Refresh Codex dev app-server components

[ScriptedAlchemy]

Summary

• refresh an already-running Codex app-server through its documented local control transport and idempotent plugin/install request before a dev epoch is attached
• keep the stable receipt-owned marketplace source and the existing immutable-generation fallback when no app-server is running; report refresh failures as AB7202
• cover the persistent fake contract and an opt-in real Codex app-server, including MCP/hooks, rebuild digest changes, and one registration

Closes #716

Validation

• pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit — passed (300 files; 4,425 passed, 6 skipped)
• pnpm test:host-install — passed (4 files; 26 passed, 2 skipped)
• AGENT_BUNDLE_NATIVE_HOST_CONTRACTS=1 pnpm exec rstest --config rstest.native-host.config.ts --testNamePattern 'app-server started before' — passed against Codex 0.153.4 (1 passed, 31 filtered skips)
• pnpm docs:site:build — passed

Deslop

Deslop: GPT-5.6 Sol, 9 edits.

Removed the redundant CLI refresh path, kept Codex's atomic host-owned install as the live-app-server publication, reused the existing stable source, host-root, and path-existence helpers, made server-request frames non-responses, and limited the native fixture to its opt-in lane.

Self-review

Reviewer: Claude Fable 5.1 Thinking High

First pass findings and disposition:

• Medium: the real Codex proof was not collected by a scripted lane. Moved it to native-codex-app-server.test.ts and added it to rstest.native-host.config.ts through nativeHostTestFiles.
• Medium: the proof hashed Agent Bundle's source instead of Codex's installed copy. It now hashes the Codex-owned destination and delays a colliding server request in the fake contract, so an early or omitted refresh fails.
• Low: rollback wording was too broad after a host-owned atomic swap. Qualified the English, Chinese, and AB7202 reference text.
• Low: non-ENOENT transport failures are loud. Kept intentionally: reporting attachment after a known running app-server rejected refresh would recreate Codex dev install is not visible to a running plugin app-server until remove/add refreshes it #716.
• Low: a server request sharing an id could be mistaken for a response. Frames carrying method are now ignored by the response matcher and covered by the fake contract.
• Low: branch and changeset hygiene. Rebased onto current origin/main; the changeset now ends in (#722).
• Low residual: changing plugin versions inside one running dev process remains the existing unsupported lifecycle boundary and is outside Codex dev install is not visible to a running plugin app-server until remove/add refreshes it #716.

Second and final passes: no bugs, breaking changes, security concerns, or documentation gaps. Guarded the native fixture build when prerequisites are absent. The native-host workflow remains intentionally local/manual and its passing command is recorded above.

GitHub Codex review: one path-helper finding; fixed in ec419a69c8, replied to, and resolved.

[changeset-bot]

🦋 Changeset detected

Latest commit: ec419a6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T00:17:02.402556Z	f98bd17	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f98bd17523

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".