feat(codex)!: remove the codex-acp harness, app-server is the only codex adapter

[joshsny]

Problem

Codex sessions could run through two harnesses: the native codex app-server adapter (flag-gated default-on) and the legacy codex-acp adapter as a silent fallback. The fallback is now a liability rather than a safety net: whenever the selector's inputs wobble (native binary not yet resolvable, flag not loaded), sessions silently land on codex-acp, which deadlocks with current codex models — the session does a minute of work and hangs forever. We hit exactly this in eval runs today: the first wave of sandboxes fell back to codex-acp and burned a 30-minute timeout each, while every later wave selected app-server and ran fine.

Changes

• Delete the codex-acp adapter entirely (adapters/codex/: CodexAcpAgent, client, spawn, session state, its structured-output/local-tools MCP server entries) and the acp-vs-app-server parity suite, which existed only to compare the two.
• Move the shared CodexSettingsManager and codex model catalog into adapters/codex-app-server/.
• Remove the codex-app-server feature flag and all useCodexAppServer plumbing: sessionService flag resolution and adapter-store pinning, workspace-server schemas, agent options, and the POSTHOG_CODEX_USE_APP_SERVER / POSTHOG_CODEX_USE_ACP env overrides. A codex session always uses the app-server adapter; a missing native binary now throws with a clear message instead of degrading.
• Stop downloading and staging the codex-acp binary (~80MB per platform).
• Compatibility: the bundle directory keeps its codex-acp name so electron-builder config, CI verify steps, and unrebased branches keep working, and nativeCodexBinaryPath still accepts the old "sibling binary" hint so older sandbox images that pass the codex-acp path keep resolving the native binary.

Breaking for in-flight codex-acp sessions: after upgrading, an existing codex session created by the acp harness resumes under app-server and will not retain its thread history. Given codex sessions were flag-gated to app-server already, the affected set is sessions created while the flag was off.

How did you test this?

• tsc --noEmit: 0 errors across @posthog/agent, @posthog/core, @posthog/ui, @posthog/shared, @posthog/workspace-server, and apps/code.
• Test suites: agent 1079 passed, core 2115 passed (1 pre-existing locale-dependent billing date-format failure, unrelated — no billing files touched), workspace-server 622 passed, shared 453 passed, ui sessions feature 347 passed.
• Deleted the selector precedence tests along with the selector; the fail-loud missing-binary path is covered by the e2e guard that asserts the native binary is present when a token is set.
• Repo-wide sweep: zero remaining references to CodexAcpAgent, useCodexAppServer, or the env overrides.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

🤖 Agent context

Follow-up to the app-server rollout (#2723) and the native binary packaging fix (#3188). Requested as "remove the codex-acp harness completely, and we will just use the app server one". The eval-run fallback incident that motivated failing loudly is described under Problem.

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[greptile-apps]

_{Reviews (1): Last reviewed commit: "feat(codex)!: remove the codex-acp harne..." | Re-trigger Greptile}

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 318b26b.}