Files
codex/codex-rs/app-server
Chris Dong 929389f596 Preserve per-image generation IDs in image generation analytics (#43953)
## What changed

Parse optional `generation_id` values from image API responses and carry the selected image's ID through the image generation tool into analytics events. Keep the ID out of serialized extension items, JSON schemas, and TypeScript types. Responses without an ID remain supported.

## Testing

Add coverage for distinct IDs in multi-image responses and responses without IDs. Extend analytics and app-server tests to verify that the selected image's ID reaches analytics, and item tests to verify that it is omitted from serialization and TypeScript types.

GitOrigin-RevId: 70a600856990140b76fdbda51a0d73b3414338b1
2026-09-09 00:34:45 +00:00
..

User verification cancellation (experimental)

Local UI clients can cancel a native user-verification RPC by sending userVerification/cancel with {requestId} and the experimentalApi opt-in. The result is an empty acknowledgment ({}). This API does not enable desktop verification capability advertisement.

requestId is the original status, enroll, delete, or verify RPC's string or integer ID on the same connection, not the server elicitation ID. Use fresh IDs for each operation and a distinct ID for the cancel RPC. Unknown, finished, unrelated, and other-connection requests are no-ops.

The acknowledgment confirms the cancellation signal without waiting for the OS prompt to close. The original RPC completes independently, with cancelled/interrupted when cancellation prevents completion. Cancellation cannot roll back completed effects. It remains effective while a proof waits for outbound queue capacity, but cannot retract a response already enqueued.

Canceling or resolving an elicitation does not itself stop a separate userVerification/verify RPC. Clients must cancel that RPC separately and discard late proofs after the approval is canceled or resolved. Only one native worker runs per app-server; if an OS call remains active after cancellation or timeout, subsequent local operations return failed/providerError until that worker exits.

Thread removal

thread/archive and thread/delete reject attempts to remove a live internal worker with JSON-RPC error -32600. The worker's owner controls its shutdown. For example, a Guardian reviewer remains available to its parent conversation after a client tries to archive or delete it.

After the owner releases the worker, its saved conversation can be archived or deleted normally. Ordinary client-controlled threads keep their existing behavior.