d61dea6fe6
Because the `codex` process could contain sensitive information in memory, such as API keys, we add logic so that when `CODEX_SECURE_MODE=1` is specified, we avail ourselves of whatever the operating system provides to restrict observability/tampering, which includes: - disabling `ptrace(2)`, so it is not possible to attach to the process with a debugger, such as `gdb` - disabling core dumps Admittedly, a user with root privileges can defeat these safeguards. For now, we only add support for this in the `codex` multitool, but we may ultimately want to support this in some of the smaller CLIs that are buildable out of our Cargo workspace.
59 lines
1.4 KiB
TOML
59 lines
1.4 KiB
TOML
[package]
|
|
edition = "2024"
|
|
name = "codex-cli"
|
|
version = { workspace = true }
|
|
|
|
[[bin]]
|
|
name = "codex"
|
|
path = "src/main.rs"
|
|
|
|
[lib]
|
|
name = "codex_cli"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
clap_complete = { workspace = true }
|
|
codex-arg0 = { workspace = true }
|
|
codex-chatgpt = { workspace = true }
|
|
codex-common = { workspace = true, features = ["cli"] }
|
|
codex-core = { workspace = true }
|
|
codex-exec = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-mcp-server = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-protocol-ts = { workspace = true }
|
|
codex-tui = { workspace = true }
|
|
ctor = { workspace = true }
|
|
owo-colors = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
supports-color = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
libc = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "android")'.dependencies]
|
|
libc = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
libc = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
assert_cmd = { workspace = true }
|
|
predicates = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|