codex 0.141.0 + MIO with event ports patch

Author: psumbera

README.md

@@ -61,7 +61,7 @@ build/install/codex/bin/codex --version
 - The wrapper uses the official Solaris Rust standalone installer target
   `x86_64-pc-solaris`.
 - The pinned Codex source is the upstream `openai/codex` release tag
-  `rust-v0.140.0`, built from its `codex-rs/` workspace.
+  `rust-v0.141.0`, built from its `codex-rs/` workspace.
 - Set `SOLARIS_CODEX_PROXY_SETUP=/path/to/proxy.sh` if your host needs an
   environment hook before downloads.
 - The codex build clears inherited Solaris `LD_*` hardening variables because
@@ -78,11 +78,6 @@ patch series under `patches/codex/` before vendoring:
 - `0002-tui-disable-unsupported-clipboard-backends-on-solaris.patch` disables
   native clipboard image and text paths that have no maintained Solaris backend
   and leaves the SSH and OSC 52 text-copy path available.
-- `0003-tui-work-around-solaris-terminal-input-and-layout.patch` keeps the TUI
-  off terminal capability probes that stalled some Solaris PTYs, replaces the
-  unreliable default `crossterm::event::EventStream` path with a Solaris input
-  reader, prefers an ASCII-safe presentation on older terminals, and redraws the
-  onboarding flow so the actionable step stays visible on smaller PTYs.
 - `0004-config-host-name-use-solaris-ai-canonname-fallback.patch` supplies the
   Solaris `AI_CANONNAME` value that the Rust `libc` crate does not expose.
 - `0005-state-use-rollback-journal-on-solaris.patch` keeps Codex state
@@ -96,6 +91,14 @@ patch series under `patches/codex/` before vendoring:
 - `0008-http-client-honor-no-proxy-before-system-proxy.patch` makes
   exec-server HTTP requests honor `NO_PROXY`/`no_proxy` hosts before reqwest's
   system proxy lookup.
+- `0010-exec-server-drain-fs-helper-output-concurrently.patch` keeps large
+  filesystem-helper responses from blocking on a full stdout pipe.
+
+Before vendoring, `patch_tui_solaris_terminal_input()` keeps the TUI off
+terminal capability probes that stalled some Solaris PTYs, replaces the
+unreliable default `crossterm::event::EventStream` path with a Solaris input
+reader, prefers an ASCII-safe presentation on older terminals, and redraws the
+onboarding flow so the actionable step stays visible on smaller PTYs.
 
 After `cargo vendor`, `build-codex.sh` still applies the remaining Solaris
 vendored-crate rewrites in place:
@@ -104,9 +107,13 @@ vendored-crate rewrites in place:
 - `patch_vendored_tree_sitter_endian()`
 - `patch_vendored_fslock()`
 - `patch_vendored_onig_sys_alloca()`
+- `patch_vendored_mio_event_ports()`
 
 Those helpers remain scripted because they also update vendored crate
 `.cargo-checksum.json`, which makes static patch files awkward to maintain.
+The mio event-ports rewrite applies the upstream proposal from
+`https://github.com/tokio-rs/mio/pull/1962`, refreshed against the `mio 1.2.0`
+crate version locked by Codex.
 
 ## Maintainer Notes
 

build-codex.sh

@@ -344,6 +344,60 @@ checksum_json.write_text(json.dumps(data, separators=(",", ":")))
 PY2
 }
 
+patch_vendored_mio_event_ports() {
+  local mio_root=${CODEX_VENDOR_DIR}/mio
+  local checksum_json=${mio_root}/.cargo-checksum.json
+  local event_ports_rs=${mio_root}/src/sys/unix/selector/event_ports.rs
+  local patch
+
+  [[ -d "${mio_root}" ]] || die "missing vendored mio source: ${mio_root}"
+  [[ -f "${checksum_json}" ]] || die "missing vendored mio checksum: ${checksum_json}"
+
+  if [[ ! -f "${event_ports_rs}" ]]; then
+    for patch in "${TOP}/patches/mio"/*.patch; do
+      [[ -e "${patch}" ]] || die "missing mio Solaris event ports patch"
+      if (
+        cd "${mio_root}"
+        "${PATCH_TOOL}" --dry-run -p1 < "${patch}" >/dev/null 2>&1
+      ); then
+        log "Applying vendored mio $(basename "${patch}")"
+        (
+          cd "${mio_root}"
+          "${PATCH_TOOL}" -p1 < "${patch}"
+        )
+      else
+        die "failed to apply vendored mio patch: ${patch}"
+      fi
+    done
+  fi
+
+  [[ -f "${event_ports_rs}" ]] || die "vendored mio Solaris event ports source was not created"
+
+  python3 - "${mio_root}" "${checksum_json}" <<'PY2'
+from pathlib import Path
+import hashlib
+import json
+import sys
+
+root = Path(sys.argv[1])
+checksum_json = Path(sys.argv[2])
+paths = [
+    "src/poll.rs",
+    "src/sys/unix/mod.rs",
+    "src/sys/unix/selector/event_ports.rs",
+]
+
+data = json.loads(checksum_json.read_text())
+files = data.setdefault("files", {})
+for rel in paths:
+    path = root / rel
+    if not path.is_file():
+        raise SystemExit(f"missing vendored mio file: {path}")
+    files[rel] = hashlib.sha256(path.read_bytes()).hexdigest()
+checksum_json.write_text(json.dumps(data, separators=(",", ":")))
+PY2
+}
+
 patch_tui_solaris_terminal_input() {
   local tui_rs=${CODEX_SRC_DIR}/tui/src/tui.rs
   local event_stream_rs=${CODEX_SRC_DIR}/tui/src/tui/event_stream.rs
@@ -935,7 +989,7 @@ v8_install_matches_pin || bash "${TOP}/build-v8.sh"
 ensure_codex_source
 apply_patch_series "${CODEX_REPO_DIR}" "${TOP}/patches/codex"
 patch_tui_solaris_terminal_input
-vendor_rust_sources "${CODEX_SRC_DIR}" "${CODEX_VENDOR_DIR}"
+vendor_rust_sources "${CODEX_SRC_DIR}" "${CODEX_VENDOR_DIR}" "" unlocked
 
 # Apply the remaining Solaris vendored-crate rewrites after cargo vendor.
 # These stay scripted because each change must also refresh the vendored
@@ -944,6 +998,7 @@ patch_vendored_nix_termios
 patch_vendored_tree_sitter_endian
 patch_vendored_fslock
 patch_vendored_onig_sys_alloca
+patch_vendored_mio_event_ports
 
 export GN="${GN_INSTALL_DIR}/bin/gn"
 export RUSTY_V8_ARCHIVE="${V8_INSTALL_DIR}/lib/librusty_v8.a"

common.sh

@@ -275,6 +275,7 @@ vendor_rust_sources() {
   local src_dir=$1
   local vendor_dir=$2
   local extra_file=${3:-}
+  local lock_mode=${4:-locked}
   local cargo_dir=${src_dir}/.cargo
   local config=${cargo_dir}/config.toml
   local raw=${vendor_dir}.config.raw
@@ -299,7 +300,9 @@ vendor_rust_sources() {
   log "Vendoring Rust dependencies for $(basename "${src_dir}")"
   (
     cd "${src_dir}"
-    if ! "${CARGO}" vendor --locked "${vendor_dir}" > "${raw}"; then
+    if [[ "${lock_mode}" == "unlocked" ]]; then
+      "${CARGO}" vendor "${vendor_dir}" > "${raw}"
+    elif ! "${CARGO}" vendor --locked --offline "${vendor_dir}" > "${raw}"; then
       log "cargo vendor --locked requested a lockfile refresh; retrying without --locked"
       rm -rf "${vendor_dir}" "${raw}"
       "${CARGO}" vendor "${vendor_dir}" > "${raw}"

patches/codex/0006-arg0-tolerate-solaris-stale-temp-cleanup.patch

@@ -10,10 +10,10 @@ What it does:
   process-scoped there and do not model a separate live Codex process
 
 diff --git a/codex-rs/arg0/src/lib.rs b/codex-rs/arg0/src/lib.rs
-index ba254d5..0eeafe8 100644
+index 2102eaf..1b0e530 100644
 --- a/codex-rs/arg0/src/lib.rs
 +++ b/codex-rs/arg0/src/lib.rs
-@@ -478,17 +478,41 @@ fn janitor_cleanup(temp_root: &Path) -> std::io::Result<()> {
+@@ -484,17 +484,41 @@ fn janitor_cleanup(temp_root: &Path) -> std::io::Result<()> {
              continue;
          };
 
@@ -61,7 +61,7 @@ index ba254d5..0eeafe8 100644
  fn try_lock_dir(dir: &Path) -> std::io::Result<Option<File>> {
      let lock_path = dir.join(LOCK_FILENAME);
      let lock_file = match File::options().read(true).write(true).open(&lock_path) {
-@@ -710,6 +734,10 @@ mod tests {
+@@ -716,6 +740,10 @@ mod tests {
      }
 
      #[test]

patches/codex/0010-exec-server-drain-fs-helper-output-concurrently.patch

@@ -10,7 +10,7 @@ before it can exit. Add a regression test that returns a helper-shaped response
 larger than a typical pipe buffer.
 
 diff --git a/codex-rs/exec-server/src/fs_sandbox.rs b/codex-rs/exec-server/src/fs_sandbox.rs
-index a99a949..91c7ae4 100644
+index cd2cc38..c348b8d 100644
 --- a/codex-rs/exec-server/src/fs_sandbox.rs
 +++ b/codex-rs/exec-server/src/fs_sandbox.rs
 @@ -16,6 +16,7 @@ use codex_sandboxing::SandboxablePreference;
@@ -21,7 +21,7 @@ index a99a949..91c7ae4 100644
  use tokio::io::AsyncWriteExt;
  use tokio::process::Command;
 
-@@ -274,6 +275,25 @@ async fn run_command(
+@@ -278,6 +279,25 @@ async fn run_command(
      request_json: Vec<u8>,
  ) -> Result<FsHelperPayload, JSONRPCErrorError> {
      let mut child = spawn_command(command)?;
@@ -47,7 +47,7 @@ index a99a949..91c7ae4 100644
      let mut stdin = child
          .stdin
          .take()
-@@ -282,15 +302,17 @@ async fn run_command(
+@@ -286,15 +306,17 @@ async fn run_command(
      stdin.shutdown().await.map_err(io_error)?;
      drop(stdin);
 
@@ -70,7 +70,7 @@ index a99a949..91c7ae4 100644
      match response {
          FsHelperResponse::Ok(payload) => Ok(payload),
          FsHelperResponse::Error(error) => Err(error),
-@@ -331,6 +353,10 @@ fn io_error(err: std::io::Error) -> JSONRPCErrorError {
+@@ -335,6 +357,10 @@ fn io_error(err: std::io::Error) -> JSONRPCErrorError {
      internal_error(err.to_string())
  }
 
@@ -81,7 +81,7 @@ index a99a949..91c7ae4 100644
  fn json_error(err: serde_json::Error) -> JSONRPCErrorError {
      internal_error(format!(
          "failed to encode or decode fs sandbox helper message: {err}"
-@@ -642,6 +668,58 @@ mod tests {
+@@ -646,6 +672,58 @@ mod tests {
          assert!(policy.can_read_path_with_cwd(alias_parent.as_path(), cwd.as_path()));
      }