codex-acp: 0.9.2 -> 0.12.0 (#510691)

{

  "version": "0.9.4",

  "hash": "sha256-sVmy7t1+z88WmYuupVmUA3GYA2kkv3nY7Z3Ic99f5UY=",

  "cargoHash": "sha256-Ik6pewc6f+cmVKiqVj1g0h7cIxLhE6xOd9p/ySo/EPg=",

  "codexRev": "c34b30a3c128bb75fcec27ef838c93c99b92fc61",

  "codexSrcHash": "sha256-SnJHiecKNCHhkiMpbsEwpUarpKLpxn1JOHLHy2vgRog=",

  "nodeVersionHash": "sha256-q/bOpgF6/0K3MDKXAC+bi1Rb/vCHNhKZpNDbhyYH+oc="

}

# auto-generated file -- DO NOT EDIT!

{

  lib,

  stdenv,

  fetchurl,

}:

fetchurl {

  name = "librusty_v8-146.4.0";

  url = "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";

  hash =

    {

      x86_64-linux = "sha256-5ktNmeSuKTouhGJEqJuAF4uhA4LBP7WRwfppaPUpEVM=";

      aarch64-linux = "sha256-2/FlsHyBvbBUvARrQ9I+afz3vMGkwbW0d2mDpxBi7Ng=";

      x86_64-darwin = "sha256-YwzSQPG77NsHFBfcGDh6uBz2fFScHFFaC0/Pnrpke7c=";

      aarch64-darwin = "sha256-v+LJvjKlbChUbw+WWCXuaPv2BkBfMQzE4XtEilaM+Yo=";

    }

    .${stdenv.hostPlatform.system}

      or (throw "librusty_v8 146.4.0 is not available for ${stdenv.hostPlatform.system}");

  meta = {

    version = "146.4.0";

    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

  };

}

{

  lib,

  stdenv,

  callPackage,

  fetchFromGitHub,

  fetchurl,

  rustPlatform,

  pkg-config,

  openssl,

  libcap,

  bubblewrap,

  librusty_v8 ? callPackage ./librusty_v8.nix { },

}:

let

  versionData = builtins.fromJSON (builtins.readFile ./hashes.json);

  inherit (versionData)

    version

    hash

    cargoHash

    codexRev

    codexSrcHash

    nodeVersionHash

    ;

  # codex-core uses include_str!("../../../../node-version.txt"), so we need

  # to place node-version.txt at the vendored workspace root.

  nodeVersionFile = fetchurl {

    url = "https://raw.githubusercontent.com/zed-industries/codex/${codexRev}/codex-rs/node-version.txt";

    hash = nodeVersionHash;

  };

  # codex-linux-sandbox compiles a patched bubblewrap source tree from

  # codex-rs/vendor/bubblewrap. Cargo vendoring flattens workspace layout,

  # so this directory must be provided explicitly.

  # codex-acp 0.12.0 pins openai/codex rust-v0.124.0 in Cargo.lock.

  codexRev = "e9fb49366c93a1478ec71cc41ecee415a197d036";

  codexHash = "sha256-YFnzzwCm9/b30qLDMbkf/rEizuTjeqdCgoBZeS0wNBo=";

  codexSrc = fetchFromGitHub {

    owner = "zed-industries";

    owner = "openai";

    repo = "codex";

    rev = codexRev;

    hash = codexSrcHash;

    hash = codexHash;

  };

in

rustPlatform.buildRustPackage {

rustPlatform.buildRustPackage (finalAttrs: {

  pname = "codex-acp";

  inherit version;

  version = "0.12.0";

  src = fetchFromGitHub {

    owner = "zed-industries";

    repo = "codex-acp";

    rev = "v${version}";

    inherit hash;

    tag = "v${finalAttrs.version}";

    hash = "sha256-qPqg95FpXHBtyHBJtrfJUwu9GokfmOJgKgqLKQ48u+8=";

  };

  inherit cargoHash;

  cargoHash = "sha256-/BZ82qiTy/mPwhf5v5CFrNSB6AxCRFdmHB72L0+KjJw=";

  preBuild = ''

    cp ${nodeVersionFile} "$NIX_BUILD_TOP/codex-acp-${version}-vendor/node-version.txt"

  # fetchCargoVendor only keeps the individual git crate subtrees, so restore

  # the workspace-root file that codex-core includes via ../../../../node-version.txt.

  postPatch = ''

    cp ${codexSrc}/codex-rs/node-version.txt "$cargoDepsCopy/source-git-0/node-version.txt"

  '';

  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {

    CODEX_BWRAP_SOURCE_DIR = "${codexSrc}/codex-rs/vendor/bubblewrap";

  env = {

    RUSTY_V8_ARCHIVE = librusty_v8;

  }

  // lib.optionalAttrs stdenv.hostPlatform.isLinux {

    CODEX_BWRAP_SOURCE_DIR = "${bubblewrap.src}";

  };

  nativeBuildInputs = [

  doCheck = false;

  passthru.updateScript = ./update.py;

  passthru.updateScript = ./update.sh;

  meta = {

    description = "An ACP-compatible coding agent powered by Codex";

    homepage = "https://github.com/zed-industries/codex-acp";

    changelog = "https://github.com/zed-industries/codex-acp/releases/tag/v${version}";

    changelog = "https://github.com/zed-industries/codex-acp/releases/tag/v${finalAttrs.version}";

    license = lib.licenses.asl20;

    maintainers = with lib.maintainers; [ tlvince ];

    platforms = lib.platforms.unix;

    sourceProvenance = with lib.sourceTypes; [ fromSource ];

    mainProgram = "codex-acp";

  };

}

})

#!/usr/bin/env nix-shell

#!nix-shell -I nixpkgs=./. -i python3 -p python3 nix cacert

"""Update script for codex-acp package.

codex-acp depends on crates from zed-industries/codex via a git dependency.

To keep the Nix expression up to date, we need to:

- update codex-acp source hash,

- extract the pinned codex git revision from Cargo.lock,

- refresh node-version.txt hash for that codex revision,

- refresh codex source hash for vendored bubblewrap on Linux,

- recompute cargoHash.

"""

from __future__ import annotations

import json

import os

import re

import subprocess

import tarfile

import tempfile

import urllib.request

from pathlib import Path

SCRIPT_DIR = Path(__file__).resolve().parent

NIXPKGS_ROOT = SCRIPT_DIR.parents[4]

HASHES_FILE = SCRIPT_DIR / "hashes.json"

OWNER = "zed-industries"

REPO = "codex-acp"

DUMMY_CARGO_HASH = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

ANSI_ESCAPE_RE = re.compile(r"\x1b\[[0-9;]*m")

def run(cmd: list[str], cwd: Path | None = None) -> str:

    result = subprocess.run(

        cmd,

        cwd=str(cwd) if cwd else None,

        check=False,

        capture_output=True,

        text=True,

    )

    if result.returncode != 0:

        output = result.stderr.strip() or result.stdout.strip()

        msg = f"Command failed ({result.returncode}): {' '.join(cmd)}"

        if output:

            msg = f"{msg}\n{output}"

        raise RuntimeError(msg)

    return result.stdout.strip()

def github_request(url: str) -> dict:

    headers = {

        "Accept": "application/vnd.github+json",

    }

    token = os.environ.get("GITHUB_TOKEN")

    if token:

        headers["Authorization"] = f"Bearer {token}"

    req = urllib.request.Request(url, headers=headers)

    with urllib.request.urlopen(req) as response:

        return json.loads(response.read().decode("utf-8"))

def fetch_latest_release(owner: str, repo: str) -> str:

    data = github_request(f"https://api.github.com/repos/{owner}/{repo}/releases/latest")

    tag_name = data["tag_name"]

    return tag_name[1:] if tag_name.startswith("v") else tag_name

def version_key(version: str) -> tuple[int, ...]:

    parts = re.findall(r"\d+", version)

    return tuple(int(part) for part in parts)

def should_update(current: str, latest: str) -> bool:

    return version_key(latest) > version_key(current)

def load_hashes(path: Path) -> dict[str, str]:

    with path.open() as f:

        return json.load(f)

def save_hashes(path: Path, data: dict[str, str]) -> None:

    with path.open("w") as f:

        json.dump(data, f, indent=2)

        f.write("\n")

def prefetch_sri(url: str, *, unpack: bool = False) -> str:

    cmd = ["nix-prefetch-url", "--type", "sha256"]

    if unpack:

        cmd.append("--unpack")

    cmd.append(url)

    raw_hash = run(cmd, cwd=NIXPKGS_ROOT)

    return run(

        [

            "nix",

            "--extra-experimental-features",

            "nix-command",

            "hash",

            "to-sri",

            "--type",

            "sha256",

            raw_hash,

        ],

        cwd=NIXPKGS_ROOT,

    )

def extract_codex_rev_from_tarball(tag: str) -> str:

    """Extract zed-industries/codex git revision from codex-acp Cargo.lock."""

    url = f"https://github.com/{OWNER}/{REPO}/archive/refs/tags/{tag}.tar.gz"

    with tempfile.TemporaryDirectory() as tmpdir:

        tarball_path = Path(tmpdir) / "source.tar.gz"

        urllib.request.urlretrieve(url, tarball_path)

        with tarfile.open(tarball_path, "r:gz") as tar:

            for member in tar.getmembers():

                if not member.name.endswith("Cargo.lock"):

                    continue

                cargo_lock = tar.extractfile(member)

                if cargo_lock is None:

                    continue

                content = cargo_lock.read().decode("utf-8")

                match = re.search(r"zed-industries/codex\?branch=acp#([a-f0-9]+)", content)

                if match:

                    return match.group(1)

    raise RuntimeError("Could not extract codex git revision from Cargo.lock")

def calculate_dependency_hash(attr_path: str) -> str:

    result = subprocess.run(

        ["nix-build", "--no-out-link", "-A", attr_path],

        cwd=str(NIXPKGS_ROOT),

        check=False,

        capture_output=True,

        text=True,

    )

    output = ANSI_ESCAPE_RE.sub("", f"{result.stdout}\n{result.stderr}")

    match = re.search(r"got:\s*(sha256-[A-Za-z0-9+/=]+)", output)

    if match:

        return match.group(1)

    if result.returncode == 0:

        raise RuntimeError("nix-build unexpectedly succeeded with placeholder cargoHash")

    raise RuntimeError("Failed to parse cargoHash from nix-build output")

def main() -> None:

    data = load_hashes(HASHES_FILE)

    current = data["version"]

    latest = fetch_latest_release(OWNER, REPO)

    print(f"Current: {current}, Latest: {latest}")

    if not should_update(current, latest):

        print("Already up to date")

        return

    tag = f"v{latest}"

    print(f"Updating codex-acp to {latest}...")

    source_url = f"https://github.com/{OWNER}/{REPO}/archive/refs/tags/{tag}.tar.gz"

    print("Calculating source hash...")

    source_hash = prefetch_sri(source_url, unpack=True)

    print(f"  hash: {source_hash}")

    print("Extracting codex git revision from Cargo.lock...")

    codex_rev = extract_codex_rev_from_tarball(tag)

    print(f"  codexRev: {codex_rev}")

    codex_src_url = f"https://github.com/zed-industries/codex/archive/{codex_rev}.tar.gz"

    print("Calculating codex source hash...")

    codex_src_hash = prefetch_sri(codex_src_url, unpack=True)

    print(f"  codexSrcHash: {codex_src_hash}")

    node_version_url = (

        f"https://raw.githubusercontent.com/zed-industries/codex/{codex_rev}/"

        "codex-rs/node-version.txt"

    )

    print("Calculating node-version.txt hash...")

    node_version_hash = prefetch_sri(node_version_url, unpack=False)

    print(f"  nodeVersionHash: {node_version_hash}")

    data = {

        "version": latest,

        "hash": source_hash,

        "cargoHash": DUMMY_CARGO_HASH,

        "codexRev": codex_rev,

        "codexSrcHash": codex_src_hash,

        "nodeVersionHash": node_version_hash,

    }

    save_hashes(HASHES_FILE, data)

    print("Calculating cargoHash...")

    attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", "codex-acp")

    cargo_hash = calculate_dependency_hash(attr_path)

    print(f"  cargoHash: {cargo_hash}")

    data["cargoHash"] = cargo_hash

    save_hashes(HASHES_FILE, data)

    print(f"Updated to {latest}")

if __name__ == "__main__":

    main()

#!/usr/bin/env nix-shell

#!nix-shell -i bash -p bash cacert common-updater-scripts coreutils curl gnutar jq nix-update

set -euo pipefail

PACKAGE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

NIXPKGS_ROOT="$(realpath "$PACKAGE_DIR/../../../..")"

PACKAGE_NIX="$PACKAGE_DIR/package.nix"

LIBRUSTY_V8_NIX="$PACKAGE_DIR/librusty_v8.nix"

ATTR_PATH=codex-acp

OWNER="zed-industries"

REPO="codex-acp"

github_api_get() {

  local url="$1"

  local curl_args=(

    --fail

    --silent

    --show-error

    -H "Accept: application/vnd.github+json"

  )

  if [[ -n "${GITHUB_TOKEN:-}" ]]; then

    curl_args+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")

  fi

  curl "${curl_args[@]}" "$url"

}

normalize_version() {

  local version="$1"

  echo "${version#v}"

}

prefetch_sri() {

  local url="$1"

  local unpack="${2:-false}"

  local raw_hash

  local args=(--type sha256)

  if [[ "$unpack" == "true" ]]; then

    args+=(--unpack)

  fi

  raw_hash="$(nix-prefetch-url "${args[@]}" "$url")"

  nix hash convert --to sri --hash-algo sha256 "$raw_hash"

}

parse_release_metadata() {

  local cargo_lock="$1"

  local codex_metadata codex_tag codex_rev v8_version

  codex_metadata="$(

    sed -nE 's|.*git\+https://github\.com/openai/codex\?tag=([^#"]+)#([0-9a-f]+).*|\1 \2|p' "$cargo_lock" \

      | head -n1

  )"

  if [[ -z "$codex_metadata" ]]; then

    echo "Could not find pinned openai/codex dependency in Cargo.lock" >&2

    return 1

  fi

  read -r codex_tag codex_rev <<<"$codex_metadata"

  if [[ -z "$codex_tag" || -z "$codex_rev" ]]; then

    echo "Could not parse pinned openai/codex dependency in Cargo.lock" >&2

    return 1

  fi

  v8_version="$(

    awk '

      /^\[\[package\]\]$/ { in_pkg = 1; is_v8 = 0; next }

      in_pkg && /^name = "v8"$/ { is_v8 = 1; next }

      in_pkg && is_v8 && /^version = "/ {

        gsub(/^version = "/, "")

        gsub(/"$/, "")

        print

        exit

      }

    ' "$cargo_lock"

  )"

  if [[ -z "$v8_version" ]]; then

    echo "Could not find v8 package version in Cargo.lock" >&2

    return 1

  fi

  printf '%s\n%s\n%s\n' "$codex_tag" "$codex_rev" "$v8_version"

}

update_codex_pins() {

  local tmp

  tmp="$(mktemp)"

  awk -v codex_rev="$CODEX_REV" -v codex_hash="$CODEX_HASH" '

    /codexRev = "[0-9a-f]+";/ {

      rev_count++

      sub(/codexRev = "[0-9a-f]+";/, "codexRev = \"" codex_rev "\";")

    }

    /codexHash = "sha256-[^"]+";/ {

      hash_count++

      sub(/codexHash = "sha256-[^"]+";/, "codexHash = \"" codex_hash "\";")

    }

    { print }

    END {

      if (rev_count != 1) {

        print "Failed to update codexRev in package.nix" > "/dev/stderr"

        exit 1

      }

      if (hash_count != 1) {

        print "Failed to update codexHash in package.nix" > "/dev/stderr"

        exit 1

      }

    }

  ' "$PACKAGE_NIX" >"$tmp"

  mv "$tmp" "$PACKAGE_NIX"

}

write_librusty_v8_nix() {

  cat >"$LIBRUSTY_V8_NIX" <<EOF

# auto-generated file -- DO NOT EDIT!

{

  lib,

  stdenv,

  fetchurl,

}:

fetchurl {

  name = "librusty_v8-${V8_VERSION}";

  url = "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_\${stdenv.hostPlatform.rust.rustcTarget}.a.gz";

  hash =

    {

      x86_64-linux = "${V8_HASH_X86_64_LINUX}";

      aarch64-linux = "${V8_HASH_AARCH64_LINUX}";

      x86_64-darwin = "${V8_HASH_X86_64_DARWIN}";

      aarch64-darwin = "${V8_HASH_AARCH64_DARWIN}";

    }

    .\${stdenv.hostPlatform.system}

    or (throw "librusty_v8 ${V8_VERSION} is not available for \${stdenv.hostPlatform.system}");

  meta = {

    version = "${V8_VERSION}";

    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

  };

}

EOF

}

cd "$NIXPKGS_ROOT"

current_version="$(nix eval --raw -f . "${ATTR_PATH}.version")"

latest_version="${CODEX_ACP_LATEST_VERSION_OVERRIDE:-}"

if [[ -z "$latest_version" ]]; then

  latest_version="$(github_api_get "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" | jq --raw-output '.tag_name')"

fi

latest_version="$(normalize_version "$latest_version")"

echo "latest  version: $latest_version"

echo "current version: $current_version"

if [[ "$latest_version" == "$current_version" ]]; then

  echo "codex-acp is already up to date"

  exit 0

fi

tmpdir="$(mktemp -d)"

trap 'rm -rf "$tmpdir"' EXIT

source_tarball="$tmpdir/codex-acp-${latest_version}.tar.gz"

source_root="$tmpdir/codex-acp-${latest_version}"

curl --fail --silent --show-error --location \

  "https://github.com/${OWNER}/${REPO}/archive/refs/tags/v${latest_version}.tar.gz" \

  --output "$source_tarball"

tar -xzf "$source_tarball" -C "$tmpdir"

mapfile -t release_metadata < <(parse_release_metadata "$source_root/Cargo.lock")

CODEX_TAG="${release_metadata[0]}"

CODEX_REV="${release_metadata[1]}"

V8_VERSION="${release_metadata[2]}"

export CODEX_REV

echo "pinned codex tag: $CODEX_TAG"

echo "pinned codex rev: $CODEX_REV"

echo "pinned v8 version: $V8_VERSION"

src_hash="$(prefetch_sri "https://github.com/${OWNER}/${REPO}/archive/refs/tags/v${latest_version}.tar.gz" true)"

CODEX_HASH="$(prefetch_sri "https://github.com/openai/codex/archive/${CODEX_REV}.tar.gz" true)"

export CODEX_HASH

V8_HASH_X86_64_LINUX="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz")"

V8_HASH_AARCH64_LINUX="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_aarch64-unknown-linux-gnu.a.gz")"

V8_HASH_X86_64_DARWIN="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_x86_64-apple-darwin.a.gz")"

V8_HASH_AARCH64_DARWIN="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_aarch64-apple-darwin.a.gz")"

export V8_VERSION V8_HASH_X86_64_LINUX V8_HASH_AARCH64_LINUX V8_HASH_X86_64_DARWIN V8_HASH_AARCH64_DARWIN

update-source-version "$ATTR_PATH" "$latest_version" "$src_hash" --ignore-same-version

update_codex_pins

write_librusty_v8_nix

nix-update "$ATTR_PATH" --version skip

echo "updated codex-acp to $latest_version"