feat(background-agent): enforce durable admission

codex-rs/app-server-protocol/src/protocol/v2/agent.rs

@@ -91,6 +91,11 @@ pub enum AgentLifecycleEffect {
 #[ts(export_to = "v2/")]
 pub struct AgentRun {
     pub agent_id: String,
+    // Stable identity of the admitted idempotency key, not the key itself:
+    // admission persists only a one-way SHA-256 digest so a caller-supplied
+    // key can never be recovered from local state. Kept under the original
+    // wire name to avoid an unversioned protocol break; use it for
+    // correlation, never as an echo of the submitted key.
     #[ts(type = "string | null")]
     pub idempotency_key: Option<String>,
     #[ts(type = "string | null")]

codex-rs/app-server/Cargo.toml

@@ -88,6 +88,7 @@ futures = { workspace = true }
 iana-time-zone = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+sha2 = { workspace = true }
 tempfile = { workspace = true }
 thiserror = { workspace = true }
 time = { workspace = true }
@@ -130,7 +131,6 @@ rmcp = { workspace = true, default-features = false, features = [
     "transport-streamable-http-server",
 ] }
 serial_test = { workspace = true }
-sha2 = { workspace = true }
 shlex = { workspace = true }
 tar = { workspace = true }
 tokio-tungstenite = { workspace = true }