Stop bundling patched zsh in Codex packages (#52213)

## What changed

Remove the patched `zsh` resource from package assembly and macOS signing, along with the `--zsh-bin` and `--zsh-manifest` packaging options.

Delete the standalone `codex-zsh` release workflow, build scripts, and DotSlash manifests. Update package documentation and layout and signing tests to match the remaining resources.

GitOrigin-RevId: 429a8db55048fed7facec89957910206523b6013

.github/actions/build-codex-packages/action.yml

@@ -103,16 +103,6 @@ runs:
           cp "$underscored_pdb" "$expected_pdb"
         done
 
-    - name: Download packaged zsh manifest
-      if: ${{ runner.os != 'Windows' }}
-      shell: bash
-      working-directory: codex-rs
-      run: |
-        set -euo pipefail
-        curl -fsSL \
-          "https://github.com/openai/codex/releases/download/codex-zsh-v0.1.0/codex-zsh" \
-          -o "${RUNNER_TEMP}/codex-zsh"
-
     - name: Archive symbols and strip binaries
       shell: bash
       working-directory: codex-rs
@@ -160,8 +150,6 @@ runs:
             --codex-command-runner-bin "${release_dir}/codex-command-runner.exe"
             --codex-windows-sandbox-setup-bin "${release_dir}/codex-windows-sandbox-setup.exe"
           )
-        else
-          package_args+=(--zsh-manifest "${RUNNER_TEMP}/codex-zsh")
         fi
 
         python3 "${PACKAGE_SOURCE_ROOT}/scripts/build_codex_package.py" \

.github/dotslash-zsh-config.json

@@ -1,32 +0,0 @@
-{
-  "outputs": {
-    "codex-zsh": {
-      "platforms": {
-        "macos-aarch64": {
-          "name": "codex-zsh-aarch64-apple-darwin.tar.gz",
-          "format": "tar.gz",
-          "hash": "sha256",
-          "path": "codex-zsh/bin/zsh"
-        },
-        "macos-x86_64": {
-          "name": "codex-zsh-x86_64-apple-darwin.tar.gz",
-          "format": "tar.gz",
-          "hash": "sha256",
-          "path": "codex-zsh/bin/zsh"
-        },
-        "linux-x86_64": {
-          "name": "codex-zsh-x86_64-unknown-linux-musl.tar.gz",
-          "format": "tar.gz",
-          "hash": "sha256",
-          "path": "codex-zsh/bin/zsh"
-        },
-        "linux-aarch64": {
-          "name": "codex-zsh-aarch64-unknown-linux-musl.tar.gz",
-          "format": "tar.gz",
-          "hash": "sha256",
-          "path": "codex-zsh/bin/zsh"
-        }
-      }
-    }
-  }
-}

.github/scripts/build-codex-package-archive.sh

@@ -11,8 +11,6 @@ Usage: build-codex-package-archive.sh \
   [--bwrap-bin <path>] \
   [--code-mode-host-bin <path>] \
   [--rg-bin <path>] \
-  [--zsh-bin <path>] \
-  [--zsh-manifest <path>] \
   [--codex-command-runner-bin <path>] \
   [--codex-windows-sandbox-setup-bin <path>] \
   [--voice-release-dir <path> --release-version <release-version>] \
@@ -65,14 +63,6 @@ while [[ $# -gt 0 ]]; do
       resource_args+=(--rg-bin "${2:?--rg-bin requires a value}")
       shift 2
       ;;
-    --zsh-bin)
-      resource_args+=(--zsh-bin "${2:?--zsh-bin requires a value}")
-      shift 2
-      ;;
-    --zsh-manifest)
-      resource_args+=(--zsh-manifest "${2:?--zsh-manifest requires a value}")
-      shift 2
-      ;;
     --codex-command-runner-bin)
       resource_args+=(
         --codex-command-runner-bin

.github/scripts/build-zsh-release-artifact.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-if [[ "$#" -ne 1 ]]; then
-  echo "usage: $0 <archive-path>" >&2
-  exit 1
-fi
-
-archive_path="$1"
-workspace="${GITHUB_WORKSPACE:?missing GITHUB_WORKSPACE}"
-zsh_commit="${ZSH_COMMIT:?missing ZSH_COMMIT}"
-zsh_patch="${ZSH_PATCH:?missing ZSH_PATCH}"
-temp_root="${RUNNER_TEMP:-/tmp}"
-work_root="$(mktemp -d "${temp_root%/}/codex-zsh-release.XXXXXX")"
-trap 'rm -rf "$work_root"' EXIT
-
-source_root="${work_root}/zsh"
-package_root="${work_root}/codex-zsh"
-wrapper_path="${work_root}/exec-wrapper"
-stdout_path="${work_root}/stdout.txt"
-wrapper_log_path="${work_root}/wrapper.log"
-
-git clone https://git.code.sf.net/p/zsh/code "$source_root"
-cd "$source_root"
-git checkout "$zsh_commit"
-git apply "${workspace}/${zsh_patch}"
-./Util/preconfig
-./configure
-
-cores="$(command -v nproc >/dev/null 2>&1 && nproc || getconf _NPROCESSORS_ONLN)"
-make -j"${cores}"
-
-cat > "$wrapper_path" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-: "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
-printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
-file="$1"
-shift
-if [[ "$#" -eq 0 ]]; then
-  exec "$file"
-fi
-arg0="$1"
-shift
-exec -a "$arg0" "$file" "$@"
-EOF
-chmod +x "$wrapper_path"
-
-CODEX_WRAPPER_LOG="$wrapper_log_path" \
-EXEC_WRAPPER="$wrapper_path" \
-"${source_root}/Src/zsh" -fc '/bin/echo smoke-zsh' > "$stdout_path"
-
-grep -Fx "smoke-zsh" "$stdout_path"
-grep -Fx "/bin/echo" "$wrapper_log_path"
-
-mkdir -p "$package_root/bin" "$(dirname "${workspace}/${archive_path}")"
-cp "${source_root}/Src/zsh" "$package_root/bin/zsh"
-chmod +x "$package_root/bin/zsh"
-
-(cd "$work_root" && tar -czf "${workspace}/${archive_path}" codex-zsh)

.github/scripts/macos-signing/provisioned_macos_cli_package.py

@@ -19,7 +19,7 @@ CODE_SIGNING_ID = "codex"
 APP = Path("CodexCLI.app")
 EXECUTABLE = APP / "Contents/MacOS/codex"
 SIGNING = Path(__file__).resolve().parent
-HELPERS = ("bin/codex-code-mode-host", "codex-path/rg", "codex-resources/zsh/bin/zsh")
+HELPERS = ("bin/codex-code-mode-host", "codex-path/rg")
 LAUNCHER = """#!/bin/sh
 set -eu
 entry="$0"

.github/scripts/macos-signing/test_sign_macos_cli_package.py

@@ -189,13 +189,13 @@ class MacosSigningTests(ProvisioningTestCase):
                 )
                 self.assertEqual(
                     ["--entitlements" in call for call in signing],
-                    [True, True, False, False],
+                    [True, True, False],
                 )
                 self.assertEqual(
                     [call[0] for call in calls if call[0].startswith("notarize")],
                     ["notarize_with_akv.py"]
                     if provisioned
-                    else ["notarize_macos_binary_with_akv.sh"] * 4,
+                    else ["notarize_macos_binary_with_akv.sh"] * 3,
                 )
                 self.assertEqual(
                     [call[1:] for call in calls if call[0] == "lipo"],

.github/scripts/verify-zsh-manifest.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-manifest="${1:?missing zsh manifest path}"
-expected_sha256="${2:?missing expected zsh manifest SHA-256}"
-
-if command -v sha256sum >/dev/null 2>&1; then
-  printf '%s  %s\n' "$expected_sha256" "$manifest" | sha256sum --check -
-else
-  printf '%s  %s\n' "$expected_sha256" "$manifest" | shasum -a 256 --check -
-fi

.github/workflows/rust-release-zsh.yml

@@ -1,182 +0,0 @@
-name: rust-release-zsh
-
-on:
-  push:
-    tags:
-      - "codex-zsh-v*.*.*"
-
-env:
-  ZSH_COMMIT: 77045ef899e53b9598bebc5a41db93a548a40ca6
-  ZSH_PATCH: codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch
-
-concurrency:
-  group: ${{ github.workflow }}::${{ github.ref_name }}
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    runs-on: ubuntu-latest
-    outputs:
-      release_tag: ${{ steps.release_tag.outputs.release_tag }}
-
-    steps:
-      - name: Validate release tag
-        id: release_tag
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [[ ! "${RELEASE_TAG}" =~ ^codex-zsh-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Tag ${RELEASE_TAG} does not match codex-zsh-vX.Y.Z." >&2
-            exit 1
-          fi
-
-          echo "release_tag=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
-
-      - name: Ensure release does not exist
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ steps.release_tag.outputs.release_tag }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
-            echo "Release ${RELEASE_TAG} already exists; publish changed artifacts under a new tag." >&2
-            exit 1
-          fi
-
-  linux:
-    name: Build zsh (Linux) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    container:
-      image: ${{ matrix.image }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: ubuntu:24.04
-            archive_name: codex-zsh-x86_64-unknown-linux-musl.tar.gz
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            variant: ubuntu-24.04
-            image: arm64v8/ubuntu:24.04
-            archive_name: codex-zsh-aarch64-unknown-linux-musl.tar.gz
-
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y \
-            autoconf \
-            bison \
-            build-essential \
-            ca-certificates \
-            gettext \
-            git \
-            libncursesw5-dev
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Build, smoke-test, and stage zsh artifact
-        shell: bash
-        run: |
-          "${GITHUB_WORKSPACE}/.github/scripts/build-zsh-release-artifact.sh" \
-            "dist/zsh/${{ matrix.target }}/${{ matrix.archive_name }}"
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: codex-zsh-${{ matrix.target }}
-          path: dist/zsh/${{ matrix.target }}/*
-
-  darwin:
-    name: Build zsh (macOS) - ${{ matrix.variant }} - ${{ matrix.target }}
-    needs: metadata
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-15-large
-            target: x86_64-apple-darwin
-            variant: macos-15
-            archive_name: codex-zsh-x86_64-apple-darwin.tar.gz
-          - runner: macos-15-xlarge
-            target: aarch64-apple-darwin
-            variant: macos-15
-            archive_name: codex-zsh-aarch64-apple-darwin.tar.gz
-
-    steps:
-      - name: Install build prerequisites
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v autoconf >/dev/null 2>&1; then
-            brew install autoconf
-          fi
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Build, smoke-test, and stage zsh artifact
-        shell: bash
-        run: |
-          "${GITHUB_WORKSPACE}/.github/scripts/build-zsh-release-artifact.sh" \
-            "dist/zsh/${{ matrix.target }}/${{ matrix.archive_name }}"
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: codex-zsh-${{ matrix.target }}
-          path: dist/zsh/${{ matrix.target }}/*
-
-  publish-release:
-    needs:
-      - metadata
-      - linux
-      - darwin
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: dist
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
-        with:
-          tag_name: ${{ needs.metadata.outputs.release_tag }}
-          name: ${{ needs.metadata.outputs.release_tag }}
-          files: dist/**
-          # Keep zsh artifact releases out of Codex's normal "latest release" channel.
-          prerelease: true
-
-      - name: Publish DotSlash manifest
-        uses: ./.github/actions/publish-dotslash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag: ${{ needs.metadata.outputs.release_tag }}
-          configs: .github/dotslash-zsh-config.json

.github/workflows/rust-release.yml

@@ -16,8 +16,6 @@ on:
 
 env:
   CODEX_REPO_ROOT: ${{ github.workspace }}
-  CODEX_ZSH_RELEASE_TAG: codex-zsh-v0.1.0
-  CODEX_ZSH_MANIFEST_SHA256: c534eab89dcea7e3d8a5e5b3f49c025c7c64cd4e4d9814ee24871de58a9359a1
 
 # The launcher uses this per-tag group as the migration boundary. Keep shared
 # publication jobs on the original queued group below when changing this.
@@ -415,17 +413,6 @@ jobs:
             cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg"
           fi
 
-      - name: Download packaged zsh manifest
-        if: ${{ runner.os != 'macOS' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          curl -fsSL \
-            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
-            -o "${RUNNER_TEMP}/codex-zsh"
-          bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
-            "${RUNNER_TEMP}/codex-zsh" "$CODEX_ZSH_MANIFEST_SHA256"
-
       - name: Build Codex package archive
         if: ${{ runner.os != 'macOS' }}
         shell: bash
@@ -444,7 +431,6 @@ jobs:
             --bundle "$BUNDLE" \
             --entrypoint-dir "target/${TARGET}/release" \
             --archive-dir "dist/${TARGET}" \
-            --zsh-manifest "${RUNNER_TEMP}/codex-zsh" \
             "${voice_args[@]}"
 
       - name: Cosign Linux voice package archives
@@ -493,8 +479,7 @@ jobs:
             --target "${{ matrix.target }}" \
             --bundle primary \
             --entrypoint-dir "target/${{ matrix.target }}/release" \
-            --archive-dir "$wheel_archives" \
-            --zsh-manifest "${RUNNER_TEMP}/codex-zsh"
+            --archive-dir "$wheel_archives"
           wheel_archive="${wheel_archives}/codex-package-${{ matrix.target }}.tar.gz"
           python3 - "$wheel_archive" <<'PY'
           import sys
@@ -774,33 +759,22 @@ jobs:
           set -euo pipefail
 
           signed_root="${GITHUB_WORKSPACE}/signed-resources/${TARGET}"
-          zsh_manifest="${RUNNER_TEMP}/codex-zsh-${TARGET}"
           mkdir -p "$signed_root"
-          curl -fsSL \
-            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
-            -o "$zsh_manifest"
-          bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
-            "$zsh_manifest" "$CODEX_ZSH_MANIFEST_SHA256"
 
-          PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" "$zsh_manifest" <<'PY'
+          PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" <<'PY'
           import shutil
           import sys
           from pathlib import Path
 
           from codex_package.ripgrep import fetch_rg
           from codex_package.targets import TARGET_SPECS
-          from codex_package.zsh import resolve_zsh_bin
 
           spec = TARGET_SPECS[sys.argv[1]]
           signed_root = Path(sys.argv[2])
-          zsh_bin = resolve_zsh_bin(spec, Path(sys.argv[3]))
-          if zsh_bin is None:
-              raise RuntimeError(f"Pinned zsh release is missing {spec.target}")
           shutil.copy2(fetch_rg(spec), signed_root / "rg")
-          shutil.copy2(zsh_bin, signed_root / "zsh")
           PY
 
-          for resource in rg zsh; do
+          for resource in rg; do
             binary="${signed_root}/${resource}"
             report_dir="${GITHUB_WORKSPACE}/macos-binary-signing-verification/${TARGET}/${resource}"
             mkdir -p "$report_dir"
@@ -1001,7 +975,7 @@ jobs:
             codesign --verify --strict --verbose=2 "$binary_path"
           done
 
-          for resource in rg zsh; do
+          for resource in rg; do
             resource_path="signed-resources/${{ matrix.target }}/${resource}"
             chmod 0755 "$resource_path"
             codesign --verify --strict --verbose=2 "$resource_path"
@@ -1041,7 +1015,6 @@ jobs:
             --entrypoint-dir "target/${TARGET}/release" \
             --archive-dir "dist/${TARGET}" \
             --rg-bin "signed-resources/${TARGET}/rg" \
-            --zsh-bin "signed-resources/${TARGET}/zsh" \
             ${voice_args[@]+"${voice_args[@]}"}
 
       - name: Build unsigned macOS DMG
@@ -1129,8 +1102,7 @@ jobs:
             --bundle primary \
             --entrypoint-dir "target/${{ matrix.target }}/release" \
             --archive-dir "$wheel_archives" \
-            --rg-bin "signed-resources/${{ matrix.target }}/rg" \
-            --zsh-bin "signed-resources/${{ matrix.target }}/zsh"
+            --rg-bin "signed-resources/${{ matrix.target }}/rg"
           wheel_archive="${wheel_archives}/codex-package-${{ matrix.target }}.tar.gz"
           python3 - "$wheel_archive" <<'PY'
           import sys
@@ -1436,8 +1408,7 @@ jobs:
           verify_signed_binary "${package_dir}/bin/codex-code-mode-host" "codex-code-mode-host"
 
           for resource in \
-            "${package_dir}/codex-path/rg" \
-            "${package_dir}/codex-resources/zsh/bin/zsh"
+            "${package_dir}/codex-path/rg"
           do
             chmod 0755 "$resource"
             lipo "$resource" -verify_arch "$expected_arch"