Add Codex as a macOS FMA (#47480)

Add support for the OpenAI Codex desktop app: create Homebrew input
(ee/maintained-apps/inputs/homebrew/codex-app.json) and a new app output
entry (ee/maintained-apps/outputs/codex-app/darwin.json) containing
version, installer URL, sha256 and install/uninstall scripts that handle
quitting/relaunch/trashing. Also add the Codex entry to
ee/maintained-apps/outputs/apps.json. Frontend assets: add a Codex SVG
icon component and update the icons index
(frontend/pages/SoftwarePage/components/icons/...), and include the PNG
app icon (website/assets/images/app-icon-codex-app-60x60@2x.png). These
changes register Codex (bundle id com.openai.codex) as a maintained
developer tool and provide installation/uninstallation logic and UI
assets.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47462

ee/maintained-apps/inputs/homebrew/codex-app.json

@@ -0,0 +1,8 @@
+{
+  "name": "Codex",
+  "unique_identifier": "com.openai.codex",
+  "token": "codex-app",
+  "installer_format": "zip",
+  "slug": "codex-app/darwin",
+  "default_categories": ["Developer tools"]
+}

ee/maintained-apps/outputs/apps.json

@@ -1268,6 +1268,13 @@
       "unique_identifier": "com.krill.CodeRunner",
       "description": "CodeRunner is a multi-language programming editor."
     },
+    {
+      "name": "Codex",
+      "slug": "codex-app/darwin",
+      "platform": "darwin",
+      "unique_identifier": "com.openai.codex",
+      "description": "Codex is OpenAI's desktop app for managing coding agents."
+    },
     {
       "name": "CodexBar",
       "slug": "codexbar/darwin",

ee/maintained-apps/outputs/codex-app/darwin.json

@@ -0,0 +1,22 @@
+{
+  "versions": [
+    {
+      "version": "26.609.30741",
+      "queries": {
+        "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.openai.codex';",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.openai.codex' AND version_compare(bundle_short_version, '26.609.30741') < 0);"
+      },
+      "installer_url": "https://persistent.oaistatic.com/codex-app-prod/Codex-darwin-arm64-26.609.30741.zip",
+      "install_script_ref": "5e3efa57",
+      "uninstall_script_ref": "a2b5ee81",
+      "sha256": "24cd7b226c70aefb9143571cdcfb2d39fb38794a98ba3935d406d89e7202bf7e",
+      "default_categories": [
+        "Developer tools"
+      ]
+    }
+  ],
+  "refs": {
+    "5e3efa57": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# extract contents\nunzip \"$INSTALLER_PATH\" -d \"$TMPDIR\"\n# copy to the applications folder\nquit_and_track_application 'com.openai.codex'\nif [ -d \"$APPDIR/Codex.app\" ]; then\n\tsudo mv \"$APPDIR/Codex.app\" \"$TMPDIR/Codex.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/Codex.app\" \"$APPDIR\"\nrelaunch_application 'com.openai.codex'\n",
+    "a2b5ee81": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nquit_application 'com.openai.codex'\nsudo rm -rf \"$APPDIR/Codex.app\"\nsudo rmdir '~/.codex'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Codex'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.openai.codex.sfl*'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.openai.codex'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.openai.codex'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.openai.codex.binarycookies'\ntrash $LOGGED_IN_USER '~/Library/Logs/com.openai.codex'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.openai.codex.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.openai.codex.savedState'\n"
+  }
+}

frontend/pages/SoftwarePage/components/icons/index.ts

@@ -142,6 +142,7 @@ import Cmux from "./Cmux";
 import Coconutbattery from "./Coconutbattery";
 import Codeedit from "./Codeedit";
 import Coderunner from "./Coderunner";
+import CodexApp from "./CodexApp";
 import Codexbar from "./Codexbar";
 import CogApp from "./CogApp";
 import Colorsnapper from "./Colorsnapper";
@@ -1040,6 +1041,7 @@ export const SOFTWARE_NAME_TO_ICON_MAP = {
   code: VisualStudioCode,
   codeedit: Codeedit,
   coderunner: Coderunner,
+  codex: CodexApp,
   codexbar: Codexbar,
   cog: CogApp,
   "colorsnapper 2": Colorsnapper,