Attributed inter-agent messages: sender identity and role on `codex queue` and app-server inject, plus a consumption receipt event

What variant of Codex are you using?

CLI (codex-cli 0.153.4 on macOS 26.6, ChatGPT auth)

What feature would you like to see?

codex queue --thread <id> --message <text> and app-server thread/inject are the ways an external orchestrator can reach a running Codex session. Both deliver the text as if the user typed it: no sender identity, no role, no reply address. In a multi-agent setup (Codex and Claude Code sessions in tmux with a shared message bus) this costs two things:

1. Provenance. The model cannot tell a peer agent's message from the human's instruction, so it treats agent text with the user's authority. We want agent-to-agent traffic attributed ("from agent X") and only the human's words treated as the human's.
2. Correctness. #45894 reports that an inter-agent message arriving mid-conversation can make Codex resurrect and answer an old user prompt. An attributed, distinct input kind would let the runtime present the message as an event in the current thread state rather than as another user turn.

Proposal

• codex queue: add --from <id> and --role <agent|system|user> (default user for compatibility). With --role agent, deliver the text as a distinct input item with the sender identity visible to the model (a developer-role message or an event block), never as a plain user prompt.
• app-server: the same fields on thread/inject; emit a notification when a queued or injected item is consumed by a turn (for example thread/inputConsumed with the queue item id, thread id and turn id), so senders get a receipt instead of polling the queue store.
• Document that queue acceptance is not a model-read receipt; the consumed event is the receipt.

Additional information

codex-cli 0.153.4 on macOS 26.6, ChatGPT auth. Related: #45894, #25446.

Start with the codex queue --thread ... --message ... CLI entry point and the app-server thread/inject entry point; read related issues #45894 and #25446 for context. Done means both paths support sender and role attribution, consumed items emit a receipt containing the queue item, thread, and turn identifiers, and the queue-versus-consumption distinction is documented.