feat: Use installation ID in remote enrollments

codex-rs/app-server-protocol/src/protocol/v2/remote_control.rs

@@ -3,12 +3,13 @@ use serde::Deserialize;
 use serde::Serialize;
 use ts_rs::TS;
 
-/// Current remote-control connection status and environment id exposed to clients.
+/// Current remote-control connection status and remote identity exposed to clients.
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
 pub struct RemoteControlStatusChangedNotification {
     pub status: RemoteControlConnectionStatus,
+    pub installation_id: String,
     pub environment_id: Option<String>,
 }
 

codex-rs/app-server-transport/src/lib.rs

@@ -11,6 +11,7 @@ pub use transport::AppServerTransportParseError;
 pub use transport::CHANNEL_CAPACITY;
 pub use transport::ConnectionOrigin;
 pub use transport::RemoteControlHandle;
+pub use transport::RemoteControlStartConfig;
 pub use transport::TransportEvent;
 pub use transport::app_server_control_socket_path;
 pub use transport::auth;

codex-rs/app-server-transport/src/transport/mod.rs

@@ -31,6 +31,7 @@ mod unix_socket_tests;
 mod websocket;
 
 pub use remote_control::RemoteControlHandle;
+pub use remote_control::RemoteControlStartConfig;
 pub use remote_control::start_remote_control;
 pub use stdio::start_stdio_connection;
 pub use unix_socket::start_control_socket_acceptor;

codex-rs/app-server-transport/src/transport/remote_control/enroll.rs

@@ -19,6 +19,7 @@ const REQUEST_ID_HEADER: &str = "x-request-id";
 const OAI_REQUEST_ID_HEADER: &str = "x-oai-request-id";
 const CF_RAY_HEADER: &str = "cf-ray";
 pub(super) const REMOTE_CONTROL_ACCOUNT_ID_HEADER: &str = "chatgpt-account-id";
+pub(super) const REMOTE_CONTROL_INSTALLATION_ID_HEADER: &str = "x-codex-installation-id";
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(super) struct RemoteControlEnrollment {
@@ -193,6 +194,7 @@ pub(crate) fn format_headers(headers: &HeaderMap) -> String {
 pub(super) async fn enroll_remote_control_server(
     remote_control_target: &RemoteControlTarget,
     auth: &RemoteControlConnectionAuth,
+    installation_id: &str,
 ) -> io::Result<RemoteControlEnrollment> {
     let enroll_url = &remote_control_target.enroll_url;
     let server_name = gethostname().to_string_lossy().trim().to_string();
@@ -201,6 +203,7 @@ pub(super) async fn enroll_remote_control_server(
         os: std::env::consts::OS,
         arch: std::env::consts::ARCH,
         app_server_version: env!("CARGO_PKG_VERSION"),
+        installation_id: installation_id.to_string(),
     };
     let client = build_reqwest_client();
     let mut auth_headers = HeaderMap::new();
@@ -210,6 +213,7 @@ pub(super) async fn enroll_remote_control_server(
         .timeout(REMOTE_CONTROL_ENROLL_TIMEOUT)
         .headers(auth_headers)
         .header(REMOTE_CONTROL_ACCOUNT_ID_HEADER, &auth.account_id)
+        .header(REMOTE_CONTROL_INSTALLATION_ID_HEADER, installation_id)
         .json(&request);
 
     let response = http_request.send().await.map_err(|err| {
@@ -459,6 +463,7 @@ mod tests {
                 auth_provider: codex_model_provider::unauthenticated_auth_provider(),
                 account_id: "account_id".to_string(),
             },
+            "11111111-1111-4111-8111-111111111111",
         )
         .await
         .expect_err("invalid response should fail to parse");

codex-rs/app-server-transport/src/transport/remote_control/mod.rs

@@ -28,6 +28,11 @@ use tokio::task::JoinHandle;
 use tokio_util::sync::CancellationToken;
 use tracing::warn;
 
+pub struct RemoteControlStartConfig {
+    pub remote_control_url: String,
+    pub installation_id: String,
+}
+
 pub(super) struct QueuedServerEnvelope {
     pub(super) event: ServerEvent,
     pub(super) client_id: ClientId,
@@ -62,7 +67,7 @@ impl RemoteControlHandle {
 }
 
 pub async fn start_remote_control(
-    remote_control_url: String,
+    config: RemoteControlStartConfig,
     state_db: Option<Arc<StateRuntime>>,
     auth_manager: Arc<AuthManager>,
     transport_event_tx: mpsc::Sender<TransportEvent>,
@@ -77,7 +82,7 @@ pub async fn start_remote_control(
         warn!("remote control disabled because sqlite state db is unavailable");
     }
     let remote_control_target = if initial_enabled {
-        Some(normalize_remote_control_url(&remote_control_url)?)
+        Some(normalize_remote_control_url(&config.remote_control_url)?)
     } else {
         None
     };
@@ -89,14 +94,18 @@ pub async fn start_remote_control(
         } else {
             RemoteControlConnectionStatus::Disabled
         },
+        installation_id: config.installation_id.clone(),
         environment_id: None,
     };
     let (status_tx, _status_rx) = watch::channel(initial_status);
     let status_publisher = RemoteControlStatusPublisher::new(status_tx.clone());
     let join_handle = tokio::spawn(async move {
         RemoteControlWebsocket::new(
-            remote_control_url,
-            remote_control_target,
+            websocket::RemoteControlWebsocketConfig {
+                remote_control_url: config.remote_control_url,
+                installation_id: config.installation_id,
+                remote_control_target,
+            },
             state_db,
             auth_manager,
             RemoteControlChannels {

codex-rs/app-server-transport/src/transport/remote_control/protocol.rs

@@ -19,6 +19,7 @@ pub(super) struct EnrollRemoteServerRequest {
     pub(super) os: &'static str,
     pub(super) arch: &'static str,
     pub(super) app_server_version: &'static str,
+    pub(super) installation_id: String,
 }
 
 #[derive(Debug, Deserialize)]