[dreynaud-oai]

A packfile URI can name a pack that is already installed locally. We still download that pack because http-fetch only looks for a partial download.

Open objects/pack/pack-<hash>.pack before starting HTTP. If we can open it, feed it to the requested index-pack command and report zero downloaded bytes. This preserves pack validation, index-pack output and keep-file handling while avoiding a second download.

Remove downloaded packs between HTTP authentication tests so later tests still make HTTP requests. Without that cleanup, pack reuse causes 15 failures in t5563.

The source branch starts at tn/codex/http-pack-transient-retry so the release controller can replay it. Daniel's patch is unchanged. A separate commit retains the reviewed CI action pins.

Validation:

• With the cleanup on the current codex base, all 217 tests across t5563, t5550, and t5702 pass with HTTP enabled.
• On the prerequisite source, t5563, t5702, and the pack reuse tests pass. Three older URL-credential tests in t5550 need the authentication fixes already present in codex.
• The combined release candidate, including http: keep discovery credentials when curl sanitizes the URL #142 and negotiator/skipping: parse parents before queueing #150, passed all 249 focused HTTP, negotiation, and protocol tests. Full staging CI also passed: 45 jobs passed, with two expected skips.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T19:21:12.102554Z	92f766d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.