Merge upstream main and release v0.144.3

Author: kbdevs

.bazelrc

@@ -105,11 +105,6 @@ common:ci --disk_cache=
 # Shared config for the main Bazel CI workflow.
 common:ci-bazel --config=ci
 common:ci-bazel --build_metadata=TAG_workflow=bazel
-# Keep code-mode integration cases out of ordinary Bazel legs. The
-# Windows-cross config below re-enables them after generating its Windows V8
-# snapshot on the Windows runner. Also skip the ConPTY Ctrl-C integration test
-# until Windows Bazel CI can reliably interrupt foreground processes.
-common:ci-bazel --test_env=CODEX_BAZEL_TEST_SKIP_FILTERS=suite::code_mode::,tests::windows_tests::conpty_ctrl_c_interrupts_powershell_foreground_child
 
 # Shared config for Bazel-backed Rust linting.
 build:clippy --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect
@@ -122,6 +117,7 @@ build:clippy --@rules_rust//rust/settings:clippy.toml=//codex-rs:clippy.toml
 build:clippy --@rules_rust//rust/settings:clippy_flag=-Dwarnings
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::await_holding_invalid_type
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::await_holding_lock
+build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::disallowed_methods
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::expect_used
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::identity_op
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::manual_clamp
@@ -165,6 +161,9 @@ build:argument-comment-lint --@rules_rust//rust/toolchain/channel=nightly
 common:ci-windows --config=ci-bazel
 common:ci-windows --build_metadata=TAG_os=windows
 common:ci-windows --repo_contents_cache=D:/a/.cache/bazel-repo-contents-cache
+# The hidden dynamic-tool callback currently times out on Windows, and ConPTY
+# cannot reliably interrupt foreground processes on Windows Bazel runners.
+common:ci-windows --test_env=CODEX_BAZEL_TEST_SKIP_FILTERS=suite::code_mode::code_mode_can_call_hidden_dynamic_tools,tests::windows_tests::conpty_ctrl_c_interrupts_powershell_foreground_child
 
 # We prefer to run the build actions entirely remotely so we can dial up the concurrency.
 # We have platform-specific tests, so we want to execute the tests on all platforms using the strongest sandboxing available on each platform.
@@ -194,9 +193,7 @@ common:ci-windows-cross --local_test_jobs=8
 common:ci-windows-cross --test_env=RUST_TEST_THREADS=1
 # Native Windows CI still covers the PowerShell parser-process tests. The
 # cross-built gnullvm binaries currently hang in those tests when run on the
-# Windows runner. Keep V8-backed code-mode tests enabled except for the hidden
-# dynamic-tool callback test, which currently times out on Windows. This config
-# replaces the base skip list, so repeat the exact ConPTY Ctrl-C test exclusion.
+# Windows runner. This replaces the Windows skip list, so retain its exclusions.
 common:ci-windows-cross --test_env=CODEX_BAZEL_TEST_SKIP_FILTERS=command_safety::powershell_parser::tests::,suite::code_mode::code_mode_can_call_hidden_dynamic_tools,tests::windows_tests::conpty_ctrl_c_interrupts_powershell_foreground_child
 common:ci-windows-cross --platforms=//:windows_x86_64_gnullvm
 common:ci-windows-cross --extra_execution_platforms=//:rbe,//:windows_x86_64_msvc

.codespellignore

@@ -1,5 +1,6 @@
 iTerm
 iTerm2
+numer
 psuedo
 SOM
 te

.github/actions/setup-rusty-v8/action.yml

@@ -19,24 +19,36 @@ runs:
         release_tag="rusty-v8-v${version}"
         base_url="https://github.com/openai/codex/releases/download/${release_tag}"
         binding_dir="${RUNNER_TEMP}/rusty_v8"
-        archive_path="${binding_dir}/librusty_v8_release_${TARGET}.a.gz"
-        binding_path="${binding_dir}/src_binding_release_${TARGET}.rs"
-        checksums_path="${binding_dir}/rusty_v8_release_${TARGET}.sha256"
+        
+        profile="ptrcomp_sandbox_release"
+
+        if [[ "$TARGET" == *-pc-windows-msvc ]]; then
+          archive_name="rusty_v8_${profile}_${TARGET}.lib.gz"
+        else
+          archive_name="librusty_v8_${profile}_${TARGET}.a.gz"
+        fi
+        binding_name="src_binding_${profile}_${TARGET}.rs"
+        checksums_name="rusty_v8_${profile}_${TARGET}.sha256"
+
+        archive_path="${binding_dir}/${archive_name}"
+        binding_path="${binding_dir}/${binding_name}"
+        checksums_path="${binding_dir}/${checksums_name}"
 
         mkdir -p "${binding_dir}"
-        curl -fsSL "${base_url}/librusty_v8_release_${TARGET}.a.gz" -o "${archive_path}"
-        curl -fsSL "${base_url}/src_binding_release_${TARGET}.rs" -o "${binding_path}"
-        curl -fsSL "${base_url}/rusty_v8_release_${TARGET}.sha256" -o "${checksums_path}"
+        curl -fsSL "${base_url}/${archive_name}" -o "${archive_path}"
+        curl -fsSL "${base_url}/${binding_name}" -o "${binding_path}"
+        curl -fsSL "${base_url}/${checksums_name}" -o "${checksums_path}"
 
         if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
           echo "Expected exactly two checksums for ${TARGET} in ${checksums_path}" >&2
           exit 1
         fi
 
+        # Existing Windows-built release manifests use CRLF line endings.
         if command -v sha256sum >/dev/null 2>&1; then
-          (cd "${binding_dir}" && sha256sum -c "${checksums_path}")
+          (cd "${binding_dir}" && tr -d '\r' < "${checksums_path}" | sha256sum -c -)
         else
-          (cd "${binding_dir}" && shasum -a 256 -c "${checksums_path}")
+          (cd "${binding_dir}" && tr -d '\r' < "${checksums_path}" | shasum -a 256 -c -)
         fi
         echo "RUSTY_V8_ARCHIVE=${archive_path}" >> "${GITHUB_ENV}"
         echo "RUSTY_V8_SRC_BINDING_PATH=${binding_path}" >> "${GITHUB_ENV}"

.github/scripts/build-codex-package-archive.sh

@@ -10,6 +10,8 @@ Usage: build-codex-package-archive.sh \
   --archive-dir <dir> \
   [--bwrap-bin <path>] \
   [--code-mode-host-bin <path>] \
+  [--rg-bin <path>] \
+  [--zsh-bin <path>] \
   [--zsh-manifest <path>] \
   [--codex-command-runner-bin <path>] \
   [--codex-windows-sandbox-setup-bin <path>] \
@@ -56,6 +58,14 @@ while [[ $# -gt 0 ]]; do
       code_mode_host_bin_provided="true"
       shift 2
       ;;
+    --rg-bin)
+      resource_args+=(--rg-bin "${2:?--rg-bin requires a value}")
+      shift 2
+      ;;
+    --zsh-bin)
+      resource_args+=(--zsh-bin "${2:?--zsh-bin requires a value}")
+      shift 2
+      ;;
     --zsh-manifest)
       resource_args+=(--zsh-manifest "${2:?--zsh-manifest requires a value}")
       shift 2

…/notarize_macos_binary_with_rcodesign.sh …igning/notarize_macos_binary_with_akv.sh.github/scripts/macos-signing/notarize_macos_binary_with_rcodesign.sh renamed to .github/scripts/macos-signing/notarize_macos_binary_with_akv.sh .github/scripts/macos-signing/notarize_macos_binary_with_rcodesign.sh renamed to .github/scripts/macos-signing/notarize_macos_binary_with_akv.sh

@@ -1,19 +1,17 @@
 #!/usr/bin/env bash
 
-# Submits a signed standalone macOS binary to Apple notarization through
-# rcodesign. Standalone binaries cannot carry a stapled ticket, so the binary
-# is submitted in a ZIP and the successful notarization log is retained.
+# Notarize a standalone binary and retain its diagnostic report.
 
 set -euo pipefail
 
 usage() {
   cat >&2 <<'EOF'
-Usage: notarize_macos_binary_with_rcodesign.sh --binary PATH [--report-dir PATH] [--max-wait-seconds SECONDS]
+Usage: notarize_macos_binary_with_akv.sh --binary PATH [--report-dir PATH] [--max-wait-seconds SECONDS]
 
 Options:
   --binary PATH                 Signed standalone macOS binary to notarize.
   --report-dir PATH             Directory for notarization logs.
-  --max-wait-seconds SECONDS    Maximum rcodesign notarization wait time.
+  --max-wait-seconds SECONDS    Maximum Apple notarization wait time.
 EOF
 }
 
@@ -63,7 +61,7 @@ if [[ ! "$max_wait_seconds" =~ ^[0-9]+$ ]]; then
   exit 2
 fi
 
-for command_name in rcodesign zip; do
+for command_name in python3 zip; do
   if ! command -v "$command_name" >/dev/null 2>&1; then
     echo "$command_name was not found on PATH." >&2
     exit 1
@@ -73,11 +71,11 @@ done
 missing_environment=0
 for variable_name in \
   APPLE_NOTARIZATION_ISSUER_ID \
-  APPLE_NOTARIZATION_KEY_ID \
-  APPLE_NOTARIZATION_KEY_P8
+  APPLE_NOTARIZATION_AKV_KEY_NAME \
+  AZURE_KEYVAULT_NAME
 do
   if [[ -z "${!variable_name:-}" ]]; then
-    echo "$variable_name must be set from CI secrets before notarizing a binary." >&2
+    echo "$variable_name must be configured before notarizing a binary." >&2
     missing_environment=1
   fi
 done
@@ -91,23 +89,6 @@ mkdir -p "$report_dir"
 notarization_temp_dir="$(mktemp -d)"
 trap 'rm -rf "$notarization_temp_dir" >/dev/null' EXIT
 
-private_key_path="$notarization_temp_dir/AuthKey_${APPLE_NOTARIZATION_KEY_ID}.p8"
-if ! printf '%s' "$APPLE_NOTARIZATION_KEY_P8" | base64 --decode >"$private_key_path" 2>/dev/null; then
-  if ! printf '%s' "$APPLE_NOTARIZATION_KEY_P8" | base64 -D >"$private_key_path" 2>/dev/null; then
-    echo "APPLE_NOTARIZATION_KEY_P8 must be a base64-encoded .p8 private key." >&2
-    exit 2
-  fi
-fi
-chmod 600 "$private_key_path"
-
-api_key_path="$notarization_temp_dir/app-store-connect-api-key.json"
-rcodesign encode-app-store-connect-api-key \
-  --output-path "$api_key_path" \
-  "$APPLE_NOTARIZATION_ISSUER_ID" \
-  "$APPLE_NOTARIZATION_KEY_ID" \
-  "$private_key_path" \
-  >"$report_dir/encode-app-store-connect-api-key.log" 2>&1
-
 binary_name="$(basename "$binary_path")"
 archive_path="$notarization_temp_dir/${binary_name}.zip"
 (
@@ -116,16 +97,15 @@ archive_path="$notarization_temp_dir/${binary_name}.zip"
 )
 
 notarization_log="$report_dir/${binary_name}-notarization.log"
-rcodesign notarize \
-  --api-key-file "$api_key_path" \
+python3 "$(dirname "$0")/notarize_with_akv.py" \
+  --file "$archive_path" \
+  --report-log "$report_dir/${binary_name}-notarization-developer-log.json" \
   --max-wait-seconds "$max_wait_seconds" \
-  --wait \
-  "$archive_path" \
   2>&1 | tee "$notarization_log"
 
 {
   echo "binary_name=$binary_name"
   echo "max_wait_seconds=$max_wait_seconds"
   echo "binary_sha256=$(shasum -a 256 "$binary_path" | awk '{ print $1 }')"
-  echo "rcodesign_notarize=completed"
+  echo "notarization=completed"
 } >"$report_dir/${binary_name}-notarization-summary.txt"

…ing/notarize_macos_dmg_with_rcodesign.sh …s-signing/notarize_macos_dmg_with_akv.sh.github/scripts/macos-signing/notarize_macos_dmg_with_rcodesign.sh renamed to .github/scripts/macos-signing/notarize_macos_dmg_with_akv.sh .github/scripts/macos-signing/notarize_macos_dmg_with_rcodesign.sh renamed to .github/scripts/macos-signing/notarize_macos_dmg_with_akv.sh

@@ -1,21 +1,17 @@
 #!/usr/bin/env bash
 
-# Notarizes and staples a signed macOS DMG through rcodesign.
-#
-# This is the Linux-compatible notarization path for the AKV/PKCS#11 signing
-# flow. It records notarization inputs and logs so workflow artifacts can be
-# audited without exposing the App Store Connect private key.
+# Notarize a signed disk image and staple its ticket.
 
 set -euo pipefail
 
 usage() {
   cat >&2 <<'EOF'
-Usage: notarize_macos_dmg_with_rcodesign.sh --dmg PATH [--report-dir PATH] [--max-wait-seconds SECONDS]
+Usage: notarize_macos_dmg_with_akv.sh --dmg PATH [--report-dir PATH] [--max-wait-seconds SECONDS]
 
 Options:
   --dmg PATH                    Signed DMG to submit to Apple notarization.
   --report-dir PATH             Directory for notarization logs.
-  --max-wait-seconds SECONDS    Maximum rcodesign notarization wait time.
+  --max-wait-seconds SECONDS    Maximum Apple notarization wait time.
 EOF
 }
 
@@ -73,11 +69,11 @@ fi
 missing_environment=0
 for variable_name in \
   APPLE_NOTARIZATION_ISSUER_ID \
-  APPLE_NOTARIZATION_KEY_ID \
-  APPLE_NOTARIZATION_KEY_P8
+  APPLE_NOTARIZATION_AKV_KEY_NAME \
+  AZURE_KEYVAULT_NAME
 do
   if [[ -z "${!variable_name:-}" ]]; then
-    echo "$variable_name must be set from CI secrets before notarizing a DMG." >&2
+    echo "$variable_name must be configured before notarizing a DMG." >&2
     missing_environment=1
   fi
 done
@@ -88,37 +84,18 @@ fi
 
 mkdir -p "$report_dir"
 
-notarization_temp_dir="$(mktemp -d)"
-trap 'rm -rf "$notarization_temp_dir" > /dev/null' EXIT
-
-private_key_path="$notarization_temp_dir/AuthKey_${APPLE_NOTARIZATION_KEY_ID}.p8"
-if ! printf '%s' "$APPLE_NOTARIZATION_KEY_P8" | base64 --decode > "$private_key_path" 2> /dev/null; then
-  if ! printf '%s' "$APPLE_NOTARIZATION_KEY_P8" | base64 -D > "$private_key_path" 2> /dev/null; then
-    echo "APPLE_NOTARIZATION_KEY_P8 must be a base64-encoded .p8 private key." >&2
-    exit 2
-  fi
-fi
-chmod 600 "$private_key_path"
-
-api_key_path="$notarization_temp_dir/app-store-connect-api-key.json"
-rcodesign encode-app-store-connect-api-key \
-  --output-path "$api_key_path" \
-  "$APPLE_NOTARIZATION_ISSUER_ID" \
-  "$APPLE_NOTARIZATION_KEY_ID" \
-  "$private_key_path" \
-  > "$report_dir/encode-app-store-connect-api-key.log" 2>&1
-
 notarization_log="$report_dir/dmg-notarization.log"
-rcodesign notarize \
-  --api-key-file "$api_key_path" \
+python3 "$(dirname "$0")/notarize_with_akv.py" \
+  --file "$dmg_path" \
+  --report-log "$report_dir/dmg-notarization-developer-log.json" \
   --max-wait-seconds "$max_wait_seconds" \
-  --staple \
-  "$dmg_path" \
   2>&1 | tee "$notarization_log"
 
+rcodesign staple "$dmg_path" 2>&1 | tee -a "$notarization_log"
+
 {
   echo "dmg_path=$dmg_path"
   echo "max_wait_seconds=$max_wait_seconds"
   echo "dmg_sha256=$(shasum -a 256 "$dmg_path" | awk '{ print $1 }')"
-  echo "rcodesign_notarize_staple=completed"
+  echo "notarization_staple=completed"
 } > "$report_dir/dmg-notarization-summary.txt"