Hello,
Please find attached a patch disabling Codex's internal update
mechanisms on OpenBSD.
Codex is installed and maintained through pkg_add. Allowing its
updater to replace package-owned binaries could bypass the ports
patches and leave the package database inconsistent.
The patch disables self-updates through the CLI, TUI, app-server
daemon and background updater.
Users are directed to pkg_add -u instead.
The daemon itself remains enabled, including its existing lifecycle
management.
Thanks,
David.
Index: devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
diff -N devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs_pkg_update 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,39 @@
+Reject internal daemon update entry points and keep the updater disabled.
+
+Index: codex-rs/app-server-daemon/src/lib.rs
+--- codex-rs/app-server-daemon/src/lib.rs.orig
++++ codex-rs/app-server-daemon/src/lib.rs
+@@ -282,6 +282,10 @@ pub async fn run_pid_update_loop(
+ restore_release: Option<String>,
+ ) -> Result<()> {
+ ensure_supported_platform()?;
++ anyhow::ensure!(
++ !cfg!(target_os = "openbsd"),
++ "the daemon is managed by the system package manager; use pkg_add -u"
++ );
+ #[cfg(windows)]
+ backend::windows::ensure_not_elevated()?;
+ update_loop::run(http_client_factory, restore_release).await
+@@ -291,6 +295,10 @@ pub async fn update(
+ http_client_factory: codex_http_client::HttpClientFactory,
+ ) -> Result<UpdateOutput> {
+ ensure_supported_platform()?;
++ anyhow::ensure!(
++ !cfg!(target_os = "openbsd"),
++ "the daemon is managed by the system package manager; use pkg_add -u"
++ );
+ #[cfg(windows)]
+ backend::windows::ensure_not_elevated()?;
+ update_loop::request_manual_update(&Daemon::from_environment()?, http_client_factory).await
+@@ -892,6 +900,11 @@ impl Daemon {
+
+ async fn ensure_managed_updater(&self, settings: &DaemonSettings) -> Result<bool> {
+ let updater = backend::pid_update_loop_backend(self.backend_paths(settings));
++ if cfg!(target_os = "openbsd") {
++ // Best effort: an invalid stale record must not prevent daemon start.
++ let _ = updater.stop().await;
++ return Ok(false);
++ }
+ if !settings.auto_update_enabled {
+ updater.stop().await?;
+ return Ok(false);
Index: devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
diff -N devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs_pkg_update 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,16 @@
+Reject --from-cli package replacement under the system package manager.
+
+Index: codex-rs/app-server-daemon/src/prepare_install.rs
+--- codex-rs/app-server-daemon/src/prepare_install.rs.orig
++++ codex-rs/app-server-daemon/src/prepare_install.rs
+@@ -52,6 +52,10 @@ pub async fn update_from_cli(
+ confirm: impl FnOnce(&InstallRequest) -> Result<bool>,
+ ) -> Result<Option<crate::UpdateOutput>> {
+ crate::ensure_supported_platform()?;
++ anyhow::ensure!(
++ !cfg!(target_os = "openbsd"),
++ "the daemon is managed by the system package manager; use pkg_add -u"
++ );
+ #[cfg(windows)]
+ crate::backend::windows::ensure_not_elevated()?;
+ let daemon = Daemon::from_environment()?;
Index: devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update
diff -N devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_cli_src_main_rs_pkg_update 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,15 @@
+Reject the package-manager update path with an explicit pkg_add message.
+
+Index: codex-rs/cli/src/main.rs
+--- codex-rs/cli/src/main.rs.orig
++++ codex-rs/cli/src/main.rs
+@@ -874,6 +874,9 @@ fn resolve_windows_update_command_from_p
+ }
+
+ fn run_update_command() -> anyhow::Result<()> {
++ if cfg!(target_os = "openbsd") {
++ anyhow::bail!("Codex is managed by OpenBSD packages; update with pkg_add -u, then restart the daemon");
++ }
+ #[cfg(debug_assertions)]
+ {
+ anyhow::bail!(
Index: devel/codex/patches/patch-codex-rs_tui_src_update_action_rs
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_tui_src_update_action_rs
diff -N devel/codex/patches/patch-codex-rs_tui_src_update_action_rs
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_tui_src_update_action_rs 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,13 @@
+Index: codex-rs/tui/src/update_action.rs
+--- codex-rs/tui/src/update_action.rs.orig
++++ codex-rs/tui/src/update_action.rs
+@@ -81,6 +81,9 @@ impl UpdateAction {
+
+ #[cfg(not(debug_assertions))]
+ pub fn get_update_action() -> Option<UpdateAction> {
++ if cfg!(target_os = "openbsd") {
++ return None; // Updates are managed by pkg_add, never an upstream installer.
++ }
+ UpdateAction::from_install_context(InstallContext::current())
+ }
+
Index: devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs
===================================================================
RCS file: devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs
diff -N devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs 18 Oct 2026 16:10:35 -0000
@@ -0,0 +1,28 @@
+Keep the daemon enabled while directing package updates to pkg_add.
+Do not offer self-installation actions for a distributor-owned executable.
+
+Index: codex-rs/tui/src/app/daemon_menu.rs
+--- codex-rs/tui/src/app/daemon_menu.rs.orig
++++ codex-rs/tui/src/app/daemon_menu.rs
+@@ -54,6 +54,10 @@ impl App {
+ Some(
+ "Manage this server on its host. Local daemon updates are unavailable for remote connections.",
+ )
++ } else if cfg!(target_os = "openbsd") {
++ Some(
++ "The daemon is installed by the system package manager. Use pkg_add -u, then codex app-server daemon restart.",
++ )
+ } else if self.daemon_cli_executable.is_none() {
+ Some("Run the Codex CLI to manage the daemon from this menu.")
+ } else {
+@@ -160,7 +164,9 @@ impl App {
+ let Some(executable) = &self.daemon_cli_executable else {
+ return;
+ };
+- if matches!(self.app_server_target, AppServerTarget::Remote { .. }) {
++ if matches!(self.app_server_target, AppServerTarget::Remote { .. })
++ || cfg!(target_os = "openbsd")
++ {
+ return;
+ }
+ let mut explanation = match source {
