From cc4bd5f859cdf01153d999995c20c9a457045bd6 Mon Sep 17 00:00:00 2001
From: Jhony Elmer Angulo Fabian <leohjaf@gmail.com>
Date: Sun, 25 Jan 2026 12:44:38 -0500
Subject: [PATCH] codex: 0.89.0 -> 0.92.0

- Update Codex from 0.89.0 to 0.92.0.
- Add cmake and git to nativeBuildInputs: rama-boring-sys uses git for patching
  during build.rs and boringssl builds via cmake; without these, local
  aarch64-darwin builds can fail with "No such file or directory".
- Add clang/libclang inputs plus LIBCLANG_PATH and compiler warning flags so
  bindgen can find libclang; keep GCC stringop-overflow and Clang
  character-conversion warning-as-error disabled to avoid known false positives
  in BoringSSL's a_bitstr.cc.
---
 pkgs/by-name/co/codex/package.nix | 34 +++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 890687be4703..38cf10a4911f 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -4,6 +4,10 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
+  clang,
+  cmake,
+  gitMinimal,
+  libclang,
   makeBinaryWrapper,
   nix-update-script,
   pkg-config,
@@ -14,26 +18,48 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.89.0";
+  version = "0.92.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-VFbtxGOqX80qWqVo+BG+BnUr8DiLCfcJCrN9fwy7utY=";
+    hash = "sha256-m/g+5wdehyaHDw6i5vik4HXiisY/iWFtPX0gKjCFPNY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-gg7KPEMO2aiBcIN8TllaDQeTLyw+WLfmMrXBKV/L53M=";
+  cargoHash = "sha256-fuT8vPb9/7fZam129nR6y+r+3j46WBhlf73Htkcjpzc=";
 
   nativeBuildInputs = [
+    clang
+    cmake
+    gitMinimal
     installShellFiles
     makeBinaryWrapper
     pkg-config
   ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    libclang
+    openssl
+  ];
+
+  # NOTE: set LIBCLANG_PATH so bindgen can locate libclang, and adjust
+  # warning-as-error flags to avoid known false positives (GCC's
+  # stringop-overflow in BoringSSL's a_bitstr.cc) while keeping Clang's
+  # character-conversion warning-as-error disabled.
+  env = {
+    LIBCLANG_PATH = "${lib.getLib libclang}/lib";
+    NIX_CFLAGS_COMPILE = toString (
+      lib.optionals stdenv.cc.isGNU [
+        "-Wno-error=stringop-overflow"
+      ]
+      ++ lib.optionals stdenv.cc.isClang [
+        "-Wno-error=character-conversion"
+      ]
+    );
+  };
 
   # NOTE: part of the test suite requires access to networking, local shells,
   # apple system configuration, etc. since this is a very fast moving target