chore(agent-tools): bump the codex pin 0.133.0 → 0.146.0 — Tier-2 compat re-verification first (13 stable releases of drift) [schedule: Daily agent update check] #249
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Cloonar/coding-lab#249
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Goal
Move the agent-tools codex pin from
0.133.0to0.146.0(13 stable releases, ~2 months of drift), re-verifying the Tier-2 compat record first, exactly ascontainers/agent-tools/versions.envanddocs/ops.md § "Agent-tools images"mandate:The re-verification is the work. The two-line
versions.envedit is the trivial part. If re-verification finds drift the record cannot absorb, the correct outcome is to report the drift on this issue and land only the compat-record updates — not to force the bump through.Evidence — current state
containers/agent-tools/versions.env:25-26:internal/compat/codex/compat.md:3-5:(The one exception already recorded there: the §1 model-catalog probe schema is additionally live-verified against 0.144.1, 2026-07-13, issue #156 / ADR-0043. Everything else is 0.133.0.)
Upstream stable releases published since (GitHub
openai/codex,rust-v*non-prerelease tags):0.147.0-alpha.*exists but is a prerelease — 0.146.0 is the target, not an alpha.New pin values (verified against the GitHub release's own per-asset digest for
rust-v0.146.0, the exact URLcontainers/agent-tools/build.sh:75-78fetches):(asset
codex-x86_64-unknown-linux-musl.tar.gz, 114169492 bytes, fromhttps://github.com/openai/codex/releases/download/rust-v0.146.0/codex-x86_64-unknown-linux-musl.tar.gz— re-derive the digest yourself from the downloaded file; do not trust this issue as the sole source.)Security advisories closed by this window — these DO reach us
The codex binary is a statically linked Rust artifact we ship into every container instance (
agent-tools:codex-<ver>, ADR-0051), so its bundled dependencies are ours./difffrom running repository-provided Git helpers/hooks, avoids PowerShell parser execution on non-Windows hosts, and rejects browser-origin exec-server websocket handshakes. (#24954, #24946, #24947)" — the/diffone reaches us directly:/diffis a chat-safe row in our static catalog (internal/provider/codex/commands.go:40), so lab exposes it in the composer, and on 0.133.0 invoking it can execute repo-provided git helpers/hooks from the instance's worktree.rmdetection, consistent full-access confirmation, and preserved rejection reasons across tools. (#32989, #33464, #34400)" — see the risk list below; "consistent full-access confirmation" is the one item that could break us rather than help us.What actually changed that touches how this repo uses codex
Every item below maps to a numbered section of
internal/compat/codex/compat.md. Each is a hypothesis to verify, not a confirmed break — none of this was observed on a live 0.146.0 binary during this investigation.§1 Spawn argv —
{codex} --ask-for-approval never --sandbox danger-full-access -c project_doc_fallback_filenames=["AGENTS.local.md"] [--model M] -c model_reasoning_effort=E [prompt]--sandbox danger-full-accessnow prompts for confirmation, every unattended spawn hangs at start. Verify first; if it reproduces, this bump is blocked and the issue should be reported rather than worked around.--profilethe primary profile selector across CLI, TUI permissions, and sandbox flows, with legacy profile configs rejected through migration guidance." We set no profile, but the sandbox/permission plumbing was reworked underneath our flags.writesapp-approval mode — a new enum member alongsidenever; confirmneverstill parses and still means never.codex debug modelscatalog probe and the per-model effort seam (ADR-0043). Our probe already asserts ordering-independent invariants, but re-run it.§4 Context-file discovery (
AGENTS.local.mdviaproject_doc_fallback_filenames)AGENTS.mdfiles are picked up consistently."AGENTS.mddiscovery...".gitis a file pointing at the reference repo's bare clone), which is exactly the symlinked/indirect workspace shape these fixes touch. Re-verify thatAGENTS.local.mdis still discovered from a worktree cwd.§5 Transcript location + rollout JSONL grammar — lab reads the rollout JSONL as the chat transcript.
turn_aborted/interruptedpair we pin.ParseRollout/ReadChatmust degrade gracefully on unknown event kinds (Claude Code's parser already does; confirm codex's does too rather than erroring).§6 Reply + interrupt recipes (bracketed paste → paced Enter; single Escape) — the most fragile coupling.
@now opens the unified mentions menu for files, plugins, and skills by default." A reply body containing@(an email address, a@userhandle, a Go module path) pasted into the composer could now open a mentions overlay that lab can neither see nor dismiss, stranding the session. OurvalidateReplyrejects control characters but not@. Test explicitly with an@in the reply text.Ctrl-Chandling from unsupported keyboard enhancement setup" — lab drives codex over tmux; §6's "Ctrl-C is forbidden EVERYWHERE" pin should be re-confirmed (it is still forbidden by lab's recipes either way, but the pinned rationale may have shifted).§7 Builtin slash-command catalog (
internal/provider/codex/commands.go, a static table scraped verbatim from the live 0.133.0 TUI popup)/newor/clear." Both rows areChatSafe: truein our table (commands.go:32-35), and/newcarriesprovider.CommandRoleClear— i.e. it backs lab's New conversation action. If either now opens a naming input overlay, the clear path strands the TUI. Verify before leaving those rows chat-safe./archive+codex archive/unarchive(0.136.0),/usage(0.140.0),/delete+codex delete(0.140.0),/import(0.140.0, extended 0.145.0)./realtime(0.140.0 — not in our table anyway).ChatSafecuration and per-row reasons.§9 Attribution ground truth — 0.134.0 #23963 adds "subagent identity in hook inputs"; §8 records hooks as the LiveSignals follow-up substrate. Worth a note, not a gate.
Build/CI (
containers/agent-tools/build.sh,.forgejo/workflows/agent-tools.yml)build.sh's URL keeps working and no build.sh change is needed now. Record it indocs/ops.md § Agent-tools imagesas a watch item: thegithub.comegress requirement listed there may eventually need to becomereleases.openai.com.Scope — files an implementing agent will touch
containers/agent-tools/versions.envCODEX_VERSION+CODEX_SHA256_X64_MUSL_TGZ, moved atomically with the compat-record updateinternal/compat/codex/compat.mdinternal/provider/codex/commands.go/new+/clearre-curation)internal/provider/codex/*.go+testdata/docs/ops.mdnix/module.nixneeds no edit —container.toolsImagesderives its default tag fromversions.envat eval time (nix/module.nix:197-213).Done means
LAB_COMPAT_LIVE=1 go test ./internal/compat/codex/ -run Live -v(
TestCompat_Live_loginStatusParses,TestCompat_Live_locateTranscript,TestCompat_Live_debugModelsProbe).@, mid-turn queue-with-steer, single-Esc abort marker, idle double-Esc +qrecovery. Ctrl-C stays forbidden and untested outside a disposable session.--ask-for-approval never --sandbox danger-full-accessstill starts a turn with no confirmation prompt.AGENTS.local.mdis still discovered from a linked-worktree cwd./newand/clearre-curated against the naming-prompt change.go test ./...green (hermetic; fixtures updated only if the rollout grammar genuinely moved).golangci-lint runclean.containers/**) builds the codex image and passes the injection smoke test on the PR — locally reproducible withcontainers/agent-tools/build.sh codex && containers/agent-tools/smoke-test.sh codex.Closes #<this issue>.Out of scope
CLAUDE_CODE_VERSION=2.1.220is the newest published release (npm@anthropic-ai/claude-codedist-taglatest=2.1.220, published 2026-07-24;stable=2.1.212). Nothing to bump. Its outstanding live re-verification is tracked on #235.versions.env:28-30) — still deferred to #126./usage, hooks-as-LiveSignals). Record what you observe in the compat doc; file follow-ups; do not build.Filed by the Daily agent update check schedule, 2026-07-31. Release notes quoted from the GitHub releases API for
openai/codex(rust-v0.134.0…rust-v0.146.0); the project'sCHANGELOG.mdis a stub pointing at that releases page.Re-verified 2026-08-01 (Daily agent update check): the target is unchanged —
0.146.0is still the newest stable. One new thing to ignore.The
0.147.0alpha line has moved fast since this was filed (four more alphas in two days) and0.147.0-alpha.4will be what the GitHub releases page shows at the top. It is still a prerelease — do not take it.rust-v0.146.0remains the target, exactly as the body says, and the pin values quoted there are unchanged.Everything else in this issue — the Tier-2 re-verification checklist, the security window, the per-section drift hypotheses, and the scope table — stands as written. Nothing new to fold in.
Re-verified 2026-08-02 (Daily agent update check): target unchanged —
0.146.0is still the newest stable codex release. No action needed on this issue; it is still accurate as written.The
0.147.0alpha line has kept moving (four prereleases in three days) but has not cut a stable. Target staysrust-v0.146.0, sha2565ba3b940…as recorded in the body.One adjacent observation, for context only — it does not change this issue's scope. nixpkgs also packages codex, and that is the other place a codex binary reaches a lab host:
services.lab.agentPackages.codexdefaults topkgs.codex(ADR-0033), the host-PATH baseline used byrunner = hostsessions, separate from the pinnedagent-tools:codex-<ver>image this issue moves.So the host-PATH codex on a current-nixpkgs host is already ahead of the
0.133.0compat pin and has been for a while — the compat record's claims do not cover it either way. Landing this issue converges the two on0.146.0. Worth knowing while doing the Tier-2 re-verification (a host with a recent nixpkgs can be used to drive the live probes without waiting on an image build), but the deliverable here is stillversions.env+ the compat record, and nothing aboutagentPackagesis in scope.Re-verified 2026-08-03 (Daily agent update check): target unchanged —
rust-v0.146.0is still the newest stable codex release, and the pin values in the body still stand. No edit needed.The
0.147.0alpha line has been quiet for three days (nothing new sincealpha.4on 2026-07-31) and still has not cut a stable. Target staysrust-v0.146.0, sha2565ba3b940…as recorded in the body.containers/agent-tools/versions.env:25-26is stillCODEX_VERSION=0.133.0.One thing did change, and it helps: this repo's own nixpkgs pin now ships codex 0.146.0
The 2026-08-02 comment noted, as context only, that nixpkgs
masterhad reached codex 0.146.0 while this repo'sflake.lockwas still ond407951447dc(codex 0.142.3). That flake bump has since landed.flake.lockmoved on 2026-08-02 in commitbbc7f99("chore(nix): nixpkgs d407951 → 148bab9c — go_1_26 1.26.4 → 1.26.5"):So on the repo's current pinned nixpkgs,
pkgs.codexis 0.146.0 — the exact release this issue targets. Two consequences for whoever picks this up:The Tier-2 live re-verification no longer needs an image build to get a 0.146.0 binary.
nix shell nixpkgs#codexfrom this flake (or the devShell) puts the target version on PATH, which is enough to drive the §1 spawn-posture check, the §4AGENTS.local.md-from-a-linked-worktree check, the §6 by-hand tmux hazard checks (including the@-in-reply mentions-menu test), the §7 TUI popup re-scrape, andLAB_COMPAT_LIVE=1 go test ./internal/compat/codex/ -run Live -v. Build the image afterwards for the CI smoke gate; do not wait on it to start probing.The drift is now internal to the repo's own pins, not just against upstream.
nix/module.nix:168defaultsservices.lab.agentPackages.codex = pkgs.codex(ADR-0033) — the host-PATH baseline forrunner = hostsessions. A host built from this flake today therefore runs codex 0.146.0 on the host arm while the container arm mounts the pinnedagent-tools:codex-0.133.0image, andinternal/compat/codex/compat.mdclaims verification against 0.133.0 for both. That is a live inconsistency, not a hypothetical: the compat record currently describes neither arm accurately on a current host. Landing this issue converges both arms on 0.146.0 and makes the record true again.This does not change the issue's scope — the deliverable is still
containers/agent-tools/versions.env+internal/compat/codex/compat.md(+internal/provider/codex/commands.goif the §7 scrape drifts), and nothing aboutagentPackagesis in scope. It is worth stating in the compat record's provenance, though, which binary the live probes were actually driven against (nixpkgspkgs.codex@148bab9cvs. the built image) — those are the same upstream release but not the same artifact.Everything else in this issue — the security window (0.136.0
/diffhardening, 0.141.0 bundled-SQLite WAL fix, 0.143.0 multi-advisory dependency sweep, 0.145.0 approval handling), the per-section drift hypotheses, the scope table and the Done checklist — stands as written.Re-verified 2026-08-04 (Daily agent update check). Target unchanged:
0.146.0is still the newest stable codex release. No edits to this issue's specification.Everything published since is a prerelease on the
0.147.0-alphaline —alpha.1,alpha.1.1,alpha.1.2,alpha.2,alpha.3,alpha.4,alpha.6, the newest of which landed 2026-08-03T21:32:07Z. None of them is a bump candidate; this issue's "0.146.0 is the target, not an alpha" instruction stands unchanged.The drift figure in the title is therefore still accurate: 13 stable releases between the pinned
0.133.0and0.146.0. The pin values in the body (CODEX_VERSION=0.146.0,CODEX_SHA256_X64_MUSL_TGZ=5ba3b9405543953081f661d0854d266f76e2abbe51d41349355a36de7673776a) are unchanged, and the GitHub release assetbuild.sh:73-76fetches still exists at that URL — the "GitHub fallback" watch item in the body has not been exercised yet.Nothing in the body needs correcting. The four advisory items, the §1/§4/§5/§6/§7 re-verification hypotheses, and the scope table are all as-filed. This comment exists only so the next sweep can see the target was re-checked rather than assumed.
Companion sweeps this run, for cross-reference: Go modules on #250 (rewritten —
modernc.org/sqlite v1.56.0published and unblockedgoose), Claude Code on #235 and the new #273 (2.1.221shipped 2026-08-03).Re-verified 2026-08-05 (Daily agent update check). Target unchanged:
0.146.0is still the newest stable codex release. No edits to this issue's specification.The
0.147.0-alphaline kept moving over the last 24h (alpha.6.12026-08-04T13:14:03Z,alpha.6.32026-08-04T19:36:48Z,alpha.6.42026-08-04T21:02:39Z, plusalpha.7tagged 2026-08-04T11:50:52Z) and still has not cut a stable. This issue's "0.146.0 is the target, not an alpha" instruction stands unchanged, and the drift figure in the title (13 stable releases) is still accurate.containers/agent-tools/versions.env:25-26is stillCODEX_VERSION=0.133.0/CODEX_SHA256_X64_MUSL_TGZ=d06019ab…. The pin values in the body (0.146.0, sha2565ba3b940…) are unchanged, and the GitHub release assetbuild.sh:71-74fetches still exists at that URL — the "GitHub fallback" watch item has still not been exercised.Nothing in the body needs correcting. The four advisory items (0.136.0
/diffhardening, 0.141.0 bundled-SQLite WAL fix, 0.143.0 multi-advisory dependency sweep, 0.145.0 approval handling), the §1/§4/§5/§6/§7 re-verification hypotheses, the scope table and the Done checklist are all as-filed. This comment exists only so the next sweep can see the target was re-checked rather than assumed.Companion sweeps this run, for cross-reference: Go modules on #250 (re-verified, no change), and a new issue #290 — Claude Code
2.1.221→2.1.222, published 2026-08-04T20:37:17Z. Note for whoever picks this issue up: #290 touches the same two files (containers/agent-tools/versions.envand a compat record), so if both are worked concurrently expect a trivialversions.envconflict — the two version lines are independent and neither issue's scope overlaps the other's compat doc.