5 Commits

• fix: remove references to corepack (#10138)

  Currently, our `npm publish` logic is failing.
  
  There were a number of things that were merged recently that seemed to
  contribute to this situation, though I think we have fixed most of them,
  but this one stands out:
  
  https://github.com/openai/codex/pull/10115
  
  As best I can tell, we tried to fix the pnpm version to a specific hash,
  but we did not do it consistently (though `shell-tool-mcp/package.json`
  had it specified twice...), so for this PR, I ran:
  
  ```
  $ git ls-files | grep package.json
  codex-cli/package.json
  codex-rs/responses-api-proxy/npm/package.json
  package.json
  sdk/typescript/package.json
  shell-tool-mcp/package.json
  ```
  
  and ensured that all of them now have this line:
  
  ```json
    "packageManager": "pnpm@10.28.2+sha512.41872f037ad22f7348e3b1debbaf7e867cfd448f2726d9cf74c08f19507c31d2c8e7a11525b983febc2df640b5438dee6023ebb1f84ed43cc2d654d2bc326264"
  ```
  
  I also went and deleted all of the `corepack` stuff that was added by
  https://github.com/openai/codex/pull/10115.
  
  If someone can explain why we need it and verify it does not break `npm
  publish`, then we can bring it back.

  Michael Bolin · 2026-01-28 23:31:25 -08:00
  4d9ae3a298
• update the ci pnpm workflow for shell-tool-mcp to use corepack for pnpm versioning (#10115)

  This updates the CI workflows for shell-tool-mcp to use the pnpm version
  from package.json and print it in the build for verification.
  
  I have read the CLA Document and I hereby sign the CLA

  mjr-openai · 2026-01-28 16:30:48 -07:00
  83d7c44500
• Upgrade GitHub Actions for Node 24 compatibility (#8102)

  ## Summary
  
  Upgrade GitHub Actions to their latest versions to ensure compatibility
  with Node 24, as Node 20 will reach end-of-life in April 2026.
  
  ## Changes
  
  | Action | Old Version(s) | New Version | Release | Files |
  |--------|---------------|-------------|---------|-------|
  | `actions/setup-node` |
  [`v5`](https://github.com/actions/setup-node/releases/tag/v5) |
  [`v6`](https://github.com/actions/setup-node/releases/tag/v6) |
  [Release](https://github.com/actions/setup-node/releases/tag/v6) |
  ci.yml, rust-release.yml, sdk.yml, shell-tool-mcp-ci.yml,
  shell-tool-mcp.yml |
  
  ## Context
  
  Per [GitHub's
  announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/),
  Node 20 is being deprecated and runners will begin using Node 24 by
  default starting March 4th, 2026.
  
  ### Why this matters
  
  - **Node 20 EOL**: April 2026
  - **Node 24 default**: March 4th, 2026
  - **Action**: Update to latest action versions that support Node 24
  
  ### Security Note
  
  Actions that were previously pinned to commit SHAs remain pinned to SHAs
  (updated to the latest release SHA) to maintain the security benefits of
  immutable references.
  
  ### Testing
  
  These changes only affect CI/CD workflow configurations and should not
  impact application functionality. The workflows should be tested by
  running them on a branch before merging.

  Salman Chishti · 2025-12-16 11:31:25 -08:00
  5ceeaa96b8
• chore(deps): bump actions/checkout from 5 to 6 (#7230)

  Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to
  6.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/releases">actions/checkout's
  releases</a>.</em></p>
  <blockquote>
  <h2>v6.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>v6-beta by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
  <li>update readme/changelog for v6 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
  <h2>v6-beta</h2>
  <h2>What's Changed</h2>
  <p>Updated persist-credentials to store the credentials under
  <code>$RUNNER_TEMP</code> instead of directly in the local git
  config.</p>
  <p>This requires a minimum Actions Runner version of <a
  href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
  to access the persisted credentials for <a
  href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
  container action</a> scenarios.</p>
  <h2>v5.0.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Changelog</h1>
  <h2>V6.0.0</h2>
  <ul>
  <li>Persist creds to a separate file by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
  <li>Update README to include Node.js 24 support details and requirements
  by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
  </ul>
  <h2>V5.0.1</h2>
  <ul>
  <li>Port v6 cleanup to v5 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
  </ul>
  <h2>V5.0.0</h2>
  <ul>
  <li>Update actions checkout to use node 24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
  </ul>
  <h2>V4.3.1</h2>
  <ul>
  <li>Port v6 cleanup to v4 by <a
  href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
  </ul>
  <h2>V4.3.0</h2>
  <ul>
  <li>docs: update README.md by <a
  href="https://github.com/motss"><code>@​motss</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li>Add internal repos for checking out multiple repositories by <a
  href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li>Documentation update - add recommended permissions to Readme by <a
  href="https://github.com/benwells"><code>@​benwells</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li>Adjust positioning of user email note and permissions heading by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li>Update CODEOWNERS for actions by <a
  href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
  <li>Update package dependencies by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  </ul>
  <h2>v4.2.2</h2>
  <ul>
  <li><code>url-helper.ts</code> now leverages well-known environment
  variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
  <li>Expand unit test coverage for <code>isGhes</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
  </ul>
  <h2>v4.2.1</h2>
  <ul>
  <li>Check out other refs/* by commit if provided, fall back to ref by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
  </ul>
  <h2>v4.2.0</h2>
  <ul>
  <li>Add Ref and Commit outputs by <a
  href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
  <li>Dependency updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
  href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
  <a
  href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
  </ul>
  <h2>v4.1.7</h2>
  <ul>
  <li>Bump the minor-npm-dependencies group across 1 directory with 4
  updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
  <li>Bump actions/checkout from 3 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
  <li>Check out other refs/* by commit by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
  <li>Pin actions/checkout's own workflows to a known, good, stable
  version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
  </ul>
  <h2>v4.1.6</h2>
  <ul>
  <li>Check platform to set archive extension appropriately by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
  </ul>
  <h2>v4.1.5</h2>
  <ul>
  <li>Update NPM dependencies by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
  <li>Bump github/codeql-action from 2 to 3 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
  <li>Bump actions/setup-node from 1 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
  <li>Bump actions/upload-artifact from 2 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
  update readme/changelog for v6 (<a
  href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
  v6-beta (<a
  href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
  Persist creds to a separate file (<a
  href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
  Update README to include Node.js 24 support details and requirements (<a
  href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
  <li>See full diff in <a
  href="https://github.com/actions/checkout/compare/v5...v6">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-11-24 11:45:57 -08:00
  6dd3606773
• feat: codex-shell-tool-mcp (#7005)

  This adds a GitHub workflow for building a new npm module we are
  experimenting with that contains an MCP server for running Bash
  commands. The new workflow, `shell-tool-mcp`, is a dependency of the
  general `release` workflow so that we continue to use one version number
  for all artifacts across the project in one GitHub release.
  
  `.github/workflows/shell-tool-mcp.yml` is the primary workflow
  introduced by this PR, which does the following:
  
  - builds the `codex-exec-mcp-server` and `codex-execve-wrapper`
  executables for both arm64 and x64 versions of Mac and Linux (preferring
  the MUSL version for Linux)
  - builds Bash (dynamically linked) for a [comically] large number of
  platforms (both x64 and arm64 for most) with a small patch specified by
  `shell-tool-mcp/patches/bash-exec-wrapper.patch`:
    - `debian-11`
    - `debian-12`
    - `ubuntu-20.04`
    - `ubuntu-22.04`
    - `ubuntu-24.04`
    - `centos-9`
    - `macos-13` (x64 only)
    - `macos-14` (arm64 only)
    - `macos-15` (arm64 only)
  - builds the TypeScript for the [new] Node module declared in the
  `shell-tool-mcp/` folder, which creates `bin/mcp-server.js`
  - adds all of the native binaries to `shell-tool-mcp/vendor/` folder;
  `bin/mcp-server.js` does a runtime check to determine which ones to
  execute
  - uses `npm pack` to create the `.tgz` for the module
  - if `publish: true` is set, invokes the `npm publish` call with the
  `.tgz`
  
  The justification for building Bash for so many different operating
  systems is because, since it is dynamically linked, we want to increase
  our confidence that the version we build is compatible with the glibc
  whatever OS we end up running on. (Note this is less of a concern with
  `codex-exec-mcp-server` and `codex-execve-wrapper` on Linux, as they are
  statically linked.)
  
  This PR also introduces the code for the npm module in `shell-tool-mcp/`
  (the proposed module name is `@openai/codex-shell-tool-mcp`). Initially,
  I intended the module to be a single file of vanilla JavaScript (like
  [`codex-cli/bin/codex.js`](https://github.com/openai/codex/blob/ab5972d447da78d3e4dd8461cf7d43a22e5d2acb/codex-cli/bin/codex.js)),
  but some of the logic seemed a bit tricky, so I decided to port it to
  TypeScript and add unit tests.
  
  `shell-tool-mcp/src/index.ts` defines the `main()` function for the
  module, which performs runtime checks to determine the clang triple to
  find the path to the Rust executables within the `vendor/` folder
  (`resolveTargetTriple()`). It uses a combination of `readOsRelease()`
  and `resolveBashPath()` to determine the correct Bash executable to run
  in the environment. Ultimately, it spawns a command like the following:
  
  ```
  codex-exec-mcp-server \
      --execve codex-execve-wrapper \
      --bash custom-bash "$@"
  ```
  
  Note `.github/workflows/shell-tool-mcp-ci.yml` defines a fairly standard
  CI job for the module (`format`/`build`/`test`).
  
  To test this PR, I pushed this branch to my personal fork of Codex and
  ran the CI job there:
  
  https://github.com/bolinfest/codex/actions/runs/19564311320
  
  Admittedly, the graph looks a bit wild now:
  
  <img width="5115" height="2969" alt="Screenshot 2025-11-20 at 11 44
  58 PM"
  src="https://github.com/user-attachments/assets/cc5ef306-efc1-4ed7-a137-5347e394f393"
  />
  
  But when it finished, I was able to download `codex-shell-tool-mcp-npm`
  from the **Artifacts** for the workflow in an empty temp directory,
  unzip the `.zip` and then the `.tgz` inside it, followed by `xattr -rc
  .` to remove the quarantine bits. Then I ran:
  
  ```shell
  npx @modelcontextprotocol/inspector node /private/tmp/foobar4/package/bin/mcp-server.js
  ```
  
  which launched the MCP Inspector and I was able to use it as expected!
  This bodes well that this should work once the package is published to
  npm:
  
  ```shell
  npx @modelcontextprotocol/inspector npx @openai/codex-shell-tool-mcp
  ```
  
  Also, to verify the package contains what I expect:
  
  ```shell
  /tmp/foobar4/package$ tree
  .
  ├── bin
  │   └── mcp-server.js
  ├── package.json
  ├── README.md
  └── vendor
      ├── aarch64-apple-darwin
      │   ├── bash
      │   │   ├── macos-14
      │   │   │   └── bash
      │   │   └── macos-15
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      ├── aarch64-unknown-linux-musl
      │   ├── bash
      │   │   ├── centos-9
      │   │   │   └── bash
      │   │   ├── debian-11
      │   │   │   └── bash
      │   │   ├── debian-12
      │   │   │   └── bash
      │   │   ├── ubuntu-20.04
      │   │   │   └── bash
      │   │   ├── ubuntu-22.04
      │   │   │   └── bash
      │   │   └── ubuntu-24.04
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      ├── x86_64-apple-darwin
      │   ├── bash
      │   │   └── macos-13
      │   │       └── bash
      │   ├── codex-exec-mcp-server
      │   └── codex-execve-wrapper
      └── x86_64-unknown-linux-musl
          ├── bash
          │   ├── centos-9
          │   │   └── bash
          │   ├── debian-11
          │   │   └── bash
          │   ├── debian-12
          │   │   └── bash
          │   ├── ubuntu-20.04
          │   │   └── bash
          │   ├── ubuntu-22.04
          │   │   └── bash
          │   └── ubuntu-24.04
          │       └── bash
          ├── codex-exec-mcp-server
          └── codex-execve-wrapper
  
  26 directories, 26 files
  ```

  Michael Bolin · 2025-11-21 08:16:36 -08:00
  d363a0968e