From 6dbd914fb9416ef8db019b1b234cbb4b647aa536 Mon Sep 17 00:00:00 2001
From: Phelipe Lorran <112786693+httpsphl@users.noreply.github.com>
Date: Sat, 10 Oct 2026 18:53:00 -0300
Subject: [PATCH] feat(agents): Codex login and limit states, compaction and
 connected tools (A3d)

- account/read at the handshake and codexErrorInfo unauthorized end in
  auth_error with a notice; usageLimitExceeded pauses the bot until the
  window's resetsAt.
- bots.compact works for Codex: thread/compact/start through the wrapper;
  the compaction turn shows a notice and no turn line.
- The owner's connected tools go in the thread's mcp_servers, secrets in
  place; a third-party tool's name is read from the request's message.
Checked with the real codex: compaction through the daemon.
---
 app/src/features/chat/ContextMeter.tsx     |  18 ++-
 app/src/features/chat/agentBot.test.tsx    |  23 +++
 app/src/i18n/en/chat.ts                    |   1 +
 app/src/i18n/es/chat.ts                    |   1 +
 app/src/i18n/pt-BR/chat.ts                 |   1 +
 crates/botloftd/src/agent/codex.rs         |   4 +
 crates/botloftd/src/agent/codex_decoder.rs | 117 +++++++++++++-
 crates/botloftd/src/agent/codex_wire.rs    |  71 +++++++--
 crates/botloftd/src/agent/mod.rs           |   9 ++
 crates/botloftd/src/context/mod.rs         |  32 ++--
 crates/botloftd/src/supervisor/spawn.rs    |   3 +
 crates/botloftd/src/workspace/connected.rs |  70 +++++++++
 crates/botloftd/src/workspace/mod.rs       |   2 +-
 crates/botloftd/tests/codex_bot.rs         | 171 +++++++++++++++++++++
 docs/spec.md                               |   7 +-
 15 files changed, 497 insertions(+), 33 deletions(-)

diff --git a/app/src/features/chat/ContextMeter.tsx b/app/src/features/chat/ContextMeter.tsx
index 7ba43671..c21e6a27 100644
--- a/app/src/features/chat/ContextMeter.tsx
+++ b/app/src/features/chat/ContextMeter.tsx
@@ -39,6 +39,8 @@ export function ContextMeter({ bot, onLater }: { bot: Bot; onLater(text: string)
   const near = usedTokens >= limit * NEAR;
   const left = autoCompactTokens === null ? null : autoCompactTokens - usedTokens;
   const claude = bot.agent === "claude";
+  // Claude Code and Codex answer a request to compact (spec 30).
+  const compactable = claude || bot.agent === "codex";
   const running = bot.state === "idle" || bot.state === "busy" || bot.state === "needs_approval";
 
   const compact = async () => {
@@ -77,17 +79,19 @@ export function ContextMeter({ bot, onLater }: { bot: Bot; onLater(text: string)
             )}
           </div>
           <p className="mt-2 text-ink-soft text-sm">
-            {!claude
+            {!compactable
               ? m.estimate
-              : left === null
-                ? m.noAuto
-                : left > 0
-                  ? m.autoLeft(tokens(left), tokens(autoCompactTokens ?? 0))
-                  : m.autoNow}
+              : bot.agent === "codex"
+                ? m.byItself
+                : left === null
+                  ? m.noAuto
+                  : left > 0
+                    ? m.autoLeft(tokens(left), tokens(autoCompactTokens ?? 0))
+                    : m.autoNow}
           </p>
           <p className="mt-1.5 text-muted text-xs">{m.about(bot.name)}</p>
           {/* Only Claude Code answers a request to compact (spec 30). */}
-          {claude && (
+          {compactable && (
             <div className="mt-3 border-line border-t pt-3">
               <Button
                 size="sm"
diff --git a/app/src/features/chat/agentBot.test.tsx b/app/src/features/chat/agentBot.test.tsx
index 5dc74239..e278706e 100644
--- a/app/src/features/chat/agentBot.test.tsx
+++ b/app/src/features/chat/agentBot.test.tsx
@@ -104,4 +104,27 @@ describe("a Codex bot", () => {
     fireEvent.click(screen.getByRole("button", { name: "Model: Default" }));
     expect(await screen.findByRole("menu", { name: "Model" })).toBeDefined();
   });
+
+  test("can compact its conversation, and says Codex does it by itself", async () => {
+    const fake = new FakeBotloft();
+    const crew = fake.addCrew("Ops");
+    const bot = fake.addBot(crew.id, "Cody");
+    fake.bot(bot.id).agent = "codex";
+    fake.setBotState(bot.id, "idle");
+    fake.setContext(bot.id, {
+      usedTokens: 90_000,
+      windowTokens: 258_400,
+      autoCompactTokens: null,
+      compacting: false,
+      updatedAt: 0,
+    });
+    renderApp(fake);
+    await crewOpened("Ops");
+    openBot("Cody");
+    await screen.findByRole("list", { name: "Messages" });
+    fireEvent.click(screen.getByRole("button", { name: /Conversation space/ }));
+    const panel = within(await screen.findByRole("dialog", { name: "Conversation space" }));
+    expect(panel.getByText(/Codex compacts it by itself/)).toBeDefined();
+    expect(panel.getByRole("button", { name: "Compact now" })).toBeDefined();
+  });
 });
diff --git a/app/src/i18n/en/chat.ts b/app/src/i18n/en/chat.ts
index f38ad4f8..ca5657b2 100644
--- a/app/src/i18n/en/chat.ts
+++ b/app/src/i18n/en/chat.ts
@@ -252,6 +252,7 @@ export const chat = {
     autoLeft: (left: string, at: string) => `${left} left before it compacts by itself, at ${at}.`,
     autoNow: "It is full enough to compact by itself on the next message.",
     noAuto: "It does not compact by itself.",
+    byItself: "Codex compacts it by itself when it gets close to full.",
     estimate:
       "An estimate: this agent does not say how large its window is, so the size comes from its model family.",
     compact: "Compact now",
diff --git a/app/src/i18n/es/chat.ts b/app/src/i18n/es/chat.ts
index 17f1d984..1b800946 100644
--- a/app/src/i18n/es/chat.ts
+++ b/app/src/i18n/es/chat.ts
@@ -244,6 +244,7 @@ export const chat: Messages["chat"] = {
     autoLeft: (left: string, at: string) => `Faltan ${left} para que se compacte sola, en ${at}.`,
     autoNow: "Ya está lo bastante llena para compactarse sola en el próximo mensaje.",
     noAuto: "No se compacta sola.",
+    byItself: "Codex la compacta solo cuando se acerca a llenarse.",
     estimate:
       "Una estimación: este agente no dice el tamaño de su ventana, así que el tamaño sale de la familia del modelo.",
     compact: "Compactar ahora",
diff --git a/app/src/i18n/pt-BR/chat.ts b/app/src/i18n/pt-BR/chat.ts
index d2711870..4dd1d35d 100644
--- a/app/src/i18n/pt-BR/chat.ts
+++ b/app/src/i18n/pt-BR/chat.ts
@@ -241,6 +241,7 @@ export const chat: Messages["chat"] = {
       `Faltam ${left} para ela se compactar sozinha, em ${at}.`,
     autoNow: "Já está cheia o bastante para se compactar sozinha na próxima mensagem.",
     noAuto: "Ela não se compacta sozinha.",
+    byItself: "O Codex compacta sozinho quando a conversa chega perto de encher.",
     estimate:
       "Uma estimativa: este agente não informa o tamanho da janela, então o tamanho vem da família do modelo.",
     compact: "Compactar agora",
diff --git a/crates/botloftd/src/agent/codex.rs b/crates/botloftd/src/agent/codex.rs
index 314c8bf5..0c7c5c8a 100644
--- a/crates/botloftd/src/agent/codex.rs
+++ b/crates/botloftd/src/agent/codex.rs
@@ -99,6 +99,10 @@ impl Agent for CodexAgent {
         false
     }
 
+    fn can_compact(&self) -> bool {
+        true
+    }
+
     fn encode_turn(&self, _uuid: &str, turn: &Turn) -> Bytes {
         // The wrapper turns this neutral line into a `turn/start`.
         super::neutral_turn_with_images(turn)
diff --git a/crates/botloftd/src/agent/codex_decoder.rs b/crates/botloftd/src/agent/codex_decoder.rs
index a6ee4027..17d6a6bd 100644
--- a/crates/botloftd/src/agent/codex_decoder.rs
+++ b/crates/botloftd/src/agent/codex_decoder.rs
@@ -9,13 +9,15 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use botloft_core::ids::BotId;
-use botloft_core::protocol::{PermissionMode, TokenUsage};
+use botloft_core::protocol::{
+    ChatBody, NoticeCode, NoticeItem, NoticeLevel, PermissionMode, TokenUsage,
+};
 use serde_json::{Value, json};
 
 use super::OutputDecoder;
 use super::codex_wire::{Answer, Shared};
 use crate::approvals::{self, Verdict};
-use crate::chat::sink;
+use crate::chat::{items, sink};
 use crate::state::Daemon;
 
 /// Reads what the server prints and tells the daemon.
@@ -33,6 +35,10 @@ pub(super) struct CodexDecoder {
     /// command, or the files a change touches.
     commands: HashMap<String, String>,
     changes: HashMap<String, Vec<(String, bool)>>,
+    /// When the usage limit resets, in Unix ms, from `account/rateLimits/updated`.
+    limit_resets_at: Option<i64>,
+    /// The running turn is a compaction: no line of its own for it.
+    compacting: bool,
 }
 
 impl CodexDecoder {
@@ -46,6 +52,8 @@ impl CodexDecoder {
             base: (0, 0, 0, 0),
             commands: HashMap::new(),
             changes: HashMap::new(),
+            limit_resets_at: None,
+            compacting: false,
         }
     }
 }
@@ -109,6 +117,7 @@ impl CodexDecoder {
             Answer::Failed(message) => {
                 tracing::warn!(bot = %bot, "codex could not start a thread: {message:?}");
             }
+            Answer::SignedOut => self.signed_out(daemon, bot, generation),
             Answer::Lost | Answer::None => {}
         }
     }
@@ -133,7 +142,7 @@ impl CodexDecoder {
             }
             "mcpServer/elicitation/request" => {
                 let server = params["serverName"].as_str().unwrap_or("mcp");
-                let tool = params["_meta"]["tool_name"].as_str().unwrap_or("tool");
+                let tool = tool_in(params["message"].as_str().unwrap_or_default());
                 (
                     format!("mcp__{server}__{tool}"),
                     params["_meta"]["tool_params"].clone(),
@@ -206,6 +215,13 @@ impl CodexDecoder {
             "item/started" => self.item_started(daemon, bot, generation, params),
             "item/completed" => self.item_completed(daemon, bot, &params["item"]),
             "thread/tokenUsage/updated" => self.token_usage(daemon, bot, &params["tokenUsage"]),
+            "account/rateLimits/updated" => {
+                // Seconds in Codex, milliseconds here.
+                self.limit_resets_at = params["rateLimits"]["primary"]["resetsAt"]
+                    .as_i64()
+                    .map(|seconds| seconds * 1000)
+                    .or(self.limit_resets_at);
+            }
             "turn/completed" => self.turn_completed(daemon, bot, generation, &params["turn"]),
             _ => {}
         }
@@ -260,6 +276,10 @@ impl CodexDecoder {
                     &json!({ "file_path": change["path"] }),
                 );
             }
+            Some("contextCompaction") => {
+                self.compacting = true;
+                crate::context::status(daemon, bot, &json!({ "status": "compacting" }));
+            }
             Some("mcpToolCall") => {
                 let name = format!(
                     "mcp__{}__{}",
@@ -276,6 +296,16 @@ impl CodexDecoder {
         let id = item["id"].as_str().unwrap_or_default();
         let ok = item["status"].as_str() == Some("completed");
         match item["type"].as_str() {
+            Some("contextCompaction") => {
+                // The owner asked, or it was full and Codex did it by itself.
+                let asked = daemon.contexts.get(bot).is_some_and(|c| c.compacting);
+                let trigger = if asked { "manual" } else { "auto" };
+                crate::context::compacted(
+                    daemon,
+                    bot,
+                    &json!({ "compact_metadata": { "trigger": trigger } }),
+                );
+            }
             Some("agentMessage") => {
                 sink::reply(daemon, bot, item["text"].as_str().unwrap_or_default());
             }
@@ -326,6 +356,26 @@ impl CodexDecoder {
 
     fn turn_completed(&mut self, daemon: &Daemon, bot: &BotId, generation: u64, turn: &Value) {
         let failed = turn["status"].as_str() != Some("completed");
+        // A compaction ends like a turn; its notice says what happened.
+        if std::mem::take(&mut self.compacting) && !failed {
+            self.usage_base();
+            self.shared.turn_done();
+            sink::finish_turn(daemon, bot, generation, false);
+            return;
+        }
+        match turn["error"]["codexErrorInfo"].as_str() {
+            Some("unauthorized") => {
+                self.signed_out(daemon, bot, generation);
+                self.shared.turn_done();
+                return;
+            }
+            Some("usageLimitExceeded") => {
+                self.limit_reached(daemon, bot, generation);
+                self.shared.turn_done();
+                return;
+            }
+            _ => {}
+        }
         let error = failed.then(|| {
             turn["error"]["message"]
                 .as_str()
@@ -353,6 +403,58 @@ impl CodexDecoder {
     }
 }
 
+impl CodexDecoder {
+    /// What the thread used so far is the base of the next turn.
+    fn usage_base(&mut self) {
+        self.base = self.usage;
+    }
+
+    fn notice(&self, daemon: &Daemon, bot: &BotId, text: &str) {
+        items::add(
+            daemon,
+            bot,
+            ChatBody::Notice(NoticeItem {
+                level: NoticeLevel::Error,
+                code: Some(NoticeCode::TurnFailed),
+                text: text.to_owned(),
+            }),
+        );
+    }
+
+    /// Nobody is signed in to Codex: only the owner can fix that, so the bot
+    /// stops until they restart it (spec 7.3).
+    fn signed_out(&self, daemon: &Daemon, bot: &BotId, generation: u64) {
+        self.notice(
+            daemon,
+            bot,
+            "Codex is not signed in. Sign in to Codex (codex login), then restart this bot.",
+        );
+        daemon.supervisor.signed_out(bot, generation);
+    }
+
+    /// The account reached its usage limit: messages wait until it resets.
+    fn limit_reached(&self, daemon: &Daemon, bot: &BotId, generation: u64) {
+        self.notice(
+            daemon,
+            bot,
+            "Codex reached its usage limit. Messages wait until it resets.",
+        );
+        let until = self
+            .limit_resets_at
+            .unwrap_or_else(|| daemon.clock.now_ms() + 5 * 60 * 1000);
+        daemon.supervisor.rate_limited(bot, generation, until);
+    }
+}
+
+/// The tool a request of an MCP server is about: the name in quotes in its
+/// message ("Allow the x MCP server to run tool \"y\"?").
+fn tool_in(message: &str) -> &str {
+    message
+        .split_once("tool \"")
+        .and_then(|(_, rest)| rest.split_once('"'))
+        .map_or("tool", |(name, _)| name)
+}
+
 /// Whether the request goes ahead: the bot's mode, a rule of the bot, or the
 /// owner (spec 10.1).
 async fn decide(
@@ -383,6 +485,15 @@ async fn decide(
 mod tests {
     use super::*;
 
+    #[test]
+    fn the_tool_is_the_name_in_quotes_of_the_message() {
+        assert_eq!(
+            tool_in("Allow the linkedin MCP server to run tool \"read_profile\"?"),
+            "read_profile"
+        );
+        assert_eq!(tool_in("something else"), "tool");
+    }
+
     #[test]
     fn a_text_that_names_a_fenced_folder_is_caught_whatever_the_slashes_and_case() {
         let fenced = vec![PathBuf::from(r"C:\Users\Ana\Botloft\Other")];
diff --git a/crates/botloftd/src/agent/codex_wire.rs b/crates/botloftd/src/agent/codex_wire.rs
index 89a8586b..8140d5c6 100644
--- a/crates/botloftd/src/agent/codex_wire.rs
+++ b/crates/botloftd/src/agent/codex_wire.rs
@@ -19,9 +19,11 @@ use crate::runtime::ProcessControl;
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum Pending {
     Initialize,
+    Account,
     ThreadStart,
     ThreadResume,
     Turn,
+    Compact,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -35,12 +37,20 @@ pub(super) enum Phase {
     Failed,
 }
 
+/// One thing for the thread to do.
+enum Work {
+    /// A message: the input of a `turn/start`.
+    Turn(Vec<Value>),
+    /// Compact the conversation (it runs as a turn of its own).
+    Compact,
+}
+
 pub(super) struct State {
     next_id: u64,
     phase: Phase,
     pending: HashMap<u64, Pending>,
-    /// The input of messages waiting for the thread or for the running turn.
-    queue: VecDeque<Vec<Value>>,
+    /// What waits for the thread or for the running turn.
+    queue: VecDeque<Work>,
     turn_active: bool,
 }
 
@@ -117,6 +127,9 @@ impl Shared {
         if let Some(model) = &self.input.model {
             params["model"] = json!(model);
         }
+        for (slug, entry) in &self.input.connected {
+            params["config"]["mcp_servers"][slug] = entry.clone();
+        }
         params
     }
 
@@ -125,6 +138,12 @@ impl Shared {
     pub(super) fn enqueue(&self, line: &[u8]) -> io::Result<()> {
         let event: Value = serde_json::from_slice(line)
             .map_err(|err| io::Error::new(io::ErrorKind::InvalidData, err))?;
+        if event["event"] == "compact" {
+            let mut state = self.lock();
+            state.queue.push_back(Work::Compact);
+            self.pump(&mut state);
+            return Ok(());
+        }
         // Text as it is; an image as the data URL `turn/start` takes.
         let input: Vec<Value> = event["message"]["content"]
             .as_array()
@@ -147,7 +166,7 @@ impl Shared {
             })
             .unwrap_or_default();
         let mut state = self.lock();
-        state.queue.push_back(input);
+        state.queue.push_back(Work::Turn(input));
         self.pump(&mut state);
         Ok(())
     }
@@ -159,9 +178,18 @@ impl Shared {
         if state.turn_active {
             return;
         }
-        let Some(input) = state.queue.pop_front() else {
+        let Some(work) = state.queue.pop_front() else {
             return;
         };
+        let input = match work {
+            Work::Turn(input) => input,
+            Work::Compact => {
+                let params = json!({ "threadId": thread });
+                state.turn_active = true;
+                self.request(state, "thread/compact/start", params, Pending::Compact);
+                return;
+            }
+        };
         let mut params = json!({
             "threadId": thread,
             "input": input,
@@ -187,6 +215,8 @@ impl Shared {
         match kind {
             Pending::Initialize if !failed => {
                 self.send(&json!({ "method": "initialized", "params": {} }));
+                // Whether Codex is signed in: asked in parallel with the thread.
+                self.request(&mut state, "account/read", json!({}), Pending::Account);
                 let params = self.thread_params();
                 match &self.input.resume {
                     Some(thread) => {
@@ -218,6 +248,20 @@ impl Shared {
                     model: event["result"]["model"].as_str().map(str::to_owned),
                 }
             }
+            Pending::Account => {
+                // `account` is null when nobody is signed in.
+                if !failed && event["result"]["account"].is_null() {
+                    Answer::SignedOut
+                } else {
+                    Answer::None
+                }
+            }
+            Pending::Compact if failed => {
+                state.turn_active = false;
+                self.pump(&mut state);
+                Answer::None
+            }
+            Pending::Compact => Answer::None,
             Pending::Turn if failed => {
                 state.turn_active = false;
                 self.pump(&mut state);
@@ -263,6 +307,8 @@ pub(super) enum Answer {
     TurnRefused(Option<String>),
     /// The process cannot start a thread.
     Failed(Option<String>),
+    /// Nobody is signed in to Codex.
+    SignedOut,
 }
 
 /// What the supervisor writes to: Botloft's turn lines in, JSON-RPC out.
@@ -315,6 +361,7 @@ mod tests {
             effort: None,
             fenced: Vec::new(),
             may_ask: true,
+            connected: Vec::new(),
         }
     }
 
@@ -345,8 +392,11 @@ mod tests {
         assert_eq!(methods(), ["initialize"]);
 
         shared.answered(&json!({ "id": 1, "result": {} }));
-        assert_eq!(methods(), ["initialize", "initialized", "thread/start"]);
-        let start = written.lock().expect("lock")[2].clone();
+        assert_eq!(
+            methods(),
+            ["initialize", "initialized", "account/read", "thread/start"]
+        );
+        let start = written.lock().expect("lock")[3].clone();
         assert_eq!(start["params"]["approvalPolicy"], "on-request");
         assert_eq!(start["params"]["sandbox"], "read-only");
         assert_eq!(start["params"]["model"], "gpt-5.5");
@@ -355,7 +405,8 @@ mod tests {
             "Bearer tok"
         );
 
-        let answer = shared.answered(&json!({ "id": 2, "result": { "thread": { "id": "th-1" } } }));
+        shared.answered(&json!({ "id": 2, "result": { "account": { "type": "chatgpt" } } }));
+        let answer = shared.answered(&json!({ "id": 3, "result": { "thread": { "id": "th-1" } } }));
         assert!(matches!(answer, Answer::Thread { thread, .. } if thread == "th-1"));
         // Only the first message goes; the second waits for its turn.
         let turns: Vec<Value> = written
@@ -391,11 +442,11 @@ mod tests {
         let written = Arc::clone(&sink.0);
         let shared = Shared::begin(Box::new(sink), input(Some("old")));
         shared.answered(&json!({ "id": 1, "result": {} }));
-        let resume = written.lock().expect("lock")[2].clone();
+        let resume = written.lock().expect("lock")[3].clone();
         assert_eq!(resume["method"], "thread/resume");
         assert_eq!(resume["params"]["threadId"], "old");
 
-        let answer = shared.answered(&json!({ "id": 2, "error": { "message": "no rollout" } }));
+        let answer = shared.answered(&json!({ "id": 3, "error": { "message": "no rollout" } }));
         assert!(matches!(answer, Answer::Lost));
         let last = written.lock().expect("lock").last().cloned().expect("line");
         assert_eq!(last["method"], "thread/start");
@@ -407,7 +458,7 @@ mod tests {
         let written = Arc::clone(&sink.0);
         let shared = Shared::begin(Box::new(sink), input(None));
         shared.answered(&json!({ "id": 1, "result": {} }));
-        shared.answered(&json!({ "id": 2, "result": { "thread": { "id": "th" } } }));
+        shared.answered(&json!({ "id": 3, "result": { "thread": { "id": "th" } } }));
         let line = json!({ "event": "user", "message": { "role": "user", "content": [
             { "type": "text", "text": "look" },
             { "type": "image", "media_type": "image/png", "data": "AAAA" },
diff --git a/crates/botloftd/src/agent/mod.rs b/crates/botloftd/src/agent/mod.rs
index 7f5dc63d..891a39bf 100644
--- a/crates/botloftd/src/agent/mod.rs
+++ b/crates/botloftd/src/agent/mod.rs
@@ -88,6 +88,9 @@ pub struct AttachInput {
     pub fenced: Vec<PathBuf>,
     /// Whether it may ask the owner at all; a plan only reads.
     pub may_ask: bool,
+    /// The owner's connected tools (spec 25) as the agent's own MCP
+    /// configuration, secrets in place: by slug.
+    pub connected: Vec<(String, Value)>,
 }
 
 /// Reads one process's output, line by line (already JSON). One per process,
@@ -121,6 +124,12 @@ pub trait Agent: Send + Sync + 'static {
     /// `workspace::prepare_bot` does not (spec 30.2).
     fn write_launch_files(&self, files: &LaunchFiles<'_>) -> io::Result<()>;
 
+    /// Whether the conversation can be compacted on the owner's request
+    /// (spec 8.6): Claude Code answers `/compact`, and Codex has its own.
+    fn can_compact(&self) -> bool {
+        self.speaks_control()
+    }
+
     /// Whether the process answers Botloft's own requests on stdin (its
     /// settings, how full its conversation is, the state of its MCP servers,
     /// `/compact`). An agent that does not shows none of those (spec 30.2).
diff --git a/crates/botloftd/src/context/mod.rs b/crates/botloftd/src/context/mod.rs
index 345d7e3c..3c17b9d4 100644
--- a/crates/botloftd/src/context/mod.rs
+++ b/crates/botloftd/src/context/mod.rs
@@ -291,7 +291,8 @@ pub(crate) fn process_ended(daemon: &Daemon, bot: &BotId) {
 pub fn compact(daemon: &Daemon, params: BotIdParams) -> ApiResult<Bot> {
     let store = daemon.store();
     let (crew, record) = active(&store, &params.bot_id)?;
-    if !crate::agent::of(record.agent).is_some_and(|agent| agent.speaks_control()) {
+    let agent = crate::agent::of(record.agent);
+    if !agent.is_some_and(|agent| agent.can_compact()) {
         return Err(ApiError::validation(format!(
             "bots that run on {} cannot compact their conversation",
             record.agent.as_str()
@@ -306,16 +307,25 @@ pub fn compact(daemon: &Daemon, params: BotIdParams) -> ApiResult<Bot> {
         if !ready {
             return Err(not_running());
         }
-        let uuid = random_uuid();
-        let line = json!({
-            "type": "user",
-            "uuid": uuid,
-            "message": { "role": "user", "content": [{ "type": "text", "text": COMPACT }] },
-        });
-        daemon
-            .supervisor
-            .write_message(&record.id, &uuid, Bytes::from(format!("{line}\n")))
-            .map_err(|_| not_running())?;
+        if record.agent == botloft_core::protocol::AgentKind::Codex {
+            // Codex compacts as a turn of its own, asked by its wrapper.
+            let line = Bytes::from("{\"event\":\"compact\"}\n");
+            daemon
+                .supervisor
+                .write_control(&record.id, line)
+                .map_err(|_| not_running())?;
+        } else {
+            let uuid = random_uuid();
+            let line = json!({
+                "type": "user",
+                "uuid": uuid,
+                "message": { "role": "user", "content": [{ "type": "text", "text": COMPACT }] },
+            });
+            daemon
+                .supervisor
+                .write_message(&record.id, &uuid, Bytes::from(format!("{line}\n")))
+                .map_err(|_| not_running())?;
+        }
         update(daemon, &record.id, |entry| entry.compacting = true);
     }
     Ok(to_protocol(daemon, &store, &crew, record))
diff --git a/crates/botloftd/src/supervisor/spawn.rs b/crates/botloftd/src/supervisor/spawn.rs
index 6cc94c3d..bd675c44 100644
--- a/crates/botloftd/src/supervisor/spawn.rs
+++ b/crates/botloftd/src/supervisor/spawn.rs
@@ -168,6 +168,8 @@ pub(super) fn launch_spec(
     // which its `mcp.json` expands (spec 25.2).
     env.extend(mcp_secrets::environment(&daemon.paths.secrets(), &servers)?);
 
+    // The connected tools in the agent's own configuration, secrets in place.
+    let connected = workspace::connected::codex_entries(&servers, &env);
     let spec = SpawnSpec {
         program,
         args,
@@ -186,6 +188,7 @@ pub(super) fn launch_spec(
                 effort: bot.effort.cli_value().map(str::to_owned),
                 fenced: fenced.clone(),
                 may_ask: bot.permission_mode != botloft_core::protocol::PermissionMode::Plan,
+                connected,
             },
             token_hash: TokenHash::of(&token).to_hex(),
             resumed,
diff --git a/crates/botloftd/src/workspace/connected.rs b/crates/botloftd/src/workspace/connected.rs
index ecc86fa6..49fbc395 100644
--- a/crates/botloftd/src/workspace/connected.rs
+++ b/crates/botloftd/src/workspace/connected.rs
@@ -50,6 +50,58 @@ fn entry(server: &McpServer) -> Value {
     }
 }
 
+/// The servers as Codex's own MCP configuration for a thread, with the
+/// secrets in place: `env` is the bot's environment, which holds each one
+/// under the name `connected_var` gives (spec 25.2, 30). Botloft's own
+/// server is never one of them.
+pub fn codex_entries(
+    servers: &[McpServer],
+    env: &[(std::ffi::OsString, std::ffi::OsString)],
+) -> Vec<(String, Value)> {
+    let value = |name: &str| -> String {
+        env.iter()
+            .find(|(key, _)| key.to_string_lossy() == name)
+            .map(|(_, value)| value.to_string_lossy().into_owned())
+            .unwrap_or_default()
+    };
+    let named = |id: &McpServerId, kind: char, names: &[String]| -> Value {
+        let map: Map<String, Value> = names
+            .iter()
+            .enumerate()
+            .map(|(index, name)| {
+                (
+                    name.clone(),
+                    Value::String(value(&connected_var(id, kind, index))),
+                )
+            })
+            .collect();
+        Value::Object(map)
+    };
+    servers
+        .iter()
+        .filter(|server| server.slug != "botloft")
+        .map(|server| {
+            let entry = match server.kind {
+                McpKind::Http => {
+                    let mut entry = json!({ "url": server.url });
+                    if !server.header_names.is_empty() {
+                        entry["http_headers"] = named(&server.id, 'H', &server.header_names);
+                    }
+                    entry
+                }
+                McpKind::Stdio => {
+                    let mut entry = json!({ "command": server.command, "args": server.args });
+                    if !server.env_names.is_empty() {
+                        entry["env"] = named(&server.id, 'E', &server.env_names);
+                    }
+                    entry
+                }
+            };
+            (server.slug.clone(), entry)
+        })
+        .collect()
+}
+
 /// Adds `servers` to the `mcpServers` of `mcp.json`. The server of Botloft
 /// is never replaced: its slug is reserved when one is registered.
 pub fn add_to(mcp: &mut Value, servers: &[McpServer]) {
@@ -137,6 +189,24 @@ mod tests {
         assert!(entry.get("command").is_none());
     }
 
+    #[test]
+    fn codex_gets_the_secrets_in_place_and_never_the_botloft_server() {
+        use std::ffi::OsString;
+        let http = server(McpKind::Http);
+        let var = connected_var(&http.id, 'H', 0);
+        let env = vec![(OsString::from(var), OsString::from("Bearer s3cret"))];
+        let mut mine = server(McpKind::Http);
+        mine.slug = "botloft".to_owned();
+        let entries = codex_entries(&[http, mine], &env);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].0, "linkedin");
+        assert_eq!(entries[0].1["url"], "http://127.0.0.1:8000/mcp");
+        assert_eq!(
+            entries[0].1["http_headers"]["Authorization"],
+            "Bearer s3cret"
+        );
+    }
+
     #[test]
     fn the_server_of_botloft_is_never_replaced() {
         let mut other = server(McpKind::Http);
diff --git a/crates/botloftd/src/workspace/mod.rs b/crates/botloftd/src/workspace/mod.rs
index b05f07fd..ebdb35f5 100644
--- a/crates/botloftd/src/workspace/mod.rs
+++ b/crates/botloftd/src/workspace/mod.rs
@@ -2,7 +2,7 @@
 //! idempotent: running it again refreshes the generated files and keeps the
 //! bot's own `CLAUDE.md`.
 
-mod connected;
+pub mod connected;
 mod files;
 pub mod folder;
 mod memory;
diff --git a/crates/botloftd/tests/codex_bot.rs b/crates/botloftd/tests/codex_bot.rs
index 639c2d42..04ef4835 100644
--- a/crates/botloftd/tests/codex_bot.rs
+++ b/crates/botloftd/tests/codex_bot.rs
@@ -575,3 +575,174 @@ async fn the_next_start_resumes_the_thread_and_a_lost_one_starts_again() {
         .await;
     sent(&second, "thread/start").await;
 }
+
+#[tokio::test(start_paused = true)]
+async fn a_bot_whose_codex_is_signed_out_stops_and_says_so() {
+    let codex = codex_bot().await;
+    let process = codex.runtime.process(1).await;
+    let init = sent(&process, "initialize").await;
+    process
+        .emit(json!({ "id": init["id"], "result": {} }))
+        .await;
+    let account = sent(&process, "account/read").await;
+    process
+        .emit(json!({ "id": account["id"], "result": { "account": null, "requiresOpenaiAuth": true } }))
+        .await;
+    codex.until(BotState::AuthError).await;
+    let said = codex.items().into_iter().any(
+        |body| matches!(body, ChatBody::Notice(notice) if notice.text.contains("not signed in")),
+    );
+    assert!(said);
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_usage_limit_pauses_the_bot_until_the_account_resets() {
+    let codex = codex_bot().await;
+    let process = codex.runtime.process(1).await;
+    handshake(&process, "th-1").await;
+    codex.until(BotState::Idle).await;
+    codex.message("u-1", "hello");
+    let turn = sent(&process, "turn/start").await;
+    process
+        .emit(json!({ "id": turn["id"], "result": {} }))
+        .await;
+    process
+        .emit(notify("account/rateLimits/updated", json!({ "rateLimits": {
+            "primary": { "usedPercent": 100, "windowDurationMins": 43200, "resetsAt": 4_102_444_800_i64 } } })))
+        .await;
+    process
+        .emit(notify(
+            "item/started",
+            json!({ "threadId": "th-1", "item": { "type": "userMessage", "id": "i" } }),
+        ))
+        .await;
+    process
+        .emit(notify(
+            "turn/completed",
+            json!({ "threadId": "th-1", "turn": {
+            "id": "t", "status": "failed", "durationMs": 5,
+            "error": { "message": "limit", "codexErrorInfo": "usageLimitExceeded" } } }),
+        ))
+        .await;
+    codex.until(BotState::RateLimited).await;
+    let said = codex.items().into_iter().any(
+        |body| matches!(body, ChatBody::Notice(notice) if notice.text.contains("usage limit")),
+    );
+    assert!(said);
+}
+
+#[tokio::test(start_paused = true)]
+async fn the_owner_can_compact_a_codex_conversation() {
+    let codex = codex_bot().await;
+    let process = codex.runtime.process(1).await;
+    handshake(&process, "th-1").await;
+    codex.until(BotState::Idle).await;
+
+    botloftd::context::compact(
+        &codex.daemon,
+        botloft_core::protocol::BotIdParams {
+            bot_id: codex.bot.clone(),
+        },
+    )
+    .expect("compact");
+    let request = sent(&process, "thread/compact/start").await;
+    assert_eq!(request["params"]["threadId"], "th-1");
+
+    process
+        .emit(json!({ "id": request["id"], "result": {} }))
+        .await;
+    process
+        .emit(notify(
+            "turn/started",
+            json!({ "threadId": "th-1", "turn": { "id": "c" } }),
+        ))
+        .await;
+    process
+        .emit(notify(
+            "item/started",
+            json!({ "threadId": "th-1", "item": { "type": "contextCompaction", "id": "k" } }),
+        ))
+        .await;
+    process
+        .emit(notify(
+            "item/completed",
+            json!({ "threadId": "th-1", "item": { "type": "contextCompaction", "id": "k" } }),
+        ))
+        .await;
+    process
+        .emit(notify("turn/completed", json!({ "threadId": "th-1", "turn": { "id": "c", "status": "completed", "durationMs": 9 } })))
+        .await;
+    // The bot was idle all along, so wait for the notice itself.
+    let mut items = codex.items();
+    for _ in 0..600 {
+        if items.iter().any(|body| matches!(body, ChatBody::Notice(_))) {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(10)).await;
+        items = codex.items();
+    }
+    assert!(
+        items.iter().any(|body| matches!(body, ChatBody::Notice(_))),
+        "the notice of the compaction"
+    );
+    // Let the end of the turn of the compaction come through, too.
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    assert!(
+        !codex
+            .items()
+            .iter()
+            .any(|body| matches!(body, ChatBody::Turn(_))),
+        "no line for the compaction itself"
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn the_owners_connected_tools_are_in_the_thread_with_their_secrets() {
+    use botloft_core::protocol::{BotMcpSetParams, McpKind, McpSaveParams};
+    let codex = codex_bot().await;
+    let first = codex.runtime.process(1).await;
+    handshake(&first, "th-1").await;
+    codex.until(BotState::Idle).await;
+    let overview = botloftd::service::mcp::save(
+        &codex.daemon,
+        McpSaveParams {
+            server_id: None,
+            name: "LinkedIn".into(),
+            kind: McpKind::Http,
+            url: Some("http://127.0.0.1:8000/mcp".into()),
+            command: None,
+            args: Vec::new(),
+            headers: std::collections::BTreeMap::from([(
+                "Authorization".to_owned(),
+                "Bearer super-secret".to_owned(),
+            )]),
+            env: std::collections::BTreeMap::new(),
+            description: String::new(),
+        },
+    )
+    .expect("save");
+    botloftd::service::mcp::set_bot(
+        &codex.daemon,
+        BotMcpSetParams {
+            bot_id: codex.bot.clone(),
+            server_ids: vec![overview.servers[0].id.clone()],
+        },
+    )
+    .expect("attach");
+    // The bot restarts to read its new tools.
+    let process = codex.runtime.process(2).await;
+    assert!(first.killed());
+    let init = sent(&process, "initialize").await;
+    process
+        .emit(json!({ "id": init["id"], "result": {} }))
+        .await;
+    let start = sent(&process, "thread/start").await;
+    let servers = &start["params"]["config"]["mcp_servers"];
+    assert_eq!(servers["linkedin"]["url"], "http://127.0.0.1:8000/mcp");
+    assert_eq!(
+        servers["linkedin"]["http_headers"]["Authorization"],
+        "Bearer super-secret"
+    );
+    // The crew's own server is still there, with the bot's token.
+    assert!(servers["botloft"]["url"].is_string());
+}
diff --git a/docs/spec.md b/docs/spec.md
index d2e2a7d6..92a5d64d 100644
--- a/docs/spec.md
+++ b/docs/spec.md
@@ -2652,6 +2652,7 @@ Decisão e contexto: `docs/adr/0003-agentes.md`. Um bot tem um **agente**, `Bot.
 | **A2** | AGY, **experimental**: só existe quando `experimental_agents = ["agy"]` no `config.toml`. Lançamento, entrada e saída, MCP do Botloft, isolamento por regras `deny`, retomada de conversa, no `agy` real. Sem aprovações do dono e sem comandos de shell (30.3); sem modelo e esforço escolhidos, contexto, compactação nem ferramentas conectadas do dono | feito (sem seletor no app) |
 | **A3a** | Codex, **experimental** (`experimental_agents = ["codex"]`): um `codex app-server` por bot, a conversa por JSON-RPC, texto ao vivo, ferramentas, MCP do Botloft por conversa, contexto exato, retomada. Sandbox `read-only` e `approvalPolicy: never`: o bot lê e responde, não muda arquivos nem roda comandos que escrevam | feito |
 | **A3b** | Codex: `approvalPolicy: on-request` (`never` num bot em modo plano). Os pedidos de aprovação de comando e de alteração de arquivo viram os cartões do Botloft, com "sempre permitir" e as regras do bot, como no Claude; o modo do bot vale (`bypass` e `accept_edits` para edições); um pedido que nomeia uma pasta cercada é recusado sem perguntar | feito |
+| **A3d** | Codex: login e limite (`account/read` ao subir e `codexErrorInfo` `unauthorized` e `usageLimitExceeded` no fim do turno viram o aviso, o estado `auth_error` ou `rate_limited` com a hora de renovar de `account/rateLimits/updated`), compactar (`thread/compact/start`, que roda como um turno com um item `contextCompaction`; o Botloft mostra o aviso e nenhuma linha de turno) e as ferramentas conectadas do dono (no `mcp_servers` da conversa, com os segredos no lugar) | feito |
 | **A3c** | Codex: lista de modelos (`agents.models` com `codex`, que roda `model/list` num `app-server` curto, guardada por 10 minutos), esforço (o mesmo controle do Claude, enviado como `effort` em cada `turn/start`) e imagens (blocos `image` com URL de dados). **Falta:** o uso do plano (`account/rateLimits/updated`), que é de outra conta e entra com as contas por agente | feito |
 | **A5** | **Lacunas do AGY**: comandos liberados por bot, bot AGY sobe sem o Claude Code, retomada conferida com o `agy` real (30.3, 30.4) | feito |
 | **A4** | Seletor de agente no app (**feito**: na criação do bot, aparece quando há mais de um agente em `enabledAgents`, com o aviso de experimental e sem a escolha de modelo; o medidor de contexto, o esforço e o modelo do campo de mensagem só aparecem para bots Claude). **Falta:** conta e login de cada agente, paridade de rotinas, navegador, desktop e perguntas | em andamento |
@@ -2683,9 +2684,13 @@ Descoberta e saúde (binário, versão mínima, login, comando de entrar); lanç
 - **Processo:** `codex app-server -c features.apps=false -c features.hooks=false -c features.plugins=false -c notify=[] -c mcp_servers.<nome>.enabled=false` (um para cada MCP do `config.toml` do dono), na `CODEX_HOME` do dono: o login vale sem copiar o token. O invólucro `CodexControl` (`agent/codex_wire.rs`) recebe a linha neutra do Botloft e a vira `turn/start` quando a thread existe e nenhum turno roda; as mensagens esperam em fila.
 - **Aperto de mão:** `initialize`, `initialized`, `thread/start` (ou `thread/resume` com o id guardado; se não existir, `thread/start`). A thread leva `cwd` (a pasta do bot), `approvalPolicy: "never"`, `sandbox: "read-only"`, `model` (`Bot.agentModel`) e o servidor MCP `botloft` com o token deste processo em `http_headers`.
 - **Eventos:** `item/started` `userMessage` é o recibo de leitura da mensagem mais antiga escrita e grava a thread a retomar; `item/agentMessage/delta` é o texto ao vivo e `item/completed` `agentMessage` fecha a resposta; `commandExecution`, `fileChange` e `mcpToolCall` aparecem como `Bash`, `Write`/`Edit` e `mcp__<servidor>__<ferramenta>`; `thread/tokenUsage/updated` dá o contexto (a última requisição e `modelContextWindow`) e os tokens do turno (o total da thread menos o que era no começo); `turn/completed` fecha o turno com `durationMs` e o erro.
-- **Pedidos do servidor:** `mcpServer/elicitation/request` do servidor `botloft` é aceito (o bot precisa das ferramentas da equipe). `item/commandExecution/requestApproval` e `item/fileChange/requestApproval` viram um cartão com o vocabulário do Claude (`Bash` com o comando, `Write` ou `Edit` com o caminho que o `item/started` do mesmo `itemId` trouxe), passam pelas regras "sempre permitir" do bot e pelo modo dele, e a resposta é `accept` ou `decline`. A tool de outro servidor MCP pede do mesmo jeito. Um pedido cujo caminho ou comando contém uma pasta cercada (a lista da seção 7.5; barras e caixa não importam) é recusado sem cartão. O resto recebe um erro.
+- **Pedidos do servidor:** `mcpServer/elicitation/request` do servidor `botloft` é aceito (o bot precisa das ferramentas da equipe). `item/commandExecution/requestApproval` e `item/fileChange/requestApproval` viram um cartão com o vocabulário do Claude (`Bash` com o comando, `Write` ou `Edit` com o caminho que o `item/started` do mesmo `itemId` trouxe), passam pelas regras "sempre permitir" do bot e pelo modo dele, e a resposta é `accept` ou `decline`. A tool de outro servidor MCP pede do mesmo jeito: o nome vem da mensagem do pedido (`Allow the <servidor> MCP server to run tool "<nome>"?`) e os parâmetros de `_meta.tool_params`. Um pedido cujo caminho ou comando contém uma pasta cercada (a lista da seção 7.5; barras e caixa não importam) é recusado sem cartão. O resto recebe um erro.
 - **Verificado com o Codex real** (0.148.0-alpha.9, daemon de desenvolvimento): o bot soube o nome e a equipe pelo `AGENTS.md`, listou as ferramentas do `botloft`, chamou `crew_roster`, e a tentativa de criar um arquivo falhou como `Bash` falho.
+- **Login e limite:** o `account/read` que vai junto com o aperto de mão responde `account: null` quando ninguém entrou: o bot vira `auth_error` com um aviso para entrar no Codex e reiniciar. Um turno que termina com `codexErrorInfo: "unauthorized"` faz o mesmo; `"usageLimitExceeded"` põe o bot em `rate_limited` até o `resetsAt` da janela principal (5 minutos sem ele). Os dois estados vieram só de teste com o `FakeRuntime`: não foram provocados no Codex real.
+- **Compactar:** `bots.compact` escreve `{"event":"compact"}` no invólucro, que manda `thread/compact/start` quando nenhum turno roda. O Codex responde com um turno cujo item é `contextCompaction`; o Botloft marca "compactando", e ao fim põe o aviso e não cria a linha do turno. O Codex também compacta sozinho perto de encher (o painel diz isso).
+- **Ferramentas conectadas:** cada servidor do dono entra no `mcp_servers` do `thread/start` (`url` e `http_headers`, ou `command`, `args` e `env`) com o valor dos segredos; o servidor `botloft` nunca é substituído.
 - **Verificado com o Codex real:** um comando que escreve um arquivo chegou como cartão `Bash` (estado `needs_approval`); permitido, o arquivo foi criado; negado, o bot disse que a permissão foi negada e nada foi criado.
+- **Compactar com o Codex real:** a conversa tinha 17.930 tokens de 258.400; `bots.compact` gerou "compactando", o aviso, nenhuma linha de turno, e o bot ainda lembrou da palavra combinada.
 - **Limites:** a leitura não é limitada (`read-only` lê tudo, e um comando só de leitura roda sem perguntar, então uma pasta cercada não é protegida contra leitura por comando); o `AGENTS.md` global e as skills da pasta pessoal do dono continuam visíveis; o modelo vem da lista do próprio Codex (`Bot.agentModel`, `-c`/`model` da thread) e o esforço de `Bot.effort`; as imagens vão como `image` com URL de dados.
 
 ### 30.3.1 Isolamento dos agentes