Add supported list/upsert/remove/refresh APIs for remote projects

Upstream request: supported remote-project registry operations

Summary

Codex Desktop can add remote projects through its supported UI and can return
projects to clients, but automation currently lacks supported operations to
idempotently manage controller-local remote-project registration. Fleet users
therefore cannot safely guarantee that an available native remote host has an
enrolled project before creating a task.

Requested app-server surface

Please add versioned, documented operations for:

• remoteProject/list returning project ID, label, host ID, remote path, kind,

schema version, and live/stale state;

• remoteProject/upsert with an idempotency key based on host ID plus normalized

remote path;

• remoteProject/remove scoped to one exact project ID/identity;
• remoteProject/refresh to reload the live registry without restarting the

desktop app.

Useful guarantees would include optimistic concurrency/version tokens,
structured duplicate/conflict errors, path normalization rules, host
availability in the same response, and an event when the live registry changes.
Mutation should preserve unrelated global state and should not require clients
to know the private persistence schema.

Reproduction and impact

1. Enroll a native remote-control host.
2. Maintain multiple Windows repositories on that host.
3. Try to create a fresh remote task for a repository that has not yet been

added through the desktop UI.

1. The host is reachable, but the repository is absent from the official live

project list, and there is no supported programmatic enrollment operation.

The required safe behavior is fail-closed: do not reuse another task, do not
stage a local substitute, and do not assume persisted state is live. For a
fleet, manually adding every current and future repository is error-prone and
cannot be enforced as a delegation preflight.

Temporary local mitigation

We built an adapter-shaped, recovery-only local tool. Ordinary enrollment still
uses the supported UI. Explicit batch bootstrap/corruption repair is permitted
only while Codex is closed, only on an exact tested desktop build and schema,
and only after a full backup, optimistic byte check, atomic replace, normal
relaunch, and official live-list verification. A startup/hourly audit is
read-only. The adapter does not synchronize tasks, transcripts, plugins,
memories, or any state between devices.

Once supported upsert/remove/refresh operations exist, this private adapter can
be removed without changing the manifest or caller-facing preflight because the
backend boundary is already isolated.

Environment

• macOS controller using Codex Desktop 26.707.72221 (bundle 5307)
• Codex CLI/app-server 0.144.2
• native remote-control Windows host
• 18 controller-local repository enrollments

Private host IDs, repository names, task IDs, and state contents are omitted.