iOS Remote tool-parity investigation with reversible host config trial

What they did

Working from a task worktree (branch codex/ios-remote-tool-parity) on a baseline commit, the author used Codex to investigate why sessions started from iOS Remote on the same desktop host did not receive the laptop session's full configured tool access and permission defaults. They inspected supported runtime and tool configuration, reproduced candidate exposure/bootstrap behavior in disposable local state, and reviewed the existing configuration-transfer helper's contracts (validated source discovery, opt-in preview/apply, private atomic backup/rollback, compatibility and failure behavior) without touching encrypted credential transfer. They ran native-runtime experiments: installed desktop 26.1023.50603 with bundled CLI 0.165.0-alpha.1.2, spun up disposable native app-server sessions using the iOS client identifier and realtime_voice source, and tested whether an explicit top-level CUA MCP definition with omit_tools_from=[] exposes CUA through Code Mode. They confirmed plugin-scoped omit_tools_from=[] does not expose CUA on the installed build, while the explicit full top-level server definition was the only verified exposure override. They checked lifecycle feasibility with a local read-only MCP fixture, confirming UserPromptSubmit MCP hooks are skipped while untrusted and run synchronously after supplying the native current hash to a disposable invocation. They reviewed the existing Herdr SessionStart hook and found it does not configure tool registration or browser environment. They acquired a fresh iOS voice fixture chat, sent one authorized read-only inventory prompt via send_message_to_thread, and found direct mcp__cua_repl.js and js_reset present but CUA omitted from ALL_TOOLS, consistent with the native manifest. They noted the follow-up was desktop-resumed (realtime_active=false), so it did not prove active iOS voice parity. They then applied a reversible host-only trial: copied the installed native unified-computer-use CUA MCP descriptor into top-level mcp_servers.cua_repl, retained command/arguments/native browser-access preloader, inherited access metadata and existing plugin policy, set omit_tools_from=[] and required=true, using the existing config helper's checked paths, lock and atomic writer, with a private backup and version-1 restore receipt outside Git (modes 0700/0600). No token or account metadata was read, injected or changed, and other parsed configuration remained exactly equal.

How it went

Tool-exposure configuration was shown to be technically possible and the reversible host trial was applied cleanly with a verified backup and restore receipt, and the bundled CLI accepted the complete definition. However, automatic full iOS parity was not verified: the fresh iOS fixture's inventory was desktop-resumed rather than first-turn active voice, the original failed turn's complete tool schema was never recorded, and no line-level iOS root cause was established. No tracked package source or persistent host configuration was changed beyond the reversible trial, and the goal remains open pending a fresh real iOS text/voice test chat.

Worth knowing

The original failure trace was never captured, so no precise root cause is claimed. The authorized inventory ran after a desktop resume (realtime_active=false), so it does not prove first-turn active iOS voice behavior. Computer Use refused to control /Applications/ChatGPT.app for safety reasons, blocking UI-level inspection. The standalone realtime probe could not start live voice under the existing auth path, and no new API key or paid service was introduced. A native MCP lifecycle hook remains an unverified candidate; SessionStart hooks can precede MCP readiness and might race a running turn. Do not pin private or version-specific native transport settings without lifecycle verification.

Wiring

Codex runs in a task worktree on branch codex/ios-remote-tool-parity off baseline 451f19befa598834113089e1303c10af1bafdee5. The existing configuration-transfer helper provides checked paths, a lock, an atomic writer, opt-in preview/apply, and private backup/rollback with a version-1 restore receipt stored outside Git in the host Codex home (dir/file modes 0700/0600). The host trial copies the installed native unified-computer-use CUA MCP descriptor into top-level mcp_servers.cua_repl in config.toml, retaining command, arguments and the native browser-access preloader, inheriting access metadata and existing plugin policy, with omit_tools_from=[] and required=true. The bundled CLI validates the complete definition and a fresh native app-server process loads the saved file with no CUA overrides. Diagnostics go through send_message_to_thread to a specific host chat, with read_thread used for read-only probes. The existing Herdr SessionStart hook handles session reporting only. ADR-0004 and ADR-0006 govern ownership and must be preserved.

Try it yourself

Investigate why sessions started from iOS Remote on this desktop host don't get the laptop session's full configured tool access and permission defaults. Work on a task branch off the current baseline. First inspect supported runtime/tool configuration and reproduce candidate exposure/bootstrap behavior in disposable local state before choosing an implementation. Review the existing configuration-transfer helper's contracts (inputs, validated source discovery, opt-in preview/apply, private atomic backup/rollback, compatibility and failure behavior) and do not change encrypted credential transfer. Test whether plugin-scoped omit_tools_from=[] versus an explicit top-level mcp_servers entry exposes CUA through Code Mode on the installed build. Keep host authentication, account/workspace policy, OS consent and signed native browser-access checks intact; do not patch proprietary app binaries, fabricate identities, remove authorization guards, or commit machine-private runtime values. If you apply a host config trial, use the existing helper's checked paths, lock and atomic writer, keep a private backup and restore receipt outside Git, and confirm other parsed configuration is unchanged. Verify with a fresh iOS text/voice session, permission readback, direct/discoverable tools and a read-only browser flow. Report remaining runtime limits accurately; do not infer runtime success from tool lists, generated files, prompts or passing unit tests.