## What changed
- Serve `GET /healthz` with a `200 OK` response over HTTP/1.1 and HTTP/2.
- Continue requiring HTTP/2 for all other requests so gRPC methods are not exposed over HTTP/1.1.
## Testing
- Add TCP listener integration coverage for HTTP/1.1 and HTTP/2 health checks and rejection of HTTP/1.1 gRPC requests.
GitOrigin-RevId: ae7bbf56323fbc76769375a6d8e90653e8adc860
## What changed
- Forward notification text to the session delegate without applying the previous 1,024-byte limit or appending a truncation suffix.
- Update the gRPC host integration test to verify that oversized multibyte notification text is delivered unchanged.
GitOrigin-RevId: 9a9e24b359a07540f70ec4e98b28524db3f7a4a0
## What changed
- Use a never-resolving promise when verifying that a session continues to
enforce its yield limit after terminating a cell.
- Use `yield_control()` to create the yielded cell in the notification-draining
test instead of relying on timer scheduling.
GitOrigin-RevId: 01cdaa94e5b8b5c89c6fa98c4bbdb28a690678e0
## What changed
- Accept root `http://` and `https://` URLs in `--code-mode-host` and use the
shared gRPC session provider for those endpoints.
- Keep `ws://` and `wss://` URLs on the existing WebSocket transport.
- Reject paths, queries, fragments, and credentials where unsupported, without
exposing gRPC URL credentials in command-line validation errors.
## Testing
- Cover argument parsing and transport selection for both remote protocols.
- Exercise a gRPC host shared across app-server threads and verify credential
rejection does not disclose usernames or passwords.
GitOrigin-RevId: b6516a85cf76db5c4cea620f89ef866d8af30cf0
## What changed
- Reopen a cached code-mode session when its gRPC host stops, while
serializing concurrent reconnection attempts and coordinating shutdown.
- Scope cell IDs to the new host generation so callbacks remain consistent
and stale `wait` or `terminate` requests are rejected.
- Accept both `unix://` and `unix:` endpoints for gRPC hosts on Unix systems.
## Testing
- Cover host restart recovery, concurrent execution after reconnection,
generation-aware callbacks and cell operations, stale cell rejection, and
Unix socket execution.
GitOrigin-RevId: 548e168fdcef7f7d54bd32262e614886bf7bdd32
## What changed
- Subscribe each gRPC code-mode session to nested tool calls and forward tool and notification callbacks to its delegate.
- Complete tool calls through the host while bounding oversized results and errors.
- Track callback ownership and cancellation so completed cells drain notifications, terminated cells cancel them, and shutdown revokes outstanding work.
- Validate callback identifiers, cell ownership, enabled tools, and pending callback limits without serializing independent callbacks or sessions.
## Testing
- Add integration and state tests for callback forwarding, completion ordering, cancellation, malformed callbacks, delegate panics, oversized results, and concurrent work.
GitOrigin-RevId: 005afbb90eea0eb77d746b930a1a96ca6dfcd4e7
## What changed
- Add `GrpcCodeModeSessionProvider` for opening code-mode sessions over HTTP/2 or an existing `tonic` channel.
- Support execution, waiting, termination, per-session limits, cell-closure callbacks, and graceful shutdown over the gRPC protocol.
- Bound transport waits and error messages, validate host identifiers and responses, and clean up abandoned executions and observers.
## Testing
- Add end-to-end TCP tests covering session persistence, cancellation, concurrent waits, shutdown, cell cleanup, and independent yield limits.
- Add unit coverage for protocol conversion, deadlines, and session lifecycle state.
GitOrigin-RevId: d4729ce608ad4b42a99744b07e1f230e46cb24ec
## What changed
- Move the host process harness and common session delegates into shared test
support modules.
- Allow the host harness to start either WebSocket or gRPC listeners and
validate the endpoint scheme they publish.
- Update the stdio and WebSocket integration tests to use the shared fixtures.
GitOrigin-RevId: a0408be7c88e4eb9ad1832b6d2698781de77168a
## What changed
- Accept `grpc://IP:PORT` endpoints through `--listen` and serve the existing
code-mode gRPC service over TCP.
- Print the bound HTTP endpoint to stdout so callers can discover the port when
binding to port `0`.
- Apply the protocol frame-size limits and disable Nagle's algorithm on accepted
connections.
## Testing
- Add an end-to-end test that starts the host on an ephemeral port, connects a
gRPC client, and opens a session.
- Verify accepted gRPC sockets have `TCP_NODELAY` enabled.
GitOrigin-RevId: 51d6c21dff8cffb47068c0677ba10ff370385cec
## What changed
- Export `GrpcCodeModeHost` as a transport-independent implementation of the
code-mode gRPC API.
- Support leased sessions, execution and wait lifecycle operations, filtered
nested tool-call subscriptions, tool completions, and notification
acknowledgements.
- Share host-wide request and active-cell limits across the existing and gRPC
transports, and bound identifiers, metadata, subscriptions, and pending
callbacks.
## Testing
- Add coverage for request conversion, ordered callback routing, cancellation,
session cleanup, backpressure, malformed input, and resource-limit handling.
GitOrigin-RevId: f146ba7e6fe4e4aa02f25dd3f961120980516d0e
## What changed
- Add `create_session_with_limits` and session-scoped cell execution limits.
- Clamp execute and wait yield times to the session's `max_yield_time_ms`
without terminating the running cell.
- Negotiate support with remote code-mode hosts and include non-default limits
in `session/open`, while keeping unlimited sessions compatible with hosts and
providers that do not support limits.
## Testing
- Cover yield-time clamping, zero-timeout behavior, and isolation between
sessions.
- Cover wire serialization, capability negotiation, unsupported hosts, and
shared process-host execution.
GitOrigin-RevId: 9517321cd605bb87f93eeaa6ba331cc2e346e582
## Why
Large nested-tool callbacks can occupy a WebSocket and delay unrelated session
operations on the same code-mode connection.
## What changed
- Negotiate the optional `dual-websocket-v1` capability and pair a second,
token-scoped WebSocket with the control connection.
- Route nested-tool callbacks and their results over the bulk socket while
keeping session operations, notifications, and execution responses on the
control socket. Reject messages sent on the wrong lane.
- Preserve the single-connection transport when the capability is unavailable,
and bound pairing, queued callbacks, and deferred cross-socket messages.
- Defer callbacks that arrive before their execution-started response, and
return delegate errors without disconnecting the connection.
## Testing
Add protocol, transport, driver, and WebSocket integration coverage for
capability negotiation, lane routing, pairing failures, out-of-order messages,
and progress during large concurrent tool results.
GitOrigin-RevId: fa4504653e7cbf3c4ec930ae57aa0a41345bad66
## What changed
- Add a `--listen` option that accepts `stdio`, `stdio://`, or a
`ws://IP:PORT` endpoint, while retaining stdio as the default.
- Serve the existing length-prefixed protocol in binary WebSocket messages,
with isolated connections, shared host limits, and a `/readyz` endpoint.
- Reject browser-origin handshakes and contain malformed frames to the affected
connection.
## Testing
- Cover listen URL parsing and complete-frame encoding and decoding.
- Exercise readiness, cell execution, tool callbacks, large frames, concurrent
connections, malformed frames, and origin rejection through the WebSocket
listener.
GitOrigin-RevId: 01c8be4c6256b8ce4a3a0002440dcb3294e5f887
## Summary
- add `ProcessOwnedCodeModeSessionProvider` and logical session
generation/rebinding state
- add the supervised child-process connection, reader/writer tasks, and
driver state machine
- make dropped execute/wait/open callers cancellation-safe with explicit
ownership handoff and durable cleanup
- validate cell/delegate lifecycle state and reject invalid protocol
transitions
- add end-to-end stdio coverage for delegates, cancellation, frame
limits, child loss, stale generations, replacement, and long-lived
sessions
## Why
This final stage exposes the process-owned client only after the wire
protocol, host-safe runtime, and standalone host are independently in
place. Transport failure is fail-stop: the client closes local state,
cancels callbacks, reaps the child, and lazily rebuilds a fresh host
generation rather than transactionally recovering the old connection.
## Stack
This is **4 of 4** in the process-owned code-mode session stack.
- Depends on #30111
- Full stack: #30108 → #30110 → #30111 → this PR
## Validation
- `just test -p codex-code-mode -p codex-code-mode-host` — 86 passed
- `just fix -p codex-code-mode`
- `just fix -p codex-code-mode-host`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `bazel test //codex-rs/code-mode:code-mode-unit-tests
//codex-rs/code-mode-host:code-mode-host-unit-tests
//codex-rs/code-mode-host:code-mode-host-stdio-test
//codex-rs/code-mode-protocol:code-mode-protocol-unit-tests` — 4/4
passed
- `just fmt`
