build(deps): bump ai-sdk-provider-codex-cli from 1.3.1 to 2.1.2 in /examples/weather-agent/desktop

[dependabot]

Bumps ai-sdk-provider-codex-cli from 1.3.1 to 2.1.2.

Release notes

Sourced from ai-sdk-provider-codex-cli's releases.

v2.1.2 — MCP bearerToken no longer exposed in process argv

Security

• The exec provider no longer places an inline MCP HTTP bearerToken on the spawned codex command line (previously serialized as -c mcp_servers.<name>.http_headers.Authorization=Bearer <token>, readable by any local process via ps or /proc/<pid>/cmdline). The token is now passed through a synthesized child-environment variable (CODEX_MCP_<NAME>_BEARER_TOKEN) referenced via bearer_token_env_var (#42).
• If both bearerToken and bearerTokenEnvVar are set, bearerTokenEnvVar wins and the inline token is ignored with a warning; an explicit Authorization entry in httpHeaders still takes precedence over bearerToken.
• The app-server transport is unaffected (MCP config travels over JSON-RPC stdin, not argv).
• Recommendation: prefer bearerTokenEnvVar over inline bearerToken, and keep secrets out of httpHeaders (values ride argv) — use envHttpHeaders instead.

Resolves both findings of security review CLAUDE-SECURITY-20260723-000521.

Full Changelog: ben-vargas/ai-sdk-provider-codex-cli@v2.1.1...v2.1.2

v2.1.1 — Crash errors now surface captured stderr

Fixed

When the codex app-server process died before responding, the provider reported a generic codex app-server exited (code=1, signal=null) while the actual cause — for example spawn …/codex ENOENT from a corrupted @openai/codex install — sat unseen in error.data.stderr. (#39)

• Crash and initialization-failure messages now include the captured stderr. A single-line excerpt (last 5 non-empty lines, ANSI-stripped, 600-character cap) is appended as … | stderr (tail): … to crash rejections, the initialize wrapper, and the resulting APICallError. The full raw capture remains available in error.data.stderr.
• Better startup hints. ENOENT during startup now produces an installation-integrity hint (missing or corrupted codex executable) instead of the previously misleading minimum-version hint, and the minimum-version hint now also fires when unknown subcommand appears only in stderr. Hint selection reads the raw error and raw stderr, so the enriched display text cannot distort classification.
• No stderr left behind, no dead-client window. The client is marked crashed synchronously on process exit — so a request issued immediately after a crash triggers a clean respawn — while message construction waits for the child's close event (120 ms cap) so stderr flushed after exit still reaches the error message. Stderr buffers are per-child, so a respawn can never be polluted by a dying process's late output.

11 new tests cover the crash-message, hint-classification, drain-race, and respawn paths.

Thanks @​MarceloAssis123 for the detailed report and the reproduction from #36.

Full changelog: ben-vargas/ai-sdk-provider-codex-cli@v2.1.0...v2.1.1

v2.1.0 — Codex CLI 0.144.x baseline

Changed

• Update the optional @openai/codex dependency from ^0.142.5 to ^0.144.0, making Codex CLI 0.144.x the validated support baseline for both codexExec and codexAppServer (same drift class as #36 on the 1.x line: a caret on a 0.x version only allows patch-level updates, so the bundled CLI could silently shadow a newer global install via node_modules/.bin).
• Raise the app-server default minCodexVersion from 0.142.5 to 0.144.0 to match the new baseline (set minCodexVersion explicitly to accept older CLIs).
• Refresh example and docs baseline references, and the lockfile, for the new Codex baseline.

v2.0.0 — AI SDK v7

Breaking Changes

• AI SDK v7 migration - This release requires AI SDK v7 and is incompatible with AI SDK v6
• Provider interface: LanguageModelV3 → LanguageModelV4, ProviderV3 → ProviderV4 (native implementation, no compatibility layer)
• Specification version: specificationVersion changed from 'v3' to 'v4' on both providers and models
• Node.js >= 22 required: the supported engines floor moves from Node 18 to Node 22
• ESM-only package: the CJS build, the require export condition, and the main/module fields are removed; consume via import (or dynamic import() from CommonJS)
• Legacy model properties removed: v6-era model properties are gone in favor of the v4 model surface; models now expose the v4 supportedUrls map (currently {})
• zod peer dependency is Zod 4 only: ^4.1.8 (Zod 3 is not supported). Importing under Zod 3 throws because .refine().passthrough() is unavailable on Zod 3's ZodEffects. 1.x allowed zod@^3.0.0 || ^4.0.0.

Added

• Top-level reasoning call option: AI SDK v7's reasoning option ('none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh') maps to Codex reasoning effort in both provider modes. Provider-specific options keep precedence (providerOptions['codex-cli'].reasoningEffort / providerOptions['codex-app-server'].effort win when set), 'provider-default' leaves configured defaults untouched, and unsupported values emit an unsupported warning instead of failing

... (truncated)

Changelog

Sourced from ai-sdk-provider-codex-cli's changelog.

[2.1.2] - 2026-07-22

Security

• The exec provider no longer places an inline MCP HTTP bearerToken on the spawned codex command line (previously serialized as -c mcp_servers.<name>.http_headers.Authorization=Bearer <token>, readable by any local process via ps or /proc/<pid>/cmdline). The token is now passed through a synthesized child-environment variable (CODEX_MCP_<NAME>_BEARER_TOKEN) referenced via bearer_token_env_var (#42). If both bearerToken and bearerTokenEnvVar are set, bearerTokenEnvVar wins and the inline token is ignored with a warning; an explicit Authorization entry in httpHeaders still takes precedence over bearerToken. The app-server transport is unaffected (MCP config travels over JSON-RPC stdin, not argv). Prefer bearerTokenEnvVar over inline bearerToken, and keep secrets out of httpHeaders (values ride argv) — use envHttpHeaders instead.

[2.1.1] - 2026-07-10

Fixed

• Surface a trimmed tail of captured stderr in app-server crash and initialization-failure messages (#39), making the root cause visible without inspecting error.data.stderr; report startup ENOENT failures with an installation-integrity hint instead of the misleading minimum-version hint; and apply the version hint when unknown subcommand appears only in stderr.

[2.1.0] - 2026-07-10

Changed

• Update the optional @openai/codex dependency from ^0.142.5 to ^0.144.0, making Codex CLI 0.144.x the validated support baseline for both codexExec and codexAppServer (same drift class as #36 on the 1.x line: a caret on a 0.x version only allows patch-level updates, so the bundled CLI could silently shadow a newer global install via node_modules/.bin).
• Raise the app-server default minCodexVersion from 0.142.5 to 0.144.0 to match the new baseline (set minCodexVersion explicitly to accept older CLIs).
• Refresh example and docs baseline references, and the lockfile, for the new Codex baseline.

[2.0.0] - 2026-07-06

Breaking Changes

• AI SDK v7 migration - This release requires AI SDK v7 and is incompatible with AI SDK v6
• Provider interface: LanguageModelV3 → LanguageModelV4, ProviderV3 → ProviderV4 (native implementation, no compatibility layer)
• Specification version: specificationVersion changed from 'v3' to 'v4' on both providers and models
• Node.js >= 22 required: the supported engines floor moves from Node 18 to Node 22
• ESM-only package: the CJS build, the require export condition, and the main/module fields are removed; consume via import (or dynamic import() from CommonJS)
• Legacy model properties removed: v6-era model properties are gone in favor of the v4 model surface; models now expose the v4 supportedUrls map (currently {})
• zod peer dependency is Zod 4 only: ^4.1.8 (Zod 3 is not supported). Importing under Zod 3 throws because .refine().passthrough() is unavailable on Zod 3's ZodEffects. 1.x allowed zod@^3.0.0 || ^4.0.0.

Added

• Top-level reasoning call option: AI SDK v7's reasoning option ('none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh') maps to Codex reasoning effort in both provider modes. Provider-specific options keep precedence (providerOptions['codex-cli'].reasoningEffort / providerOptions['codex-app-server'].effort win when set), 'provider-default' leaves configured defaults untouched, and unsupported values emit an unsupported warning instead of failing
• v4 content handling:
  • v4 tagged file data ({ type: 'data' | 'url' | 'reference' | 'text' }) is accepted for file/image message parts, with legacy untagged data shapes still supported for compatibility
  • canonical v4 tool-result file content is rendered into prompt text across its data/url/reference/text variants, with warnings for unrecognized data types
  • custom content parts (in prompts and tool results) and assistant reasoning-file parts are skipped with explicit unsupported warnings

Changed

• Dependencies updated for AI SDK v7:
  • @ai-sdk/provider: ^4.0.0
  • @ai-sdk/provider-utils: ^5.0.0
  • ai (dev): ^7.0.0
• zod peer dependency narrowed to ^4.1.8 (Zod 4 only; see Breaking Changes)
• Model discovery guidance: documentation no longer maintains a static model catalog; use listModels() / provider.listModels() — available slugs follow your installed Codex CLI
• Optional @openai/codex dependency: ^0.130.0 → ^0.142.5; app-server protocol types synced with and release-tested against Codex CLI 0.142.5

... (truncated)

Commits

• 4f5101d fix: never place inline MCP bearerToken on the codex command line (#42)
• fc4a97f fix: surface captured stderr in app-server crash error messages (#40)
• f4dc868 feat: bump @​openai/codex optional dependency to ^0.144.0 (#38)
• 27cc294 feat!: AI SDK v7 compatibility (#35)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pumpkinredbean]

Closing launch-time version-update noise. Security alerts and automated security fixes remain enabled; dependency upgrades will be reviewed deliberately.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.