feat: advance tested Codex CLI to official rust-v0.144.4 (#11)

* feat: advance tested Codex CLI to official rust-v0.144.4 with derived digests

* chore(release): rebind pending evidence to 0.3.3 module content

Author: rldyourmnd

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project are documented here.
 
+## [0.3.3] - 2026-07-14
+
+### Changed
+
+- Tested Codex CLI advanced to the official `rust-v0.144.4` release
+  (2026-07-14; vendor-declared "No user-facing changes in this patch
+  release"). All version pins, installer references, and the builder's
+  config-schema source link now point at 0.144.4.
+- `build/release-evidence.json` rebound to the 0.3.3 module content
+  (execution-bound schema 2, pending until CI lane records exist).
+
 ## 0.3.2 - 2026-07-13
 
 ### Fixed

README.md

@@ -1,14 +1,14 @@
 # NDDev Codex Setup Manager
 
 `nddev-codex-app` is a dependency-free manager for a caller-selected Codex
-home. Version `0.3.2` installs the exact tested official Codex CLI standalone
+home. Version `0.3.3` installs the exact tested official Codex CLI standalone
 release into that target and switches one of two complete NDDev configuration
 sets without deleting unrelated target state. The repository also publishes
 the independently installable `nddev-builder` Codex marketplace.
 
 The current OpenAI desktop product is the ChatGPT app for macOS and Windows. It
 contains separate Chat plus selectable ChatGPT Work and Codex modes. Codex CLI
-`0.144.3` still implements `codex app` through legacy `Codex.app`/`Codex.dmg`
+`0.144.4` still implements `codex app` through legacy `Codex.app`/`Codex.dmg`
 packaging. This module does not manage either desktop bundle directly; on
 macOS, `desktop` is only a narrow delegation to that upstream command.
 
@@ -42,7 +42,7 @@ or defaults to `~/.codex`.
 - Python directory-FD and no-follow filesystem operations for mutations
 - an absolute target whose parent already exists
 
-This build installs and requires Codex CLI `0.144.3`. The configuration format
+This build installs and requires Codex CLI `0.144.4`. The configuration format
 remains compatible with Codex CLI `0.138.0` or newer.
 
 ## Install the official Codex CLI
@@ -56,7 +56,7 @@ python3 cli-tools/nddev_codex.py update-cli \
   --target /absolute/path/to/codex-home
 ```
 
-Install and update first download the pinned OpenAI `rust-v0.144.3`
+Install and update first download the pinned OpenAI `rust-v0.144.4`
 `install.sh` asset into a temporary directory, enforce its exact size and
 SHA-256, and invoke it without a shell pipeline. That verified official
 installer then downloads the pinned checksum manifest and host package and
@@ -72,7 +72,7 @@ symlinks, compatibility entrypoint, code-mode host, bundled ripgrep, Linux
 sandbox helper, executable ownership/modes, bounded `codex --version` output,
 the official temporary-directory PATH-alias diagnostic when present, and exact
 canonical stdout version. `install-cli` and `update-cli` are idempotent when
-`0.144.3` is already current. A different installed version must be advanced
+`0.144.4` is already current. A different installed version must be advanced
 with `update-cli`.
 
 `software-status` is non-mutating and reports `installed`, `current`, `version`,
@@ -174,7 +174,7 @@ Both commands require the exact current target-owned CLI and never resolve
 setup and forwards Codex arguments unchanged. `desktop` invokes exactly
 `codex app` with no argument, or with one validated absolute workspace;
 arbitrary upstream installer/source flags are not exposed. It does not require
-a managed setup because Codex CLI `0.144.3` passes only a workspace URL to the
+a managed setup because Codex CLI `0.144.4` passes only a workspace URL to the
 GUI: setting `CODEX_HOME` for the bridge process is not a guarantee that the
 desktop application will inherit the selected target configuration. Both keep
 standard I/O attached and return the child exit code.

SECURITY.md

@@ -46,9 +46,9 @@ days. These targets are best-effort.
   they are not an administrator enforcement mechanism.
 - Permission profiles are a beta Codex surface whose configuration syntax is
   compatible from Codex CLI 0.138.0. This build installs, launches, and tests
-  exactly 0.144.3.
+  exactly 0.144.4.
 - `install-cli` and `update-cli` verify the exact pinned official
-  `rust-v0.144.3` installer asset before execution. The official installer then
+  `rust-v0.144.4` installer asset before execution. The official installer then
   downloads the pinned checksum manifest and host package and verifies their
   release digests and package checksum from isolated temporary state with a
   fixed release and install root. Abnormal installer exits terminate its whole

VERSION

@@ -1 +1 @@
-0.3.2
+0.3.3

build/manifest.json

@@ -5,7 +5,7 @@
     "location": "sibling .<target-name>.nddev-codex-backups",
     "slots": 10
   },
-  "build_version": "0.3.2",
+  "build_version": "0.3.3",
   "command_policy": {
     "json_supported": [
       "list",
@@ -101,7 +101,7 @@
     "json_manager_errors_supported": true,
     "manager_command": "python3 cli-tools/nddev_codex.py launch --target <absolute-target> -- [args...]",
     "requires_clean_managed_target": true,
-    "required_version": "0.144.3",
+    "required_version": "0.144.4",
     "streams_child_stdio": true,
     "successful_child_output_wrapped": false,
     "target_environment_scope": "child-process-only",
@@ -134,10 +134,10 @@
     "installer": {
       "abnormal_exit_cleanup": "terminate-process-group-before-unlock",
       "asset": "install.sh",
-      "release_tag": "rust-v0.144.3",
+      "release_tag": "rust-v0.144.4",
       "sha256": "1154e9daf713aacd1534efca8042bfd6665ad24bc1d1dfd86b8f439fe60a7a5d",
       "size_bytes": 25133,
-      "url": "https://github.com/openai/codex/releases/download/rust-v0.144.3/install.sh"
+      "url": "https://github.com/openai/codex/releases/download/rust-v0.144.4/install.sh"
     },
     "layout": {
       "code_mode_host": "packages/standalone/current/bin/codex-code-mode-host",
@@ -154,7 +154,7 @@
       "macos",
       "linux"
     ],
-    "tested_version": "0.144.3"
+    "tested_version": "0.144.4"
   },
   "transaction_policy": {
     "agents_override_blocked_commands": [

build/release-evidence.json

@@ -2,18 +2,18 @@
   "schema_version": 2,
   "module": {
     "repository": "NDDev-it-com/nddev-codex-app",
-    "setup_digest": "sha256:5a4b6a2b19bf8d1d50accd5be0f30395e6d6c7f9213b9c620d0ea015b59f7d7b"
+    "setup_digest": "sha256:f1a44eb07f3990ff67713047d822de9a9a0dec82bdea67ce2ce35d9852584c6c"
   },
   "harness": {
     "repository": "NDDev-it-com/nddev-harnesses",
     "commit": "4a87355de2bf4019fcd106a73778c72ab99fac50"
   },
   "adapter": {
     "id": "codex",
-    "version": "0.3.2"
+    "version": "0.3.3"
   },
   "vendor": {
-    "cli_version": "0.144.3",
+    "cli_version": "0.144.4",
     "permission_profiles_since": "0.138.0"
   },
   "platforms": [
@@ -29,8 +29,8 @@
     }
   ],
   "lanes": [],
-  "generated_at_utc": "2026-07-14T02:51:49Z",
-  "expires_at_utc": "2027-01-10T02:51:49Z",
+  "generated_at_utc": "2026-07-14T10:44:52Z",
+  "expires_at_utc": "2027-01-10T10:44:52Z",
   "promotion": {
     "decision": "pending",
     "waivers": []

build/version.json

@@ -1,7 +1,7 @@
 {
-  "build_version": "0.3.2",
+  "build_version": "0.3.3",
   "codex_permission_profiles_since": "0.138.0",
-  "codex_cli_tested": "0.144.3",
+  "codex_cli_tested": "0.144.4",
   "nddev_builder_plugin_version": "0.3.1",
   "python_requires": ">=3.10",
   "runtime_baseline_ref": "references/codex-baseline.json",

cli-tools/nddev_codex.py

@@ -42,7 +42,7 @@
 OWNER_DIRECTORY_MODE = 0o700
 METADATA_MAX_BYTES = 256 * 1024
 MANAGED_PAYLOAD_MAX_BYTES = 8 * 1024 * 1024
-TESTED_CODEX_VERSION = "0.144.3"
+TESTED_CODEX_VERSION = "0.144.4"
 INSTALLER_RELEASE_TAG = f"rust-v{TESTED_CODEX_VERSION}"
 INSTALLER_NAME = "install.sh"
 INSTALLER_URL = (
@@ -54,23 +54,23 @@
     f"https://api.github.com/repos/openai/codex/releases/tags/{INSTALLER_RELEASE_TAG}"
 )
 PACKAGE_CHECKSUM_ASSET = "codex-package_SHA256SUMS"
-PACKAGE_CHECKSUM_SHA256 = "8cf3a2935c0bda2de4a0c6e6597765ae770f9222ae5ff814b36d4a78ceb34446"
+PACKAGE_CHECKSUM_SHA256 = "09e949a00cbcbd95d5a3d3bd6c7647e38965e944a3f7d2eb148781d3a488414a"
 PACKAGE_ASSETS = {
     "aarch64-apple-darwin": (
         "codex-package-aarch64-apple-darwin.tar.gz",
-        "9f74eca4a113f972be6187f0fc1c6bcf0d2831b604ed59c217c926ec512fef1f",
+        "312e6fa2826596fb23cc1193c30d51902b6522c36ccc43b36417590e0ebd533d",
     ),
     "x86_64-apple-darwin": (
         "codex-package-x86_64-apple-darwin.tar.gz",
-        "35a1c886f00ec70c350773d88ef4f7cb083510ae682ff90ac687779ecb75bf88",
+        "666671fbe761fe1fd57d74e725c5a306729f81f4fbefc16a01a0595e69864d41",
     ),
     "aarch64-unknown-linux-musl": (
         "codex-package-aarch64-unknown-linux-musl.tar.gz",
-        "d91c6354ec1efc125068056c02bc8cffbc0a53fd4ecfebc3e5f1771765fc7fa3",
+        "b1bc561a5bf74f9c5767c698275ae8043cee2ce45341098048b0b0b8b4e2cfc5",
     ),
     "x86_64-unknown-linux-musl": (
         "codex-package-x86_64-unknown-linux-musl.tar.gz",
-        "1c3c1f1f636da56a197ce0b5084d44b86f58f0fb32983278fa55c2544d221af4",
+        "d0a7bdb2ca821c9bb5f4cc2fb11a4ed96025db63b20d1bddf1e632361a108220",
     ),
 }
 INSTALLER_MAX_BYTES = 64 * 1024

config/nddev-contract.json

@@ -85,7 +85,7 @@
     "json_manager_errors_supported": true,
     "manager_command": "python3 cli-tools/nddev_codex.py launch --target <absolute-target> -- [args...]",
     "requires_clean_managed_target": true,
-    "required_version": "0.144.3",
+    "required_version": "0.144.4",
     "streams_child_stdio": true,
     "successful_child_output_wrapped": false,
     "target_environment_scope": "child-process-only",
@@ -153,10 +153,10 @@
     "installer": {
       "abnormal_exit_cleanup": "terminate-process-group-before-unlock",
       "asset": "install.sh",
-      "release_tag": "rust-v0.144.3",
+      "release_tag": "rust-v0.144.4",
       "sha256": "1154e9daf713aacd1534efca8042bfd6665ad24bc1d1dfd86b8f439fe60a7a5d",
       "size_bytes": 25133,
-      "url": "https://github.com/openai/codex/releases/download/rust-v0.144.3/install.sh"
+      "url": "https://github.com/openai/codex/releases/download/rust-v0.144.4/install.sh"
     },
     "layout": {
       "code_mode_host": "packages/standalone/current/bin/codex-code-mode-host",
@@ -173,7 +173,7 @@
       "macos",
       "linux"
     ],
-    "tested_version": "0.144.3"
+    "tested_version": "0.144.4"
   },
   "source_root": "setups",
   "version_ref": "build/version.json"

plugins/nddev-builder/scripts/check_codex_artifact.py

@@ -288,8 +288,8 @@
     "xxxxxxxx",
 }
 
-# Top-level properties from the official Codex 0.144.3 ConfigToml schema:
-# https://github.com/openai/codex/blob/rust-v0.144.3/codex-rs/core/config.schema.json
+# Top-level properties from the official Codex 0.144.4 ConfigToml schema:
+# https://github.com/openai/codex/blob/rust-v0.144.4/codex-rs/core/config.schema.json
 # Validation is intentionally top-level only. Named tables such as
 # mcp_servers.<name>, permissions.<name>, plugins, marketplaces, projects, and
 # agents have dynamic keys and are validated by Codex or focused checkers.
@@ -2819,7 +2819,7 @@ def _validate_config_file(path: Path, *, budget: ScanBudget | None = None) -> Ar
             path,
             payload,
             CONFIG_TOP_LEVEL_KEYS,
-            "Codex 0.144.3 config top-level",
+            "Codex 0.144.4 config top-level",
         )
     return report