test: qualify selected Codex runtime independently of legacy dependencies

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/__tests__/grok-public-install-sandbox.test.mjs

@@ -93,10 +93,33 @@ test('the installed Codex probe exercises the public export and rejects incomple
     assert.equal(JSON.parse(result.stdout).codexCommandLeaseVerified, true);
     assert.equal(readFileSync(join(server, 'lease-closed'), 'utf8'), 'ok');
     assert.equal(JSON.parse(result.stdout).providerCalls, 0);
+    const legacyPath = 'node_modules/legacy-codex-adapter/node_modules/@openai/codex-' + target;
+    const legacy = join(consumer, legacyPath); mkdirSync(legacy, { recursive: true });
+    const legacyManifest = { ...manifest, version: '0.156.1-' + target };
+    writeFileSync(join(legacy, 'package.json'), JSON.stringify(legacyManifest));
+    lock.packages[legacyPath] = { ...entry, version: legacyManifest.version,
+      resolved: 'https://registry.npmjs.org/@openai/codex/-/codex-' + legacyManifest.version + '.tgz' };
+    writeFileSync(join(consumer, 'package-lock.json'), JSON.stringify(lock));
+    result = run(); assert.equal(result.status, 0, result.stderr);
+    assert.equal(JSON.parse(result.stdout).codexPlatformPackages.length, 2);
+    assert.equal(JSON.parse(result.stdout).codexSelectedPlatformPath, platformPath);
+    assert.equal(JSON.parse(result.stdout).codexSelectedPlatformVersion, '0.160.0-' + target);
+    const legacyCommand = join(legacy, 'codex');
+    writeFileSync(legacyCommand, '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+    writeFileSync(index, `export const resolvePinnedCodexCommand = () => ${JSON.stringify(legacyCommand)};`);
+    result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /Selected Codex platform version must match the qualified pin/);
+    writeFileSync(index, `import { writeFileSync } from 'node:fs'; export const resolvePinnedCodexCommand = () => {
+      writeFileSync(${JSON.stringify(join(platform, 'package.json'))}, ${JSON.stringify(JSON.stringify({ ...manifest, altered: true }))});
+      return ${JSON.stringify(command)}; };`);
+    result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /metadata must match its scanned provenance/);
+    writeFileSync(join(platform, 'package.json'), JSON.stringify(manifest));
+    writeFileSync(index, "export const resolvePinnedCodexCommand = () => { throw new Error('Bundled Codex runtime version mismatch'); };");
+    result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /Bundled Codex runtime version mismatch/);
+    writeFileSync(index, `export const resolvePinnedCodexCommand = () => ${JSON.stringify(command)};`);
     const emptySlot = join(server, 'node_modules/@openai/codex-' + target);
     mkdirSync(emptySlot, { recursive: true });
     result = run(); assert.equal(result.status, 0, result.stderr);
-    assert.equal(JSON.parse(result.stdout).codexPlatformPackages.length, 1,
+    assert.equal(JSON.parse(result.stdout).codexPlatformPackages.length, 2,
       'An empty nested npm optional slot must not obscure the qualified hoisted host package');
     writeFileSync(join(emptySlot, 'undeclared-native-payload'), 'native fixture; never executed');
     result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /empty regular directory; found.*undeclared-native-payload/);
@@ -144,13 +167,17 @@ test('actual tar member checks allow Codex JavaScript but reject nested platform
   assert.match(source, /assertNoBundledCodexPayloads\(run\('tar', \['-tzf', tarball\]\)/);
 });
 
-test('consumer provenance rejects bundled, foreign, unpinned and non-official Codex payloads', () => {
+test('consumer provenance rejects bundled, foreign, inconsistent and non-official Codex payloads', () => {
   const path = 'node_modules/@openai/codex-linux-x64';
   const manifest = { name: '@openai/codex', version: '0.160.0-linux-x64', os: ['linux'], cpu: ['x64'] };
   const entry = { version: manifest.version, resolved: `https://registry.npmjs.org/@openai/codex/-/codex-${manifest.version}.tgz`,
     integrity: `sha512-${Buffer.alloc(64, 1).toString('base64')}` };
-  const check = (value = entry, installed = [{ path, manifest }]) => assertInstalledCodexPlatformProvenance({ packages: { [path]: value } }, installed, '0.160.0', 'linux-x64');
+  const check = (value = entry, installed = [{ path, manifest }]) => assertInstalledCodexPlatformProvenance({ packages: { [path]: value } }, installed, 'linux-x64');
   assert.equal(check().codexConsumerHostOnly, true);
+  const legacyManifest = { ...manifest, version: '0.156.1-linux-x64' };
+  assert.equal(check({ ...entry, version: legacyManifest.version,
+    resolved: 'https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-linux-x64.tgz' }, [{ path, manifest: legacyManifest }]).codexConsumerHostOnly, true);
+  assert.throws(() => check(entry, [{ path, manifest: { ...manifest, version: '^0.160.0-linux-x64' } }]), /exact host version/);
   for (const change of [
     { inBundle: true }, { link: true }, { version: '0.156.1-linux-x64' },
     { resolved: 'https://example.com/@openai/codex/-/codex-0.160.0-linux-x64.tgz' },

scripts/grok-public-install-sandbox.mjs

@@ -24,17 +24,19 @@ export function assertNoBundledCodexPayloads(entries) {
   }
 }
 
-// This same pure check is embedded in the offline installed consumer below.
-export function assertInstalledCodexPlatformProvenance(lock, installed, expectedVersion, target) {
+// Verify every host payload against its own official npm provenance, including
+// independent legacy closures. The selected native runtime is pinned below.
+export function assertInstalledCodexPlatformProvenance(lock, installed, target) {
   assert.match(target, /^(linux|darwin|win32)-(x64|arm64)$/);
   assert.ok(Array.isArray(installed) && installed.length > 0, 'Consumer must install its host Codex platform package');
   const alias = `@openai/codex-${target}`;
   for (const { path, manifest } of installed) {
     assert.ok(path.endsWith(`/node_modules/${alias}`) || path === `node_modules/${alias}`,
       'Consumer must contain only the host Codex platform payload');
-    const version = `${expectedVersion}-${target}`;
+    const version = manifest.version;
+    assert.ok(typeof version === 'string' && version.endsWith('-' + target)
+      && /^\d+\.\d+\.\d+$/.test(version.slice(0, -target.length - 1)), 'Installed Codex platform must declare an exact host version');
     assert.ok([alias, '@openai/codex'].includes(manifest.name), 'Installed Codex platform package identity must match its alias');
-    assert.equal(manifest.version, version, 'Installed Codex platform version must match the qualified pin');
     const [os, cpu] = target.split('-');
     assert.deepEqual(manifest.os, [os]);
     assert.deepEqual(manifest.cpu, [cpu]);
@@ -102,7 +104,7 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi
         }
       }
     }
-    const provenance = (${assertInstalledCodexPlatformProvenance.toString()})(lock, installed, ${JSON.stringify(expectedVersion)}, process.platform + '-' + process.arch);
+    const provenance = (${assertInstalledCodexPlatformProvenance.toString()})(lock, installed, process.platform + '-' + process.arch);
     const index = ${JSON.stringify(indexPath)};
     assert.ok(contained(index), 'Codex public index must be installed in the consumer');
     const { resolvePinnedCodexCommand } = await import(pathToFileURL(index).href);
@@ -112,8 +114,12 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi
     assert.ok(statSync(command).isFile(), 'Pinned Codex must be a regular executable');
     accessSync(command, constants.X_OK);
     const selectedPlatformManifest = realpathSync(createRequire(command).resolve('@openai/codex-' + process.platform + '-' + process.arch + '/package.json'));
-    assert.ok(installed.some(({ path }) => realpathSync(join(root, path, 'package.json')) === selectedPlatformManifest),
-      'Codex wrapper must resolve an official host platform package from its installed graph');
+    const selectedPlatform = installed.find(({ path }) => realpathSync(join(root, path, 'package.json')) === selectedPlatformManifest);
+    assert.ok(selectedPlatform, 'Codex wrapper must resolve an official host platform package from its installed graph');
+    const selectedMetadata = JSON.parse(readFileSync(selectedPlatformManifest, 'utf8'));
+    assert.deepEqual(selectedMetadata, selectedPlatform.manifest, 'Selected Codex platform metadata must match its scanned provenance');
+    assert.equal(selectedMetadata.version, ${JSON.stringify(expectedVersion)} + '-' + process.platform + '-' + process.arch,
+      'Selected Codex platform version must match the qualified pin');
     const version = execFileSync(command, ['--version'], { timeout: 30_000, maxBuffer: 128 * 1024, encoding: 'utf8',
       env: { PATH: '/usr/local/bin:/usr/bin:/bin', HOME: '/tmp', NODE_PATH: '' } }).trim();
     assert.equal(version, 'codex-cli ' + ${JSON.stringify(expectedVersion)}, 'Installed Codex version must match the qualified pin');
@@ -130,7 +136,7 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi
     const lease = await installation.openCommand();
     await lease.close();
     console.log(JSON.stringify({ pinnedCodexCommandVerified: true, pinnedCodexVersion: ${JSON.stringify(expectedVersion)},
-      ...provenance, codexQualifiedInstallationVerified: true, codexCommandLeaseVerified: true, providerCalls: 0 }));
+      ...provenance, codexSelectedPlatformPath: selectedPlatform.path, codexSelectedPlatformVersion: selectedMetadata.version, codexQualifiedInstallationVerified: true, codexCommandLeaseVerified: true, providerCalls: 0 }));
   `;
 }