Propagate Apps tool refreshes to existing threads (#43900)

## Why

Refreshing installed Apps without a thread should update the tools available to existing threads on their next turn.

## What changed

- Publish live tool catalogs to clients with matching transport, auth, protocol, and listing settings within the same account and home directory. Ignore the thread attribution header when matching scopes.
- Adopt updated tools before catalog reads and new calls, preserving running calls and rejecting calls prepared against an outdated catalog revision.
- Keep the newest successful fetch per scope so older refreshes cannot overwrite newer tools, and exclude disk snapshots from live updates.

## Testing

Add regression coverage for refresh propagation to an existing thread without another tools listing, scope and account isolation, out-of-order refreshes, late client startup, and running versus stale prepared calls.

GitOrigin-RevId: 7a5ee34e23742ce374c6647dc8928b76ea622448

codex-rs/app-server/tests/suite/v2/app_installed.rs

@@ -103,6 +103,74 @@ async fn installed_apps_force_refresh_only_refreshes_tools_snapshot() -> Result<
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn installed_apps_threadless_refresh_updates_existing_thread_tools() -> Result<()> {
+    let fixture = InstalledAppsFixture::start().await?;
+    fixture.set_tools(vec![connector_tool("alpha", "Alpha")?]);
+    let responses_server = responses::start_mock_server().await;
+    let codex_home = configured_codex_home(fixture.base_url())?;
+    MockResponsesConfig::new(&responses_server.uri())
+        .with_root_config(&format!(
+            "chatgpt_base_url = {:?}\nmcp_oauth_credentials_store = \"file\"",
+            fixture.base_url(),
+        ))
+        .enable_feature(Feature::Apps)
+        .disable_feature(Feature::CodeMode)
+        .disable_feature(Feature::CodeModeOnly)
+        .disable_feature(Feature::ToolSearch)
+        .write(codex_home.path())?;
+    let mut app_server = start_app_server(codex_home.path()).await?;
+    let ThreadStartResponse { thread, .. } = app_server
+        .start_thread(ThreadStartParams::default())
+        .await?;
+
+    for (index, (connector_id, connector_name)) in [("alpha", "Alpha"), ("beta", "Beta")]
+        .into_iter()
+        .enumerate()
+    {
+        if index > 0 {
+            fixture.set_tools(vec![connector_tool(connector_id, connector_name)?]);
+            send_installed_request(&mut app_server, /*force_refresh*/ true).await?;
+        }
+        let response_id = format!("response-{connector_id}");
+        let response = responses::mount_sse_once(
+            &responses_server,
+            responses::sse(vec![
+                responses::ev_response_created(&response_id),
+                responses::ev_assistant_message("message", "done"),
+                responses::ev_completed(&response_id),
+            ]),
+        )
+        .await;
+        app_server
+            .start_turn_and_wait_for_completion(TurnStartParams {
+                thread_id: thread.id.clone(),
+                input: vec![UserInput::Text {
+                    text: "Show the available apps".to_string(),
+                    text_elements: Vec::new(),
+                }],
+                ..Default::default()
+            })
+            .await?;
+
+        let body = response.single_request().body_json();
+        for candidate in ["alpha", "beta"] {
+            assert_eq!(
+                responses::namespace_child_tool(
+                    &body,
+                    &format!("mcp__codex_apps__{candidate}"),
+                    &format!("connector_{candidate}"),
+                )
+                .is_some(),
+                candidate == connector_id,
+                "the existing thread should expose the refreshed Apps catalog: {body}",
+            );
+        }
+        assert_eq!(fixture.list_tools_calls(), index + 1);
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn installed_apps_global_disable_retains_tool_derived_identities() -> Result<()> {
     let fixture = InstalledAppsFixture::start().await?;