From 4031f5ffe840898a3f403268afa94b8cb8b17c76 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Mon, 14 Sep 2026 15:38:03 +0500 Subject: [PATCH] feat(setup): refresh codex harness --- .gds/bundle.lock.yaml | 16 + .gds/compiled-policy.json | 412 ++++++++++++++++++ CHANGELOG.md | 25 ++ Cargo.lock | 8 +- Cargo.toml | 8 +- README.md | 2 +- crates/codex-setup-system/src/software.rs | 78 ++-- crates/codex-setup-system/tests/lifecycle.rs | 17 +- install.ps1 | 2 +- install.sh | 2 +- references/codex-baseline.json | 88 ++-- .../home/agents/nddev-builder.toml | 11 +- setups/nddev-builder/setup.json | 4 +- 13 files changed, 570 insertions(+), 103 deletions(-) create mode 100644 .gds/bundle.lock.yaml create mode 100644 .gds/compiled-policy.json diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml new file mode 100644 index 0000000..4f27a32 --- /dev/null +++ b/.gds/bundle.lock.yaml @@ -0,0 +1,16 @@ +# GENERATED FILE - DO NOT EDIT DIRECTLY +schema_version: 1 + +bundle: + version: "0.9.4-dev" + release_sequence: 0 + channel: "development" + source_tree_digest: "sha256:b1c334df899c661304dc45ef29898df24ff4a6ddffd2a6ca4d6f1f795d585189" + digest: "sha256:469ac74bf934333ee1fde843ad04a26e002e5b5ec9c782fbe68ec6fe313bfac0" + +projection: + input_digest: "sha256:1f8b2558bc748593ed16bd069a32c50d12acfd923ae29cd398b0b6360c9fb97d" + output_digest: "sha256:1bc616a57202f145974e0002e21a77d8d0ddafea4ed7bf261bd0f6da836f7f56" + files: + - path: ".gds/compiled-policy.json" + digest: "sha256:eee55b283957a67c6ac3c369f7218a6b9ce07071de802a45117a016e576af9cf" diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json new file mode 100644 index 0000000..5f01b2e --- /dev/null +++ b/.gds/compiled-policy.json @@ -0,0 +1,412 @@ +{ + "schema_version": 1, + "compiled_policy": { + "repository_id": "repo_01M0QEF303AAMRB0G64Q5S8W78", + "bundle_version": "0.9.4-dev", + "digest": "sha256:bbcefb49524571df06f352e99aaf80780babe504917fd67575e32933bbf1397d" + }, + "sources": [ + { + "id": "repository-default", + "tier": "base", + "priority": 100, + "distribution": "public", + "path": "policies/base/repository-default.yaml", + "digest": "sha256:0ea560cc2653184e07c6f744455f745a34f764a5c0dcda55f2dc76fa5296f2f0" + }, + { + "id": "opennetwork-default", + "tier": "owner", + "priority": 110, + "distribution": "public", + "path": "policies/owners/opennetwork-default.yaml", + "digest": "sha256:096b9781b05c37fd5b440a171a6e5599cda3ef77983db72bf9c68d3d40b34ab4" + } + ], + "effective": { + "agent": { + "generated_projection_edit": "forbidden", + "profiles": [ + "core", + "drakkars" + ] + }, + "context": { + "private_parent_persistence": "forbidden" + }, + "git": { + "branch_cleanup": "merged-only", + "default_branch": "main", + "integration": "pull-request" + }, + "github": { + "actions": { + "allowed_actions": { + "management": "observed" + }, + "enabled": { + "management": "managed", + "value": true + }, + "selected_actions": { + "management": "observed" + }, + "sha_pinning_required": { + "management": "observed" + } + }, + "merge": { + "allow_auto_merge": { + "management": "observed" + }, + "allow_merge_commit": { + "management": "managed", + "value": true + }, + "allow_rebase_merge": { + "management": "observed" + }, + "allow_squash_merge": { + "management": "managed", + "value": false + }, + "allow_update_branch": { + "management": "managed", + "value": true + }, + "delete_branch_on_merge": { + "management": "managed", + "value": true + }, + "merge_commit_message": { + "management": "observed" + }, + "merge_commit_title": { + "management": "observed" + }, + "squash_merge_commit_message": { + "management": "observed" + }, + "squash_merge_commit_title": { + "management": "observed" + } + }, + "releases": { + "immutable": { + "management": "observed" + } + }, + "rulesets": { + "management": "observed" + }, + "security": { + "management": "observed" + }, + "workflow": { + "can_approve_pull_request_reviews": { + "management": "managed", + "value": false + }, + "default_workflow_permissions": { + "management": "managed", + "value": "read" + } + } + }, + "package_management": { + "mutable_version_resolution": "forbidden", + "npm_family_on_managed_path": "allowed", + "remote_stream_to_shell": "forbidden" + }, + "rollout": { + "mode": "pull-request" + }, + "security": { + "external_write_requires_approval": true, + "public_projection_scan": "required", + "secrets_in_repository": "forbidden" + } + }, + "provenance": { + "/effective/agent/generated_projection_edit": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/agent/profiles/0": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "append" + }, + "/effective/agent/profiles/1": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "append" + }, + "/effective/context/private_parent_persistence": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/git/branch_cleanup": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/git/default_branch": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/git/integration": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/actions/allowed_actions/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/actions/enabled/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/actions/enabled/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/actions/selected_actions/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/actions/sha_pinning_required/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_auto_merge/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_merge_commit/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_merge_commit/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_rebase_merge/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_squash_merge/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_squash_merge/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_update_branch/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/allow_update_branch/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/delete_branch_on_merge/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/delete_branch_on_merge/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/merge_commit_message/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/merge_commit_title/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/squash_merge_commit_message/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/merge/squash_merge_commit_title/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/releases/immutable/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/rulesets/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/security/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/workflow/can_approve_pull_request_reviews/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/workflow/can_approve_pull_request_reviews/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/workflow/default_workflow_permissions/management": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/github/workflow/default_workflow_permissions/value": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/package_management/mutable_version_resolution": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/package_management/npm_family_on_managed_path": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/package_management/remote_stream_to_shell": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/rollout/mode": { + "source": "opennetwork-default", + "tier": "owner", + "priority": 110, + "file": "policies/owners/opennetwork-default.yaml", + "operation": "set" + }, + "/effective/security/external_write_requires_approval": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/security/public_projection_scan": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + }, + "/effective/security/secrets_in_repository": { + "source": "repository-default", + "tier": "base", + "priority": 100, + "file": "policies/base/repository-default.yaml", + "operation": "set" + } + } +} diff --git a/CHANGELOG.md b/CHANGELOG.md index b0fd972..3d04de5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,31 @@ cut and that this clone does not carry. ## [Unreleased] +## [0.0.71] - 2026-09-13 + +nddev-builder guidance is refreshed against each harness's current native +extension model. Codex custom agents now cover inherited session settings and +project scope; its hook guide includes Interrupt and the limits of asynchronous +hooks as enforcement. Antigravity plugin and subagent guidance records the +current manifest minimum, bundled agents, workspace isolation, inherited safety +boundaries and validation behavior observed in CLI 1.2.2. + +Every builder manifest now cites all vendor pages used by its generated +component guides, including sources beyond the base permission posture. The +provider protocol, setup ownership and software artifact pins are unchanged. + +## [0.0.70] - 2026-09-13 + +Software artifacts are refreshed from verified vendor bytes: Claude Code +2.1.270, Codex 0.154.0, Grok Build 1.0.31, OpenCode 1.18.30, Cursor +2026.09.10-fd3934a and Antigravity CLI 1.2.2. Pi remains at 0.85.1. +Every published platform digest and rollback pin is transcribed from the same +verified ledger. + +Lifecycle integration tests remain compatible with the pinned Rust 1.98.0 +toolchain by reading Cargo's executable path at runtime. Provider behavior, +protocol-v3 declarations and setup ownership are unchanged. + ## [0.0.69] - 2026-09-08 Native lifecycle evidence runs every provider command in the same isolated diff --git a/Cargo.lock b/Cargo.lock index bd3e8ca..30748fe 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -25,7 +25,7 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "codex-setup-system" -version = "0.0.69" +version = "0.0.71" dependencies = [ "harness-runtime", "provider-v3", @@ -76,7 +76,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" [[package]] name = "harness-runtime" -version = "0.0.69" +version = "0.0.71" dependencies = [ "provider-v3", "serde", @@ -147,7 +147,7 @@ dependencies = [ [[package]] name = "provider-v3" -version = "0.0.69" +version = "0.0.71" dependencies = [ "serde", "serde_json", @@ -209,7 +209,7 @@ dependencies = [ [[package]] name = "setup-core" -version = "0.0.69" +version = "0.0.71" dependencies = [ "miniz_oxide", "serde", diff --git a/Cargo.toml b/Cargo.toml index a3ebfb9..016ae38 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -8,7 +8,7 @@ members = [ ] [workspace.package] -version = "0.0.69" +version = "0.0.71" edition = "2024" rust-version = "1.89" license = "AGPL-3.0-or-later" @@ -23,9 +23,9 @@ sha2 = "0.11" # `setup-core::archive`); an inflate loop is not, because its bugs are # memory-safety bugs and it is not improved by being hand-written here. miniz_oxide = "0.9" -setup-core = { path = "crates/setup-core", version = "0.0.69" } -provider-v3 = { path = "crates/provider-v3", version = "0.0.69" } -harness-runtime = { path = "crates/harness-runtime", version = "0.0.69" } +setup-core = { path = "crates/setup-core", version = "0.0.71" } +provider-v3 = { path = "crates/provider-v3", version = "0.0.71" } +harness-runtime = { path = "crates/harness-runtime", version = "0.0.71" } [workspace.lints.rust] unsafe_code = "forbid" diff --git a/README.md b/README.md index 0c8e7e8..391114c 100644 --- a/README.md +++ b/README.md @@ -179,7 +179,7 @@ release is a convenience, not the authorised copy. ```bash docker run --rm -v "$HOME/.config:/config" \ - ghcr.io/nddev-opennetwork/codex-setup-system:0.0.69 \ + ghcr.io/nddev-opennetwork/codex-setup-system:0.0.71 \ status --target /config/ --json ``` diff --git a/crates/codex-setup-system/src/software.rs b/crates/codex-setup-system/src/software.rs index 51384ed..7618617 100644 --- a/crates/codex-setup-system/src/software.rs +++ b/crates/codex-setup-system/src/software.rs @@ -20,103 +20,103 @@ use harness_runtime::{Artifact, Delivery, Previous, Shape, Software}; pub(crate) const ARTIFACTS: &[Artifact] = &[ Artifact { platform: "linux/arm64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-arm64.tgz", - bytes: 121_707_000, - sha256: "sha256:439c0dd0d6923f607b4e5cd1e3079c12f0b86f6e5007f07e377d6ad25e2d7bb9", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-linux-arm64.tgz", + bytes: 122_610_794, + sha256: "sha256:a2315b5f64bfeaff79b71e0d35505ba8c22cc1e96cab9dc950b614c804105b24", shape: Shape::GzipTar, member: "package/vendor/aarch64-unknown-linux-musl/bin/codex", }, Artifact { platform: "linux/x86_64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-x64.tgz", - bytes: 129_272_137, - sha256: "sha256:54818cb9fce3360cc6e44cfc5a96952cd5c1243efb43cbe488e11dda84663e08", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-linux-x64.tgz", + bytes: 129_654_638, + sha256: "sha256:e27c83a49e6031685ee7f956c12aad5f16484d3a80181dd3fea930fb96b3832b", shape: Shape::GzipTar, member: "package/vendor/x86_64-unknown-linux-musl/bin/codex", }, Artifact { platform: "macos/arm64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-arm64.tgz", - bytes: 115_672_312, - sha256: "sha256:535d301b49131abfda3264f959fb0defa40bbc306976d98ddbc15c424636c55c", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-darwin-arm64.tgz", + bytes: 116_501_639, + sha256: "sha256:2a98662d79316a59993c7233e3e25a1aa1d42da4b45904585d33a5a7da1cade1", shape: Shape::GzipTar, member: "package/vendor/aarch64-apple-darwin/bin/codex", }, Artifact { platform: "macos/x86_64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-x64.tgz", - bytes: 123_544_033, - sha256: "sha256:5e468958503c60e940b1b1af3fe2064c16fd141f1607111caf99f2c0a0e80725", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-darwin-x64.tgz", + bytes: 124_308_807, + sha256: "sha256:92c493533c53c433c4d94252251daba4f379ccba06a9964d260abb47a535dce1", shape: Shape::GzipTar, member: "package/vendor/x86_64-apple-darwin/bin/codex", }, Artifact { platform: "windows/arm64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-arm64.tgz", - bytes: 132_173_674, - sha256: "sha256:6d0bf07e04810f0ed4ad2984f6c9f0547bb9e0e1bb1f8fe9ecce0de3376bbfef", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-win32-arm64.tgz", + bytes: 132_888_437, + sha256: "sha256:a072b19e67fd65f2827c925a9d3c89b1a55da70b8e24cc21b81c800a77cb3d53", shape: Shape::GzipTar, member: "package/vendor/aarch64-pc-windows-msvc/bin/codex.exe", }, Artifact { platform: "windows/x86_64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-x64.tgz", - bytes: 141_495_386, - sha256: "sha256:05f473573f38b3f4dc9484e6807a511a1bb0e128dfa50816dafc5f79e553cdca", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-win32-x64.tgz", + bytes: 142_162_836, + sha256: "sha256:27eedae55e37ed1da4078b36a6ef9e4ffe8546a60fd6df5ee6408fdd16aff8ea", shape: Shape::GzipTar, member: "package/vendor/x86_64-pc-windows-msvc/bin/codex.exe", }, ]; -/// The artifacts 0.153.2 was published as, kept so +/// The artifacts 0.153.4 was published as, kept so /// `software_update` has a version to move from and `rollback` a tree to /// return to. Measured from bytes when it was the current pin. pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[ Artifact { platform: "linux/arm64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-arm64.tgz", - bytes: 121_675_259, - sha256: "sha256:df2f8f764bf86aeae51d71cc37686dcbd2c24e4bce9a9d1e8f249141fd99fac3", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-arm64.tgz", + bytes: 121_707_000, + sha256: "sha256:439c0dd0d6923f607b4e5cd1e3079c12f0b86f6e5007f07e377d6ad25e2d7bb9", shape: Shape::GzipTar, member: "package/vendor/aarch64-unknown-linux-musl/bin/codex", }, Artifact { platform: "linux/x86_64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-x64.tgz", - bytes: 129_259_793, - sha256: "sha256:1fd52113294979c9936a110cab7cb9d5e9d1e28086f112fd6748a05826a9e5a0", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-x64.tgz", + bytes: 129_272_137, + sha256: "sha256:54818cb9fce3360cc6e44cfc5a96952cd5c1243efb43cbe488e11dda84663e08", shape: Shape::GzipTar, member: "package/vendor/x86_64-unknown-linux-musl/bin/codex", }, Artifact { platform: "macos/arm64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-arm64.tgz", - bytes: 115_669_249, - sha256: "sha256:151ecdd90b96af823a2828146bff056c8a5f42d2ab4da63a198fe8a4ad84990b", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-arm64.tgz", + bytes: 115_672_312, + sha256: "sha256:535d301b49131abfda3264f959fb0defa40bbc306976d98ddbc15c424636c55c", shape: Shape::GzipTar, member: "package/vendor/aarch64-apple-darwin/bin/codex", }, Artifact { platform: "macos/x86_64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-x64.tgz", - bytes: 123_497_670, - sha256: "sha256:ec139bb87cdd25d8038069cef7ff2bdd2d119c7fcf0ac6e26dcc1020573cd112", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-x64.tgz", + bytes: 123_544_033, + sha256: "sha256:5e468958503c60e940b1b1af3fe2064c16fd141f1607111caf99f2c0a0e80725", shape: Shape::GzipTar, member: "package/vendor/x86_64-apple-darwin/bin/codex", }, Artifact { platform: "windows/arm64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-arm64.tgz", - bytes: 132_143_077, - sha256: "sha256:71ba906090143a310354ae5c864d5c677e05842b373cadcf84ef2872f8ddcfa1", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-arm64.tgz", + bytes: 132_173_674, + sha256: "sha256:6d0bf07e04810f0ed4ad2984f6c9f0547bb9e0e1bb1f8fe9ecce0de3376bbfef", shape: Shape::GzipTar, member: "package/vendor/aarch64-pc-windows-msvc/bin/codex.exe", }, Artifact { platform: "windows/x86_64", - url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-x64.tgz", - bytes: 141_510_231, - sha256: "sha256:e674587ea13f7051aeae697b1425ec028a236f54fa1dd1a15661ef7c063f2874", + url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-x64.tgz", + bytes: 141_495_386, + sha256: "sha256:05f473573f38b3f4dc9484e6807a511a1bb0e128dfa50816dafc5f79e553cdca", shape: Shape::GzipTar, member: "package/vendor/x86_64-pc-windows-msvc/bin/codex.exe", }, @@ -124,12 +124,12 @@ pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[ /// Codex's program, and where its bytes come from. pub(crate) const SOFTWARE: Software = Software { - version: "0.153.4", + version: "0.154.0", command: "codex", delivery: Delivery::Artifacts(ARTIFACTS), unsupported: &[], previous: Some(Previous { - version: "0.153.2", + version: "0.153.4", artifacts: PREVIOUS_ARTIFACTS, }), }; diff --git a/crates/codex-setup-system/tests/lifecycle.rs b/crates/codex-setup-system/tests/lifecycle.rs index 2ddd680..33f9556 100644 --- a/crates/codex-setup-system/tests/lifecycle.rs +++ b/crates/codex-setup-system/tests/lifecycle.rs @@ -10,12 +10,15 @@ //! runs for all seven systems on all three platforms, and a crate carries only //! the one fact that is its own: which binary to run. +#![allow(clippy::expect_used, reason = "tests require Cargo's binary path")] + /// Install, select, back up, hold, restore, restore to a named slot, release, /// remove -- and a file this provider does not own, present throughout. #[test] fn the_documented_round_trip_works_on_this_system() { - let exe = std::path::Path::new(env!("CARGO_BIN_EXE_codex-setup-system")); - let problems = harness_runtime::probe::round_trip(exe); + let exe = std::env::var("CARGO_BIN_EXE_codex-setup-system") + .expect("Cargo must expose the codex setup-system binary to integration tests"); + let problems = harness_runtime::probe::round_trip(std::path::Path::new(&exe)); assert!( problems.is_empty(), "the round trip disagreed with what this build documents:\n {}", @@ -26,8 +29,9 @@ fn the_documented_round_trip_works_on_this_system() { /// A target this provider was never pointed at is refused, never guessed at. #[test] fn a_target_that_is_not_one_is_refused_on_this_system() { - let exe = std::path::Path::new(env!("CARGO_BIN_EXE_codex-setup-system")); - let problems = harness_runtime::probe::refuses_a_target_it_should(exe); + let exe = std::env::var("CARGO_BIN_EXE_codex-setup-system") + .expect("Cargo must expose the codex setup-system binary to integration tests"); + let problems = harness_runtime::probe::refuses_a_target_it_should(std::path::Path::new(&exe)); assert!(problems.is_empty(), "{}", problems.join("\n ")); } @@ -38,7 +42,8 @@ fn a_target_that_is_not_one_is_refused_on_this_system() { /// test in one process cannot reach it, so this drives real ones. #[test] fn one_process_writes_this_target_at_a_time() { - let exe = std::path::Path::new(env!("CARGO_BIN_EXE_codex-setup-system")); - let problems = harness_runtime::probe::one_writer_at_a_time(exe); + let exe = std::env::var("CARGO_BIN_EXE_codex-setup-system") + .expect("Cargo must expose the codex setup-system binary to integration tests"); + let problems = harness_runtime::probe::one_writer_at_a_time(std::path::Path::new(&exe)); assert!(problems.is_empty(), "{}", problems.join("\n ")); } diff --git a/install.ps1 b/install.ps1 index c9df034..10d2d72 100644 --- a/install.ps1 +++ b/install.ps1 @@ -7,7 +7,7 @@ # powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0 [CmdletBinding()] param( - [string]$Version = "0.0.69", + [string]$Version = "0.0.71", [string]$InstallDir = "$env:LOCALAPPDATA\Programs\codex-setup-system" ) $ErrorActionPreference = "Stop" diff --git a/install.sh b/install.sh index efdd59c..b672c34 100644 --- a/install.sh +++ b/install.sh @@ -14,7 +14,7 @@ set -eu REPO="NDDev-OpenNetwork/codex-setup-system" BINARY="codex-setup-system" -VERSION="${1:-0.0.69}" +VERSION="${1:-0.0.71}" PREFIX="${CODEX_INSTALL_DIR:-$HOME/.local/bin}" case "$(uname -s)" in diff --git a/references/codex-baseline.json b/references/codex-baseline.json index a006192..ddc169f 100644 --- a/references/codex-baseline.json +++ b/references/codex-baseline.json @@ -21,12 +21,12 @@ "desktop_documented_product": "ChatGPT", "desktop_pinned_cli_packaging": "Codex.app/Codex.dmg", "installer_asset": "install.sh", - "installer_release": "rust-v0.153.4", - "installed_version": "0.153.4", + "installer_release": "rust-v0.154.0", + "installed_version": "0.154.0", "standalone_layout": "packages/standalone" }, "verified_version_ref": "build/version.json:codex_cli_tested", - "verified_at": "2026-09-07T03:12:33+00:00", + "verified_at": "2026-09-13T15:17:16+00:00", "native_surfaces": { "verified_at": "2026-08-31", "config_home": "~/.codex", @@ -212,89 +212,89 @@ "shape": "gzip-tar", "platforms": { "linux/arm64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-arm64.tgz", - "bytes": 121707000, - "sha256": "sha256:439c0dd0d6923f607b4e5cd1e3079c12f0b86f6e5007f07e377d6ad25e2d7bb9", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-linux-arm64.tgz", + "bytes": 122610794, + "sha256": "sha256:a2315b5f64bfeaff79b71e0d35505ba8c22cc1e96cab9dc950b614c804105b24", "member": "package/vendor/aarch64-unknown-linux-musl/bin/codex" }, "linux/x86_64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-x64.tgz", - "bytes": 129272137, - "sha256": "sha256:54818cb9fce3360cc6e44cfc5a96952cd5c1243efb43cbe488e11dda84663e08", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-linux-x64.tgz", + "bytes": 129654638, + "sha256": "sha256:e27c83a49e6031685ee7f956c12aad5f16484d3a80181dd3fea930fb96b3832b", "member": "package/vendor/x86_64-unknown-linux-musl/bin/codex" }, "macos/arm64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-arm64.tgz", - "bytes": 115672312, - "sha256": "sha256:535d301b49131abfda3264f959fb0defa40bbc306976d98ddbc15c424636c55c", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-darwin-arm64.tgz", + "bytes": 116501639, + "sha256": "sha256:2a98662d79316a59993c7233e3e25a1aa1d42da4b45904585d33a5a7da1cade1", "member": "package/vendor/aarch64-apple-darwin/bin/codex" }, "macos/x86_64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-x64.tgz", - "bytes": 123544033, - "sha256": "sha256:5e468958503c60e940b1b1af3fe2064c16fd141f1607111caf99f2c0a0e80725", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-darwin-x64.tgz", + "bytes": 124308807, + "sha256": "sha256:92c493533c53c433c4d94252251daba4f379ccba06a9964d260abb47a535dce1", "member": "package/vendor/x86_64-apple-darwin/bin/codex" }, "windows/arm64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-arm64.tgz", - "bytes": 132173674, - "sha256": "sha256:6d0bf07e04810f0ed4ad2984f6c9f0547bb9e0e1bb1f8fe9ecce0de3376bbfef", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-win32-arm64.tgz", + "bytes": 132888437, + "sha256": "sha256:a072b19e67fd65f2827c925a9d3c89b1a55da70b8e24cc21b81c800a77cb3d53", "member": "package/vendor/aarch64-pc-windows-msvc/bin/codex.exe" }, "windows/x86_64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-x64.tgz", - "bytes": 141495386, - "sha256": "sha256:05f473573f38b3f4dc9484e6807a511a1bb0e128dfa50816dafc5f79e553cdca", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-win32-x64.tgz", + "bytes": 142162836, + "sha256": "sha256:27eedae55e37ed1da4078b36a6ef9e4ffe8546a60fd6df5ee6408fdd16aff8ea", "member": "package/vendor/x86_64-pc-windows-msvc/bin/codex.exe" } }, - "version": "0.153.4", - "verified_at": "2026-09-07T03:12:33+00:00" + "version": "0.154.0", + "verified_at": "2026-09-13T15:17:16+00:00" }, - "setup_catalogue_digest": "sha256:58465e95466a2f0f5572d5807512e32445e9e40f16eb1ded9f815213cca1d6d7", + "setup_catalogue_digest": "sha256:798c777e0ec0accbd155d666d896c1aad341779c8c8a457fdeccaecfb8f5499e", "previous_software_artifacts": { "command": "codex", "shape": "gzip-tar", "platforms": { "linux/arm64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-arm64.tgz", - "bytes": 121675259, - "sha256": "sha256:df2f8f764bf86aeae51d71cc37686dcbd2c24e4bce9a9d1e8f249141fd99fac3", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-arm64.tgz", + "bytes": 121707000, + "sha256": "sha256:439c0dd0d6923f607b4e5cd1e3079c12f0b86f6e5007f07e377d6ad25e2d7bb9", "member": "package/vendor/aarch64-unknown-linux-musl/bin/codex" }, "linux/x86_64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-x64.tgz", - "bytes": 129259793, - "sha256": "sha256:1fd52113294979c9936a110cab7cb9d5e9d1e28086f112fd6748a05826a9e5a0", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-x64.tgz", + "bytes": 129272137, + "sha256": "sha256:54818cb9fce3360cc6e44cfc5a96952cd5c1243efb43cbe488e11dda84663e08", "member": "package/vendor/x86_64-unknown-linux-musl/bin/codex" }, "macos/arm64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-arm64.tgz", - "bytes": 115669249, - "sha256": "sha256:151ecdd90b96af823a2828146bff056c8a5f42d2ab4da63a198fe8a4ad84990b", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-arm64.tgz", + "bytes": 115672312, + "sha256": "sha256:535d301b49131abfda3264f959fb0defa40bbc306976d98ddbc15c424636c55c", "member": "package/vendor/aarch64-apple-darwin/bin/codex" }, "macos/x86_64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-x64.tgz", - "bytes": 123497670, - "sha256": "sha256:ec139bb87cdd25d8038069cef7ff2bdd2d119c7fcf0ac6e26dcc1020573cd112", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-x64.tgz", + "bytes": 123544033, + "sha256": "sha256:5e468958503c60e940b1b1af3fe2064c16fd141f1607111caf99f2c0a0e80725", "member": "package/vendor/x86_64-apple-darwin/bin/codex" }, "windows/arm64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-arm64.tgz", - "bytes": 132143077, - "sha256": "sha256:71ba906090143a310354ae5c864d5c677e05842b373cadcf84ef2872f8ddcfa1", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-arm64.tgz", + "bytes": 132173674, + "sha256": "sha256:6d0bf07e04810f0ed4ad2984f6c9f0547bb9e0e1bb1f8fe9ecce0de3376bbfef", "member": "package/vendor/aarch64-pc-windows-msvc/bin/codex.exe" }, "windows/x86_64": { - "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-x64.tgz", - "bytes": 141510231, - "sha256": "sha256:e674587ea13f7051aeae697b1425ec028a236f54fa1dd1a15661ef7c063f2874", + "url": "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-x64.tgz", + "bytes": 141495386, + "sha256": "sha256:05f473573f38b3f4dc9484e6807a511a1bb0e128dfa50816dafc5f79e553cdca", "member": "package/vendor/x86_64-pc-windows-msvc/bin/codex.exe" } }, - "version": "0.153.2", - "verified_at": "2026-09-04T13:31:03+00:00" + "version": "0.153.4", + "verified_at": "2026-09-07T03:12:33+00:00" }, "capability_features": { "measured_at": "2026-08-30", diff --git a/setups/nddev-builder/home/agents/nddev-builder.toml b/setups/nddev-builder/home/agents/nddev-builder.toml index 4c0a72d..0de08af 100644 --- a/setups/nddev-builder/home/agents/nddev-builder.toml +++ b/setups/nddev-builder/home/agents/nddev-builder.toml @@ -42,7 +42,7 @@ what it owns, ask the binary: `codex-setup-system provider-info`. **Where it goes**: `~/.codex/agents/.toml` -**Decided by**: https://github.com/openai/codex/blob/rust-v0.151.0/codex-rs/agent-roles/src/discovery.rs; routing measured by running the 0.151.0 binary against a temporary CODEX_HOME +**Decided by**: https://learn.chatgpt.com/docs/agent-configuration/subagents; routing originally measured by running the 0.151.0 binary against a temporary CODEX_HOME **How it runs**: Codex spawns the role by its `name`. @@ -54,12 +54,18 @@ what it owns, ask the binary: `codex-setup-system provider-info`. | `description` | **yes** | Role guidance shown when choosing and spawning that agent type. | | `developer_instructions` | **yes** | The role's prompt. Refused when absent, and it is the one a reader leaves out. | | `nickname_candidates` | no | Names an agent spawned with this role may be given. | +| `model` | no | Model override for sessions spawned with this role. | +| `model_reasoning_effort` | no | Reasoning effort for the selected model. | +| `sandbox_mode` | no | Narrow the spawned session's sandbox policy. | +| `mcp_servers` | no | Role-specific MCP server configuration. | +| `skills.config` | no | Skills made available to the spawned session. | ## What bites - **All three fields above are refused when missing, and the third is the one you will forget.** Measured against the 0.151.0 binary with a temporary `CODEX_HOME`, read back through `codex doctor`: a file with `name` and `description` alone is refused with *"must define `developer_instructions`"*; without `name`, *"must define a non-empty `name`"*; without `description`, *"must define a description"*. A complete one is accepted in silence, and so is one a directory deeper. - **This page said the opposite until 2026-08-30, and how it was wrong is the part worth keeping.** It said a file in `agents/` is not an agent and a role is irreducibly a `[agents.]` stanza plus the layer it points at. The measurement behind that planted an `agents/.md` and observed that nothing loaded it -- and the product's discovery filters on `extension == "toml"`, so that control could not have failed whatever the truth was. A negative drawn from an experiment incapable of producing a positive. - **The stanza form still works.** A `[agents.]` table with `config_file` names a role and excludes that file from the directory scan, so the two forms do not collide. This toolkit shipped as that pair until 2026-08-30 and ships as one standalone file now -- read `agents/nddev-builder.toml` as the worked example of the kind this provider declares. +- **Personal and project agents are separate scopes.** Put personal roles under `~/.codex/agents/` and repository roles under `.codex/agents/`. A standalone agent file is a configuration layer: settings it omits, including sandbox, MCP and skills configuration, inherit from the parent session. ## Before you ship one @@ -139,12 +145,13 @@ Generated from the same rows as the section above, for every harness in this est ## Events -`SessionStart` `SessionEnd` `SubagentStart` `SubagentStop` `PreToolUse` `PostToolUse` `PermissionRequest` `PreCompact` `PostCompact` `UserPromptSubmit` `Stop` +`SessionStart` `SessionEnd` `SubagentStart` `SubagentStop` `PreToolUse` `PostToolUse` `PermissionRequest` `PreCompact` `PostCompact` `UserPromptSubmit` `Stop` `Interrupt` ## What bites - **Hooks are trusted by hash, and this changes what an install means.** The vendor is explicit: *"Before a non-managed hook can run, Codex requires you to review and trust the exact hook definition. Codex records trust against the hook's current hash, so new or changed hooks are marked for review and skipped until trusted."* So writing this file -- by an install, or by a restore putting back a file that was trusted before -- leaves the hooks inert until a person runs `/hooks` and trusts them again. A setup that carries hooks cannot promise they are active, only that the file is in place. Say so where a reader will see it. - This surface is a single JSON **file**, not a directory of them. The other harness in this estate that routes hooks does the opposite; a hook moved between the two has to be repackaged. +- **A hook is useful policy, not a complete enforcement boundary.** Some specialised tool paths bypass tool hooks, and matching hooks for one event start concurrently. Keep hard security boundaries in the sandbox and permission layer. An async hook cannot block, approve or rewrite the operation that started it. ## The same file on the other harnesses diff --git a/setups/nddev-builder/setup.json b/setups/nddev-builder/setup.json index 1288ae9..7246403 100644 --- a/setups/nddev-builder/setup.json +++ b/setups/nddev-builder/setup.json @@ -5,8 +5,10 @@ "sources": [ "https://github.com/openai/codex/blob/rust-v0.151.0/codex-rs/agent-roles/src/discovery.rs", "https://learn.chatgpt.com/docs/agent-configuration/agents-md", + "https://learn.chatgpt.com/docs/agent-configuration/subagents", "https://learn.chatgpt.com/docs/config-file/config-reference", - "https://learn.chatgpt.com/docs/custom-prompts" + "https://learn.chatgpt.com/docs/custom-prompts", + "https://learn.chatgpt.com/docs/hooks" ], "setup_stable_id": "setup_01M15EN748TQX8H824ERR55JXC", "setup_version": "1.5",