Cloonar/coding-lab

Fork 0

chore(agent-tools): bump the codex pin 0.133.0 → 0.146.0 — Tier-2 compat re-verification first (13 stable releases of drift) [schedule: Daily agent update check] #249

New issue

Open

opened 2026-07-31 04:08:23 +02:00 by dominik.polakovics · 1 comment

dominik.polakovics commented

2026-07-31 04:08:23 +02:00

Owner

Goal

Move the agent-tools codex pin from 0.133.0 to 0.146.0 (13 stable releases, ~2 months of drift), re-verifying the Tier-2 compat record first, exactly as containers/agent-tools/versions.env and docs/ops.md § "Agent-tools images" mandate:

BEFORE bumping a version here, re-verify the compat record against the new CLI version FIRST (the compat doc is the checklist), THEN move the version + sha256 together. A bump that skips the re-verification ships an unverified CLI under a pin that claims verification.

The re-verification is the work. The two-line versions.env edit is the trivial part. If re-verification finds drift the record cannot absorb, the correct outcome is to report the drift on this issue and land only the compat-record updates — not to force the bump through.

Evidence — current state

containers/agent-tools/versions.env:25-26:

CODEX_VERSION=0.133.0
CODEX_SHA256_X64_MUSL_TGZ=d06019ab9c35d281b78dc2ebb2ae55c2bb97ea11bf7f452bafe390eddb0034ef

internal/compat/codex/compat.md:3-5:

Pinned version: **codex-cli 0.133.0** — live probes on the lab host,
2026-07-10 (issue #87's Tier-2 spike sweep, all eleven live-spike questions,
recorded in the issue's Amendment 2 ...)

(The one exception already recorded there: the §1 model-catalog probe schema is additionally live-verified against 0.144.1, 2026-07-13, issue #156 / ADR-0043. Everything else is 0.133.0.)

Upstream stable releases published since (GitHub openai/codex, rust-v* non-prerelease tags):

rust-v0.146.0  2026-07-29     rust-v0.144.3  2026-07-13
rust-v0.145.0  2026-07-21     rust-v0.144.2  2026-07-13
rust-v0.144.6  2026-07-18     rust-v0.144.1  2026-07-09
rust-v0.144.5  2026-07-16     rust-v0.144.0  2026-07-09
rust-v0.144.4  2026-07-14     rust-v0.143.0  2026-07-08
                              rust-v0.142.x  2026-06-22 .. 2026-07-01
                              rust-v0.134.0 .. 0.141.0   2026-05-26 .. 2026-06-18

0.147.0-alpha.* exists but is a prerelease — 0.146.0 is the target, not an alpha.

New pin values (verified against the GitHub release's own per-asset digest for rust-v0.146.0, the exact URL containers/agent-tools/build.sh:75-78 fetches):

CODEX_VERSION=0.146.0
CODEX_SHA256_X64_MUSL_TGZ=5ba3b9405543953081f661d0854d266f76e2abbe51d41349355a36de7673776a

(asset codex-x86_64-unknown-linux-musl.tar.gz, 114169492 bytes, from https://github.com/openai/codex/releases/download/rust-v0.146.0/codex-x86_64-unknown-linux-musl.tar.gz — re-derive the digest yourself from the downloaded file; do not trust this issue as the sole source.)

Security advisories closed by this window — these DO reach us

The codex binary is a statically linked Rust artifact we ship into every container instance (agent-tools:codex-<ver>, ADR-0051), so its bundled dependencies are ours.

0.143.0 (chore): "Updated OpenSSL, Hono, fast-uri, quick-xml, and crossbeam-epoch to address security advisories. (#29487, #29650, #30941, #31308)" — an explicit multi-advisory dependency sweep. Our pinned 0.133.0 predates all four.
0.136.0 (bug fixes): "Command-safety hardening prevents /diff from running repository-provided Git helpers/hooks, avoids PowerShell parser execution on non-Windows hosts, and rejects browser-origin exec-server websocket handshakes. (#24954, #24946, #24947)" — the /diff one reaches us directly: /diff is a chat-safe row in our static catalog (internal/provider/codex/commands.go:40), so lab exposes it in the composer, and on 0.133.0 invoking it can execute repo-provided git helpers/hooks from the instance's worktree.
0.141.0 (bug fixes): "Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)" — data-integrity, not a CVE, but it is codex's own session state DB.
0.145.0 (bug fixes): "Strengthened safety and approval handling with better forced-rm detection, consistent full-access confirmation, and preserved rejection reasons across tools. (#32989, #33464, #34400)" — see the risk list below; "consistent full-access confirmation" is the one item that could break us rather than help us.

What actually changed that touches how this repo uses codex

Every item below maps to a numbered section of internal/compat/codex/compat.md. Each is a hypothesis to verify, not a confirmed break — none of this was observed on a live 0.146.0 binary during this investigation.

§1 Spawn argv — {codex} --ask-for-approval never --sandbox danger-full-access -c project_doc_fallback_filenames=["AGENTS.local.md"] [--model M] -c model_reasoning_effort=E [prompt]

0.145.0 #33464 "consistent full-access confirmation". Highest-risk item in this bump. If --sandbox danger-full-access now prompts for confirmation, every unattended spawn hangs at start. Verify first; if it reproduces, this bump is blocked and the issue should be reported rather than worked around.
0.134.0: "Made --profile the primary profile selector across CLI, TUI permissions, and sandbox flows, with legacy profile configs rejected through migration guidance." We set no profile, but the sandbox/permission plumbing was reworked underneath our flags.
0.144.0 added a writes app-approval mode — a new enum member alongside never; confirm never still parses and still means never.
0.138.0: "model-defined effort levels now flow through in the order advertised by the model" — touches the §1 codex debug models catalog probe and the per-model effort seam (ADR-0043). Our probe already asserts ordering-independent invariants, but re-run it.

§4 Context-file discovery (AGENTS.local.md via project_doc_fallback_filenames)

0.138.0 #26205/#26465: "Workspace instruction loading is more accurate for remote and symlinked workspaces, so the right AGENTS.md files are picked up consistently."
0.142.0 #28958 et al.: remote environments "preserve executor-native paths, shells, AGENTS.md discovery..."
Why this reaches us specifically: every lab instance runs in a linked git worktree (.git is a file pointing at the reference repo's bare clone), which is exactly the symlinked/indirect workspace shape these fixes touch. Re-verify that AGENTS.local.md is still discovered from a worktree cwd.

§5 Transcript location + rollout JSONL grammar — lab reads the rollout JSONL as the chat transcript.

0.142.0 #28746/#28494: "Configurable rollout token budgets ... abort turns when exhausted" — potentially new rollout event kinds and a new turn-termination reason alongside the turn_aborted / interrupted pair we pin.
0.145.0: experimental "paginated thread history with efficient resume, search, persisted names, sub-agent support, and memories" (#33364, #33907, #34085, #34229, #34386) — the largest session-storage change in the window.
0.146.0: thread forking with paginated history, pinned threads, side conversations (#35220, #35251, #35011).
0.140.0 #26859/#27719: corrupted SQLite state DBs are now rebuilt from rollout data — the rollout is now load-bearing for recovery, so its shape matters more.
ParseRollout/ReadChat must degrade gracefully on unknown event kinds (Claude Code's parser already does; confirm codex's does too rather than erroring).

§6 Reply + interrupt recipes (bracketed paste → paced Enter; single Escape) — the most fragile coupling.

0.140.0 #27499: "Typing @ now opens the unified mentions menu for files, plugins, and skills by default." A reply body containing @ (an email address, a @user handle, a Go module path) pasted into the composer could now open a mentions overlay that lab can neither see nor dismiss, stranding the session. Our validateReply rejects control characters but not @. Test explicitly with an @ in the reply text.
0.135.0 #24371: "Older tmux/iTerm control-mode sessions no longer lose normal Ctrl-C handling from unsupported keyboard enhancement setup" — lab drives codex over tmux; §6's "Ctrl-C is forbidden EVERYWHERE" pin should be re-confirmed (it is still forbidden by lab's recipes either way, but the pinned rationale may have shifted).
0.141.0 #28235: "TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction."
0.146.0 #35000/#35021: "nonblocking interrupts, keyboard handling" — directly under the single-Escape interrupt recipe.

§7 Builtin slash-command catalog (internal/provider/codex/commands.go, a static table scraped verbatim from the live 0.133.0 TUI popup)

0.146.0 #34605: "Name new sessions with /new or /clear." Both rows are ChatSafe: true in our table (commands.go:32-35), and /new carries provider.CommandRoleClear — i.e. it backs lab's New conversation action. If either now opens a naming input overlay, the clear path strands the TUI. Verify before leaving those rows chat-safe.
Commands added in the window and absent from our table: /archive + codex archive/unarchive (0.136.0), /usage (0.140.0), /delete + codex delete (0.140.0), /import (0.140.0, extended 0.145.0).
Removed in the window: /realtime (0.140.0 — not in our table anyway).
The table needs a fresh verbatim TUI scrape at 0.146.0, with the same row-by-row ChatSafe curation and per-row reasons.

§9 Attribution ground truth — 0.134.0 #23963 adds "subagent identity in hook inputs"; §8 records hooks as the LiveSignals follow-up substrate. Worth a note, not a gate.

Build/CI (containers/agent-tools/build.sh, .forgejo/workflows/agent-tools.yml)

0.146.0 chore #34505/#34508/#34729/#34910: "Publish release artifacts, channel metadata, and installer aliases through OpenAI-hosted release infrastructure, with GitHub fallback." The GitHub release assets still exist for 0.146.0 (verified — the exact asset and digest are quoted above), so build.sh's URL keeps working and no build.sh change is needed now. Record it in docs/ops.md § Agent-tools images as a watch item: the github.com egress requirement listed there may eventually need to become releases.openai.com.
0.143.0 #31056: "Reduced installer failures from GitHub API rate limits by reusing release metadata" — unrelated to our direct asset download.

Scope — files an implementing agent will touch

Path	Change
`containers/agent-tools/versions.env`	`CODEX_VERSION` + `CODEX_SHA256_X64_MUSL_TGZ`, moved atomically with the compat-record update
`internal/compat/codex/compat.md`	Pin header → 0.146.0; per-section provenance re-dated to what was actually re-verified; every drift above recorded in its own section
`internal/provider/codex/commands.go`	Only if the §7 TUI scrape shows drift (expected: new rows, `/new` + `/clear` re-curation)
`internal/provider/codex/*.go` + `testdata/`	Only if re-verification finds real drift. No port change is expected; if you find yourself rewriting the adapter, stop and report here instead
`docs/ops.md`	The OpenAI-hosted-release watch item under § Agent-tools images

nix/module.nix needs no edit — container.toolsImages derives its default tag from versions.env at eval time (nix/module.nix:197-213).

Done means

The three automated live probes pass against a real 0.146.0 binary:
LAB_COMPAT_LIVE=1 go test ./internal/compat/codex/ -run Live -v
(TestCompat_Live_loginStatusParses, TestCompat_Live_locateTranscript, TestCompat_Live_debugModelsProbe).
The by-hand §6 hazard checks are re-driven in a scratch tmux TUI on 0.146.0, per that section's own "When this breaks" instructions: paste-without-submit, paste containing @, mid-turn queue-with-steer, single-Esc abort marker, idle double-Esc + q recovery. Ctrl-C stays forbidden and untested outside a disposable session.
§1 spawn posture confirmed live: --ask-for-approval never --sandbox danger-full-access still starts a turn with no confirmation prompt.
§4 confirmed live: AGENTS.local.md is still discovered from a linked-worktree cwd.
§7 re-scraped from the live 0.146.0 TUI popup; /new and /clear re-curated against the naming-prompt change.
go test ./... green (hermetic; fixtures updated only if the rollout grammar genuinely moved).
golangci-lint run clean.
Version + sha256 + compat-record land in one commit.
The agent-tools CI gate (path-gated on containers/**) builds the codex image and passes the injection smoke test on the PR — locally reproducible with
containers/agent-tools/build.sh codex && containers/agent-tools/smoke-test.sh codex.
PR body says Closes #<this issue>.

Out of scope

The Claude Code pin. CLAUDE_CODE_VERSION=2.1.220 is the newest published release (npm @anthropic-ai/claude-code dist-tag latest = 2.1.220, published 2026-07-24; stable = 2.1.212). Nothing to bump. Its outstanding live re-verification is tracked on #235.
The gemini seam (versions.env:28-30) — still deferred to #126.
Any adapter feature work the new codex versions enable (paginated history, /usage, hooks-as-LiveSignals). Record what you observe in the compat doc; file follow-ups; do not build.
Host pin rollout beyond what merging to main already publishes.

Filed by the Daily agent update check schedule, 2026-07-31. Release notes quoted from the GitHub releases API for openai/codex (rust-v0.134.0 … rust-v0.146.0); the project's CHANGELOG.md is a stub pointing at that releases page.

## Goal Move the agent-tools **codex** pin from `0.133.0` to **`0.146.0`** (13 stable releases, ~2 months of drift), re-verifying the Tier-2 compat record first, exactly as `containers/agent-tools/versions.env` and `docs/ops.md § "Agent-tools images"` mandate: > BEFORE bumping a version here, re-verify the compat record against the new CLI version FIRST (the compat doc is the checklist), THEN move the version + sha256 together. A bump that skips the re-verification ships an unverified CLI under a pin that claims verification. **The re-verification is the work. The two-line `versions.env` edit is the trivial part.** If re-verification finds drift the record cannot absorb, the correct outcome is to report the drift on this issue and land only the compat-record updates — not to force the bump through. ## Evidence — current state `containers/agent-tools/versions.env:25-26`: ``` CODEX_VERSION=0.133.0 CODEX_SHA256_X64_MUSL_TGZ=d06019ab9c35d281b78dc2ebb2ae55c2bb97ea11bf7f452bafe390eddb0034ef ``` `internal/compat/codex/compat.md:3-5`: ``` Pinned version: **codex-cli 0.133.0** — live probes on the lab host, 2026-07-10 (issue #87's Tier-2 spike sweep, all eleven live-spike questions, recorded in the issue's Amendment 2 ...) ``` (The one exception already recorded there: the §1 model-catalog probe **schema** is additionally live-verified against 0.144.1, 2026-07-13, issue #156 / ADR-0043. Everything else is 0.133.0.) Upstream stable releases published since (GitHub `openai/codex`, `rust-v*` non-prerelease tags): ``` rust-v0.146.0 2026-07-29 rust-v0.144.3 2026-07-13 rust-v0.145.0 2026-07-21 rust-v0.144.2 2026-07-13 rust-v0.144.6 2026-07-18 rust-v0.144.1 2026-07-09 rust-v0.144.5 2026-07-16 rust-v0.144.0 2026-07-09 rust-v0.144.4 2026-07-14 rust-v0.143.0 2026-07-08 rust-v0.142.x 2026-06-22 .. 2026-07-01 rust-v0.134.0 .. 0.141.0 2026-05-26 .. 2026-06-18 ``` `0.147.0-alpha.*` exists but is a prerelease — **0.146.0 is the target**, not an alpha. New pin values (verified against the GitHub release's own per-asset digest for `rust-v0.146.0`, the exact URL `containers/agent-tools/build.sh:75-78` fetches): ``` CODEX_VERSION=0.146.0 CODEX_SHA256_X64_MUSL_TGZ=5ba3b9405543953081f661d0854d266f76e2abbe51d41349355a36de7673776a ``` (asset `codex-x86_64-unknown-linux-musl.tar.gz`, 114169492 bytes, from `https://github.com/openai/codex/releases/download/rust-v0.146.0/codex-x86_64-unknown-linux-musl.tar.gz` — re-derive the digest yourself from the downloaded file; do not trust this issue as the sole source.) ## Security advisories closed by this window — these DO reach us The codex binary is a statically linked Rust artifact we ship into every container instance (`agent-tools:codex-<ver>`, ADR-0051), so its bundled dependencies are ours. - **0.143.0 (chore):** *"Updated OpenSSL, Hono, fast-uri, quick-xml, and crossbeam-epoch to address security advisories. (#29487, #29650, #30941, #31308)"* — an explicit multi-advisory dependency sweep. Our pinned 0.133.0 predates all four. - **0.136.0 (bug fixes):** *"Command-safety hardening prevents `/diff` from running repository-provided Git helpers/hooks, avoids PowerShell parser execution on non-Windows hosts, and rejects browser-origin exec-server websocket handshakes. (#24954, #24946, #24947)"* — the `/diff` one reaches us directly: `/diff` is a **chat-safe** row in our static catalog (`internal/provider/codex/commands.go:40`), so lab exposes it in the composer, and on 0.133.0 invoking it can execute repo-provided git helpers/hooks from the instance's worktree. - **0.141.0 (bug fixes):** *"Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)"* — data-integrity, not a CVE, but it is codex's own session state DB. - **0.145.0 (bug fixes):** *"Strengthened safety and approval handling with better forced-`rm` detection, consistent full-access confirmation, and preserved rejection reasons across tools. (#32989, #33464, #34400)"* — see the risk list below; "consistent full-access confirmation" is the one item that could *break* us rather than help us. ## What actually changed that touches how this repo uses codex Every item below maps to a numbered section of `internal/compat/codex/compat.md`. Each is a **hypothesis to verify**, not a confirmed break — none of this was observed on a live 0.146.0 binary during this investigation. **§1 Spawn argv** — `{codex} --ask-for-approval never --sandbox danger-full-access -c project_doc_fallback_filenames=["AGENTS.local.md"] [--model M] -c model_reasoning_effort=E [prompt]` - 0.145.0 #33464 *"consistent full-access confirmation"*. **Highest-risk item in this bump.** If `--sandbox danger-full-access` now prompts for confirmation, every unattended spawn hangs at start. Verify first; if it reproduces, this bump is blocked and the issue should be reported rather than worked around. - 0.134.0: *"Made `--profile` the primary profile selector across CLI, TUI permissions, and sandbox flows, with legacy profile configs rejected through migration guidance."* We set no profile, but the sandbox/permission plumbing was reworked underneath our flags. - 0.144.0 added a `writes` app-approval mode — a new enum member alongside `never`; confirm `never` still parses and still means never. - 0.138.0: *"model-defined effort levels now flow through in the order advertised by the model"* — touches the §1 `codex debug models` catalog probe and the per-model effort seam (ADR-0043). Our probe already asserts ordering-independent invariants, but re-run it. **§4 Context-file discovery (`AGENTS.local.md` via `project_doc_fallback_filenames`)** - 0.138.0 #26205/#26465: *"Workspace instruction loading is more accurate for remote and symlinked workspaces, so the right `AGENTS.md` files are picked up consistently."* - 0.142.0 #28958 et al.: remote environments *"preserve executor-native paths, shells, `AGENTS.md` discovery..."* - **Why this reaches us specifically:** every lab instance runs in a *linked git worktree* (`.git` is a file pointing at the reference repo's bare clone), which is exactly the symlinked/indirect workspace shape these fixes touch. Re-verify that `AGENTS.local.md` is still discovered from a worktree cwd. **§5 Transcript location + rollout JSONL grammar** — lab reads the rollout JSONL as the chat transcript. - 0.142.0 #28746/#28494: *"Configurable rollout token budgets ... abort turns when exhausted"* — potentially new rollout event kinds and a new turn-termination reason alongside the `turn_aborted` / `interrupted` pair we pin. - 0.145.0: experimental *"paginated thread history with efficient resume, search, persisted names, sub-agent support, and memories"* (#33364, #33907, #34085, #34229, #34386) — the largest session-storage change in the window. - 0.146.0: thread forking with paginated history, pinned threads, side conversations (#35220, #35251, #35011). - 0.140.0 #26859/#27719: corrupted SQLite state DBs are now *rebuilt from rollout data* — the rollout is now load-bearing for recovery, so its shape matters more. - `ParseRollout`/`ReadChat` must degrade gracefully on unknown event kinds (Claude Code's parser already does; confirm codex's does too rather than erroring). **§6 Reply + interrupt recipes** (bracketed paste → paced Enter; single Escape) — the most fragile coupling. - 0.140.0 #27499: *"Typing `@` now opens the unified mentions menu for files, plugins, and skills **by default**."* A reply body containing `@` (an email address, a `@user` handle, a Go module path) pasted into the composer could now open a mentions overlay that lab can neither see nor dismiss, stranding the session. Our `validateReply` rejects control characters but not `@`. **Test explicitly with an `@` in the reply text.** - 0.135.0 #24371: *"Older tmux/iTerm control-mode sessions no longer lose normal `Ctrl-C` handling from unsupported keyboard enhancement setup"* — lab drives codex over tmux; §6's "Ctrl-C is forbidden EVERYWHERE" pin should be re-confirmed (it is still forbidden by lab's recipes either way, but the pinned rationale may have shifted). - 0.141.0 #28235: *"TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction."* - 0.146.0 #35000/#35021: *"nonblocking interrupts, keyboard handling"* — directly under the single-Escape interrupt recipe. **§7 Builtin slash-command catalog** (`internal/provider/codex/commands.go`, a static table scraped verbatim from the live 0.133.0 TUI popup) - 0.146.0 #34605: *"Name new sessions with `/new` or `/clear`."* Both rows are `ChatSafe: true` in our table (`commands.go:32-35`), and `/new` carries `provider.CommandRoleClear` — i.e. it backs lab's **New conversation** action. If either now opens a naming input overlay, the clear path strands the TUI. **Verify before leaving those rows chat-safe.** - Commands added in the window and absent from our table: `/archive` + `codex archive`/`unarchive` (0.136.0), `/usage` (0.140.0), `/delete` + `codex delete` (0.140.0), `/import` (0.140.0, extended 0.145.0). - Removed in the window: `/realtime` (0.140.0 — not in our table anyway). - The table needs a fresh verbatim TUI scrape at 0.146.0, with the same row-by-row `ChatSafe` curation and per-row reasons. **§9 Attribution ground truth** — 0.134.0 #23963 adds *"subagent identity in hook inputs"*; §8 records hooks as the LiveSignals follow-up substrate. Worth a note, not a gate. **Build/CI (`containers/agent-tools/build.sh`, `.forgejo/workflows/agent-tools.yml`)** - 0.146.0 chore #34505/#34508/#34729/#34910: *"Publish release artifacts, channel metadata, and installer aliases through OpenAI-hosted release infrastructure, **with GitHub fallback**."* The GitHub release assets still exist for 0.146.0 (verified — the exact asset and digest are quoted above), so `build.sh`'s URL keeps working and **no build.sh change is needed now**. Record it in `docs/ops.md § Agent-tools images` as a watch item: the `github.com` egress requirement listed there may eventually need to become `releases.openai.com`. - 0.143.0 #31056: *"Reduced installer failures from GitHub API rate limits by reusing release metadata"* — unrelated to our direct asset download. ## Scope — files an implementing agent will touch | Path | Change | |---|---| | `containers/agent-tools/versions.env` | `CODEX_VERSION` + `CODEX_SHA256_X64_MUSL_TGZ`, moved **atomically with the compat-record update** | | `internal/compat/codex/compat.md` | Pin header → 0.146.0; per-section provenance re-dated to what was actually re-verified; every drift above recorded in its own section | | `internal/provider/codex/commands.go` | Only if the §7 TUI scrape shows drift (expected: new rows, `/new` + `/clear` re-curation) | | `internal/provider/codex/*.go` + `testdata/` | Only if re-verification finds real drift. **No port change is expected**; if you find yourself rewriting the adapter, stop and report here instead | | `docs/ops.md` | The OpenAI-hosted-release watch item under § Agent-tools images | `nix/module.nix` needs **no** edit — `container.toolsImages` derives its default tag from `versions.env` at eval time (`nix/module.nix:197-213`). ## Done means - [ ] The three automated live probes pass against a real 0.146.0 binary: `LAB_COMPAT_LIVE=1 go test ./internal/compat/codex/ -run Live -v` (`TestCompat_Live_loginStatusParses`, `TestCompat_Live_locateTranscript`, `TestCompat_Live_debugModelsProbe`). - [ ] The by-hand §6 hazard checks are re-driven in a scratch tmux TUI on 0.146.0, per that section's own "When this breaks" instructions: paste-without-submit, **paste containing `@`**, mid-turn queue-with-steer, single-Esc abort marker, idle double-Esc + `q` recovery. Ctrl-C stays forbidden and untested outside a disposable session. - [ ] §1 spawn posture confirmed live: `--ask-for-approval never --sandbox danger-full-access` still starts a turn with **no** confirmation prompt. - [ ] §4 confirmed live: `AGENTS.local.md` is still discovered from a linked-worktree cwd. - [ ] §7 re-scraped from the live 0.146.0 TUI popup; `/new` and `/clear` re-curated against the naming-prompt change. - [ ] `go test ./...` green (hermetic; fixtures updated only if the rollout grammar genuinely moved). - [ ] `golangci-lint run` clean. - [ ] Version + sha256 + compat-record land in **one** commit. - [ ] The agent-tools CI gate (path-gated on `containers/**`) builds the codex image and passes the injection smoke test on the PR — locally reproducible with `containers/agent-tools/build.sh codex && containers/agent-tools/smoke-test.sh codex`. - [ ] PR body says `Closes #<this issue>`. ## Out of scope - The **Claude Code** pin. `CLAUDE_CODE_VERSION=2.1.220` is the newest published release (npm `@anthropic-ai/claude-code` dist-tag `latest` = `2.1.220`, published 2026-07-24; `stable` = `2.1.212`). Nothing to bump. Its outstanding live re-verification is tracked on #235. - The gemini seam (`versions.env:28-30`) — still deferred to #126. - Any adapter feature work the new codex versions enable (paginated history, `/usage`, hooks-as-LiveSignals). Record what you observe in the compat doc; file follow-ups; do not build. - Host pin rollout beyond what merging to main already publishes. --- *Filed by the Daily agent update check schedule, 2026-07-31. Release notes quoted from the GitHub releases API for `openai/codex` (`rust-v0.134.0` … `rust-v0.146.0`); the project's `CHANGELOG.md` is a stub pointing at that releases page.*

dominik.polakovics added the

ready-for-agent

enhancement

labels

2026-07-31 04:08:23 +02:00

dominik.polakovics referenced this issue from a commit

2026-07-31 04:48:00 +02:00

chore(agent-tools): bump codex pin 0.133.0 → 0.146.0 after Tier-2 compat re-verification

dominik.polakovics referenced this issue from a pull request that will close it,

2026-07-31 04:48:28 +02:00

chore(agent-tools): bump codex pin 0.133.0 → 0.146.0 — Tier-2 compat re-verification first #252

dominik.polakovics referenced this issue

2026-07-31 05:04:11 +02:00

chore(agent-tools): bump codex pin 0.133.0 → 0.146.0 — Tier-2 compat re-verification first #252

dominik.polakovics commented

2026-08-01 04:08:55 +02:00

Author

Owner

Re-verified 2026-08-01 (Daily agent update check): the target is unchanged — 0.146.0 is still the newest stable. One new thing to ignore.

$ curl -s 'https://api.github.com/repos/openai/codex/releases?per_page=15'
rust-v0.147.0-alpha.4    2026-07-31  prerelease
rust-v0.147.0-alpha.3    2026-07-31  prerelease
rust-v0.147.0-alpha.1.1  2026-07-31  prerelease
rust-v0.147.0-alpha.2    2026-07-30  prerelease
rust-v0.146.0            2026-07-29  <-- newest non-prerelease
rust-v0.147.0-alpha.1    2026-07-29  prerelease

The 0.147.0 alpha line has moved fast since this was filed (four more alphas in two days) and 0.147.0-alpha.4 will be what the GitHub releases page shows at the top. It is still a prerelease — do not take it. rust-v0.146.0 remains the target, exactly as the body says, and the pin values quoted there are unchanged.

Everything else in this issue — the Tier-2 re-verification checklist, the security window, the per-section drift hypotheses, and the scope table — stands as written. Nothing new to fold in.

**Re-verified 2026-08-01 (Daily agent update check): the target is unchanged — `0.146.0` is still the newest stable. One new thing to ignore.** ``` $ curl -s 'https://api.github.com/repos/openai/codex/releases?per_page=15' rust-v0.147.0-alpha.4 2026-07-31 prerelease rust-v0.147.0-alpha.3 2026-07-31 prerelease rust-v0.147.0-alpha.1.1 2026-07-31 prerelease rust-v0.147.0-alpha.2 2026-07-30 prerelease rust-v0.146.0 2026-07-29 <-- newest non-prerelease rust-v0.147.0-alpha.1 2026-07-29 prerelease ``` The `0.147.0` alpha line has moved fast since this was filed (four more alphas in two days) and `0.147.0-alpha.4` will be what the GitHub releases page shows at the top. **It is still a prerelease — do not take it.** `rust-v0.146.0` remains the target, exactly as the body says, and the pin values quoted there are unchanged. Everything else in this issue — the Tier-2 re-verification checklist, the security window, the per-section drift hypotheses, and the scope table — stands as written. Nothing new to fold in.

dominik.polakovics referenced this issue

2026-08-01 04:10:05 +02:00

chore(web): jsdom 29.1.1 → 30.0.1 — the only landable npm major (eslint 10 + TypeScript 7 are peer-blocked upstream) [schedule: Daily agent update check] #255