On Tue, 20 Oct 2026 08:59:00 +0200,
David Uhden Collado <[email protected]> wrote:
>
> [1 <text/plain; UTF-8 (7bit)>]
> Hello,
>
> Please find attached a patch disabling Codex's internal update
> mechanisms on OpenBSD.
>
> Codex is installed and maintained through pkg_add. Allowing its
> updater to replace package-owned binaries could bypass the ports
> patches and leave the package database inconsistent.
>
> The patch disables self-updates through the CLI, TUI, app-server
> daemon and background updater.
>
> Users are directed to pkg_add -u instead.
>
> The daemon itself remains enabled, including its existing lifecycle
> management.
>
You haven't tested it before suggested the patch, have you?
Out of the box behaviour:
~ $ codex app-server daemon update
{"status":"unsupported","managedCodexPath":"/usr/local/bin/codex","installedVersion":"0.163.0","runningVersion":"0.163.0","message":"This
command requires a daemon package selected from its managed releases
directory."}
~ $
> Thanks,
> David.
> [2 codex-0.163.0p0-04-package-updater.patch <text/x-patch; UTF-8 (base64)>]
> Index:
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
> ===================================================================
> RCS file:
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
> diff -N
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
> 18 Oct 2026 16:10:35 -0000
> @@ -0,0 +1,39 @@
> +Reject internal daemon update entry points and keep the updater disabled.
> +
> +Index: codex-rs/app-server-daemon/src/lib.rs
> +--- codex-rs/app-server-daemon/src/lib.rs.orig
> ++++ codex-rs/app-server-daemon/src/lib.rs
> +@@ -282,6 +282,10 @@ pub async fn run_pid_update_loop(
> + restore_release: Option<String>,
> + ) -> Result<()> {
> + ensure_supported_platform()?;
> ++ anyhow::ensure!(
> ++ !cfg!(target_os = "openbsd"),
> ++ "the daemon is managed by the system package manager; use pkg_add
> -u"
> ++ );
> + #[cfg(windows)]
> + backend::windows::ensure_not_elevated()?;
> + update_loop::run(http_client_factory, restore_release).await
> +@@ -291,6 +295,10 @@ pub async fn update(
> + http_client_factory: codex_http_client::HttpClientFactory,
> + ) -> Result<UpdateOutput> {
> + ensure_supported_platform()?;
> ++ anyhow::ensure!(
> ++ !cfg!(target_os = "openbsd"),
> ++ "the daemon is managed by the system package manager; use pkg_add
> -u"
> ++ );
> + #[cfg(windows)]
> + backend::windows::ensure_not_elevated()?;
> + update_loop::request_manual_update(&Daemon::from_environment()?,
> http_client_factory).await
> +@@ -892,6 +900,11 @@ impl Daemon {
> +
> + async fn ensure_managed_updater(&self, settings: &DaemonSettings) ->
> Result<bool> {
> + let updater =
> backend::pid_update_loop_backend(self.backend_paths(settings));
> ++ if cfg!(target_os = "openbsd") {
> ++ // Best effort: an invalid stale record must not prevent daemon
> start.
> ++ let _ = updater.stop().await;
> ++ return Ok(false);
> ++ }
> + if !settings.auto_update_enabled {
> + updater.stop().await?;
> + return Ok(false);
> Index:
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
> ===================================================================
> RCS file:
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
> diff -N
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++
> devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
> 18 Oct 2026 16:10:35 -0000
> @@ -0,0 +1,16 @@
> +Reject --from-cli package replacement under the system package manager.
> +
> +Index: codex-rs/app-server-daemon/src/prepare_install.rs
> +--- codex-rs/app-server-daemon/src/prepare_install.rs.orig
> ++++ codex-rs/app-server-daemon/src/prepare_install.rs
> +@@ -52,6 +52,10 @@ pub async fn update_from_cli(
> + confirm: impl FnOnce(&InstallRequest) -> Result<bool>,
> + ) -> Result<Option<crate::UpdateOutput>> {
> + crate::ensure_supported_platform()?;
> ++ anyhow::ensure!(
> ++ !cfg!(target_os = "openbsd"),
> ++ "the daemon is managed by the system package manager; use pkg_add
> -u"
> ++ );
> + #[cfg(windows)]
> + crate::backend::windows::ensure_not_elevated()?;
> + let daemon = Daemon::from_environment()?;
> Index: devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update
> ===================================================================
> RCS file: devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update
> diff -N devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update 18 Oct
> 2026 16:10:35 -0000
> @@ -0,0 +1,15 @@
> +Reject the package-manager update path with an explicit pkg_add message.
> +
> +Index: codex-rs/cli/src/main.rs
> +--- codex-rs/cli/src/main.rs.orig
> ++++ codex-rs/cli/src/main.rs
> +@@ -874,6 +874,9 @@ fn resolve_windows_update_command_from_p
> + }
> +
> + fn run_update_command() -> anyhow::Result<()> {
> ++ if cfg!(target_os = "openbsd") {
> ++ anyhow::bail!("Codex is managed by OpenBSD packages; update with
> pkg_add -u, then restart the daemon");
> ++ }
> + #[cfg(debug_assertions)]
> + {
> + anyhow::bail!(
> Index: devel/codex/patches/patch-codex-rs_tui_src_update_action_rs
> ===================================================================
> RCS file: devel/codex/patches/patch-codex-rs_tui_src_update_action_rs
> diff -N devel/codex/patches/patch-codex-rs_tui_src_update_action_rs
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ devel/codex/patches/patch-codex-rs_tui_src_update_action_rs 18 Oct
> 2026 16:10:35 -0000
> @@ -0,0 +1,13 @@
> +Index: codex-rs/tui/src/update_action.rs
> +--- codex-rs/tui/src/update_action.rs.orig
> ++++ codex-rs/tui/src/update_action.rs
> +@@ -81,6 +81,9 @@ impl UpdateAction {
> +
> + #[cfg(not(debug_assertions))]
> + pub fn get_update_action() -> Option<UpdateAction> {
> ++ if cfg!(target_os = "openbsd") {
> ++ return None; // Updates are managed by pkg_add, never an upstream
> installer.
> ++ }
> + UpdateAction::from_install_context(InstallContext::current())
> + }
> +
> Index: devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs
> ===================================================================
> RCS file: devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs
> diff -N devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs 18 Oct
> 2026 16:10:35 -0000
> @@ -0,0 +1,28 @@
> +Keep the daemon enabled while directing package updates to pkg_add.
> +Do not offer self-installation actions for a distributor-owned executable.
> +
> +Index: codex-rs/tui/src/app/daemon_menu.rs
> +--- codex-rs/tui/src/app/daemon_menu.rs.orig
> ++++ codex-rs/tui/src/app/daemon_menu.rs
> +@@ -54,6 +54,10 @@ impl App {
> + Some(
> + "Manage this server on its host. Local daemon updates are
> unavailable for remote connections.",
> + )
> ++ } else if cfg!(target_os = "openbsd") {
> ++ Some(
> ++ "The daemon is installed by the system package manager. Use
> pkg_add -u, then codex app-server daemon restart.",
> ++ )
> + } else if self.daemon_cli_executable.is_none() {
> + Some("Run the Codex CLI to manage the daemon from this menu.")
> + } else {
> +@@ -160,7 +164,9 @@ impl App {
> + let Some(executable) = &self.daemon_cli_executable else {
> + return;
> + };
> +- if matches!(self.app_server_target, AppServerTarget::Remote { .. })
> {
> ++ if matches!(self.app_server_target, AppServerTarget::Remote { .. })
> ++ || cfg!(target_os = "openbsd")
> ++ {
> + return;
> + }
> + let mut explanation = match source {
--
wbr, Kirill
