fix(ai-cli): install current upstream Codex and Claude releases

- Pin official Codex 0.161.0 and Claude Code 2.1.292 binaries
- Preserve Codex helpers and Claude's NixOS compatibility wrapper
- Add an updater for stable upstream versions and checksums
- Document CLI updates independently of stable NixOS inputs

packages/ai-cli.nix

@@ -0,0 +1,53 @@
+{ pkgs }:
+let
+  versions = builtins.fromJSON (builtins.readFile ./ai-cli-versions.json);
+in
+{
+  # Use the complete official package, including Code Mode and voice helpers.
+  codex = pkgs.stdenvNoCC.mkDerivation {
+    pname = "codex";
+    inherit (versions.codex) version;
+    src = pkgs.fetchurl {
+      url = "https://github.com/openai/codex/releases/download/rust-v${versions.codex.version}/codex-package-x86_64-unknown-linux-musl.tar.gz";
+      inherit (versions.codex) sha256;
+    };
+    sourceRoot = ".";
+    nativeBuildInputs = [ pkgs.autoPatchelfHook pkgs.makeWrapper ];
+    buildInputs = [ pkgs.glibc pkgs.ncurses ];
+    dontBuild = true;
+    dontStrip = true;
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p "$out"
+      cp -r bin codex-path codex-resources codex-package.json "$out/"
+      runHook postInstall
+    '';
+    postFixup = ''
+      wrapProgram "$out/bin/codex" \
+        --prefix PATH : ${pkgs.lib.makeBinPath [ pkgs.ripgrep pkgs.bubblewrap ]}
+    '';
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      "$out/bin/codex" --version | grep -F "codex-cli ${versions.codex.version}"
+      runHook postInstallCheck
+    '';
+    meta = {
+      description = "OpenAI coding agent, official upstream binary package";
+      homepage = "https://github.com/openai/codex";
+      license = pkgs.lib.licenses.asl20;
+      mainProgram = "codex";
+      platforms = [ "x86_64-linux" ];
+      sourceProvenance = [ pkgs.lib.sourceTypes.binaryNativeCode ];
+    };
+  };
+
+  # Keep Nixpkgs' NixOS compatibility fixes and sandbox dependencies.
+  claude-code = pkgs.claude-code.override {
+    manifest = {
+      inherit (versions.claude-code) version;
+      platforms.linux-x64.checksum = versions.claude-code.sha256;
+    };
+  };
+}