Repository navigation
feat(agents): Codex bots, experimental (A3a of spec 30) - #249
Merged
Merged
Conversation
One codex app-server per bot, spoken to in JSON-RPC: a wrapper (CodexControl) turns Botloft's turn line into turn/start once the thread exists and no turn runs; the decoder maps item/turn/tokenUsage notifications onto the chat, the exact context window and the turn's tokens. Botloft's MCP server goes in the thread config with the bot's token; the owner's MCP servers, plugins, hooks and notifier are switched off with -c. Read-only sandbox, nothing asked, so the bot reads and answers; approvals are A3b. Agent gains attach (wrap the process). Checked with the real codex 0.148.0-alpha.9 in a dev daemon.
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First slice of Codex bots, off unless
experimental_agents = ["codex"]is inconfig.toml(codex_pathto point at the executable).What it does. One
codex app-serverper bot over stdio JSON-RPC.CodexControlwraps the process: it takes Botloft's neutral turn line, does the handshake (initialize,thread/startorthread/resume) and sendsturn/startwhen the thread exists and no turn runs, queuing the rest. The decoder mapsitem/*,turn/*andthread/tokenUsage/updatedonto the chat: replies and live text, tools (shown as Bash, Write/Edit andmcp__botloft__*), read receipt, turn end with the turn's tokens, the conversation to resume, the exact context window and the model.Team and isolation. Botloft's MCP server goes into the thread's config with the bot's token;
AGENTS.mdholds the rules. The owner's MCP servers, plugins, hooks and notifier are switched off with-c; the login is used as is (sharedCODEX_HOME, no token copy).Limits (spec 30.3.2).
read-onlysandbox andapprovalPolicy: never: the bot reads and answers, it cannot change files or run commands that write. Reads are not fenced; the owner's globalAGENTS.mdand personal skills stay visible. No model picker or images yet. The dialog says so in the three languages. Approvals through Botloft's cards are A3b.Why read-only. With
workspace-writethe sandbox's command hung on this machine (spec 30.4);read-onlyplus approvals is also the model that gives the owner the usual 'ask before acting'.Interface.
Agentgainsattach(wrap the process and make its decoder); Claude and agy keep the default.Checked with the real codex 0.148.0-alpha.9 in a dev daemon: the bot knew its name and crew from
AGENTS.md, listed and called the crew's tools, and its attempt to write a file failed as a failed Bash tool.Tests:
codex_bot.rs(handshake and the owner's things off, chat/tokens/context, answers to requests, resume and lost thread),codex_wireunit tests, an app test for the dialog; fmt, clippy -D warnings,cargo test --workspaceandpnpm checkpass.