build: Finish update using codex

Author: ishulgin

.agents/skills/codex-update-compat/references/codex-update-playbook.md

@@ -66,6 +66,7 @@ Approach:
 2. Run focused tests for touched event/file.
 3. Update snapshots only after confirming expected behavior.
 4. Run full suite at end.
+5. Do not change the logic of authentication tests.
 
 ## Known Env-Dependent Failures
 

.github/workflows/codex-update.yml

@@ -62,6 +62,22 @@ jobs:
           npm run generate-types
           git add package.json package-lock.json src/app-server
           git commit -m "Update codex to ${{ env.VERSION }}"
+
+      - name: Finalize update with Codex
+        id: codex-finalize
+        uses: openai/codex-action@v1
+        with:
+          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
+          codex-version: ${{ env.VERSION }}
+          codex-args: '-c shell_environment_policy.inherit=none'
+          output-file: pr-body.md
+          prompt: >
+            Finalize the update using codex-update-compat skill. 
+            Commit the changes, the message should mention that types or/and tests after the update were fixed. 
+            Do not include validation run details, list of commits or any hyperlinks to the final message, mention only what you changed and why.
+
+      - name: Push branch updates
+        run: |
           git push origin "${{ env.BRANCH }}"
 
       - name: Generate GitHub App token
@@ -75,8 +91,10 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
+          echo -e "[What's new](https://github.com/openai/codex/releases/tag/rust-v${{ env.VERSION }})\n\n$(cat pr-body.md 2>/dev/null || true)" > pr-body.md
+
           gh pr create \
             --base main \
             --title "Update codex to ${{ env.VERSION }}" \
-            --body "[What's new](https://github.com/openai/codex/releases/tag/rust-v${{ env.VERSION }})" \
+            --body-file pr-body.md \
             --label "codex-update"

AGENTS.md

@@ -20,7 +20,7 @@
 - Tests live under `src/__tests__/` and use Vitest.
 - Favor event-driven assertions (see `src/__tests__/CodexACPAgent/*`).
 - Prefer snapshot-based tests using `toMatchFileSnapshot()` over inline assertions.
-- When snapshot response data drifts, prefer replacing that response payload with a stable placeholder over asserting fragile fields.
+- When snapshot response data drifts, prefer replacing that response payload with a stable placeholder over asserting fragile fields (except for 'model/list').
 - Focus on behavior and outputs rather than implementation details.
 - Use `/run-codex` skill (`.claude/skills/run-codex/`) to test with real Codex and observe actual events.
 

src/__tests__/CodexACPAgent/CodexAcpClient.test.ts

@@ -58,18 +58,21 @@ describe('ACP server test', { timeout: 40_000 }, () => {
     });
 
     it('should throw error without authentication', async () => {
-        const codexAcpAgent = fixture.getCodexAcpAgent();
+        await overrideCodexHome('cli_auth_credentials_store = "file"', async () => {
+            const authFixture = createTestFixture();
+            const codexAcpAgent = authFixture.getCodexAcpAgent();
 
-        await codexAcpAgent.initialize({protocolVersion: 1});
-        await fixture.getCodexAcpClient().logout();
-        fixture.clearCodexConnectionDump();
+            await codexAcpAgent.initialize({protocolVersion: 1});
+            await authFixture.getCodexAcpClient().logout();
+            authFixture.clearCodexConnectionDump();
 
-        await expect(
-            codexAcpAgent.newSession({cwd: "", mcpServers: []})
-        ).rejects.toThrow("Authentication required");
+            await expect(
+                codexAcpAgent.newSession({cwd: "", mcpServers: []})
+            ).rejects.toThrow("Authentication required");
 
-        const transportDump = fixture.getCodexConnectionDump(ignoredFields);
-        await expect(transportDump).toMatchFileSnapshot("data/auth-failed.json");
+            const transportDump = authFixture.getCodexConnectionDump(ignoredFields);
+            await expect(transportDump).toMatchFileSnapshot("data/auth-failed.json");
+        });
     });
 
     it('should authenticate with key', async () => {