chore(agent-tools): bump codex pin 0.133.0 → 0.146.0 — Tier-2 compat re-verification first #252

Open

dominik.polakovics wants to merge 1 commit from afk/249 into main

dominik.polakovics commented

2026-07-31 04:48:27 +02:00

Owner

Moves the agent-tools codex pin 0.133.0 → 0.146.0 (13 stable releases), re-verifying the Tier-2 compat record FIRST per versions.env / docs/ops.md § Agent-tools images / ADR-0051. Version + sha256 + compat-record land in this one commit.

Re-verification performed (in-container, 2026-07-31)

Artifact: sha256 re-derived from the exact GitHub release asset build.sh fetches — 5ba3b9405543953081f661d0854d266f76e2abbe51d41349355a36de7673776a (114169492 bytes), matching the issue's value. Binary runs (codex-cli 0.146.0) and is still static-pie (no PT_INTERP, zero DT_NEEDED) — the ADR-0051 FROM-scratch injection contract holds.
All three automated live probes PASS against the real 0.146.0 binary (LAB_COMPAT_LIVE=1 go test ./internal/compat/codex/ -run Live -v): loginStatusParses (logged-out leg), debugModelsProbe (§1 schema clean; catalog values moved — new spawn default gpt-5.6-sol — which the probe design absorbs), and locateTranscript against a genuine 0.146.0 rollout produced by an unauthenticated codex exec probe turn on this host.
Upstream source diff rust-v0.133.0 → rust-v0.146.0 (both tarballs), refuting the two release-note risks: the 0.145.0 "consistent full-access confirmation" triggers ONLY from the interactive permissions menu (single sender in the tree; run_main maps --sandbox/--ask-for-approval straight into config) — unattended --ask-for-approval never --sandbox danger-full-access spawns hit no new prompt; and bare /new + /clear dispatch is unchanged (the 0.146.0 naming change is an additive optional inline argument, no overlay) — the chat-safe rows and lab's clear path stay valid. never still parses; no writes approval value exists (deprecated on-failure was removed; unused by lab).
CLI probe battery: login status both signals, device-auth capture (both §2 scrape regexes hold), codex features list, full flag inventory, §11 recipe parse-through to a genuine 401.

Drift recorded in `internal/compat/codex/compat.md` (all absorbed)

§2 device-auth caution line reworded (new fixture device-auth-0.146.0.txt); §5 additive grammar — new world_state/inter_agent_communication* record types, new session_meta/user_message/task_complete keys, per-line ordinal — pinned by the new REAL-capture fixture rollout-authfail-0.146.0.jsonl + TestCompat_RolloutAuthFail146Fixture_maps, plus two default-off watch items (paginated history mode, .zst rollout compression); §6 mentions-v2 now stable-on (bare trailing @ in a paste newly triggers the popup; Enter-inserts hazard class existed at 0.133.0 too); §7 popup gained import/archive/delete/usage — all 40 pinned rows byte-identical (source diff + binary strings), table deliberately stays the 0.133.0 live scrape until the dev-host re-scrape re-curates; §8 plugin_hooks retired upstream (LiveSignals substrate is the core hooks feature only now); §9 attribution is no longer absent at source — 0.146.0 ships a server-side-gated instruction extension emitting Co-authored-by: Codex <noreply@openai.com> / Generated with Codex. under ChatGPT auth; the existing ScrubPatterns cover exactly these strings and graduate to load-bearing; §10 codex doctor exits 1 logged-out, and the first real turn git-clones a ~5300-file plugin-marketplace repo into $CODEX_HOME/.tmp/plugins (egress/disk note for containerized sessions); §11 recipe flags re-confirmed.

Outstanding dev-host merge gate (recorded in compat.md, per the 2.1.220 claude-bump precedent)

The probing container has no codex login and no tmux, so these stay owed to the dev host: the §6 by-hand hazard sweep (now incl. paste-ending-in-@token and bare-trailing-@), the §7 live popup re-scrape + row-by-row curation of the four new rows, the §3/§4 live seeding legs, one real authenticated spawn (argv banner + the three §1 sandbox traps), and the §9 real-commit git log inspection.

Verification

go test ./... green (47 packages), golangci-lint run (2.12.2, CI's version) — 0 issues.
The agent-tools CI gate is path-gated on containers/** and will build the codex image + run the injection smoke test on this PR; the static-pie check above is the local predictor (no podman in this container).
nix/module.nix untouched by design — container.toolsImages derives its default tag from versions.env at eval time.

Closes #249

🤖 Generated with Claude Code

Moves the agent-tools codex pin `0.133.0 → 0.146.0` (13 stable releases), re-verifying the Tier-2 compat record FIRST per `versions.env` / `docs/ops.md § Agent-tools images` / ADR-0051. Version + sha256 + compat-record land in this one commit. ## Re-verification performed (in-container, 2026-07-31) - **Artifact**: sha256 re-derived from the exact GitHub release asset `build.sh` fetches — `5ba3b9405543953081f661d0854d266f76e2abbe51d41349355a36de7673776a` (114169492 bytes), matching the issue's value. Binary runs (`codex-cli 0.146.0`) and is still **static-pie** (no `PT_INTERP`, zero `DT_NEEDED`) — the ADR-0051 FROM-scratch injection contract holds. - **All three automated live probes PASS** against the real 0.146.0 binary (`LAB_COMPAT_LIVE=1 go test ./internal/compat/codex/ -run Live -v`): `loginStatusParses` (logged-out leg), `debugModelsProbe` (§1 schema clean; catalog values moved — new spawn default `gpt-5.6-sol` — which the probe design absorbs), and `locateTranscript` against a **genuine 0.146.0 rollout** produced by an unauthenticated `codex exec` probe turn on this host. - **Upstream source diff** `rust-v0.133.0 → rust-v0.146.0` (both tarballs), refuting the two release-note risks: the 0.145.0 "consistent full-access confirmation" triggers ONLY from the interactive permissions menu (single sender in the tree; `run_main` maps `--sandbox`/`--ask-for-approval` straight into config) — unattended `--ask-for-approval never --sandbox danger-full-access` spawns hit no new prompt; and bare `/new` + `/clear` dispatch is unchanged (the 0.146.0 naming change is an additive optional inline argument, no overlay) — the chat-safe rows and lab's clear path stay valid. `never` still parses; no `writes` approval value exists (deprecated `on-failure` was removed; unused by lab). - **CLI probe battery**: login status both signals, device-auth capture (both §2 scrape regexes hold), `codex features list`, full flag inventory, §11 recipe parse-through to a genuine 401. ## Drift recorded in `internal/compat/codex/compat.md` (all absorbed) §2 device-auth caution line reworded (new fixture `device-auth-0.146.0.txt`); §5 additive grammar — new `world_state`/`inter_agent_communication*` record types, new `session_meta`/`user_message`/`task_complete` keys, per-line `ordinal` — pinned by the new REAL-capture fixture `rollout-authfail-0.146.0.jsonl` + `TestCompat_RolloutAuthFail146Fixture_maps`, plus two default-off watch items (paginated history mode, `.zst` rollout compression); §6 mentions-v2 now stable-on (bare trailing `@` in a paste newly triggers the popup; Enter-inserts hazard class existed at 0.133.0 too); §7 popup gained `import`/`archive`/`delete`/`usage` — all 40 pinned rows byte-identical (source diff + binary strings), table deliberately stays the 0.133.0 live scrape until the dev-host re-scrape re-curates; §8 `plugin_hooks` retired upstream (LiveSignals substrate is the core `hooks` feature only now); **§9 attribution is no longer absent at source** — 0.146.0 ships a server-side-gated instruction extension emitting `Co-authored-by: Codex <noreply@openai.com>` / `Generated with Codex.` under ChatGPT auth; the existing ScrubPatterns cover exactly these strings and graduate to load-bearing; §10 `codex doctor` exits 1 logged-out, and the first real turn git-clones a ~5300-file plugin-marketplace repo into `$CODEX_HOME/.tmp/plugins` (egress/disk note for containerized sessions); §11 recipe flags re-confirmed. ## Outstanding dev-host merge gate (recorded in compat.md, per the 2.1.220 claude-bump precedent) The probing container has no codex login and no tmux, so these stay owed to the dev host: the §6 by-hand hazard sweep (now incl. paste-ending-in-`@token` and bare-trailing-`@`), the §7 live popup re-scrape + row-by-row curation of the four new rows, the §3/§4 live seeding legs, one real authenticated spawn (argv banner + the three §1 sandbox traps), and the §9 real-commit `git log` inspection. ## Verification - `go test ./...` green (47 packages), `golangci-lint run` (2.12.2, CI's version) — 0 issues. - The agent-tools CI gate is path-gated on `containers/**` and will build the codex image + run the injection smoke test on this PR; the static-pie check above is the local predictor (no podman in this container). - `nix/module.nix` untouched by design — `container.toolsImages` derives its default tag from `versions.env` at eval time. Closes #249 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-07-31 04:48:29 +02:00

chore(agent-tools): bump codex pin 0.133.0 → 0.146.0 after Tier-2 compat re-verification

agent-tools / publish (pull_request) Has been skipped

Details

agent-tools / smoke (pull_request) Successful in 13m58s

Details

ci / native (pull_request) Successful in 14m23s

Details

5fab6905d2

Re-verifies internal/compat/codex/compat.md against codex-cli 0.146.0
FIRST (the ADR-0051 bump procedure), then moves the version + sha256
together. In-container re-verification (issue #249): sha256 re-derived
from the exact release asset build.sh fetches; the binary is still
static-pie (the ADR-0051 injection contract); all three automated live
probes PASS against the real 0.146.0 binary — locateTranscript against
a genuine 0.146.0 rollout captured on this host, committed as the new
rollout-authfail-0.146.0.jsonl fixture pinning the additive §5 grammar
(world_state et al.); device-auth re-captured (reworded caution line,
both scrape regexes hold — new device-auth-0.146.0.txt fixture); plus
an upstream source diff rust-v0.133.0 → rust-v0.146.0 refuting the two
release-note risks (the 0.145 "full-access confirmation" is
permissions-menu-only, no startup gate; bare /new + /clear dispatch is
unchanged — the 0.146 naming change is an additive inline argument).

Recorded drift, all absorbed by the compat record: §2 wording, §5
additive record types plus two default-off watch items (paginated
history, zst compression), §6 mentions-v2 stable-on (a bare trailing @
in a paste now opens the popup), §7 four new popup rows (the pinned
table deliberately stays the 0.133.0 scrape until the dev-host
re-scrape), §8 plugin_hooks retired upstream, §9 attribution returned
as a server-side-gated instruction extension (the scrub patterns
graduate from defensive to load-bearing), §10 doctor exits 1 logged-out
+ the first real turn clones a plugin-marketplace repo into
$CODEX_HOME/.tmp/plugins, §11 recipe flags parse through to a real 401.
The live TUI legs (§6 hazard sweep incl. the new @ checks, §7 popup
re-scrape, §3/§4 seeding legs, §9 real-commit inspection) remain the
dev-host merge gate, per the 2.1.220 claude-bump precedent.

docs/ops.md gains the OpenAI-hosted-release-infrastructure watch item
(the GitHub asset leg still exists and was digest-verified at 0.146.0).

Closes #249

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics commented

2026-07-31 05:04:11 +02:00

Author

Owner

[autoland] verdict: pass

Verdict: PASS with CONCERNS — validated, awaiting human confirm. Not auto-merged: the concerns below want a maintainer's eye before this publishes to main.

Verification signal relied on: labctl pr checks 252 aggregate success — ci / native (14m23s; the repo's go test ./... + golangci-lint gate) and agent-tools / smoke (13m58s; path-gated on containers/**, triggered by the versions.env edit, so it actually fetched the new digest and ran the ADR-0051 injection smoke test against the real 0.146.0 artifact). Nothing re-run locally.

Conventions: title is Conventional Commits (chore(agent-tools): …); body carries Closes #249; head afk/249 is a direct descendant of origin/main (no conflict, no resolution commit). Diff touches exactly the files the issue's scope table names — versions.env, compat.md, compat_test.go, doc.go, two new fixtures, docs/ops.md — plus nothing else. Version + sha256 + compat record land in one commit, as versions.env / docs/ops.md and the issue both require.

Concerns (non-blocking, for the human):

§1 spawn posture is source-verified, not live-verified — internal/compat/codex/compat.md (0.146.0 note, §1). Issue #249 named the 0.145.0 "consistent full-access confirmation" (#33464) the highest-risk item in this bump and said "verify first; if it reproduces, this bump is blocked." The evidence here is an upstream source diff (single sender of OpenFullAccessConfirmation is the interactive permissions-menu action builder; run_main maps --sandbox/--ask-for-approval straight into config; trust-screen predicate byte-identical) plus a live codex exec turn that did start without a prompt — but that turn ran --sandbox read-only, not --sandbox danger-full-access. The exact unattended spawn posture is therefore reasoned, not observed. If the reasoning is wrong, every unattended codex spawn hangs at start. The PR records this honestly as an owed dev-host leg.
Issue #249's "Done means" checkboxes for the live-TUI legs are unmet by design — the §6 by-hand hazard sweep (incl. the newly-widened bare-trailing-@ trigger), the §7 popup re-scrape + row-by-row ChatSafe curation of the four new rows (import/archive/delete/usage), the §3/§4 live seeding legs, and the §9 real-commit git log inspection. The probing container had no codex login and no tmux. These are deferred to a recorded dev-host merge gate, which follows the merged 2.1.220 Claude-Code precedent (commit 52a9176 / PR #246 deferred its live recipe suite the same way) — but that is a maintainer's call to ratify, not a lander's.
§9 attribution changed posture and ScrubPatterns are now load-bearing — internal/compat/codex/compat.md §9 note. 0.146.0 ships a server-side-gated instruction extension emitting Co-authored-by: Codex <noreply@openai.com> / Generated with Codex. under ChatGPT auth, with no local off switch; SeedOpts.Incogni stays a no-op and the previously-defensive scrub patterns become the operative incogni mechanism. The patterns do cover both strings, but this is a real change in what protects incogni — verified from source only, with the real-commit inspection owed.
§7 catalog table deliberately still describes 0.133.0 — internal/provider/codex/commands.go is untouched while the shipped binary moves to 0.146.0. The PR's argument (all 40 pinned rows byte-identical by source diff + binary strings; four new rows simply "not offered in the composer") is sound and degrades safely, but the table's provenance and the running binary now disagree by 13 releases until the re-scrape lands.

None of these are marked blocking. Merging is the human's call.

[autoland] verdict: pass **Verdict: PASS with CONCERNS** — validated, awaiting human confirm. Not auto-merged: the concerns below want a maintainer's eye before this publishes to main. **Verification signal relied on:** `labctl pr checks 252` aggregate **`success`** — `ci / native` (14m23s; the repo's `go test ./...` + `golangci-lint` gate) and `agent-tools / smoke` (13m58s; path-gated on `containers/**`, triggered by the `versions.env` edit, so it actually fetched the new digest and ran the ADR-0051 injection smoke test against the real 0.146.0 artifact). Nothing re-run locally. **Conventions:** title is Conventional Commits (`chore(agent-tools): …`); body carries `Closes #249`; head `afk/249` is a direct descendant of `origin/main` (no conflict, no resolution commit). Diff touches exactly the files the issue's scope table names — `versions.env`, `compat.md`, `compat_test.go`, `doc.go`, two new fixtures, `docs/ops.md` — plus nothing else. Version + sha256 + compat record land in one commit, as `versions.env` / `docs/ops.md` and the issue both require. **Concerns (non-blocking, for the human):** 1. **§1 spawn posture is source-verified, not live-verified** — `internal/compat/codex/compat.md` (0.146.0 note, §1). Issue #249 named the 0.145.0 "consistent full-access confirmation" (#33464) the *highest-risk item in this bump* and said "verify first; if it reproduces, this bump is blocked." The evidence here is an upstream source diff (single sender of `OpenFullAccessConfirmation` is the interactive permissions-menu action builder; `run_main` maps `--sandbox`/`--ask-for-approval` straight into config; trust-screen predicate byte-identical) plus a live `codex exec` turn that did start without a prompt — but that turn ran `--sandbox read-only`, not `--sandbox danger-full-access`. The exact unattended spawn posture is therefore reasoned, not observed. If the reasoning is wrong, every unattended codex spawn hangs at start. The PR records this honestly as an owed dev-host leg. 2. **Issue #249's "Done means" checkboxes for the live-TUI legs are unmet by design** — the §6 by-hand hazard sweep (incl. the newly-widened bare-trailing-`@` trigger), the §7 popup re-scrape + row-by-row ChatSafe curation of the four new rows (`import`/`archive`/`delete`/`usage`), the §3/§4 live seeding legs, and the §9 real-commit `git log` inspection. The probing container had no codex login and no tmux. These are deferred to a recorded dev-host merge gate, which follows the merged 2.1.220 Claude-Code precedent (commit 52a9176 / PR #246 deferred its live recipe suite the same way) — but that is a maintainer's call to ratify, not a lander's. 3. **§9 attribution changed posture and `ScrubPatterns` are now load-bearing** — `internal/compat/codex/compat.md` §9 note. 0.146.0 ships a server-side-gated instruction extension emitting `Co-authored-by: Codex <noreply@openai.com>` / `Generated with Codex.` under ChatGPT auth, with no local off switch; `SeedOpts.Incogni` stays a no-op and the previously-defensive scrub patterns become the operative incogni mechanism. The patterns do cover both strings, but this is a real change in what protects incogni — verified from source only, with the real-commit inspection owed. 4. **§7 catalog table deliberately still describes 0.133.0** — `internal/provider/codex/commands.go` is untouched while the shipped binary moves to 0.146.0. The PR's argument (all 40 pinned rows byte-identical by source diff + binary strings; four new rows simply "not offered in the composer") is sound and degrades safely, but the table's provenance and the running binary now disagree by 13 releases until the re-scrape lands. None of these are marked blocking. Merging is the human's call.