Fix 26.803 startup and sync upstream main

.github/workflows/ci.yml

@@ -39,6 +39,7 @@ jobs:
           bash -n scripts/build-rpm.sh
           bash -n scripts/build-pacman.sh
           bash -n scripts/build-appimage.sh
+          bash -n scripts/ci/download-upstream-dmg.sh
           bash -n scripts/ci/update-nix-hashes.sh
           bash -n scripts/ci/validate-nix-pins.sh
 
@@ -143,6 +144,40 @@ jobs:
             echo "- Verified generic feature resource, 0640 mode, and runtime dependency."
           } >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Create Codex Micro packaged app fixture
+        env:
+          CODEX_FIXTURE_LINUX_FEATURES_JSON: '["codex-micro"]'
+        run: |
+          set -euo pipefail
+          rm -rf codex-app dist
+          tests/fixtures/create-packaged-app-fixture.sh codex-app
+          printf '%s\n' '{"enabled":["codex-micro"]}' > /tmp/codex-micro-features.json
+
+      - name: Build Codex Micro Debian package
+        env:
+          CODEX_LINUX_FEATURES_CONFIG: /tmp/codex-micro-features.json
+        run: PACKAGE_VERSION="$CI_PACKAGE_VERSION" ./scripts/build-deb.sh
+
+      - name: Inspect Codex Micro Debian package
+        run: |
+          set -euo pipefail
+          deb_file="$(find dist -maxdepth 1 -name 'codex-desktop_*.deb' -print -quit)"
+          test -n "$deb_file"
+          dpkg-deb -c "$deb_file" | tee /tmp/deb-micro-contents.txt >/dev/null
+          dpkg-deb -f "$deb_file" Depends | tee /tmp/deb-micro-depends.txt >/dev/null
+          grep -q './usr/lib/udev/rules.d/70-codex-micro.rules' /tmp/deb-micro-contents.txt
+          grep -q 'libudev1' /tmp/deb-micro-depends.txt
+          grep -q 'libusb-1.0-0' /tmp/deb-micro-depends.txt
+          rule_mode="$(
+            awk '$NF == "./usr/lib/udev/rules.d/70-codex-micro.rules" { print $1 }' \
+              /tmp/deb-micro-contents.txt
+          )"
+          test "$rule_mode" = '-rw-r--r--'
+          {
+            echo "- Codex Micro build: \`$(basename "$deb_file")\`"
+            echo "- Verified udev rule, 0644 mode, and libudev/libusb dependencies."
+          } >> "$GITHUB_STEP_SUMMARY"
+
   nix:
     name: Nix Package Builds
     runs-on: ubuntu-latest
@@ -257,6 +292,7 @@ jobs:
             .#codex-desktop-computer-use-ui
             .#codex-desktop-remote-mobile-control
             .#codex-desktop-computer-use-ui-remote-mobile-control
+            .#checks.x86_64-linux.nix-pipewire-alsa-wrapper
             .#checks.x86_64-linux.nix-gsettings-schema-wrapper
             .#checks.x86_64-linux.watchdog-linux-features
           )
@@ -363,6 +399,41 @@ jobs:
             echo "- Verified generic feature resource, 0640 mode, and runtime dependency."
           } >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Create Codex Micro packaged app fixture
+        env:
+          CODEX_FIXTURE_LINUX_FEATURES_JSON: '["codex-micro"]'
+        run: |
+          set -euo pipefail
+          rm -rf codex-app dist
+          tests/fixtures/create-packaged-app-fixture.sh codex-app
+          printf '%s\n' '{"enabled":["codex-micro"]}' > /tmp/codex-micro-features.json
+
+      - name: Build Codex Micro RPM package
+        env:
+          CODEX_LINUX_FEATURES_CONFIG: /tmp/codex-micro-features.json
+        run: PACKAGE_VERSION="$CI_PACKAGE_VERSION" ./scripts/build-rpm.sh
+
+      - name: Inspect Codex Micro RPM package
+        run: |
+          set -euo pipefail
+          rpm_file="$(find dist -maxdepth 1 -name 'codex-desktop-*.rpm' -print -quit)"
+          test -n "$rpm_file"
+          rpm -qlp "$rpm_file" | tee /tmp/rpm-micro-contents.txt >/dev/null
+          rpm -qlvp "$rpm_file" | tee /tmp/rpm-micro-long-contents.txt >/dev/null
+          rpm -qp --requires "$rpm_file" | tee /tmp/rpm-micro-requires.txt >/dev/null
+          grep -q '/usr/lib/udev/rules.d/70-codex-micro.rules' /tmp/rpm-micro-contents.txt
+          grep -q '^libudev\.so\.1' /tmp/rpm-micro-requires.txt
+          grep -q '^libusb-1\.0\.so\.0' /tmp/rpm-micro-requires.txt
+          rule_mode="$(
+            awk '$NF == "/usr/lib/udev/rules.d/70-codex-micro.rules" { print $1 }' \
+              /tmp/rpm-micro-long-contents.txt
+          )"
+          test "$rule_mode" = '-rw-r--r--'
+          {
+            echo "- Codex Micro build: \`$(basename "$rpm_file")\`"
+            echo "- Verified udev rule, 0644 mode, and libudev/libusb dependencies."
+          } >> "$GITHUB_STEP_SUMMARY"
+
   package-pacman:
     name: Build Pacman Package
     runs-on: ubuntu-latest
@@ -426,21 +497,49 @@ jobs:
                 fixture_mode="$(sed -n "1s/ .*//p" /tmp/pacman-feature-long-contents.txt)"
                 test "$fixture_mode" = "-rw-r-----"
                 printf "%s\n" "$(basename "$feature_pkg_file")" > /tmp/pacman-feature-package-name.txt
+
+                rm -rf codex-app dist
+                CODEX_FIXTURE_LINUX_FEATURES_JSON="[\"codex-micro\"]" \
+                  tests/fixtures/create-packaged-app-fixture.sh codex-app
+                printf "%s\n" "{\"enabled\":[\"codex-micro\"]}" \
+                  > /tmp/codex-micro-features.json
+
+                CODEX_LINUX_FEATURES_CONFIG=/tmp/codex-micro-features.json \
+                PACKAGE_VERSION="$CI_PACKAGE_VERSION" \
+                  ./scripts/build-pacman.sh
+
+                micro_pkg_file="$(find dist -maxdepth 1 -name "codex-desktop-*.pkg.tar.*" -print -quit)"
+                test -n "$micro_pkg_file"
+                pacman -Qlp "$micro_pkg_file" | tee /tmp/pacman-micro-contents.txt >/dev/null
+                tar -xOf "$micro_pkg_file" .PKGINFO | tee /tmp/pacman-micro-pkginfo.txt >/dev/null
+                tar -tvf "$micro_pkg_file" \
+                  usr/lib/udev/rules.d/70-codex-micro.rules \
+                  | tee /tmp/pacman-micro-long-contents.txt >/dev/null
+                grep -q "usr/lib/udev/rules.d/70-codex-micro.rules" /tmp/pacman-micro-contents.txt
+                grep -q "^depend = libusb$" /tmp/pacman-micro-pkginfo.txt
+                grep -q "^depend = systemd-libs$" /tmp/pacman-micro-pkginfo.txt
+                micro_rule_mode="$(sed -n "1s/ .*//p" /tmp/pacman-micro-long-contents.txt)"
+                test "$micro_rule_mode" = "-rw-r--r--"
+                printf "%s\n" "$(basename "$micro_pkg_file")" > /tmp/pacman-micro-package-name.txt
               '"'"'
               cp /tmp/pacman-package-name.txt /work/.pacman-package-name.txt
               cp /tmp/pacman-feature-package-name.txt /work/.pacman-feature-package-name.txt
+              cp /tmp/pacman-micro-package-name.txt /work/.pacman-micro-package-name.txt
             '
 
       - name: Write pacman validation summary
         run: |
           set -euo pipefail
           pkg_file="$(cat .pacman-package-name.txt)"
           feature_pkg_file="$(cat .pacman-feature-package-name.txt)"
+          micro_pkg_file="$(cat .pacman-micro-package-name.txt)"
           {
             echo "## Pacman Package Validation"
             echo ""
             echo "- Built: \`$pkg_file\`"
             echo "- Verified updater binary, user service, update-builder bundle, and packaged runtime helper."
             echo "- Feature-enabled build: \`$feature_pkg_file\`"
             echo "- Verified generic feature resource, 0640 mode, and runtime dependency."
+            echo "- Codex Micro build: \`$micro_pkg_file\`"
+            echo "- Verified udev rule, 0644 mode, and systemd-libs/libusb dependencies."
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/upstream-build-app.yml

@@ -10,12 +10,16 @@ on:
       - scripts/patch-linux-window-ui.js
       - scripts/patch-linux-window-ui.test.js
       - scripts/patches/**
+      - scripts/ci/download-upstream-dmg.sh
       - scripts/ci/validate-patch-report.js
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
       - scripts/lib/candidate-install.sh
       - scripts/lib/bundled-plugins.sh
       - scripts/lib/browser-client-node-repl-runtime.test.js
+      - scripts/lib/build-info.js
+      - scripts/lib/build-info.sh
+      - scripts/lib/build-info.test.js
       - scripts/lib/patch-browser-client-iab-socket-scope.js
       - scripts/lib/patch-validation.js
       - scripts/lib/upstream-dmg-acceptance.js
@@ -33,12 +37,16 @@ on:
       - scripts/patch-linux-window-ui.js
       - scripts/patch-linux-window-ui.test.js
       - scripts/patches/**
+      - scripts/ci/download-upstream-dmg.sh
       - scripts/ci/validate-patch-report.js
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
       - scripts/lib/candidate-install.sh
       - scripts/lib/bundled-plugins.sh
       - scripts/lib/browser-client-node-repl-runtime.test.js
+      - scripts/lib/build-info.js
+      - scripts/lib/build-info.sh
+      - scripts/lib/build-info.test.js
       - scripts/lib/patch-browser-client-iab-socket-scope.js
       - scripts/lib/patch-validation.js
       - scripts/lib/upstream-dmg-acceptance.js
@@ -124,11 +132,12 @@ jobs:
           key: upstream-dmg-${{ env.DMG_CACHE_SCHEMA_VERSION }}-${{ steps.upstream-metadata.outputs.cache_segment }}
 
       - name: Download upstream DMG
-        if: steps.dmg-cache.outputs.cache-hit != 'true'
         run: |
           set -euo pipefail
-          mkdir -p "$(dirname "$UPSTREAM_DMG_PATH")"
-          curl -fL --retry 3 -o "$UPSTREAM_DMG_PATH" "$UPSTREAM_DMG_URL"
+          scripts/ci/download-upstream-dmg.sh \
+            "$UPSTREAM_DMG_URL" \
+            "$UPSTREAM_DMG_PATH" \
+            --reuse-existing
 
       - name: Record local DMG fingerprint
         id: local-dmg
@@ -277,5 +286,6 @@ jobs:
               repo: context.repo,
               decision,
               currentHttpIdentityKey: httpIdentity(currentMetadata)?.key ?? null,
+              scanAll: true,
             });
             core.info(`Upstream DMG issue reconciliation: ${JSON.stringify(result)}`);

AGENTS.md

@@ -110,11 +110,14 @@ Repository governance: [issue and pull request labels](docs/label-governance.md)
 - Core patch descriptors are the source of truth for shipped Linux
   compatibility patches. Read `scripts/patches/core/README.md` before adding
   or moving descriptors.
-- ASAR patches are fail-soft unless intentionally marked `required-upstream`.
-  Each patch should be idempotent and report warnings when current upstream
-  drift prevents a needle from matching.
-- Patch reports are written for installs/rebuilds. Upstream-build CI fails only
-  for required upstream patches that are missing or skipped.
+- ASAR patches are fail-soft unless intentionally marked `required-upstream`,
+  or unless a transactional mutation reports `failed-integrity` because it
+  cannot prove rollback restored the original bytes. Each patch should be
+  idempotent and report warnings when current upstream drift prevents a needle
+  from matching.
+- Patch reports are written for installs/rebuilds. Upstream-build CI fails for
+  required upstream patches that are missing or skipped and for every
+  `failed-integrity` status.
 - Do not recreate deleted compatibility barrels such as
   `scripts/patches/main-process.js`, `webview-assets.js`, or `shared.js`.
 - Feature patching uses only `entrypoints.patchDescriptors`. Removed feature

CHANGELOG.md

@@ -10,6 +10,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Linux launcher accepts `--profile NAME` / `--profile=NAME` / `-p NAME` and
   applies the named Codex CLI profile to runtime commands and the local
   app-server without changing the Desktop sign-in used for remote control.
+- A disabled-by-default `deferred-update-build` Linux feature adds a **Build
+  updates automatically** setting. Turning it off keeps notification and DMG
+  verification active while deferring local package builds until an explicit
+  **Check for updates**.
+- The embedded Computer Use backend is synchronized to standalone v0.4.6 as
+  `0.4.6-linux-alpha1`, including generic X11/EWMH window control, X11
+  `xdotool` keyboard, text, and coordinate-click input, KDE portal scroll
+  polarity, and portal key chords, with generic X11 registered last.
 - A shared upstream DMG acceptance profile now produces the same structured
   decision for local installs, updater rebuilds, and scheduled CI. Scheduled
   rejections create one fingerprinted drift issue and supersede issues for
@@ -42,6 +50,63 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Fixed
 
+- Deferred upstream DMGs are revalidated before a build. A newer candidate
+  supersedes the pending download, and a deleted cached DMG is redownloaded in
+  the same explicit check. Fresh app-launch checks preserve the stable deferred
+  candidate without an upstream DMG request; stale checks use HEAD and reuse a valid
+  unchanged cached DMG, while offline checks leave it pending. The optional
+  state marker retains the existing `update_detected` status so updater 0.10.x
+  can read the state and resume its previous automatic-build behavior. State
+  written by prerelease builds using `update_available` is migrated back to
+  `update_detected` on read.
+- Native X11 coordinate clicks now use one supervised xdotool XTEST command,
+  fall back to ydotool only when xdotool cannot launch, and preserve nested X11
+  session identity instead of importing a host Wayland display.
+- Wrapper update checks no longer offer rebuilds when every change since the
+  installed commit is limited to repository documentation or metadata.
+- The updater feature picker now changes only the enabled feature list, preserving
+  nested feature settings and other local configuration keys across rebuilds.
+- The opt-in Dock icon tweak now targets the current upstream main-process
+  bundle, restoring Linux window, tray, and desktop icon synchronization.
+- The opt-in shallow repository watcher now patches both current app bundles
+  and routes the Linux Parcel working-tree path through the same shallow host,
+  restoring bounded watches on the latest upstream DMG.
+- The opt-in directory-only working-tree watcher now routes the current Linux
+  Parcel working-tree path through its existing bounded directory watcher,
+  restoring the feature on the latest upstream DMG, with byte-verified rollback
+  for its paired bundle writes.
+- Computer Use now supports Plasma 5 and 6 KWin scripting, validates every
+  ydotool 1.0.3+ command shape it emits, and rejects semantically incompatible
+  CLIs even when a daemon socket exists. Hyprland dispatch validation handles
+  exit-zero errors, modifier chords use the v0.4.3 delay, and an xdotool command
+  that starts but fails is never replayed through ydotool.
+- Open Target Discovery now resolves the selected Linux editor or terminal
+  through the current private open-target command path. Command-path drift is
+  reported before the feature changes the main bundle, so enabled-feature
+  acceptance cannot mistake a partially patched bundle for success.
+- Repeated current-DMG patch passes now keep composed native and frameless
+  titlebars, external-open handling, Record & Replay, and Browser Use runtime
+  resolution byte-identical. Complete markers no longer depend on
+  function-local minified aliases, while partial markers remain fail-soft and
+  leave drifted assets untouched.
+- Remote mobile control now patches the current 26.721 dual-gate enablement
+  bridge instead of reporting it as already applied. Startup auto-connects the
+  environment owned by this Desktop without overwriting saved choices for
+  other enrolled hosts.
+- Updater-managed npm Codex CLI installs now serialize across daemon, launcher,
+  and status processes. If npm reports the exact stale Arborist retirement
+  directory failure, automatic paths preserve the working CLI and direct the
+  user to read-only diagnostics. The explicit `repair-cli` command revalidates
+  the condition under the shared lock, records crash-durable quarantines, and
+  retries npm once per explicit invocation without discarding failed recovery
+  state or concurrent updater state. A parent-independent bounded supervisor
+  retains the lock while mutating npm children run without inheriting it,
+  terminates their complete process group, and releases the lock only after
+  cleanup if the updater parent or supervisor exits abruptly or the npm leader
+  leaves a background descendant.
+  Late routine CLI checks revalidate both the repair journal and their original
+  CLI state before persisting a result. Missing-CLI preflight also re-resolves a
+  CLI installed while it waited for the lock before consulting npm.
 - Concurrent updater entrypoints now serialize state reloads and cache cleanup
   before persisting startup state. A second process can no longer prune an
   active rebuild workspace, while forced checks wait for startup maintenance