feat(core, mcp): cache codex_apps tools in memory (#29003)

## Description

This makes Codex Apps tool reads use a shared in-memory snapshot instead
of rereading the disk cache every time `list_all_tools()` runs. Disk
still seeds the cache on startup and gets updated after successful
fetches, but it is no longer the live read path.

The core change is that `McpManager` now owns a process-scoped
`CodexAppsToolsCache`. Codex threads in the same app-server process now
share this Codex Apps in-memory tools snapshot. The snapshot is keyed by
the Codex home plus the Codex Apps identity: the active Codex auth
user/workspace and the effective Codex Apps MCP source config.

There's already code to hard-refresh the cache, so we respect it in this
PR.

## Local benchmark

I ran a local steady-state microbenchmark of the exact repeated Codex
Apps cached-tools read this PR removes, using the same real local cache
payload in both trees: `3,678,138` bytes and `381` tools. The cache file
was already warm in the OS page cache, so this measures same-process
reread/deserialization work rather than cold-disk latency or full turn
latency. Each run is 25 iterations (mimicking a turn that makes 25
inference calls).

| Version | Run 1 | Run 2 | Avg |
|---|---:|---:|---:|
| `origin/main` disk read + JSON deserialize + `filter_tools` | `50.755
ms` | `52.894 ms` | `51.825 ms` |
| This branch in-memory `current_tools` + `filter_tools` | `0.740 ms` |
`0.778 ms` | `0.759 ms` |

That removes about `51 ms` from each repeated Codex Apps cached-tools
read on this machine, roughly `68x` faster for that subpath. It is
useful evidence for the hot path this PR changes, but not a claim that
every production turn gets `51 ms` faster; end-to-end impact also
depends on the rest of `list_all_tools()` and tool-payload construction.

This is on my M2 Max macbook, so with a slower disk this would be much
worse (and indeed we did see this really blew up turn runtime with a
slow disk).

Author: owenlin0

codex-rs/app-server/src/request_processors/mcp_processor.rs

@@ -249,15 +249,12 @@ impl McpRequestProcessor {
             }
             None => (self.load_latest_config(/*fallback_cwd*/ None).await?, None),
         };
+        let mcp_manager = self.thread_manager.mcp_manager();
         let mcp_config = match thread {
             Some(thread) => thread.runtime_mcp_config(&config).await,
-            None => {
-                self.thread_manager
-                    .mcp_manager()
-                    .runtime_config(&config)
-                    .await
-            }
+            None => mcp_manager.runtime_config(&config).await,
         };
+        let codex_apps_tools_cache = mcp_manager.codex_apps_tools_cache();
         let auth = self.auth_manager.auth().await;
         let environment_manager = self.thread_manager.environment_manager();
         // This status path has no turn-selected environment. Use config cwd
@@ -274,6 +271,7 @@ impl McpRequestProcessor {
                 mcp_config,
                 auth,
                 runtime_context,
+                codex_apps_tools_cache,
             )
             .await;
         });
@@ -287,13 +285,15 @@ impl McpRequestProcessor {
         mcp_config: codex_mcp::McpConfig,
         auth: Option<CodexAuth>,
         runtime_context: McpRuntimeContext,
+        codex_apps_tools_cache: codex_mcp::CodexAppsToolsCache,
     ) {
         let result = Self::list_mcp_server_status_response(
             request_id.request_id.to_string(),
             params,
             mcp_config,
             auth,
             runtime_context,
+            codex_apps_tools_cache,
         )
         .await;
         outgoing.send_result(request_id, result).await;
@@ -305,6 +305,7 @@ impl McpRequestProcessor {
         mcp_config: codex_mcp::McpConfig,
         auth: Option<CodexAuth>,
         runtime_context: McpRuntimeContext,
+        codex_apps_tools_cache: codex_mcp::CodexAppsToolsCache,
     ) -> Result<ListMcpServerStatusResponse, JSONRPCErrorError> {
         let detail = match params.detail.unwrap_or(McpServerStatusDetail::Full) {
             McpServerStatusDetail::Full => McpSnapshotDetail::Full,
@@ -316,6 +317,7 @@ impl McpRequestProcessor {
             auth.as_ref(),
             request_id,
             runtime_context,
+            codex_apps_tools_cache,
             detail,
         )
         .await;
@@ -406,11 +408,9 @@ impl McpRequestProcessor {
         }
 
         let config = self.load_latest_config(/*fallback_cwd*/ None).await?;
-        let mcp_config = self
-            .thread_manager
-            .mcp_manager()
-            .runtime_config(&config)
-            .await;
+        let mcp_manager = self.thread_manager.mcp_manager();
+        let mcp_config = mcp_manager.runtime_config(&config).await;
+        let codex_apps_tools_cache = mcp_manager.codex_apps_tools_cache();
         let auth = self.auth_manager.auth().await;
         let environment_manager = self.thread_manager.environment_manager();
         // This threadless resource-read path has no turn cwd or turn-selected
@@ -425,6 +425,7 @@ impl McpRequestProcessor {
                 &mcp_config,
                 auth.as_ref(),
                 runtime_context,
+                codex_apps_tools_cache,
                 &server,
                 &uri,
             )

codex-rs/codex-mcp/src/codex_apps.rs

@@ -1,70 +1,9 @@
 //! Codex Apps support for the host-owned apps MCP server.
 //!
-//! This module owns the pieces that are unique to ChatGPT-hosted app
-//! connectors: cache scoping by authenticated user, disk cache reads/writes,
-//! connector allow-list filtering, and the normalization that turns app
+//! This module owns the normalization that turns ChatGPT-hosted app
 //! connector/tool metadata into model-visible MCP callable names.
 
-use std::path::PathBuf;
-use std::time::Instant;
-
-use crate::runtime::emit_duration;
-use crate::tools::MCP_TOOLS_CACHE_WRITE_DURATION_METRIC;
-use crate::tools::ToolInfo;
-use anyhow::Context;
-use codex_login::CodexAuth;
-use codex_protocol::mcp::McpServerInfo;
 use codex_utils_plugins::mcp_connector::sanitize_name;
-use serde::Deserialize;
-use serde::Serialize;
-use sha1::Digest;
-use sha1::Sha1;
-use tracing::instrument;
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CodexAppsToolsCacheKey {
-    pub(crate) account_id: Option<String>,
-    pub(crate) chatgpt_user_id: Option<String>,
-    pub(crate) is_workspace_account: bool,
-}
-
-pub fn codex_apps_tools_cache_key(auth: Option<&CodexAuth>) -> CodexAppsToolsCacheKey {
-    CodexAppsToolsCacheKey {
-        account_id: auth.and_then(CodexAuth::get_account_id),
-        chatgpt_user_id: auth.and_then(CodexAuth::get_chatgpt_user_id),
-        is_workspace_account: auth.is_some_and(CodexAuth::is_workspace_account),
-    }
-}
-
-#[derive(Clone)]
-pub(crate) struct CodexAppsToolsCacheContext {
-    pub(crate) codex_home: PathBuf,
-    pub(crate) user_key: CodexAppsToolsCacheKey,
-}
-
-impl CodexAppsToolsCacheContext {
-    pub(crate) fn tools_cache_path(&self) -> PathBuf {
-        self.cache_path_in(CODEX_APPS_TOOLS_CACHE_DIR)
-    }
-
-    pub(crate) fn server_info_cache_path(&self) -> PathBuf {
-        self.cache_path_in(CODEX_APPS_SERVER_INFO_CACHE_DIR)
-    }
-
-    fn cache_path_in(&self, cache_dir: &str) -> PathBuf {
-        let user_key_json = serde_json::to_string(&self.user_key).unwrap_or_default();
-        let user_key_hash = sha1_hex(&user_key_json);
-        self.codex_home
-            .join(cache_dir)
-            .join(format!("{user_key_hash}.json"))
-    }
-}
-
-pub(crate) enum CachedCodexAppsToolsLoad {
-    Hit(Vec<ToolInfo>),
-    Missing,
-    Invalid,
-}
 
 pub(crate) fn normalize_codex_apps_tool_title(connector_name: Option<&str>, value: &str) -> String {
     let Some(connector_name) = connector_name
@@ -124,152 +63,3 @@ pub(crate) fn normalize_codex_apps_callable_namespace(
         server_name.to_string()
     }
 }
-
-pub(crate) fn write_codex_apps_tools_cache(
-    cache_context: Option<&CodexAppsToolsCacheContext>,
-    server_info: &McpServerInfo,
-    tools: &[ToolInfo],
-) {
-    if let Some(cache_context) = cache_context {
-        let cache_write_start = Instant::now();
-        write_cached_codex_apps_tools(cache_context, tools);
-        if let Err(err) = write_cached_codex_apps_server_info(cache_context, server_info) {
-            tracing::warn!("failed to write Codex Apps server info cache: {err:#}");
-        }
-        emit_duration(
-            MCP_TOOLS_CACHE_WRITE_DURATION_METRIC,
-            cache_write_start.elapsed(),
-            &[],
-        );
-    }
-}
-
-pub(crate) fn load_startup_cached_codex_apps_tools_snapshot(
-    cache_context: Option<&CodexAppsToolsCacheContext>,
-) -> Option<Vec<ToolInfo>> {
-    let cache_context = cache_context?;
-
-    match load_cached_codex_apps_tools(cache_context) {
-        CachedCodexAppsToolsLoad::Hit(tools) => Some(tools),
-        CachedCodexAppsToolsLoad::Missing | CachedCodexAppsToolsLoad::Invalid => None,
-    }
-}
-
-pub(crate) fn load_startup_cached_codex_apps_server_info(
-    cache_context: Option<&CodexAppsToolsCacheContext>,
-) -> Option<McpServerInfo> {
-    load_cached_codex_apps_server_info(cache_context?)
-}
-
-#[cfg(test)]
-pub(crate) fn read_cached_codex_apps_tools(
-    cache_context: &CodexAppsToolsCacheContext,
-) -> Option<Vec<ToolInfo>> {
-    match load_cached_codex_apps_tools(cache_context) {
-        CachedCodexAppsToolsLoad::Hit(tools) => Some(tools),
-        CachedCodexAppsToolsLoad::Missing | CachedCodexAppsToolsLoad::Invalid => None,
-    }
-}
-
-#[instrument(level = "trace", skip_all)]
-pub(crate) fn load_cached_codex_apps_tools(
-    cache_context: &CodexAppsToolsCacheContext,
-) -> CachedCodexAppsToolsLoad {
-    let cache_path = cache_context.tools_cache_path();
-    let bytes = match std::fs::read(cache_path) {
-        Ok(bytes) => bytes,
-        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
-            return CachedCodexAppsToolsLoad::Missing;
-        }
-        Err(_) => return CachedCodexAppsToolsLoad::Invalid,
-    };
-    let cache: CodexAppsToolsDiskCache = match serde_json::from_slice(&bytes) {
-        Ok(cache) => cache,
-        Err(_) => return CachedCodexAppsToolsLoad::Invalid,
-    };
-    if cache.schema_version != CODEX_APPS_TOOLS_CACHE_SCHEMA_VERSION {
-        return CachedCodexAppsToolsLoad::Invalid;
-    }
-    CachedCodexAppsToolsLoad::Hit(cache.tools)
-}
-
-pub(crate) fn write_cached_codex_apps_tools(
-    cache_context: &CodexAppsToolsCacheContext,
-    tools: &[ToolInfo],
-) {
-    let cache_path = cache_context.tools_cache_path();
-    if let Some(parent) = cache_path.parent()
-        && std::fs::create_dir_all(parent).is_err()
-    {
-        return;
-    }
-    let Ok(bytes) = serde_json::to_vec_pretty(&CodexAppsToolsDiskCache {
-        schema_version: CODEX_APPS_TOOLS_CACHE_SCHEMA_VERSION,
-        tools: tools.to_vec(),
-    }) else {
-        return;
-    };
-    let _ = std::fs::write(cache_path, bytes);
-}
-
-#[instrument(level = "trace", skip_all)]
-pub(crate) fn load_cached_codex_apps_server_info(
-    cache_context: &CodexAppsToolsCacheContext,
-) -> Option<McpServerInfo> {
-    let bytes = std::fs::read(cache_context.server_info_cache_path()).ok()?;
-    let cache: CodexAppsServerInfoDiskCache = serde_json::from_slice(&bytes).ok()?;
-    (cache.schema_version == CODEX_APPS_SERVER_INFO_CACHE_SCHEMA_VERSION)
-        .then_some(cache.server_info)
-}
-
-fn write_cached_codex_apps_server_info(
-    cache_context: &CodexAppsToolsCacheContext,
-    server_info: &McpServerInfo,
-) -> anyhow::Result<()> {
-    let cache_path = cache_context.server_info_cache_path();
-    if let Some(parent) = cache_path.parent() {
-        std::fs::create_dir_all(parent).with_context(|| {
-            format!(
-                "failed to create Codex Apps server info cache directory `{}`",
-                parent.display()
-            )
-        })?;
-    }
-    let bytes = serde_json::to_vec_pretty(&CodexAppsServerInfoDiskCache {
-        schema_version: CODEX_APPS_SERVER_INFO_CACHE_SCHEMA_VERSION,
-        server_info: server_info.clone(),
-    })
-    .context("failed to serialize Codex Apps server info cache")?;
-    std::fs::write(&cache_path, bytes).with_context(|| {
-        format!(
-            "failed to write Codex Apps server info cache `{}`",
-            cache_path.display()
-        )
-    })?;
-    Ok(())
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct CodexAppsToolsDiskCache {
-    schema_version: u8,
-    tools: Vec<ToolInfo>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct CodexAppsServerInfoDiskCache {
-    schema_version: u8,
-    server_info: McpServerInfo,
-}
-
-const CODEX_APPS_TOOLS_CACHE_DIR: &str = "cache/codex_apps_tools";
-pub(crate) const CODEX_APPS_TOOLS_CACHE_SCHEMA_VERSION: u8 = 4;
-
-const CODEX_APPS_SERVER_INFO_CACHE_DIR: &str = "cache/codex_apps_server_info";
-const CODEX_APPS_SERVER_INFO_CACHE_SCHEMA_VERSION: u8 = 1;
-
-fn sha1_hex(s: &str) -> String {
-    let mut hasher = Sha1::new();
-    hasher.update(s.as_bytes());
-    let sha1 = hasher.finalize();
-    format!("{sha1:x}")
-}