Skip to content

Replace ChatGPT app-server with an on-demand thin Rust transport - #601

Open
cogwheel0 wants to merge 24 commits into
mainfrom
t3code/add-chatgpt-app-server
Open

Replace ChatGPT app-server with an on-demand thin Rust transport#601
cogwheel0 wants to merge 24 commits into
mainfrom
t3code/add-chatgpt-app-server

Conversation

@cogwheel0

@cogwheel0 cogwheel0 commented Jul 30, 2026

Copy link
Copy Markdown
Owner

Summary

Adds ChatGPT Account as a first-class backend, separate from Direct Connections, and replaces the intermediate in-process app-server with an on-demand thin Rust coordinator built on the pinned codex-api, codex-login, and codex-protocol crates.

Conduit remains the authoritative chat store. Rust starts only when ChatGPT is configured, selected, or has pending cleanup; it owns secure device-code authentication, Responses streaming, bounded scheduling, compaction, web search, and image generation.

Runtime boundary

  • FRB v3 exposes exactly 13 typed functions.
  • Exactly two tools are available: web.run and image_gen.imagegen.
  • No generic RPC, app-server/core direct dependency, arbitrary Dart tools, shell, patching, workspace/filesystem API, MCP, approvals, Git, V8, or Deno.
  • Authentication uses ephemeral codex-login storage and verified secure-storage mutation acknowledgement; Rust never creates auth.json.
  • Checkpoints are bounded, account/model/session/tool-policy bound, disposable, and fall back to full local replay.
  • Schema 10 stores only final transport-session and checkpoint state; no migration for the unmerged intermediate rollout schema is included.
  • The exposure audit reports accepted transitive Codex crates without failing the PR and rejects prohibited dependencies even when Cargo package aliases are used.

Verification

  • cargo fmt, warnings-denied clippy, 26 Rust tests, and the exposure audit pass.
  • FRB 2.12.0 regeneration is deterministic and committed.
  • flutter analyze passes.
  • 46 focused ChatGPT, FRB lifecycle, disconnect-ownership, image-cache, database, and exposure-audit tests pass after final review fixes.
  • 105 focused ChatGPT/direct-chat/native-sheet/release-notes tests pass after merging main.
  • Android split-ABI and unsigned iOS release builds passed before the release-build workflow job was removed.
  • Compressed native contribution measured 5.3 MiB armeabi-v7a, 7.0 MiB arm64-v8a, 7.0 MiB x86_64, and 5.9 MiB iOS.
  • Pixel 8 device verification covers account login, chat streaming, web-search sources, image generation, relaunch, and citation rendering. No iPhone device testing is part of the final review cycle.

Review status

  • Ready for review and merged with current main.
  • All five Macroscope findings and both Greptile findings are fixed across e5edfaa, e45cfb5, 65055da, and 40005e9 with regression coverage.
  • Greptile, Macroscope, and both native checks pass on final head 40005e9; all review threads are resolved.
  • CodeRabbit's full-PR review is skipped because 169 files exceed its 150-file limit. Incremental local reviews were run for every final patch; all actionable findings were fixed, and the final ownership and Rust deadlock confirmation reviews each returned zero findings.

Note

Add ChatGPT account backend with device-code login and on-demand Rust transport

  • Replaces the previous ChatGPT app-server approach with a thin Rust FFI library (conduit_chatgpt_runtime) built via Cargokit and bridged to Flutter using flutter_rust_bridge 2.12.0, exposing auth, model listing, turn streaming, and interruption APIs.
  • Adds ChatGptAccountAdapter implementing DirectProviderAdapter with model capability mapping, streaming completions, and cancellation that interrupts the native Rust turn.
  • Introduces a device-code login flow: ChatGptConnectionController manages auth state, ChatGptVerificationBrowser hosts an in-app webview restricted to auth.openai.com, and auto-dismisses on success.
  • Adds PreferredBackend.chatgpt, routing guards that redirect unauthenticated users to a new ChatGptAccountPage, and lazy runtime initialization gated on backend preference or pending cleanup state.
  • Persists ChatGPT auth snapshots via SecureCredentialStorage under a lock shared with deleteAll; adds a direct_thread_bindings table (schema v10) to durably bind local chats to ChatGPT transport sessions, with cascade-delete cleanup on disconnect.
  • Vendors a modified pagable 0.4.0 crate and the Cargokit build toolchain; CI audit scripts enforce pinned Codex commits, an approved FRB API allowlist, fixed base URL, and compressed artifact size budgets.
  • Risk: disabling use_precompiled_binaries means every developer and CI machine now compiles the Rust runtime locally, significantly increasing cold build times.

Macroscope summarized 40005e9.

Greptile Summary

This change adds ChatGPT Account as a first-class direct-chat backend, including native account authentication and streaming, durable local thread bindings and checkpoints, account-scoped cleanup on disconnect, routing, UI, and platform build integration.

The completion lifecycle was examined for the timing window where the native transport can emit a terminal event before startTurn returns its run identifier. The Dart adapter buffers these events, assigns the run identifier, and replays the buffer before awaiting completion; no defect was confirmed from the available evidence.

T-Rex validation blocked

  • Missing tool: flutter and dart. The focused reproduction and the targeted ChatGPT adapter/client tests could not execute because neither executable is installed.
  • The focused Rust event-hub test began compiling the locked native dependency graph but did not complete during the available execution window.

Confidence Score: 5/5

The PR is safe to merge; no blocking failure remains.

No verified defects or unresolved review findings remain. The examined early-event completion path explicitly buffers and replays events that precede the native run identifier, so terminal delivery is handled by the implementation. Flutter-based execution could not run because the required toolchain is unavailable, but that did not establish a product defect.

T-Rex T-Rex Logs

What T-Rex did

  • A focused Flutter race-reproduction was authored to emit a native completed event before startTurn returns its run ID and to verify that the adapter emits DirectStreamDone and settles completion; however, the reproduction and focused ChatGPT adapter/tests could not run because Flutter and Dart are not installed.
  • A focused Rust event-hub test was started, but its locked dependency compilation did not finish and no runtime assertion result was observed.
  • The overall result is blocked/inconclusive: the Dart route buffers pre-RunInfo events and replays them after obtaining the native run ID, while the native Rust path can emit early terminal events, but existing tests do not explicitly force terminal emission before startTurn resolves.

View all artifacts

T-Rex Ran code and verified through T-Rex

Reviews (5): Last reviewed commit: "fix(chatgpt): preempt blocked event deli..." | Re-trigger Greptile

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 169 files, which is 19 over the limit of 150.

To get a review, narrow the scope:
• coderabbit review --committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7a237c44-f651-4cd7-8bc6-ea95dfaf4eac

📥 Commits

Reviewing files that changed from the base of the PR and between 1af1d60 and 40005e9.

⛔ Files ignored due to path filters (5)
  • ios/Podfile.lock is excluded by !**/*.lock
  • native/chatgpt_runtime/Cargo.lock is excluded by !**/*.lock
  • native/mobile_compat/pagable/Cargo.lock is excluded by !**/*.lock
  • pubspec.lock is excluded by !**/*.lock
  • rust_builder/cargokit/build_tool/pubspec.lock is excluded by !**/*.lock
📒 Files selected for processing (169)
  • .github/workflows/chatgpt-runtime.yml
  • .gitignore
  • README.md
  • THIRD_PARTY_NOTICES.md
  • analysis_options.yaml
  • cargokit_options.yaml
  • docs/BUILDING.md
  • flutter_rust_bridge.yaml
  • lib/core/database/app_database.dart
  • lib/core/database/daos/direct_thread_bindings_dao.dart
  • lib/core/database/tables/direct_thread_bindings.dart
  • lib/core/persistence/persistence_keys.dart
  • lib/core/providers/app_providers.dart
  • lib/core/providers/backend_mode_providers.dart
  • lib/core/router/app_router.dart
  • lib/core/services/image_attachment_cache_service.dart
  • lib/core/services/media_upload_controller.dart
  • lib/core/services/native_sheet_bridge.dart
  • lib/core/services/navigation_service.dart
  • lib/core/services/secure_credential_storage.dart
  • lib/features/auth/providers/unified_auth_providers.dart
  • lib/features/auth/views/backend_chooser_page.dart
  • lib/features/chat/providers/chat_providers.dart
  • lib/features/chat/widgets/modern_chat_input.dart
  • lib/features/chatgpt/chatgpt_account_adapter.dart
  • lib/features/chatgpt/chatgpt_feature.dart
  • lib/features/chatgpt/chatgpt_providers.dart
  • lib/features/chatgpt/chatgpt_runtime_client.dart
  • lib/features/chatgpt/chatgpt_thread_binding_store.dart
  • lib/features/chatgpt/chatgpt_verification_browser.dart
  • lib/features/chatgpt/frb_chatgpt_runtime_client.dart
  • lib/features/chatgpt/native_generated/api/contract.dart
  • lib/features/chatgpt/native_generated/api/runtime.dart
  • lib/features/chatgpt/native_generated/frb_generated.dart
  • lib/features/chatgpt/native_generated/frb_generated.io.dart
  • lib/features/chatgpt/native_generated/frb_generated.web.dart
  • lib/features/chatgpt/views/chatgpt_account_page.dart
  • lib/features/direct_connections/models/direct_completion.dart
  • lib/features/direct_connections/providers/direct_connection_providers.dart
  • lib/features/direct_connections/services/direct_chat_bridge.dart
  • lib/features/direct_connections/services/direct_local_document_service.dart
  • lib/features/direct_connections/services/direct_model_registry.dart
  • lib/features/direct_connections/services/openai_compatible_adapter.dart
  • lib/features/direct_connections/views/direct_connection_editor_page.dart
  • lib/features/direct_connections/views/direct_connections_page.dart
  • lib/features/hermes/providers/hermes_providers.dart
  • lib/features/navigation/widgets/sidebar_user_pill.dart
  • lib/features/profile/views/profile_page.dart
  • lib/features/release_notes/release_notes_coordinator.dart
  • lib/l10n/app_cs.arb
  • lib/l10n/app_de.arb
  • lib/l10n/app_en.arb
  • lib/l10n/app_es.arb
  • lib/l10n/app_fr.arb
  • lib/l10n/app_it.arb
  • lib/l10n/app_ja.arb
  • lib/l10n/app_ko.arb
  • lib/l10n/app_nl.arb
  • lib/l10n/app_ru.arb
  • lib/l10n/app_sk.arb
  • lib/l10n/app_zh.arb
  • lib/l10n/app_zh_Hant.arb
  • lib/main.dart
  • native/chatgpt_runtime/.gitignore
  • native/chatgpt_runtime/Cargo.toml
  • native/chatgpt_runtime/cargokit.yaml
  • native/chatgpt_runtime/src/api/contract.rs
  • native/chatgpt_runtime/src/api/mod.rs
  • native/chatgpt_runtime/src/api/runtime.rs
  • native/chatgpt_runtime/src/frb_generated.rs
  • native/chatgpt_runtime/src/lib.rs
  • native/mobile_compat/pagable/Cargo.toml
  • native/mobile_compat/pagable/LICENSE-MIT
  • native/mobile_compat/pagable/README.md
  • native/mobile_compat/pagable/src/arc_erase.rs
  • native/mobile_compat/pagable/src/context.rs
  • native/mobile_compat/pagable/src/flavors.rs
  • native/mobile_compat/pagable/src/impls.rs
  • native/mobile_compat/pagable/src/impls/arc.rs
  • native/mobile_compat/pagable/src/impls/collections.rs
  • native/mobile_compat/pagable/src/impls/regex.rs
  • native/mobile_compat/pagable/src/impls/serde.rs
  • native/mobile_compat/pagable/src/impls/static_interner.rs
  • native/mobile_compat/pagable/src/impls/static_value.rs
  • native/mobile_compat/pagable/src/impls/std.rs
  • native/mobile_compat/pagable/src/impls/tuples.rs
  • native/mobile_compat/pagable/src/lib.rs
  • native/mobile_compat/pagable/src/pagable_arc.rs
  • native/mobile_compat/pagable/src/storage.rs
  • native/mobile_compat/pagable/src/storage/data.rs
  • native/mobile_compat/pagable/src/storage/handle.rs
  • native/mobile_compat/pagable/src/storage/in_memory.rs
  • native/mobile_compat/pagable/src/storage/support.rs
  • native/mobile_compat/pagable/src/storage/traits.rs
  • native/mobile_compat/pagable/src/test.rs
  • native/mobile_compat/pagable/src/test/derive.rs
  • native/mobile_compat/pagable/src/testing.rs
  • native/mobile_compat/pagable/src/traits.rs
  • native/mobile_compat/pagable/src/typetag.rs
  • pubspec.yaml
  • rust-toolchain.toml
  • rust_builder/.gitignore
  • rust_builder/README.md
  • rust_builder/android/.gitignore
  • rust_builder/android/build.gradle
  • rust_builder/android/settings.gradle
  • rust_builder/android/src/main/AndroidManifest.xml
  • rust_builder/cargokit/.gitignore
  • rust_builder/cargokit/LICENSE
  • rust_builder/cargokit/README
  • rust_builder/cargokit/build_pod.sh
  • rust_builder/cargokit/build_tool/README.md
  • rust_builder/cargokit/build_tool/analysis_options.yaml
  • rust_builder/cargokit/build_tool/bin/build_tool.dart
  • rust_builder/cargokit/build_tool/lib/build_tool.dart
  • rust_builder/cargokit/build_tool/lib/src/android_environment.dart
  • rust_builder/cargokit/build_tool/lib/src/artifacts_provider.dart
  • rust_builder/cargokit/build_tool/lib/src/build_cmake.dart
  • rust_builder/cargokit/build_tool/lib/src/build_gradle.dart
  • rust_builder/cargokit/build_tool/lib/src/build_pod.dart
  • rust_builder/cargokit/build_tool/lib/src/build_tool.dart
  • rust_builder/cargokit/build_tool/lib/src/builder.dart
  • rust_builder/cargokit/build_tool/lib/src/cargo.dart
  • rust_builder/cargokit/build_tool/lib/src/crate_hash.dart
  • rust_builder/cargokit/build_tool/lib/src/environment.dart
  • rust_builder/cargokit/build_tool/lib/src/logging.dart
  • rust_builder/cargokit/build_tool/lib/src/options.dart
  • rust_builder/cargokit/build_tool/lib/src/precompile_binaries.dart
  • rust_builder/cargokit/build_tool/lib/src/rustup.dart
  • rust_builder/cargokit/build_tool/lib/src/target.dart
  • rust_builder/cargokit/build_tool/lib/src/util.dart
  • rust_builder/cargokit/build_tool/lib/src/verify_binaries.dart
  • rust_builder/cargokit/build_tool/pubspec.yaml
  • rust_builder/cargokit/build_tool/test/rustup_test.dart
  • rust_builder/cargokit/cmake/cargokit.cmake
  • rust_builder/cargokit/cmake/resolve_symlinks.ps1
  • rust_builder/cargokit/gradle/plugin.gradle
  • rust_builder/cargokit/run_build_tool.cmd
  • rust_builder/cargokit/run_build_tool.sh
  • rust_builder/ios/Classes/dummy_file.c
  • rust_builder/ios/conduit_chatgpt_runtime.podspec
  • rust_builder/linux/CMakeLists.txt
  • rust_builder/macos/Classes/dummy_file.c
  • rust_builder/macos/conduit_chatgpt_runtime.podspec
  • rust_builder/pubspec.yaml
  • rust_builder/windows/.gitignore
  • rust_builder/windows/CMakeLists.txt
  • test/core/database/chat_list_index_migration_test.dart
  • test/core/database/daos/direct_thread_bindings_dao_test.dart
  • test/core/providers/backend_mode_providers_test.dart
  • test/core/router/chatgpt_lazy_runtime_test.dart
  • test/core/router/hermes_router_policy_test.dart
  • test/core/services/secure_credential_storage_test.dart
  • test/features/auth/views/adaptive_auth_flow_test.dart
  • test/features/chat/widgets/enhanced_image_attachment_cache_test.dart
  • test/features/chatgpt/chatgpt_account_adapter_test.dart
  • test/features/chatgpt/chatgpt_account_ui_test.dart
  • test/features/chatgpt/chatgpt_disconnect_cleanup_test.dart
  • test/features/chatgpt/frb_chatgpt_runtime_client_test.dart
  • test/features/direct_connections/direct_connections_ui_test.dart
  • test/features/direct_connections/direct_registry_test.dart
  • test/features/profile/profile_page_hermes_test.dart
  • test/features/release_notes/release_notes_coordinator_test.dart
  • test/tool/chatgpt_runtime_exposure_audit_test.dart
  • third_party/LICENSE-APACHE-2.0
  • third_party/LICENSE-FLUTTER-RUST-BRIDGE-MIT
  • tool/audit_chatgpt_release_size.sh
  • tool/audit_chatgpt_runtime_exposure.sh
  • tool/regenerate_chatgpt_bindings.sh

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Review on demand using usage pricing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@macroscopeapp

macroscopeapp Bot commented Jul 30, 2026

Copy link
Copy Markdown

Macroscope has since reviewed this pull request. An earlier review was skipped by a cost limit; a review has now completed, so that notice no longer applies.

ChatGPT models were routed through direct-only gates that trusted only OpenRouter and Ollama, while the router subscribed to native auth unconditionally. Advertise and trust canonical ChatGPT tool capabilities, then subscribe through a configured-or-selected gate. Regression tests cover both tool availability and zero eager controller builds.
Comment thread lib/core/router/app_router.dart
Force mobile model metadata onto direct web and image tools, import generated images from bounded validated payloads, and avoid false SVG classification from embedded metadata.

Hide Codex conversation lifecycle items from the visible tool stream so only reasoning appears as Thinking while sources and generated images retain their native chat surfaces. Add protocol-shaped regression coverage and extend the exposure audit.
Comment thread tool/audit_chatgpt_runtime_exposure.sh Outdated
Comment thread lib/core/services/image_attachment_cache_service.dart
Comment thread native/chatgpt_runtime/src/api/runtime.rs Outdated
@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@cogwheel0 cogwheel0 changed the title Add ChatGPT account backend with in-process Rust runtime Replace ChatGPT app-server with an on-demand thin Rust transport Jul 31, 2026
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread native/chatgpt_runtime/src/api/runtime.rs
@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Comment thread tool/audit_chatgpt_runtime_exposure.sh
@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread lib/features/chatgpt/frb_chatgpt_runtime_client.dart Outdated
Comment thread native/chatgpt_runtime/src/api/runtime.rs
@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@cogwheel0

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 1, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…p-server

# Conflicts:
#	lib/l10n/app_cs.arb
#	lib/l10n/app_de.arb
#	lib/l10n/app_en.arb
#	lib/l10n/app_es.arb
#	lib/l10n/app_fr.arb
#	lib/l10n/app_it.arb
#	lib/l10n/app_ja.arb
#	lib/l10n/app_ko.arb
#	lib/l10n/app_nl.arb
#	lib/l10n/app_ru.arb
#	lib/l10n/app_sk.arb
#	lib/l10n/app_zh.arb
#	lib/l10n/app_zh_Hant.arb
#	lib/main.dart
@cogwheel0
cogwheel0 marked this pull request as ready for review August 1, 2026 08:32
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Comment thread lib/features/chatgpt/frb_chatgpt_runtime_client.dart
Comment thread lib/features/chatgpt/chatgpt_providers.dart Outdated
Comment thread native/chatgpt_runtime/src/api/runtime.rs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant