`patch-app` fails on Codex Desktop ≥26.601.20914 — JS bundle refactor changed needle targets

[un-tag]

Disclaimer: This issue was filed by a DeepSeek V4 Flash agent, after the human discovered the breakage.

OS: macOS 26.5 (arm64)
Codex Desktop: 26.601.20914 (from /Applications/Codex.app/Contents/Info.plist)
codex-shim status: running on http://127.0.0.1:8765 with 9 models (BYOK)
Repro:

codex-shim patch-app
# → Could not find the expected model picker allowlist filter in Codex Desktop.

What changed: Codex Desktop refactored its JavaScript bundles. The model-picker allowlist filter moved from model-queries-*.js to models-and-reasoning-efforts-*.js, and the surrounding minified code was rewritten. The old needle:

let u=c.useHiddenModels&&o!==`amazonBedrock`,d;

no longer exists anywhere in the extracted ASAR. _find_js_bundle() returns None because neither the needle nor the replacement string is present in any bundle.

Additionally, the sidebar needle changed: the sourceKinds variable was renamed from ke to he.

Fix applied locally (diff pasted below). Two changes in codex_shim/cli.py:

1. Model picker needle — targets the new code pattern in models-and-reasoning-efforts-*.js:

   MODEL_PICKER_NEEDLE = "let a=[],o=null,s=i&&e!==\`amazonBedrock\`;"
   MODEL_PICKER_REPLACEMENT = "let a=[],o=null,s=!1;"

2. Sidebar needle — renamed variable ke → he:

   # old: sourceKinds:ke
   # new: sourceKinds:he

3. Glob search order — added models-and-reasoning-efforts-*.js before the fallback *.js:

   ["models-and-reasoning-efforts-*.js", "model-queries-*.js", "*.js"],

Full diff:

-MODEL_PICKER_NEEDLE = "let u=c.useHiddenModels&&o!==\`amazonBedrock\`,d;"
-MODEL_PICKER_REPLACEMENT = "let u=!1,d;"
+MODEL_PICKER_NEEDLE = "let a=[],o=null,s=i&&e!==\`amazonBedrock\`;"
+MODEL_PICKER_REPLACEMENT = "let a=[],o=null,s=!1;"

 SIDEBAR_RECENT_THREADS_NEEDLE = (
     "listRecentThreads({cursor:e,limit:t}){return this.params.requestClient.sendRequest(\`thread/list\`,"
-    "{limit:t,cursor:e,sortKey:this.recentConversationSortKey,modelProviders:null,archived:!1,sourceKinds:ke})}"
+    "{limit:t,cursor:e,sortKey:this.recentConversationSortKey,modelProviders:null,archived:!1,sourceKinds:he})}"
 )
 SIDEBAR_RECENT_THREADS_REPLACEMENT = (
     "listRecentThreads({cursor:e,limit:t}){return this.params.requestClient.sendRequest(\`thread/list\`,"
-    "{limit:t,cursor:e,sortKey:this.recentConversationSortKey,modelProviders:[],archived:!1,sourceKinds:ke})}"
+    "{limit:t,cursor:e,sortKey:this.recentConversationSortKey,modelProviders:[],archived:!1,sourceKinds:he})}"
 )

-["model-queries-*.js", "*.js"],
+["models-and-reasoning-efforts-*.js", "model-queries-*.js", "*.js"],

Note: These needle strings are version-specific and will likely break again on the next Codex Desktop update that re-minifies the bundles. A more robust approach (e.g., searching for semantic patterns like useHiddenModels or amazonBedrock instead of exact minified strings) would be ideal, but that would require bundling a lightweight JS parser or using regex heuristics — a bigger lift than this one-shot fix.

[OnlyTerp]

Integrated in #36 — regex-based patch-app needles, idempotent APPLIED markers, and related backlog items are on branch integrate-open-backlog.

[OnlyTerp]

Resolved in #36 (merged 2026-06-11). The integration PR includes regex-based patch-app needles, doctor diagnostics, CSRF protection, image detail normalization, and subscription docs.