRPCErrorError {
+                code: INVALID_REQUEST_ERROR_CODE,
+                message: experimental_required_message(reason),
+                data: None,
+            };
+            self.outgoing.send_error(request_id, error).await;
+            return;
+        }
+
+        match codex_request {
+            ClientRequest::ConfigRead { request_id, params } => {
+                self.handle_config_read(
+                    ConnectionRequestId {
+                        connection_id,
+                        request_id,
+                    },
+                    params,
+                )
+                .await;
+            }
+            ClientRequest::ExternalAgentConfigDetect { request_id, params } => {
+                self.handle_external_agent_config_detect(
+                    ConnectionRequestId {
+                        connection_id,
+                        request_id,
+                    },
+                    params,
+                )
+                .await;
+            }
+            ClientRequest::ExternalAgentConfigImport { request_id, params } => {
+                self.handle_external_agent_config_import(
+                    ConnectionRequestId {
+                        connection_id,
+                        request_id,
+                    },
+                    params,
+                )
+                .await;
+            }
+            ClientRequest::ConfigValueWrite { request_id, params } => {
+                self.handle_config_value_write(
+                    ConnectionRequestId {
+                        connection_id,
+                        request_id,
+                    },
+                    params,
+                )
+                .await;
+            }
+            ClientRequest::ConfigBatchWrite { request_id, params } => {
+                self.handle_config_batch_write(
+                    ConnectionRequestId {
+                        connection_id,
+                        request_id,
+                    },
+                    params,
+                )
+                .await;
+            }
+            ClientRequest::ConfigRequirementsRead {
+                request_id,
+                params: _,
+            } => {
+                self.handle_config_requirements_read(ConnectionRequestId {
+                    connection_id,
+                    request_id,
+                })
+                .await;
+            }
+            other => {
+                // Box the delegated future so this wrapper's async state machine does not
+                // inline the full `CodexMessageProcessor::process_request` future, which
+                // can otherwise push worker-thread stack usage over the edge.
+                self.codex_message_processor
+                    .process_request(connection_id, other, session.app_server_client_name.clone())
+                    .boxed()
+                    .await;
+            }
+        }
+    }
+
     async fn handle_config_read(&self, request_id: ConnectionRequestId, params: ConfigReadParams) {
         match self.config_api.read(params).await {
             Ok(response) => self.outgoing.send_response(request_id, response).await,

codex-rs/app-server/src/outgoing_message.rs

@@ -273,6 +273,25 @@ impl OutgoingMessageSender {
         self.take_request_callback(id).await.is_some()
     }
 
+    pub(crate) async fn cancel_all_requests(&self, error: Option<JSONRPCErrorError>) {
+        let entries = {
+            let mut request_id_to_callback = self.request_id_to_callback.lock().await;
+            request_id_to_callback
+                .drain()
+                .map(|(_, entry)| entry)
+                .collect::<Vec<_>>()
+        };
+
+        if let Some(error) = error {
+            for entry in entries {
+                if let Err(err) = entry.callback.send(Err(error.clone())) {
+                    let request_id = entry.request.id();
+                    warn!("could not notify callback for {request_id:?} due to: {err:?}");
+                }
+            }
+        }
+    }
+
     async fn take_request_callback(
         &self,
         id: &RequestId,

codex-rs/app-server/src/transport.rs

@@ -4,6 +4,16 @@ use crate::outgoing_message::ConnectionId;
 use crate::outgoing_message::OutgoingEnvelope;
 use crate::outgoing_message::OutgoingError;
 use crate::outgoing_message::OutgoingMessage;
+use axum::Router;
+use axum::extract::ConnectInfo;
+use axum::extract::State;
+use axum::extract::ws::Message as WebSocketMessage;
+use axum::extract::ws::WebSocket;
+use axum::extract::ws::WebSocketUpgrade;
+use axum::http::StatusCode;
+use axum::response::IntoResponse;
+use axum::routing::any;
+use axum::routing::get;
 use codex_app_server_protocol::JSONRPCErrorError;
 use codex_app_server_protocol::JSONRPCMessage;
 use codex_app_server_protocol::ServerRequest;
@@ -28,12 +38,8 @@ use tokio::io::AsyncWriteExt;
 use tokio::io::BufReader;
 use tokio::io::{self};
 use tokio::net::TcpListener;
-use tokio::net::TcpStream;
 use tokio::sync::mpsc;
 use tokio::task::JoinHandle;
-use tokio_tungstenite::accept_async_with_config;
-use tokio_tungstenite::tungstenite::Message as WebSocketMessage;
-use tokio_tungstenite::tungstenite::protocol::WebSocketConfig;
 use tokio_util::sync::CancellationToken;
 use tracing::debug;
 use tracing::error;
@@ -55,9 +61,15 @@ fn print_websocket_startup_banner(addr: SocketAddr) {
     let title = colorize("codex app-server (WebSockets)", Style::new().bold().cyan());
     let listening_label = colorize("listening on:", Style::new().dimmed());
     let listen_url = colorize(&format!("ws://{addr}"), Style::new().green());
+    let ready_label = colorize("readyz:", Style::new().dimmed());
+    let ready_url = colorize(&format!("http://{addr}/readyz"), Style::new().green());
+    let health_label = colorize("healthz:", Style::new().dimmed());
+    let health_url = colorize(&format!("http://{addr}/healthz"), Style::new().green());
     let note_label = colorize("note:", Style::new().dimmed());
     eprintln!("{title}");
     eprintln!("  {listening_label} {listen_url}");
+    eprintln!("  {ready_label} {ready_url}");
+    eprintln!("  {health_label} {health_url}");
     if addr.ip().is_loopback() {
         eprintln!(
             "  {note_label} binds localhost only (use SSH port-forwarding for remote access)"
@@ -69,6 +81,28 @@ fn print_websocket_startup_banner(addr: SocketAddr) {
     }
 }
 
+#[derive(Clone)]
+struct WebSocketListenerState {
+    transport_event_tx: mpsc::Sender<TransportEvent>,
+    connection_counter: Arc<AtomicU64>,
+}
+
+async fn health_check_handler() -> StatusCode {
+    StatusCode::OK
+}
+
+async fn websocket_upgrade_handler(
+    websocket: WebSocketUpgrade,
+    ConnectInfo(peer_addr): ConnectInfo<SocketAddr>,
+    State(state): State<WebSocketListenerState>,
+) -> impl IntoResponse {
+    let connection_id = ConnectionId(state.connection_counter.fetch_add(1, Ordering::Relaxed));
+    info!(%peer_addr, "websocket client connected");
+    websocket.on_upgrade(move |stream| async move {
+        run_websocket_connection(connection_id, stream, state.transport_event_tx).await;
+    })
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum AppServerTransport {
     Stdio,
@@ -279,54 +313,34 @@ pub(crate) async fn start_websocket_acceptor(
     print_websocket_startup_banner(local_addr);
     info!("app-server websocket listening on ws://{local_addr}");
 
-    let connection_counter = Arc::new(AtomicU64::new(1));
+    let router = Router::new()
+        .route("/readyz", get(health_check_handler))
+        .route("/healthz", get(health_check_handler))
+        .fallback(any(websocket_upgrade_handler))
+        .with_state(WebSocketListenerState {
+            transport_event_tx,
+            connection_counter: Arc::new(AtomicU64::new(1)),
+        });
+    let server = axum::serve(
+        listener,
+        router.into_make_service_with_connect_info::<SocketAddr>(),
+    )
+    .with_graceful_shutdown(async move {
+        shutdown_token.cancelled().await;
+    });
     Ok(tokio::spawn(async move {
-        loop {
-            tokio::select! {
-                _ = shutdown_token.cancelled() => {
-                    info!("websocket acceptor shutting down");
-                    break;
-                }
-                accept_result = listener.accept() => {
-                    match accept_result {
-                        Ok((stream, peer_addr)) => {
-                            info!(%peer_addr, "websocket client connected");
-                            let connection_id =
-                                ConnectionId(connection_counter.fetch_add(1, Ordering::Relaxed));
-                            let transport_event_tx_for_connection = transport_event_tx.clone();
-                            tokio::spawn(async move {
-                                run_websocket_connection(
-                                    connection_id,
-                                    stream,
-                                    transport_event_tx_for_connection,
-                                )
-                                .await;
-                            });
-                        }
-                        Err(err) => {
-                            error!("failed to accept websocket connection: {err}");
-                        }
-                    }
-                }
-            }
+        if let Err(err) = server.await {
+            error!("websocket acceptor failed: {err}");
         }
+        info!("websocket acceptor shutting down");
     }))
 }
 
 async fn run_websocket_connection(
     connection_id: ConnectionId,
-    stream: TcpStream,
+    websocket_stream: WebSocket,
     transport_event_tx: mpsc::Sender<TransportEvent>,
 ) {
-    let websocket_stream =
-        match accept_async_with_config(stream, Some(WebSocketConfig::default())).await {
-            Ok(stream) => stream,
-            Err(err) => {
-                warn!("failed to complete websocket handshake: {err}");
-                return;
-            }
-        };
-
     let (writer_tx, writer_rx) = mpsc::channel::<OutgoingMessage>(CHANNEL_CAPACITY);
     let writer_tx_for_reader = writer_tx.clone();
     let disconnect_token = CancellationToken::new();
@@ -377,10 +391,7 @@ async fn run_websocket_connection(
 }
 
 async fn run_websocket_outbound_loop(
-    mut websocket_writer: futures::stream::SplitSink<
-        tokio_tungstenite::WebSocketStream<TcpStream>,
-        WebSocketMessage,
-    >,
+    mut websocket_writer: futures::stream::SplitSink<WebSocket, WebSocketMessage>,
     mut writer_rx: mpsc::Receiver<OutgoingMessage>,
     mut writer_control_rx: mpsc::Receiver<WebSocketMessage>,
     disconnect_token: CancellationToken,
@@ -414,9 +425,7 @@ async fn run_websocket_outbound_loop(
 }
 
 async fn run_websocket_inbound_loop(
-    mut websocket_reader: futures::stream::SplitStream<
-        tokio_tungstenite::WebSocketStream<TcpStream>,
-    >,
+    mut websocket_reader: futures::stream::SplitStream<WebSocket>,
     transport_event_tx: mpsc::Sender<TransportEvent>,
     writer_tx_for_reader: mpsc::Sender<OutgoingMessage>,
     writer_control_tx: mpsc::Sender<WebSocketMessage>,
@@ -435,7 +444,7 @@ async fn run_websocket_inbound_loop(
                             &transport_event_tx,
                             &writer_tx_for_reader,
                             connection_id,
-                            &text,
+                            text.as_ref(),
                         )
                         .await
                         {
@@ -457,7 +466,6 @@ async fn run_websocket_inbound_loop(
                     Some(Ok(WebSocketMessage::Binary(_))) => {
                         warn!("dropping unsupported binary websocket message");
                     }
-                    Some(Ok(WebSocketMessage::Frame(_))) => {}
                     Some(Err(err)) => {
                         warn!("websocket receive error: {err}");
                         break;
@@ -671,6 +679,7 @@ pub(crate) async fn route_outgoing_envelope(
 mod tests {
     use super::*;
     use crate::error_code::OVERLOADED_ERROR_CODE;
+    use codex_app_server_protocol::CommandExecutionRequestApprovalSkillMetadata;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use pretty_assertions::assert_eq;
     use serde_json::json;
@@ -991,6 +1000,9 @@ mod tests {
                                 macos: None,
                             },
                         ),
+                        skill_metadata: Some(CommandExecutionRequestApprovalSkillMetadata {
+                            path_to_skills_md: PathBuf::from("/tmp/SKILLS.md"),
+                        }),
                         proposed_execpolicy_amendment: None,
                         proposed_network_policy_amendments: None,
                         available_decisions: None,
@@ -1006,6 +1018,7 @@ mod tests {
             .expect("request should be delivered to the connection");
         let json = serde_json::to_value(message).expect("request should serialize");
         assert_eq!(json["params"].get("additionalPermissions"), None);
+        assert_eq!(json["params"].get("skillMetadata"), None);
     }
 
     #[tokio::test]
@@ -1053,6 +1066,9 @@ mod tests {
                                 macos: None,
                             },
                         ),
+                        skill_metadata: Some(CommandExecutionRequestApprovalSkillMetadata {
+                            path_to_skills_md: PathBuf::from("/tmp/SKILLS.md"),
+                        }),
                         proposed_execpolicy_amendment: None,
                         proposed_network_policy_amendments: None,
                         available_decisions: None,
@@ -1079,6 +1095,12 @@ mod tests {
                 "macos": null,
             })
         );
+        assert_eq!(
+            json["params"]["skillMetadata"],
+            json!({
+                "pathToSkillsMd": "/tmp/SKILLS.md",
+            })
+        );
     }
 
     #[tokio::test]

codex-rs/app-server/tests/common/lib.rs

@@ -29,6 +29,7 @@ pub use models_cache::write_models_cache_with_models;
 pub use responses::create_apply_patch_sse_response;
 pub use responses::create_exec_command_sse_response;
 pub use responses::create_final_assistant_message_sse_response;
+pub use responses::create_request_permissions_sse_response;
 pub use responses::create_request_user_input_sse_response;
 pub use responses::create_shell_command_sse_response;
 pub use rollout::create_fake_rollout;

codex-rs/app-server/tests/common/mcp_process.rs

@@ -41,6 +41,7 @@ use codex_app_server_protocol::MockExperimentalMethodParams;
 use codex_app_server_protocol::ModelListParams;
 use codex_app_server_protocol::PluginInstallParams;
 use codex_app_server_protocol::PluginListParams;
+use codex_app_server_protocol::PluginUninstallParams;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::ReviewStartParams;
 use codex_app_server_protocol::ServerRequest;
@@ -454,6 +455,15 @@ impl McpProcess {
         self.send_request("plugin/install", params).await
     }
 
+    /// Send a `plugin/uninstall` JSON-RPC request.
+    pub async fn send_plugin_uninstall_request(
+        &mut self,
+        params: PluginUninstallParams,
+    ) -> anyhow::Result<i64> {
+        let params = Some(serde_json::to_value(params)?);
+        self.send_request("plugin/uninstall", params).await
+    }
+
     /// Send a `plugin/list` JSON-RPC request.
     pub async fn send_plugin_list_request(
         &mut self,

codex-rs/app-server/tests/common/responses.rs

@@ -83,3 +83,23 @@ pub fn create_request_user_input_sse_response(call_id: &str) -> anyhow::Result<S
         responses::ev_completed("resp-1"),
     ]))
 }
+
+pub fn create_request_permissions_sse_response(call_id: &str) -> anyhow::Result<String> {
+    let tool_call_arguments = serde_json::to_string(&json!({
+        "reason": "Select a workspace root",
+        "permissions": {
+            "file_system": {
+                "write": [
+                    ".",
+                    "../shared"
+                ]
+            }
+        }
+    }))?;
+
+    Ok(responses::sse(vec![
+        responses::ev_response_created("resp-1"),
+        responses::ev_function_call(call_id, "request_permissions", &tool_call_arguments),
+        responses::ev_completed("resp-1"),
+    ]))
+}

codex-rs/app-server/tests/suite/auth.rs

@@ -33,6 +33,9 @@ sandbox_mode = "danger-full-access"
 
 model_provider = "mock_provider"
 
+[features]
+shell_snapshot = false
+
 [model_providers.mock_provider]
 name = "Mock provider for test"
 base_url = "http://127.0.0.1:0/v1"
@@ -53,6 +56,9 @@ fn create_config_toml(codex_home: &Path) -> std::io::Result<()> {
 model = "mock-model"
 approval_policy = "never"
 sandbox_mode = "danger-full-access"
+
+[features]
+shell_snapshot = false
 "#,
     )
 }
@@ -65,6 +71,9 @@ model = "mock-model"
 approval_policy = "never"
 sandbox_mode = "danger-full-access"
 forced_login_method = "{forced_method}"
+
+[features]
+shell_snapshot = false
 "#
     );
     std::fs::write(config_toml, contents)

codex-rs/app-server/tests/suite/fuzzy_file_search.rs

@@ -7,6 +7,7 @@ use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::RequestId;
 use pretty_assertions::assert_eq;
 use serde_json::json;
+use std::path::Path;
 use tempfile::TempDir;
 use tokio::time::timeout;
 
@@ -23,7 +24,23 @@ enum FileExpectation {
     NonEmpty,
 }
 
+fn create_config_toml(codex_home: &Path) -> std::io::Result<()> {
+    let config_toml = codex_home.join("config.toml");
+    std::fs::write(
+        config_toml,
+        r#"
+model = "mock-model"
+approval_policy = "never"
+sandbox_mode = "danger-full-access"
+
+[features]
+shell_snapshot = false
+"#,
+    )
+}
+
 async fn initialized_mcp(codex_home: &TempDir) -> Result<McpProcess> {
+    create_config_toml(codex_home.path())?;
     let mut mcp = McpProcess::new(codex_home.path()).await?;
     timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
     Ok(mcp)
@@ -164,6 +181,7 @@ async fn assert_no_session_updates_for(
 async fn test_fuzzy_file_search_sorts_and_includes_indices() -> Result<()> {
     // Prepare a temporary Codex home and a separate root with test files.
     let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path())?;
     let root = TempDir::new()?;
 
     // Create files designed to have deterministic ordering for query "abe".
@@ -235,6 +253,7 @@ async fn test_fuzzy_file_search_sorts_and_includes_indices() -> Result<()> {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_fuzzy_file_search_accepts_cancellation_token() -> Result<()> {
     let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path())?;
     let root = TempDir::new()?;
 
     std::fs::write(root.path().join("alpha.txt"), "contents")?;
@@ -434,7 +453,7 @@ async fn test_fuzzy_file_search_session_update_after_stop_fails() -> Result<()>
 async fn test_fuzzy_file_search_session_stops_sending_updates_after_stop() -> Result<()> {
     let codex_home = TempDir::new()?;
     let root = TempDir::new()?;
-    for i in 0..2_000 {
+    for i in 0..512 {
         let file_path = root.path().join(format!("file-{i:04}.txt"));
         std::fs::write(file_path, "contents")?;
     }

codex-rs/app-server/tests/suite/v2/account.rs

@@ -83,6 +83,9 @@ sandbox_mode = "danger-full-access"
 
 model_provider = "mock_provider"
 
+[features]
+shell_snapshot = false
+
 [model_providers.mock_provider]
 name = "Mock provider for test"
 base_url = "{base_url}"

codex-rs/app-server/tests/suite/v2/app_list.rs

@@ -501,16 +501,6 @@ async fn list_apps_waits_for_accessible_data_before_emitting_directory_updates()
         })
         .await?;
 
-    let maybe_update = timeout(
-        Duration::from_millis(150),
-        read_app_list_updated_notification(&mut mcp),
-    )
-    .await;
-    assert!(
-        maybe_update.is_err(),
-        "unexpected directory-only app/list update before accessible apps loaded"
-    );
-
     let expected = vec![
         AppInfo {
             id: "beta".to_string(),
@@ -544,8 +534,17 @@ async fn list_apps_waits_for_accessible_data_before_emitting_directory_updates()
         },
     ];
 
-    let update = read_app_list_updated_notification(&mut mcp).await?;
-    assert_eq!(update.data, expected);
+    loop {
+        let update = read_app_list_updated_notification(&mut mcp).await?;
+        if update.data == expected {
+            break;
+        }
+
+        assert!(
+            !update.data.is_empty() && update.data.iter().all(|connector| connector.is_accessible),
+            "unexpected directory-only app/list update before accessible apps loaded"
+        );
+    }
 
     let response: JSONRPCResponse = timeout(
         DEFAULT_TIMEOUT,

codex-rs/app-server/tests/suite/v2/config_rpc.rs

@@ -605,6 +605,7 @@ async fn config_batch_write_applies_multiple_edits() -> Result<()> {
                 },
             ],
             expected_version: None,
+            reload_user_config: false,
         })
         .await?;
     let batch_resp: JSONRPCResponse = timeout(

codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs

@@ -12,6 +12,7 @@ use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::RequestId;
 use futures::SinkExt;
 use futures::StreamExt;
+use reqwest::StatusCode;
 use serde_json::json;
 use std::net::SocketAddr;
 use std::path::Path;
@@ -79,6 +80,34 @@ async fn websocket_transport_routes_per_connection_handshake_and_responses() ->
     Ok(())
 }
 
+#[tokio::test]
+async fn websocket_transport_serves_health_endpoints_on_same_listener() -> Result<()> {
+    let server = create_mock_responses_server_sequence_unchecked(Vec::new()).await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri(), "never")?;
+
+    let bind_addr = reserve_local_addr()?;
+    let mut process = spawn_websocket_server(codex_home.path(), bind_addr).await?;
+    let client = reqwest::Client::new();
+
+    let readyz = http_get(&client, bind_addr, "/readyz").await?;
+    assert_eq!(readyz.status(), StatusCode::OK);
+
+    let healthz = http_get(&client, bind_addr, "/healthz").await?;
+    assert_eq!(healthz.status(), StatusCode::OK);
+
+    let mut ws = connect_websocket(bind_addr).await?;
+    send_initialize_request(&mut ws, 1, "ws_health_client").await?;
+    let init = read_response_for_id(&mut ws, 1).await?;
+    assert_eq!(init.id, RequestId::Integer(1));
+
+    process
+        .kill()
+        .await
+        .context("failed to stop websocket app-server process")?;
+    Ok(())
+}
+
 pub(super) async fn spawn_websocket_server(
     codex_home: &Path,
     bind_addr: SocketAddr,
@@ -133,6 +162,30 @@ pub(super) async fn connect_websocket(bind_addr: SocketAddr) -> Result<WsClient>
     }
 }
 
+async fn http_get(
+    client: &reqwest::Client,
+    bind_addr: SocketAddr,
+    path: &str,
+) -> Result<reqwest::Response> {
+    let deadline = Instant::now() + Duration::from_secs(10);
+    loop {
+        match client
+            .get(format!("http://{bind_addr}{path}"))
+            .send()
+            .await
+            .with_context(|| format!("failed to GET http://{bind_addr}{path}"))
+        {
+            Ok(response) => return Ok(response),
+            Err(err) => {
+                if Instant::now() >= deadline {
+                    bail!("failed to GET http://{bind_addr}{path}: {err}");
+                }
+                sleep(Duration::from_millis(50)).await;
+            }
+        }
+    }
+}
+
 pub(super) async fn send_initialize_request(
     stream: &mut WsClient,
     id: i64,

codex-rs/app-server/tests/suite/v2/mod.rs

@@ -19,8 +19,10 @@ mod output_schema;
 mod plan_item;
 mod plugin_install;
 mod plugin_list;
+mod plugin_uninstall;
 mod rate_limits;
 mod realtime_conversation;
+mod request_permissions;
 mod request_user_input;
 mod review;
 mod safety_check_downgrade;

codex-rs/app-server/tests/suite/v2/plan_item.rs

@@ -1,7 +1,8 @@
 use anyhow::Result;
 use anyhow::anyhow;
+use anyhow::bail;
 use app_test_support::McpProcess;
-use app_test_support::create_mock_responses_server_sequence;
+use app_test_support::create_mock_responses_server_sequence_unchecked;
 use app_test_support::to_response;
 use codex_app_server_protocol::ItemCompletedNotification;
 use codex_app_server_protocol::ItemStartedNotification;
@@ -28,11 +29,13 @@ use pretty_assertions::assert_eq;
 use std::collections::BTreeMap;
 use std::path::Path;
 use tempfile::TempDir;
+use tokio::time::sleep;
 use tokio::time::timeout;
+use wiremock::MockServer;
 
 const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
 
-#[tokio::test]
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn plan_mode_uses_proposed_plan_block_for_plan_item() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
@@ -45,7 +48,7 @@ async fn plan_mode_uses_proposed_plan_block_for_plan_item() -> Result<()> {
         responses::ev_assistant_message("msg-1", &full_message),
         responses::ev_completed("resp-1"),
     ])];
-    let server = create_mock_responses_server_sequence(responses).await;
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
 
     let codex_home = TempDir::new()?;
     create_config_toml(codex_home.path(), &server.uri())?;
@@ -56,6 +59,7 @@ async fn plan_mode_uses_proposed_plan_block_for_plan_item() -> Result<()> {
     let turn = start_plan_mode_turn(&mut mcp).await?;
     let (_, completed_items, plan_deltas, turn_completed) =
         collect_turn_notifications(&mut mcp).await?;
+    wait_for_responses_request_count(&server, 1).await?;
 
     assert_eq!(turn_completed.turn.id, turn.id);
     assert_eq!(turn_completed.turn.status, TurnStatus::Completed);
@@ -93,7 +97,7 @@ async fn plan_mode_uses_proposed_plan_block_for_plan_item() -> Result<()> {
     Ok(())
 }
 
-#[tokio::test]
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn plan_mode_without_proposed_plan_does_not_emit_plan_item() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
@@ -102,7 +106,7 @@ async fn plan_mode_without_proposed_plan_does_not_emit_plan_item() -> Result<()>
         responses::ev_assistant_message("msg-1", "Done"),
         responses::ev_completed("resp-1"),
     ])];
-    let server = create_mock_responses_server_sequence(responses).await;
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
 
     let codex_home = TempDir::new()?;
     create_config_toml(codex_home.path(), &server.uri())?;
@@ -112,6 +116,7 @@ async fn plan_mode_without_proposed_plan_does_not_emit_plan_item() -> Result<()>
 
     let _turn = start_plan_mode_turn(&mut mcp).await?;
     let (_, completed_items, plan_deltas, _) = collect_turn_notifications(&mut mcp).await?;
+    wait_for_responses_request_count(&server, 1).await?;
 
     let has_plan_item = completed_items
         .iter()
@@ -214,6 +219,36 @@ async fn collect_turn_notifications(
     }
 }
 
+async fn wait_for_responses_request_count(
+    server: &MockServer,
+    expected_count: usize,
+) -> Result<()> {
+    timeout(DEFAULT_READ_TIMEOUT, async {
+        loop {
+            let Some(requests) = server.received_requests().await else {
+                bail!("wiremock did not record requests");
+            };
+            let responses_request_count = requests
+                .iter()
+                .filter(|request| {
+                    request.method == "POST" && request.url.path().ends_with("/responses")
+                })
+                .count();
+            if responses_request_count == expected_count {
+                return Ok::<(), anyhow::Error>(());
+            }
+            if responses_request_count > expected_count {
+                bail!(
+                    "expected exactly {expected_count} /responses requests, got {responses_request_count}"
+                );
+            }
+            sleep(std::time::Duration::from_millis(10)).await;
+        }
+    })
+    .await??;
+    Ok(())
+}
+
 fn create_config_toml(codex_home: &Path, server_uri: &str) -> std::io::Result<()> {
     let features = BTreeMap::from([(Feature::CollaborationModes, true)]);
     let feature_entries = features

codex-rs/app-server/tests/suite/v2/plugin_uninstall.rs

@@ -0,0 +1,84 @@
+use std::time::Duration;
+
+use anyhow::Result;
+use app_test_support::McpProcess;
+use app_test_support::to_response;
+use codex_app_server_protocol::JSONRPCResponse;
+use codex_app_server_protocol::PluginUninstallParams;
+use codex_app_server_protocol::PluginUninstallResponse;
+use codex_app_server_protocol::RequestId;
+use pretty_assertions::assert_eq;
+use tempfile::TempDir;
+use tokio::time::timeout;
+
+const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);
+
+#[tokio::test]
+async fn plugin_uninstall_removes_plugin_cache_and_config_entry() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    write_installed_plugin(&codex_home, "debug", "sample-plugin")?;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        r#"[features]
+plugins = true
+
+[plugins."sample-plugin@debug"]
+enabled = true
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let params = PluginUninstallParams {
+        plugin_id: "sample-plugin@debug".to_string(),
+    };
+
+    let request_id = mcp.send_plugin_uninstall_request(params.clone()).await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let response: PluginUninstallResponse = to_response(response)?;
+    assert_eq!(response, PluginUninstallResponse {});
+
+    assert!(
+        !codex_home
+            .path()
+            .join("plugins/cache/debug/sample-plugin")
+            .exists()
+    );
+    let config = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+    assert!(!config.contains(r#"[plugins."sample-plugin@debug"]"#));
+
+    let request_id = mcp.send_plugin_uninstall_request(params).await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let response: PluginUninstallResponse = to_response(response)?;
+    assert_eq!(response, PluginUninstallResponse {});
+
+    Ok(())
+}
+
+fn write_installed_plugin(
+    codex_home: &TempDir,
+    marketplace_name: &str,
+    plugin_name: &str,
+) -> Result<()> {
+    let plugin_root = codex_home
+        .path()
+        .join("plugins/cache")
+        .join(marketplace_name)
+        .join(plugin_name)
+        .join("local/.codex-plugin");
+    std::fs::create_dir_all(&plugin_root)?;
+    std::fs::write(
+        plugin_root.join("plugin.json"),
+        format!(r#"{{"name":"{plugin_name}"}}"#),
+    )?;
+    Ok(())
+}

codex-rs/app-server/tests/suite/v2/request_permissions.rs

@@ -0,0 +1,157 @@
+use anyhow::Result;
+use app_test_support::McpProcess;
+use app_test_support::create_final_assistant_message_sse_response;
+use app_test_support::create_mock_responses_server_sequence;
+use app_test_support::create_request_permissions_sse_response;
+use app_test_support::to_response;
+use codex_app_server_protocol::JSONRPCMessage;
+use codex_app_server_protocol::JSONRPCResponse;
+use codex_app_server_protocol::PermissionGrantScope;
+use codex_app_server_protocol::PermissionsRequestApprovalResponse;
+use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::ServerRequest;
+use codex_app_server_protocol::ServerRequestResolvedNotification;
+use codex_app_server_protocol::ThreadStartParams;
+use codex_app_server_protocol::ThreadStartResponse;
+use codex_app_server_protocol::TurnStartParams;
+use codex_app_server_protocol::TurnStartResponse;
+use codex_app_server_protocol::UserInput as V2UserInput;
+use tokio::time::timeout;
+
+const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn request_permissions_round_trip() -> Result<()> {
+    let codex_home = tempfile::TempDir::new()?;
+    let responses = vec![
+        create_request_permissions_sse_response("call1")?,
+        create_final_assistant_message_sse_response("done")?,
+    ];
+    let server = create_mock_responses_server_sequence(responses).await;
+    create_config_toml(codex_home.path(), &server.uri())?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_start_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("mock-model".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let thread_start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(thread_start_id)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response(thread_start_resp)?;
+
+    let turn_start_id = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![V2UserInput::Text {
+                text: "pick a directory".to_string(),
+                text_elements: Vec::new(),
+            }],
+            model: Some("mock-model".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let turn_start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_start_id)),
+    )
+    .await??;
+    let TurnStartResponse { turn, .. } = to_response(turn_start_resp)?;
+
+    let server_req = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_request_message(),
+    )
+    .await??;
+    let ServerRequest::PermissionsRequestApproval { request_id, params } = server_req else {
+        panic!("expected PermissionsRequestApproval request, got: {server_req:?}");
+    };
+
+    assert_eq!(params.thread_id, thread.id);
+    assert_eq!(params.turn_id, turn.id);
+    assert_eq!(params.item_id, "call1");
+    assert_eq!(params.reason, Some("Select a workspace root".to_string()));
+    let requested_writes = params
+        .permissions
+        .file_system
+        .and_then(|file_system| file_system.write)
+        .expect("request should include write permissions");
+    assert_eq!(requested_writes.len(), 2);
+    let resolved_request_id = request_id.clone();
+
+    mcp.send_response(
+        request_id,
+        serde_json::to_value(PermissionsRequestApprovalResponse {
+            permissions: codex_app_server_protocol::GrantedPermissionProfile {
+                network: None,
+                file_system: Some(codex_app_server_protocol::AdditionalFileSystemPermissions {
+                    read: None,
+                    write: Some(vec![requested_writes[0].clone()]),
+                }),
+                macos: None,
+            },
+            scope: PermissionGrantScope::Turn,
+        })?,
+    )
+    .await?;
+
+    let mut saw_resolved = false;
+    loop {
+        let message = timeout(DEFAULT_READ_TIMEOUT, mcp.read_next_message()).await??;
+        let JSONRPCMessage::Notification(notification) = message else {
+            continue;
+        };
+        match notification.method.as_str() {
+            "serverRequest/resolved" => {
+                let resolved: ServerRequestResolvedNotification = serde_json::from_value(
+                    notification
+                        .params
+                        .clone()
+                        .expect("serverRequest/resolved params"),
+                )?;
+                assert_eq!(resolved.thread_id, thread.id);
+                assert_eq!(resolved.request_id, resolved_request_id);
+                saw_resolved = true;
+            }
+            "turn/completed" => {
+                assert!(saw_resolved, "serverRequest/resolved should arrive first");
+                break;
+            }
+            _ => {}
+        }
+    }
+
+    Ok(())
+}
+
+fn create_config_toml(codex_home: &std::path::Path, server_uri: &str) -> std::io::Result<()> {
+    let config_toml = codex_home.join("config.toml");
+    std::fs::write(
+        config_toml,
+        format!(
+            r#"
+model = "mock-model"
+approval_policy = "untrusted"
+sandbox_mode = "read-only"
+
+model_provider = "mock_provider"
+
+[model_providers.mock_provider]
+name = "Mock provider for test"
+base_url = "{server_uri}/v1"
+wire_api = "responses"
+request_max_retries = 0
+stream_max_retries = 0
+
+[features]
+request_permissions_tool = true
+"#
+        ),
+    )
+}

codex-rs/app-server/tests/suite/v2/thread_resume.rs

@@ -4,7 +4,7 @@ use app_test_support::create_apply_patch_sse_response;
 use app_test_support::create_fake_rollout_with_text_elements;
 use app_test_support::create_final_assistant_message_sse_response;
 use app_test_support::create_mock_responses_server_repeating_assistant;
-use app_test_support::create_mock_responses_server_sequence;
+use app_test_support::create_mock_responses_server_sequence_unchecked;
 use app_test_support::create_shell_command_sse_response;
 use app_test_support::rollout_path;
 use app_test_support::to_response;
@@ -59,6 +59,36 @@ use uuid::Uuid;
 const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
 const CODEX_5_2_INSTRUCTIONS_TEMPLATE_DEFAULT: &str = "You are Codex, a coding agent based on GPT-5. You and the user share the same workspace and collaborate to achieve the user's goals.";
 
+async fn wait_for_responses_request_count(
+    server: &wiremock::MockServer,
+    expected_count: usize,
+) -> Result<()> {
+    timeout(DEFAULT_READ_TIMEOUT, async {
+        loop {
+            let Some(requests) = server.received_requests().await else {
+                anyhow::bail!("wiremock did not record requests");
+            };
+            let responses_request_count = requests
+                .iter()
+                .filter(|request| {
+                    request.method == "POST" && request.url.path().ends_with("/responses")
+                })
+                .count();
+            if responses_request_count == expected_count {
+                return Ok::<(), anyhow::Error>(());
+            }
+            if responses_request_count > expected_count {
+                anyhow::bail!(
+                    "expected exactly {expected_count} /responses requests, got {responses_request_count}"
+                );
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+    })
+    .await??;
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_resume_rejects_unmaterialized_thread() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
@@ -866,7 +896,7 @@ async fn thread_resume_replays_pending_command_execution_request_approval() -> R
         )?,
         create_final_assistant_message_sse_response("done")?,
     ];
-    let server = create_mock_responses_server_sequence(responses).await;
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
     let codex_home = TempDir::new()?;
     create_config_toml(codex_home.path(), &server.uri())?;
 
@@ -981,6 +1011,7 @@ async fn thread_resume_replays_pending_command_execution_request_approval() -> R
         primary.read_stream_until_notification_message("turn/completed"),
     )
     .await??;
+    wait_for_responses_request_count(&server, 3).await?;
 
     Ok(())
 }
@@ -1003,7 +1034,7 @@ async fn thread_resume_replays_pending_file_change_request_approval() -> Result<
         create_apply_patch_sse_response(patch, "patch-call")?,
         create_final_assistant_message_sse_response("done")?,
     ];
-    let server = create_mock_responses_server_sequence(responses).await;
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
     create_config_toml(&codex_home, &server.uri())?;
 
     let mut primary = McpProcess::new(&codex_home).await?;
@@ -1146,6 +1177,7 @@ async fn thread_resume_replays_pending_file_change_request_approval() -> Result<
         primary.read_stream_until_notification_message("turn/completed"),
     )
     .await??;
+    wait_for_responses_request_count(&server, 3).await?;
 
     Ok(())
 }

codex-rs/app-server/tests/suite/v2/thread_unsubscribe.rs

@@ -1,8 +1,9 @@
 use anyhow::Context;
 use anyhow::Result;
 use app_test_support::McpProcess;
+use app_test_support::create_final_assistant_message_sse_response;
 use app_test_support::create_mock_responses_server_repeating_assistant;
-use app_test_support::create_mock_responses_server_sequence;
+use app_test_support::create_mock_responses_server_sequence_unchecked;
 use app_test_support::create_shell_command_sse_response;
 use app_test_support::to_response;
 use codex_app_server_protocol::ItemStartedNotification;
@@ -106,12 +107,15 @@ async fn thread_unsubscribe_during_turn_interrupts_turn_and_emits_thread_closed(
     let working_directory = tmp.path().join("workdir");
     std::fs::create_dir(&working_directory)?;
 
-    let server = create_mock_responses_server_sequence(vec![create_shell_command_sse_response(
-        shell_command.clone(),
-        Some(&working_directory),
-        Some(10_000),
-        "call_sleep",
-    )?])
+    let server = create_mock_responses_server_sequence_unchecked(vec![
+        create_shell_command_sse_response(
+            shell_command.clone(),
+            Some(&working_directory),
+            Some(10_000),
+            "call_sleep",
+        )?,
+        create_final_assistant_message_sse_response("Done")?,
+    ])
     .await;
     create_config_toml(&codex_home, &server.uri())?;
 

codex-rs/app-server/tests/suite/v2/turn_start_zsh_fork.rs

@@ -54,6 +54,7 @@ async fn turn_start_shell_zsh_fork_executes_command_v2() -> Result<()> {
     std::fs::create_dir(&codex_home)?;
     let workspace = tmp.path().join("workspace");
     std::fs::create_dir(&workspace)?;
+    let release_marker = workspace.join("interrupt-release");
 
     let Some(zsh_path) = find_test_zsh_path()? else {
         eprintln!("skipping zsh fork test: no zsh executable found");
@@ -61,8 +62,15 @@ async fn turn_start_shell_zsh_fork_executes_command_v2() -> Result<()> {
     };
     eprintln!("using zsh path for zsh-fork test: {}", zsh_path.display());
 
+    // Keep the shell command in flight until we interrupt it. A fast command
+    // like `echo hi` can finish before the interrupt arrives on faster runners,
+    // which turns this into a test for post-command follow-up behavior instead
+    // of interrupting an active zsh-fork command.
+    let release_marker_escaped = release_marker.to_string_lossy().replace('\'', r#"'\''"#);
+    let wait_for_interrupt =
+        format!("while [ ! -f '{release_marker_escaped}' ]; do sleep 0.01; done");
     let response = create_shell_command_sse_response(
-        vec!["echo".to_string(), "hi".to_string()],
+        vec!["/bin/sh".to_string(), "-c".to_string(), wait_for_interrupt],
         None,
         Some(5000),
         "call-zsh-fork",
@@ -155,7 +163,9 @@ async fn turn_start_shell_zsh_fork_executes_command_v2() -> Result<()> {
     assert_eq!(id, "call-zsh-fork");
     assert_eq!(status, CommandExecutionStatus::InProgress);
     assert!(command.starts_with(&zsh_path.display().to_string()));
-    assert!(command.contains(" -lc 'echo hi'"));
+    assert!(command.contains("/bin/sh -c"));
+    assert!(command.contains("sleep 0.01"));
+    assert!(command.contains(&release_marker.display().to_string()));
     assert_eq!(cwd, workspace);
 
     mcp.interrupt_turn_and_wait_for_aborted(thread.id, turn.id, DEFAULT_READ_TIMEOUT)
@@ -663,22 +673,50 @@ async fn turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2()
             };
             assert_eq!(id, "call-zsh-fork-subcommand-decline");
             assert_eq!(status, CommandExecutionStatus::Declined);
-            assert!(
-                aggregated_output.is_none()
-                    || aggregated_output == Some("exec command rejected by user".to_string())
-            );
+            if let Some(output) = aggregated_output.as_deref() {
+                assert!(
+                    output == "exec command rejected by user"
+                        || output.contains("sandbox denied exec error"),
+                    "unexpected aggregated output: {output}"
+                );
+            }
 
-            mcp.interrupt_turn_and_wait_for_aborted(
-                thread.id.clone(),
-                turn.id.clone(),
+            match timeout(
                 DEFAULT_READ_TIMEOUT,
+                mcp.read_stream_until_notification_message("turn/completed"),
             )
-            .await?;
+            .await
+            {
+                Ok(Ok(completed_notif)) => {
+                    let completed: TurnCompletedNotification = serde_json::from_value(
+                        completed_notif
+                            .params
+                            .expect("turn/completed params must be present"),
+                    )?;
+                    assert_eq!(completed.thread_id, thread.id);
+                    assert_eq!(completed.turn.id, turn.id);
+                    assert!(matches!(
+                        completed.turn.status,
+                        TurnStatus::Interrupted | TurnStatus::Completed
+                    ));
+                }
+                Ok(Err(error)) => return Err(error),
+                Err(_) => {
+                    mcp.interrupt_turn_and_wait_for_aborted(
+                        thread.id.clone(),
+                        turn.id.clone(),
+                        DEFAULT_READ_TIMEOUT,
+                    )
+                    .await?;
+                }
+            }
         }
         Ok(Err(error)) => return Err(error),
         Err(_) => {
             // Some zsh builds abort the turn immediately after the rejected
-            // subcommand without emitting a parent `item/completed`.
+            // subcommand without emitting a parent `item/completed`, and Linux
+            // sandbox failures can also complete the turn before the parent
+            // completion item is observed.
             let completed_notif = timeout(
                 DEFAULT_READ_TIMEOUT,
                 mcp.read_stream_until_notification_message("turn/completed"),
@@ -691,7 +729,10 @@ async fn turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2()
             )?;
             assert_eq!(completed.thread_id, thread.id);
             assert_eq!(completed.turn.id, turn.id);
-            assert_eq!(completed.turn.status, TurnStatus::Interrupted);
+            assert!(matches!(
+                completed.turn.status,
+                TurnStatus::Interrupted | TurnStatus::Completed
+            ));
         }
     }
 

codex-rs/backend-client/src/client.rs

@@ -10,6 +10,7 @@ use codex_protocol::account::PlanType as AccountPlanType;
 use codex_protocol::protocol::CreditsSnapshot;
 use codex_protocol::protocol::RateLimitSnapshot;
 use codex_protocol::protocol::RateLimitWindow;
+use reqwest::StatusCode;
 use reqwest::header::AUTHORIZATION;
 use reqwest::header::CONTENT_TYPE;
 use reqwest::header::HeaderMap;
@@ -17,6 +18,65 @@ use reqwest::header::HeaderName;
 use reqwest::header::HeaderValue;
 use reqwest::header::USER_AGENT;
 use serde::de::DeserializeOwned;
+use std::fmt;
+
+#[derive(Debug)]
+pub enum RequestError {
+    UnexpectedStatus {
+        method: String,
+        url: String,
+        status: StatusCode,
+        content_type: String,
+        body: String,
+    },
+    Other(anyhow::Error),
+}
+
+impl RequestError {
+    pub fn status(&self) -> Option<StatusCode> {
+        match self {
+            Self::UnexpectedStatus { status, .. } => Some(*status),
+            Self::Other(_) => None,
+        }
+    }
+
+    pub fn is_unauthorized(&self) -> bool {
+        self.status() == Some(StatusCode::UNAUTHORIZED)
+    }
+}
+
+impl fmt::Display for RequestError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::UnexpectedStatus {
+                method,
+                url,
+                status,
+                content_type,
+                body,
+            } => write!(
+                f,
+                "{method} {url} failed: {status}; content-type={content_type}; body={body}"
+            ),
+            Self::Other(err) => write!(f, "{err}"),
+        }
+    }
+}
+
+impl std::error::Error for RequestError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::UnexpectedStatus { .. } => None,
+            Self::Other(err) => Some(err.as_ref()),
+        }
+    }
+}
+
+impl From<anyhow::Error> for RequestError {
+    fn from(err: anyhow::Error) -> Self {
+        Self::Other(err)
+    }
+}
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum PathStyle {
@@ -148,6 +208,33 @@ impl Client {
         Ok((body, ct))
     }
 
+    async fn exec_request_detailed(
+        &self,
+        req: reqwest::RequestBuilder,
+        method: &str,
+        url: &str,
+    ) -> std::result::Result<(String, String), RequestError> {
+        let res = req.send().await.map_err(anyhow::Error::from)?;
+        let status = res.status();
+        let content_type = res
+            .headers()
+            .get(CONTENT_TYPE)
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("")
+            .to_string();
+        let body = res.text().await.unwrap_or_default();
+        if !status.is_success() {
+            return Err(RequestError::UnexpectedStatus {
+                method: method.to_string(),
+                url: url.to_string(),
+                status,
+                content_type,
+                body,
+            });
+        }
+        Ok((body, content_type))
+    }
+
     fn decode_json<T: DeserializeOwned>(&self, url: &str, ct: &str, body: &str) -> Result<T> {
         match serde_json::from_str::<T>(body) {
             Ok(v) => Ok(v),
@@ -256,14 +343,17 @@ impl Client {
     ///
     /// `GET /api/codex/config/requirements` (Codex API style) or
     /// `GET /wham/config/requirements` (ChatGPT backend-api style).
-    pub async fn get_config_requirements_file(&self) -> Result<ConfigFileResponse> {
+    pub async fn get_config_requirements_file(
+        &self,
+    ) -> std::result::Result<ConfigFileResponse, RequestError> {
         let url = match self.path_style {
             PathStyle::CodexApi => format!("{}/api/codex/config/requirements", self.base_url),
             PathStyle::ChatGptApi => format!("{}/wham/config/requirements", self.base_url),
         };
         let req = self.http.get(&url).headers(self.headers());
-        let (body, ct) = self.exec_request(req, "GET", &url).await?;
+        let (body, ct) = self.exec_request_detailed(req, "GET", &url).await?;
         self.decode_json::<ConfigFileResponse>(&url, &ct, &body)
+            .map_err(RequestError::from)
     }
 
     /// Create a new task (user turn) by POSTing to the appropriate backend path

codex-rs/backend-client/src/lib.rs

@@ -2,6 +2,7 @@ mod client;
 pub mod types;
 
 pub use client::Client;
+pub use client::RequestError;
 pub use types::CodeTaskDetailsResponse;
 pub use types::CodeTaskDetailsResponseExt;
 pub use types::ConfigFileResponse;

codex-rs/cloud-requirements/src/lib.rs

@@ -17,6 +17,7 @@ use chrono::Utc;
 use codex_backend_client::Client as BackendClient;
 use codex_core::AuthManager;
 use codex_core::auth::CodexAuth;
+use codex_core::auth::RefreshTokenError;
 use codex_core::config_loader::CloudRequirementsLoadError;
 use codex_core::config_loader::CloudRequirementsLoader;
 use codex_core::config_loader::ConfigRequirementsToml;
@@ -44,6 +45,7 @@ const CLOUD_REQUIREMENTS_MAX_ATTEMPTS: usize = 5;
 const CLOUD_REQUIREMENTS_CACHE_FILENAME: &str = "cloud-requirements-cache.json";
 const CLOUD_REQUIREMENTS_CACHE_REFRESH_INTERVAL: Duration = Duration::from_secs(5 * 60);
 const CLOUD_REQUIREMENTS_CACHE_TTL: Duration = Duration::from_secs(30 * 60);
+const CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE: &str = "failed to load your workspace-managed config";
 const CLOUD_REQUIREMENTS_CACHE_WRITE_HMAC_KEY: &[u8] =
     b"codex-cloud-requirements-cache-v3-064f8542-75b4-494c-a294-97d3ce597271";
 const CLOUD_REQUIREMENTS_CACHE_READ_HMAC_KEYS: &[&[u8]] =
@@ -62,6 +64,12 @@ enum FetchCloudRequirementsStatus {
     Request,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+enum FetchCloudRequirementsError {
+    Retryable(FetchCloudRequirementsStatus),
+    Unauthorized(CloudRequirementsLoadError),
+}
+
 #[derive(Clone, Debug, Eq, Error, PartialEq)]
 enum CacheLoadStatus {
     #[error("Skipping cloud requirements cache read because auth identity is incomplete.")]
@@ -141,6 +149,16 @@ fn verify_cache_signature(payload_bytes: &[u8], signature: &str) -> bool {
         .any(|key| verify_cache_signature_with_key(payload_bytes, &signature_bytes, key))
 }
 
+fn auth_identity(auth: &CodexAuth) -> (Option<String>, Option<String>) {
+    let token_data = auth.get_token_data().ok();
+    let chatgpt_user_id = token_data
+        .as_ref()
+        .and_then(|token_data| token_data.id_token.chatgpt_user_id.as_deref())
+        .map(str::to_owned);
+    let account_id = auth.get_account_id();
+    (chatgpt_user_id, account_id)
+}
+
 fn cache_payload_bytes(payload: &CloudRequirementsCacheSignedPayload) -> Option<Vec<u8>> {
     serde_json::to_vec(&payload).ok()
 }
@@ -153,7 +171,7 @@ trait RequirementsFetcher: Send + Sync {
     async fn fetch_requirements(
         &self,
         auth: &CodexAuth,
-    ) -> Result<Option<String>, FetchCloudRequirementsStatus>;
+    ) -> Result<Option<String>, FetchCloudRequirementsError>;
 }
 
 struct BackendRequirementsFetcher {
@@ -171,7 +189,7 @@ impl RequirementsFetcher for BackendRequirementsFetcher {
     async fn fetch_requirements(
         &self,
         auth: &CodexAuth,
-    ) -> Result<Option<String>, FetchCloudRequirementsStatus> {
+    ) -> Result<Option<String>, FetchCloudRequirementsError> {
         let client = BackendClient::from_auth(self.base_url.clone(), auth)
             .inspect_err(|err| {
                 tracing::warn!(
@@ -179,13 +197,25 @@ impl RequirementsFetcher for BackendRequirementsFetcher {
                     "Failed to construct backend client for cloud requirements"
                 );
             })
-            .map_err(|_| FetchCloudRequirementsStatus::BackendClientInit)?;
+            .map_err(|_| {
+                FetchCloudRequirementsError::Retryable(
+                    FetchCloudRequirementsStatus::BackendClientInit,
+                )
+            })?;
 
         let response = client
             .get_config_requirements_file()
             .await
             .inspect_err(|err| tracing::warn!(error = %err, "Failed to fetch cloud requirements"))
-            .map_err(|_| FetchCloudRequirementsStatus::Request)?;
+            .map_err(|err| {
+                if err.is_unauthorized() {
+                    FetchCloudRequirementsError::Unauthorized(CloudRequirementsLoadError::new(
+                        err.to_string(),
+                    ))
+                } else {
+                    FetchCloudRequirementsError::Retryable(FetchCloudRequirementsStatus::Request)
+                }
+            })?;
 
         let Some(contents) = response.contents else {
             tracing::info!(
@@ -281,14 +311,12 @@ impl CloudRequirementsService {
         {
             return Ok(None);
         }
-        let token_data = auth.get_token_data().ok();
-        let chatgpt_user_id = token_data
-            .as_ref()
-            .and_then(|token_data| token_data.id_token.chatgpt_user_id.as_deref());
-        let account_id = auth.get_account_id();
-        let account_id = account_id.as_deref();
+        let (chatgpt_user_id, account_id) = auth_identity(&auth);
 
-        match self.load_cache(chatgpt_user_id, account_id).await {
+        match self
+            .load_cache(chatgpt_user_id.as_deref(), account_id.as_deref())
+            .await
+        {
             Ok(signed_payload) => {
                 tracing::info!(
                     path = %self.cache_path.display(),
@@ -301,28 +329,20 @@ impl CloudRequirementsService {
             }
         }
 
-        self.fetch_with_retries(&auth, chatgpt_user_id, account_id)
-            .await
-            .ok_or_else(|| {
-                let message = "failed to load your workspace-managed config";
-                tracing::error!(
-                    path = %self.cache_path.display(),
-                    "{message}"
-                );
-                CloudRequirementsLoadError::new(message)
-            })
+        self.fetch_with_retries(auth).await
     }
 
     async fn fetch_with_retries(
         &self,
-        auth: &CodexAuth,
-        chatgpt_user_id: Option<&str>,
-        account_id: Option<&str>,
-    ) -> Option<Option<ConfigRequirementsToml>> {
-        for attempt in 1..=CLOUD_REQUIREMENTS_MAX_ATTEMPTS {
-            let contents = match self.fetcher.fetch_requirements(auth).await {
+        mut auth: CodexAuth,
+    ) -> Result<Option<ConfigRequirementsToml>, CloudRequirementsLoadError> {
+        let mut attempt = 1;
+        let mut auth_recovery = self.auth_manager.unauthorized_recovery();
+
+        while attempt <= CLOUD_REQUIREMENTS_MAX_ATTEMPTS {
+            let contents = match self.fetcher.fetch_requirements(&auth).await {
                 Ok(contents) => contents,
-                Err(status) => {
+                Err(FetchCloudRequirementsError::Retryable(status)) => {
                     if attempt < CLOUD_REQUIREMENTS_MAX_ATTEMPTS {
                         tracing::warn!(
                             status = ?status,
@@ -332,8 +352,60 @@ impl CloudRequirementsService {
                         );
                         sleep(backoff(attempt as u64)).await;
                     }
+                    attempt += 1;
                     continue;
                 }
+                Err(FetchCloudRequirementsError::Unauthorized(err)) => {
+                    if auth_recovery.has_next() {
+                        tracing::warn!(
+                            attempt,
+                            max_attempts = CLOUD_REQUIREMENTS_MAX_ATTEMPTS,
+                            "Cloud requirements request was unauthorized; attempting auth recovery"
+                        );
+                        match auth_recovery.next().await {
+                            Ok(()) => {
+                                let Some(refreshed_auth) = self.auth_manager.auth().await else {
+                                    tracing::error!(
+                                        "Auth recovery succeeded but no auth is available for cloud requirements"
+                                    );
+                                    return Err(CloudRequirementsLoadError::new(
+                                        CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE,
+                                    ));
+                                };
+                                auth = refreshed_auth;
+                                continue;
+                            }
+                            Err(RefreshTokenError::Permanent(failed)) => {
+                                tracing::warn!(
+                                    error = %failed,
+                                    "Failed to recover from unauthorized cloud requirements request"
+                                );
+                                return Err(CloudRequirementsLoadError::new(failed.message));
+                            }
+                            Err(RefreshTokenError::Transient(recovery_err)) => {
+                                if attempt < CLOUD_REQUIREMENTS_MAX_ATTEMPTS {
+                                    tracing::warn!(
+                                        error = %recovery_err,
+                                        attempt,
+                                        max_attempts = CLOUD_REQUIREMENTS_MAX_ATTEMPTS,
+                                        "Failed to recover from unauthorized cloud requirements request; retrying"
+                                    );
+                                    sleep(backoff(attempt as u64)).await;
+                                }
+                                attempt += 1;
+                                continue;
+                            }
+                        }
+                    }
+
+                    tracing::warn!(
+                        error = %err,
+                        "Cloud requirements request was unauthorized and no auth recovery is available"
+                    );
+                    return Err(CloudRequirementsLoadError::new(
+                        CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE,
+                    ));
+                }
             };
 
             let requirements = match contents.as_deref() {
@@ -341,27 +413,29 @@ impl CloudRequirementsService {
                     Ok(requirements) => requirements,
                     Err(err) => {
                         tracing::error!(error = %err, "Failed to parse cloud requirements");
-                        return None;
+                        return Err(CloudRequirementsLoadError::new(
+                            CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE,
+                        ));
                     }
                 },
                 None => None,
             };
 
-            if let Err(err) = self
-                .save_cache(
-                    chatgpt_user_id.map(str::to_owned),
-                    account_id.map(str::to_owned),
-                    contents,
-                )
-                .await
-            {
+            let (chatgpt_user_id, account_id) = auth_identity(&auth);
+            if let Err(err) = self.save_cache(chatgpt_user_id, account_id, contents).await {
                 tracing::warn!(error = %err, "Failed to write cloud requirements cache");
             }
 
-            return Some(requirements);
+            return Ok(requirements);
         }
 
-        None
+        tracing::error!(
+            path = %self.cache_path.display(),
+            "{CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE}"
+        );
+        Err(CloudRequirementsLoadError::new(
+            CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE,
+        ))
     }
 
     async fn refresh_cache_in_background(&self) {
@@ -392,20 +466,10 @@ impl CloudRequirementsService {
             return false;
         }
 
-        let token_data = auth.get_token_data().ok();
-        let chatgpt_user_id = token_data
-            .as_ref()
-            .and_then(|token_data| token_data.id_token.chatgpt_user_id.as_deref());
-        let account_id = auth.get_account_id();
-        let account_id = account_id.as_deref();
-
-        if self
-            .fetch_with_retries(&auth, chatgpt_user_id, account_id)
-            .await
-            .is_none()
-        {
+        if let Err(err) = self.fetch_with_retries(auth).await {
             tracing::error!(
                 path = %self.cache_path.display(),
+                error = %err,
                 "Failed to refresh cloud requirements cache from remote"
             );
             if let Some(metrics) = codex_otel::metrics::global() {
@@ -594,6 +658,7 @@ mod tests {
     use std::path::Path;
     use std::sync::atomic::AtomicUsize;
     use std::sync::atomic::Ordering;
+    use tempfile::TempDir;
     use tempfile::tempdir;
 
     fn write_auth_json(codex_home: &Path, value: serde_json::Value) -> std::io::Result<()> {
@@ -622,6 +687,49 @@ mod tests {
         account_id: Option<&str>,
     ) -> Arc<AuthManager> {
         let tmp = tempdir().expect("tempdir");
+        write_auth_json(
+            tmp.path(),
+            chatgpt_auth_json(
+                plan_type,
+                chatgpt_user_id,
+                account_id,
+                "test-access-token",
+                "test-refresh-token",
+            ),
+        )
+        .expect("write auth");
+        Arc::new(AuthManager::new(
+            tmp.path().to_path_buf(),
+            false,
+            AuthCredentialsStoreMode::File,
+        ))
+    }
+
+    fn chatgpt_auth_json(
+        plan_type: &str,
+        chatgpt_user_id: Option<&str>,
+        account_id: Option<&str>,
+        access_token: &str,
+        refresh_token: &str,
+    ) -> serde_json::Value {
+        chatgpt_auth_json_with_mode(
+            plan_type,
+            chatgpt_user_id,
+            account_id,
+            access_token,
+            refresh_token,
+            None,
+        )
+    }
+
+    fn chatgpt_auth_json_with_mode(
+        plan_type: &str,
+        chatgpt_user_id: Option<&str>,
+        account_id: Option<&str>,
+        access_token: &str,
+        refresh_token: &str,
+        auth_mode: Option<&str>,
+    ) -> serde_json::Value {
         let header = json!({ "alg": "none", "typ": "JWT" });
         let auth_payload = json!({
             "chatgpt_plan_type": plan_type,
@@ -637,22 +745,54 @@ mod tests {
         let signature_b64 = URL_SAFE_NO_PAD.encode(b"sig");
         let fake_jwt = format!("{header_b64}.{payload_b64}.{signature_b64}");
 
-        let auth_json = json!({
+        let mut auth_json = json!({
             "OPENAI_API_KEY": null,
             "tokens": {
                 "id_token": fake_jwt,
-                "access_token": "test-access-token",
-                "refresh_token": "test-refresh-token",
+                "access_token": access_token,
+                "refresh_token": refresh_token,
                 "account_id": account_id,
             },
             "last_refresh": "2025-01-01T00:00:00Z",
         });
-        write_auth_json(tmp.path(), auth_json).expect("write auth");
-        Arc::new(AuthManager::new(
-            tmp.path().to_path_buf(),
-            false,
-            AuthCredentialsStoreMode::File,
-        ))
+        if let Some(auth_mode) = auth_mode {
+            auth_json["auth_mode"] = serde_json::Value::String(auth_mode.to_string());
+        }
+        auth_json
+    }
+
+    struct ManagedAuthContext {
+        _home: TempDir,
+        manager: Arc<AuthManager>,
+    }
+
+    fn managed_auth_context(
+        plan_type: &str,
+        chatgpt_user_id: Option<&str>,
+        account_id: Option<&str>,
+        access_token: &str,
+        refresh_token: &str,
+    ) -> ManagedAuthContext {
+        let home = tempdir().expect("tempdir");
+        write_auth_json(
+            home.path(),
+            chatgpt_auth_json(
+                plan_type,
+                chatgpt_user_id,
+                account_id,
+                access_token,
+                refresh_token,
+            ),
+        )
+        .expect("write auth");
+        ManagedAuthContext {
+            manager: Arc::new(AuthManager::new(
+                home.path().to_path_buf(),
+                false,
+                AuthCredentialsStoreMode::File,
+            )),
+            _home: home,
+        }
     }
 
     fn auth_manager_with_plan(plan_type: &str) -> Arc<AuthManager> {
@@ -663,6 +803,10 @@ mod tests {
         contents.and_then(|contents| parse_cloud_requirements(contents).ok().flatten())
     }
 
+    fn request_error() -> FetchCloudRequirementsError {
+        FetchCloudRequirementsError::Retryable(FetchCloudRequirementsStatus::Request)
+    }
+
     struct StaticFetcher {
         contents: Option<String>,
     }
@@ -672,7 +816,7 @@ mod tests {
         async fn fetch_requirements(
             &self,
             _auth: &CodexAuth,
-        ) -> Result<Option<String>, FetchCloudRequirementsStatus> {
+        ) -> Result<Option<String>, FetchCloudRequirementsError> {
             Ok(self.contents.clone())
         }
     }
@@ -684,7 +828,7 @@ mod tests {
         async fn fetch_requirements(
             &self,
             _auth: &CodexAuth,
-        ) -> Result<Option<String>, FetchCloudRequirementsStatus> {
+        ) -> Result<Option<String>, FetchCloudRequirementsError> {
             pending::<()>().await;
             Ok(None)
         }
@@ -692,12 +836,12 @@ mod tests {
 
     struct SequenceFetcher {
         responses:
-            tokio::sync::Mutex<VecDeque<Result<Option<String>, FetchCloudRequirementsStatus>>>,
+            tokio::sync::Mutex<VecDeque<Result<Option<String>, FetchCloudRequirementsError>>>,
         request_count: AtomicUsize,
     }
 
     impl SequenceFetcher {
-        fn new(responses: Vec<Result<Option<String>, FetchCloudRequirementsStatus>>) -> Self {
+        fn new(responses: Vec<Result<Option<String>, FetchCloudRequirementsError>>) -> Self {
             Self {
                 responses: tokio::sync::Mutex::new(VecDeque::from(responses)),
                 request_count: AtomicUsize::new(0),
@@ -710,13 +854,57 @@ mod tests {
         async fn fetch_requirements(
             &self,
             _auth: &CodexAuth,
-        ) -> Result<Option<String>, FetchCloudRequirementsStatus> {
+        ) -> Result<Option<String>, FetchCloudRequirementsError> {
             self.request_count.fetch_add(1, Ordering::SeqCst);
             let mut responses = self.responses.lock().await;
             responses.pop_front().unwrap_or(Ok(None))
         }
     }
 
+    struct TokenFetcher {
+        expected_token: String,
+        contents: String,
+        request_count: AtomicUsize,
+    }
+
+    #[async_trait::async_trait]
+    impl RequirementsFetcher for TokenFetcher {
+        async fn fetch_requirements(
+            &self,
+            auth: &CodexAuth,
+        ) -> Result<Option<String>, FetchCloudRequirementsError> {
+            self.request_count.fetch_add(1, Ordering::SeqCst);
+            if matches!(
+                auth.get_token().as_deref(),
+                Ok(token) if token == self.expected_token.as_str()
+            ) {
+                Ok(Some(self.contents.clone()))
+            } else {
+                Err(FetchCloudRequirementsError::Unauthorized(
+                    CloudRequirementsLoadError::new("GET /config/requirements failed: 401"),
+                ))
+            }
+        }
+    }
+
+    struct UnauthorizedFetcher {
+        message: String,
+        request_count: AtomicUsize,
+    }
+
+    #[async_trait::async_trait]
+    impl RequirementsFetcher for UnauthorizedFetcher {
+        async fn fetch_requirements(
+            &self,
+            _auth: &CodexAuth,
+        ) -> Result<Option<String>, FetchCloudRequirementsError> {
+            self.request_count.fetch_add(1, Ordering::SeqCst);
+            Err(FetchCloudRequirementsError::Unauthorized(
+                CloudRequirementsLoadError::new(self.message.clone()),
+            ))
+        }
+    }
+
     #[tokio::test]
     async fn fetch_cloud_requirements_skips_non_chatgpt_auth() {
         let auth_manager = auth_manager_with_api_key();
@@ -839,7 +1027,7 @@ mod tests {
     #[tokio::test(start_paused = true)]
     async fn fetch_cloud_requirements_retries_until_success() {
         let fetcher = Arc::new(SequenceFetcher::new(vec![
-            Err(FetchCloudRequirementsStatus::Request),
+            Err(request_error()),
             Ok(Some("allowed_approval_policies = [\"never\"]".to_string())),
         ]));
         let codex_home = tempdir().expect("tempdir");
@@ -871,6 +1059,206 @@ mod tests {
         assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
     }
 
+    #[tokio::test]
+    async fn fetch_cloud_requirements_recovers_after_unauthorized_reload() {
+        let auth = managed_auth_context(
+            "business",
+            Some("user-12345"),
+            Some("account-12345"),
+            "stale-access-token",
+            "test-refresh-token",
+        );
+        write_auth_json(
+            auth._home.path(),
+            chatgpt_auth_json(
+                "business",
+                Some("user-12345"),
+                Some("account-12345"),
+                "fresh-access-token",
+                "test-refresh-token",
+            ),
+        )
+        .expect("write refreshed auth");
+
+        let fetcher = Arc::new(TokenFetcher {
+            expected_token: "fresh-access-token".to_string(),
+            contents: "allowed_approval_policies = [\"never\"]".to_string(),
+            request_count: AtomicUsize::new(0),
+        });
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudRequirementsService::new(
+            Arc::clone(&auth.manager),
+            fetcher.clone(),
+            codex_home.path().to_path_buf(),
+            CLOUD_REQUIREMENTS_TIMEOUT,
+        );
+
+        assert_eq!(
+            service.fetch().await,
+            Ok(Some(ConfigRequirementsToml {
+                allowed_approval_policies: Some(vec![AskForApproval::Never]),
+                allowed_sandbox_modes: None,
+                allowed_web_search_modes: None,
+                feature_requirements: None,
+                mcp_servers: None,
+                rules: None,
+                enforce_residency: None,
+                network: None,
+            }))
+        );
+        assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+    }
+
+    #[tokio::test]
+    async fn fetch_cloud_requirements_recovers_after_unauthorized_reload_updates_cache_identity() {
+        let auth = managed_auth_context(
+            "business",
+            Some("user-12345"),
+            Some("account-12345"),
+            "stale-access-token",
+            "test-refresh-token",
+        );
+        write_auth_json(
+            auth._home.path(),
+            chatgpt_auth_json(
+                "business",
+                Some("user-99999"),
+                Some("account-12345"),
+                "fresh-access-token",
+                "test-refresh-token",
+            ),
+        )
+        .expect("write refreshed auth");
+
+        let fetcher = Arc::new(TokenFetcher {
+            expected_token: "fresh-access-token".to_string(),
+            contents: "allowed_approval_policies = [\"never\"]".to_string(),
+            request_count: AtomicUsize::new(0),
+        });
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudRequirementsService::new(
+            Arc::clone(&auth.manager),
+            fetcher.clone(),
+            codex_home.path().to_path_buf(),
+            CLOUD_REQUIREMENTS_TIMEOUT,
+        );
+
+        assert_eq!(
+            service.fetch().await,
+            Ok(Some(ConfigRequirementsToml {
+                allowed_approval_policies: Some(vec![AskForApproval::Never]),
+                allowed_sandbox_modes: None,
+                allowed_web_search_modes: None,
+                feature_requirements: None,
+                mcp_servers: None,
+                rules: None,
+                enforce_residency: None,
+                network: None,
+            }))
+        );
+
+        let path = codex_home.path().join(CLOUD_REQUIREMENTS_CACHE_FILENAME);
+        let cache_file: CloudRequirementsCacheFile =
+            serde_json::from_str(&std::fs::read_to_string(path).expect("read cache"))
+                .expect("parse cache");
+        assert_eq!(
+            cache_file.signed_payload.chatgpt_user_id,
+            Some("user-99999".to_string())
+        );
+        assert_eq!(
+            cache_file.signed_payload.account_id,
+            Some("account-12345".to_string())
+        );
+        assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+    }
+
+    #[tokio::test]
+    async fn fetch_cloud_requirements_surfaces_auth_recovery_message() {
+        let auth = managed_auth_context(
+            "enterprise",
+            Some("user-12345"),
+            Some("account-12345"),
+            "stale-access-token",
+            "test-refresh-token",
+        );
+        write_auth_json(
+            auth._home.path(),
+            chatgpt_auth_json(
+                "enterprise",
+                Some("user-12345"),
+                Some("account-99999"),
+                "fresh-access-token",
+                "test-refresh-token",
+            ),
+        )
+        .expect("write mismatched auth");
+
+        let fetcher = Arc::new(UnauthorizedFetcher {
+            message: "GET /config/requirements failed: 401".to_string(),
+            request_count: AtomicUsize::new(0),
+        });
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudRequirementsService::new(
+            Arc::clone(&auth.manager),
+            fetcher.clone(),
+            codex_home.path().to_path_buf(),
+            CLOUD_REQUIREMENTS_TIMEOUT,
+        );
+
+        let err = service
+            .fetch()
+            .await
+            .expect_err("cloud requirements should surface auth recovery errors");
+        assert_eq!(
+            err.to_string(),
+            "Your access token could not be refreshed because you have since logged out or signed in to another account. Please sign in again."
+        );
+        assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn fetch_cloud_requirements_unauthorized_without_recovery_uses_generic_message() {
+        let auth_home = tempdir().expect("tempdir");
+        write_auth_json(
+            auth_home.path(),
+            chatgpt_auth_json_with_mode(
+                "enterprise",
+                Some("user-12345"),
+                Some("account-12345"),
+                "test-access-token",
+                "test-refresh-token",
+                Some("chatgptAuthTokens"),
+            ),
+        )
+        .expect("write auth");
+        let auth_manager = Arc::new(AuthManager::new(
+            auth_home.path().to_path_buf(),
+            false,
+            AuthCredentialsStoreMode::File,
+        ));
+
+        let fetcher = Arc::new(UnauthorizedFetcher {
+            message:
+                "GET https://chatgpt.com/backend-api/wham/config/requirements failed: 401; content-type=text/html; body=<html>nope</html>"
+                    .to_string(),
+            request_count: AtomicUsize::new(0),
+        });
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudRequirementsService::new(
+            auth_manager,
+            fetcher.clone(),
+            codex_home.path().to_path_buf(),
+            CLOUD_REQUIREMENTS_TIMEOUT,
+        );
+
+        let err = service
+            .fetch()
+            .await
+            .expect_err("cloud requirements should fail closed");
+        assert_eq!(err.to_string(), CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE);
+        assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    }
+
     #[tokio::test]
     async fn fetch_cloud_requirements_parse_error_does_not_retry() {
         let fetcher = Arc::new(SequenceFetcher::new(vec![
@@ -902,9 +1290,7 @@ mod tests {
         );
         let _ = prime_service.fetch().await;
 
-        let fetcher = Arc::new(SequenceFetcher::new(vec![Err(
-            FetchCloudRequirementsStatus::Request,
-        )]));
+        let fetcher = Arc::new(SequenceFetcher::new(vec![Err(request_error())]));
         let service = CloudRequirementsService::new(
             auth_manager_with_plan("business"),
             fetcher.clone(),
@@ -1219,10 +1605,7 @@ mod tests {
 
     #[tokio::test]
     async fn fetch_cloud_requirements_none_is_success_without_retry() {
-        let fetcher = Arc::new(SequenceFetcher::new(vec![
-            Ok(None),
-            Err(FetchCloudRequirementsStatus::Request),
-        ]));
+        let fetcher = Arc::new(SequenceFetcher::new(vec![Ok(None), Err(request_error())]));
         let codex_home = tempdir().expect("tempdir");
         let service = CloudRequirementsService::new(
             auth_manager_with_plan("enterprise"),
@@ -1238,9 +1621,7 @@ mod tests {
     #[tokio::test(start_paused = true)]
     async fn fetch_cloud_requirements_stops_after_max_retries() {
         let fetcher = Arc::new(SequenceFetcher::new(vec![
-            Err(
-                FetchCloudRequirementsStatus::Request
-            );
+            Err(request_error());
             CLOUD_REQUIREMENTS_MAX_ATTEMPTS
         ]));
         let codex_home = tempdir().expect("tempdir");

codex-rs/core/BUILD.bazel

@@ -36,6 +36,9 @@ codex_rust_crate(
     ],
     test_data_extra = [
         "config.schema.json",
+    ] + glob([
+        "src/**/snapshots/**",
+    ]) + [
         # This is a bit of a hack, but empirically, some of our integration tests
         # are relying on the presence of this file as a repo root marker. When
         # running tests locally, this "just works," but in remote execution,

codex-rs/core/config.schema.json

@@ -410,6 +410,9 @@
             "request_permissions": {
               "type": "boolean"
             },
+            "request_permissions_tool": {
+              "type": "boolean"
+            },
             "request_rule": {
               "type": "boolean"
             },
@@ -1313,6 +1316,10 @@
           "description": "Reject MCP elicitation prompts.",
           "type": "boolean"
         },
+        "request_permissions": {
+          "description": "Reject approval prompts related to built-in permission requests.",
+          "type": "boolean"
+        },
         "rules": {
           "description": "Reject prompts triggered by execpolicy `prompt` rules.",
           "type": "boolean"
@@ -1324,6 +1331,7 @@
       },
       "required": [
         "mcp_elicitations",
+        "request_permissions",
         "rules",
         "sandbox_approval"
       ],
@@ -1882,6 +1890,9 @@
         "request_permissions": {
           "type": "boolean"
         },
+        "request_permissions_tool": {
+          "type": "boolean"
+        },
         "request_rule": {
           "type": "boolean"
         },

codex-rs/core/src/client_common.rs

@@ -155,12 +155,11 @@ fn strip_total_output_header(output: &str) -> Option<(&str, u32)> {
 pub(crate) mod tools {
     use crate::tools::spec::JsonSchema;
     use codex_protocol::config_types::WebSearchContextSize;
-    use codex_protocol::config_types::WebSearchFilters;
-    use codex_protocol::config_types::WebSearchUserLocation;
+    use codex_protocol::config_types::WebSearchFilters as ConfigWebSearchFilters;
+    use codex_protocol::config_types::WebSearchUserLocation as ConfigWebSearchUserLocation;
     use codex_protocol::config_types::WebSearchUserLocationType;
     use serde::Deserialize;
     use serde::Serialize;
-    use serde::Serializer;
 
     /// When serialized as JSON, this produces a valid "Tool" in the OpenAI
     /// Responses API.
@@ -181,16 +180,10 @@ pub(crate) mod tools {
         WebSearch {
             #[serde(skip_serializing_if = "Option::is_none")]
             external_web_access: Option<bool>,
-            #[serde(
-                skip_serializing_if = "Option::is_none",
-                serialize_with = "serialize_web_search_filters"
-            )]
-            filters: Option<WebSearchFilters>,
-            #[serde(
-                skip_serializing_if = "Option::is_none",
-                serialize_with = "serialize_web_search_user_location"
-            )]
-            user_location: Option<WebSearchUserLocation>,
+            #[serde(skip_serializing_if = "Option::is_none")]
+            filters: Option<ResponsesApiWebSearchFilters>,
+            #[serde(skip_serializing_if = "Option::is_none")]
+            user_location: Option<ResponsesApiWebSearchUserLocation>,
             #[serde(skip_serializing_if = "Option::is_none")]
             search_context_size: Option<WebSearchContextSize>,
             #[serde(skip_serializing_if = "Option::is_none")]
@@ -212,63 +205,43 @@ pub(crate) mod tools {
         }
     }
 
-    fn serialize_web_search_filters<S>(
-        filters: &Option<WebSearchFilters>,
-        serializer: S,
-    ) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        match filters {
-            Some(filters) => {
-                #[derive(Serialize)]
-                struct SerializableWebSearchFilters<'a> {
-                    #[serde(skip_serializing_if = "Option::is_none")]
-                    allowed_domains: Option<&'a Vec<String>>,
-                }
+    #[derive(Debug, Clone, Serialize, PartialEq)]
+    pub(crate) struct ResponsesApiWebSearchFilters {
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub(crate) allowed_domains: Option<Vec<String>>,
+    }
 
-                SerializableWebSearchFilters {
-                    allowed_domains: filters.allowed_domains.as_ref(),
-                }
-                .serialize(serializer)
+    impl From<ConfigWebSearchFilters> for ResponsesApiWebSearchFilters {
+        fn from(filters: ConfigWebSearchFilters) -> Self {
+            Self {
+                allowed_domains: filters.allowed_domains,
             }
-            None => serializer.serialize_none(),
         }
     }
 
-    fn serialize_web_search_user_location<S>(
-        user_location: &Option<WebSearchUserLocation>,
-        serializer: S,
-    ) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        match user_location {
-            Some(user_location) => {
-                #[derive(Serialize)]
-                struct SerializableWebSearchUserLocation<'a> {
-                    #[serde(rename = "type")]
-                    r#type: WebSearchUserLocationType,
-                    #[serde(skip_serializing_if = "Option::is_none")]
-                    country: Option<&'a String>,
-                    #[serde(skip_serializing_if = "Option::is_none")]
-                    region: Option<&'a String>,
-                    #[serde(skip_serializing_if = "Option::is_none")]
-                    city: Option<&'a String>,
-                    #[serde(skip_serializing_if = "Option::is_none")]
-                    timezone: Option<&'a String>,
-                }
+    #[derive(Debug, Clone, Serialize, PartialEq)]
+    pub(crate) struct ResponsesApiWebSearchUserLocation {
+        #[serde(rename = "type")]
+        pub(crate) r#type: WebSearchUserLocationType,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub(crate) country: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub(crate) region: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub(crate) city: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub(crate) timezone: Option<String>,
+    }
 
-                SerializableWebSearchUserLocation {
-                    r#type: user_location.r#type,
-                    country: user_location.country.as_ref(),
-                    region: user_location.region.as_ref(),
-                    city: user_location.city.as_ref(),
-                    timezone: user_location.timezone.as_ref(),
-                }
-                .serialize(serializer)
+    impl From<ConfigWebSearchUserLocation> for ResponsesApiWebSearchUserLocation {
+        fn from(user_location: ConfigWebSearchUserLocation) -> Self {
+            Self {
+                r#type: user_location.r#type,
+                country: user_location.country,
+                region: user_location.region,
+                city: user_location.city,
+                timezone: user_location.timezone,
             }
-            None => serializer.serialize_none(),
         }
     }
 

codex-rs/core/src/codex.rs

@@ -71,6 +71,7 @@ use codex_otel::current_span_w3c_trace_context;
 use codex_otel::set_parent_from_w3c_trace_context;
 use codex_protocol::ThreadId;
 use codex_protocol::approvals::ElicitationRequestEvent;
+use codex_protocol::approvals::ExecApprovalRequestSkillMetadata;
 use codex_protocol::approvals::ExecPolicyAmendment;
 use codex_protocol::approvals::NetworkPolicyAmendment;
 use codex_protocol::approvals::NetworkPolicyRuleAction;
@@ -102,6 +103,10 @@ use codex_protocol::protocol::TurnAbortReason;
 use codex_protocol::protocol::TurnContextItem;
 use codex_protocol::protocol::TurnContextNetworkItem;
 use codex_protocol::protocol::TurnStartedEvent;
+use codex_protocol::request_permissions::PermissionGrantScope;
+use codex_protocol::request_permissions::RequestPermissionsArgs;
+use codex_protocol::request_permissions::RequestPermissionsEvent;
+use codex_protocol::request_permissions::RequestPermissionsResponse;
 use codex_protocol::request_user_input::RequestUserInputArgs;
 use codex_protocol::request_user_input::RequestUserInputResponse;
 use codex_rmcp_client::ElicitationResponse;
@@ -301,6 +306,7 @@ use crate::windows_sandbox::WindowsSandboxLevelExt;
 use codex_async_utils::OrCancelExt;
 use codex_otel::SessionTelemetry;
 use codex_otel::TelemetryAuthMode;
+use codex_otel::metrics::names::THREAD_STARTED_METRIC;
 use codex_protocol::config_types::CollaborationMode;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;
@@ -945,6 +951,11 @@ impl SessionConfiguration {
 
     pub(crate) fn apply(&self, updates: &SessionSettingsUpdate) -> ConstraintResult<Self> {
         let mut next_configuration = self.clone();
+        let file_system_policy_matches_legacy = self.file_system_sandbox_policy
+            == FileSystemSandboxPolicy::from_legacy_sandbox_policy(
+                self.sandbox_policy.get(),
+                &self.cwd,
+            );
         if let Some(collaboration_mode) = updates.collaboration_mode.clone() {
             next_configuration.collaboration_mode = collaboration_mode;
         }
@@ -960,21 +971,35 @@ impl SessionConfiguration {
         if let Some(approval_policy) = updates.approval_policy {
             next_configuration.approval_policy.set(approval_policy)?;
         }
+        let mut sandbox_policy_changed = false;
         if let Some(sandbox_policy) = updates.sandbox_policy.clone() {
             next_configuration.sandbox_policy.set(sandbox_policy)?;
             next_configuration.file_system_sandbox_policy =
                 FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_read_denies(
                     next_configuration.sandbox_policy.get(),
+                    &next_configuration.cwd,
                     &next_configuration.file_system_sandbox_policy,
                 );
             next_configuration.network_sandbox_policy =
                 NetworkSandboxPolicy::from(next_configuration.sandbox_policy.get());
+            sandbox_policy_changed = true;
         }
         if let Some(windows_sandbox_level) = updates.windows_sandbox_level {
             next_configuration.windows_sandbox_level = windows_sandbox_level;
         }
+        let mut cwd_changed = false;
         if let Some(cwd) = updates.cwd.clone() {
             next_configuration.cwd = cwd;
+            cwd_changed = true;
+        }
+        if sandbox_policy_changed || (cwd_changed && file_system_policy_matches_legacy) {
+            // Preserve richer split policies across cwd-only updates; only
+            // rederive when the session is already using the legacy bridge.
+            next_configuration.file_system_sandbox_policy =
+                FileSystemSandboxPolicy::from_legacy_sandbox_policy(
+                    next_configuration.sandbox_policy.get(),
+                    &next_configuration.cwd,
+                );
         }
         if let Some(app_server_client_name) = updates.app_server_client_name.clone() {
             next_configuration.app_server_client_name = Some(app_server_client_name);
@@ -1411,7 +1436,7 @@ impl Session {
         };
         config.features.emit_metrics(&session_telemetry);
         session_telemetry.counter(
-            "codex.thread.started",
+            THREAD_STARTED_METRIC,
             1,
             &[(
                 "is_git",
@@ -2724,6 +2749,7 @@ impl Session {
         network_approval_context: Option<NetworkApprovalContext>,
         proposed_execpolicy_amendment: Option<ExecPolicyAmendment>,
         additional_permissions: Option<PermissionProfile>,
+        skill_metadata: Option<ExecApprovalRequestSkillMetadata>,
         available_decisions: Option<Vec<ReviewDecision>>,
     ) -> ReviewDecision {
         //  command-level approvals use `call_id`.
@@ -2777,6 +2803,7 @@ impl Session {
             proposed_execpolicy_amendment,
             proposed_network_policy_amendments,
             additional_permissions,
+            skill_metadata,
             available_decisions: Some(available_decisions),
             parsed_cmd,
         });
@@ -2820,6 +2847,58 @@ impl Session {
         rx_approve
     }
 
+    pub async fn request_permissions(
+        &self,
+        turn_context: &TurnContext,
+        call_id: String,
+        args: RequestPermissionsArgs,
+    ) -> Option<RequestPermissionsResponse> {
+        match turn_context.approval_policy.value() {
+            AskForApproval::Never => {
+                return Some(RequestPermissionsResponse {
+                    permissions: PermissionProfile::default(),
+                    scope: PermissionGrantScope::Turn,
+                });
+            }
+            AskForApproval::Reject(reject_config)
+                if reject_config.rejects_request_permissions() =>
+            {
+                return Some(RequestPermissionsResponse {
+                    permissions: PermissionProfile::default(),
+                    scope: PermissionGrantScope::Turn,
+                });
+            }
+            AskForApproval::OnFailure
+            | AskForApproval::OnRequest
+            | AskForApproval::UnlessTrusted
+            | AskForApproval::Reject(_) => {}
+        }
+
+        let (tx_response, rx_response) = oneshot::channel();
+        let prev_entry = {
+            let mut active = self.active_turn.lock().await;
+            match active.as_mut() {
+                Some(at) => {
+                    let mut ts = at.turn_state.lock().await;
+                    ts.insert_pending_request_permissions(call_id.clone(), tx_response)
+                }
+                None => None,
+            }
+        };
+        if prev_entry.is_some() {
+            warn!("Overwriting existing pending request_permissions for call_id: {call_id}");
+        }
+
+        let event = EventMsg::RequestPermissions(RequestPermissionsEvent {
+            call_id,
+            turn_id: turn_context.sub_id.clone(),
+            reason: args.reason,
+            permissions: args.permissions,
+        });
+        self.send_event(turn_context, event).await;
+        rx_response.await.ok()
+    }
+
     pub async fn request_user_input(
         &self,
         turn_context: &TurnContext,
@@ -2956,6 +3035,59 @@ impl Session {
         }
     }
 
+    pub async fn notify_request_permissions_response(
+        &self,
+        call_id: &str,
+        response: RequestPermissionsResponse,
+    ) {
+        let mut granted_for_session = None;
+        let entry = {
+            let mut active = self.active_turn.lock().await;
+            match active.as_mut() {
+                Some(at) => {
+                    let mut ts = at.turn_state.lock().await;
+                    let entry = ts.remove_pending_request_permissions(call_id);
+                    if entry.is_some() && !response.permissions.is_empty() {
+                        match response.scope {
+                            PermissionGrantScope::Turn => {
+                                ts.record_granted_permissions(response.permissions.clone());
+                            }
+                            PermissionGrantScope::Session => {
+                                granted_for_session = Some(response.permissions.clone());
+                            }
+                        }
+                    }
+                    entry
+                }
+                None => None,
+            }
+        };
+        if let Some(permissions) = granted_for_session {
+            let mut state = self.state.lock().await;
+            state.record_granted_permissions(permissions);
+        }
+        match entry {
+            Some(tx_response) => {
+                tx_response.send(response).ok();
+            }
+            None => {
+                warn!("No pending request_permissions found for call_id: {call_id}");
+            }
+        }
+    }
+
+    pub(crate) async fn granted_turn_permissions(&self) -> Option<PermissionProfile> {
+        let active = self.active_turn.lock().await;
+        let active = active.as_ref()?;
+        let ts = active.turn_state.lock().await;
+        ts.granted_permissions()
+    }
+
+    pub(crate) async fn granted_session_permissions(&self) -> Option<PermissionProfile> {
+        let state = self.state.lock().await;
+        state.granted_permissions()
+    }
+
     pub async fn notify_dynamic_tool_response(&self, call_id: &str, response: DynamicToolResponse) {
         let entry = {
             let mut active = self.active_turn.lock().await;
@@ -3195,7 +3327,6 @@ impl Session {
             DeveloperInstructions::from_policy(
                 turn_context.sandbox_policy.get(),
                 turn_context.approval_policy.value(),
-                turn_context.features.enabled(Feature::GuardianApproval),
                 self.services.exec_policy.current().as_ref(),
                 &turn_context.cwd,
                 turn_context.features.enabled(Feature::RequestPermissions),
@@ -3924,6 +4055,10 @@ async fn submission_loop(sess: Arc<Session>, config: Arc<Config>, rx_sub: Receiv
                     handlers::request_user_input_response(&sess, id, response).await;
                     false
                 }
+                Op::RequestPermissionsResponse { id, response } => {
+                    handlers::request_permissions_response(&sess, id, response).await;
+                    false
+                }
                 Op::DynamicToolResponse { id, response } => {
                     handlers::dynamic_tool_response(&sess, id, response).await;
                     false
@@ -4106,6 +4241,7 @@ mod handlers {
     use codex_protocol::protocol::ThreadRolledBackEvent;
     use codex_protocol::protocol::TurnAbortReason;
     use codex_protocol::protocol::WarningEvent;
+    use codex_protocol::request_permissions::RequestPermissionsResponse;
     use codex_protocol::request_user_input::RequestUserInputResponse;
 
     use crate::context_manager::is_user_turn_boundary;
@@ -4348,6 +4484,15 @@ mod handlers {
         sess.notify_user_input_response(&id, response).await;
     }
 
+    pub async fn request_permissions_response(
+        sess: &Arc<Session>,
+        id: String,
+        response: RequestPermissionsResponse,
+    ) {
+        sess.notify_request_permissions_response(&id, response)
+            .await;
+    }
+
     pub async fn dynamic_tool_response(
         sess: &Arc<Session>,
         id: String,
@@ -6217,6 +6362,7 @@ fn realtime_text_for_event(msg: &EventMsg) -> Option<String> {
         | EventMsg::ImageGenerationBegin(_)
         | EventMsg::ImageGenerationEnd(_)
         | EventMsg::ExecApprovalRequest(_)
+        | EventMsg::RequestPermissions(_)
         | EventMsg::RequestUserInput(_)
         | EventMsg::DynamicToolCallRequest(_)
         | EventMsg::DynamicToolCallResponse(_)

codex-rs/core/src/codex_delegate.rs

@@ -13,6 +13,10 @@ use codex_protocol::protocol::RequestUserInputEvent;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SubAgentSource;
 use codex_protocol::protocol::Submission;
+use codex_protocol::request_permissions::PermissionGrantScope;
+use codex_protocol::request_permissions::RequestPermissionsArgs;
+use codex_protocol::request_permissions::RequestPermissionsEvent;
+use codex_protocol::request_permissions::RequestPermissionsResponse;
 use codex_protocol::request_user_input::RequestUserInputArgs;
 use codex_protocol::request_user_input::RequestUserInputResponse;
 use codex_protocol::user_input::UserInput;
@@ -251,6 +255,19 @@ async fn forward_events(
                         )
                         .await;
                     }
+                    Event {
+                        msg: EventMsg::RequestPermissions(event),
+                        ..
+                    } => {
+                        handle_request_permissions(
+                            &codex,
+                            &parent_session,
+                            &parent_ctx,
+                            event,
+                            &cancel_token,
+                        )
+                        .await;
+                    }
                     Event {
                         id,
                         msg: EventMsg::RequestUserInput(event),
@@ -332,6 +349,7 @@ async fn handle_exec_approval(
         network_approval_context,
         proposed_execpolicy_amendment,
         additional_permissions,
+        skill_metadata,
         available_decisions,
         ..
     } = event;
@@ -346,6 +364,7 @@ async fn handle_exec_approval(
         network_approval_context,
         proposed_execpolicy_amendment,
         additional_permissions,
+        skill_metadata,
         available_decisions,
     );
     let decision = await_approval_with_cancel(
@@ -423,6 +442,30 @@ async fn handle_request_user_input(
     let _ = codex.submit(Op::UserInputAnswer { id, response }).await;
 }
 
+async fn handle_request_permissions(
+    codex: &Codex,
+    parent_session: &Session,
+    parent_ctx: &TurnContext,
+    event: RequestPermissionsEvent,
+    cancel_token: &CancellationToken,
+) {
+    let call_id = event.call_id;
+    let args = RequestPermissionsArgs {
+        reason: event.reason,
+        permissions: event.permissions,
+    };
+    let response_fut = parent_session.request_permissions(parent_ctx, call_id.clone(), args);
+    let response =
+        await_request_permissions_with_cancel(response_fut, parent_session, &call_id, cancel_token)
+            .await;
+    let _ = codex
+        .submit(Op::RequestPermissionsResponse {
+            id: call_id,
+            response,
+        })
+        .await;
+}
+
 async fn await_user_input_with_cancel<F>(
     fut: F,
     parent_session: &Session,
@@ -449,6 +492,34 @@ where
     }
 }
 
+async fn await_request_permissions_with_cancel<F>(
+    fut: F,
+    parent_session: &Session,
+    call_id: &str,
+    cancel_token: &CancellationToken,
+) -> RequestPermissionsResponse
+where
+    F: core::future::Future<Output = Option<RequestPermissionsResponse>>,
+{
+    tokio::select! {
+        biased;
+        _ = cancel_token.cancelled() => {
+            let empty = RequestPermissionsResponse {
+                permissions: Default::default(),
+                scope: PermissionGrantScope::Turn,
+            };
+            parent_session
+                .notify_request_permissions_response(call_id, empty.clone())
+                .await;
+            empty
+        }
+        response = fut => response.unwrap_or_else(|| RequestPermissionsResponse {
+            permissions: Default::default(),
+            scope: PermissionGrantScope::Turn,
+        }),
+    }
+}
+
 /// Await an approval decision, aborting on cancellation.
 async fn await_approval_with_cancel<F>(
     fut: F,
@@ -477,11 +548,16 @@ where
 mod tests {
     use super::*;
     use async_channel::bounded;
+    use codex_protocol::models::NetworkPermissions;
+    use codex_protocol::models::PermissionProfile;
     use codex_protocol::models::ResponseItem;
     use codex_protocol::protocol::AgentStatus;
+    use codex_protocol::protocol::EventMsg;
     use codex_protocol::protocol::RawResponseItemEvent;
     use codex_protocol::protocol::TurnAbortReason;
     use codex_protocol::protocol::TurnAbortedEvent;
+    use codex_protocol::request_permissions::RequestPermissionsEvent;
+    use codex_protocol::request_permissions::RequestPermissionsResponse;
     use pretty_assertions::assert_eq;
     use tokio::sync::watch;
 
@@ -600,4 +676,91 @@ mod tests {
             .expect("forward_ops did not exit")
             .expect("forward_ops join error");
     }
+
+    #[tokio::test]
+    async fn handle_request_permissions_uses_tool_call_id_for_round_trip() {
+        let (parent_session, parent_ctx, rx_events) =
+            crate::codex::make_session_and_context_with_rx().await;
+        *parent_session.active_turn.lock().await = Some(crate::state::ActiveTurn::default());
+
+        let (tx_sub, rx_sub) = bounded(SUBMISSION_CHANNEL_CAPACITY);
+        let (_tx_events, rx_events_child) = bounded(SUBMISSION_CHANNEL_CAPACITY);
+        let (_agent_status_tx, agent_status) = watch::channel(AgentStatus::PendingInit);
+        let codex = Arc::new(Codex {
+            tx_sub,
+            rx_event: rx_events_child,
+            agent_status,
+            session: Arc::clone(&parent_session),
+        });
+
+        let call_id = "tool-call-1".to_string();
+        let expected_response = RequestPermissionsResponse {
+            permissions: PermissionProfile {
+                network: Some(NetworkPermissions {
+                    enabled: Some(true),
+                }),
+                ..PermissionProfile::default()
+            },
+            scope: PermissionGrantScope::Turn,
+        };
+        let cancel_token = CancellationToken::new();
+        let request_call_id = call_id.clone();
+
+        let handle = tokio::spawn({
+            let codex = Arc::clone(&codex);
+            let parent_session = Arc::clone(&parent_session);
+            let parent_ctx = Arc::clone(&parent_ctx);
+            let cancel_token = cancel_token.clone();
+            async move {
+                handle_request_permissions(
+                    codex.as_ref(),
+                    parent_session.as_ref(),
+                    parent_ctx.as_ref(),
+                    RequestPermissionsEvent {
+                        call_id: request_call_id,
+                        turn_id: "child-turn-1".to_string(),
+                        reason: Some("need access".to_string()),
+                        permissions: PermissionProfile {
+                            network: Some(NetworkPermissions {
+                                enabled: Some(true),
+                            }),
+                            ..PermissionProfile::default()
+                        },
+                    },
+                    &cancel_token,
+                )
+                .await;
+            }
+        });
+
+        let request_event = timeout(Duration::from_secs(1), rx_events.recv())
+            .await
+            .expect("request_permissions event timed out")
+            .expect("request_permissions event missing");
+        let EventMsg::RequestPermissions(request) = request_event.msg else {
+            panic!("expected RequestPermissions event");
+        };
+        assert_eq!(request.call_id, call_id.clone());
+
+        parent_session
+            .notify_request_permissions_response(&call_id, expected_response.clone())
+            .await;
+
+        timeout(Duration::from_secs(1), handle)
+            .await
+            .expect("handle_request_permissions hung")
+            .expect("handle_request_permissions join error");
+
+        let submission = timeout(Duration::from_secs(1), rx_sub.recv())
+            .await
+            .expect("request_permissions response timed out")
+            .expect("request_permissions response missing");
+        assert_eq!(
+            submission.op,
+            Op::RequestPermissionsResponse {
+                id: call_id,
+                response: expected_response,
+            }
+        );
+    }
 }

codex-rs/core/src/codex_tests.rs

@@ -17,6 +17,14 @@ use crate::tools::format_exec_output_str;
 use codex_protocol::ThreadId;
 use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::FunctionCallOutputPayload;
+use codex_protocol::permissions::FileSystemAccessMode;
+use codex_protocol::permissions::FileSystemPath;
+use codex_protocol::permissions::FileSystemSandboxEntry;
+use codex_protocol::permissions::FileSystemSandboxPolicy;
+use codex_protocol::permissions::FileSystemSpecialPath;
+use codex_protocol::protocol::ReadOnlyAccess;
+use codex_protocol::protocol::SandboxPolicy;
+use codex_protocol::request_permissions::PermissionGrantScope;
 use tracing::Span;
 
 use crate::protocol::CompactedItem;
@@ -1885,6 +1893,100 @@ pub(crate) async fn make_session_configuration_for_tests() -> SessionConfigurati
     }
 }
 
+#[tokio::test]
+async fn session_configuration_apply_preserves_split_file_system_policy_on_cwd_only_update() {
+    let mut session_configuration = make_session_configuration_for_tests().await;
+    let workspace = tempfile::tempdir().expect("create temp dir");
+    let project_root = workspace.path().join("project");
+    let original_cwd = project_root.join("subdir");
+    let docs_dir = original_cwd.join("docs");
+    std::fs::create_dir_all(&docs_dir).expect("create docs dir");
+    let docs_dir =
+        codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&docs_dir).expect("docs");
+
+    session_configuration.cwd = original_cwd;
+    session_configuration.sandbox_policy =
+        codex_config::Constrained::allow_any(SandboxPolicy::WorkspaceWrite {
+            writable_roots: Vec::new(),
+            read_only_access: ReadOnlyAccess::Restricted {
+                include_platform_defaults: true,
+                readable_roots: vec![docs_dir.clone()],
+            },
+            network_access: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
+        });
+    session_configuration.file_system_sandbox_policy = FileSystemSandboxPolicy::restricted(vec![
+        FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::CurrentWorkingDirectory,
+            },
+            access: FileSystemAccessMode::Write,
+        },
+        FileSystemSandboxEntry {
+            path: FileSystemPath::Path { path: docs_dir },
+            access: FileSystemAccessMode::Read,
+        },
+    ]);
+
+    let updated = session_configuration
+        .apply(&SessionSettingsUpdate {
+            cwd: Some(project_root),
+            ..Default::default()
+        })
+        .expect("cwd-only update should succeed");
+
+    assert_eq!(
+        updated.file_system_sandbox_policy,
+        session_configuration.file_system_sandbox_policy
+    );
+}
+
+#[tokio::test]
+async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_update() {
+    let mut session_configuration = make_session_configuration_for_tests().await;
+    let workspace = tempfile::tempdir().expect("create temp dir");
+    let project_root = workspace.path().join("project");
+    let original_cwd = project_root.join("subdir");
+    let docs_dir = original_cwd.join("docs");
+    std::fs::create_dir_all(&docs_dir).expect("create docs dir");
+    let docs_dir =
+        codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&docs_dir).expect("docs");
+
+    session_configuration.cwd = original_cwd;
+    session_configuration.sandbox_policy =
+        codex_config::Constrained::allow_any(SandboxPolicy::WorkspaceWrite {
+            writable_roots: Vec::new(),
+            read_only_access: ReadOnlyAccess::Restricted {
+                include_platform_defaults: true,
+                readable_roots: vec![docs_dir],
+            },
+            network_access: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
+        });
+    session_configuration.file_system_sandbox_policy =
+        FileSystemSandboxPolicy::from_legacy_sandbox_policy(
+            session_configuration.sandbox_policy.get(),
+            &session_configuration.cwd,
+        );
+
+    let updated = session_configuration
+        .apply(&SessionSettingsUpdate {
+            cwd: Some(project_root.clone()),
+            ..Default::default()
+        })
+        .expect("cwd-only update should succeed");
+
+    assert_eq!(
+        updated.file_system_sandbox_policy,
+        FileSystemSandboxPolicy::from_legacy_sandbox_policy(
+            updated.sandbox_policy.get(),
+            &project_root,
+        )
+    );
+}
+
 #[tokio::test]
 async fn session_new_fails_when_zsh_fork_enabled_without_zsh_path() {
     let codex_home = tempfile::tempdir().expect("create temp dir");
@@ -2141,6 +2243,153 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
     (session, turn_context)
 }
 
+#[tokio::test]
+async fn notify_request_permissions_response_ignores_unmatched_call_id() {
+    let (session, _turn_context) = make_session_and_context().await;
+    *session.active_turn.lock().await = Some(ActiveTurn::default());
+
+    session
+        .notify_request_permissions_response(
+            "missing",
+            codex_protocol::request_permissions::RequestPermissionsResponse {
+                permissions: codex_protocol::models::PermissionProfile {
+                    network: Some(codex_protocol::models::NetworkPermissions {
+                        enabled: Some(true),
+                    }),
+                    ..Default::default()
+                },
+                scope: PermissionGrantScope::Turn,
+            },
+        )
+        .await;
+
+    assert_eq!(session.granted_turn_permissions().await, None);
+}
+
+#[tokio::test]
+async fn request_permissions_emits_event_when_reject_policy_allows_requests() {
+    let (session, mut turn_context, rx) = make_session_and_context_with_rx().await;
+    *session.active_turn.lock().await = Some(ActiveTurn::default());
+    Arc::get_mut(&mut turn_context)
+        .expect("single turn context ref")
+        .approval_policy
+        .set(crate::protocol::AskForApproval::Reject(
+            crate::protocol::RejectConfig {
+                sandbox_approval: true,
+                rules: true,
+                request_permissions: false,
+                mcp_elicitations: true,
+            },
+        ))
+        .expect("test setup should allow updating approval policy");
+
+    let session = Arc::new(session);
+    let turn_context = Arc::new(turn_context);
+    let call_id = "call-1".to_string();
+    let expected_response = codex_protocol::request_permissions::RequestPermissionsResponse {
+        permissions: codex_protocol::models::PermissionProfile {
+            network: Some(codex_protocol::models::NetworkPermissions {
+                enabled: Some(true),
+            }),
+            ..Default::default()
+        },
+        scope: codex_protocol::request_permissions::PermissionGrantScope::Turn,
+    };
+
+    let handle = tokio::spawn({
+        let session = Arc::clone(&session);
+        let turn_context = Arc::clone(&turn_context);
+        let call_id = call_id.clone();
+        async move {
+            session
+                .request_permissions(
+                    turn_context.as_ref(),
+                    call_id,
+                    codex_protocol::request_permissions::RequestPermissionsArgs {
+                        reason: Some("need network".to_string()),
+                        permissions: codex_protocol::models::PermissionProfile {
+                            network: Some(codex_protocol::models::NetworkPermissions {
+                                enabled: Some(true),
+                            }),
+                            ..Default::default()
+                        },
+                    },
+                )
+                .await
+        }
+    });
+
+    let request_event = tokio::time::timeout(StdDuration::from_secs(1), rx.recv())
+        .await
+        .expect("request_permissions event timed out")
+        .expect("request_permissions event missing");
+    let EventMsg::RequestPermissions(request) = request_event.msg else {
+        panic!("expected request_permissions event");
+    };
+    assert_eq!(request.call_id, call_id);
+
+    session
+        .notify_request_permissions_response(&request.call_id, expected_response.clone())
+        .await;
+
+    let response = tokio::time::timeout(StdDuration::from_secs(1), handle)
+        .await
+        .expect("request_permissions future timed out")
+        .expect("request_permissions join error");
+
+    assert_eq!(response, Some(expected_response));
+}
+
+#[tokio::test]
+async fn request_permissions_returns_empty_grant_when_reject_policy_blocks_requests() {
+    let (session, mut turn_context, rx) = make_session_and_context_with_rx().await;
+    *session.active_turn.lock().await = Some(ActiveTurn::default());
+    Arc::get_mut(&mut turn_context)
+        .expect("single turn context ref")
+        .approval_policy
+        .set(crate::protocol::AskForApproval::Reject(
+            crate::protocol::RejectConfig {
+                sandbox_approval: false,
+                rules: false,
+                request_permissions: true,
+                mcp_elicitations: false,
+            },
+        ))
+        .expect("test setup should allow updating approval policy");
+
+    let response = session
+        .request_permissions(
+            &turn_context,
+            "call-1".to_string(),
+            codex_protocol::request_permissions::RequestPermissionsArgs {
+                reason: Some("need network".to_string()),
+                permissions: codex_protocol::models::PermissionProfile {
+                    network: Some(codex_protocol::models::NetworkPermissions {
+                        enabled: Some(true),
+                    }),
+                    ..Default::default()
+                },
+            },
+        )
+        .await;
+
+    assert_eq!(
+        response,
+        Some(
+            codex_protocol::request_permissions::RequestPermissionsResponse {
+                permissions: codex_protocol::models::PermissionProfile::default(),
+                scope: codex_protocol::request_permissions::PermissionGrantScope::Turn,
+            }
+        )
+    );
+    assert!(
+        tokio::time::timeout(StdDuration::from_millis(50), rx.recv())
+            .await
+            .is_err(),
+        "unexpected request_permissions event emitted",
+    );
+}
+
 #[tokio::test]
 async fn submit_with_id_captures_current_span_trace_context() {
     let (session, _turn_context) = make_session_and_context().await;

codex-rs/core/src/codex_tests_guardian.rs

@@ -16,8 +16,16 @@ use codex_execpolicy::RuleMatch;
 use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::NetworkPermissions;
 use codex_protocol::models::PermissionProfile;
+use codex_protocol::permissions::FileSystemSandboxPolicy;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use core_test_support::codex_linux_sandbox_exe_or_skip;
+use core_test_support::responses::ev_assistant_message;
+use core_test_support::responses::ev_completed;
+use core_test_support::responses::ev_response_created;
+use core_test_support::responses::mount_sse_once;
+use core_test_support::responses::sse;
+use core_test_support::responses::start_mock_server;
 use pretty_assertions::assert_eq;
 use serde::Deserialize;
 use std::collections::HashMap;
@@ -27,6 +35,29 @@ use tempfile::tempdir;
 
 #[tokio::test]
 async fn guardian_allows_shell_additional_permissions_requests_past_policy_validation() {
+    let server = start_mock_server().await;
+    let _request_log = mount_sse_once(
+        &server,
+        sse(vec![
+            ev_response_created("resp-guardian"),
+            ev_assistant_message(
+                "msg-guardian",
+                &serde_json::json!({
+                    "risk_level": "low",
+                    "risk_score": 5,
+                    "rationale": "The request only widens permissions for a benign local echo command.",
+                    "evidence": [{
+                        "message": "The planned command is an `echo hi` smoke test.",
+                        "why": "This is low-risk and does not attempt destructive or exfiltrating behavior.",
+                    }],
+                })
+                .to_string(),
+            ),
+            ev_completed("resp-guardian"),
+        ]),
+    )
+    .await;
+
     let (mut session, mut turn_context_raw) = make_session_and_context().await;
     turn_context_raw.codex_linux_sandbox_exe = codex_linux_sandbox_exe_or_skip!();
     turn_context_raw
@@ -45,13 +76,34 @@ async fn guardian_allows_shell_additional_permissions_requests_past_policy_valid
         .sandbox_policy
         .set(SandboxPolicy::DangerFullAccess)
         .expect("test setup should allow updating sandbox policy");
+    // This test is about request-permissions validation, not managed sandbox
+    // policy enforcement. Widen the derived sandbox policies directly so the
+    // command runs without depending on a platform sandbox binary.
+    turn_context_raw.file_system_sandbox_policy =
+        FileSystemSandboxPolicy::from(turn_context_raw.sandbox_policy.get());
+    turn_context_raw.network_sandbox_policy =
+        NetworkSandboxPolicy::from(turn_context_raw.sandbox_policy.get());
+    let mut config = (*turn_context_raw.config).clone();
+    config.model_provider.base_url = Some(format!("{}/v1", server.uri()));
+    let config = Arc::new(config);
+    let models_manager = Arc::new(crate::test_support::models_manager_with_provider(
+        config.codex_home.clone(),
+        Arc::clone(&session.services.auth_manager),
+        config.model_provider.clone(),
+    ));
+    session.services.models_manager = models_manager;
+    turn_context_raw.config = Arc::clone(&config);
+    turn_context_raw.provider = config.model_provider.clone();
     let session = Arc::new(session);
     let turn_context = Arc::new(turn_context_raw);
+    let expiration_ms: u64 = if cfg!(windows) { 2_500 } else { 1_000 };
 
     let params = ExecParams {
         command: if cfg!(windows) {
             vec![
                 "cmd.exe".to_string(),
+                "/Q".to_string(),
+                "/D".to_string(),
                 "/C".to_string(),
                 "echo hi".to_string(),
             ]
@@ -63,7 +115,7 @@ async fn guardian_allows_shell_additional_permissions_requests_past_policy_valid
             ]
         },
         cwd: turn_context.cwd.clone(),
-        expiration: 1000.into(),
+        expiration: expiration_ms.into(),
         env: HashMap::new(),
         network: None,
         sandbox_permissions: SandboxPermissions::WithAdditionalPermissions,

codex-rs/core/src/config/config_tests.rs

@@ -574,6 +574,156 @@ fn permissions_profiles_reject_nested_entries_for_non_project_roots() -> std::io
     Ok(())
 }
 
+fn load_workspace_permission_profile(profile: PermissionProfileToml) -> std::io::Result<Config> {
+    let codex_home = TempDir::new()?;
+    let cwd = TempDir::new()?;
+    std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+
+    Config::load_from_base_config_with_overrides(
+        ConfigToml {
+            default_permissions: Some("workspace".to_string()),
+            permissions: Some(PermissionsToml {
+                entries: BTreeMap::from([("workspace".to_string(), profile)]),
+            }),
+            ..Default::default()
+        },
+        ConfigOverrides {
+            cwd: Some(cwd.path().to_path_buf()),
+            ..Default::default()
+        },
+        codex_home.path().to_path_buf(),
+    )
+}
+
+#[test]
+fn permissions_profiles_allow_unknown_special_paths() -> std::io::Result<()> {
+    let config = load_workspace_permission_profile(PermissionProfileToml {
+        filesystem: Some(FilesystemPermissionsToml {
+            entries: BTreeMap::from([(
+                ":future_special_path".to_string(),
+                FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
+            )]),
+        }),
+        network: None,
+    })?;
+
+    assert_eq!(
+        config.permissions.file_system_sandbox_policy,
+        FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::unknown(":future_special_path", None),
+            },
+            access: FileSystemAccessMode::Read,
+        }]),
+    );
+    assert_eq!(
+        config.permissions.sandbox_policy.get(),
+        &SandboxPolicy::ReadOnly {
+            access: ReadOnlyAccess::Restricted {
+                include_platform_defaults: false,
+                readable_roots: Vec::new(),
+            },
+            network_access: false,
+        }
+    );
+    assert!(
+        config.startup_warnings.iter().any(|warning| warning.contains(
+            "Configured filesystem path `:future_special_path` is not recognized by this version of Codex and will be ignored."
+        )),
+        "{:?}",
+        config.startup_warnings
+    );
+    Ok(())
+}
+
+#[test]
+fn permissions_profiles_allow_unknown_special_paths_with_nested_entries() -> std::io::Result<()> {
+    let config = load_workspace_permission_profile(PermissionProfileToml {
+        filesystem: Some(FilesystemPermissionsToml {
+            entries: BTreeMap::from([(
+                ":future_special_path".to_string(),
+                FilesystemPermissionToml::Scoped(BTreeMap::from([(
+                    "docs".to_string(),
+                    FileSystemAccessMode::Read,
+                )])),
+            )]),
+        }),
+        network: None,
+    })?;
+
+    assert_eq!(
+        config.permissions.file_system_sandbox_policy,
+        FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::unknown(":future_special_path", Some("docs".into())),
+            },
+            access: FileSystemAccessMode::Read,
+        }]),
+    );
+    assert!(
+        config.startup_warnings.iter().any(|warning| warning.contains(
+            "Configured filesystem path `:future_special_path` with nested entry `docs` is not recognized by this version of Codex and will be ignored."
+        )),
+        "{:?}",
+        config.startup_warnings
+    );
+    Ok(())
+}
+
+#[test]
+fn permissions_profiles_allow_missing_filesystem_with_warning() -> std::io::Result<()> {
+    let config = load_workspace_permission_profile(PermissionProfileToml {
+        filesystem: None,
+        network: None,
+    })?;
+
+    assert_eq!(
+        config.permissions.file_system_sandbox_policy,
+        FileSystemSandboxPolicy::restricted(Vec::new())
+    );
+    assert_eq!(
+        config.permissions.sandbox_policy.get(),
+        &SandboxPolicy::ReadOnly {
+            access: ReadOnlyAccess::Restricted {
+                include_platform_defaults: false,
+                readable_roots: Vec::new(),
+            },
+            network_access: false,
+        }
+    );
+    assert!(
+        config.startup_warnings.iter().any(|warning| warning.contains(
+            "Permissions profile `workspace` does not define any recognized filesystem entries for this version of Codex."
+        )),
+        "{:?}",
+        config.startup_warnings
+    );
+    Ok(())
+}
+
+#[test]
+fn permissions_profiles_allow_empty_filesystem_with_warning() -> std::io::Result<()> {
+    let config = load_workspace_permission_profile(PermissionProfileToml {
+        filesystem: Some(FilesystemPermissionsToml {
+            entries: BTreeMap::new(),
+        }),
+        network: None,
+    })?;
+
+    assert_eq!(
+        config.permissions.file_system_sandbox_policy,
+        FileSystemSandboxPolicy::restricted(Vec::new())
+    );
+    assert!(
+        config.startup_warnings.iter().any(|warning| warning.contains(
+            "Permissions profile `workspace` does not define any recognized filesystem entries for this version of Codex."
+        )),
+        "{:?}",
+        config.startup_warnings
+    );
+    Ok(())
+}
+
 #[test]
 fn permissions_profiles_reject_project_root_parent_traversal() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;

codex-rs/core/src/config/mod.rs

@@ -2006,7 +2006,11 @@ impl Config {
             let configured_network_proxy_config =
                 network_proxy_config_from_profile_network(profile.network.as_ref());
             let (mut file_system_sandbox_policy, network_sandbox_policy) =
-                compile_permission_profile(permissions, default_permissions)?;
+                compile_permission_profile(
+                    permissions,
+                    default_permissions,
+                    &mut startup_warnings,
+                )?;
             let mut sandbox_policy = file_system_sandbox_policy
                 .to_legacy_sandbox_policy(network_sandbox_policy, &resolved_cwd)?;
             if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
@@ -2039,7 +2043,8 @@ impl Config {
                     }
                 }
             }
-            let file_system_sandbox_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
+            let file_system_sandbox_policy =
+                FileSystemSandboxPolicy::from_legacy_sandbox_policy(&sandbox_policy, &resolved_cwd);
             let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
             (
                 configured_network_proxy_config,
@@ -2405,6 +2410,7 @@ impl Config {
             } else {
                 FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_read_denies(
                     &effective_sandbox_policy,
+                    &resolved_cwd,
                     &file_system_sandbox_policy,
                 )
             };

codex-rs/core/src/config/permissions.rs

@@ -1,3 +1,4 @@
+use std::borrow::Cow;
 use std::collections::BTreeMap;
 use std::io;
 use std::path::Component;
@@ -158,30 +159,27 @@ pub(crate) fn resolve_permission_profile<'a>(
 pub(crate) fn compile_permission_profile(
     permissions: &PermissionsToml,
     profile_name: &str,
+    startup_warnings: &mut Vec<String>,
 ) -> io::Result<(FileSystemSandboxPolicy, NetworkSandboxPolicy)> {
     let profile = resolve_permission_profile(permissions, profile_name)?;
 
-    let filesystem = profile.filesystem.as_ref().ok_or_else(|| {
-        io::Error::new(
-            io::ErrorKind::InvalidInput,
-            format!(
-                "permissions profile `{profile_name}` must define a `[permissions.{profile_name}.filesystem]` table"
-            ),
-        )
-    })?;
-
-    if filesystem.is_empty() {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            format!(
-                "permissions profile `{profile_name}` must define at least one filesystem entry"
-            ),
-        ));
-    }
-
     let mut entries = Vec::new();
-    for (path, permission) in &filesystem.entries {
-        compile_filesystem_permission(path, permission, &mut entries)?;
+    if let Some(filesystem) = profile.filesystem.as_ref() {
+        if filesystem.is_empty() {
+            push_warning(
+                startup_warnings,
+                missing_filesystem_entries_warning(profile_name),
+            );
+        } else {
+            for (path, permission) in &filesystem.entries {
+                compile_filesystem_permission(path, permission, &mut entries, startup_warnings)?;
+            }
+        }
+    } else {
+        push_warning(
+            startup_warnings,
+            missing_filesystem_entries_warning(profile_name),
+        );
     }
 
     let network_sandbox_policy = compile_network_sandbox_policy(profile.network.as_ref());
@@ -207,16 +205,17 @@ fn compile_filesystem_permission(
     path: &str,
     permission: &FilesystemPermissionToml,
     entries: &mut Vec<FileSystemSandboxEntry>,
+    startup_warnings: &mut Vec<String>,
 ) -> io::Result<()> {
     match permission {
         FilesystemPermissionToml::Access(access) => entries.push(FileSystemSandboxEntry {
-            path: compile_filesystem_path(path)?,
+            path: compile_filesystem_path(path, startup_warnings)?,
             access: *access,
         }),
         FilesystemPermissionToml::Scoped(scoped_entries) => {
             for (subpath, access) in scoped_entries {
                 entries.push(FileSystemSandboxEntry {
-                    path: compile_scoped_filesystem_path(path, subpath)?,
+                    path: compile_scoped_filesystem_path(path, subpath, startup_warnings)?,
                     access: *access,
                 });
             }
@@ -225,8 +224,12 @@ fn compile_filesystem_permission(
     Ok(())
 }
 
-fn compile_filesystem_path(path: &str) -> io::Result<FileSystemPath> {
-    if let Some(special) = parse_special_path(path)? {
+fn compile_filesystem_path(
+    path: &str,
+    startup_warnings: &mut Vec<String>,
+) -> io::Result<FileSystemPath> {
+    if let Some(special) = parse_special_path(path) {
+        maybe_push_unknown_special_path_warning(&special, startup_warnings);
         return Ok(FileSystemPath::Special { value: special });
     }
 
@@ -234,21 +237,33 @@ fn compile_filesystem_path(path: &str) -> io::Result<FileSystemPath> {
     Ok(FileSystemPath::Path { path })
 }
 
-fn compile_scoped_filesystem_path(path: &str, subpath: &str) -> io::Result<FileSystemPath> {
+fn compile_scoped_filesystem_path(
+    path: &str,
+    subpath: &str,
+    startup_warnings: &mut Vec<String>,
+) -> io::Result<FileSystemPath> {
     if subpath == "." {
-        return compile_filesystem_path(path);
+        return compile_filesystem_path(path, startup_warnings);
     }
 
-    if let Some(special) = parse_special_path(path)? {
-        if !matches!(special, FileSystemSpecialPath::ProjectRoots { .. }) {
-            return Err(io::Error::new(
+    if let Some(special) = parse_special_path(path) {
+        let subpath = parse_relative_subpath(subpath)?;
+        let special = match special {
+            FileSystemSpecialPath::ProjectRoots { .. } => Ok(FileSystemPath::Special {
+                value: FileSystemSpecialPath::project_roots(Some(subpath)),
+            }),
+            FileSystemSpecialPath::Unknown { path, .. } => Ok(FileSystemPath::Special {
+                value: FileSystemSpecialPath::unknown(path, Some(subpath)),
+            }),
+            _ => Err(io::Error::new(
                 io::ErrorKind::InvalidInput,
                 format!("filesystem path `{path}` does not support nested entries"),
-            ));
+            )),
+        }?;
+        if let FileSystemPath::Special { value } = &special {
+            maybe_push_unknown_special_path_warning(value, startup_warnings);
         }
-        return Ok(FileSystemPath::Special {
-            value: FileSystemSpecialPath::project_roots(Some(parse_relative_subpath(subpath)?)),
-        });
+        return Ok(special);
     }
 
     let subpath = parse_relative_subpath(subpath)?;
@@ -257,33 +272,90 @@ fn compile_scoped_filesystem_path(path: &str, subpath: &str) -> io::Result<FileS
     Ok(FileSystemPath::Path { path })
 }
 
-fn parse_special_path(path: &str) -> io::Result<Option<FileSystemSpecialPath>> {
-    let special = match path {
+// WARNING: keep this parser forward-compatible.
+// Adding a new `:special_path` must not make older Codex versions reject the
+// config. Unknown values intentionally round-trip through
+// `FileSystemSpecialPath::Unknown` so they can be surfaced as warnings and
+// ignored, rather than aborting config load.
+fn parse_special_path(path: &str) -> Option<FileSystemSpecialPath> {
+    match path {
         ":root" => Some(FileSystemSpecialPath::Root),
         ":minimal" => Some(FileSystemSpecialPath::Minimal),
         ":project_roots" => Some(FileSystemSpecialPath::project_roots(None)),
         ":tmpdir" => Some(FileSystemSpecialPath::Tmpdir),
-        _ if path.starts_with(':') => {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                format!("unknown filesystem special path `{path}`"),
-            ));
-        }
+        _ if path.starts_with(':') => Some(FileSystemSpecialPath::unknown(path, None)),
         _ => None,
-    };
-
-    Ok(special)
+    }
 }
 
 fn parse_absolute_path(path: &str) -> io::Result<AbsolutePathBuf> {
-    let path_ref = Path::new(path);
-    if !path_ref.is_absolute() && path != "~" && !path.starts_with("~/") {
+    parse_absolute_path_for_platform(path, cfg!(windows))
+}
+
+fn parse_absolute_path_for_platform(path: &str, is_windows: bool) -> io::Result<AbsolutePathBuf> {
+    let path_ref = normalize_absolute_path_for_platform(path, is_windows);
+    if !is_absolute_path_for_platform(path, path_ref.as_ref(), is_windows)
+        && path != "~"
+        && !path.starts_with("~/")
+    {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
             format!("filesystem path `{path}` must be absolute, use `~/...`, or start with `:`"),
         ));
     }
-    AbsolutePathBuf::from_absolute_path(path_ref)
+    AbsolutePathBuf::from_absolute_path(path_ref.as_ref())
+}
+
+fn is_absolute_path_for_platform(path: &str, normalized_path: &Path, is_windows: bool) -> bool {
+    if is_windows {
+        is_windows_absolute_path(path)
+            || is_windows_absolute_path(&normalized_path.to_string_lossy())
+    } else {
+        normalized_path.is_absolute()
+    }
+}
+
+fn normalize_absolute_path_for_platform(path: &str, is_windows: bool) -> Cow<'_, Path> {
+    if !is_windows {
+        return Cow::Borrowed(Path::new(path));
+    }
+
+    match normalize_windows_device_path(path) {
+        Some(normalized) => Cow::Owned(PathBuf::from(normalized)),
+        None => Cow::Borrowed(Path::new(path)),
+    }
+}
+
+fn normalize_windows_device_path(path: &str) -> Option<String> {
+    if let Some(unc) = path.strip_prefix(r"\\?\UNC\") {
+        return Some(format!(r"\\{unc}"));
+    }
+    if let Some(unc) = path.strip_prefix(r"\\.\UNC\") {
+        return Some(format!(r"\\{unc}"));
+    }
+    if let Some(path) = path.strip_prefix(r"\\?\")
+        && is_windows_drive_absolute_path(path)
+    {
+        return Some(path.to_string());
+    }
+    if let Some(path) = path.strip_prefix(r"\\.\")
+        && is_windows_drive_absolute_path(path)
+    {
+        return Some(path.to_string());
+    }
+    None
+}
+
+fn is_windows_absolute_path(path: &str) -> bool {
+    is_windows_drive_absolute_path(path) || path.starts_with(r"\\")
+}
+
+fn is_windows_drive_absolute_path(path: &str) -> bool {
+    let bytes = path.as_bytes();
+    bytes.len() >= 3
+        && bytes[0].is_ascii_alphabetic()
+        && bytes[1] == b':'
+        && matches!(bytes[2], b'\\' | b'/')
 }
 
 fn parse_relative_subpath(subpath: &str) -> io::Result<PathBuf> {
@@ -304,3 +376,48 @@ fn parse_relative_subpath(subpath: &str) -> io::Result<PathBuf> {
         ),
     ))
 }
+
+fn push_warning(startup_warnings: &mut Vec<String>, message: String) {
+    tracing::warn!("{message}");
+    startup_warnings.push(message);
+}
+
+fn missing_filesystem_entries_warning(profile_name: &str) -> String {
+    format!(
+        "Permissions profile `{profile_name}` does not define any recognized filesystem entries for this version of Codex. Filesystem access will remain restricted. Upgrade Codex if this profile expects filesystem permissions."
+    )
+}
+
+fn maybe_push_unknown_special_path_warning(
+    special: &FileSystemSpecialPath,
+    startup_warnings: &mut Vec<String>,
+) {
+    let FileSystemSpecialPath::Unknown { path, subpath } = special else {
+        return;
+    };
+    push_warning(
+        startup_warnings,
+        match subpath.as_deref() {
+            Some(subpath) => format!(
+                "Configured filesystem path `{path}` with nested entry `{}` is not recognized by this version of Codex and will be ignored. Upgrade Codex if this path is required.",
+                subpath.display()
+            ),
+            None => format!(
+                "Configured filesystem path `{path}` is not recognized by this version of Codex and will be ignored. Upgrade Codex if this path is required."
+            ),
+        },
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn normalize_absolute_path_for_platform_simplifies_windows_verbatim_paths() {
+        let parsed =
+            normalize_absolute_path_for_platform(r"\\?\D:\c\x\worktrees\2508\swift-base", true);
+        assert_eq!(parsed, PathBuf::from(r"D:\c\x\worktrees\2508\swift-base"));
+    }
+}

codex-rs/core/src/context_manager/history_tests.rs

@@ -421,9 +421,23 @@ fn for_prompt_rewrites_image_generation_calls_when_images_are_supported() {
             ResponseItem::Message {
                 id: None,
                 role: "user".to_string(),
-                content: vec![ContentItem::InputImage {
-                    image_url: "data:image/png;base64,Zm9v".to_string(),
-                }],
+                content: vec![
+                    ContentItem::InputText {
+                        text: "Image Generation Call".to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "Image ID: ig_123".to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "Prompt: lobster".to_string(),
+                    },
+                    ContentItem::InputImage {
+                        image_url: "data:image/png;base64,Zm9v".to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "Saved to: CWD".to_string(),
+                    },
+                ],
                 end_turn: None,
                 phase: None,
             },
@@ -475,10 +489,24 @@ fn for_prompt_rewrites_image_generation_calls_when_images_are_unsupported() {
             ResponseItem::Message {
                 id: None,
                 role: "user".to_string(),
-                content: vec![ContentItem::InputText {
-                    text: "image content omitted because you do not support image input"
-                        .to_string(),
-                }],
+                content: vec![
+                    ContentItem::InputText {
+                        text: "Image Generation Call".to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "Image ID: ig_123".to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "Prompt: lobster".to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "image content omitted because you do not support image input"
+                            .to_string(),
+                    },
+                    ContentItem::InputText {
+                        text: "Saved to: CWD".to_string(),
+                    },
+                ],
                 end_turn: None,
                 phase: None,
             },

codex-rs/core/src/context_manager/normalize.rs

@@ -215,17 +215,37 @@ pub(crate) fn rewrite_image_generation_calls_for_stateless_input(items: &mut Vec
     *items = original_items
         .into_iter()
         .map(|item| match item {
-            ResponseItem::ImageGenerationCall { result, .. } => {
+            ResponseItem::ImageGenerationCall {
+                id,
+                revised_prompt,
+                result,
+                ..
+            } => {
                 let image_url = if result.starts_with("data:") {
                     result
                 } else {
                     format!("data:image/png;base64,{result}")
                 };
+                let revised_prompt = revised_prompt.unwrap_or_default();
 
                 ResponseItem::Message {
                     id: None,
                     role: "user".to_string(),
-                    content: vec![ContentItem::InputImage { image_url }],
+                    content: vec![
+                        ContentItem::InputText {
+                            text: "Image Generation Call".to_string(),
+                        },
+                        ContentItem::InputText {
+                            text: format!("Image ID: {id}"),
+                        },
+                        ContentItem::InputText {
+                            text: format!("Prompt: {revised_prompt}"),
+                        },
+                        ContentItem::InputImage { image_url },
+                        ContentItem::InputText {
+                            text: "Saved to: CWD".to_string(),
+                        },
+                    ],
                     end_turn: None,
                     phase: None,
                 }

codex-rs/core/src/context_manager/updates.rs

@@ -43,7 +43,6 @@ fn build_permissions_update_item(
     Some(DeveloperInstructions::from_policy(
         next.sandbox_policy.get(),
         next.approval_policy.value(),
-        next.features.enabled(Feature::GuardianApproval),
         exec_policy,
         &next.cwd,
         next.features.enabled(Feature::RequestPermissions),

codex-rs/core/src/exec_policy.rs

@@ -1589,6 +1589,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 AskForApproval::Reject(RejectConfig {
                     sandbox_approval: false,
                     rules: false,
+                    request_permissions: false,
                     mcp_elicitations: false,
                 }),
                 &SandboxPolicy::new_read_only_policy(),
@@ -1610,6 +1611,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 approval_policy: AskForApproval::Reject(RejectConfig {
                     sandbox_approval: true,
                     rules: false,
+                    request_permissions: false,
                     mcp_elicitations: false,
                 }),
                 sandbox_policy: &SandboxPolicy::new_read_only_policy(),
@@ -1647,6 +1649,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 approval_policy: AskForApproval::Reject(RejectConfig {
                     sandbox_approval: true,
                     rules: false,
+                    request_permissions: false,
                     mcp_elicitations: false,
                 }),
                 sandbox_policy: &SandboxPolicy::new_read_only_policy(),
@@ -1682,6 +1685,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 approval_policy: AskForApproval::Reject(RejectConfig {
                     sandbox_approval: false,
                     rules: true,
+                    request_permissions: false,
                     mcp_elicitations: false,
                 }),
                 sandbox_policy: &SandboxPolicy::new_read_only_policy(),

codex-rs/core/src/features.rs

@@ -93,6 +93,8 @@ pub enum Feature {
     ApplyPatchFreeform,
     /// Allow requesting additional filesystem permissions while staying sandboxed.
     RequestPermissions,
+    /// Expose the built-in request_permissions tool.
+    RequestPermissionsTool,
     /// Allow the model to request web searches that fetch live content.
     WebSearchRequest,
     /// Allow the model to request web searches that fetch cached content.
@@ -147,7 +149,7 @@ pub enum Feature {
     Steer,
     /// Allow request_user_input in Default collaboration mode.
     DefaultModeRequestUserInput,
-    /// Enable guardian subagent approvals.
+    /// Enable automatic review for approval prompts.
     GuardianApproval,
     /// Enable collaboration modes (Plan, Default).
     /// Kept for config backward compatibility; behavior is always collaboration-modes-enabled.
@@ -581,6 +583,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::UnderDevelopment,
         default_enabled: false,
     },
+    FeatureSpec {
+        id: Feature::RequestPermissionsTool,
+        key: "request_permissions_tool",
+        stage: Stage::UnderDevelopment,
+        default_enabled: false,
+    },
     FeatureSpec {
         id: Feature::UseLinuxSandboxBwrap,
         key: "use_linux_sandbox_bwrap",
@@ -702,8 +710,8 @@ pub const FEATURES: &[FeatureSpec] = &[
         id: Feature::GuardianApproval,
         key: "guardian_approval",
         stage: Stage::Experimental {
-            name: "Guardian approvals",
-            menu_description: "Let a guardian subagent review `on-request` approval prompts instead of showing them to you, including sandbox escapes and blocked network access.",
+            name: "Automatic approval review",
+            menu_description: "Dispatch `on-request` approval prompts (for e.g. sandbox escapes or blocked network access) to a carefully-prompted security reviewer subagent rather than blocking the agent on your input.",
             announcement: "",
         },
         default_enabled: false,
@@ -909,17 +917,35 @@ mod tests {
         let stage = spec.stage;
 
         assert!(matches!(stage, Stage::Experimental { .. }));
-        assert_eq!(stage.experimental_menu_name(), Some("Guardian approvals"));
+        assert_eq!(
+            stage.experimental_menu_name(),
+            Some("Automatic approval review")
+        );
         assert_eq!(
             stage.experimental_menu_description().map(str::to_owned),
             Some(
-                "Let a guardian subagent review `on-request` approval prompts instead of showing them to you, including sandbox escapes and blocked network access.".to_string()
+                "Dispatch `on-request` approval prompts (for e.g. sandbox escapes or blocked network access) to a carefully-prompted security reviewer subagent rather than blocking the agent on your input.".to_string()
             )
         );
         assert_eq!(stage.experimental_announcement(), None);
         assert_eq!(Feature::GuardianApproval.default_enabled(), false);
     }
 
+    #[test]
+    fn request_permissions_is_under_development() {
+        assert_eq!(Feature::RequestPermissions.stage(), Stage::UnderDevelopment);
+        assert_eq!(Feature::RequestPermissions.default_enabled(), false);
+    }
+
+    #[test]
+    fn request_permissions_tool_is_under_development() {
+        assert_eq!(
+            Feature::RequestPermissionsTool.stage(),
+            Stage::UnderDevelopment
+        );
+        assert_eq!(Feature::RequestPermissionsTool.default_enabled(), false);
+    }
+
     #[test]
     fn image_generation_is_under_development() {
         assert_eq!(Feature::ImageGeneration.stage(), Stage::UnderDevelopment);