Add proot and Python to first-run setup, auto-changelog in CI

- Install proot + libtalloc from Termux repos during bootstrap so
  the codex agent can use proot for dpkg path remapping
- Pre-install Python 3.12 + pip during first-run setup
- CI release notes now auto-generated from git commit messages
  since the previous release tag

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: friuns

.github/workflows/build-apk.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -59,6 +61,22 @@ jobs:
           name: codexapp
           path: android/app/build/outputs/apk/debug/codexapp.apk
 
+      - name: Generate changelog
+        if: github.ref == 'refs/heads/android'
+        id: changelog
+        run: |
+          PREV_TAG=$(git tag --sort=-v:refname | head -1)
+          if [ -n "$PREV_TAG" ]; then
+            CHANGES=$(git log "$PREV_TAG"..HEAD --pretty=format:"- %s" --reverse)
+          else
+            CHANGES=$(git log --pretty=format:"- %s" --reverse -20)
+          fi
+          {
+            echo "notes<<CHANGELOG_EOF"
+            echo "$CHANGES"
+            echo "CHANGELOG_EOF"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Create Release
         if: github.ref == 'refs/heads/android'
         uses: softprops/action-gh-release@v2
@@ -68,9 +86,12 @@ jobs:
           body: |
             🔥 **Codex App** — OpenAI Codex on Android
 
-            📱 Install the APK on any ARM64 Android 7.0+ device.
-            No root required.
+            📱 Install the APK on any ARM64 Android 7.0+ device. No root required.
+
+            ### Changes
+            ${{ steps.changelog.outputs.notes }}
 
+            ---
             Built from commit ${{ github.sha }}
           files: android/app/build/outputs/apk/debug/codexapp.apk
           draft: false

android/app/src/main/java/com/codex/mobile/CodexServerManager.kt

@@ -79,6 +79,11 @@ class CodexServerManager(private val context: Context) {
 
     // ── Install checks ─────────────────────────────────────────────────────
 
+    fun isProotInstalled(): Boolean {
+        val paths = BootstrapInstaller.getPaths(context)
+        return File(paths.prefixDir, "bin/proot").exists()
+    }
+
     fun isNodeInstalled(): Boolean {
         val paths = BootstrapInstaller.getPaths(context)
         return File(paths.prefixDir, "bin/node").exists()
@@ -177,6 +182,123 @@ WEOF
         return isNodeInstalled()
     }
 
+    /**
+     * Install proot from the Termux repository. proot uses ptrace to
+     * intercept filesystem syscalls and remap hardcoded Termux paths
+     * (e.g. /data/data/com.termux/files/usr) to our actual prefix,
+     * enabling dpkg, apt-get install, and other tools that have
+     * compiled-in path references.
+     */
+    fun installProot(onProgress: (String) -> Unit): Boolean {
+        val paths = BootstrapInstaller.getPaths(context)
+        val prefix = paths.prefixDir
+        val termuxPrefix = "/data/data/com.termux/files/usr"
+
+        onProgress("Downloading proot…")
+
+        val downloadCmd = """
+            cd $prefix/tmp &&
+            apt-get update --allow-insecure-repositories 2>&1;
+            apt-get download --allow-unauthenticated proot libtalloc 2>&1
+        """.trimIndent()
+
+        val dlCode = runInPrefix(downloadCmd, onOutput = { onProgress(it) })
+        if (dlCode != 0) {
+            Log.e(TAG, "apt-get download proot failed with code $dlCode")
+            return false
+        }
+
+        onProgress("Extracting proot…")
+        val extractCmd = """
+            cd $prefix/tmp &&
+            mkdir -p _proot_stage &&
+            for deb in proot*.deb libtalloc*.deb; do
+                [ -f "${'$'}deb" ] && dpkg-deb -x "${'$'}deb" _proot_stage/ 2>&1
+            done &&
+            if [ -d "_proot_stage$termuxPrefix" ]; then
+                cp -a _proot_stage$termuxPrefix/* "$prefix/" 2>&1
+            elif [ -d "_proot_stage/usr" ]; then
+                cp -a _proot_stage/usr/* "$prefix/" 2>&1
+            fi &&
+            chmod 700 "$prefix/bin/proot" 2>/dev/null
+            rm -rf _proot_stage proot*.deb libtalloc*.deb 2>/dev/null
+            echo "proot installed"
+        """.trimIndent()
+
+        val extractCode = runInPrefix(extractCmd, onOutput = { onProgress(it) })
+        if (extractCode != 0) {
+            Log.e(TAG, "proot extract failed with code $extractCode")
+            return false
+        }
+
+        return isProotInstalled()
+    }
+
+    fun isPythonInstalled(): Boolean {
+        val paths = BootstrapInstaller.getPaths(context)
+        return File(paths.prefixDir, "bin/python3").exists() ||
+            File(paths.prefixDir, "bin/python").exists()
+    }
+
+    /**
+     * Install Python using proot to handle dpkg's hardcoded Termux paths.
+     * proot bind-mounts our prefix onto the compiled-in Termux prefix so
+     * dpkg postinst scripts and shared library lookups resolve correctly.
+     */
+    fun installPython(onProgress: (String) -> Unit): Boolean {
+        val paths = BootstrapInstaller.getPaths(context)
+        val prefix = paths.prefixDir
+        val termuxPrefix = "/data/data/com.termux/files/usr"
+
+        onProgress("Downloading Python packages…")
+
+        val downloadCmd = """
+            cd $prefix/tmp &&
+            apt-get update --allow-insecure-repositories 2>&1;
+            apt-get download --allow-unauthenticated python python-pip 2>&1
+        """.trimIndent()
+
+        val dlCode = runInPrefix(downloadCmd, onOutput = { onProgress(it) })
+        if (dlCode != 0) {
+            Log.e(TAG, "apt-get download python failed with code $dlCode")
+        }
+
+        onProgress("Extracting Python…")
+        val extractCmd = """
+            cd $prefix/tmp &&
+            mkdir -p _python_stage &&
+            for deb in python*.deb; do
+                [ -f "${'$'}deb" ] && echo "Extracting ${'$'}deb..." && dpkg-deb -x "${'$'}deb" _python_stage/ 2>&1
+            done &&
+            if [ -d "_python_stage$termuxPrefix" ]; then
+                cp -a _python_stage$termuxPrefix/* "$prefix/" 2>&1
+            elif [ -d "_python_stage/usr" ]; then
+                cp -a _python_stage/usr/* "$prefix/" 2>&1
+            fi &&
+            chmod 700 "$prefix/bin/python"* 2>/dev/null
+            chmod 700 "$prefix/bin/pip"* 2>/dev/null
+            rm -rf _python_stage python*.deb 2>/dev/null
+            echo "Python installed"
+        """.trimIndent()
+
+        val extractCode = runInPrefix(extractCmd, onOutput = { onProgress(it) })
+        if (extractCode != 0) {
+            Log.e(TAG, "Python extract failed with code $extractCode")
+            return false
+        }
+
+        // Create python3 wrapper to handle shebang issues
+        val fixCmd = """
+            if [ -f "$prefix/bin/python3" ] && [ ! -f "$prefix/bin/python" ]; then
+                ln -sf python3 "$prefix/bin/python"
+            fi
+            echo "Python ready"
+        """.trimIndent()
+        runInPrefix(fixCmd, onOutput = { onProgress(it) })
+
+        return isPythonInstalled()
+    }
+
     fun installCodex(onProgress: (String) -> Unit): Boolean {
         val paths = BootstrapInstaller.getPaths(context)
         val prefix = paths.prefixDir

android/app/src/main/java/com/codex/mobile/MainActivity.kt

@@ -139,6 +139,16 @@ class MainActivity : AppCompatActivity() {
         }
         updateStatus("Environment ready")
 
+        // Step 1b: Install proot (needed for dpkg/apt-get path remapping)
+        if (!serverManager.isProotInstalled()) {
+            updateStatus("Installing proot…", "Needed for package management")
+            val prootOk = serverManager.installProot { msg -> updateDetail(msg) }
+            if (!prootOk) {
+                throw RuntimeException("Failed to install proot")
+            }
+        }
+        updateStatus("proot ready")
+
         // Step 2: Install Node.js
         if (!serverManager.isNodeInstalled()) {
             updateStatus("Installing Node.js (first run)…", "This may take a few minutes")
@@ -149,6 +159,15 @@ class MainActivity : AppCompatActivity() {
         }
         updateStatus("Node.js ready")
 
+        // Step 2b: Install Python
+        if (!serverManager.isPythonInstalled()) {
+            updateStatus("Installing Python…")
+            val pyOk = serverManager.installPython { msg -> updateDetail(msg) }
+            if (!pyOk) {
+                Log.w(TAG, "Python install failed — continuing without it")
+            }
+        }
+
         // Step 3: Install Codex CLI
         if (!serverManager.isCodexInstalled()) {
             updateStatus("Installing Codex CLI…", "This may take a few minutes")