Repository navigation
codex: desktop OTEL tracing on macOS - #1187
Merged
andy-xu-db merged 1 commit intoOct 21, 2026
Merged
Conversation
andy-xu-db
marked this pull request as ready for review
October 19, 2026 14:54
andy-xu-db
force-pushed
the
andy-xu-db/stack/andy/codex-desktop-tracing-macos
branch
from
October 19, 2026 20:35
d3d26e0 to
f01858e
Compare
masonc08
approved these changes
Oct 19, 2026
#1112 runs ug's OTEL proxy as a systemd user service so Codex desktop traces get a fresh Databricks token, but only on Linux. On macOS, run the same proxy as the LaunchAgent com.databricks.ug-codex-otel, loaded with `launchctl bootstrap gui/<uid>`; KeepAlive restarts it after a failure. An unchanged launch leaves a loaded agent alone; a changed plist is reloaded with bootout + bootstrap. Co-authored-by: Isaac <no-reply@databricks.com>
andy-xu-db
force-pushed
the
andy-xu-db/stack/andy/codex-desktop-tracing-macos
branch
from
October 19, 2026 22:35
5b570c9 to
1ef8a4c
Compare
andy-xu-db
enabled auto-merge
October 21, 2026 15:44
Collaborator
Author
|
/merge |
andy-xu-db
deleted the
andy-xu-db/stack/andy/codex-desktop-tracing-macos
branch
October 21, 2026 15:51
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Oct 21, 2026
Follows #1187 (macOS, merged); this PR's diff is the Windows change only. ## What Extends the Codex desktop OTEL login service from the previous PR in this stack to Windows: a per-user logon task `com.databricks.ug-codex-otel` that needs no admin rights. It runs the venv's `pythonw.exe -m ucode.cli otel-proxy`, so no console window appears. ## Notes - Task Scheduler keeps its own copy of the task, so ug keeps the XML it registered in `~/.ucode` to track ownership and the port. The file is UTF-16, the encoding `schtasks` reads, so `write_text_file` gains an `encoding` argument. - Like macOS, Windows returns early from the shared functions, so the Linux and macOS code is untouched; the Linux unit is still byte-identical to main. - A changed definition runs `/End` before `/Create /F`, which would otherwise leave the old proxy running. `IgnoreNew` keeps `/Run` from starting a second proxy next to a running one. ## Validation - A component test simulates `schtasks` and checks the task XML, the UTF-16 file, an unchanged launch, a workspace change, and removal. It passes in the Windows unit-test CI job. - `just lint` passes; `tests/test_agent_codex.py` passes. The 7 full-suite failures (`test_agents_init` update prompts, `test_e2e_user_agent`) fail the same way on main. - End to end on a GitHub `windows-latest` runner, with ug installed by `uv tool install`, the real Databricks CLI, and Codex's real `codex app-server`, against a local fake workspace: - `ug configure` writes the exporter and registers the task; the proxy listens within ~2s under windowless `pythonw.exe`. - App-server sessions export OTLP traces with the Databricks token, before and after a simulated logout/login (`/End` + `/Run`). - Disabling tracing removes the exporter and the task. - A standard (non-admin) user registered the task as their own `At logon time` / `Interactive only` task, and removal worked. ## Limits - Marked `shortcut:` in code: a crashed proxy waits for the next logon or `ug codex` launch, and the task doesn't get the shell's `DATABRICKS_*` overrides. - The non-admin run couldn't start the task because that test user had no desktop session; a real user configuring from their own session wasn't tested. - Not run with a real workspace, a real reboot, or the Codex desktop app itself (only its app server). This pull request and its description were written by Isaac. Co-authored-by: Isaac <no-reply@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🥞 Stacked PR
Use this link to review incremental changes.
What
#1112 runs ug's OTEL proxy as a login service so Codex desktop traces get a fresh Databricks token, but only on Linux. This adds the same service on macOS: the LaunchAgent
com.databricks.ug-codex-otelin~/Library/LaunchAgents, loaded withlaunchctl bootstrap gui/<uid>.KeepAliverestarts it after a failure.The proxy, fixed port,
~/.codex/config.tomlexporter, warn-only setup, and removal on disable orug revertare unchanged. Linux code is untouched: macOS returns early from the shared functions, and the Linux unit andsystemctlcalls are byte-identical to main. Windows follows in the next PR of this stack.Notes
bootout+bootstrap._otel_service_env(), the variables the service inherits, so the unit and the plist can't drift apart.Validation
launchctland checks the plist, an unchanged launch, a workspace change, and removal.systemctlcall sequence from this branch and from main: they're identical.just lintpasses;tests/test_agent_codex.pypasses. The 7 full-suite failures (test_agents_initupdate prompts,test_e2e_user_agent) fail the same way on main.macos-latestrunner, with ug installed byuv tool install, the real Databricks CLI, and Codex's realcodex app-server, against a local fake workspace:ug configurewrites the exporter and starts the LaunchAgent./ai-gateway/otel/v1/traceswith the Databricks token, before and after a simulated logout/login (bootout+bootstrap).KeepAliverestarts a killed proxy, and disabling tracing removes the exporter and the agent.This pull request and its description were written by Isaac.
E2E Test: