feat: add persistent governed Codex coworker

.env.example

@@ -137,8 +137,23 @@ COPILOTKIT_LICENSE_TOKEN=
 # 0, or leaving this unset, switches the watchdog off. Nothing is watched and no turn is ever ended.
 AGENT_STALL_TIMEOUT_MS=60000
 
+# Local Codex compatibility mode. This runs the host-side AG-UI adapter on port 4202, reuses the
+# account already authenticated by `codex login`, and skips the two API-key Bot containers. Its
+# Codex threads survive adapter restarts. Every side-effecting tool call returns through OpenBot's
+# signed gateway, where the current grant, policy and audit trail are applied. MCP, app, plugin and
+# web capabilities are disabled; turns are sandboxed read-only without network access, and the
+# adapter interrupts any native shell or file action Codex still attempts.
+#
+# CODEX_AGENT_ENABLED=true
+# CODEX_AGENT_PORT=4202
+# CODEX_AGENT_WORKSPACE=.openbot-codex/workspace
+# CODEX_AGENT_STATE=.openbot-codex/threads.json
+# OPENBOT_TOOL_URL=http://localhost:3001/api/agent-tools/call
+# AGENT_ENDPOINT_ALLOWED_HOSTS=localhost:4202
+
 # Model key. Required by the proof-of-concept Bot, which speaks OpenAI's API directly, and by the
-# framework Bot unless you point it at another provider below.
+# framework Bot unless you enable the local Codex compatibility mode above or point it at another
+# provider below.
 OPENAI_API_KEY=
 
 # Where that key is spent. Unset, it is OpenAI. Set, it is any endpoint speaking the same
@@ -329,4 +344,3 @@ AGENT_TOOL_TOKEN=
 # for a deployment that has not stood up a worker. Set for one that has: openssl rand -base64 32.
 # Do not accept a default in production.
 WORKER_SHARED_SECRET=
-

.gitignore

@@ -18,6 +18,7 @@ node_modules/
 app/src/lib/generated/application-config.ts
 .logs/
 .demo-logs/
+.openbot-codex/
 **/.impeccable
 .wave-state.md
 

CHANGELOG.md

@@ -8,6 +8,19 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
+### A local Codex coworker keeps its conversation and uses OpenBot's governed tools
+
+OpenBot can now run a coworker through the Codex app already signed in on the host, without an API
+key. Its conversation survives adapter and app-server restarts: OpenBot records the Codex thread it
+owns, resumes that exact thread, and refuses to silently replace unreadable recovery state.
+
+Connector calls do not go around the deployment. Codex sees only the tools OpenBot assigned to that
+coworker, and every call returns with the deployment's signed run assertion through the existing
+grant, policy and audit gateway. Native Codex shell, file, web, app, plugin and MCP paths are disabled
+or interrupted for this mode, and the remaining turn is sandboxed read-only without network access.
+Rejected, stale and duplicate callbacks are reported as failed tool results rather than being
+carried out.
+
 ### Coworkers are made in a wizard and managed in a dialog
 
 Creating a coworker is now a three-step wizard — who it is, who may see it, then where it runs,

agent-codex/README.md

@@ -0,0 +1,21 @@
+# Codex coworker
+
+This local-only AG-UI adapter lets OpenBot talk to the installed Codex app-server using the ChatGPT
+account already authenticated by `codex login`.
+
+The adapter records the join between each OpenBot Intelligence thread and its persistent Codex
+thread in `.openbot-codex/threads.json`. On every later run—including after the adapter restarts—it
+resumes that Codex thread and refreshes its standing instructions. Codex restores the dynamic-tool
+catalog persisted with the thread; OpenBot still rechecks the current grant and policy on every call.
+
+Only tools that OpenBot marks as deployment-owned are exposed as Codex dynamic tools. Calls return
+to `/api/agent-tools/call` with OpenBot's signed run assertion and agent token, so the deployment
+rechecks the Bot's grant and policy and writes the normal audit events. Codex-native shell, file,
+MCP, app, web and multi-agent paths are disabled. The adapter interrupts native shell and file
+attempts; turns run in the read-only sandbox without network access, so an action that races the
+interrupt cannot write or reach the network.
+
+Enable it with `CODEX_AGENT_ENABLED=true`. `scripts/start.sh` then runs this adapter on
+`CODEX_AGENT_PORT` (default `4202`) and skips the two provider-API-key Bot containers. The start
+script supplies `AGENT_TOOL_TOKEN`, `OPENBOT_TOOL_URL` and `CODEX_AGENT_STATE`; set those explicitly
+when starting `agent-codex` by hand.

agent-codex/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@openbot/agent-codex",
+  "version": "0.0.2",
+  "license": "MIT",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "bun src/index.ts",
+    "dev": "bun --watch src/index.ts",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@ag-ui/core": "0.0.57",
+    "@ag-ui/encoder": "0.0.57"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.3",
+    "typescript": "^5.9.3"
+  }
+}