Merge branch 'main' into sd-cli

Resolve conflict in src/index.ts caused by agentclientprotocol#135 (codex app-server is
now started via node when using the bundled codex.js). Drop the local
getCodexPath() helper and pass process.env["CODEX_PATH"] (possibly
undefined) to both startCodexConnection and runCodexCli, mirroring
the same bundled-path + node-spawn fallback inside runCodexCli.

Author: SteffenDE

.github/workflows/ci.yml

@@ -6,45 +6,26 @@ on:
   pull_request:
     branches: [main]
 
-jobs:
-  typecheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-      - run: npm ci
-      - run: npm run typecheck
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-      - run: npm ci
-      - run: npm test
-      - name: Run e2e tests
-        env:
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        run:
-          npm run test:e2e
+permissions: {}
 
-  build:
+jobs:
+  ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
-      - run: npm ci
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
-      - run: npm run bundle:all
-      - uses: actions/upload-artifact@v4
-        with:
-          name: binaries
-          path: dist/bin/
+      - name: Install dependencies
+        run: npm ci
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Run unit tests
+        run: npm test
+      - name: Bundle binaries
+        run: npm run bundle:all

.github/workflows/codex-update.yml

@@ -23,12 +23,15 @@ jobs:
       - name: Check if update is required
         id: check
         run: |
-          if npm outdated "$CODEX_PACKAGE"; then
-            echo "Package is up to date"
+          RAW=$(jq -r --arg pkg "$CODEX_PACKAGE" '.dependencies[$pkg]' package.json)
+          CURRENT="${RAW#[\^~]}"
+          LATEST=$(npm view "$CODEX_PACKAGE" version)
+
+          if [ "$CURRENT" = "$LATEST" ]; then
+            echo "Package is up to date ($CURRENT)"
             exit 0
           fi
 
-          LATEST=$(npm view "$CODEX_PACKAGE" version)
           BRANCH="codex-update/$LATEST"
 
           if git ls-remote --exit-code --heads origin "refs/heads/$BRANCH" >/dev/null 2>&1; then

.github/workflows/e2e.yml

@@ -0,0 +1,33 @@
+name: E2E tests
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+      - name: Configure sandboxing
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes bubblewrap
+          sudo sysctl -w kernel.unprivileged_userns_clone=1
+          if [ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
+      - name: Install dependencies
+        run: npm ci
+      - name: Run e2e tests
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: npm run test:e2e

.github/workflows/publish.yml

@@ -18,6 +18,14 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
+      - name: Configure sandboxing
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes bubblewrap
+          sudo sysctl -w kernel.unprivileged_userns_clone=1
+          if [ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
       - run: npm ci
       - run: npm run typecheck
       - run: npm test
@@ -40,7 +48,7 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
       - run: npm ci
-      - run: npm publish --access public --tag beta
+      - run: npm publish --access public
 
   create-release:
     needs: publish-to-npm

.github/workflows/version-bump.yml

@@ -0,0 +1,43 @@
+name: Version Bump
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Bump x.y.z (triggers release): patch=z, minor=y (resets z), major=x (resets y, z)'
+        type: choice
+        default: 'patch'
+        options:
+          - patch
+          - minor
+          - major
+
+permissions: {}
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub token
+        uses: actions/create-github-app-token@v2
+        id: generate-token
+        with:
+          app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
+          private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      # Bumps the version, commits to main, and pushes a v* tag.
+      # The tag push triggers the Release workflow (publish.yml), which publishes to npm.
+      - name: Bump version
+        run: npm version ${{ inputs.bump }} -m "Release v%s"
+
+      - name: Push commit and tag
+        run: git push --follow-tags origin main

.gitignore

@@ -3,3 +3,4 @@ dist/
 *.log
 .DS_Store
 .idea/
+tmp/

README.md

@@ -4,5 +4,4 @@
 
 ## Documentation
 
-- **[Development Guide](readme-dev.md)** - Setup, configuration, and building binaries
-- **[Release Instructions](release.md)** - How to create a new release
+- **[Development Guide](readme-dev.md)** - Setup, configuration, and building binaries

package-lock.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.40",
+  "version": "0.0.44",
   "description": "",
   "main": "dist/index.js",
   "bin": {
@@ -61,8 +61,8 @@
     "vitest": "^4.0.10"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "^0.16.1",
-    "@openai/codex": "^0.125.0",
+    "@agentclientprotocol/sdk": "^0.21.0",
+    "@openai/codex": "^0.128.0",
     "diff": "^8.0.3",
     "open": "^11.0.0",
     "vscode-jsonrpc": "^8.2.1"