fix(core): complete upstream integration

- Update all AuthManager::shared and CodexAuth::from_codex_home call sites with originator
- Use rollout::policy helper to filter persisted items
- Fix shell tool description formatting and UA helper reference
- Remove unused import in chatgpt_client

Build: ./build-fast.sh clean with zero warnings

codex-rs/chatgpt/src/chatgpt_client.rs

@@ -1,5 +1,4 @@
 use codex_core::config::Config;
-use codex_core::default_client::create_client;
 
 use crate::chatgpt_token::get_chatgpt_token_data;
 use crate::chatgpt_token::init_chatgpt_token_from_auth;

codex-rs/cli/src/login.rs

@@ -60,7 +60,11 @@ pub async fn run_login_with_api_key(
 pub async fn run_login_status(cli_config_overrides: CliConfigOverrides) -> ! {
     let config = load_config_or_exit(cli_config_overrides);
 
-    match CodexAuth::from_codex_home(&config.codex_home, AuthMode::ApiKey) {
+    match CodexAuth::from_codex_home(
+        &config.codex_home,
+        AuthMode::ApiKey,
+        &config.responses_originator_header,
+    ) {
         Ok(Some(auth)) => match auth.mode {
             AuthMode::ApiKey => match auth.get_token().await {
                 Ok(api_key) => {

codex-rs/cli/src/proto.rs

@@ -40,6 +40,7 @@ pub async fn run_main(opts: ProtoCli) -> anyhow::Result<()> {
     let conversation_manager = ConversationManager::new(AuthManager::shared(
         config.codex_home.clone(),
         codex_login::AuthMode::ApiKey,
+        config.responses_originator_header.clone(),
     ));
     let NewConversation {
         conversation_id: _,

codex-rs/core/src/client.rs

@@ -33,6 +33,7 @@ use crate::config::Config;
 use crate::config_types::ReasoningEffort as ReasoningEffortConfig;
 use crate::config_types::ReasoningSummary as ReasoningSummaryConfig;
 use crate::config_types::TextVerbosity as TextVerbosityConfig;
+use crate::default_client::create_client;
 use crate::debug_logger::DebugLogger;
 use crate::error::CodexErr;
 use crate::error::Result;
@@ -97,7 +98,7 @@ impl ModelClient {
         Self {
             config,
             auth_manager,
-            client: crate::http_client::build_http_client(),
+            client,
             provider,
             session_id,
             effort,

codex-rs/core/src/config.rs

@@ -895,7 +895,7 @@ impl Config {
         use codex_protocol::mcp_protocol::AuthMode;
         use crate::CodexAuth;
         
-        match CodexAuth::from_codex_home(codex_home, AuthMode::ApiKey) {
+        match CodexAuth::from_codex_home(codex_home, AuthMode::ApiKey, "codex_cli_rs") {
             Ok(Some(auth)) => auth.mode == AuthMode::ChatGPT,
             _ => false,
         }

codex-rs/core/src/config_types.rs

@@ -8,6 +8,8 @@ use std::path::PathBuf;
 use wildmatch::WildMatchPattern;
 
 use serde::Deserialize;
+use serde::Serialize;
+use strum_macros::Display;
 
 /// Configuration for external agent models
 #[derive(Deserialize, Debug, Clone, PartialEq)]

codex-rs/core/src/conversation_manager.rs

@@ -68,7 +68,11 @@ impl ConversationManager {
 
     pub async fn new_conversation(&self, config: Config) -> CodexResult<NewConversation> {
         // Build auth from codex_home using API key mode by default.
-        let auth = CodexAuth::from_codex_home(&config.codex_home, AuthMode::ApiKey)?;
+        let auth = CodexAuth::from_codex_home(
+            &config.codex_home,
+            AuthMode::ApiKey,
+            &config.responses_originator_header,
+        )?;
         self.spawn_conversation(config, auth).await
     }
 

codex-rs/core/src/openai_tools.rs

@@ -277,6 +277,14 @@ fn create_shell_tool_for_sandbox(sandbox_policy: &SandboxPolicy) -> OpenAiTool {
             writable_roots,
             ..
         } => {
+            let roots_str = if writable_roots.is_empty() {
+                "    - (none)\n".to_string()
+            } else {
+                writable_roots
+                    .iter()
+                    .map(|p| format!("    - {}\n", p.display()))
+                    .collect()
+            };
             format!(
                 r#"
 The shell tool is used to execute shell commands.
@@ -295,6 +303,7 @@ The shell tool is used to execute shell commands.
   - Include a short, 1 sentence explanation for why we need to run with_escalated_permissions in the justification parameter.
 
 Default timeout: 120000 ms (120s). Override via the `timeout` parameter."#,
+                roots_str,
                 if !network_access {
                     "\n    - Commands that require network access\n"
                 } else {

codex-rs/core/src/rollout/recorder.rs

@@ -23,8 +23,8 @@ use super::SESSIONS_SUBDIR;
 use super::list::ConversationsPage;
 use super::list::Cursor;
 use super::list::get_conversations;
-use super::policy::is_persisted_response_item;
 use crate::config::Config;
+use super::policy::is_persisted_response_item;
 use crate::conversation_manager::InitialHistory;
 use codex_protocol::models::ResponseItem;
 
@@ -149,16 +149,7 @@ impl RolloutRecorder {
     pub(crate) async fn record_items(&self, items: &[ResponseItem]) -> std::io::Result<()> {
         let filtered: Vec<ResponseItem> = items
             .iter()
-            .filter(|item| matches!(
-                item,
-                ResponseItem::Message { .. }
-                    | ResponseItem::LocalShellCall { .. }
-                    | ResponseItem::FunctionCall { .. }
-                    | ResponseItem::FunctionCallOutput { .. }
-                    | ResponseItem::CustomToolCall { .. }
-                    | ResponseItem::CustomToolCallOutput { .. }
-                    | ResponseItem::Reasoning { .. }
-            ))
+            .filter(|item| is_persisted_response_item(item))
             .cloned()
             .collect();
         if filtered.is_empty() {

codex-rs/exec/src/lib.rs

@@ -191,6 +191,7 @@ pub async fn run_main(cli: Cli, codex_linux_sandbox_exe: Option<PathBuf>) -> any
     let conversation_manager = ConversationManager::new(AuthManager::shared(
         config.codex_home.clone(),
         codex_login::AuthMode::ApiKey,
+        config.responses_originator_header.clone(),
     ));
     let NewConversation {
         conversation_id: _,

codex-rs/mcp-server/src/message_processor.rs

@@ -54,7 +54,11 @@ impl MessageProcessor {
         config: Arc<Config>,
     ) -> Self {
         let outgoing = Arc::new(outgoing);
-        let auth_manager = AuthManager::shared(config.codex_home.clone(), AuthMode::ApiKey);
+        let auth_manager = AuthManager::shared(
+            config.codex_home.clone(),
+            AuthMode::ApiKey,
+            config.responses_originator_header.clone(),
+        );
         let conversation_manager = Arc::new(ConversationManager::new(auth_manager.clone()));
         let codex_message_processor = CodexMessageProcessor::new(
             auth_manager,

codex-rs/tui/src/app.rs

@@ -124,6 +124,7 @@ impl App<'_> {
         let conversation_manager = Arc::new(ConversationManager::new(AuthManager::shared(
             config.codex_home.clone(),
             AuthMode::ApiKey,
+            config.responses_originator_header.clone(),
         )));
 
         // Split queues so interactive input never waits behind bulk updates.

codex-rs/tui/src/chatwidget.rs

@@ -1007,6 +1007,7 @@ impl ChatWidget<'_> {
             let conversation_manager = ConversationManager::new(AuthManager::shared(
                 config_for_agent_loop.codex_home.clone(),
                 AuthMode::ApiKey,
+                config_for_agent_loop.responses_originator_header.clone(),
             ));
             let new_conversation = match conversation_manager
                 .new_conversation(config_for_agent_loop)

codex-rs/tui/src/lib.rs

@@ -388,7 +388,7 @@ pub enum LoginStatus {
 /// Determine current login status based on auth.json presence.
 pub fn get_login_status(config: &Config) -> LoginStatus {
     let codex_home = config.codex_home.clone();
-    match CodexAuth::from_codex_home(&codex_home, AuthMode::ApiKey) {
+    match CodexAuth::from_codex_home(&codex_home, AuthMode::ApiKey, &config.responses_originator_header) {
         Ok(Some(auth)) => LoginStatus::AuthMode(auth.mode),
         _ => LoginStatus::NotAuthenticated,
     }