feat: OpenAI Codex as a codeoid backend (app-server JSON-RPC, first slice)

[saucam]

What

Codex CLI becomes the third native harness backend (after claude and pi) — agentic GPT riding ChatGPT-subscription auth, which lives entirely in codex's own ~/.codex store; codeoid never touches tokens. First slice of docs/provider-codex-design.md, grounded against a live probe of @openai/codex@0.144.1 (codex app-server, newline JSON-RPC over stdio, self-describing protocol via generate-json-schema).

Design

• codex/rpc.ts — JSON-RPC client: requests, notifications, and server→client requests. That last category is the headline: codex natively asks its client for approvals, so unlike pi there is no injected bridge extension — the protocol itself provides the gate seam.
• codex/index.ts — CodexProvider (warm). One codex thread per backing session: thread id round-trips as backingSessionId, thread/resume reattaches after daemon restart, rotation starts a fresh thread. Every turn/start pins approvalPolicy: "untrusted" so codex asks before privileged actions and codeoid's canUseTool is authoritative — fail-closed throughout (no gate wired → denied; unknown server request → refused, not guessed). item/tool/requestUserInput maps onto the feat: provider extension surface — dialogs, dynamic commands, rich parts, provider registry #131 dialog surface (session.ui_request). Items codex runs under its own trusted policy (read-only commands) are recorded retrospectively as paired tool_start/tool_complete — visible in scrollback and canonical history without pretending codeoid gated them. systemPromptAppend → developerInstructions; seedFromHistory prepends the structured transcript from feat: Phase-2 canonical history — native tool_use/functionCall replay across backends #138 (one-shot); model/list feeds the live model picker.
• buildCodexEnv — hardened subprocess env (GHSA-38vh posture): CODEX_/OPENAI_/LC_ prefixes + *_API_KEY suffix; ~/.codex reachable via HOME in the shared basics.
• Config/registry — providers.codex {enabled, command} mirroring pi; activation via resolveCodexCommand (config → PATH), otherwise the feat: bundle pi so the backend works with zero install #141 supported-but-unavailable hint (npm i -g @openai/codex). No bundled fallback yet: @openai/codex is a per-platform native binary — bundling needs a size/platform audit first (tracked in the design doc).
• No wire changes — the provider surface from feat: provider extension surface — dialogs, dynamic commands, rich parts, provider registry #131–fix: allowlist the pi subprocess environment (GHSA-38vh parity) #135 absorbs all of it.

Tests

fake-codex fixture (newline JSON-RPC subprocess, fake-pi pattern) driving nine cases: text+thinking streaming with usage mapping, approval approve and deny round-trips (the fixture only runs the item when it receives approved), retrospective non-gated items, structured-history seed (and its one-shot semantics), user-input select round-trip, missing-binary error, model catalog mapping, and resolution/registry hint states.

Not yet covered (follow-up slices, listed in the design doc): turn/steer → pushMidTurn, plan/diff notifications as rich parts, dynamic commands, live smoke against a real logged-in codex, bundling audit.

bun run test (1252 pass), typecheck, lint green.

🤖 Generated with Claude Code

[github-actions]

🤖 Gemini code review

Introduced OpenAI Codex as a codeoid backend utilizing JSON-RPC over stdio. Includes a robust client, custom sandboxed environment, config registry integration, and extensive offline test suites. Found and addressed a potential host crash due to unhandled stdin EPIPE errors.

Findings: 🔴 0 · 🟠 1 · 🟡 0 · 🟢 1

---

_{Tokens spent · ⬆️ Input: 17,706 · ⬇️ Output: 388 · Σ Total: 26,349
Total may be higher due to thinking token counts.}

[codecov]

Codecov Report

❌ Patch coverage is 98.13665% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.55%. Comparing base (3bc25c3) to head (d03b9ad).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/daemon/providers/registry.ts	70.37%	8 Missing ⚠️
src/daemon/providers/codex/rpc.ts	99.07%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #142      +/-   ##
==========================================
+ Coverage   82.11%   82.55%   +0.44%     
==========================================
  Files          98      101       +3     
  Lines       16922    17404     +482     
==========================================
+ Hits        13895    14368     +473     
- Misses       3027     3036       +9     

Flag	Coverage Δ
daemon	82.55% <98.13%> (+0.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/config.ts	91.64% <100.00%> (+0.16%)	⬆️
src/daemon/providers/codex/index.ts	100.00% <100.00%> (ø)
src/daemon/providers/codex/resolve.ts	100.00% <100.00%> (ø)
src/daemon/providers/env.ts	100.00% <100.00%> (ø)
src/daemon/providers/codex/rpc.ts	99.07% <99.07%> (ø)
src/daemon/providers/registry.ts	94.07% <70.37%> (-5.93%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.