ci: unblock fork CI runner selection and npm staging

.github/workflows/bazel.yml

@@ -20,32 +20,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          # macOS
-          - os: macos-15-xlarge
-            target: aarch64-apple-darwin
-          - os: macos-15-xlarge
-            target: x86_64-apple-darwin
-
-          # Linux
-          - os: ubuntu-24.04
-            target: x86_64-unknown-linux-gnu
-          - os: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-          # 2026-02-27 Bazel tests have been flaky on arm in CI.
-          # Disable until we can investigate and stabilize them.
-          # - os: ubuntu-24.04-arm
-          #   target: aarch64-unknown-linux-musl
-          # - os: ubuntu-24.04-arm
-          #   target: aarch64-unknown-linux-gnu
-
-          # TODO: Enable Windows once we fix the toolchain issues there.
-          #- os: windows-latest
-          #  target: x86_64-pc-windows-gnullvm
-    runs-on: ${{ matrix.os }}
+        include: ${{ fromJSON(github.repository == 'openai/codex' && '[{"os":"macos-15-xlarge","fallback_os":"macos-15","target":"aarch64-apple-darwin"},{"os":"macos-15-xlarge","fallback_os":"macos-15-intel","target":"x86_64-apple-darwin"},{"os":"ubuntu-24.04","target":"x86_64-unknown-linux-gnu"},{"os":"ubuntu-24.04","target":"x86_64-unknown-linux-musl"}]' || '[{"os":"macos-15-xlarge","fallback_os":"macos-15","target":"aarch64-apple-darwin"},{"os":"ubuntu-24.04","target":"x86_64-unknown-linux-gnu"}]') }}
+    # macOS larger runners are available in upstream, but forks should fall back
+    # to the standard hosted labels that match the target architecture. Forks
+    # also use a reduced hosted subset for now because the hosted Intel macOS
+    # and Linux musl Bazel lanes are not stable in this fork's CI environment.
+    runs-on: ${{ github.repository == 'openai/codex' && matrix.os || matrix.fallback_os || matrix.os }}
 
     # Configure a human readable name for each job
-    name: Local Bazel build on ${{ matrix.os }} for ${{ matrix.target }}
+    name: Local Bazel build on ${{ github.repository == 'openai/codex' && matrix.os || matrix.fallback_os || matrix.os }} for ${{ matrix.target }}
 
     steps:
       - uses: actions/checkout@v6

.github/workflows/rust-ci.yml

@@ -85,8 +85,10 @@ jobs:
 
   # --- CI to validate on different os/targets --------------------------------
   lint_build:
-    name: Lint/Build — ${{ matrix.runner }} - ${{ matrix.target }}${{ matrix.profile == 'release' && ' (release)' || '' }}
-    runs-on: ${{ matrix.runs_on || matrix.runner }}
+    name: Lint/Build — ${{ github.repository == 'openai/codex' && matrix.runner || matrix.fallback_runner || matrix.runner }} - ${{ matrix.target }}${{ matrix.profile == 'release' && ' (release)' || '' }}
+    # Keep upstream on its larger/custom runners, but let forks run the same
+    # matrix on standard hosted labels they can actually provision.
+    runs-on: ${{ github.repository == 'openai/codex' && (matrix.upstream_runs_on || matrix.runner) || matrix.fallback_runner || matrix.runner }}
     timeout-minutes: 30
     needs: changed
     # Keep job-level if to avoid spinning up runners when not needed
@@ -107,45 +109,53 @@ jobs:
       matrix:
         include:
           - runner: macos-15-xlarge
+            fallback_runner: macos-15
             target: aarch64-apple-darwin
             profile: dev
           - runner: macos-15-xlarge
+            fallback_runner: macos-15-intel
             target: x86_64-apple-darwin
             profile: dev
           - runner: ubuntu-24.04
+            fallback_runner: ubuntu-24.04
             target: x86_64-unknown-linux-musl
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-x64
           - runner: ubuntu-24.04
+            fallback_runner: ubuntu-24.04
             target: x86_64-unknown-linux-gnu
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-x64
           - runner: ubuntu-24.04-arm
+            fallback_runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-musl
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-arm64
           - runner: ubuntu-24.04-arm
+            fallback_runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-arm64
           - runner: windows-x64
+            fallback_runner: windows-2025
             target: x86_64-pc-windows-msvc
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-windows-x64
           - runner: windows-arm64
+            fallback_runner: windows-11-arm
             target: aarch64-pc-windows-msvc
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-windows-arm64
 
@@ -154,30 +164,35 @@ jobs:
           # Hopefully this also pre-populates the build cache to speed up
           # releases.
           - runner: macos-15-xlarge
+            fallback_runner: macos-15
             target: aarch64-apple-darwin
             profile: release
           - runner: ubuntu-24.04
+            fallback_runner: ubuntu-24.04
             target: x86_64-unknown-linux-musl
             profile: release
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-x64
           - runner: ubuntu-24.04-arm
+            fallback_runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-musl
             profile: release
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-arm64
           - runner: windows-x64
+            fallback_runner: windows-2025
             target: x86_64-pc-windows-msvc
             profile: release
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-windows-x64
           - runner: windows-arm64
+            fallback_runner: windows-11-arm
             target: aarch64-pc-windows-msvc
             profile: release
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-windows-arm64
 
@@ -451,8 +466,8 @@ jobs:
           key: apt-${{ matrix.runner }}-${{ matrix.target }}-v1
 
   tests:
-    name: Tests — ${{ matrix.runner }} - ${{ matrix.target }}
-    runs-on: ${{ matrix.runs_on || matrix.runner }}
+    name: Tests — ${{ github.repository == 'openai/codex' && matrix.runner || matrix.fallback_runner || matrix.runner }} - ${{ matrix.target }}
+    runs-on: ${{ github.repository == 'openai/codex' && (matrix.upstream_runs_on || matrix.runner) || matrix.fallback_runner || matrix.runner }}
     timeout-minutes: 30
     needs: changed
     if: ${{ needs.changed.outputs.codex == 'true' || needs.changed.outputs.workflows == 'true' || github.event_name == 'push' }}
@@ -470,39 +485,51 @@ jobs:
       matrix:
         include:
           - runner: macos-15-xlarge
+            fallback_runner: macos-15
             target: aarch64-apple-darwin
             profile: dev
           - runner: ubuntu-24.04
+            fallback_runner: ubuntu-24.04
             target: x86_64-unknown-linux-gnu
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-x64
           - runner: ubuntu-24.04-arm
+            fallback_runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-linux-arm64
           - runner: windows-x64
+            fallback_runner: windows-2025
             target: x86_64-pc-windows-msvc
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-windows-x64
           - runner: windows-arm64
+            fallback_runner: windows-11-arm
             target: aarch64-pc-windows-msvc
             profile: dev
-            runs_on:
+            upstream_runs_on:
               group: codex-runners
               labels: codex-windows-arm64
 
     steps:
       - uses: actions/checkout@v6
       - name: Set up Node.js for js_repl tests
+        if: ${{ matrix.target != 'aarch64-pc-windows-msvc' }}
         uses: actions/setup-node@v6
         with:
           node-version-file: codex-rs/node-version.txt
+      - name: Set up x64 Node.js for js_repl tests (Windows ARM)
+        if: ${{ matrix.target == 'aarch64-pc-windows-msvc' }}
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: codex-rs/node-version.txt
+          architecture: x64
       - name: Install Linux build dependencies
         if: ${{ runner.os == 'Linux' }}
         shell: bash
@@ -596,6 +623,11 @@ jobs:
             sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
           fi
 
+      - name: Prebuild CLI test binaries
+        run: |
+          cargo build --all-features -p codex-cli --bin codex --target ${{ matrix.target }} --profile ci-test
+          cargo build --all-features -p codex-rmcp-client --bin test_stdio_server --target ${{ matrix.target }} --profile ci-test
+
       - name: tests
         id: test
         run: cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test --timings

.prettierignore

@@ -5,3 +5,6 @@ pnpm-lock.yaml
 prompt.md
 *_prompt.md
 *_instructions.md
+
+# Vendored parser bundle; keep upstream minified formatting intact.
+codex-rs/core/src/tools/js_repl/meriyah.umd.min.js

codex-rs/app-server/tests/common/models_cache.rs

@@ -50,6 +50,10 @@ fn preset_to_info(preset: &ModelPreset, priority: i32) -> ModelInfo {
     }
 }
 
+fn default_openai_provider_scope() -> String {
+    "provider_name=OpenAI;base_url=https://api.openai.com/v1;auth_mode=None".to_string()
+}
+
 /// Write a models_cache.json file to the codex home directory.
 /// This prevents ModelsManager from making network requests to refresh models.
 /// The cache will be treated as fresh (within TTL) and used instead of fetching from the network.
@@ -89,6 +93,7 @@ pub fn write_models_cache_with_models(
         "fetched_at": fetched_at,
         "etag": null,
         "client_version": client_version,
+        "provider_scope": default_openai_provider_scope(),
         "models": models
     });
     std::fs::write(cache_path, serde_json::to_string_pretty(&cache)?)

codex-rs/cli/build.rs

@@ -4,7 +4,10 @@ use std::path::PathBuf;
 use std::process::Command;
 
 fn main() {
-    let manifest_dir = std::env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR is set");
+    let Some(manifest_dir) = std::env::var_os("CARGO_MANIFEST_DIR") else {
+        println!("cargo:rustc-env=CODEX_CLI_VERSION=unknown");
+        return;
+    };
     let repo_root = Path::new(&manifest_dir).join("../..");
 
     configure_git_rerun_inputs(&repo_root);

codex-rs/core/src/codex.rs

@@ -5669,7 +5669,10 @@ pub(crate) async fn run_turn(
 
                     // Run reflection if enabled and we haven't exceeded max attempts.
                     let max_attempts = reflection_config.max_attempts;
-                    if reflection_enabled && reflection_attempt < max_attempts {
+                    if reflection_enabled
+                        && reflection_attempt < max_attempts
+                        && let Some(reflection_model_info) = reflection_model_info.as_ref()
+                    {
                         reflection_attempt += 1;
                         info!(
                             "Running reflection evaluation (attempt {}/{})",
@@ -5687,9 +5690,6 @@ pub(crate) async fn run_turn(
                             max_attempts,
                         );
 
-                        let reflection_model_info = reflection_model_info
-                            .as_ref()
-                            .expect("reflection model info");
                         match evaluate_reflection(
                             &sess.services.model_client,
                             reflection_model_info,