Kirill A. Korinsky wrote:
On Tue, 20 Oct 2026 08:59:00 +0200,
David Uhden Collado <[email protected]> wrote:
[1 <text/plain; UTF-8 (7bit)>]
Hello,
Please find attached a patch disabling Codex's internal update
mechanisms on OpenBSD.
Codex is installed and maintained through pkg_add. Allowing its
updater to replace package-owned binaries could bypass the ports
patches and leave the package database inconsistent.
The patch disables self-updates through the CLI, TUI, app-server
daemon and background updater.
Users are directed to pkg_add -u instead.
The daemon itself remains enabled, including its existing lifecycle
management.
You haven't tested it before suggested the patch, have you?
Out of the box behaviour:
~ $ codex app-server daemon update
{"status":"unsupported","managedCodexPath":"/usr/local/bin/codex","installedVersion":"0.163.0","runningVersion":"0.163.0","message":"This
command requires a daemon package selected from its managed releases directory."}
Your example confirms that the existing managed-release check works.
However, it only covers one update path.
The patch also addresses:
- "update --from-cli", which can copy and select a local CLI package.
- The background updater, which can be started independently.
- "codex update" and the TUI, which select update mechanisms based
on the detected installation method.
- Daemon startup, ensuring that no managed updater is launched.
I agree that the current installation already rejects several of
these operations. The purpose is to enforce an explicit OpenBSD policy
rather than depend on upstream installation detection continuing to
behave the same way.
It also improves diagnostics. Instead of a generic "unsupported"
status or a message about missing managed releases, users receive
a clear explanation that Codex is managed by OpenBSD packages and
must be updated with pkg_add -u, followed by a daemon restart.
