d61dea6fe6
Because the `codex` process could contain sensitive information in memory, such as API keys, we add logic so that when `CODEX_SECURE_MODE=1` is specified, we avail ourselves of whatever the operating system provides to restrict observability/tampering, which includes: - disabling `ptrace(2)`, so it is not possible to attach to the process with a debugger, such as `gdb` - disabling core dumps Admittedly, a user with root privileges can defeat these safeguards. For now, we only add support for this in the `codex` multitool, but we may ultimately want to support this in some of the smaller CLIs that are buildable out of our Cargo workspace.
210 lines
4.9 KiB
TOML
210 lines
4.9 KiB
TOML
[workspace]
|
|
members = [
|
|
"ansi-escape",
|
|
"apply-patch",
|
|
"arg0",
|
|
"cli",
|
|
"common",
|
|
"core",
|
|
"exec",
|
|
"execpolicy",
|
|
"file-search",
|
|
"git-tooling",
|
|
"linux-sandbox",
|
|
"login",
|
|
"mcp-client",
|
|
"mcp-server",
|
|
"mcp-types",
|
|
"ollama",
|
|
"protocol",
|
|
"protocol-ts",
|
|
"tui",
|
|
"utils/readiness",
|
|
]
|
|
resolver = "2"
|
|
|
|
[workspace.package]
|
|
version = "0.0.0"
|
|
# Track the edition for all workspace crates in one place. Individual
|
|
# crates can still override this value, but keeping it here means new
|
|
# crates created with `cargo new -w ...` automatically inherit the 2024
|
|
# edition.
|
|
edition = "2024"
|
|
|
|
[workspace.dependencies]
|
|
# Internal
|
|
codex-ansi-escape = { path = "ansi-escape" }
|
|
codex-apply-patch = { path = "apply-patch" }
|
|
codex-arg0 = { path = "arg0" }
|
|
codex-chatgpt = { path = "chatgpt" }
|
|
codex-common = { path = "common" }
|
|
codex-core = { path = "core" }
|
|
codex-exec = { path = "exec" }
|
|
codex-file-search = { path = "file-search" }
|
|
codex-git-tooling = { path = "git-tooling" }
|
|
codex-linux-sandbox = { path = "linux-sandbox" }
|
|
codex-login = { path = "login" }
|
|
codex-mcp-client = { path = "mcp-client" }
|
|
codex-mcp-server = { path = "mcp-server" }
|
|
codex-ollama = { path = "ollama" }
|
|
codex-protocol = { path = "protocol" }
|
|
codex-protocol-ts = { path = "protocol-ts" }
|
|
codex-tui = { path = "tui" }
|
|
codex-utils-readiness = { path = "utils/readiness" }
|
|
core_test_support = { path = "core/tests/common" }
|
|
mcp-types = { path = "mcp-types" }
|
|
mcp_test_support = { path = "mcp-server/tests/common" }
|
|
|
|
# External
|
|
allocative = "0.3.3"
|
|
ansi-to-tui = "7.0.0"
|
|
anyhow = "1"
|
|
arboard = "3"
|
|
askama = "0.12"
|
|
assert_cmd = "2"
|
|
async-channel = "2.3.1"
|
|
async-stream = "0.3.6"
|
|
async-trait = "0.1.89"
|
|
base64 = "0.22.1"
|
|
bytes = "1.10.1"
|
|
chrono = "0.4.42"
|
|
clap = "4"
|
|
clap_complete = "4"
|
|
color-eyre = "0.6.3"
|
|
crossterm = "0.28.1"
|
|
ctor = "0.5.0"
|
|
derive_more = "2"
|
|
diffy = "0.4.2"
|
|
dirs = "6"
|
|
dotenvy = "0.15.7"
|
|
env-flags = "0.1.1"
|
|
env_logger = "0.11.5"
|
|
eventsource-stream = "0.2.3"
|
|
futures = "0.3"
|
|
icu_decimal = "2.0.0"
|
|
icu_locale_core = "2.0.0"
|
|
ignore = "0.4.23"
|
|
image = { version = "^0.25.8", default-features = false }
|
|
insta = "1.43.2"
|
|
itertools = "0.14.0"
|
|
landlock = "0.4.1"
|
|
lazy_static = "1"
|
|
libc = "0.2.175"
|
|
log = "0.4"
|
|
maplit = "1.0.2"
|
|
mime_guess = "2.0.5"
|
|
multimap = "0.10.0"
|
|
nucleo-matcher = "0.3.1"
|
|
openssl-sys = "*"
|
|
os_info = "3.12.0"
|
|
owo-colors = "4.2.0"
|
|
path-absolutize = "3.1.1"
|
|
path-clean = "1.0.1"
|
|
pathdiff = "0.2"
|
|
portable-pty = "0.9.0"
|
|
predicates = "3"
|
|
pretty_assertions = "1.4.1"
|
|
pulldown-cmark = "0.10"
|
|
rand = "0.9"
|
|
ratatui = "0.29.0"
|
|
regex-lite = "0.1.7"
|
|
reqwest = "0.12"
|
|
schemars = "0.8.22"
|
|
seccompiler = "0.5.0"
|
|
serde = "1"
|
|
serde_json = "1"
|
|
serde_with = "3.14"
|
|
sha1 = "0.10.6"
|
|
sha2 = "0.10"
|
|
shlex = "1.3.0"
|
|
similar = "2.7.0"
|
|
starlark = "0.13.0"
|
|
strum = "0.27.2"
|
|
strum_macros = "0.27.2"
|
|
supports-color = "3.0.2"
|
|
sys-locale = "0.3.2"
|
|
tempfile = "3.23.0"
|
|
textwrap = "0.16.2"
|
|
thiserror = "2.0.16"
|
|
time = "0.3"
|
|
tiny_http = "0.12"
|
|
tokio = "1"
|
|
tokio-stream = "0.1.17"
|
|
tokio-test = "0.4"
|
|
tokio-util = "0.7.16"
|
|
toml = "0.9.5"
|
|
toml_edit = "0.23.4"
|
|
tracing = "0.1.41"
|
|
tracing-appender = "0.2.3"
|
|
tracing-subscriber = "0.3.20"
|
|
tree-sitter = "0.25.9"
|
|
tree-sitter-bash = "0.25.0"
|
|
ts-rs = "11"
|
|
unicode-segmentation = "1.12.0"
|
|
unicode-width = "0.2"
|
|
url = "2"
|
|
urlencoding = "2.1"
|
|
uuid = "1"
|
|
vt100 = "0.16.2"
|
|
walkdir = "2.5.0"
|
|
webbrowser = "1.0"
|
|
which = "6"
|
|
wildmatch = "2.5.0"
|
|
wiremock = "0.6"
|
|
|
|
[workspace.lints]
|
|
rust = {}
|
|
|
|
[workspace.lints.clippy]
|
|
expect_used = "deny"
|
|
identity_op = "deny"
|
|
manual_clamp = "deny"
|
|
manual_filter = "deny"
|
|
manual_find = "deny"
|
|
manual_flatten = "deny"
|
|
manual_map = "deny"
|
|
manual_memcpy = "deny"
|
|
manual_non_exhaustive = "deny"
|
|
manual_ok_or = "deny"
|
|
manual_range_contains = "deny"
|
|
manual_retain = "deny"
|
|
manual_strip = "deny"
|
|
manual_try_fold = "deny"
|
|
manual_unwrap_or = "deny"
|
|
needless_borrow = "deny"
|
|
needless_borrowed_reference = "deny"
|
|
needless_collect = "deny"
|
|
needless_late_init = "deny"
|
|
needless_option_as_deref = "deny"
|
|
needless_question_mark = "deny"
|
|
needless_update = "deny"
|
|
redundant_clone = "deny"
|
|
redundant_closure = "deny"
|
|
redundant_closure_for_method_calls = "deny"
|
|
redundant_static_lifetimes = "deny"
|
|
trivially_copy_pass_by_ref = "deny"
|
|
uninlined_format_args = "deny"
|
|
unnecessary_filter_map = "deny"
|
|
unnecessary_lazy_evaluations = "deny"
|
|
unnecessary_sort_by = "deny"
|
|
unnecessary_to_owned = "deny"
|
|
unwrap_used = "deny"
|
|
|
|
# cargo-shear cannot see the platform-specific openssl-sys usage, so we
|
|
# silence the false positive here instead of deleting a real dependency.
|
|
[workspace.metadata.cargo-shear]
|
|
ignored = ["openssl-sys", "codex-utils-readiness"]
|
|
|
|
[profile.release]
|
|
lto = "fat"
|
|
# Because we bundle some of these executables with the TypeScript CLI, we
|
|
# remove everything to make the binary as small as possible.
|
|
strip = "symbols"
|
|
|
|
# See https://github.com/openai/codex/issues/1411 for details.
|
|
codegen-units = 1
|
|
|
|
[patch.crates-io]
|
|
# ratatui = { path = "../../ratatui" }
|
|
ratatui = { git = "https://github.com/nornagon/ratatui", branch = "nornagon-v0.29.0-patch" }
|