## What changed
Remove the patched `zsh` resource from package assembly and macOS signing, along with the `--zsh-bin` and `--zsh-manifest` packaging options.
Delete the standalone `codex-zsh` release workflow, build scripts, and DotSlash manifests. Update package documentation and layout and signing tests to match the remaining resources.
GitOrigin-RevId: 429a8db55048fed7facec89957910206523b6013
## Why
Cargo and Bazel embed different PDB filenames in the Windows code-mode host executable. The package smoke test must support both names while verifying that the debug symbols match the packaged executable.
## What changed
- Keep the archived PDB and copy it to `codex_code_mode_host.pdb`, allowing `dumpbin /PDBPATH` to resolve either name. Accept either path in the assertion.
- Set `sandbox_workspace_write.writable_roots = []` explicitly in the smoke-test configuration.
GitOrigin-RevId: fc2610f580dad49e38848582bc63f1f829cb766d
## What changed
Expose resolved Cargo package names in `DEP_DATA`, set `CARGO_PKG_NAME` for Rust compilation, and pass the package name to build scripts. Propagate `rustc_env` to generated binary targets so they receive the same package metadata as libraries.
## Testing
Strengthen the packaged CLI smoke test to require `--version` to print exactly `codex-cli <version>`, using the workspace package version from `codex-rs/Cargo.toml`.
GitOrigin-RevId: 274b741067af76313358f44c1bd9b2521938fa9c
## What changed
- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.
## Testing
Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.
GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
## What changed
Add a cross-platform pytest suite that extracts the CLI and app-server
archives and verifies:
- common CLI discovery commands;
- code-mode execution through both packaged entrypoints, including use of each
package's bundled `rg`; and
- the presence and usability of packaged debug symbols on Linux, macOS, and
Windows.
The suite accepts gzip or zstd package archives and isolates its Codex
configuration and state from the invoking environment.
GitOrigin-RevId: 25e517d349242c9f6226e95ef41e37a783e2373f
jif