chore(ci/upstream-merge): add branding guard + auto-fix step for TUI/CLI\n\nAdd non-fixing verify step to flag newly introduced user-visible 'Codex' strings\nunder TUI/CLI paths vs origin/<branch>. Add CI job to auto-fix branding in the\nmerge worktree using a safe single-line quoted-string replacement script.

.github/workflows/upstream-merge.yml

@@ -782,6 +782,34 @@ jobs:
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
         run: |
           set -euo pipefail
+          # Auto-fix branding introduced by upstream in user-visible strings under TUI/CLI
+          # We only touch lines inside quotes/backticks and only in files changed by this merge.
+          changed_files=$(git diff --name-only "origin/${DEFAULT_BRANCH}..origin/upstream-merge" -- 'codex-rs/tui/**' 'codex-cli/**' | tr '\n' ' ' || true)
+          if [ -n "${changed_files:-}" ]; then
+            wt=.wt-branding-fix
+            rm -rf "$wt" && git worktree add -f "$wt" origin/upstream-merge >/dev/null
+            pushd "$wt" >/dev/null
+            touched=()
+            for f in $changed_files; do
+              [ -f "$f" ] || continue
+              # Skip obvious non-source or vendored artifacts
+              case "$f" in
+                *.png|*.jpg|*.jpeg|*.gif|*.svg|*.pdf) continue;;
+              esac
+              # Replace 'Codex' with 'Code' only inside quoted/backtick strings (single-line)
+              if rg -n "Codex" -- "$f" >/dev/null 2>&1; then
+                python3 scripts/upstream-merge/branding_fix.py "$f" || true
+                touched+=("$f")
+              fi
+            done
+            if ! git diff --quiet -- ${touched[@]:-}; then
+              git -c user.email="github-actions[bot]@users.noreply.github.com" -c user.name="github-actions[bot]" \
+                commit -a -m "chore(merge): auto-rebrand user-visible strings ('Codex'→'Code') in TUI/CLI files"
+              git push origin HEAD:upstream-merge
+            fi
+            popd >/dev/null
+            git worktree remove -f "$wt" >/dev/null
+          fi
           # docs/** changes are allowed; we may still prefer ours but do not hard-fail here.
           if git diff --name-only "origin/${DEFAULT_BRANCH}..origin/upstream-merge" -- 'docs/**' | grep -q .; then
             echo "::notice::docs/** changed on upstream-merge; ensuring agent reviews and preserves local branding where needed." >&2

scripts/upstream-merge/branding_fix.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""
+In-place branding fixer for upstream merges.
+
+Replaces the brand name 'Codex' -> 'Code' only within single-line quoted
+string literals (", ', `). Non-quoted occurrences are left untouched.
+
+Usage:
+  python3 scripts/upstream-merge/branding_fix.py <file> [<file> ...]
+"""
+from __future__ import annotations
+import io
+import os
+import re
+import sys
+
+# Matches a single-line quoted string: double, single, or backtick, with escapes.
+Q = re.compile(r'("(?:[^"\\]|\\.)*"|\'(?:[^\'\\]|\\.)*\'|`(?:[^`\\]|\\.)*`)')
+
+def fix_text(text: str) -> str:
+    def repl(m: re.Match[str]) -> str:
+        s = m.group(0)
+        return s.replace("Codex", "Code")
+    return Q.sub(repl, text)
+
+def process_file(path: str) -> bool:
+    try:
+        with io.open(path, 'r', encoding='utf-8') as f:
+            original = f.read()
+    except (OSError, UnicodeDecodeError):
+        return False
+    updated = fix_text(original)
+    if updated != original:
+        with io.open(path, 'w', encoding='utf-8', newline='') as f:
+            f.write(updated)
+        return True
+    return False
+
+def main(argv: list[str]) -> int:
+    if len(argv) < 2:
+        print("usage: branding_fix.py <file> [<file> ...]", file=sys.stderr)
+        return 2
+    changed = False
+    for p in argv[1:]:
+        if os.path.isfile(p):
+            if process_file(p):
+                changed = True
+    return 0 if changed else 0
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
+

scripts/upstream-merge/verify.sh

@@ -14,6 +14,7 @@ mkdir -p .github/auto
 status_build="ok"
 status_api="ok"
 status_guards="ok"
+status_branding="ok"
 
 {
   echo "[verify] START $(date -u +%FT%TZ)"
@@ -86,8 +87,33 @@ fi
 # Summarize guards
 echo "guards=${status_guards}" >> "$guards_log"
 
+# STEP 4: Branding guard parity with CI (non-fixing check)
+{
+  echo "[verify] STEP 4: branding guard (TUI/CLI user-visible)"
+}
+DEFAULT_BRANCH_LOCAL=${DEFAULT_BRANCH:-main}
+# Try to fetch origin to ensure refs exist; ignore failure for local runs
+git fetch origin "$DEFAULT_BRANCH_LOCAL" >/dev/null 2>&1 || true
+range_ref="origin/${DEFAULT_BRANCH_LOCAL}..HEAD"
+changed_files=$(git diff --name-only $range_ref -- 'codex-rs/tui/**' 'codex-cli/**' | tr '\n' ' ' || true)
+if [ -n "${changed_files:-}" ]; then
+  if git diff -U0 --no-color $range_ref -- $changed_files \
+    | grep -E '^\+' \
+    | grep -E '"[^"]*Codex[^"]*"|'\''[^'\''']*Codex[^'\''']*'\''|`[^`]*Codex[^`]*`' \
+    | grep -Evi '(codex-rs|codex-[a-z0-9_-]+|https?://|Cargo|crate|package|workspace)' >/dev/null 2>&1; then
+    echo "[branding] new user-visible 'Codex' strings detected under TUI/CLI relative to $range_ref" | tee -a "$guards_log"
+    git diff -U0 --no-color $range_ref -- $changed_files \
+      | grep -E '^\+' \
+      | grep -E '"[^"]*Codex[^"]*"|'\''[^'\''']*Codex[^'\''']*'\''|`[^`]*Codex[^`]*`' \
+      | sed 's/^/> /' | tee -a "$guards_log" || true
+    status_branding="fail"
+  fi
+else
+  echo "[branding] no relevant file changes vs $range_ref; skipping" | tee -a "$guards_log"
+fi
+
 rc=0
-if [[ "$status_build" != ok || "$status_api" != ok || "$status_guards" != ok ]]; then
+if [[ "$status_build" != ok || "$status_api" != ok || "$status_guards" != ok || "$status_branding" != ok ]]; then
   rc=1
 fi
 
@@ -95,7 +121,8 @@ cat > .github/auto/VERIFY.json <<JSON
 {
   "build_fast": "$status_build",
   "api_check": "$status_api",
-  "guards": "$status_guards"
+  "guards": "$status_guards",
+  "branding": "$status_branding"
 }
 JSON