From 031b2eca45c4c22c158df2fefeba253e1aaa8441 Mon Sep 17 00:00:00 2001
From: Jhony Elmer Angulo Fabian <leohjaf@gmail.com>
Date: Thu, 26 Mar 2026 17:56:02 -0500
Subject: [PATCH] codex: 0.116.0 -> 0.118.0

Add a pinned librusty_v8 fetcher and set RUSTY_V8_ARCHIVE in the Nix
build environment.

This avoids rusty_v8 falling back to downloading the prebuilt V8 static
library during the build, which was causing the codex 0.118.0 build to
fail.

On Linux, also wrap `codex` with `bubblewrap` in PATH so the upstream
sandbox launcher can resolve `bwrap` correctly on NixOS.
---
 pkgs/by-name/co/codex/fetchers.nix    | 20 ++++++++++++++++++++
 pkgs/by-name/co/codex/librusty_v8.nix | 12 ++++++++++++
 pkgs/by-name/co/codex/package.nix     | 17 ++++++++++++-----
 3 files changed, 44 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/by-name/co/codex/fetchers.nix
 create mode 100644 pkgs/by-name/co/codex/librusty_v8.nix

diff --git a/pkgs/by-name/co/codex/fetchers.nix b/pkgs/by-name/co/codex/fetchers.nix
new file mode 100644
index 000000000000..0835ffdd365a
--- /dev/null
+++ b/pkgs/by-name/co/codex/fetchers.nix
@@ -0,0 +1,20 @@
+# not a stable interface, do not reference outside the codex package but make a copy if you need
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+{
+  fetchLibrustyV8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      sha256 = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+}
diff --git a/pkgs/by-name/co/codex/librusty_v8.nix b/pkgs/by-name/co/codex/librusty_v8.nix
new file mode 100644
index 000000000000..213a3174cee3
--- /dev/null
+++ b/pkgs/by-name/co/codex/librusty_v8.nix
@@ -0,0 +1,12 @@
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "146.4.0";
+  shas = {
+    x86_64-linux = "sha256-5ktNmeSuKTouhGJEqJuAF4uhA4LBP7WRwfppaPUpEVM=";
+    aarch64-linux = "sha256-2/FlsHyBvbBUvARrQ9I+afz3vMGkwbW0d2mDpxBi7Ng=";
+    x86_64-darwin = "sha256-YwzSQPG77NsHFBfcGDh6uBz2fFScHFFaC0/Pnrpke7c=";
+    aarch64-darwin = "sha256-v+LJvjKlbChUbw+WWCXuaPv2BkBfMQzE4XtEilaM+Yo=";
+  };
+}
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 3cbb31d2466f..d69950dcf3fc 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -1,15 +1,19 @@
 {
   lib,
   stdenv,
+  callPackage,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  cargo,
+  bubblewrap,
   clang,
   cmake,
   gitMinimal,
   libcap,
   libclang,
+  librusty_v8 ? callPackage ./librusty_v8.nix {
+    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
+  },
   makeBinaryWrapper,
   nix-update-script,
   pkg-config,
@@ -20,18 +24,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.116.0";
+  version = "0.118.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-PTsKphg3gPlBUs5oMM34RhJJ4jxvD6hand5aVjXcuZ4=";
+    hash = "sha256-FdtV+CIqTInnegcXrXBxw4aE0JnNDh4GdYKwUDjSk9Y=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-X5Yh8+3UrCZfzIplb4OzFfcfoklMu3FikU9vZ6CJbfc=";
+  cargoHash = "sha256-7rexlmc79eUkwcqTa8rN3GFDy1dWs+0h/SUllZqAcpM=";
 
   nativeBuildInputs = [
     clang
@@ -64,6 +68,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         "-Wno-error=character-conversion"
       ]
     );
+    RUSTY_V8_ARCHIVE = librusty_v8;
   };
 
   # NOTE: part of the test suite requires access to networking, local shells,
@@ -82,7 +87,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/codex --prefix PATH : ${lib.makeBinPath [ ripgrep ]}
+    wrapProgram $out/bin/codex --prefix PATH : ${
+      lib.makeBinPath ([ ripgrep ] ++ lib.optionals stdenv.hostPlatform.isLinux [ bubblewrap ])
+    }
   '';
 
   doInstallCheck = true;