Publish srcux candidate 0000000776-20261021-173123

3 files changed, 229 insertions, 11 deletions

diff --git a/dev-util/codex/Manifest b/dev-util/codex/Manifest
index 6571b3749506..31e43347236b 100644
--- a/dev-util/codex/Manifest
+++ b/dev-util/codex/Manifest
@@ -1,12 +1,9 @@
 DIST cloudflare-zlib-sys-0.3.6.crate 147199 BLAKE2B b7089d328048b838fd9003f14cd9bddb720507a3426bd3a99ab70aa32dabee44078d6e9f9cc0171d7674ebf084fdd60776063e6976d5bd9ae61b2943c94c00d1 SHA512 c0064ab7dda47088450b3abd0ac12981e1db44564e7acf03af0836f9a9c54310cac5f93dd0cbc64c32749ea9cfe899ead81533f630dd00f5e29e9c6ef7150e6e
-DIST codex-0.157.0.tar.gz 16112186 BLAKE2B 10bd25c71650418e8b0dbd21b9903ccf474e52ea002c959adba99e929293acdef35290ce73f7c794ebb180a821a30943e79c2d002c10df32f8251a7c280b2ae9 SHA512 9d74ac25bbf53b755b9131f41e2048c06e6a78499f61dc942630511f6ff26da0fa12a0aa72f0c3813915a98bb9de20901d2549d2c09425d570655d209e36ffbc
-DIST codex-0.160.0.tar.gz 16677782 BLAKE2B 426ee2ecddf9ed54f36ade4350cb0961d0ca612caf54054f6803c4135f86395f25fd48f1b3701d55bc1a361903a11d71d5a6fdbb690070a34e9e1293a021df79 SHA512 f0b44cff050e8f665a4019c6cb20923dbafb9ae93dec4ae52595c1406962db77d23006c4a655291bfd175278a94e89366cc79e79847c8e15d5c6779b76393fd1
 DIST codex-0.162.0.tar.gz 17185464 BLAKE2B 598d6225e1771f3613b0a9a78966e1a362fd1e9ad7e1e20a39e3f3df66bdf0fe5e5fd8c2f426464a50bb5bcad0308d9db761f56c492f5599aad7a87c2947225c SHA512 a83fb429657816e7e3eb81220b139988bbd884343c72cb53244dbac60ff9478bdd44781f262e2e749ed38004806eb23fa5782949e07c70cd2e802cfc67af7a46
-DIST codex-rust-v0.157.0-crates.tar.xz 157554932 BLAKE2B 97eed631134b7a03e2923f1a1a8548d1c746e8b24f43fe352fc47b27a2c02de15ad676939976eefb515786fa314cc6f0499dc46fc6e3559c13a4dea0fd7c21ba SHA512 9fb979c584745cf77c99638f83465a953ee100aff8c048700318d09bbd6105d0c25b8eeefd9b9dc5bd414370591d0f6acc89c9d4f5d0a262bb6424532aea4c6d
-DIST codex-rust-v0.160.0-crates.tar.xz 157575148 BLAKE2B 604051f98230a239a8f7a25b100cdbb70a36a7c2cc76881e776a530a747ddd377c3b72d6a775157f5a61a7fb2c4dbf54ab017550bd78ec937ff72612203f4963 SHA512 e0c76be465c904edd8acb07235ec645b71c816be62195f4ff4f9d9150638800fe67dfed1a0ec30df356bd60dc152505924798c599ea94177ee0a7d7eca5cfbf4
+DIST codex-0.163.0.tar.gz 17505520 BLAKE2B 07894bdcc675592346acfc71998ac31cba847c4816cb6f0d85b451006cc1576ad2c1c4531d3cd85c31e18b40ecd74422a2a64c80654e11d5b4aa3c85141f68aa SHA512 5ae2a24f1d359b4ba0ad782c362c7a84bbb436f8f4a6e920338db9d095a469f28fa51e01002dfe79478a06565a93dd750881e5784cc9ff9ae31a0081aee975ec
 DIST codex-rust-v0.162.0-crates.tar.xz 158312872 BLAKE2B 28c01090275034d0ea5dc1178775970ff7f1ab79b77b1e583114824ed031e895ddb5e719e2a2a937e48378b66c48b45e61559cdee0d8f8f945b41202c269a603 SHA512 4af40e540fd92c972742a600d345f752afd584686ccec43c5a8e692c8f2821d797c223a72a4b5104c68b0e65f2c4c3845d0578475cb31ba4a77a119a2075b28f
+DIST codex-rust-v0.163.0-crates.tar.xz 158329364 BLAKE2B e4f131dd59982013715ed9d88d155399b10d21ab6fef247b05c8de04583c57db16621b67644a58f366d36c20d8867499f05d5f232f8f53718eb1ab181e992a86 SHA512 be2fd2e614799d537e832467c2230874ff443c69944ff435e3c32b512cff08f7d284ba91bae57208d65856c72931b01d805845f1978a134b7a9504563c49ebb1
 DIST crossterm-ed1cdab335221515706178d68495bba2aed1924f.gh.tar.gz 162382 BLAKE2B 6611cdebbdce8f8b0795f344d1826bc17a6b06b8a24754a0c3db5e85acb1c38aab29624d4c7e59eba1d75da602be7eff4509bd251ba9c9df752a923b1356167b SHA512 960fc78854343bb811d6811e628575c6bbd01e24416613d2ee4fc695016031c5a87cf0da31c53a04fada1582b7447d1128a1c645e311c3d157a09e256f3790ee
-DIST crossterm-efa177859fd9623d57b9fe7ae9bf491ae1ac6ec4.gh.tar.gz 145349 BLAKE2B c75ce5f67f7d0040f183a32cd1d8420a307e2acf11de9163a0c69fbd788de34452dcc48b160b2cf15d64c971634f7fe93a50127582aaac14d70373a4b68324f4 SHA512 6aedeb88d51e59db101aa37a0f3b77f24f4a251e3a3da533c32c6919102b93ff02cdcb4b37b3eeb7407debf1c970c51e6f05bf0baa0eb206497a33c6c9e68895
 DIST h3-e07e69412876f7e26f026bd75a48b2704d8c8283.gh.tar.gz 244832 BLAKE2B bea2d550925b09b3fd0a33aef734a26a7457d91dc0a89fe72cd6de684dd2f2a37de5ac615691e7d92cc47fa7aaad4ab13c253dd30eaa3287f7d62e139f77d07a SHA512 9dc2589b2ea013f6bb79c05fb515fdf236834116241ecb33c783b64102e3904c11beea7d75ad12d3fd48b66276387da96c162657010292eae5a8c84260ef94d2
 DIST libz-ng-sys-1.1.16.crate 478122 BLAKE2B 7c1be97251029732cd3a8c77dad8a492193282b5fddf40df480ef3a35a49f5d25c7dc183d81aa267722276156c8b97243742117686d078f2d3a566546fa83d58 SHA512 c7d1b062a06b283ee2d398ff456f13634ed1d2d436ea2b8a55f19fbbad47bc419e068b0f9e805221321062b8c5ad309dd3e5d466741780549ae3e5299eee06e1
 DIST libz-sys-1.1.20.crate 830422 BLAKE2B 26265b1faf04f7d0cfd751ddf003585b1be59fcf8fde3ddfd86f18cc3e2d5c3b62a808f47c01329a57759d14fe6283cd94a72eda46d5c5031249df0f1696ab03 SHA512 9b537e7c01553e782be145223c6d174601ade3a950bfd0eb4ea09658da5b8910cf0d0c5984672f9d198f73d5aa63d21e0c20c4c44ff7d0a017ee11ae4ecf4859
@@ -14,6 +11,7 @@ DIST mxc-6cd3d58f05d3447e67109cfb75e042803b843ca4.gh.tar.gz 5985947 BLAKE2B f2c4
 DIST nucleo-4253de9faabb4e5c6d81d946a5e35a90f87347ee.gh.tar.gz 86782 BLAKE2B a812a2d2f08df818ac7b13b800f51c4229ea1f968668b1224fbc1fd82fb4e045f6b2c536ec6d2647a579097efbddaf041f4b7b356107679156aaa3ca5a9d4068 SHA512 354061278efce55defb30b9ee2ef5cdab745ab56d7d113f6f47a8ac174b4215ec6efe15c15bef0e3d907350182c0d189071e9d7d17d40e807d4db5361682f4e0
 DIST rules_rust-b56cbaa8465e74127f1ea216f813cd377295ad81.gh.tar.gz 3951333 BLAKE2B e369b7ccc25326726340fced4c8f8f9181f02f45be9d5f24d00201999a2b11c42d010e7623429b1910db7fdfdf4c202e061a5ba5db722d3126ee26d9597d7e0d SHA512 3f2ef3d7940096fa34b85ee0d9979085fe99c7d2ae8c5ed9399bd5cf8370a31fa93d16c752f22166b42d30c2b7f9f921f7a963928519592e3ffd588644d3b1c7
 DIST rust-sdk-3e636cab26c013eca5131103c03d20237f12c4df.gh.tar.gz 711661 BLAKE2B b7b03cfc9f5c5bb063d8d40eadb7f294acc77b52c577e4a6f1837c21c282d87dd77832771e0a7d13f7e1e62cac96b86d04747057670b64f46832fd1b3eca3d21 SHA512 8e8cb7302c81c4e8e3b05fb95ac8cc43e28fdd168a4625847aca550631413af17e1296ff433824e533074cf41c03eba29e6c56d80b81cf9ecdc1631b72e732ed
+DIST rust-sdk-4048ac40e958fb1a7d614617a2ae8d26666ee2fa.gh.tar.gz 741132 BLAKE2B 282c360ef618299529c285d92dc586e4af890a842092766bcaff9dd487198122ee320070a5b68df5ea5bf1d9acbc3d5639d6b715ecb0419b61ed4a1ac9b78723 SHA512 d01b0cd0814abedfcd71e8b6fd5365af305da1547cbef009e9da043a6259d79fcfd45a1a78db8956a20763d72e878bd1dfe56e93b73836807a83a59c3b1c3601
 DIST rusty_v8_150.4.0_librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz 28897449 BLAKE2B ff719ae67fb52adbe51ac310aa56d059cdd81b466f0e3cc056367888257df306c0554773e2474f2e6438ab2c0e3c29bd039fb1e083f695164cb4db3c22a60cc0 SHA512 5a858b6eea1080cf1182caef98c58ccb62c44a52969e5e3409b2b9a9fb2adc2e2b98273195328e4608d4027b80ea1fc6eea286ba53b9796eab46dbe998213784
 DIST rusty_v8_150.4.0_librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz 29557041 BLAKE2B eb2a923086cf66e6c9d3322889f3e9dbbd6cba2b70aff1ecc5bfd3954ffd24a1eb079a1ce4f2852c54a03270919c93617dac479259bc0a9fefaa04f6f12a2806 SHA512 a29c010e56a64a9abcca01606bae1961c74fe8be38eed73c3ef6670013d8998f0c9e806ef00c46dc33cc38dff72d8941a4cfe8a984113134b841aa2404972ede
 DIST rusty_v8_150.4.0_src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs 39884 BLAKE2B b21381b7f09d0205455ba541b2a38ff79b9535c4b8436b309f39f4b40d819e604b3689298ae81deb00c07a12a21ef0fd1bd0bbddb196d63f24d8621ace7165c1 SHA512 4ebc8dfb8b87fb6e1b39a67582e4690278ebcadf8a18314f642fd6658e2b5706a7acbbd52ab1899d985700a8e886dda6a601a29d977bdfcc9da46209b1a90571
diff --git a/dev-util/codex/README.md b/dev-util/codex/README.md
index 85276ef79cef..1e4eecdd516e 100644
--- a/dev-util/codex/README.md
+++ b/dev-util/codex/README.md
@@ -1,6 +1,7 @@
 # Codex daemon upgrades
 
-`codex-0.162.0-r1.ebuild` adds the post-install daemon update. Keep its
+`codex-0.163.0.ebuild` retains the post-install daemon update introduced in
+`codex-0.162.0-r1.ebuild`. Keep its
 `pkg_postinst` function when bumping versions; upgrading `/usr/bin/codex` alone
 does not replace an existing managed background-server package.
 
@@ -18,14 +19,14 @@ The ebuild does not install a complete standalone package, so `--from-cli`
 cannot be used. Override `CODEX_DAEMON_HOME` in `make.conf` for another shared
 home, or set `CODEX_DAEMON_AUTO_UPDATE="no"` to disable this hook.
 
-The matching revision is available immediately in the local personal overlay.
-This source revision enters srcux through its normal publication process;
-published release trees have not been edited.
+Keep the versioned recipe in this distribution authoring tree and the local
+personal overlay consistent. Publish source updates through Crucible's normal
+checked workflow; do not edit generated release trees.
 
 ```sh
-emerge --pretend --oneshot '=dev-util/codex-0.162.0-r1::personal'
+emerge --pretend --oneshot '=dev-util/codex-0.163.0::personal'
 bash /var/git/repos/personal/dev-util/codex/tests/test-postinst.bash \
-  /var/lib/crucible/repos/srcux/sources/distribution/dev-util/codex/codex-0.162.0-r1.ebuild
+  /var/lib/crucible/repos/srcux/sources/distribution/dev-util/codex/codex-0.163.0.ebuild
 CODEX_HOME=/var/lib/ai/codex/.codex codex app-server daemon version
 ```
 
@@ -41,3 +42,9 @@ directory to be changed from workbench ownership to `root:root`, mode `0700`.
 After that correction, CLI and server both reported 0.162.0. Do not change
 ownership automatically in the ebuild; another user's daemon needs its own
 permissions.
+
+For 0.163.0, `rmcp` and `rmcp-macros` use upstream lockfile revision
+`4048ac40e958fb1a7d614617a2ae8d26666ee2fa`. The other Git pins, Rust 1.95.0
+minimum, and V8 150.4.0 sandbox/pointer-compression assets remain unchanged.
+Every bump must check all Git pins against the new lockfile; changing only the
+ebuild filename does not update them.
diff --git a/dev-util/codex/codex-0.163.0.ebuild b/dev-util/codex/codex-0.163.0.ebuild
new file mode 100644
index 000000000000..1baaed744e46
--- /dev/null
+++ b/dev-util/codex/codex-0.163.0.ebuild
@@ -0,0 +1,213 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# NOTE: This package uses a pre-built crate tarball instead of listing individual
+# crates in CRATES="". This approach is required because:
+# 1. Codex has 800+ crate dependencies, which triggers Portage QA warnings:
+#    "QA Notice: This package uses a very large number of CRATES. Please provide
+#    a crate tarball instead and fetch it via SRC_URI."
+# 2. Stricter ebuild QA checks (e.g., in CI pipelines) fail with too many crates.
+#
+# The crate tarball is auto-generated by GitHub Actions at:
+#   https://github.com/gentoo-zh-drafts/codex/
+# Workflow source code for auditing:
+#   https://github.com/gentoo-zh-drafts/codex/blob/crate-dist/.github/workflows/crates.yml
+# This allows anyone to review and verify the crate packaging process.
+
+CRATES="
+	cloudflare-zlib-sys@0.3.6
+	libz-ng-sys@1.1.16
+	libz-sys@1.1.20
+"
+
+declare -A GIT_CRATES=(
+	[appcontainer_common]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/backends/appcontainer/common'
+	[crossterm]='https://github.com/openai-oss-forks/crossterm;ed1cdab335221515706178d68495bba2aed1924f;crossterm-%commit%'
+	[h3]='https://github.com/hyperium/h3;e07e69412876f7e26f026bd75a48b2704d8c8283;h3-%commit%/h3'
+	[h3-quinn]='https://github.com/hyperium/h3;e07e69412876f7e26f026bd75a48b2704d8c8283;h3-%commit%/h3-quinn'
+	[learning_mode_core]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/learning_mode_core'
+	[learning_mode_windows]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/backends/learning_mode/windows'
+	[mxc_config_contract]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/mxc_config_contract'
+	[mxc_telemetry]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/mxc_telemetry'
+	[process_security_environment_spec]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/generated/process_security_environment_specification'
+	[nucleo-matcher]='https://github.com/helix-editor/nucleo;4253de9faabb4e5c6d81d946a5e35a90f87347ee;nucleo-%commit%/matcher'
+	[nucleo]='https://github.com/helix-editor/nucleo;4253de9faabb4e5c6d81d946a5e35a90f87347ee;nucleo-%commit%'
+	[rmcp]='https://github.com/modelcontextprotocol/rust-sdk;4048ac40e958fb1a7d614617a2ae8d26666ee2fa;rust-sdk-%commit%/crates/rmcp'
+	[rmcp-macros]='https://github.com/modelcontextprotocol/rust-sdk;4048ac40e958fb1a7d614617a2ae8d26666ee2fa;rust-sdk-%commit%/crates/rmcp-macros'
+	[sandbox_spec]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/generated/base_container_specification'
+	[runfiles]='https://github.com/dzbarsky/rules_rust;b56cbaa8465e74127f1ea216f813cd377295ad81;rules_rust-%commit%/rust/runfiles'
+	[tokio-tungstenite]='https://github.com/openai-oss-forks/tokio-tungstenite;0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186;tokio-tungstenite-%commit%'
+	[tungstenite]='https://github.com/openai-oss-forks/tungstenite-rs;4fffad30fe373adbdcffab9545e9e9bf4f2fc19f;tungstenite-rs-%commit%'
+	[wxc_common]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/wxc_common'
+)
+
+RUST_MIN_VER="1.95.0"
+
+# python3 .github/scripts/rusty_v8_bazel.py resolved-v8-crate-version
+RUSTY_V8_TAG="150.4.0"
+
+inherit cargo check-reqs toolchain-funcs
+
+CHECKREQS_MEMORY="15G"
+CHECKREQS_DISK_BUILD="20G"
+
+DESCRIPTION="Codex CLI - OpenAI's AI-powered coding agent"
+HOMEPAGE="https://github.com/openai/codex"
+
+# The crate tarball URL uses ${PV} so it auto-updates when bumping versions.
+# This tarball is generated by: https://github.com/gentoo-zh-drafts/codex/
+# See .github/workflows/crates.yml for the generation process.
+SRC_URI="
+	https://github.com/openai/${PN}/archive/rust-v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/gentoo-zh-drafts/codex/releases/download/rust-v${PV}/codex-rust-v${PV}-crates.tar.xz
+	amd64? (
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz
+			-> rusty_v8_${RUSTY_V8_TAG}_librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs
+			-> rusty_v8_${RUSTY_V8_TAG}_src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs
+	)
+	arm64? (
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz
+			-> rusty_v8_${RUSTY_V8_TAG}_librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs
+			-> rusty_v8_${RUSTY_V8_TAG}_src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs
+	)
+	${CARGO_CRATE_URIS}
+"
+
+S="${WORKDIR}/${PN}-rust-v${PV}/codex-rs"
+
+LICENSE="Apache-2.0"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD-2 BSD Boost-1.0
+	CC0-1.0 CDLA-Permissive-2.0 ISC MIT MPL-2.0 Unicode-3.0 ZLIB
+"
+SLOT="0"
+KEYWORDS="-* ~amd64 ~arm64"
+# Tests fail due to ring crate conflicts with system OpenSSL
+RESTRICT="test"
+
+DEPEND="
+	dev-libs/openssl:=
+	sys-apps/dbus
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+# rust does not use *FLAGS from make.conf, silence portage warning
+QA_FLAGS_IGNORED="usr/bin/${PN} usr/bin/codex-code-mode-host"
+
+pkg_pretend() {
+	check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	check-reqs_pkg_setup
+	rust_pkg_setup
+	if tc-is-lto; then
+		export CARGO_PROFILE_RELEASE_LTO=thin
+	else
+		export CARGO_PROFILE_RELEASE_LTO=false
+	fi
+}
+
+gen_git_crate_dir() {
+	# https://github.com/gentoo/gentoo/blob/b09dd88412fe2d5eee5a8891e08bfa2d67848da3/eclass/cargo.eclass#L442
+	IFS=';' read -r crate_uri commit crate_dir <<<"${GIT_CRATES[$1]}"
+	echo "${WORKDIR}/${crate_dir//%commit%/${commit}}"
+}
+
+src_prepare() {
+	default
+
+	# Fix tokio-tungstenite's git dependency on tungstenite
+	sed -i '/^\[dependencies\.tungstenite\]/,/^$/{
+		s|git = "[^"]*"|path = "'"$(gen_git_crate_dir tungstenite)"'"|
+		/^rev = /d
+	}' "$(gen_git_crate_dir tokio-tungstenite)/Cargo.toml" || die
+
+	# Remove the [patch.crates-io] section and add path-based patches
+	sed -i '/^\[patch\.crates-io\]/,/^$/d' "${S}/Cargo.toml" || die
+	sed -i '/^\[patch\."ssh:\/\/git@github\.com/,/^$/d' "${S}/Cargo.toml" || die
+
+	# Add new patch section with local paths
+	cat >> "${S}/Cargo.toml" <<-EOF || die
+
+	[patch.crates-io]
+	crossterm = { path = "$(gen_git_crate_dir crossterm)" }
+	tokio-tungstenite = { path = "$(gen_git_crate_dir tokio-tungstenite)" }
+	tungstenite = { path = "$(gen_git_crate_dir tungstenite)" }
+	EOF
+}
+
+src_compile() {
+	local rusty_v8_triple
+	use amd64 && rusty_v8_triple=x86_64-unknown-linux-musl
+	use arm64 && rusty_v8_triple=aarch64-unknown-linux-musl
+
+	# codex-core trait resolution overflows rustc's default 8MiB stack
+	export RUST_MIN_STACK=16777216
+
+	# codex-code-mode-runtime enables V8's sandbox and pointer compression.
+	RUSTY_V8_ARCHIVE="${DISTDIR}/rusty_v8_${RUSTY_V8_TAG}_librusty_v8_ptrcomp_sandbox_release_${rusty_v8_triple}.a.gz" \
+	RUSTY_V8_SRC_BINDING_PATH="${DISTDIR}/rusty_v8_${RUSTY_V8_TAG}_src_binding_ptrcomp_sandbox_release_${rusty_v8_triple}.rs" \
+		cargo_src_compile --package codex-cli --package codex-code-mode-host
+}
+
+src_install() {
+	# The CLI starts Code Mode through a sibling executable.
+	dobin "$(cargo_target_dir)/codex" \
+		"$(cargo_target_dir)/codex-code-mode-host"
+	einstalldocs
+}
+
+pkg_postinst() {
+	# Only update an existing daemon after a merge on the running system.
+	[[ ${ROOT} == / && -z ${EPREFIX} && -n ${REPLACING_VERSIONS} ]] || return 0
+	[[ ${CODEX_DAEMON_AUTO_UPDATE:-yes} == yes ]] || return 0
+
+	# Portage does not inherit the interactive shell's CODEX_HOME reliably.
+	# This distribution uses a shared home; other installations can override it
+	# with CODEX_DAEMON_HOME in make.conf.
+	local codex_home=${CODEX_DAEMON_HOME:-/var/lib/ai/codex/.codex}
+	[[ -d ${codex_home}/app-server-daemon ]] || return 0
+	[[ -L ${codex_home}/packages/app-server-daemon/current ||
+		-L ${codex_home}/packages/standalone/current ]] || return 0
+
+	# Do not run a user's daemon as root or change its ownership during a merge.
+	if [[ ! -O ${codex_home}/app-server-daemon/settings.json ]]; then
+		ewarn "Skipping Codex daemon update: settings are not owned by the merge user."
+		ewarn "Run 'codex app-server daemon update' as the daemon owner."
+		return 0
+	fi
+
+	# A restarted daemon must not inherit Portage's temporary HOME or build env.
+	local passwd_entry daemon_user daemon_home daemon_shell unused
+	if ! passwd_entry=$(getent passwd "${EUID}"); then
+		ewarn "Cannot resolve the merge user's home; update the Codex daemon manually."
+		return 0
+	fi
+	IFS=: read -r daemon_user unused unused unused unused daemon_home daemon_shell \
+		<<< "${passwd_entry}"
+	if [[ ${daemon_home} != /* || ! -d ${daemon_home} ]]; then
+		ewarn "The merge user's home is unavailable; update the Codex daemon manually."
+		return 0
+	fi
+
+	einfo "Updating the Codex background server in ${codex_home} (may restart it)..."
+	# The system build has no standalone package manifest, so --from-cli is
+	# unavailable. Use the upstream daemon updater with a bounded wait.
+	if ! ( cd "${daemon_home}" && env -i HOME="${daemon_home}" \
+		USER="${daemon_user}" LOGNAME="${daemon_user}" SHELL="${daemon_shell}" \
+		PATH=/usr/sbin:/usr/bin:/sbin:/bin CODEX_HOME="${codex_home}" \
+		/usr/bin/timeout --kill-after=10s 300s \
+		"${EROOT}usr/bin/codex" app-server daemon update ); then
+		ewarn "Codex CLI was installed, but the background server update did not complete."
+		ewarn "Retry: CODEX_HOME='${codex_home}' codex app-server daemon update"
+		ewarn "If migration completed but startup failed, fix the reported error and run:"
+		ewarn "CODEX_HOME='${codex_home}' codex app-server daemon start"
+	fi
+}