From 987651a760cdfe4cd9493388e8c16b8f99643a05 Mon Sep 17 00:00:00 2001
From: JJ Liebig <jonathan.liebig@gmail.com>
Date: Sat, 5 Sep 2026 02:14:07 +0200
Subject: fix: detect codex startup update prompts (#3636)

refs #3632
---
 src/detect/manifest/tests.rs    | 41 +++++++++++++++++++++++++++++++++++++++++
 src/detect/manifests/codex.toml | 13 +++++++++++--
 2 files changed, 52 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/detect/manifest/tests.rs b/src/detect/manifest/tests.rs
index 63345636..00730a44 100644
--- a/src/detect/manifest/tests.rs
+++ b/src/detect/manifest/tests.rs
@@ -931,6 +931,47 @@ fn codex_trust_directory_requires_live_top_region() {
     assert!(!result.visible_blocker);
 }
 
+#[test]
+fn codex_startup_update_requires_complete_live_chooser() {
+    let chooser = "Update available! 0.153.0 -> 9.8.7\n\
+        Run bun add -g @openai/codex to update.\n\n\
+        › 1. Update now\n\
+          2. Skip until next version\n\n\
+        Press enter to continue   \n";
+    let wrapped = "✨ Update available! 0.153.0\n\n\
+        Release notes: https://example\n\n\
+        › 1. Update now (runs `npm\n\
+             install -g\n\
+             @openai/codex`)\n\
+          2. Skip\n\
+          3. Skip until next\n\
+             version\n\n\
+        Press enter to continue\n";
+
+    for screen in [chooser, wrapped] {
+        let result = osc_explain(Agent::Codex, screen, "project", "");
+        assert_eq!(result.state, AgentState::Blocked);
+        assert_eq!(
+            result.matched_rule.as_ref().map(|rule| rule.id.as_str()),
+            Some("startup_update")
+        );
+        assert!(result.visible_blocker);
+    }
+
+    for screen in [
+        chooser.replace("Update now", "Install"),
+        format!("{wrapped}\n› Ask Codex to do anything\n"),
+    ] {
+        let result = osc_explain(Agent::Codex, &screen, "project", "");
+        assert_eq!(result.state, AgentState::Idle);
+        assert_ne!(
+            result.matched_rule.as_ref().map(|rule| rule.id.as_str()),
+            Some("startup_update")
+        );
+        assert!(!result.visible_blocker);
+    }
+}
+
 #[test]
 fn codex_background_terminal_screen_does_not_override_osc_idle() {
     // Background terminal tasks can be long-lived helpers such as dev servers.
diff --git a/src/detect/manifests/codex.toml b/src/detect/manifests/codex.toml
index 6833f390..884492c4 100644
--- a/src/detect/manifests/codex.toml
+++ b/src/detect/manifests/codex.toml
@@ -1,7 +1,7 @@
 id = "codex"
-version = "2026.08.28.1"
+version = "2026.09.05.1"
 min_engine_version = 3
-updated_at = "2026-08-28T00:00:00Z"
+updated_at = "2026-09-05T00:00:00Z"
 
 [[rules]]
 id = "osc_title_blocked"
@@ -42,6 +42,15 @@ all = [
   { regex = ['(?s)Do\s+you\s+trust\s+the\s+contents\s+of\s+this\s+directory\?'] },
 ]
 
+[[rules]]
+id = "startup_update"
+state = "blocked"
+priority = 950
+region = "bottom_non_empty_lines(20)"
+visible_blocker = true
+contains = ["Update available!", "Update now"]
+regex = ['Skip\s+until\s+next\s+version', 'Press enter to continue\s*\z']
+
 [[rules]]
 id = "live_strong_blocker"
 state = "blocked"
-- 
cgit v1.2.3