Fix Codex token reporting and validate Windows runtime

[nickbeau]

Spec mapping

• SPEC.md section 10.1: platform-specific Codex subprocess launch contract.
• SPEC.md sections 10.4 and 13.5: streamed usage telemetry and absolute token accounting.
• SPEC.md section 13.7.1: dashboard/runtime token-consumption observability.
• SPEC.md section 17: agent protocol and Windows execution conformance coverage.

Summary

• Parse the current Codex app-server thread/tokenUsage/updated payload shape at params.tokenUsage.total.
• Continue accepting the existing direct, snake_case, camelCase, and legacy wrapper shapes.
• Deliberately use the absolute total snapshot and ignore the per-response last snapshot so persisted and dashboard totals do not double-count.
• Add parser-level and Windows subprocess integration regressions using the generated Codex 0.149.1 protocol shape.
• Run normal CI on both ubuntu-latest and windows-latest.
• Document the Windows cmd.exe /d /s /c and macOS/Linux /bin/bash -lc launch contract in the spec and implementation plan.
• Update .NET 10 dependencies to the 10.0.11 servicing release, eliminating the high-severity NuGet vulnerability warnings encountered during validation.

Root cause

The app-server now reports thread totals inside a wrapper:

{
  "method": "thread/tokenUsage/updated",
  "params": {
    "tokenUsage": {
      "total": {
        "inputTokens": 110,
        "outputTokens": 70,
        "totalTokens": 180
      },
      "last": {
        "inputTokens": 11,
        "outputTokens": 7,
        "totalTokens": 18
      }
    }
  }
}

Symphony found tokenUsage but expected token fields directly on that object. Parsing therefore returned no usage values, leaving persisted and API/dashboard totals at zero. The parser now unwraps the absolute total object before extracting counters.

Validation

• dotnet restore Symphony.slnx: passed with no warnings.
• dotnet build Symphony.slnx --configuration Release --no-restore: passed with 0 warnings and 0 errors.
• dotnet test Symphony.slnx --configuration Release --no-build --no-restore: 136 passed, 0 failed; the single real-GitHub integration test remained intentionally opt-in and skipped.
• dotnet format Symphony.slnx --verify-no-changes --no-restore: passed.
• dotnet list Symphony.slnx package --vulnerable --include-transitive: no vulnerable packages across all projects.
• dotnet restore src/Symphony.Host/Symphony.Host.csproj --runtime win-x64: passed.
• Self-contained win-x64 publish: passed; Symphony.exe version returned Symphony 0.1.0-dev, and setup-symphony.cmd plus wwwroot/index.html were present.
• git diff --check: passed.

Risk and rollout

• No database migration or configuration change is required.
• Existing legacy token payload shapes remain supported.
• Token aggregation semantics remain unchanged: only absolute thread totals advance dashboard/API totals; the nested last snapshot is not accumulated.
• Windows is now a required CI leg, so Windows-specific process and packaging regressions are caught before merge.

References

• Official Codex app-server documentation: https://developers.openai.com/codex/app-server/

[Copilot]

Pull request overview

Fixes Codex token usage parsing, adds Windows validation, updates .NET dependencies, and documents cross-platform launch behavior.

Changes:

• Parses wrapped absolute tokenUsage.total snapshots without double-counting last.
• Adds parser and Windows subprocess regression coverage.
• Expands CI to Linux and Windows and updates documentation and dependencies.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Summary	Review note
tests/Symphony.Integration.Tests/Symphony.Integration.Tests.csproj	Updates test dependencies.	—
tests/Symphony.Integration.Tests/CodexAgentRunnerTests.cs	Adds token usage and Windows regression coverage.	—
src/Symphony.Infrastructure.Workspaces/Symphony.Infrastructure.Workspaces.csproj	Updates .NET dependencies.	—
src/Symphony.Infrastructure.Workflows/Symphony.Infrastructure.Workflows.csproj	Updates .NET dependencies.	—
src/Symphony.Infrastructure.Tracker.GitHub/Symphony.Infrastructure.Tracker.GitHub.csproj	Updates .NET dependencies.	—
src/Symphony.Infrastructure.Persistence.Sqlite/Symphony.Infrastructure.Persistence.Sqlite.csproj	Updates EF Core and security dependencies.	—
src/Symphony.Infrastructure.Agent.Codex/Symphony.Infrastructure.Agent.Codex.csproj	Updates Codex dependencies.	—
src/Symphony.Infrastructure.Agent.Codex/CodexAgentRunner.cs	Parses wrapped absolute token totals.	—
src/Symphony.Host/Symphony.Host.csproj	Updates host dependencies.	—
SPEC.md	Documents platform-specific shell contracts.	—
README.md	Documents cross-platform CI.	—
IMPLEMENTATION_PLAN.md	Records cross-platform validation.	—
.github/workflows/ci.yml	Adds Windows CI coverage.	Critical: update the token usage assertion from other_message to thread/tokenUsage/updated before requiring Windows CI.

Suppressed comments (1)

SPEC.md:454

• This updates the launch contract in sections 5.3.6 and 10.1, but section 17.5 still says the client invokes bash -lc on every platform (SPEC.md:2041). That leaves the normative conformance checklist contradictory for Windows; update that checklist to use the same platform-specific invocation.

  - The runtime launches this command through the platform shell in the workspace directory:
    - Windows: `cmd.exe /d /s /c <codex.command>`
    - macOS/Linux: `/bin/bash -lc <codex.command>`

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.