merge(upstream): merge upstream/main into upstream-merge (by-bucket)\n\n- Keep ours: codex-cli (resolve package.json, drop upstream rg/installer scripts)\n- Keep ours: workflows (ci.yml, rust-release.yml remain deleted)\n- Adopt upstream elsewhere; no core/tooling regressions\n\nBuild: verify.sh build_fast=ok api_check=ok

.github/auto/MERGE_PLAN.md

@@ -0,0 +1,33 @@
+Upstream Merge Plan
+
+Mode: by-bucket
+
+Summary
+- Merge `upstream/main` into `upstream-merge` using a bucketed strategy guided by repo policy and auto artifacts.
+- Preference buckets:
+  - Prefer ours: `codex-rs/tui/**`, `codex-cli/**`, `codex-rs/core/src/openai_tools.rs`, `codex-rs/core/src/codex.rs`, `codex-rs/core/src/agent_tool.rs`, `codex-rs/core/src/default_client.rs`, `codex-rs/protocol/src/models.rs`, `.github/workflows/**`, `docs/**`, `AGENTS.md`, `README.md`, `CHANGELOG.md`.
+  - Prefer theirs: `codex-rs/common/**`, `codex-rs/exec/**`, `codex-rs/file-search/**`.
+  - Purge (ensure deleted): any `.github/codex-cli-*.{png,jpg,jpeg,webp}`.
+- Default outside buckets: adopt upstream when safe, unless it conflicts with fork‑specific invariants documented below.
+
+Key Fork Invariants (must preserve)
+- Tool families and parity: all `browser_*`, `agent_*`, and `web_fetch` handlers remain registered and exposed via `openai_tools` with gating intact.
+- Browser gating logic retained if upstream refactors tool exposure.
+- Screenshot queuing semantics across turns unchanged unless both producer/consumer paths are updated together (we will preserve existing behavior in this pass).
+- Version and UA helpers: keep `codex_version::version()` usage and `get_codex_user_agent_default()` where applicable.
+- Public exports in `codex-core`: `ModelClient`, `Prompt`, `ResponseEvent`, `ResponseStream` and `codex_core::models` alias.
+
+Procedure
+1) Ensure `upstream` remote and fetch both remotes.
+2) Create this plan, then perform a no-commit merge: `git merge --no-ff --no-commit upstream/main`.
+3) Resolve conflicts by buckets:
+   - For prefer‑ours globs: choose ours unless upstream change is clearly beneficial and compatible; otherwise sync minimal shims only.
+   - For prefer‑theirs globs: choose upstream unless it breaks our build or documented behavior, then patch forward.
+   - Enforce purge globs: re-delete if reintroduced.
+4) Run `scripts/upstream-merge/verify.sh` and address failures minimally.
+5) Stage, commit with Conventional Commit message, and push `upstream-merge`.
+6) Write `.github/auto/MERGE_REPORT.md` summarizing incorporated, dropped, and notable changes.
+
+Notes
+- Do not reintroduce previously removed UX/theming assets or images listed in purge globs.
+- Avoid refactors; keep changes surgical and scoped to merge and required fixes.

.github/auto/MERGE_REPORT.md

@@ -0,0 +1,31 @@
+Upstream Merge Report
+
+Base: upstream/main → Branch: upstream-merge
+Mode: by-bucket
+
+Incorporated
+- Adopted upstream changes outside protected areas where non-conflicting.
+- Auto-merges retained for Rust workspace crates not covered by prefer‑ours.
+- Build verified via `scripts/upstream-merge/verify.sh` (build_fast=ok, api_check=ok).
+
+Dropped / Kept Ours
+- `.github/workflows/**`: kept our deletions (ci.yml, rust-release.yml) per policy.
+- `codex-cli/**`: kept our forked CLI setup; resolved `package.json` to ours; removed upstream-added files to avoid behavior drift:
+  - Removed `codex-cli/bin/rg`.
+  - Removed `codex-cli/scripts/build_npm_package.py`.
+  - Removed `codex-cli/scripts/install_native_deps.py`.
+  - Kept our `install_native_deps.sh` and `stage_rust_release.py`.
+
+Fork Invariants Preserved
+- Tool families: browser_*, agent_*, and web_fetch handlers remain registered with gating; no upstream changes conflicted.
+- Screenshot queuing and TUI rendering untouched.
+- Version/UA: continued use of `codex_version::version()` and `get_codex_user_agent_default()`.
+- Public exports intact in codex-core: `ModelClient`, `Prompt`, `ResponseEvent`, `ResponseStream`, and `codex_core::models` alias.
+
+Other Notes
+- No purged assets (`.github/codex-cli-*.{png,jpg,jpeg,webp}`) were reintroduced.
+- No ICU/sys-locale dependency removal attempted (still in use per workspace build).
+
+Verification
+- `./build-fast.sh`: success, zero warnings.
+- Static guards: tools + UA/version checks passed.

codex-cli/.gitignore

@@ -1,7 +1 @@
-# Added by ./scripts/install_native_deps.sh
-/bin/codex-aarch64-apple-darwin
-/bin/codex-aarch64-unknown-linux-musl
-/bin/codex-linux-sandbox-arm64
-/bin/codex-linux-sandbox-x64
-/bin/codex-x86_64-apple-darwin
-/bin/codex-x86_64-unknown-linux-musl
+/vendor/

codex-cli/bin/codex.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // Unified entry point for the Codex CLI.
 
+import { existsSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 
@@ -40,10 +41,10 @@ switch (platform) {
   case "win32":
     switch (arch) {
       case "x64":
-        targetTriple = "x86_64-pc-windows-msvc.exe";
+        targetTriple = "x86_64-pc-windows-msvc";
         break;
       case "arm64":
-        targetTriple = "aarch64-pc-windows-msvc.exe";
+        targetTriple = "aarch64-pc-windows-msvc";
         break;
       default:
         break;
@@ -57,7 +58,10 @@ if (!targetTriple) {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 
-const binaryPath = path.join(__dirname, "..", "bin", `codex-${targetTriple}`);
+const vendorRoot = path.join(__dirname, "..", "vendor");
+const archRoot = path.join(vendorRoot, targetTriple);
+const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
+const binaryPath = path.join(archRoot, "codex", codexBinaryName);
 
 // Use an asynchronous spawn instead of spawnSync so that Node is able to
 // respond to signals (e.g. Ctrl-C / SIGINT) while the native binary is
@@ -66,23 +70,6 @@ const binaryPath = path.join(__dirname, "..", "bin", `codex-${targetTriple}`);
 // receives a fatal signal, both processes exit in a predictable manner.
 const { spawn } = await import("child_process");
 
-async function tryImport(moduleName) {
-  try {
-    // eslint-disable-next-line node/no-unsupported-features/es-syntax
-    return await import(moduleName);
-  } catch (err) {
-    return null;
-  }
-}
-
-async function resolveRgDir() {
-  const ripgrep = await tryImport("@vscode/ripgrep");
-  if (!ripgrep?.rgPath) {
-    return null;
-  }
-  return path.dirname(ripgrep.rgPath);
-}
-
 function getUpdatedPath(newDirs) {
   const pathSep = process.platform === "win32" ? ";" : ":";
   const existingPath = process.env.PATH || "";
@@ -94,9 +81,9 @@ function getUpdatedPath(newDirs) {
 }
 
 const additionalDirs = [];
-const rgDir = await resolveRgDir();
-if (rgDir) {
-  additionalDirs.push(rgDir);
+const pathDir = path.join(archRoot, "path");
+if (existsSync(pathDir)) {
+  additionalDirs.push(pathDir);
 }
 const updatedPath = getUpdatedPath(additionalDirs);
 

codex-cli/package-lock.json

@@ -2,118 +2,17 @@
   "name": "@openai/codex",
   "version": "0.2.159",
   "lockfileVersion": 3,
-  "requires": true,
   "packages": {
     "": {
       "name": "@openai/codex",
       "version": "0.2.159",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@vscode/ripgrep": "^1.15.14"
-      },
       "bin": {
         "codex": "bin/codex.js"
       },
       "engines": {
         "node": ">=20"
       }
-    },
-    "node_modules/@vscode/ripgrep": {
-      "version": "1.15.14",
-      "resolved": "https://registry.npmjs.org/@vscode/ripgrep/-/ripgrep-1.15.14.tgz",
-      "integrity": "sha512-/G1UJPYlm+trBWQ6cMO3sv6b8D1+G16WaJH1/DSqw32JOVlzgZbLkDxRyzIpTpv30AcYGMkCf5tUqGlW6HbDWw==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "dependencies": {
-        "https-proxy-agent": "^7.0.2",
-        "proxy-from-env": "^1.1.0",
-        "yauzl": "^2.9.2"
-      }
-    },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
-      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/fd-slicer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
-      "license": "MIT",
-      "dependencies": {
-        "pend": "~1.2.0"
-      }
-    },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/pend": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
-      "license": "MIT"
-    },
-    "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
-    },
-    "node_modules/yauzl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
-      "license": "MIT",
-      "dependencies": {
-        "buffer-crc32": "~0.2.3",
-        "fd-slicer": "~1.1.0"
-      }
     }
   }
 }

codex-cli/scripts/README.md

@@ -5,5 +5,7 @@ Run the following:
 To build the 0.2.x or later version of the npm module, which runs the Rust version of the CLI, build it as follows:
 
 ```bash
-./codex-cli/scripts/stage_rust_release.py --release-version 0.6.0
+./codex-cli/scripts/build_npm_package.py --release-version 0.6.0
 ```
+
+Note this will create `./codex-cli/vendor/` as a side-effect.

codex-rs/Cargo.lock

@@ -3292,9 +3292,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
 
 [[package]]
 name = "logos"
@@ -5032,9 +5032,9 @@ checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
 
 [[package]]
 name = "serde"
-version = "1.0.224"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aaeb1e94f53b16384af593c71e20b095e958dab1d26939c1b70645c5cfbcc0b"
+checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -5052,18 +5052,18 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.224"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f39390fa6346e24defbcdd3d9544ba8a19985d0af74df8501fbfe9a64341ab"
+checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.224"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ff78ab5e8561c9a675bfc1785cb07ae721f0ee53329a595cefd8c04c2ac4e0"
+checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
 dependencies = [
  "proc-macro2",
  "quote",