Add optional process metrics sampling for code-mode hosts (#57841)

## What changed

- Add `GetProcessMetrics` and provider sampling APIs for process ID, start time, cumulative CPU time, and resident memory, exposed through `ThreadManager` without creating a thread or session.
- Distinguish unsupported collection, a locally absent host, and sampling failures. Process-owned providers never start or replace a host when sampling.
- Bound gRPC sampling to one second without retries or explicit connection resets. Run optional collectors on a detached worker with at most one collection in flight, so stalled collection cannot block the HTTP/2 driver or runtime shutdown.

## Testing

Add coverage for snapshots, collector errors and panics, deadlines, overload, and shutdown with a stuck collector. Extend lifecycle tests to check that sampling preserves session state and keepalive behavior without starting or restarting local hosts.

GitOrigin-RevId: eeafe275891d0464636f28a29345a87aed1a12dc

codex-rs/code-mode-protocol/src/grpc/codex.code_mode.v1.proto

@@ -10,6 +10,10 @@ package codex.code_mode.v1;
 // unknown session_id. Clients may retire the session binding on this status.
 // Missing cells use WaitResponse.missing_cell instead.
 service CodeModeHost {
+  // Optional host-level observation. UNIMPLEMENTED means no collector. Sampling
+  // never opens/closes a session and failures affect only this RPC stream.
+  rpc GetProcessMetrics(GetProcessMetricsRequest) returns (GetProcessMetricsResponse);
+
   // Opens a session lease. The first event is always SessionOpened; dropping
   // this stream closes the session and terminates its active cells.
   rpc OpenSession(OpenSessionRequest) returns (stream SessionEvent);
@@ -43,6 +47,15 @@ service CodeModeHost {
   rpc Terminate(TerminateRequest) returns (WaitResponse);
 }
 
+message GetProcessMetricsRequest {}
+
+message GetProcessMetricsResponse {
+  uint32 process_id = 1;
+  double process_start_time_seconds = 2;
+  double cpu_seconds_total = 3;
+  uint64 resident_memory_bytes = 4;
+}
+
 message OpenSessionRequest {
   optional SessionCellExecutionLimits cell_execution_limits = 1;
   // Absent preserves the legacy client-side truncation behavior.

codex-rs/code-mode-protocol/src/lib.rs

@@ -2,6 +2,7 @@ mod description;
 pub mod grpc;
 pub mod host;
 mod json_schema_types;
+mod process_metrics;
 mod response;
 mod runtime;
 mod session;
@@ -24,6 +25,8 @@ pub use description::parse_exec_source;
 pub use description::render_code_mode_sample;
 pub use json_schema_types::DEFAULT_INPUT_SCHEMA_MAX_BYTES;
 pub use json_schema_types::render_json_schema_to_typescript;
+pub use process_metrics::CodeModeProcessMetrics;
+pub use process_metrics::CodeModeProcessMetricsSample;
 pub use response::DEFAULT_IMAGE_DETAIL;
 pub use response::FunctionCallOutputContentItem;
 pub use response::ImageDetail;

codex-rs/code-mode-protocol/src/process_metrics.rs

@@ -0,0 +1,21 @@
+//! Optional process observations, independent of sessions. Process-owned
+//! providers observe existing children; remote transports own connection policy.
+
+/// A cumulative observation of one host process, shared across its sessions.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CodeModeProcessMetrics {
+    pub process_id: u32,
+    /// Unix timestamp, stable for this process across all metrics transports.
+    pub process_start_time_seconds: f64,
+    pub cpu_seconds_total: f64,
+    pub resident_memory_bytes: u64,
+}
+
+/// Unsupported capability and an absent process are distinct from a failed sample.
+#[derive(Clone, Debug, PartialEq)]
+pub enum CodeModeProcessMetricsSample {
+    Unsupported,
+    /// The process owner knows no host is running; never inferred from an RPC status.
+    NotRunning,
+    Snapshot(CodeModeProcessMetrics),
+}

codex-rs/code-mode-protocol/src/session.rs

@@ -223,6 +223,16 @@ pub trait CodeModeSessionProvider: Send + Sync {
         Ok(())
     }
 
+    /// Observes a host without starting a session. Process-owned providers must
+    /// not start or replace a host. Network providers may connect or reconnect
+    /// according to their transport policy. Sampling failures and cancellation
+    /// must not explicitly reset the shared execution connection.
+    fn sample_process_metrics(
+        &self,
+    ) -> CodeModeSessionResultFuture<'_, crate::CodeModeProcessMetricsSample> {
+        Box::pin(async { Ok(crate::CodeModeProcessMetricsSample::Unsupported) })
+    }
+
     fn create_session(&self) -> CodeModeSessionProviderFuture<'_>;
 
     /// Creates a session whose cells share the supplied execution limits.