Allow updating Codex CLI on SSH hosts from Settings > Connections

What feature would you like to see?

Please allow users to check and update the Codex CLI installed on an SSH host directly from the Codex App's Settings > Connections > SSH interface.

For each SSH host, the app could show:

• the detected remote Codex CLI path and current version;
• the version required or recommended by the current Codex App;
• an Update CLI action when the remote version is outdated or incompatible;
• the exact command and install method that will be used before execution;
• a clear privilege prompt if sudo or other elevated access is required;
• progress, success/failure details, and a version re-check after the update.

The action should respect how Codex was originally installed when possible (for example npm, Homebrew, or a standalone binary). If an automatic update is unsafe or unsupported, the UI should provide a copyable command tailored to that host instead.

Why is this useful?

The Codex App can update independently of Codex CLI installations on remote SSH machines. This can leave the app and remote app-server/CLI on incompatible versions and break remote projects until the user manually opens a terminal, identifies which codex binary the app is using, and updates it.

Managing multiple SSH hosts makes this repetitive and error-prone. A version-aware update action in the Connections screen would put the repair workflow next to the detected compatibility problem.

This is especially useful for:

• users with several remote development machines;
• remote hosts that are not opened in a separate terminal regularly;
• environments where multiple Codex installations exist on PATH;
• teams where the desktop app updates faster than centrally managed remote machines.

Suggested behavior

1. Probe the same remote codex binary/path that the app will actually launch.
2. Display current version, recommended version, and compatibility status.
3. Let the user review and confirm the proposed update command.
4. Run the update over the existing SSH connection.
5. Re-probe the binary and restart/reconnect the remote app-server if needed.
6. If the update cannot be performed, show an actionable reason and a copyable manual command.

Related: #30122 reports that frequent Codex App updates can become incompatible with SSH-host CLI versions. This request proposes an in-app recovery and maintenance workflow for that problem.

Additional information

The update action should never silently switch to a different codex binary. The UI should show the resolved executable path before and after updating, which would also help diagnose stale or shadowed installations.