codex 0.143.0 + MIO patch update

Author: psumbera

README.md

@@ -61,7 +61,7 @@ build/install/codex/bin/codex --version
 - The wrapper uses the official Solaris Rust standalone installer target
   `x86_64-pc-solaris`.
 - The pinned Codex source is the upstream `openai/codex` release tag
-  `rust-v0.142.5`, built from its `codex-rs/` workspace.
+  `rust-v0.143.0`, built from its `codex-rs/` workspace.
 - Set `SOLARIS_CODEX_PROXY_SETUP=/path/to/proxy.sh` if your host needs an
   environment hook before downloads.
 - The codex build clears inherited Solaris `LD_*` hardening variables because
@@ -111,7 +111,7 @@ vendored-crate rewrites in place:
 
 Those helpers remain scripted because they also update vendored crate
 `.cargo-checksum.json`, which makes static patch files awkward to maintain.
-The mio event-ports rewrite applies the upstream proposal from
+The mio event-ports rewrite applies the upstream accepted changes from
 `https://github.com/tokio-rs/mio/pull/1962`, refreshed against the `mio 1.2.0`
 crate version locked by Codex.
 

build-codex.sh

@@ -385,6 +385,7 @@ paths = [
     "src/poll.rs",
     "src/sys/unix/mod.rs",
     "src/sys/unix/selector/event_ports.rs",
+    "src/sys/unix/waker/event_ports.rs",
 ]
 
 data = json.loads(checksum_json.read_text())

patches/codex/0007-app-server-daemon-use-fcntl-locks-on-solaris.patch

@@ -60,10 +60,10 @@ index b525e61..68c85dc 100644
  fn try_lock_file(_file: &fs::File) -> Result<bool> {
      bail!("pid-managed app-server startup is unsupported on this platform")
 diff --git a/codex-rs/app-server-daemon/src/lib.rs b/codex-rs/app-server-daemon/src/lib.rs
-index 21fecef..461bda0 100644
+index 5870075..95ff316 100644
 --- a/codex-rs/app-server-daemon/src/lib.rs
 +++ b/codex-rs/app-server-daemon/src/lib.rs
-@@ -823,7 +823,7 @@ fn should_reexec_updater(
+@@ -831,7 +831,7 @@ fn should_reexec_updater(
          && outcome == RestartIfRunningOutcome::Restarted
  }
 
@@ -72,7 +72,7 @@ index 21fecef..461bda0 100644
  fn try_lock_file(file: &tokio::fs::File) -> Result<bool> {
      use std::os::fd::AsRawFd;
 
-@@ -839,6 +839,35 @@ fn try_lock_file(file: &tokio::fs::File) -> Result<bool> {
+@@ -847,6 +847,35 @@ fn try_lock_file(file: &tokio::fs::File) -> Result<bool> {
      Err(err).context("failed to lock daemon operation")
  }
 

patches/codex/0008-http-client-honor-no-proxy-before-system-proxy.patch

@@ -13,24 +13,25 @@ This was offered to upstream via:
 https://github.com/openai/codex/issues/4242
 
 diff --git a/codex-rs/exec-server/src/client/reqwest_http_client.rs b/codex-rs/exec-server/src/client/reqwest_http_client.rs
-index 9e22fc0..1862197 100644
+index d0cffa6..dd849de 100644
 --- a/codex-rs/exec-server/src/client/reqwest_http_client.rs
 +++ b/codex-rs/exec-server/src/client/reqwest_http_client.rs
-@@ -46,17 +46,23 @@ pub(crate) struct PendingReqwestHttpBodyStream {
+@@ -49,20 +49,25 @@ pub(crate) struct PendingReqwestHttpBodyStream {
  /// Validates `http/request` parameters and runs the actual `reqwest` call used
  /// by the exec-server route and the local [`HttpClient`] backend.
  pub(crate) struct ReqwestHttpRequestRunner {
 -    client: reqwest::Client,
 +    timeout_ms: Option<u64>,
++    redirect_policy: HttpRedirectPolicy,
  }
 
  impl ReqwestHttpClient {
--    fn build_client(timeout_ms: Option<u64>) -> Result<reqwest::Client, ExecServerError> {
--        let builder = match timeout_ms {
-+    fn build_client(
-+        timeout_ms: Option<u64>,
+     fn build_client(
+         timeout_ms: Option<u64>,
+         redirect_policy: HttpRedirectPolicy,
 +        url: &Url,
-+    ) -> Result<reqwest::Client, ExecServerError> {
+     ) -> Result<reqwest::Client, ExecServerError> {
+-        let builder = match timeout_ms {
 +        let mut builder = match timeout_ms {
              None => reqwest::Client::builder(),
              Some(timeout_ms) => {
@@ -40,32 +41,35 @@ index 9e22fc0..1862197 100644
 +        if request_matches_no_proxy(url) {
 +            builder = builder.no_proxy();
 +        }
-         build_reqwest_client_with_custom_ca(builder)
-             .map_err(|error| ExecServerError::HttpRequest(error.to_string()))
-     }
-@@ -112,9 +118,7 @@ impl HttpClient for ReqwestHttpClient {
- 
- impl ReqwestHttpRequestRunner {
-     pub(crate) fn new(timeout_ms: Option<u64>) -> Result<Self, JSONRPCErrorError> {
--        let client = ReqwestHttpClient::build_client(timeout_ms)
+         let builder = match redirect_policy {
+             HttpRedirectPolicy::Follow => builder,
+             HttpRedirectPolicy::Stop => builder.redirect(reqwest::redirect::Policy::none()),
+@@ -125,9 +130,10 @@ impl ReqwestHttpRequestRunner {
+         timeout_ms: Option<u64>,
+         redirect_policy: HttpRedirectPolicy,
+     ) -> Result<Self, JSONRPCErrorError> {
+-        let client = ReqwestHttpClient::build_client(timeout_ms, redirect_policy)
 -            .map_err(|error| internal_error(error.to_string()))?;
 -        Ok(Self { client })
-+        Ok(Self { timeout_ms })
++        Ok(Self {
++            timeout_ms,
++            redirect_policy,
++        })
      }
 
      pub(crate) async fn run(
-@@ -136,7 +140,9 @@ impl ReqwestHttpRequestRunner {
-         }
- 
-         let headers = Self::build_headers(params.headers)?;
+@@ -159,7 +165,9 @@ impl ReqwestHttpRequestRunner {
+         );
+         let mut headers = Self::build_headers(params.headers)?;
+         codex_otel::inject_span_w3c_trace_headers(&request_span, &mut headers);
 -        let mut request = self.client.request(method.clone(), url).headers(headers);
-+        let client = ReqwestHttpClient::build_client(self.timeout_ms, &url)
++        let client = ReqwestHttpClient::build_client(self.timeout_ms, self.redirect_policy, &url)
 +            .map_err(|error| internal_error(error.to_string()))?;
 +        let mut request = client.request(method.clone(), url).headers(headers);
          if let Some(body) = params.body {
              request = request.body(body.into_inner());
          }
-@@ -295,3 +301,98 @@ fn error_source_chain(error: &reqwest::Error) -> Option<String> {
+@@ -320,3 +328,98 @@ fn error_source_chain(error: &reqwest::Error) -> Option<String> {
      }
      (!sources.is_empty()).then(|| sources.join(": "))
  }

patches/codex/0010-exec-server-drain-fs-helper-output-concurrently.patch

@@ -10,7 +10,7 @@ before it can exit. Add a regression test that returns a helper-shaped response
 larger than a typical pipe buffer.
 
 diff --git a/codex-rs/exec-server/src/fs_sandbox.rs b/codex-rs/exec-server/src/fs_sandbox.rs
-index 3dbcf73..1ef9129 100644
+index 812d767..1286e8f 100644
 --- a/codex-rs/exec-server/src/fs_sandbox.rs
 +++ b/codex-rs/exec-server/src/fs_sandbox.rs
 @@ -17,6 +17,7 @@ use codex_sandboxing::SandboxablePreference;
@@ -21,7 +21,7 @@ index 3dbcf73..1ef9129 100644
  use tokio::io::AsyncWriteExt;
  use tokio::process::Command;
 
-@@ -299,6 +300,25 @@ async fn run_command(
+@@ -302,6 +303,25 @@ async fn run_command(
      request_json: Vec<u8>,
  ) -> Result<FsHelperPayload, JSONRPCErrorError> {
      let mut child = spawn_command(command)?;
@@ -47,7 +47,7 @@ index 3dbcf73..1ef9129 100644
      let mut stdin = child
          .stdin
          .take()
-@@ -307,15 +327,17 @@ async fn run_command(
+@@ -310,15 +330,17 @@ async fn run_command(
      stdin.shutdown().await.map_err(io_error)?;
      drop(stdin);
 
@@ -70,7 +70,7 @@ index 3dbcf73..1ef9129 100644
      match response {
          FsHelperResponse::Ok(payload) => Ok(payload),
          FsHelperResponse::Error(error) => Err(error),
-@@ -358,6 +380,10 @@ fn io_error(err: std::io::Error) -> JSONRPCErrorError {
+@@ -361,6 +383,10 @@ fn io_error(err: std::io::Error) -> JSONRPCErrorError {
      internal_error(err.to_string())
  }
 
@@ -81,7 +81,7 @@ index 3dbcf73..1ef9129 100644
  fn json_error(err: serde_json::Error) -> JSONRPCErrorError {
      internal_error(format!(
          "failed to encode or decode fs sandbox helper message: {err}"
-@@ -675,6 +701,58 @@ mod tests {
+@@ -678,6 +704,58 @@ mod tests {
          assert!(policy.can_read_path_with_cwd(alias_parent.as_path(), cwd.as_path()));
      }