# Codex daemon upgrades

`codex-0.164.0.ebuild` retains the post-install daemon update introduced in
`codex-0.162.0-r1.ebuild`. Keep its
`pkg_postinst` function when bumping versions; upgrading `/usr/bin/codex` alone
does not replace an existing managed background-server package.

After a successful replacement on the live system, the hook runs
`codex app-server daemon update` for the existing shared home at
`/var/lib/ai/codex/.codex`. It accepts both legacy and current daemon package
layouts, checks that daemon settings belong to the merge user, and starts the
updater from that user's account home with a clean environment. It skips fresh
installs, alternate ROOTs, and Gentoo Prefix. It does not create a daemon or
change ownership.

The updater follows the upstream production channel and may restart the server.
It has a five-minute timeout; failures warn without failing the CLI merge.
The ebuild does not install a complete standalone package, so `--from-cli`
cannot be used. Override `CODEX_DAEMON_HOME` in `make.conf` for another shared
home, or set `CODEX_DAEMON_AUTO_UPDATE="no"` to disable this hook.

Keep the versioned recipe in this distribution authoring tree and the local
personal overlay consistent. Publish source updates through Crucible's normal
checked workflow; do not edit generated release trees.

```sh
emerge --pretend --oneshot '=dev-util/codex-0.164.0::personal'
bash /var/git/repos/personal/dev-util/codex/tests/test-postinst.bash \
  /var/lib/crucible/repos/srcux/sources/distribution/dev-util/codex/codex-0.164.0.ebuild
CODEX_HOME=/var/lib/ai/codex/.codex codex app-server daemon version
```

The behavior tests mock the updater and perform no download or restart. They
cover environment isolation, update failures and timeouts, both package
layouts, and the skip conditions. No Rust rebuild is needed to exercise the
hook, but installing the revision follows the normal Portage build process.

If an update migrates successfully but startup fails, correct the reported
error and run `codex app-server daemon start` using the same user and
`CODEX_HOME`. On 2026-10-08 a root-run daemon required its control socket
directory to be changed from workbench ownership to `root:root`, mode `0700`.
After that correction, CLI and server both reported 0.162.0. Do not change
ownership automatically in the ebuild; another user's daemon needs its own
permissions.

For 0.164.0, the lockfile replaces the separate `mxc` crates with
`mxc-sdk` at `b21120168d70befe12356411423266bfef168446` (`src/mxc-sdk`).
`rmcp` and `rmcp-macros` move to `98a54789b80110ad210495c4ad845c89e1980471`.
The other Git pins are unchanged. Upstream's toolchain pin is Rust 1.99.1;
`RUST_MIN_VER` is 1.99.0 because that is the newest packaged slot. V8
sandbox/pointer-compression assets are 152.2.0. The crate tarball already
contains every crates.io crate, including `libz-sys` 1.1.29, so `CRATES` is
empty. Every bump must check all Git pins against the new lockfile; changing
only the ebuild filename does not update them.