fix(codex): backport 0.159 bindings and runtime compatibility

[AIdoesmyjob]

Before this update, the fork carried older protocol bindings and endpoint behavior. Live Codex is now 0.159.3, independently updated outside this release lane and freshly checked against the candidate. This separate compatibility batch backports pingdotgg#14311 from pingdotgg/t3code on top of the first reliability batch.

The three generated 0.159 protocol artifacts match upstream exactly. Minimal prerequisite runtime adaptations use the relevant portions of pingdotgg#11338, pingdotgg#13480, and pingdotgg#13481: paginated history reads, stricter MCP elicitation JSON typing, required project IDs, nullable request parameters, and thread/revert in place of the removed rollback endpoint. They do not introduce the broader managed account/token stack from pingdotgg#14290.

Compatibility: minimum Codex CLI 0.156, recommended 0.159; the verified live CLI already meets this. Existing legacy history remains readable/resumable, while unsupported legacy-history rewind is restricted on the server. The CLI itself is not upgraded by this PR.

Validation: focused protocol/runtime tests and scoped typechecks passed, with independent safe/compatibility review and 95 relevant tests. Generated artifacts were compared to upstream. The server-side legacy rewind restriction is preserved; actual production conversation continuity passed as recorded below.

Combined-candidate acceptance at exact tip 2ee25b539546efcf2d8b27eeb39f6c45e5eb6677: pinned pnpm 11.10 frozen-lock install passed; all 15 root typecheck tasks passed locally and on Linux; changed TypeScript lint exited zero (warnings only); Linux targeted suites passed 969 tests; full Linux server tests passed 4,081 tests, with 10 skips limited to optional real-provider opt-in / Windows cases; full Linux web tests passed 3,910 tests. Web/server builds and clean-install package smoke passed: HTML, byte-exact served JavaScript, SQLite integrity with 47 migrations, authenticated isolated config/model catalog containing eight Skofo model entries with default gpt-6-astra, and real Codex CLI 0.159.2 protocol-schema compatibility. The checkout is clean. These are recorded acceptance results, not a claim of green GitHub CI.

Installable VM package: /home/monstrcow/.local/share/t3code-deploy/packages/t3-0.0.40-skofo.20260930.reliability1.tgz, SHA-256 045bc56c6be97dc4235d8b39ac12261e434ddb3bafb0db6eb49f8ee741938b56. All 14 direct runtime dependency versions match the frozen lockfile exactly.

Isolated browser acceptance: PASS. Rendered chat widths measured 768 / 1,152 / 1,504 px; the 390 px mobile layout had no horizontal overflow; composer draft and terminal state persisted; the eight-model Skofo catalog and default gpt-6-astra were verified without starting a provider turn. Lukas explicitly approved read-only verification through the existing authenticated production browser session; final production catalog verification passed. No production authentication bypass or permanent verification grant has been created.

Final production acceptance and publication: PASS. Deployed exact source 2ee25b539546efcf2d8b27eeb39f6c45e5eb6677, version 0.0.40-skofo.20260930.reliability1, using the immutable package/checksum above. Source was published by a normal fast-forward with no force, squash, rebase, or SHA rewriting; fork main is exactly the deployed HEAD. All six batch PRs #3–#8 were marked merged at 2026-10-01T17:44:16Z.

Production checks passed: byte-exact installed server/web assets, all 14 runtime dependency pins, Node 24, internal endpoint, public HTTP 302 authentication edge with HSTS, unchanged SQLite user version 0 and 47 migrations, no fatal service logs, stable PID / zero automatic restarts, and authenticated production catalog/UI. Two interrupted threads automatically resumed once in their original Claude conversations, made real progress, and consumed their recovery markers; no extra manual retry prompt was sent. The normal unconsumed five-minute startup grant was preserved and no permanent verification grant was minted. The temporary restart setting was removed with a fresh compare-and-swap and General Settings confirmed it off. Original control-group behavior, 30-second stop timeout, and on-failure restart policy were restored; the temporary drop-in is absent.

The live CLIs were independently updated outside this release lane: current Codex 0.159.3 and Claude 2.1.286 were freshly checked against the candidate, with Anthropic SDK 0.3.260. This release did not upgrade either CLI. The 52 approved abandoned preview/test roots were cleaned up without deleting data files. Earlier procedural systemd-exit/output-format/timestamp and tar-umask mistakes caused safe holds/fallbacks or automatic rollback, not an application regression; the strict guard was preserved. The final frozen V7 deployment exited zero. Final completed record 20261001T173847Z-maintenance-reliability1 has manifest SHA-256 ea2496a8854c1ade2c352a351979ee743da9375b0fb6181c0aa24efcb604b550 and references the completed checksummed original rollback snapshot. Current database contents were retained during the earlier automatic rollback.

This PR was initially reviewed as a scoped stacked batch against its preceding branch. Retargeting to main at release time allowed exact validated/deployed HEAD publication; it did not introduce an unvalidated merge tree. The test evidence above is local/VM acceptance, not a claim of green fork GitHub CI.

Model/harness: OpenAI Codex in Codex desktop; the exact model identifier is not exposed to this release session.