Astra checked the Codex source code that gets compiled and shipped by Arch Linux. Straight up linked me to the User-Agent builder code.

https://github.com/openai/codex/blob/687a119f0fcaace47e1f1ab...

That's more than sufficient for me. The open source codex client seems clean.

There is some kind of "hosted search service" that I couldn't verify. I don't have a remote server I can point it at in order to inspect the traffic. Would be cool if someone else could shed some light on that.