fix(codex): persist session messages after app-server turn (#38210)

[Tranquil-Flow]

What

The codex app-server runtime path (run_codex_app_server_turn) bypasses the session persistence that the chat_completions path performs. Completed turns are never written to the messages table in state.db, so session.resume / session.info report message_count: 0 with messages: []. The desktop SPA reconciles its conversation view against that empty server state and discards the just-streamed reply.

Fix

Added agent._persist_session(messages) after successful codex app-server turns, gated on not turn.interrupted and turn.error is None, with exception safety. Mirrors the same pattern already used for external memory sync in the same function.

Files changed

• agent/codex_runtime.py — +11 lines: persist call + comment block
• tests/agent/transports/test_codex_app_server_runtime.py — +104 lines: 3 regression tests

Verification

• Root cause confirmed: run_codex_app_server_turn() on upstream/main does not call _persist_session(). The codex app-server path returns directly, bypassing session persistence.
• 30/30 tests pass in test_codex_app_server_runtime.py (27 existing + 3 new).
• Regression tests:
  • test_persist_called_on_success — verifies _persist_session is called with messages including the assistant reply
  • test_persist_not_called_on_interrupt — verifies persistence is skipped on interrupted turns
  • test_persist_not_called_on_error — verifies persistence is skipped on errored turns

Competitor analysis

No competing open PRs found for this issue.

---

Auto-published by Moonsong via Path B automated pipeline.

[gitszabolcs]

Tested this patch live against f019a9c4 — applied this exact diff to agent/codex_runtime.py, restarted the dashboard, and drove a real openai-codex/gpt-5.5 turn from the macOS desktop app over a remote connection.

✅ It fixes #38210. Codex turns now persist; the desktop view no longer reconciles away the streamed reply. sessions.message_count is non-zero and the assistant row lands in messages.

⚠️ But it surfaces a pre-existing duplication: every user message is now written (and displayed) twice. Assistant messages are unaffected.

state.db after two turns, with only this patch applied:

rowid | role      | content
405   | user      | 'hi'
406   | user      | 'hi'                   <- duplicate
407   | assistant | 'Hi. What would you like to work on?'
408   | user      | 'Finally you work!'
409   | user      | 'Finally you work!'    <- duplicate
410   | assistant | "I'm here and responding..."

Root cause

run_codex_app_server_turn does messages.extend(turn.projected_messages), and codex's projector (codex_event_projector.py::_project_user_message) re-emits the user turn as a userMessage echo. But run_conversation() has already appended the user message before this path runs (there's even a NOTE in the function about exactly this). So messages ends up as [user, user, assistant].

Pre-patch this was invisible: the codex path never persisted, and the empty server view got reconciled to nothing. Now that _persist_session(messages) flushes the list, the duplicate user row becomes real and visible.

The new regression test passes because its mocked turn.projected_messages contains only an assistant entry — a real codex turn's projection leads with the userMessage echo, which the mock doesn't reproduce.

Suggested fix

Drop the echo at the splice point, since Hermes already owns the user message:

if turn.projected_messages:
    # Codex re-emits the user turn as a userMessage echo, but
    # run_conversation() already appended the user message (see NOTE
    # above). Drop it so the turn isn't stored/shown twice.
    projected = [m for m in turn.projected_messages if m.get("role") != "user"]
    messages.extend(projected)

With both changes applied, a fresh session persists exactly 1 user + 1 assistant per turn and the desktop view is correct. A regression test that includes a userMessage item in the mocked projection (not just an agentMessage) would have caught this. Happy to open a follow-up PR if useful.

[teknium1]

Thanks for the persistence diagnosis and regression coverage.

Automated hermes-sweeper review found that current main already implements the requested Codex app-server persistence guarantee with the duplicate-write safeguard identified in the discussion:

• agent/turn_context.py:354-356 persists the inbound user turn before the Codex early return.
• agent/codex_runtime.py:445-470 appends projected Codex messages and flushes only newly unpersisted rows via _flush_messages_to_session_db(messages).
• agent/codex_runtime.py:535-546 returns agent_persisted=True, preventing the gateway from re-inserting the already-persisted user message.
• tests/agent/test_codex_app_server_persist.py:79-129 verifies exactly-once user/assistant persistence against a real SessionDB and FTS visibility.

This landed in dc1ea005d9dbf7cbe18380755bfc4d4c08df9553 and shipped in v2026.7.1.