## What changed
- Accept `grpc://IP:PORT` endpoints through `--listen` and serve the existing
code-mode gRPC service over TCP.
- Print the bound HTTP endpoint to stdout so callers can discover the port when
binding to port `0`.
- Apply the protocol frame-size limits and disable Nagle's algorithm on accepted
connections.
## Testing
- Add an end-to-end test that starts the host on an ephemeral port, connects a
gRPC client, and opens a session.
- Verify accepted gRPC sockets have `TCP_NODELAY` enabled.
GitOrigin-RevId: 51d6c21dff8cffb47068c0677ba10ff370385cec
## What changed
- Export `GrpcCodeModeHost` as a transport-independent implementation of the
code-mode gRPC API.
- Support leased sessions, execution and wait lifecycle operations, filtered
nested tool-call subscriptions, tool completions, and notification
acknowledgements.
- Share host-wide request and active-cell limits across the existing and gRPC
transports, and bound identifiers, metadata, subscriptions, and pending
callbacks.
## Testing
- Add coverage for request conversion, ordered callback routing, cancellation,
session cleanup, backpressure, malformed input, and resource-limit handling.
GitOrigin-RevId: f146ba7e6fe4e4aa02f25dd3f961120980516d0e
## Why
Large nested-tool callbacks can occupy a WebSocket and delay unrelated session
operations on the same code-mode connection.
## What changed
- Negotiate the optional `dual-websocket-v1` capability and pair a second,
token-scoped WebSocket with the control connection.
- Route nested-tool callbacks and their results over the bulk socket while
keeping session operations, notifications, and execution responses on the
control socket. Reject messages sent on the wrong lane.
- Preserve the single-connection transport when the capability is unavailable,
and bound pairing, queued callbacks, and deferred cross-socket messages.
- Defer callbacks that arrive before their execution-started response, and
return delegate errors without disconnecting the connection.
## Testing
Add protocol, transport, driver, and WebSocket integration coverage for
capability negotiation, lane routing, pairing failures, out-of-order messages,
and progress during large concurrent tool results.
GitOrigin-RevId: fa4504653e7cbf3c4ec930ae57aa0a41345bad66
## What changed
- Move the V8 implementation into a dedicated `codex-code-mode-runtime` crate used by `codex-code-mode-host`, removing the embedded runtime fallback from the Codex process.
- Resolve the host executable from the active installation layout and check its availability before selecting tools.
- Fall back to direct tools with a one-time warning when optional code mode is unavailable. Keep `code_mode_only` and `disable_in_process_fallback` configurations fail-closed.
## Testing
- Cover host discovery for standalone and package layouts, including missing hosts and symlinks.
- Verify direct-tool fallback, one-time warnings, and fail-closed code-mode-only behavior.
GitOrigin-RevId: 5aa3c6f1db148b2231fc24089a2ee0e2b00dbddb
## What changed
- Add a `--listen` option that accepts `stdio`, `stdio://`, or a
`ws://IP:PORT` endpoint, while retaining stdio as the default.
- Serve the existing length-prefixed protocol in binary WebSocket messages,
with isolated connections, shared host limits, and a `/readyz` endpoint.
- Reject browser-origin handshakes and contain malformed frames to the affected
connection.
## Testing
- Cover listen URL parsing and complete-frame encoding and decoding.
- Exercise readiness, cell execution, tool callbacks, large frames, concurrent
connections, malformed frames, and origin rejection through the WebSocket
listener.
GitOrigin-RevId: 01c8be4c6256b8ce4a3a0002440dcb3294e5f887
## Summary
- add `ProcessOwnedCodeModeSessionProvider` and logical session
generation/rebinding state
- add the supervised child-process connection, reader/writer tasks, and
driver state machine
- make dropped execute/wait/open callers cancellation-safe with explicit
ownership handoff and durable cleanup
- validate cell/delegate lifecycle state and reject invalid protocol
transitions
- add end-to-end stdio coverage for delegates, cancellation, frame
limits, child loss, stale generations, replacement, and long-lived
sessions
## Why
This final stage exposes the process-owned client only after the wire
protocol, host-safe runtime, and standalone host are independently in
place. Transport failure is fail-stop: the client closes local state,
cancels callbacks, reaps the child, and lazily rebuilds a fresh host
generation rather than transactionally recovering the old connection.
## Stack
This is **4 of 4** in the process-owned code-mode session stack.
- Depends on #30111
- Full stack: #30108 → #30110 → #30111 → this PR
## Validation
- `just test -p codex-code-mode -p codex-code-mode-host` — 86 passed
- `just fix -p codex-code-mode`
- `just fix -p codex-code-mode-host`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `bazel test //codex-rs/code-mode:code-mode-unit-tests
//codex-rs/code-mode-host:code-mode-host-unit-tests
//codex-rs/code-mode-host:code-mode-host-stdio-test
//codex-rs/code-mode-protocol:code-mode-protocol-unit-tests` — 4/4
passed
- `just fmt`
## Summary
- implement the standalone `codex-code-mode-host` stdio service
- route sessions, cells, delegate requests, responses, and cancellation
through a bounded host peer
- supervise request, writer, cell-forwarding, actor, and V8 failure
boundaries
- bound request/session tombstones and fail-stop the connection on
invalid protocol state
- add host-only duplex protocol tests and local Cargo/Bazel run recipes
## Why
This stage makes the host process independently runnable and reviewable
before exposing any remote client in Codex. Transport or runtime failure
closes the connection and relies on process replacement rather than
transactional recovery.
## Stack
This is **3 of 4** in the process-owned code-mode session stack.
- Depends on #30110
- The final client PR targets this branch
## Validation
- `just test -p codex-code-mode-host` — 7 host-only tests passed
- `just fix -p codex-code-mode-host`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `just fmt`
This is phase 1 of a 4 phase stack:
1. **Add protocol and host crates for new IPC code mode implementation**
2. Create the new standalone binary
3. Create a new IPC `CodeModeSessionProvider` to use new binary
4. Remove v8 from core and only use IPC provider
## Add protocol and host crates for new IPC code mode implementation
Establish a clean process boundary without changing the existing
in-process behavior.
- Add the codex-code-mode-protocol crate for shared session, runtime,
response, and tool-definition types.
- Move protocol-facing code out of the V8-backed implementation.
- Add a buildable codex-code-mode-host crate as the foundation for the
standalone process.
- Keep the existing in-process runtime as the active implementation.
