Add Codex CLI issue 14860 fix package

GitLaughs · GitLaughs · commit 8d7c11151ead · 2026-05-19T16:26:10.000+08:00
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,16 @@
+.DS_Store
+*.o
+*.so
+*.dylib
+*.dll
+*.exe
+codex
+codex.bak-*
+target/
+.cargo-target/
+.cargo-home/
+.rustup-home/
+source/
+vendor/
+*.log
+
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -0,0 +1,90 @@
+# Codex CLI 0.131.0 issue #14860 fix package
+
+This repository contains a small, source-based patch package for Codex CLI
+0.131.0. It does not ship or replace Codex with any third-party binary.
+
+The patch follows the Nopiskl issue #14860 approach:
+
+- set `reqwest::ClientBuilder::tcp_user_timeout` to 120 seconds in the default
+  Codex HTTP client
+- keep the installed CLI version at `codex-cli 0.131.0`
+- provide a CentOS 7 compatibility shim for the final link step when older
+  system headers/libc do not expose symbols needed by transitive native code
+
+## Contents
+
+- `patches/codex-cli-0.131.0-issue14860-tcp-user-timeout.patch`
+  - The source patch for `codex-rs/login/src/auth/default_client.rs`.
+- `src/centos7_compat.c`
+  - Link-time compatibility symbols used on CentOS 7: `memfd_create`,
+    `le16toh`, and `be16toh`.
+- `scripts/build_codex_0_131_0_with_issue14860_fix.sh`
+  - Applies the patch if needed and builds `codex-cli` from an official
+    `rust-v0.131.0` source checkout.
+- `scripts/install_patched_codex.sh`
+  - Backs up the currently installed Codex vendor binary and installs the
+    locally built replacement.
+- `docs/centos7-build-notes.md`
+  - Notes from the CentOS 7 build and install flow.
+
+## Prerequisites
+
+Use an official Codex `rust-v0.131.0` source checkout. This package assumes the
+checkout layout contains `codex-rs/`.
+
+On CentOS 7, install the system build dependencies:
+
+```bash
+yum install -y openssl-devel perl-IPC-Cmd cmake
+```
+
+Use a local Rust/Cargo installation for the source tree instead of modifying
+global shell configuration. The tested build used Rust 1.93.0 with:
+
+```bash
+RUSTUP_HOME=/path/to/codex-rust-v0.131.0-src/.rustup-home
+CARGO_HOME=/path/to/codex-rust-v0.131.0-src/.cargo-home
+```
+
+## Build
+
+From this repository:
+
+```bash
+SOURCE_ROOT=/path/to/codex-rust-v0.131.0-src \
+RUSTUP_HOME=/path/to/codex-rust-v0.131.0-src/.rustup-home \
+CARGO_HOME=/path/to/codex-rust-v0.131.0-src/.cargo-home \
+CARGO_TARGET_DIR=/path/to/codex-rust-v0.131.0-src/.cargo-target \
+scripts/build_codex_0_131_0_with_issue14860_fix.sh
+```
+
+Expected verification:
+
+```bash
+/path/to/codex-rust-v0.131.0-src/.cargo-target/release/codex --version
+# codex-cli 0.131.0
+```
+
+## Install
+
+The install script must run as a user that can write the installed Codex vendor
+binary path.
+
+```bash
+SOURCE_ROOT=/path/to/codex-rust-v0.131.0-src \
+INSTALL_PATH=/usr/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex \
+scripts/install_patched_codex.sh
+```
+
+The script creates a timestamped backup beside the original binary before
+installing the patched binary with mode `755`.
+
+## Verified local result
+
+The local patched binary verified as:
+
+```text
+codex-cli 0.131.0
+```
+
+`codex app-server --help` also returned successfully.
diff --git a/docs/centos7-build-notes.md b/docs/centos7-build-notes.md
@@ -0,0 +1,56 @@
+# CentOS 7 build notes
+
+## Goal
+
+Build Codex CLI 0.131.0 from official `rust-v0.131.0` source with only the
+issue #14860 timeout patch, then install the resulting binary over the local
+Codex vendor binary after creating a backup.
+
+## System dependencies
+
+The successful CentOS 7 build required:
+
+```bash
+yum install -y openssl-devel perl-IPC-Cmd cmake
+```
+
+The temporary vendored OpenSSL Cargo changes were not needed and should be
+removed before the final build.
+
+## Source patch
+
+`codex-rs/login/src/auth/default_client.rs` was changed to:
+
+- import `std::time::Duration`
+- define `DEFAULT_TCP_USER_TIMEOUT` as 120 seconds
+- call `builder.tcp_user_timeout(DEFAULT_TCP_USER_TIMEOUT)` in
+  `try_build_reqwest_client()`
+
+## Link compatibility
+
+On the local CentOS 7 system the final `codex-cli` link failed with missing
+symbols:
+
+- `le16toh`
+- `be16toh`
+- `memfd_create`
+
+These came from transitive native code (`tree-sitter` and V8) and old system
+headers/libc. The build script compiles `src/centos7_compat.c` and passes the
+resulting object as a final `rustc` link argument.
+
+## Local verification
+
+The patched local install was verified with:
+
+```bash
+codex --version
+codex app-server --help
+```
+
+Expected version output:
+
+```text
+codex-cli 0.131.0
+```
+
diff --git a/patches/codex-cli-0.131.0-issue14860-tcp-user-timeout.patch b/patches/codex-cli-0.131.0-issue14860-tcp-user-timeout.patch
@@ -0,0 +1,31 @@
+diff --git a/codex-rs/login/src/auth/default_client.rs b/codex-rs/login/src/auth/default_client.rs
+index ee51edf..23450c1 100644
+--- a/codex-rs/login/src/auth/default_client.rs
++++ b/codex-rs/login/src/auth/default_client.rs
+@@ -16,6 +16,7 @@ use reqwest::header::USER_AGENT;
+ use std::sync::LazyLock;
+ use std::sync::Mutex;
+ use std::sync::RwLock;
++use std::time::Duration;
+ 
+ /// Set this to add a suffix to the User-Agent string.
+ ///
+@@ -36,6 +37,7 @@ pub static USER_AGENT_SUFFIX: LazyLock<Mutex<Option<String>>> = LazyLock::new(||
+ pub const DEFAULT_ORIGINATOR: &str = "codex_cli_rs";
+ pub const CODEX_INTERNAL_ORIGINATOR_OVERRIDE_ENV_VAR: &str = "CODEX_INTERNAL_ORIGINATOR_OVERRIDE";
+ pub const RESIDENCY_HEADER_NAME: &str = "x-openai-internal-codex-residency";
++const DEFAULT_TCP_USER_TIMEOUT: Duration = Duration::from_secs(120);
+ 
+ pub use codex_config::ResidencyRequirement;
+ 
+@@ -221,6 +223,9 @@ pub fn build_reqwest_client() -> reqwest::Client {
+ /// this method directly.
+ pub fn try_build_reqwest_client() -> Result<reqwest::Client, BuildCustomCaTransportError> {
+     let mut builder = reqwest::Client::builder().default_headers(default_headers());
++    // reqwest defaults tcp_user_timeout to 30s on Linux-family targets, which is too short
++    // for long-running unary requests such as remote compaction.
++    builder = builder.tcp_user_timeout(DEFAULT_TCP_USER_TIMEOUT);
+     if is_sandboxed() {
+         builder = builder.no_proxy();
+     }
+
diff --git a/scripts/build_codex_0_131_0_with_issue14860_fix.sh b/scripts/build_codex_0_131_0_with_issue14860_fix.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SOURCE_ROOT="${SOURCE_ROOT:-${REPO_DIR}/../codex-rust-v0.131.0-src}"
+CODEX_RS="${SOURCE_ROOT}/codex-rs"
+RUSTUP_HOME="${RUSTUP_HOME:-${SOURCE_ROOT}/.rustup-home}"
+CARGO_HOME="${CARGO_HOME:-${SOURCE_ROOT}/.cargo-home}"
+CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-${SOURCE_ROOT}/.cargo-target}"
+CARGO_BIN="${CARGO_BIN:-${CARGO_HOME}/bin/cargo}"
+COMPAT_SRC="${REPO_DIR}/src/centos7_compat.c"
+COMPAT_DIR="${CODEX_RS}/target_compat"
+COMPAT_OBJ="${COMPAT_DIR}/centos7_compat.o"
+PATCH_FILE="${REPO_DIR}/patches/codex-cli-0.131.0-issue14860-tcp-user-timeout.patch"
+
+if [[ ! -d "${CODEX_RS}" ]]; then
+  echo "missing codex-rs directory: ${CODEX_RS}" >&2
+  exit 1
+fi
+
+if [[ ! -x "${CARGO_BIN}" ]]; then
+  echo "missing cargo binary: ${CARGO_BIN}" >&2
+  exit 1
+fi
+
+cd "${SOURCE_ROOT}"
+
+if ! grep -q "DEFAULT_TCP_USER_TIMEOUT" codex-rs/login/src/auth/default_client.rs; then
+  patch -p1 < "${PATCH_FILE}"
+fi
+
+mkdir -p "${COMPAT_DIR}"
+cp "${COMPAT_SRC}" "${COMPAT_DIR}/centos7_compat.c"
+cc -fPIC -c "${COMPAT_DIR}/centos7_compat.c" -o "${COMPAT_OBJ}"
+
+cd "${CODEX_RS}"
+
+env \
+  RUSTUP_HOME="${RUSTUP_HOME}" \
+  CARGO_HOME="${CARGO_HOME}" \
+  CARGO_TARGET_DIR="${CARGO_TARGET_DIR}" \
+  CFLAGS="${CFLAGS:--fno-builtin-memcmp}" \
+  CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO:-false}" \
+  CARGO_PROFILE_RELEASE_CODEGEN_UNITS="${CARGO_PROFILE_RELEASE_CODEGEN_UNITS:-16}" \
+  "${CARGO_BIN}" rustc -p codex-cli --release --bin codex -- \
+    -C "link-arg=${COMPAT_OBJ}"
+
+"${CARGO_TARGET_DIR}/release/codex" --version
diff --git a/scripts/install_patched_codex.sh b/scripts/install_patched_codex.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SOURCE_ROOT="${SOURCE_ROOT:-${REPO_DIR}/../codex-rust-v0.131.0-src}"
+CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-${SOURCE_ROOT}/.cargo-target}"
+BUILT_CODEX="${BUILT_CODEX:-${CARGO_TARGET_DIR}/release/codex}"
+INSTALL_PATH="${INSTALL_PATH:-/usr/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex}"
+
+if [[ ! -x "${BUILT_CODEX}" ]]; then
+  echo "missing built codex binary: ${BUILT_CODEX}" >&2
+  exit 1
+fi
+
+if [[ ! -f "${INSTALL_PATH}" ]]; then
+  echo "missing installed codex binary: ${INSTALL_PATH}" >&2
+  exit 1
+fi
+
+timestamp="$(date +%Y%m%d-%H%M%S)"
+backup_path="${INSTALL_PATH}.bak-${timestamp}"
+
+cp -a "${INSTALL_PATH}" "${backup_path}"
+install -m 755 "${BUILT_CODEX}" "${INSTALL_PATH}"
+
+echo "backup: ${backup_path}"
+echo "installed: ${INSTALL_PATH}"
+"${INSTALL_PATH}" --version
diff --git a/src/centos7_compat.c b/src/centos7_compat.c
@@ -0,0 +1,34 @@
+#include <stdint.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#ifndef SYS_memfd_create
+#ifdef __NR_memfd_create
+#define SYS_memfd_create __NR_memfd_create
+#elif defined(__x86_64__)
+#define SYS_memfd_create 319
+#else
+#error "SYS_memfd_create is not defined for this target"
+#endif
+#endif
+
+uint16_t le16toh(uint16_t value) {
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+    return value;
+#else
+    return __builtin_bswap16(value);
+#endif
+}
+
+uint16_t be16toh(uint16_t value) {
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+    return __builtin_bswap16(value);
+#else
+    return value;
+#endif
+}
+
+int memfd_create(const char *name, unsigned int flags) {
+    return (int)syscall(SYS_memfd_create, name, flags);
+}
+
