Update Codex 0.148 Solaris build and runtime fixes

Build a native protoc for the code-mode protocol, honor PROTOC in its build script, and install the 0.148 sources.

Refresh the exec-server patch, keep Mio event-port fallback polling active, and make the vendored Mio patch series repeatable.

Author: psumbera

README.md

@@ -51,7 +51,7 @@ Installed artifacts end up in:
 - `build/install/codex/bin/codex`
 - `build/install/codex/bin/codex-code-mode-host`
 
-Codex 0.147 enables the separate code-mode host by default. Keep
+Codex 0.148 enables the separate code-mode host by default. Keep
 `codex-code-mode-host` beside `codex` when copying or packaging this build.
 
 Quick verification:
@@ -69,7 +69,7 @@ build/install/codex/bin/codex-code-mode-host --help
 - The wrapper uses the official Solaris Rust standalone installer target
   `x86_64-pc-solaris`.
 - The pinned Codex source is the upstream `openai/codex` release tag
-  `rust-v0.147.0`, built from its `codex-rs/` workspace.
+  `rust-v0.148.0`, built from its `codex-rs/` workspace.
 - Set `SOLARIS_CODEX_PROXY_SETUP=/path/to/proxy.sh` if your host needs an
   environment hook before downloads.
 - The codex build clears inherited Solaris `LD_*` hardening variables because

build-codex.sh

@@ -350,48 +350,75 @@ patch_vendored_mio_event_ports() {
   local event_ports_rs=${mio_root}/src/sys/unix/selector/event_ports.rs
   local base_patch=${TOP}/patches/mio/0001-selector-use-solaris-event-ports.patch
   local cache_stamp=${CODEX_SRC_DIR}/target/.solaris-mio-event-ports.sha256
+  local patch_stamp=${mio_root}/.solaris-mio-patch-series.sha256
   local event_ports_hash
   local cached_hash=
+  local patch_series_hash
+  local cached_patch_series_hash=
   local patch
 
   [[ -d "${mio_root}" ]] || die "missing vendored mio source: ${mio_root}"
   [[ -f "${checksum_json}" ]] || die "missing vendored mio checksum: ${checksum_json}"
 
-  if [[ ! -f "${event_ports_rs}" ]]; then
-    [[ -f "${base_patch}" ]] || die "missing mio Solaris event ports patch: ${base_patch}"
-    log "Applying vendored mio $(basename "${base_patch}")"
-    (
-      cd "${mio_root}"
-      "${PATCH_TOOL}" --batch --forward --fuzz=0 -p1 < "${base_patch}"
-    ) || die "failed to apply vendored mio patch: ${base_patch}"
-  fi
+  patch_series_hash=$(python3 - "${TOP}/patches/mio" <<'PY2'
+from pathlib import Path
+import hashlib
+import sys
 
-  [[ -f "${event_ports_rs}" ]] || die "vendored mio Solaris event ports source was not created"
+digest = hashlib.sha256()
+for path in sorted(Path(sys.argv[1]).glob("*.patch")):
+    digest.update(path.name.encode())
+    digest.update(b"\0")
+    digest.update(path.read_bytes())
+print(digest.hexdigest())
+PY2
+)
+  if [[ -f "${patch_stamp}" ]]; then
+    cached_patch_series_hash=$(<"${patch_stamp}")
+  fi
 
-  # Newer Mio revisions may already contain the base event-ports
-  # implementation. Apply Solaris correctness fixes independently so they are
-  # also used when the base patch is unnecessary.
-  for patch in "${TOP}/patches/mio"/*.patch; do
-    [[ -e "${patch}" ]] || continue
-    [[ "${patch}" == "${base_patch}" ]] && continue
-    if (
-      cd "${mio_root}"
-      "${PATCH_TOOL}" --dry-run --batch --forward --fuzz=0 -p1 < "${patch}" >/dev/null 2>&1
-    ); then
-      log "Applying vendored mio $(basename "${patch}")"
+  if [[ "${cached_patch_series_hash}" == "${patch_series_hash}" ]]; then
+    log "Already applied vendored mio Solaris patch series"
+  else
+    if [[ ! -f "${event_ports_rs}" ]]; then
+      [[ -f "${base_patch}" ]] || die "missing mio Solaris event ports patch: ${base_patch}"
+      log "Applying vendored mio $(basename "${base_patch}")"
       (
         cd "${mio_root}"
-        "${PATCH_TOOL}" --batch --forward --fuzz=0 -p1 < "${patch}"
-      )
-    elif (
-      cd "${mio_root}"
-      "${PATCH_TOOL}" --dry-run --batch --forward --fuzz=0 -R -p1 < "${patch}" >/dev/null 2>&1
-    ); then
-      log "Already applied vendored mio $(basename "${patch}")"
-    else
-      die "failed to apply vendored mio patch: ${patch}"
+        "${PATCH_TOOL}" --batch --forward --fuzz=0 -p1 < "${base_patch}"
+      ) || die "failed to apply vendored mio patch: ${base_patch}"
     fi
-  done
+
+    [[ -f "${event_ports_rs}" ]] || die "vendored mio Solaris event ports source was not created"
+
+    # Newer Mio revisions may already contain the base event-ports
+    # implementation. Apply Solaris correctness fixes independently so they are
+    # also used when the base patch is unnecessary.
+    for patch in "${TOP}/patches/mio"/*.patch; do
+      [[ -e "${patch}" ]] || continue
+      [[ "${patch}" == "${base_patch}" ]] && continue
+      if (
+        cd "${mio_root}"
+        "${PATCH_TOOL}" --dry-run --batch --forward --fuzz=0 -p1 < "${patch}" >/dev/null 2>&1
+      ); then
+        log "Applying vendored mio $(basename "${patch}")"
+        (
+          cd "${mio_root}"
+          "${PATCH_TOOL}" --batch --forward --fuzz=0 -p1 < "${patch}"
+        )
+      elif (
+        cd "${mio_root}"
+        "${PATCH_TOOL}" --dry-run --batch --forward --fuzz=0 -R -p1 < "${patch}" >/dev/null 2>&1
+      ); then
+        log "Already applied vendored mio $(basename "${patch}")"
+      else
+        die "failed to apply vendored mio patch: ${patch}"
+      fi
+    done
+    printf '%s\n' "${patch_series_hash}" > "${patch_stamp}"
+  fi
+
+  [[ -f "${event_ports_rs}" ]] || die "vendored mio Solaris event ports source was not created"
 
   python3 - "${mio_root}" "${checksum_json}" <<'PY2'
 from pathlib import Path
@@ -1066,6 +1093,7 @@ refresh_cached_rusty_v8_archive() {
 
 
 prepare_rust
+prepare_protoc
 build_env_common
 
 v8_install_matches_pin || bash "${TOP}/build-v8.sh"

common.sh

@@ -26,6 +26,9 @@ CODEX_SRC_DIR=${CODEX_REPO_DIR}/codex-rs
 CODEX_VENDOR_DIR=${SRC_DIR}/codex-rust-v${SOLARIS_CODEX_VERSION}-vendored-sources
 BINDGEN_PREFIX=${TOOLCHAIN_DIR}/bindgen-cli-${BINDGEN_CLI_VERSION}
 BINDGEN_ROOT_DIR=${TOOLCHAIN_DIR}/rust-bindgen-root
+PROTOBUF_PREFIX=${TOOLCHAIN_DIR}/protobuf-${PROTOBUF_VERSION}
+PROTOBUF_ARCHIVE=protobuf-${PROTOBUF_VERSION}.tar.gz
+PROTOBUF_ARCHIVE_URL=https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VERSION}/${PROTOBUF_ARCHIVE}
 
 GN_INSTALL_DIR=${INSTALL_DIR}/gn
 V8_INSTALL_DIR=${INSTALL_DIR}/v8
@@ -212,6 +215,50 @@ prepare_rust() {
   )
 }
 
+prepare_protoc() {
+  ensure_dirs
+  need_cmd /usr/bin/curl
+  need_cmd gtar
+  need_cmd cmake
+  need_cmd gcc
+  need_cmd g++
+
+  if [[ -x "${PROTOBUF_PREFIX}/bin/protoc" ]]; then
+    return 0
+  fi
+
+  maybe_enable_proxy
+
+  local archive_path=${DOWNLOAD_DIR}/${PROTOBUF_ARCHIVE}
+  local source_dir=${SRC_DIR}/protobuf-${PROTOBUF_VERSION}
+  local build_dir=${BUILD_DIR}/protobuf-build-${PROTOBUF_VERSION}
+
+  if [[ ! -f "${archive_path}" ]]; then
+    log "Downloading protobuf ${PROTOBUF_VERSION} for native protoc"
+    /usr/bin/curl -L -f -o "${archive_path}" "${PROTOBUF_ARCHIVE_URL}"
+  fi
+
+  rm -rf "${source_dir}" "${build_dir}"
+  gtar xf "${archive_path}" -C "${SRC_DIR}"
+
+  log "Building native protoc ${PROTOBUF_VERSION}"
+  cmake -S "${source_dir}" -B "${build_dir}" \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_C_COMPILER="$(command -v gcc)" \
+    -DCMAKE_CXX_COMPILER="$(command -v g++)" \
+    -DCMAKE_INSTALL_PREFIX="${PROTOBUF_PREFIX}" \
+    -Dprotobuf_BUILD_TESTS=OFF \
+    -Dprotobuf_BUILD_EXAMPLES=OFF \
+    -Dprotobuf_BUILD_SHARED_LIBS=OFF \
+    -Dprotobuf_WITH_ZLIB=OFF
+  cmake --build "${build_dir}" --target protoc -j "${SOLARIS_CODEX_JOBS:-4}"
+  mkdir -p "${PROTOBUF_PREFIX}/bin"
+  cp -p "${build_dir}/protoc" "${PROTOBUF_PREFIX}/bin/protoc"
+
+  [[ -x "${PROTOBUF_PREFIX}/bin/protoc" ]] || \
+    die "native protoc build did not produce ${PROTOBUF_PREFIX}/bin/protoc"
+}
+
 ensure_gn_source() {
   fetch_git_source "${GN_GIT_URL}" "${GN_GIT_REF}" "${GN_SRC_DIR}"
 }
@@ -337,6 +384,7 @@ build_env_common() {
   export NINJA=/usr/bin/ninja
   export LIBCLANG_PATH="$(detect_libclang_path)"
   export CARGO_NET_GIT_FETCH_WITH_CLI=true
+  export PROTOC="${PROTOBUF_PREFIX}/bin/protoc"
 }
 
 verify_file() {

patches/codex/0010-exec-server-drain-fs-helper-output-concurrently.patch

@@ -10,21 +10,23 @@ before it can exit. Add a regression test that returns a helper-shaped response
 larger than a typical pipe buffer.
 
 diff --git a/codex-rs/exec-server/src/fs_sandbox.rs b/codex-rs/exec-server/src/fs_sandbox.rs
-index 812d767..1286e8f 100644
 --- a/codex-rs/exec-server/src/fs_sandbox.rs
 +++ b/codex-rs/exec-server/src/fs_sandbox.rs
-@@ -17,6 +17,7 @@ use codex_sandboxing::SandboxablePreference;
- use codex_utils_absolute_path::AbsolutePathBuf;
+@@ -19,5 +19,6 @@ use codex_utils_absolute_path::AbsolutePathBuf;
  use codex_utils_absolute_path::canonicalize_preserving_symlinks;
  use codex_utils_path_uri::PathUri;
 +use tokio::io::AsyncReadExt;
  use tokio::io::AsyncWriteExt;
  use tokio::process::Command;
 
-@@ -300,6 +301,25 @@ async fn run_command(
-     request_json: Vec<u8>,
- ) -> Result<FsHelperPayload, JSONRPCErrorError> {
-     let mut child = spawn_command(command)?;
+@@ -322,9 +323,35 @@ async fn run_command(
+ }
+ 
+ pub(crate) async fn wait_for_helper_output(
+-    child: tokio::process::Child,
++    mut child: tokio::process::Child,
+ ) -> Result<std::process::Output, JSONRPCErrorError> {
+-    let output = child.wait_with_output().await.map_err(io_error)?;
 +    let mut stdout = child
 +        .stdout
 +        .take()
@@ -34,43 +36,28 @@ index 812d767..1286e8f 100644
 +        .take()
 +        .ok_or_else(|| internal_error("failed to open fs sandbox helper stderr".to_string()))?;
 +    let stdout_task = tokio::spawn(async move {
-+        let mut stdout_buf = Vec::new();
-+        stdout.read_to_end(&mut stdout_buf).await?;
-+        Ok::<_, std::io::Error>(stdout_buf)
++        let mut bytes = Vec::new();
++        stdout.read_to_end(&mut bytes).await?;
++        Ok::<_, std::io::Error>(bytes)
 +    });
 +    let stderr_task = tokio::spawn(async move {
-+        let mut stderr_buf = Vec::new();
-+        stderr.read_to_end(&mut stderr_buf).await?;
-+        Ok::<_, std::io::Error>(stderr_buf)
++        let mut bytes = Vec::new();
++        stderr.read_to_end(&mut bytes).await?;
++        Ok::<_, std::io::Error>(bytes)
 +    });
 +
-     let mut stdin = child
-         .stdin
-         .take()
-@@ -308,15 +328,17 @@ async fn run_command(
-     stdin.shutdown().await.map_err(io_error)?;
-     drop(stdin);
- 
--    let output = child.wait_with_output().await.map_err(io_error)?;
--    if !output.status.success() {
 +    let status = child.wait().await.map_err(io_error)?;
 +    let stdout = stdout_task.await.map_err(join_error)?.map_err(io_error)?;
 +    let stderr = stderr_task.await.map_err(join_error)?.map_err(io_error)?;
-+
-+    if !status.success() {
++    let output = std::process::Output {
++        status,
++        stdout,
++        stderr,
++    };
+     if !output.status.success() {
          return Err(internal_error(format!(
              "fs sandbox helper failed with status {status}: {stderr}",
--            status = output.status,
--            stderr = String::from_utf8_lossy(&output.stderr).trim()
-+            stderr = String::from_utf8_lossy(&stderr).trim()
-         )));
-     }
--    let response: FsHelperResponse = serde_json::from_slice(&output.stdout).map_err(json_error)?;
-+    let response: FsHelperResponse = serde_json::from_slice(&stdout).map_err(json_error)?;
-     match response {
-         FsHelperResponse::Ok(payload) => Ok(payload),
-         FsHelperResponse::Error(error) => Err(error),
-@@ -359,6 +381,10 @@ fn io_error(err: std::io::Error) -> JSONRPCErrorError {
+@@ -381,6 +408,10 @@ pub(crate) fn io_error(err: std::io::Error) -> JSONRPCErrorError {
      internal_error(err.to_string())
  }
 
@@ -81,8 +68,8 @@ index 812d767..1286e8f 100644
  fn json_error(err: serde_json::Error) -> JSONRPCErrorError {
      internal_error(format!(
          "failed to encode or decode fs sandbox helper message: {err}"
-@@ -682,6 +708,58 @@ mod tests {
-         assert!(policy.can_read_path_with_cwd(alias_parent.as_path(), cwd.as_path()));
+@@ -727,6 +758,58 @@ mod tests {
+         assert!(!policy.can_read_path_with_cwd(alias_parent.as_path(), cwd.as_path()));
      }
 
 +    #[cfg(unix)]

patches/codex/0011-code-mode-protocol-honor-protoc-environment.patch

@@ -0,0 +1,20 @@
+Allow builders to provide a native protoc executable. The
+protoc-bin-vendored crate has no Solaris platform package, and its statically
+linked Linux executable cannot run on Solaris.
+
+diff --git a/codex-rs/code-mode-protocol/build.rs b/codex-rs/code-mode-protocol/build.rs
+--- a/codex-rs/code-mode-protocol/build.rs
++++ b/codex-rs/code-mode-protocol/build.rs
+@@ -5,7 +5,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
+     println!("cargo:rerun-if-changed=src/grpc");
+ 
+     let mut config = tonic_prost_build::Config::new();
+-    config.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
++    let protoc = match std::env::var_os("PROTOC") {
++        Some(path) => PathBuf::from(path),
++        None => protoc_bin_vendored::protoc_bin_path()?,
++    };
++    config.protoc_executable(protoc);
+     let proto_files = glob::glob("src/grpc/*.proto")?.collect::<Result<Vec<_>, _>>()?;
+ 
+     tonic_prost_build::configure()

patches/mio/0002-event-ports-rearm-fallback-interests.patch

@@ -255,23 +255,29 @@ index aacf254..ee1d0ff 100644
      }
 
      cfg_io_source! {
-@@ -454,8 +473,7 @@ impl SelectorState {
+@@ -454,8 +473,11 @@ impl SelectorState {
                  interests,
                  generation: 1,
                  associated: true,
 -                needs_fallback: true,
 -                fallback_writable: true,
-+                fallback_interests: None,
++                // Poll immediately after registration as a safety net for
++                // readiness that changes while the event-port association is
++                // being installed. Without this, a missed initial event can
++                // leave the descriptor outside fallback polling forever.
++                fallback_interests: Some(interests),
              },
          );
          Ok(record)
-@@ -480,8 +498,7 @@ impl SelectorState {
+@@ -480,8 +502,9 @@ impl SelectorState {
          data.interests = interests;
          data.generation = generation;
          data.associated = true;
 -        data.needs_fallback = true;
 -        data.fallback_writable = true;
-+        data.fallback_interests = None;
++        // As with initial registration, cover readiness changes racing with
++        // the new event-port association.
++        data.fallback_interests = Some(interests);
          Ok(())
      }