From d31ede063409d19c330af9134b84ba98dc9587f2 Mon Sep 17 00:00:00 2001
From: Cooper Gamble <cooper@openai.com>
Date: Tue, 2 Jun 2026 22:14:07 +0000
Subject: [PATCH] [codex] preserve native integrity state for Apps uploads [ci
 changed_files]

---
 codex-rs/core/src/client.rs          |  4 ++++
 codex-rs/core/src/mcp_openai_file.rs | 26 ++++++++++++++++++++++----
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/codex-rs/core/src/client.rs b/codex-rs/core/src/client.rs
index 2564c323f9..6327fda059 100644
--- a/codex-rs/core/src/client.rs
+++ b/codex-rs/core/src/client.rs
@@ -415,6 +415,10 @@ impl ModelClient {
             .map(NativeIntegrityStateContext::surface)
     }
 
+    pub(crate) fn native_integrity_state_context(&self) -> Option<NativeIntegrityStateContext> {
+        self.state.native_integrity_state.clone()
+    }
+
     pub(crate) fn set_native_integrity_surface(&self, surface: NativeIntegritySurface) {
         if self
             .state
diff --git a/codex-rs/core/src/mcp_openai_file.rs b/codex-rs/core/src/mcp_openai_file.rs
index ae44515c62..a322389368 100644
--- a/codex-rs/core/src/mcp_openai_file.rs
+++ b/codex-rs/core/src/mcp_openai_file.rs
@@ -13,6 +13,7 @@
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use codex_api::upload_local_file;
+use codex_client::NativeIntegrityStateContext;
 use codex_login::CodexAuth;
 use serde_json::Value as JsonValue;
 
@@ -33,15 +34,21 @@ pub(crate) async fn rewrite_mcp_tool_arguments_for_openai_files(
         return Ok(Some(arguments_value));
     };
     let auth = sess.services.auth_manager.auth().await;
+    let native_integrity_state = sess.services.model_client.native_integrity_state_context();
     let mut rewritten_arguments = arguments.clone();
 
     for field_name in openai_file_input_params {
         let Some(value) = arguments.get(field_name) else {
             continue;
         };
-        let Some(uploaded_value) =
-            rewrite_argument_value_for_openai_files(turn_context, auth.as_ref(), field_name, value)
-                .await?
+        let Some(uploaded_value) = rewrite_argument_value_for_openai_files(
+            turn_context,
+            auth.as_ref(),
+            native_integrity_state.clone(),
+            field_name,
+            value,
+        )
+        .await?
         else {
             continue;
         };
@@ -58,6 +65,7 @@ pub(crate) async fn rewrite_mcp_tool_arguments_for_openai_files(
 async fn rewrite_argument_value_for_openai_files(
     turn_context: &TurnContext,
     auth: Option<&CodexAuth>,
+    native_integrity_state: Option<NativeIntegrityStateContext>,
     field_name: &str,
     value: &JsonValue,
 ) -> Result<Option<JsonValue>, String> {
@@ -66,6 +74,7 @@ async fn rewrite_argument_value_for_openai_files(
             let rewritten = build_uploaded_local_argument_value(
                 turn_context,
                 auth,
+                native_integrity_state,
                 field_name,
                 /*index*/ None,
                 path_or_file_ref,
@@ -82,6 +91,7 @@ async fn rewrite_argument_value_for_openai_files(
                 let rewritten = build_uploaded_local_argument_value(
                     turn_context,
                     auth,
+                    native_integrity_state.clone(),
                     field_name,
                     Some(index),
                     path_or_file_ref,
@@ -98,6 +108,7 @@ async fn rewrite_argument_value_for_openai_files(
 async fn build_uploaded_local_argument_value(
     turn_context: &TurnContext,
     auth: Option<&CodexAuth>,
+    native_integrity_state: Option<NativeIntegrityStateContext>,
     field_name: &str,
     index: Option<usize>,
     file_path: &str,
@@ -114,7 +125,11 @@ async fn build_uploaded_local_argument_value(
             "ChatGPT auth is required to upload local files for Codex Apps tools".to_string(),
         );
     }
-    let upload_auth = codex_model_provider::auth_provider_from_auth(auth);
+    let upload_auth = codex_model_provider::with_native_integrity_state(
+        codex_model_provider::auth_provider_from_auth(auth),
+        Some(auth),
+        native_integrity_state,
+    );
     let uploaded = upload_local_file(
         turn_context.config.chatgpt_base_url.trim_end_matches('/'),
         upload_auth.as_ref(),
@@ -229,6 +244,7 @@ mod tests {
         let rewritten = build_uploaded_local_argument_value(
             &turn_context,
             Some(&auth),
+            /*native_integrity_state*/ None,
             "file",
             /*index*/ None,
             "file_report.csv",
@@ -312,6 +328,7 @@ mod tests {
         let rewritten = rewrite_argument_value_for_openai_files(
             &turn_context,
             Some(&auth),
+            /*native_integrity_state*/ None,
             "file",
             &serde_json::json!("file_report.csv"),
         )
@@ -429,6 +446,7 @@ mod tests {
         let rewritten = rewrite_argument_value_for_openai_files(
             &turn_context,
             Some(&auth),
+            /*native_integrity_state*/ None,
             "files",
             &serde_json::json!(["one.csv", "two.csv"]),
         )