Merge remote-tracking branch 'upstream/main'

Author: lee101

AGENTS.md

@@ -23,6 +23,7 @@ In the codex-rs folder where the rust code lives:
 - When making a change that adds or changes an API, ensure that the documentation in the `docs/` folder is up to date if applicable.
 - Prefer private modules and explicitly exported public crate API.
 - If you change `ConfigToml` or nested config types, run `just write-config-schema` to update `codex-rs/core/config.schema.json`.
+- When working with MCP tool calls, prefer using `codex-rs/codex-mcp/src/mcp_connection_manager.rs` to handle mutation of tools and tool calls. Aim to minimize the footprint of changes and leverage existing abstractions rather than plumbing code through multiple levels of function calls.
 - If you change Rust dependencies (`Cargo.toml` or `Cargo.lock`), run `just bazel-lock-update` from the
   repo root to refresh `MODULE.bazel.lock`, and include that lockfile update in the same change.
 - After dependency changes, run `just bazel-lock-check` from the repo root so lockfile drift is caught

codex-rs/Cargo.lock

@@ -1,5 +1,6 @@
 [workspace]
 members = [
+    "account",
     "analytics",
     "backend-client",
     "ansi-escape",
@@ -104,6 +105,7 @@ license = "Apache-2.0"
 # Internal
 app_test_support = { path = "app-server/tests/common" }
 codex-analytics = { path = "analytics" }
+codex-account = { path = "account" }
 codex-ansi-escape = { path = "ansi-escape" }
 codex-api = { path = "codex-api" }
 codex-app-server = { path = "app-server" }

codex-rs/Cargo.toml

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "account",
+    crate_name = "codex_account",
+)

codex-rs/account/BUILD.bazel

@@ -0,0 +1,19 @@
+[package]
+name = "codex-account"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish = false
+
+[lib]
+name = "codex_account"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+codex-backend-client = { workspace = true }
+codex-login = { workspace = true }
+thiserror = { workspace = true }

codex-rs/account/Cargo.toml

@@ -0,0 +1,121 @@
+use codex_backend_client::Client as BackendClient;
+use codex_backend_client::RequestError;
+use codex_backend_client::WorkspaceRole as BackendWorkspaceRole;
+use codex_login::AuthManager;
+use codex_login::CodexAuth;
+use thiserror::Error;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum WorkspaceRole {
+    AccountOwner,
+    AccountAdmin,
+    StandardUser,
+}
+
+impl WorkspaceRole {
+    fn is_workspace_owner(self) -> bool {
+        matches!(self, Self::AccountOwner | Self::AccountAdmin)
+    }
+}
+
+impl From<BackendWorkspaceRole> for WorkspaceRole {
+    fn from(value: BackendWorkspaceRole) -> Self {
+        match value {
+            BackendWorkspaceRole::AccountOwner => Self::AccountOwner,
+            BackendWorkspaceRole::AccountAdmin => Self::AccountAdmin,
+            BackendWorkspaceRole::StandardUser => Self::StandardUser,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct WorkspaceOwnership {
+    pub workspace_role: Option<WorkspaceRole>,
+    pub is_workspace_owner: Option<bool>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AddCreditsNudgeEmailStatus {
+    Sent,
+    CooldownActive,
+}
+
+#[derive(Debug, Error)]
+pub enum SendAddCreditsNudgeEmailError {
+    #[error("codex account authentication required to notify workspace owner")]
+    AuthRequired,
+
+    #[error("chatgpt authentication required to notify workspace owner")]
+    ChatGptAuthRequired,
+
+    #[error("failed to construct backend client: {0}")]
+    CreateClient(#[from] anyhow::Error),
+
+    #[error("failed to notify workspace owner: {0}")]
+    Request(#[from] RequestError),
+}
+
+pub async fn send_add_credits_nudge_email(
+    chatgpt_base_url: impl Into<String>,
+    auth_manager: &AuthManager,
+) -> Result<AddCreditsNudgeEmailStatus, SendAddCreditsNudgeEmailError> {
+    let auth = auth_manager
+        .auth()
+        .await
+        .ok_or(SendAddCreditsNudgeEmailError::AuthRequired)?;
+    send_add_credits_nudge_email_for_auth(chatgpt_base_url, &auth).await
+}
+
+pub async fn send_add_credits_nudge_email_for_auth(
+    chatgpt_base_url: impl Into<String>,
+    auth: &CodexAuth,
+) -> Result<AddCreditsNudgeEmailStatus, SendAddCreditsNudgeEmailError> {
+    if !auth.is_chatgpt_auth() {
+        return Err(SendAddCreditsNudgeEmailError::ChatGptAuthRequired);
+    }
+
+    let client = BackendClient::from_auth(chatgpt_base_url, auth)?;
+    match client.send_add_credits_nudge_email().await {
+        Ok(()) => Ok(AddCreditsNudgeEmailStatus::Sent),
+        Err(err) if err.status().is_some_and(|status| status.as_u16() == 429) => {
+            Ok(AddCreditsNudgeEmailStatus::CooldownActive)
+        }
+        Err(err) => Err(err.into()),
+    }
+}
+
+pub async fn resolve_workspace_role_and_owner_for_auth(
+    chatgpt_base_url: &str,
+    auth: Option<&CodexAuth>,
+) -> WorkspaceOwnership {
+    let token_is_workspace_owner = auth.and_then(CodexAuth::is_workspace_owner);
+    let Some(auth) = auth else {
+        return WorkspaceOwnership::default();
+    };
+
+    let workspace_role = fetch_current_workspace_role_for_auth(chatgpt_base_url, auth).await;
+    let is_workspace_owner = workspace_role
+        .map(WorkspaceRole::is_workspace_owner)
+        .or(token_is_workspace_owner);
+    WorkspaceOwnership {
+        workspace_role,
+        is_workspace_owner,
+    }
+}
+
+async fn fetch_current_workspace_role_for_auth(
+    chatgpt_base_url: &str,
+    auth: &CodexAuth,
+) -> Option<WorkspaceRole> {
+    if !auth.is_chatgpt_auth() {
+        return None;
+    }
+
+    let client = BackendClient::from_auth(chatgpt_base_url.to_string(), auth).ok()?;
+    client
+        .get_current_workspace_role()
+        .await
+        .ok()
+        .flatten()
+        .map(WorkspaceRole::from)
+}

codex-rs/account/src/lib.rs

@@ -454,6 +454,7 @@ fn subagent_thread_started_review_serializes_expected_shape() {
     let event = TrackEventRequest::ThreadInitialized(subagent_thread_started_event_request(
         SubAgentThreadStartedInput {
             thread_id: "thread-review".to_string(),
+            parent_thread_id: None,
             product_client_id: "codex-tui".to_string(),
             client_name: "codex-tui".to_string(),
             client_version: "1.0.0".to_string(),
@@ -496,6 +497,7 @@ fn subagent_thread_started_thread_spawn_serializes_parent_thread_id() {
     let event = TrackEventRequest::ThreadInitialized(subagent_thread_started_event_request(
         SubAgentThreadStartedInput {
             thread_id: "thread-spawn".to_string(),
+            parent_thread_id: None,
             product_client_id: "codex-tui".to_string(),
             client_name: "codex-tui".to_string(),
             client_version: "1.0.0".to_string(),
@@ -526,6 +528,7 @@ fn subagent_thread_started_memory_consolidation_serializes_expected_shape() {
     let event = TrackEventRequest::ThreadInitialized(subagent_thread_started_event_request(
         SubAgentThreadStartedInput {
             thread_id: "thread-memory".to_string(),
+            parent_thread_id: None,
             product_client_id: "codex-tui".to_string(),
             client_name: "codex-tui".to_string(),
             client_version: "1.0.0".to_string(),
@@ -550,6 +553,7 @@ fn subagent_thread_started_other_serializes_expected_shape() {
     let event = TrackEventRequest::ThreadInitialized(subagent_thread_started_event_request(
         SubAgentThreadStartedInput {
             thread_id: "thread-guardian".to_string(),
+            parent_thread_id: None,
             product_client_id: "codex-tui".to_string(),
             client_name: "codex-tui".to_string(),
             client_version: "1.0.0".to_string(),
@@ -562,6 +566,31 @@ fn subagent_thread_started_other_serializes_expected_shape() {
 
     let payload = serde_json::to_value(&event).expect("serialize other subagent event");
     assert_eq!(payload["event_params"]["subagent_source"], "guardian");
+    assert_eq!(payload["event_params"]["parent_thread_id"], json!(null));
+}
+
+#[test]
+fn subagent_thread_started_other_serializes_explicit_parent_thread_id() {
+    let event = TrackEventRequest::ThreadInitialized(subagent_thread_started_event_request(
+        SubAgentThreadStartedInput {
+            thread_id: "thread-guardian".to_string(),
+            parent_thread_id: Some("parent-thread-guardian".to_string()),
+            product_client_id: "codex-tui".to_string(),
+            client_name: "codex-tui".to_string(),
+            client_version: "1.0.0".to_string(),
+            model: "gpt-5".to_string(),
+            ephemeral: false,
+            subagent_source: SubAgentSource::Other("guardian".to_string()),
+            created_at: 126,
+        },
+    ));
+
+    let payload = serde_json::to_value(&event).expect("serialize guardian subagent event");
+    assert_eq!(payload["event_params"]["subagent_source"], "guardian");
+    assert_eq!(
+        payload["event_params"]["parent_thread_id"],
+        "parent-thread-guardian"
+    );
 }
 
 #[tokio::test]
@@ -574,6 +603,7 @@ async fn subagent_thread_started_publishes_without_initialize() {
             AnalyticsFact::Custom(CustomAnalyticsFact::SubAgentThreadStarted(
                 SubAgentThreadStartedInput {
                     thread_id: "thread-review".to_string(),
+                    parent_thread_id: None,
                     product_client_id: "codex-tui".to_string(),
                     client_name: "codex-tui".to_string(),
                     client_version: "1.0.0".to_string(),

codex-rs/analytics/src/analytics_client_tests.rs

@@ -249,7 +249,9 @@ pub(crate) fn subagent_thread_started_event_request(
         thread_source: Some("subagent"),
         initialization_mode: ThreadInitializationMode::New,
         subagent_source: Some(subagent_source_name(&input.subagent_source)),
-        parent_thread_id: subagent_parent_thread_id(&input.subagent_source),
+        parent_thread_id: input
+            .parent_thread_id
+            .or_else(|| subagent_parent_thread_id(&input.subagent_source)),
         created_at: input.created_at,
     };
     ThreadInitializedEvent {

codex-rs/analytics/src/events.rs

@@ -54,6 +54,7 @@ pub struct AppInvocation {
 #[derive(Clone)]
 pub struct SubAgentThreadStartedInput {
     pub thread_id: String,
+    pub parent_thread_id: Option<String>,
     pub product_client_id: String,
     pub client_name: String,
     pub client_version: String,

codex-rs/analytics/src/facts.rs

@@ -19,6 +19,7 @@ codex-core = { workspace = true }
 codex-exec-server = { workspace = true }
 codex-feedback = { workspace = true }
 codex-protocol = { workspace = true }
+codex-utils-rustls-provider = { workspace = true }
 futures = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }