Post-review pass driven by reviewer.py. The original PR shipped the
backend codex provider, the registry entry (with `hidden:true`), the
status API, and the `CodexParallelTabs` component, but the chat UI
never surfaced the row, required an API key for the connection, and
never sent `parallel_calls` over the wire. Also fixes a CodeQL leak
in the parallel fan-out error path and adds the canonical streaming
hook upstream actually exposes.
Frontend
* chat-providers-dialog.tsx now calls `/api/codex/status` alongside
`/api/providers/registry`. When the host has Codex installed the
Add connection dialog gains a synthetic Codex row (curated model
list comes from `supported_models`) so the picker is reachable.
* The Add / Edit connection guards now skip the API-key requirement
for Codex the same way they do for the custom OpenAI-compat
presets; the field itself is also hidden so the user is not asked
for a key Studio will not use.
* chat-adapter.ts now also exempts Codex from the "Missing API key"
pre-flight, and emits `parallel_calls` on the outgoing request
when the selected connection is Codex (clamped to [1, 20] by the
shared helper, defaults to 1).
* external-providers.ts adds `codexParallelCalls` to
ExternalProviderConfig so future composer UI can persist the
user's pick per connection.
Backend
* `_stream_thread_run` now tries `thread.turn(prompt).stream()`
first, mirroring the canonical openai_codex API
(`openai/codex/sdk/python/src/openai_codex/api.py`). The legacy
`thread.run_streaming(prompt)` path is kept as a fallback and the
buffered `await thread.run(prompt)` stays as the last resort.
* `_stream_codex_parallel` no longer echoes `str(exc)` in the
`codex_tab_error` SSE event. Per-tab failures now surface a
generic "Codex tab failed" message plus an `exception_type`
discriminator; `CodexUnavailableError` is the only exception
whose text is forwarded verbatim because it is a user-actionable
install hint with no sensitive content (CodeQL
`py/information-exposure-through-exception`).
Tests
* New `TestCodexHardenedRegressions::test_parallel_tab_error_sanitised`
injects a fake SDK that raises with a path-like message and
asserts the SSE frames do not echo it.
* New `TestCodexHardenedRegressions::test_thread_turn_stream_path_taken`
verifies the canonical `thread.turn(prompt).stream()` hook is
preferred over the legacy helper.
All 26 codex_provider tests pass. Frontend `tsc --noEmit` clean.
d6c47f6664