build!: move to Python 3.15 and update dependencies and tools

.github/workflows/ci.yml

@@ -23,9 +23,9 @@ jobs:
         with:
           fetch-depth: 0
       - name: Install aqua
-        uses: aquaproj/aqua-installer@96a9bc20066c5bf5e275b41019cfc165b25f4e2e # v4.0.5
+        uses: aquaproj/aqua-installer@611554c6f0137ba41c8dd15aca8bee82504ea461 # v4.1.1
         with:
-          aqua_version: v2.61.0
+          aqua_version: v2.65.2
       - name: Install pinned tools
         run: aqua install
       - name: Sync dependencies

.python-version

@@ -1 +1 @@
-3.14
+3.15

AGENTS.md

@@ -24,10 +24,10 @@ Read the root README, `docs/README.md`, and the relevant document under
 
 ## Environment
 
-Support Python 3.14.x only, using `.python-version` as the development major.
+Support Python 3.15.x only, using `.python-version` as the development major.
 Use aqua for pinned developer tools and uv with `uv.lock` for Python
-dependencies. The runtime boundaries are `openai-codex==0.154.0` and
-`mcp==2.2.0`.
+dependencies. The runtime boundaries are `openai-codex==0.163.0` and
+`mcp==2.3.0`.
 
 Do not change dependency versions to bypass failures or silently substitute a
 different `codex` from PATH. Supporting a new Python major is a separate

CHANGELOG.md

@@ -11,6 +11,10 @@ Versioning and uses Git tags as its release channel.
   commit one that replaced the user's policy with `allowed_roots = ["/"]`.
 - Security: `allowed_roots` are resolved once at startup, so a symlink created
   after startup can no longer redirect a root outside the configured path.
+- Changed the supported Python major from 3.14 to 3.15; Python 3.14 is no
+  longer supported.
+- Updated the runtime boundaries to `openai-codex==0.163.0` (with its bundled
+  runtime) and `mcp==2.3.0`.
 
 ## [0.1.1] - 2026-09-14
 

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thank you for helping improve `codex-app-mcp`.
 
 ## Development setup
 
-The project supports Python 3.14.x only. Install aqua, then run:
+The project supports Python 3.15.x only. Install aqua, then run:
 
 ```sh
 aqua install

README.ja.md

@@ -28,12 +28,12 @@ HTTP transportはv0.1の対象外です。
 
 | 要件 | 確認 |
 |---|---|
-| Python 3.14.x（開発majorは`.python-version`参照） | `codex-app-mcp doctor` |
+| Python 3.15.x（開発majorは`.python-version`参照） | `codex-app-mcp doctor` |
 | [uv](https://docs.astral.sh/uv/) | `uv --version` |
 | Codex 認証済み（`~/.codex/auth.json` 等） | `codex-app-mcp doctor` が存在のみ確認 |
 | ネットワーク: モデル推論に OpenAI への接続 | doctor の catalog 確認 |
 
-依存は完全固定: `openai-codex==0.154.0`（SDK 同梱の `codex app-server` を利用）、`mcp==2.2.0`。PATH 上の他 `codex` は使用しない。
+依存は完全固定: `openai-codex==0.163.0`（SDK 同梱の `codex app-server` を利用）、`mcp==2.3.0`。PATH 上の他 `codex` は使用しない。
 
 ## 3. クイックスタート
 
@@ -48,8 +48,8 @@ uvx --from git+https://github.com/PyYoshi/codex-app-mcp.git@v0.1.1 \
   codex-app-mcp doctor
 ```
 
-サポート対象は最新安定majorのPython 3.14系のみ。`pyproject.toml`で
-`>=3.14,<3.15`を要求し、`.python-version`は3.14系の最新利用可能patchを選ぶ。
+サポート対象は最新安定majorのPython 3.15系のみ。`pyproject.toml`で
+`>=3.15,<3.16`を要求し、`.python-version`は3.15系の最新利用可能patchを選ぶ。
 
 doctor は SDK/runtime・認証の有無・自己接続の疑い・policy・モデル catalog を確認する。`ok: true` になれば使用可能。
 

README.md

@@ -30,12 +30,12 @@ an active turn, and HTTP transport are outside the v0.1 scope.
 
 ## Requirements
 
-- Python 3.14.x (the latest stable Python major supported by this release)
+- Python 3.15.x (the latest stable Python major supported by this release)
 - [uv](https://docs.astral.sh/uv/)
 - an existing Codex login, such as `~/.codex/auth.json`
 - network access to OpenAI when running inference
 
-Runtime boundaries are pinned to `openai-codex==0.154.0` and `mcp==2.2.0`.
+Runtime boundaries are pinned to `openai-codex==0.163.0` and `mcp==2.3.0`.
 The Codex runtime bundled with the SDK is used; an unrelated `codex` on `PATH`
 is not substituted.
 

aqua-checksums.json

@@ -1,63 +1,63 @@
 {
   "checksums": [
     {
-      "id": "github_release/github.com/astral-sh/uv/0.12.13/uv-aarch64-apple-darwin.tar.gz",
-      "checksum": "7E6DDB9316ACC00F2296C82FF4D99977870EE34B2F0DDCAE9444D714DB9364ED",
+      "id": "github_release/github.com/astral-sh/uv/0.13.5/uv-aarch64-apple-darwin.tar.gz",
+      "checksum": "743F85035A1996ECB350659E01CD9FAEA9709829BE09B1B4B03C73EAF3C9CD73",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/astral-sh/uv/0.12.13/uv-aarch64-unknown-linux-musl.tar.gz",
-      "checksum": "F44BC1037A17889FE562FFFD2002D4ED108E499FBE68B4F022AF244DC7B8244F",
+      "id": "github_release/github.com/astral-sh/uv/0.13.5/uv-aarch64-unknown-linux-musl.tar.gz",
+      "checksum": "7906C79ADB21C81ABD559841BA76BB1D9AF9D791ACAC7A041B2972E03AE16538",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/astral-sh/uv/0.12.13/uv-x86_64-apple-darwin.tar.gz",
-      "checksum": "5E287EF61CB6A9B61B3A83FEF124FD143E400468A7DAC794230147A810E17119",
+      "id": "github_release/github.com/astral-sh/uv/0.13.5/uv-x86_64-apple-darwin.tar.gz",
+      "checksum": "B0F52B0E3945B4107D89024EA38E625683011FBFC05A0D98F9FA2D6DCEE28C66",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/astral-sh/uv/0.12.13/uv-x86_64-pc-windows-msvc.zip",
-      "checksum": "A86C9DC7BAD9B03F388583B7187C05FE9951C2E0D392217E8FD43D97787F6EC2",
+      "id": "github_release/github.com/astral-sh/uv/0.13.5/uv-x86_64-pc-windows-msvc.zip",
+      "checksum": "A38B8D1902B7CFBC76B423BA1BB456F623F42064CDC72628B6075B89AFD1019A",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/astral-sh/uv/0.12.13/uv-x86_64-unknown-linux-musl.tar.gz",
-      "checksum": "4E2BFD0C9007B1032A50E539E965FD0A6037D87AD93AE1580D220A92D4C94098",
+      "id": "github_release/github.com/astral-sh/uv/0.13.5/uv-x86_64-unknown-linux-musl.tar.gz",
+      "checksum": "57EF9D9CCB01FB1BD998DF995B0DD221B52F7D7841FBEA93F2D4463BF61FB7A9",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/betterleaks/betterleaks/v1.7.4/betterleaks_1.7.4_darwin_arm64.tar.gz",
-      "checksum": "9D68AB4A009A26F3F35131F321DDFF11E53AAA5608A1633308836A802FE2F732",
+      "id": "github_release/github.com/betterleaks/betterleaks/v1.9.0/betterleaks_1.9.0_darwin_arm64.tar.gz",
+      "checksum": "83DD7EAAB13D44A1E8E347A17064CDEF153A1478DB473276D41B38D55613D3F2",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/betterleaks/betterleaks/v1.7.4/betterleaks_1.7.4_darwin_x64.tar.gz",
-      "checksum": "36AFD22F9CFC90C1DE83A9FD4A6181E3D9A7CA473783BCFED826998A64029E11",
+      "id": "github_release/github.com/betterleaks/betterleaks/v1.9.0/betterleaks_1.9.0_darwin_x64.tar.gz",
+      "checksum": "68DFD83458D9E7F90663DAA7A81C7F944083B170DAE82E4F5F8D0581ED519EF1",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/betterleaks/betterleaks/v1.7.4/betterleaks_1.7.4_linux_arm64.tar.gz",
-      "checksum": "038D8379935FB6699E12C2C95D0D4901A1EF420CBC553B7C4D4710570D03024E",
+      "id": "github_release/github.com/betterleaks/betterleaks/v1.9.0/betterleaks_1.9.0_linux_arm64.tar.gz",
+      "checksum": "1D39116E0A58DC94574715E2AA12A2DBD5062F193EEE3FEC011FEF6BA06BD13B",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/betterleaks/betterleaks/v1.7.4/betterleaks_1.7.4_linux_x64.tar.gz",
-      "checksum": "9ED7739A39A26A2217F38726BFF8A8F4FE079D3B21272CAA7959823CCC444D96",
+      "id": "github_release/github.com/betterleaks/betterleaks/v1.9.0/betterleaks_1.9.0_linux_x64.tar.gz",
+      "checksum": "F8B185A39FFCECE2A1CA82BF3A4E7435CD81963FFD16B7A9128DAF75F35F6DE7",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/betterleaks/betterleaks/v1.7.4/betterleaks_1.7.4_windows_arm64.zip",
-      "checksum": "3C48203A1FF18D1EBAC9B3F191015F57999BBFFCFF3833651E6A3B4944561E7F",
+      "id": "github_release/github.com/betterleaks/betterleaks/v1.9.0/betterleaks_1.9.0_windows_arm64.zip",
+      "checksum": "3E5B9B6CDBFE8D486AE2DD2FA137473DC9AB42BF50317F051B73561121861816",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/betterleaks/betterleaks/v1.7.4/betterleaks_1.7.4_windows_x64.zip",
-      "checksum": "085CC79A0CDF1DC86BCF087B2BFBD337DD996FD55BFC3F9E63F9F5144437E2B2",
+      "id": "github_release/github.com/betterleaks/betterleaks/v1.9.0/betterleaks_1.9.0_windows_x64.zip",
+      "checksum": "B765DAEC9FDA475B031B5A5159798CBE4294A3F2A50683CBC0471226E376D3DA",
       "algorithm": "sha256"
     },
     {
-      "id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.538.0/registry.yaml",
-      "checksum": "2BDF2310CD8DFD9AE2015014A90554485DB37EDD0902B0AA6873023F99F53CF7",
+      "id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.575.0/registry.yaml",
+      "checksum": "340BC6F1FA7124077830D090576F9DC538212FDD7869F8DE973E81B0124EFFA1",
       "algorithm": "sha256"
     }
   ]

aqua.yaml

@@ -4,8 +4,8 @@ checksum:
 
 registries:
   - type: standard
-    ref: v4.538.0 # renovate: depName=aquaproj/aqua-registry
+    ref: v4.575.0 # renovate: depName=aquaproj/aqua-registry
 
 packages:
-  - name: astral-sh/uv@0.12.13
-  - name: betterleaks/betterleaks@v1.7.4
+  - name: astral-sh/uv@0.13.5
+  - name: betterleaks/betterleaks@v1.9.0

pyproject.toml

@@ -3,7 +3,7 @@ name = "codex-app-mcp"
 version = "0.1.1"
 description = "Local MCP bridge exposing Codex App Server threads/turns as the codex / codex-reply MCP tools (noninteractive compatibility subset)"
 readme = "README.md"
-requires-python = ">=3.14,<3.15"
+requires-python = ">=3.15,<3.16"
 license = "MIT"
 license-files = ["LICENSE"]
 authors = [
@@ -15,12 +15,12 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
     "Operating System :: POSIX :: Linux",
     "Programming Language :: Python :: 3 :: Only",
-    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Topic :: Software Development :: Libraries :: Application Frameworks",
 ]
 dependencies = [
-    "mcp==2.2.0",
-    "openai-codex==0.160.0",
+    "mcp==2.3.0",
+    "openai-codex==0.163.0",
 ]
 
 [project.urls]
@@ -58,7 +58,7 @@ markers = [
 
 [tool.ruff]
 line-length = 100
-target-version = "py314"
+target-version = "py315"
 
 [tool.ruff.lint.per-file-ignores]
 # Long assertion messages are part of these regression diagnostics.

src/codex_app_mcp/doctor.py

@@ -29,8 +29,8 @@
 
 
 def _is_supported_python(version_info: tuple[int, ...] = sys.version_info) -> bool:
-    """Return whether the interpreter is in the supported 3.14 major line."""
-    return (3, 14) <= version_info[:2] < (3, 15)
+    """Return whether the interpreter is in the supported 3.15 major line."""
+    return (3, 15) <= version_info[:2] < (3, 16)
 
 
 def _check(ok: bool, detail: str, *, level_on_fail: str = FAIL) -> dict[str, str]:

tests/contract/fake_app_server.py

@@ -107,7 +107,7 @@ def _thread_obj(self, thread_id: str, cwd: str, overrides: dict) -> dict:
             "updatedAt": now,
             "cwd": overrides.get("cwd", cwd),
             "ephemeral": False,
-            "cliVersion": "0.154.0-fake",
+            "cliVersion": "0.163.0-fake",
             "modelProvider": "openai",
             "preview": "fake thread",
             "sessionId": f"session-{thread_id}",
@@ -155,9 +155,9 @@ def handle_initialize(self, request_id: str, params: dict) -> None:
         result = {
             "serverInfo": self.scenario.get(
                 "initialize",
-                {"name": "fake-app-server", "version": "0.154.0"},
+                {"name": "fake-app-server", "version": "0.163.0"},
             ),
-            "userAgent": "codex-fake/0.154.0",
+            "userAgent": "codex-fake/0.163.0",
             "platformFamily": "linux",
         }
         InitializeResponse.model_validate(result)

tests/unit/test_config_policy.py

@@ -50,7 +50,7 @@ def _config(**kw) -> object:
 
 @pytest.mark.parametrize(
     ("version", "supported"),
-    [((3, 13, 15), False), ((3, 14, 0), True), ((3, 14, 99), True), ((3, 15, 0), False)],
+    [((3, 14, 99), False), ((3, 15, 0), True), ((3, 15, 99), True), ((3, 16, 0), False)],
 )
 def test_doctor_python_support_matches_package_metadata(version, supported):
     assert _is_supported_python(version) is supported

tests/unit/test_results.py

@@ -112,6 +112,27 @@ def test_commentary_and_command_output_excluded():
     assert outcome.final_text is None
 
 
+def test_partial_answer_is_never_the_final_text():
+    """openai-codex 0.163.0 added MessagePhase.partial_answer; like the SDK's own
+    final-response scan, only final_answer or phase-unspecified text counts."""
+    reducer = TurnResultReducer()
+    _observe_sequence(
+        reducer,
+        [
+            _Item("agentMessage", "途中まで", "partial_answer"),
+            _Item("agentMessage", "最終回答", "final_answer"),
+            _Item("agentMessage", "後続の途中", "partial_answer"),
+        ],
+    )
+    reducer.observe("turn/completed", _TurnCompleted("th", _Turn("t1", "completed")))
+    assert reducer.finalize().final_text == "最終回答"
+
+    reducer = TurnResultReducer()
+    _observe_sequence(reducer, [_Item("agentMessage", "途中まで", "partial_answer")])
+    reducer.observe("turn/completed", _TurnCompleted("th", _Turn("t1", "completed")))
+    assert reducer.finalize().final_text is None
+
+
 def test_failed_turn_raises():
     reducer = TurnResultReducer()
     reducer.observe(