Desktop should support an app-server binary override for local debugging #30432

Summary

Codex Desktop should provide a supported way to run an alternate local app-server binary for debugging transport/performance fixes without modifying the signed app bundle.

Right now, testing a local app-server transport fix against the Desktop renderer appears to require replacing:

/Applications/Codex.app/Contents/Resources/codex

That is risky because it can break the app bundle signature/notarization assumptions and makes rollback/testing awkward.

Why this matters

During a renderer-freeze investigation, a narrow local prototype in codex-rs/app-server-transport reduced renderer-facing event pressure by coalescing adjacent delta notifications. The prototype can be tested at the Rust package level, but proving it against the actual Desktop renderer requires Desktop to launch the patched codex app-server.

Replacing the bundled binary is the wrong default workflow for this:

• it mutates /Applications/Codex.app;
• it can invalidate code signing/sealed-resource expectations;
• it is hard to recommend safely to users;
• it makes local rollback and A/B comparison error-prone.

Suggested fix

Add a supported developer/debug override for the app-server executable path, for example one of:

CODEX_DESKTOP_APP_SERVER_BIN=/path/to/codex

or a config key explicitly gated to dev/debug builds, such as:

[app_server]
binary_path = "/path/to/local/target/release/codex"

The override should be safe by default:

• disabled in normal production unless an explicit debug flag is present;
• clearly shown in About/diagnostics when active;
• log the selected app-server path and version;
• refuse relative paths;
• avoid leaking tokens or sensitive env in diagnostics;
• provide an easy fallback to the bundled binary.

Expected behavior

Developers and advanced users should be able to A/B test app-server fixes against the real Desktop renderer without replacing files inside the signed .app bundle.

Acceptance criteria

• Desktop can launch a specified external codex app-server binary for local debugging.
• Diagnostics show whether Desktop is using bundled or external app-server.
• The override can be disabled without reinstalling the app.
• Normal signed-app behavior remains unchanged when the override is not configured.

Related issue context

This would make it much safer to validate fixes for renderer freeze/performance families such as:

• Codex macOS app renderer freezes at 100% CPU after auto-starting browser/node_repl runtime #28502
• Codex Desktop meta-bug: unbounded session/turn state causes freezes, context bloat, and lost active-turn control #25779
• Codex Desktop renderer crashes after MCP/runtime burst with large active thread state #26362
• Codex Desktop becomes unusable on long active threads due to app-server/renderer memory and TRACE log churn #21134