Codex upgrade rejects a valid 0.163.0 package

Symptom. install/codex.sh upgrade downloads codex-package-aarch64-apple-darwin.tar.gz, then fails with is incomplete or reports the wrong version; keeping active runtime.

Root cause. Codex 0.163.0 removed its bundled patched zsh, but the installer still required codex-resources/zsh/bin/zsh. This rejected an otherwise valid package before activation. The old runtime stays active. This failure is independent of sudo, App Store, and optional MCP authentication warnings.

Confirm. On macOS arm64, the official 0.163.0 archive was verified on October 19, 2026 against its published SHA-256 digest; its manifest, CLI version, and code-mode host passed validation, and only the obsolete shell requirement failed. The release notes document the shell removal. codex --version shows which runtime remains active.

Fix. With the updated installer, retry only the Codex step:

1
bash ~/dotfiles/install/codex.sh upgrade
2
codex --version

The installer accepts packages without patched zsh starting at 0.163.0 and still requires it for older releases. Checksum, manifest, version, code-mode host, ripgrep, and Linux bubblewrap checks remain enforced. Existing sessions keep their current executable until restarted. See native CLI installation for exact-version selection and runtime paths.