Clean up direct-binary release and update paths

.github/blob-size-allowlist.txt

@@ -1,7 +1,6 @@
 # Paths are matched exactly, relative to the repository root.
 # Keep this list short and limited to intentional large checked-in assets.
 
-.github/codex-cli-splash.png
 MODULE.bazel.lock
 codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
 codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

.github/dependabot.yaml

@@ -22,12 +22,6 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
-  - package-ecosystem: docker
-    directory: codex-cli
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/github.json

@@ -85,12 +85,12 @@
   },
   "release": {
     "intent": {
-      "kind": "package-version",
-      "file": "codex-cli/package.json",
+      "kind": "version-file",
+      "file": "VERSION",
       "workflow": "Release Intent"
     },
     "metadataFiles": [
-      "codex-cli/package.json",
+      "VERSION",
       "CHANGELOG.md",
       "docs/release-notes/RELEASE_NOTES.md"
     ],

.github/merge-policy.json

@@ -1,7 +1,6 @@
 {
   "prefer_ours_globs": [
     "codex-rs/tui/**",
-    "codex-cli/**",
     "codex-rs/core/src/openai_tools.rs",
     "codex-rs/core/src/codex.rs",
     "codex-rs/core/src/agent_tool.rs",
@@ -18,13 +17,9 @@
     "codex-rs/exec/**",
     "codex-rs/file-search/**"
   ],
-  "purge_globs": [
-    ".github/codex-cli-*.png",
-    ".github/codex-cli-*.jpg",
-    ".github/codex-cli-*.jpeg",
-    ".github/codex-cli-*.webp"
-  ],
+  "purge_globs": [],
   "perma_removed_paths": [
+    "codex-cli/**",
     ".github/workflows/rust-ci.yml",
     ".github/workflows/rust-ci-full.yml"
   ]

.github/workflows/README.md

@@ -7,18 +7,17 @@ Rust-specific `rust-ci*.yml` workflows are intentionally removed for Every Code.
 - `./build-fast.sh` is the required local Rust verification gate.
 - `preview-build.yml` builds preview binaries for pull requests.
 - `release.yml` is displayed in GitHub Actions as `Release Intent`. It runs
-  after relevant `main` pushes, determines whether the committed
-  `codex-cli/package.json` version has an existing `v<version>` tag, and either
-  exits successfully as a no-op or publishes the GitHub Release.
+  after relevant `main` pushes, determines whether the committed `VERSION` has
+  an existing `v<version>` tag, and either exits successfully as a no-op or
+  publishes the GitHub Release.
 
 ## Release Operator Notes
 
 - A successful `Release Intent` run does not always mean a release was cut. It
-  means the workflow either published the new package version or confirmed that
-  the current version tag already exists.
-- To cut a release, merge a release metadata PR that bumps
-  `codex-cli/package.json` and updates `CHANGELOG.md` plus
-  `docs/release-notes/RELEASE_NOTES.md`.
+  means the workflow either published the new `VERSION` or confirmed that the
+  current version tag already exists.
+- To cut a release, merge a release metadata PR that bumps `VERSION` and updates
+  `CHANGELOG.md` plus `docs/release-notes/RELEASE_NOTES.md`.
 - To verify publishing, check for the tag or release directly. Example:
 
   ```sh

.github/workflows/release.yml

@@ -4,8 +4,8 @@ on:
   push:
     branches: [ main ]
     # Ignore common non-release paths. For other main pushes, the workflow
-    # determines whether the committed package version represents release
-    # intent. Runs with no new package version are successful no-ops.
+    # determines whether the committed VERSION represents release intent. Runs
+    # with no new VERSION are successful no-ops.
     paths-ignore:
       - '.github/workflows/issue-triage.yml'
       - '.github/workflows/preview-build.yml'
@@ -486,41 +486,27 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Update package.json version
+      - name: Prepare release tag
         id: version
-        working-directory: codex-cli
         shell: bash
         run: |
-          git config --local user.email "action@github.com"
-          git config --local user.name "GitHub Action"
           NEW_VERSION="${{ needs.determine-version.outputs.version }}"
-          npm version "$NEW_VERSION" --no-git-tag-version --allow-same-version
-          echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
-          git add package.json
-          if git diff --staged --quiet; then
-            echo "skip_push=true" >> "$GITHUB_OUTPUT"
-          else
-            git commit -m "chore(release): ${NEW_VERSION}"
-            echo "skip_push=false" >> "$GITHUB_OUTPUT"
+          if [[ "$(tr -d '[:space:]' < VERSION)" != "$NEW_VERSION" ]]; then
+            echo "VERSION does not match release intent ${NEW_VERSION}" >&2
+            exit 1
           fi
+          echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
           if ! git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; then
             git tag "v${NEW_VERSION}"
           fi
           echo "tag=v${NEW_VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Download all artifacts
-        if: steps.version.outputs.skip_push == 'true'
         uses: actions/download-artifact@v4
         with:
           path: artifacts/
 
       - name: Prepare release assets
-        if: steps.version.outputs.skip_push == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -534,26 +520,22 @@ jobs:
           ls -la release-assets/ || true
 
       - name: Verify local release notes metadata
-        if: steps.version.outputs.skip_push == 'true'
         shell: bash
         run: |
           set -euo pipefail
           scripts/check-release-notes-version.sh --version "${{ steps.version.outputs.version }}"
 
       - name: Push tag
-        if: steps.version.outputs.skip_push == 'true'
         shell: bash
         run: git push origin "v${{ steps.version.outputs.version }}" || true
 
       - name: Verify release notes header matches version
-        if: steps.version.outputs.skip_push == 'true'
         shell: bash
         run: |
           set -euo pipefail
           scripts/check-release-notes-version.sh
 
       - name: Generate update manifest
-        if: steps.version.outputs.skip_push == 'true'
         shell: bash
         env:
           NEW_VERSION: ${{ steps.version.outputs.version }}
@@ -567,7 +549,6 @@ jobs:
             --output release-assets/update-manifest.json
 
       - name: Create GitHub Release
-        if: steps.version.outputs.skip_push == 'true'
         uses: softprops/action-gh-release@v2
         with:
           tag_name: v${{ steps.version.outputs.version }}

.github/workflows/upstream-merge.yml

@@ -426,14 +426,13 @@ jobs:
           comm -13 .github/auto/DEFAULT_CRATES.txt .github/auto/UPSTREAM_CRATES.txt > .github/auto/DELETED_ON_DEFAULT.txt || true
 
           git diff --name-only "origin/${DEFAULT_BRANCH}..upstream/${UPSTREAM_BRANCH}" > .github/auto/DELTA_FILES.txt || true
-          awk 'BEGIN{tui=cli=core=docs=tests=other=0}
+          awk 'BEGIN{tui=core=docs=tests=other=0}
                /^codex-rs\/tui\//{tui++; next}
-               /^codex-cli\//{cli++; next}
                /^codex-rs\/(core|common|protocol|exec|file-search)\//{core++; next}
                /^docs\//{docs++; next}
                /(^|\/)tests?\//{tests++; next}
                {other++}
-               END{printf("tui=%d cli=%d core=%d docs=%d tests=%d other=%d\n",tui,cli,core,docs,tests,other)}' \
+               END{printf("tui=%d core=%d docs=%d tests=%d other=%d\n",tui,core,docs,tests,other)}' \
             .github/auto/DELTA_FILES.txt > .github/auto/CHANGE_HISTOGRAM.txt
 
           FILES_COUNT=$(wc -l < .github/auto/DELTA_FILES.txt | tr -d ' ')
@@ -515,7 +514,6 @@ jobs:
           MERGE_MODE: ${{ steps.prep.outputs.merge_mode || 'one-shot' }}
           OURS_GLOBS: |
             codex-rs/tui/**
-            codex-cli/**
             .github/workflows/**
             AGENTS.md
             README.md
@@ -794,11 +792,6 @@ jobs:
           # Remove any accidentally committed artifacts under .github/auto/** (these should be uploaded, not tracked)
           auto_tracked=$(git ls-files -- '.github/auto/**' || true)
           if [ -n "$auto_tracked" ]; then echo "$auto_tracked" | xargs -r git rm -f --; removed=true; fi
-          # Remove any tracked upstream images disallowed by local policy
-          for p in .github/codex-cli-*.png .github/codex-cli-*.jpg .github/codex-cli-*.jpeg .github/codex-cli-*.webp; do
-            files=$(git ls-files -- "$p" || true)
-            if [ -n "$files" ]; then echo "$files" | xargs -r git rm -f --; removed=true; fi
-          done
           # Belt-and-suspenders: drop any accidentally committed cargo cache dirs
           # Cover both repo-root and nested workspace (e.g., codex-rs/.cargo-home)
           for d in .cargo-home .cargo2 codex-rs/.cargo-home codex-rs/.cargo2; do
@@ -831,10 +824,10 @@ jobs:
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
         run: |
           set -euo pipefail
-          # Guide-only branding report: detect user-visible 'Codex' strings under TUI/CLI affected by this merge.
+          # Guide-only branding report: detect user-visible 'Codex' strings under TUI affected by this merge.
           mkdir -p .github/auto
           : > .github/auto/VERIFY_branding.log
-          changed_files=$(git diff --name-only "origin/${DEFAULT_BRANCH}..origin/upstream-merge" -- 'codex-rs/tui/**' 'codex-cli/**' | tr '\n' ' ' || true)
+          changed_files=$(git diff --name-only "origin/${DEFAULT_BRANCH}..origin/upstream-merge" -- 'codex-rs/tui/**' | tr '\n' ' ' || true)
           if [ -n "${changed_files:-}" ]; then
             echo "[branding] scanning changed TUI/CLI files for user-visible 'Codex' strings..." | tee -a .github/auto/VERIFY_branding.log
             git diff -U0 --no-color "origin/${DEFAULT_BRANCH}..origin/upstream-merge" -- $changed_files \

.gitignore

@@ -16,9 +16,6 @@ build/
 out/
 storybook-static/
 
-# ignore README for publishing
-codex-cli/README.md
-
 # ignore Nix derivation results
 result
 
@@ -67,9 +64,6 @@ result
 /.aider.tags.cache.*/
 
 # Binary symlinks generated by dev-fast builds
-codex-cli/bin/*-darwin
-codex-cli/bin/*-linux-*
-codex-cli/bin/*-windows-*
 code-rs/code-cli/bin/
 codex-rs/codex-cli/bin/
 code-rs/bin/
@@ -97,7 +91,7 @@ code-rs/bin/
 /npm-binaries/
 /.github/auto/
 
-# Homebrew formula staging (generated)
+# Legacy Homebrew formula staging scratch
 Formula/Code.rb
 homebrew-tap/Formula/Code.rb
 

.prettierignore

@@ -1,5 +1,3 @@
-/codex-cli/dist
-/codex-cli/node_modules
 pnpm-lock.yaml
 
 prompt.md

AGENTS.md

@@ -90,7 +90,7 @@ Examples:
   and `.github/github.json` PR workflow metadata when watching fix trains,
   auto-review lag, CI, review comments, and merge readiness.
 - Use `just local-code-rebuild` to rebuild the current branch into the PATH-resolved binary.
-- After `./build-fast.sh`, run `just local-code-rebuild` again before release smoke checks; the fast build validates dev-fast artifacts, while the rebuild recipe owns the PATH-resolved release binary and embeds the package version.
+- After `./build-fast.sh`, run `just local-code-rebuild` again before release smoke checks; the fast build validates dev-fast artifacts, while the rebuild recipe owns the PATH-resolved release binary and embeds the `VERSION` file value.
 - During active local work, run
   `just local-cleanup-space --apply --keep-current-fast-cache` when repo-local
   build caches grow large; this removes stale per-branch `./build-fast.sh`
@@ -140,7 +140,6 @@ When the user asks you to "push" local work:
 
 - Never rebase in this flow. Do not use `git pull --rebase` or attempt to replay local commits.
 - Prefer a simple merge of `origin/main` into the current branch, keeping our local history intact.
-- If the remote only has trivial release metadata changes (e.g., `codex-cli/package.json` version bumps), adopt the remote version for those files and keep ours for everything else unless the user specifies otherwise.
 - If in doubt or if conflicts touch non-trivial areas, pause and ask before resolving.
 
 Quick procedure (merge-only):
@@ -152,7 +151,6 @@ Quick procedure (merge-only):
 - Merge without auto-commit: `git merge --no-ff --no-commit origin/main` (stops before committing so you can choose sides)
 - Resolve policy:
   - Default to ours: `git checkout --ours .`
-  - Take remote for trivial package/version files as needed, e.g.: `git checkout --theirs codex-cli/package.json`
 - Stage and commit the merge with a descriptive message, e.g.:
   - `git add -A && git commit -m "Merge origin/main: adopt remote version bumps; keep ours elsewhere (<areas>)"`
 - Run `./build-fast.sh` and then `git push`

README.md

@@ -92,8 +92,8 @@ code
 
 Use `code update-check` to inspect the current GitHub Release manifest and
 `code update --yes` to install a newer verified direct binary when one is
-available. npm and Homebrew publishing are deferred unless package-manager
-distribution becomes intentional again.
+available. Every Code releases are distributed through GitHub Releases; npm and
+Homebrew publishing are not part of the current release path.
 
 **Authenticate** (one of the following):
 - **Sign in with ChatGPT** (Plus/Pro/Team; uses models available to your plan)

VERSION

@@ -0,0 +1 @@
+0.6.113

build-fast.sh

@@ -674,8 +674,7 @@ if [ $? -eq 0 ]; then
     echo "Binary location: ${BIN_DISPLAY_PATH}"
     echo ""
 
-    # Keep old symlink locations working for compatibility
-    # Create symlink in target/release for npm wrapper expectations
+    # Keep old target symlink locations working for compatibility.
     release_link_target="../${BIN_SUBDIR}/${BIN_FILENAME}"
     dev_fast_link_target="../${BIN_SUBDIR}/${BIN_FILENAME}"
 
@@ -705,8 +704,6 @@ if [ $? -eq 0 ]; then
     }
 
     CLI_TARGET_CODE="../../target/${BIN_SUBDIR}/${BIN_FILENAME}"
-    CLI_TARGET_CODEX="../../${WORKSPACE_DIR}/target/${BIN_SUBDIR}/${BIN_FILENAME}"
-
     CLI_LINK_ABSOLUTE=""
     if [ "${TARGET_DIR_ABS}" != "${REPO_TARGET_ABS}" ]; then
       release_link_target="${BIN_PATH}"
@@ -731,10 +728,7 @@ if [ $? -eq 0 ]; then
       ln -sf "${release_link_target}" "./target/release/${CRATE_PREFIX}"
     fi
 
-    # Update the symlinks in CLI wrapper directories
-    if [ -d "../codex-cli/bin" ]; then
-      create_cli_symlinks "../codex-cli/bin" "${CLI_TARGET_CODEX}"
-    fi
+    # Update the symlinks in active CLI wrapper directories.
     if [ -d "./code-cli/bin" ]; then
       create_cli_symlinks "./code-cli/bin" "${CLI_TARGET_CODE}"
     fi