feat(codex): wake threads from background monitoring events

[tris203]

What Changed

Codex background commands can outlive a turn, but their output does not wake the agent. Add session-scoped monitor_subscribe and monitor_unsubscribe tools to the existing T3 MCP server so Codex 0.153.2+ can subscribe to a native shell process, finish its turn, and respond when the watcher emits an event.

The adapter emits the existing task lifecycle events used by Claude's monitoring UI. Wake output is bounded and coalesced while foreground work runs; Stop cancels background processes and queued wakes. Explicitly rejected events remain recoverable, and ambiguous timeouts retain diagnostics without automatic replay.

Why

Keep process execution under Codex's native shell approvals and sandbox while using T3's existing authenticated MCP toolkit and monitoring presentation. Monitoring capability is independent of browser permission, and tools are hidden from sessions without that capability. No environment marker, monitoring prompt injection, or client UI changes are required.

Validation

• 197 focused server tests pass, including MCP HTTP discovery, credential isolation, event framing, foreground deferral, stalled-request Stop handling, and failed-delivery recovery.
• Server typecheck, targeted lint, and diff whitespace checks pass.
• Live Codex 0.153.2 launched a watcher, subscribed through MCP, finished its turn, woke from output, and stopped successfully.
• Tool descriptions explicitly guide watch requests and timers; model tool selection remains model-driven.

Implemented with GPT-6 and GPT-5.6 Sol through the Codex harness in T3 Code.

Note

Add Codex background monitoring with capability-gated MCP subscribe/unsubscribe tools

• Introduces CodexBackgroundTasks to track native shell tasks, frame their output into bounded monitor events, and queue wake signals for idle threads
• Adds MonitorSessions service and MonitorSession registry so MCP tool calls route subscribe/unsubscribe operations to the matching provider session
• Adds monitor_subscribe and monitor_unsubscribe MCP tools, discovered only when the invocation context carries the monitor capability
• ProviderService.prepareMcpSession now issues monitor capability for Codex sessions independent of the browser preview capability; sessions with no capabilities receive no credential
• CodexSessionRuntime serializes user turns and monitor wakes, delivers one background wake when the session is idle and subscribed, and on Stop/interrupt cancels queued wakes, stops background tasks, and attempts bounded terminal cleanup
• CodexAdapter.mapToRuntimeEvents exposes background task lifecycle and monitor delivery as task.started, item.completed, and task.completed runtime events
• Risk: CodexSessionRuntime.sendTurn and interruptTurn now apply a 10-second timeout to MCP reload and turn-start operations; a stalled Codex peer that previously blocked indefinitely now fails after the timeout. McpCapability gained a monitor member and McpCredentialRequest gained an optional capabilities field, defaulting to preview when omitted — out-of-tree callers that construct credential requests without capabilities still get preview-only behavior.

^{Macroscope summarized ce3848a.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a new Codex background-monitoring workflow across the MCP authorization layer, provider service, event adapter, and session runtime, including automatic wake turns and Stop-time process cleanup. Its cross-cutting runtime and capability/credential changes exceed the scope of an auto-approvable additive change and merit human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[tris203]

Addressed the static-analysis suppression called out in the final approval summary in 7a39b4c: the runtime test now uses the existing Effect FileSystem and Path services, with no diagnostic override. All 13 runtime tests, server typecheck, and targeted lint pass. The monitoring capability remains enabled for Codex as requested; the repository policy requiring human review for product-default changes still applies.