Sync upstream rust-v0.64.0 (#66)

## Upstream Sync

This PR syncs changes from upstream release `rust-v0.64.0`.

### Summary

- **Upstream tag:** `rust-v0.64.0`
- **Commits to merge:** ~183
- **Release notes:** [GitHub
Release](https://github.com/openai/codex/releases/tag/rust-v0.64.0)

### Workflow Sanitization

The following upstream workflows had their triggers replaced with
\`workflow_dispatch\`:
- `cargo-deny.yml`
- `ci.yml`
- `cla.yml`
- `close-stale-contributor-prs.yml`
- `codespell.yml`
- `issue-deduplicator.yml`
- `issue-labeler.yml`
- `rust-release.yml`
- `sdk.yml`
- `shell-tool-mcp-ci.yml`
- `shell-tool-mcp.yml`


### Merge Instructions

1. Review the changes for conflicts with our ACP fork work
2. Resolve any merge conflicts:
   ```bash
   git checkout dev
   git merge sync/upstream-v0.64.0 --no-ff
   # Resolve conflicts if any
   ```
3. Run tests: `cd codex-rs && cargo test`
4. Update snapshot tests if needed: `cargo insta review`
5. Mark as ready for review when satisfied

### After Merge

- Delete the `sync/upstream-v0.64.0` branch
- Consider tagging a new nori release if significant changes

---------

Signed-off-by: Fahad <fahad@2doapp.com>
Signed-off-by: lionelchg <lionel.cheng@hotmail.fr>
Signed-off-by: kyuheon-kr <kyuheon.kr@gmail.com>
Signed-off-by: lionel-oai <lionel@openai.com>
Signed-off-by: Dmitri Khokhlov <dkhokhlov@cribl.io>
Signed-off-by: Yorling <shallowcloud@yeah.net>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>
Co-authored-by: iceweasel-oai <iceweasel@openai.com>
Co-authored-by: Dylan Hurd <dylan.hurd@openai.com>
Co-authored-by: jif-oai <jif@openai.com>
Co-authored-by: Anton Panasenko <apanasenko@openai.com>
Co-authored-by: simister <simcoea@gmail.com>
Co-authored-by: Eric Traut <etraut@openai.com>
Co-authored-by: Owen Lin <owenlin0@gmail.com>
Co-authored-by: Jeremy Rose <172423086+nornagon-openai@users.noreply.github.com>
Co-authored-by: zhao-oai <zhao@openai.com>
Co-authored-by: Celia Chen <celia@openai.com>
Co-authored-by: pakrym-oai <pakrym@openai.com>
Co-authored-by: ae <ae@openai.com>
Co-authored-by: Michael Bolin <mbolin@openai.com>
Co-authored-by: Thibault Sottiaux <tibo@openai.com>
Co-authored-by: Beehive Innovations <guidedways@users.noreply.github.com>
Co-authored-by: Lionel Cheng <60159831+lionelchg@users.noreply.github.com>
Co-authored-by: hanson-openai <hanson@openai.com>
Co-authored-by: LIHUA <1017343802@qq.com>
Co-authored-by: Josh McKinney <joshka@openai.com>
Co-authored-by: Kyuheon Kim <65669461+kyuheon-kr@users.noreply.github.com>
Co-authored-by: lionel-oai <lionel@openai.com>
Co-authored-by: Dmitri Khokhlov <dkhokhlov@gmail.com>
Co-authored-by: Weiller Carvalho <99501431+weillercarvalho@users.noreply.github.com>
Co-authored-by: Xiao-Yong Jin <jinxiaoyong@gmail.com>
Co-authored-by: Yorling <shallowcloud@yeah.net>
Co-authored-by: Matthew Zeng <mzeng@openai.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas Klausner <wiz@gatalith.at>
Co-authored-by: Gabriel Peal <gpeal@users.noreply.github.com>
Co-authored-by: Priyadarshini Tamilselvan <priya61197@gmail.com>
Co-authored-by: lionelchg <lionel.cheng@hotmail.fr>
Co-authored-by: Job Chong <jobchong@users.noreply.github.com>
Co-authored-by: Ali Towaiji <145403626+Towaiji@users.noreply.github.com>
Co-authored-by: Albert O'Shea <albertoshea2@gmail.com>
Co-authored-by: Kaden Gruizenga <kjgruiz@pm.me>
Co-authored-by: linuxmetel <61399424+linuxmetel@users.noreply.github.com>
Co-authored-by: Steve Mostovoy <stevemostovoy@openai.com>
Co-authored-by: Manoel Calixto <manoel.calixto.neto@gmail.com>
Co-authored-by: Colin Young <ccy@openai.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 41 people

.github/workflows/cargo-deny.yml

@@ -0,0 +1,22 @@
+name: cargo-deny
+
+on: workflow_dispatch
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./codex-rs
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Run cargo-deny
+        uses: EmbarkStudios/cargo-deny-action@v1
+        with:
+          rust-version: stable
+          manifest-path: ./codex-rs/Cargo.toml

.github/workflows/rust-ci.yml

@@ -35,11 +35,33 @@ jobs:
           targets: ${{ matrix.target }}
           components: clippy
 
-      - name: Install nightly rustfmt
-        run: rustup toolchain install nightly --component rustfmt --profile minimal
+      - name: Compute lockfile hash
+        id: lockhash
+        working-directory: codex-rs
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "hash=$(sha256sum Cargo.lock | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+          echo "toolchain_hash=$(sha256sum rust-toolchain.toml | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      # Explicit cache restore: split cargo home vs target, so we can
+      # avoid caching the large target dir on the gnu-dev job.
+      - name: Restore cargo home cache
+        id: cache_cargo_home_restore
+        uses: actions/cache/restore@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-home-${{ matrix.runner }}-${{ matrix.target }}-${{ matrix.profile }}-${{ steps.lockhash.outputs.hash }}-${{ steps.lockhash.outputs.toolchain_hash }}
+          restore-keys: |
+            cargo-home-${{ matrix.runner }}-${{ matrix.target }}-${{ matrix.profile }}-
 
-      # sccache setup
+      # Install and restore sccache cache
       - name: Install sccache
+        if: ${{ env.USE_SCCACHE == 'true' }}
         uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2
         with:
           tool: sccache

.github/workflows/shell-tool-mcp-ci.yml

@@ -0,0 +1,36 @@
+name: shell-tool-mcp CI
+
+on: workflow_dispatch
+
+env:
+  NODE_VERSION: 22
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Format check
+        run: pnpm --filter @openai/codex-shell-tool-mcp run format
+
+      - name: Run tests
+        run: pnpm --filter @openai/codex-shell-tool-mcp test
+
+      - name: Build
+        run: pnpm --filter @openai/codex-shell-tool-mcp run build