Remove Guardian subagent-spawner plumbing (#45491)

## What changed

- Remove `AgentSpawner` and `AgentSpawnFuture` from the extension API, along with the Guardian wrapper, thread lifecycle context, and app-server injection plumbing.
- Define `InternalSessionSpawnFuture` directly as a boxed future instead of aliasing `AgentSpawnFuture`.
- Raise the workspace `rustls` minimum version to `0.23.45`.

GitOrigin-RevId: b7319dee41bfb869479afeb7555a6f050c4d00a5

codex-rs/app-server/src/extensions.rs

@@ -8,13 +8,9 @@ use codex_app_server_protocol::ThreadGoal;
 use codex_app_server_protocol::ThreadGoalUpdatedNotification;
 use codex_app_server_protocol::ThreadQueueChangedNotification;
 use codex_app_server_protocol::WarningNotification;
-use codex_core::NewThread;
-use codex_core::StartThreadOptions;
 use codex_core::ThreadManager;
 use codex_core::config::Config;
 use codex_exec_server::EnvironmentManager;
-use codex_extension_api::AgentSpawnFuture;
-use codex_extension_api::AgentSpawner;
 use codex_extension_api::ExtensionEventSink;
 use codex_extension_api::ExtensionRegistry;
 use codex_extension_api::ExtensionRegistryBuilder;
@@ -25,7 +21,6 @@ use codex_goal_extension::GoalService;
 use codex_http_client::HttpClientFactory;
 use codex_login::AuthManager;
 use codex_protocol::ThreadId;
-use codex_protocol::error::CodexErr;
 use codex_protocol::protocol::Event;
 use codex_protocol::protocol::EventMsg;
 use codex_queue_extension::QueuedItemService;
@@ -52,13 +47,9 @@ pub(crate) struct ThreadExtensionDependencies {
     pub(crate) turn_start_admission: Option<Arc<dyn TurnStartAdmission>>,
 }
 
-pub(crate) fn thread_extensions<S>(
-    guardian_agent_spawner: S,
+pub(crate) fn thread_extensions(
     dependencies: ThreadExtensionDependencies,
-) -> Arc<ExtensionRegistry<Config>>
-where
-    S: AgentSpawner<StartThreadOptions, Spawned = NewThread, Error = CodexErr> + 'static,
-{
+) -> Arc<ExtensionRegistry<Config>> {
     let ThreadExtensionDependencies {
         event_sink,
         auth_manager,
@@ -101,12 +92,7 @@ where
         git_attribution_base_url,
         http_client_factory,
     );
-    codex_guardian_v2::install(
-        &mut builder,
-        guardian_agent_spawner,
-        auth_manager.clone(),
-        thread_manager,
-    );
+    codex_guardian_v2::install(&mut builder, auth_manager.clone(), thread_manager);
     codex_memories_extension::install(&mut builder, codex_otel::global());
     codex_mcp_extension::install(&mut builder);
     codex_mcp_extension::install_executor_plugins(&mut builder, environment_manager);
@@ -309,24 +295,6 @@ impl ExtensionEventSink for AppServerExtensionEventSink {
     }
 }
 
-pub(crate) fn guardian_agent_spawner(
-    thread_manager: Weak<ThreadManager>,
-) -> impl AgentSpawner<StartThreadOptions, Spawned = NewThread, Error = CodexErr> {
-    move |forked_from_thread_id: ThreadId,
-          options: StartThreadOptions|
-          -> AgentSpawnFuture<'static, NewThread, CodexErr> {
-        let thread_manager = thread_manager.clone();
-        Box::pin(async move {
-            let thread_manager = thread_manager.upgrade().ok_or_else(|| {
-                CodexErr::UnsupportedOperation("thread manager dropped".to_string())
-            })?;
-            thread_manager
-                .spawn_subagent(forked_from_thread_id, options)
-                .await
-        })
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use codex_protocol::protocol::ThreadGoal as CoreThreadGoal;

codex-rs/app-server/src/mcp_refresh.rs

@@ -65,7 +65,6 @@ async fn load_refresh_config(
 mod tests {
     use super::*;
     use crate::extensions::ThreadExtensionDependencies;
-    use crate::extensions::guardian_agent_spawner;
     use crate::extensions::thread_extensions;
     use codex_arg0::Arg0DispatchPaths;
     use codex_config::CloudConfigBundleLoader;
@@ -326,23 +325,20 @@ enabled = false
                 codex_core::CodexAppsToolsCache::default(),
                 SessionSource::Exec,
                 Arc::clone(&environment_manager),
-                thread_extensions(
-                    guardian_agent_spawner(thread_manager.clone()),
-                    ThreadExtensionDependencies {
-                        event_sink: Arc::new(NoopExtensionEventSink),
-                        auth_manager: auth_manager.clone(),
-                        state_db: Some(state_db.clone()),
-                        analytics_events_client: codex_analytics::AnalyticsEventsClient::disabled(),
-                        thread_manager: thread_manager.clone(),
-                        goal_service: Arc::new(codex_goal_extension::GoalService::new()),
-                        environment_manager: Arc::clone(&environment_manager),
-                        executor_skill_provider: Arc::clone(&executor_skill_provider),
-                        git_attribution_base_url: good_config.chatgpt_base_url.clone(),
-                        http_client_factory: good_config.http_client_factory(),
-                        queue_service: None,
-                        turn_start_admission: None,
-                    },
-                ),
+                thread_extensions(ThreadExtensionDependencies {
+                    event_sink: Arc::new(NoopExtensionEventSink),
+                    auth_manager: auth_manager.clone(),
+                    state_db: Some(state_db.clone()),
+                    analytics_events_client: codex_analytics::AnalyticsEventsClient::disabled(),
+                    thread_manager: thread_manager.clone(),
+                    goal_service: Arc::new(codex_goal_extension::GoalService::new()),
+                    environment_manager: Arc::clone(&environment_manager),
+                    executor_skill_provider: Arc::clone(&executor_skill_provider),
+                    git_attribution_base_url: good_config.chatgpt_base_url.clone(),
+                    http_client_factory: good_config.http_client_factory(),
+                    queue_service: None,
+                    turn_start_admission: None,
+                }),
                 Arc::new(CodexHomeUserInstructionsProvider::new(
                     good_config.codex_home.clone(),
                 )),

codex-rs/app-server/src/message_processor.rs

@@ -13,7 +13,6 @@ use crate::error_code::invalid_params;
 use crate::error_code::invalid_request;
 use crate::extensions::ThreadExtensionDependencies;
 use crate::extensions::app_server_extension_event_sink;
-use crate::extensions::guardian_agent_spawner;
 use crate::extensions::thread_extensions;
 use crate::external_agent_migration::ExternalAgentConfigRequestProcessor;
 use crate::external_agent_migration::ExternalAgentConfigRequestProcessorArgs;
@@ -335,23 +334,20 @@ impl MessageProcessor {
                 codex_core::CodexAppsToolsCache::default(),
                 session_source,
                 environment_manager,
-                thread_extensions(
-                    guardian_agent_spawner(thread_manager.clone()),
-                    ThreadExtensionDependencies {
-                        event_sink: Arc::clone(&extension_event_sink),
-                        auth_manager: auth_manager.clone(),
-                        state_db: state_db.clone(),
-                        analytics_events_client: analytics_events_client.clone(),
-                        thread_manager: thread_manager.clone(),
-                        goal_service: Arc::clone(&goal_service),
-                        environment_manager: Arc::clone(&environment_manager_for_extensions),
-                        executor_skill_provider: Arc::clone(&executor_skill_provider),
-                        git_attribution_base_url: config.chatgpt_base_url.clone(),
-                        http_client_factory: config.http_client_factory(),
-                        queue_service: queue_service.clone(),
-                        turn_start_admission: Some(Arc::clone(&turn_start_admission)),
-                    },
-                ),
+                thread_extensions(ThreadExtensionDependencies {
+                    event_sink: Arc::clone(&extension_event_sink),
+                    auth_manager: auth_manager.clone(),
+                    state_db: state_db.clone(),
+                    analytics_events_client: analytics_events_client.clone(),
+                    thread_manager: thread_manager.clone(),
+                    goal_service: Arc::clone(&goal_service),
+                    environment_manager: Arc::clone(&environment_manager_for_extensions),
+                    executor_skill_provider: Arc::clone(&executor_skill_provider),
+                    git_attribution_base_url: config.chatgpt_base_url.clone(),
+                    http_client_factory: config.http_client_factory(),
+                    queue_service: queue_service.clone(),
+                    turn_start_admission: Some(Arc::clone(&turn_start_admission)),
+                }),
                 Arc::new(CodexHomeUserInstructionsProvider::new(
                     config.codex_home.clone(),
                 )),