diff --git a/.github/actions/build-codex-packages/action.yml b/.github/actions/build-codex-packages/action.yml
index aa8a517679..86d9fdeae8 100644
--- a/.github/actions/build-codex-packages/action.yml
+++ b/.github/actions/build-codex-packages/action.yml
@@ -23,7 +23,7 @@ runs:
shell: bash
working-directory: codex-rs
env:
- BASE_BINARIES: "codex codex-app-server codex-code-mode-host codex-exec-server"
+ BASE_BINARIES: "codex codex-app-server codex-code-mode-host"
WINDOWS_ONLY_BINARIES: "codex-command-runner codex-windows-sandbox-setup"
BUILD_MODE: ${{ inputs.build-mode }}
BUILD_SYSTEM: ${{ inputs.build-system }}
@@ -138,7 +138,6 @@ runs:
package_args=(
--target "$target"
--code-mode-host-bin "${release_dir}/codex-code-mode-host${exe_suffix}"
- --exec-server-bin "${release_dir}/codex-exec-server${exe_suffix}"
--cargo-profile release
--package-version "$CODEX_PACKAGE_VERSION"
--force
@@ -184,6 +183,7 @@ runs:
mkdir -p "${GITHUB_WORKSPACE}/codex-rs/target"
pytest_args=(
-v
+ --basetemp "${GITHUB_WORKSPACE}/codex-rs/target/package-smoke-tmp"
--package-target "$target"
--symbols-archive "${GITHUB_WORKSPACE}/symbols-dist/${target}/codex-symbols-${target}.tar.gz"
)
@@ -194,17 +194,13 @@ runs:
exit 1
fi
- # Windows setup helpers can finish background ACL work after pytest exits.
- # Separate roots keep the next run from deleting their executables.
uv run --frozen pytest "${pytest_args[@]}" \
- --basetemp "${GITHUB_WORKSPACE}/codex-rs/target/package-smoke-gzip-tmp" \
--compression gzip \
--cli-archive "${archive_dir}/codex-package-${target}.tar.gz" \
--app-server-archive "${archive_dir}/codex-app-server-package-${target}.tar.gz" \
test_codex_package.py
uv run --frozen pytest "${pytest_args[@]}" \
- --basetemp "${GITHUB_WORKSPACE}/codex-rs/target/package-smoke-zstd-tmp" \
--compression zstd \
--cli-archive "${archive_dir}/codex-package-${target}.tar.zst" \
--app-server-archive "${archive_dir}/codex-app-server-package-${target}.tar.zst" \
diff --git a/.github/scripts/build-codex-package-archive.sh b/.github/scripts/build-codex-package-archive.sh
index 20c12a3389..16db0342ae 100644
--- a/.github/scripts/build-codex-package-archive.sh
+++ b/.github/scripts/build-codex-package-archive.sh
@@ -136,8 +136,6 @@ case "$target" in
;;
esac
-resource_args+=(--exec-server-bin "${entrypoint_dir%/}/codex-exec-server${exe_suffix}")
-
code_mode_host_bin="${entrypoint_dir%/}/codex-code-mode-host${exe_suffix}"
if [[ "$code_mode_host_bin_provided" == "false" && -f "$code_mode_host_bin" ]]; then
resource_args+=(--code-mode-host-bin "$code_mode_host_bin")
diff --git a/.github/scripts/macos-signing/codex-exec-server.entitlements.plist b/.github/scripts/macos-signing/codex-exec-server.entitlements.plist
deleted file mode 100644
index 0c67376eba..0000000000
--- a/.github/scripts/macos-signing/codex-exec-server.entitlements.plist
+++ /dev/null
@@ -1,5 +0,0 @@
-
-
-
-
-
diff --git a/.github/scripts/macos-signing/provisioned_macos_cli_package.py b/.github/scripts/macos-signing/provisioned_macos_cli_package.py
index 5266feabff..e9bc091074 100644
--- a/.github/scripts/macos-signing/provisioned_macos_cli_package.py
+++ b/.github/scripts/macos-signing/provisioned_macos_cli_package.py
@@ -19,7 +19,7 @@ CODE_SIGNING_ID = "codex"
APP = Path("CodexCLI.app")
EXECUTABLE = APP / "Contents/MacOS/codex"
SIGNING = Path(__file__).resolve().parent
-HELPERS = ("bin/codex-code-mode-host", "bin/codex-exec-server", "codex-path/rg")
+HELPERS = ("bin/codex-code-mode-host", "codex-path/rg")
LAUNCHER = """#!/bin/sh
set -eu
entry="$0"
diff --git a/.github/scripts/macos-signing/sign_macos_cli_package.py b/.github/scripts/macos-signing/sign_macos_cli_package.py
index 8e3ef6726f..ac214160a1 100644
--- a/.github/scripts/macos-signing/sign_macos_cli_package.py
+++ b/.github/scripts/macos-signing/sign_macos_cli_package.py
@@ -2,7 +2,6 @@
import argparse
import os
-import plistlib
import subprocess
import sys
from pathlib import Path
@@ -135,12 +134,6 @@ def main(configuration: bundle.ProfileConfiguration | None = None):
check=True,
)
if relative.startswith("bin/"):
- # Signing tools may omit the blob when no entitlements are requested.
- if (
- actual.stat().st_size == 0
- and plistlib.loads(entitlements.read_bytes()) == {}
- ):
- actual.write_bytes(entitlements.read_bytes())
expected = reports / f"{name}-expected.plist"
subprocess.run(
[
diff --git a/.github/scripts/macos-signing/test_sign_macos_cli_package.py b/.github/scripts/macos-signing/test_sign_macos_cli_package.py
index 5ed7349397..1b7ac328ee 100644
--- a/.github/scripts/macos-signing/test_sign_macos_cli_package.py
+++ b/.github/scripts/macos-signing/test_sign_macos_cli_package.py
@@ -34,15 +34,10 @@ if name == "codesign":
target = Path(args[-1]).name
if target == "CodexCLI.app":
source = Path(os.environ["CODEX_REPO_ROOT"]) / "signing-verification/codex-provisioned-entitlements.plist"
- elif target in ("codex", "codex-code-mode-host", "codex-exec-server"):
+ elif target in ("codex", "codex-code-mode-host"):
source = Path(os.environ["MOCK_SIGNING_SCRIPTS"]) / (target + ".entitlements.plist")
else:
sys.exit(0)
- if target == "codex-exec-server" and os.environ.get("MOCK_EXECUTOR_ENTITLEMENTS"):
- sys.stdout.buffer.write(plistlib.dumps({"unexpected": True}))
- sys.exit(0)
- if not plistlib.loads(source.read_bytes()) and os.environ.get("MOCK_OMIT_EMPTY_ENTITLEMENTS"):
- sys.exit(0)
if os.environ.get("MOCK_WRONG_ENTITLEMENTS"):
sys.stdout.buffer.write(plistlib.dumps({"unexpected": True}))
else:
@@ -150,21 +145,15 @@ class MacosSigningTests(ProvisioningTestCase):
)
def test_standard_and_provisioned_signing_and_verification(self):
- for provisioned, target, omit_empty in itertools.product(
- (False, True),
- ("aarch64-apple-darwin", "x86_64-apple-darwin"),
- (False, True),
+ for provisioned, target in itertools.product(
+ (False, True), ("aarch64-apple-darwin", "x86_64-apple-darwin")
):
with (
- self.subTest(
- provisioned=provisioned, target=target, omit_empty=omit_empty
- ),
+ self.subTest(provisioned=provisioned, target=target),
tempfile.TemporaryDirectory() as directory,
):
root = Path(directory).resolve()
package, driver, env = self.fixture(root, provisioned, target)
- if omit_empty:
- env["MOCK_OMIT_EMPTY_ENTITLEMENTS"] = "1"
result = self.run_driver(driver, "sign", package, env)
self.assertEqual(result.returncode, 0, result.stderr)
result = self.run_driver(driver, "verify", package, env)
@@ -200,13 +189,13 @@ class MacosSigningTests(ProvisioningTestCase):
)
self.assertEqual(
["--entitlements" in call for call in signing],
- [True, True, True, False],
+ [True, True, False],
)
self.assertEqual(
[call[0] for call in calls if call[0].startswith("notarize")],
["notarize_with_akv.py"]
if provisioned
- else ["notarize_macos_binary_with_akv.sh"] * 4,
+ else ["notarize_macos_binary_with_akv.sh"] * 3,
)
self.assertEqual(
[call[1:] for call in calls if call[0] == "lipo"],
@@ -329,12 +318,7 @@ class MacosSigningTests(ProvisioningTestCase):
def test_verification_rejects_wrong_signing_identity_and_entitlements(self):
for provisioned, failure in itertools.product(
- (False, True),
- (
- "MOCK_WRONG_SIGNING_IDENTITY",
- "MOCK_WRONG_ENTITLEMENTS",
- "MOCK_EXECUTOR_ENTITLEMENTS",
- ),
+ (False, True), ("MOCK_WRONG_SIGNING_IDENTITY", "MOCK_WRONG_ENTITLEMENTS")
):
with (
self.subTest(provisioned=provisioned, failure=failure),
diff --git a/.github/workflows/rust-release-windows.yml b/.github/workflows/rust-release-windows.yml
index ae435ae4af..f80bcb34e7 100644
--- a/.github/workflows/rust-release-windows.yml
+++ b/.github/workflows/rust-release-windows.yml
@@ -4,7 +4,7 @@ on:
workflow_call:
env:
- WINDOWS_BINARIES: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy codex-windows-sandbox-setup codex-windows-sandbox-service codex-command-runner codex-app-server"
+ WINDOWS_BINARIES: "codex codex-code-mode-host codex-responses-api-proxy codex-windows-sandbox-setup codex-windows-sandbox-service codex-command-runner codex-app-server"
jobs:
build-windows-binaries:
@@ -39,14 +39,14 @@ jobs:
- runner: windows-x64
target: x86_64-pc-windows-msvc
bundle: primary
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-x64
- runner: windows-arm64
target: aarch64-pc-windows-msvc
bundle: primary
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-arm64
@@ -67,14 +67,14 @@ jobs:
- runner: windows-x64
target: x86_64-pc-windows-msvc
bundle: app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-x64
- runner: windows-arm64
target: aarch64-pc-windows-msvc
bundle: app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-arm64
@@ -549,26 +549,6 @@ jobs:
--entrypoint-dir "$CARGO_TARGET_DIR/$target/release" \
--archive-dir "dist/$target"
- - name: Verify packaged executor signatures and bytes
- shell: pwsh
- run: |
- $target = "${{ matrix.target }}"
- $source = Join-Path $env:CARGO_TARGET_DIR "$target/release/codex-exec-server.exe"
- foreach ($stem in @("codex-package", "codex-app-server-package")) {
- $package = Join-Path $env:RUNNER_TEMP "verify-executor-$stem-$target"
- New-Item -ItemType Directory -Path $package | Out-Null
- tar -xzf "dist/$target/$stem-$target.tar.gz" -C $package
- if ($LASTEXITCODE -ne 0) { throw "Cannot extract executor package" }
- $binary = Join-Path $package "bin/codex-exec-server.exe"
- if ((Get-FileHash $binary).Hash -ne (Get-FileHash $source).Hash) {
- throw "Packaged executor differs from the signed input"
- }
- $signature = Get-AuthenticodeSignature $binary
- if ($signature.Status -ne "Valid" -or $null -eq $signature.TimeStamperCertificate) {
- throw "Invalid or untimestamped executor signature"
- }
- }
-
- name: Verify packaged Windows voice closure
shell: pwsh
run: |
diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index 6a4a2dcaca..7702e44a6c 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -96,50 +96,50 @@ jobs:
target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
build_dmg: "true"
- runner: macos-15-xlarge
target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
build_dmg: "false"
- runner: macos-15-xlarge
target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
build_dmg: "true"
- runner: macos-15-xlarge
target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
build_dmg: "false"
# Release artifacts intentionally ship MUSL-linked Linux binaries.
- runner: ${{ github.event.repository.name }}-linux-x64-xl
target: x86_64-unknown-linux-musl
bundle: primary
artifact_name: x86_64-unknown-linux-musl
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy bwrap"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy bwrap"
build_dmg: "false"
- runner: ${{ github.event.repository.name }}-linux-x64-xl
target: x86_64-unknown-linux-musl
bundle: app-server
artifact_name: x86_64-unknown-linux-musl-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
build_dmg: "false"
- runner: ${{ github.event.repository.name }}-linux-arm64
target: aarch64-unknown-linux-musl
bundle: primary
artifact_name: aarch64-unknown-linux-musl
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy bwrap"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy bwrap"
build_dmg: "false"
- runner: ${{ github.event.repository.name }}-linux-arm64
target: aarch64-unknown-linux-musl
bundle: app-server
artifact_name: aarch64-unknown-linux-musl-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
build_dmg: "false"
steps:
@@ -398,9 +398,9 @@ jobs:
mkdir -p "$dest"
for binary in ${{ matrix.binaries }}; do
- # Both variants package the host and executor; only the primary publishes
+ # Both variants package the host, but only the primary bundle publishes
# standalone binary archives to avoid duplicate release asset names.
- if [[ "${{ matrix.bundle }}" == "app-server" && ( "$binary" == "codex-code-mode-host" || "$binary" == "codex-exec-server" ) ]]; then
+ if [[ "${{ matrix.bundle }}" == "app-server" && "$binary" == "codex-code-mode-host" ]]; then
continue
fi
cp "target/${{ matrix.target }}/release/${binary}" "$dest/${binary}-${{ matrix.target }}"
@@ -662,19 +662,19 @@ jobs:
- target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
- target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
- target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
- target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -907,22 +907,22 @@ jobs:
- target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
build_dmg: "true"
- target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
build_dmg: "false"
- target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
build_dmg: "true"
- target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
build_dmg: "false"
steps:
@@ -1001,9 +1001,9 @@ jobs:
mkdir -p "$dest"
for binary in ${{ matrix.binaries }}; do
- # Both variants package the host and executor; only the primary publishes
+ # Both variants package the host, but only the primary bundle publishes
# standalone binary archives to avoid duplicate release asset names.
- if [[ "${{ matrix.bundle }}" == "app-server" && ( "$binary" == "codex-code-mode-host" || "$binary" == "codex-exec-server" ) ]]; then
+ if [[ "${{ matrix.bundle }}" == "app-server" && "$binary" == "codex-code-mode-host" ]]; then
continue
fi
cp "target/${{ matrix.target }}/release/${binary}" "$dest/${binary}-${{ matrix.target }}"
@@ -1300,22 +1300,22 @@ jobs:
- target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
verify_dmg: "true"
- target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
verify_dmg: "false"
- target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
- binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
+ binaries: "codex codex-code-mode-host codex-responses-api-proxy"
verify_dmg: "true"
- target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
- binaries: "codex-app-server codex-code-mode-host codex-exec-server"
+ binaries: "codex-app-server codex-code-mode-host"
verify_dmg: "false"
steps:
@@ -1376,15 +1376,6 @@ jobs:
normalized_actual="$(mktemp)"
normalized_expected="$(mktemp)"
codesign -d --entitlements :- "$path" >"$actual_entitlements"
- # An omitted entitlement blob is valid only when the expected plist is empty.
- python3 - "$expected_entitlements" "$actual_entitlements" <<'PY'
- import plistlib
- import sys
- from pathlib import Path
- expected, actual = map(Path, sys.argv[1:])
- if not actual.stat().st_size and plistlib.loads(expected.read_bytes()) == {}:
- actual.write_bytes(expected.read_bytes())
- PY
plutil -convert xml1 -o "$normalized_actual" "$actual_entitlements"
plutil -convert xml1 -o "$normalized_expected" "$expected_entitlements"
diff -u "$normalized_expected" "$normalized_actual"
@@ -1395,9 +1386,9 @@ jobs:
binary_path="${RUNNER_TEMP}/signed-binaries/${binary}"
verify_signed_binary "$binary_path" "$binary"
- # The app-server package contains both helpers, but their standalone archives
+ # The app-server package contains the host, but its standalone archives
# are omitted above to avoid duplicate release asset names.
- if [[ "${{ matrix.bundle }}" == "app-server" && ( "$binary" == "codex-code-mode-host" || "$binary" == "codex-exec-server" ) ]]; then
+ if [[ "${{ matrix.bundle }}" == "app-server" && "$binary" == "codex-code-mode-host" ]]; then
continue
fi
@@ -1433,7 +1424,6 @@ jobs:
tar -xzf "${packaged_dir}/${package_stem}-${target}.tar.gz" -C "$package_dir"
verify_signed_binary "${package_dir}/bin/${package_entrypoint}" "$package_entrypoint"
verify_signed_binary "${package_dir}/bin/codex-code-mode-host" "codex-code-mode-host"
- verify_signed_binary "${package_dir}/bin/codex-exec-server" "codex-exec-server"
for resource in \
"${package_dir}/codex-path/rg"
diff --git a/codex-rs/BUILD.bazel b/codex-rs/BUILD.bazel
index fc151fdc2e..e169894153 100644
--- a/codex-rs/BUILD.bazel
+++ b/codex-rs/BUILD.bazel
@@ -53,7 +53,6 @@ runtime_archive(
"//codex-rs/app-server:release_files",
"//codex-rs/cli:release_files",
"//codex-rs/code-mode-host:release_files",
- "//codex-rs/exec-server-cli:release_files",
] + select({
"@platforms//os:linux": ["//codex-rs/bwrap:release_files"],
"@platforms//os:windows": [
@@ -71,7 +70,6 @@ runtime_archive(
srcs = [
"//codex-rs/cli:release_files",
"//codex-rs/code-mode-host:release_files",
- "//codex-rs/exec-server-cli:release_files",
"//codex-rs/responses-api-proxy:release_files",
] + select({
"@platforms//os:linux": ["//codex-rs/bwrap:release_files"],
@@ -86,7 +84,6 @@ runtime_archive(
srcs = [
"//codex-rs/app-server:release_files",
"//codex-rs/code-mode-host:release_files",
- "//codex-rs/exec-server-cli:release_files",
] + select({
"@platforms//os:linux": ["//codex-rs/bwrap:release_files"],
"//conditions:default": [],
diff --git a/codex-rs/exec-server-cli/BUILD.bazel b/codex-rs/exec-server-cli/BUILD.bazel
index 553d6aeda1..5d31d3ad0d 100644
--- a/codex-rs/exec-server-cli/BUILD.bazel
+++ b/codex-rs/exec-server-cli/BUILD.bazel
@@ -1,6 +1,4 @@
load("//:defs.bzl", "codex_rust_crate")
-load("//bazel/platforms:release_binaries.bzl", "multiplatform_binaries")
-load("//bazel/rules:runtime_package.bzl", "release_binary")
codex_rust_crate(
name = "exec-server-cli",
@@ -11,7 +9,3 @@ codex_rust_crate(
# The standalone integration test launches native OS sandboxes itself.
test_tags = ["no-sandbox"],
)
-
-release_binary(binary = ":codex-exec-server")
-
-multiplatform_binaries(name = "codex-exec-server")
diff --git a/codex-rs/exec-server/README.md b/codex-rs/exec-server/README.md
index 46a465a79d..13d6c80986 100644
--- a/codex-rs/exec-server/README.md
+++ b/codex-rs/exec-server/README.md
@@ -17,8 +17,6 @@ use `codex-arg0` for hidden filesystem, process, and platform sandbox dispatch.
The standalone executable accepts the same executor arguments and `-c` config
overrides, including `--listen stdio`. Build it with
`cargo build -p codex-exec-server-cli --bin codex-exec-server`.
-Canonical packages place it in `bin/` beside the entrypoint, with platform
-sandbox resources in `codex-resources/`.
## Command metadata
diff --git a/scripts/codex_package/README.md b/scripts/codex_package/README.md
index d5f829debb..6c6ba6a108 100644
--- a/scripts/codex_package/README.md
+++ b/scripts/codex_package/README.md
@@ -19,8 +19,7 @@ The builder creates a canonical Codex package directory:
├── codex-package.json
├── bin
│ ├── [.exe]
-│ ├── codex-code-mode-host[.exe]
-│ └── codex-exec-server[.exe]
+│ └── codex-code-mode-host[.exe]
├── codex-resources
│ ├── bwrap # Linux only
│ ├── codex-command-runner.exe # Windows only
@@ -31,9 +30,6 @@ The builder creates a canonical Codex package directory:
The package directory is the primary artifact. Archive formats such as
`.tar.gz`, `.tar.zst`, and `.zip` are serializations of that directory.
-The `execServer` field in `codex-package.json` advertises the packaged executor.
-Installers use its presence to repair a missing executor while accepting older
-packages that predate the standalone binary.
If `--target` is omitted, the builder uses the release target for the current
host platform. On Linux, that default is a musl target to match Codex release
@@ -54,7 +50,6 @@ override was provided:
- all targets: the selected entrypoint, unless `--entrypoint-bin` is provided
- all targets: `codex-code-mode-host`, unless `--code-mode-host-bin` is provided
-- all targets: `codex-exec-server`, unless `--exec-server-bin` is provided
- Linux targets: `bwrap`, unless `--bwrap-bin` is provided
- Windows targets: `codex-command-runner` and `codex-windows-sandbox-setup`,
unless the corresponding prebuilt helper flags are provided
@@ -65,15 +60,15 @@ explicit target. Release jobs that already built and signed/notarized the
entrypoint should pass `--entrypoint-bin` so the package contains that exact
binary instead of rebuilding it.
-Release jobs should likewise pass `--code-mode-host-bin` and `--exec-server-bin`
-so the package preserves the signed host and executor beside the entrypoint.
+Release jobs should likewise pass `--code-mode-host-bin` so the package contains
+the signed host executable beside the signed entrypoint.
On Linux and macOS, the builder strips symbols from the **package copies** of
-source-built release-profile entrypoint, code-mode host, and executor binaries. Cargo outputs
+source-built release-profile entrypoint and code-mode host binaries. Cargo outputs
retain their symbols for debugging. The default `--strip auto` also preserves
development/profiling builds and prebuilt inputs
byte-for-byte, including signatures. Use `--strip all` to also strip prebuilt
-first-party executable copies, or `--strip none` to keep symbols in every package copy.
+entrypoint/host copies, or `--strip none` to keep symbols in every package copy.
Strip before production signing; `--strip all` is not appropriate for inputs
whose release signatures must be preserved. Windows MSVC symbols are separate
PDB files and are not included in the package.
diff --git a/scripts/codex_package/cargo.py b/scripts/codex_package/cargo.py
index 7f598256dd..f759e44762 100644
--- a/scripts/codex_package/cargo.py
+++ b/scripts/codex_package/cargo.py
@@ -18,7 +18,6 @@ CODEX_RS_ROOT = REPO_ROOT / "codex-rs"
class SourceBuildOutputs:
entrypoint_bin: Path
code_mode_host_bin: Path
- exec_server_bin: Path
bwrap_bin: Path | None
codex_command_runner_bin: Path | None
codex_windows_sandbox_setup_bin: Path | None
@@ -32,7 +31,6 @@ def build_source_binaries(
profile: str,
entrypoint_bin: Path | None,
code_mode_host_bin: Path | None,
- exec_server_bin: Path | None,
bwrap_bin: Path | None,
codex_command_runner_bin: Path | None,
codex_windows_sandbox_setup_bin: Path | None,
@@ -48,7 +46,6 @@ def build_source_binaries(
variant,
build_entrypoint=entrypoint_bin is None,
build_code_mode_host=code_mode_host_bin is None,
- build_exec_server=exec_server_bin is None,
build_bwrap=spec.is_linux and bwrap_bin is None,
build_codex_command_runner=spec.is_windows and codex_command_runner_bin is None,
build_codex_windows_sandbox_setup=spec.is_windows
@@ -67,11 +64,7 @@ def build_source_binaries(
cmd.extend(["--bin", binary])
cargo_env = None
- if (
- entrypoint_bin is None
- or code_mode_host_bin is None
- or exec_server_bin is None
- ):
+ if entrypoint_bin is None or code_mode_host_bin is None:
codex_v8_env = resolve_codex_v8_cargo_env(spec)
if codex_v8_env:
cargo_env = {**os.environ, **codex_v8_env}
@@ -95,11 +88,6 @@ def build_source_binaries(
if code_mode_host_bin is not None
else output_dir / f"codex-code-mode-host{spec.exe_suffix}"
),
- exec_server_bin=(
- exec_server_bin.resolve()
- if exec_server_bin is not None
- else output_dir / f"codex-exec-server{spec.exe_suffix}"
- ),
bwrap_bin=resolve_output_path(
bwrap_bin,
output_dir / "bwrap" if spec.is_linux else None,
@@ -123,7 +111,6 @@ def source_binaries_for_target(
*,
build_entrypoint: bool,
build_code_mode_host: bool,
- build_exec_server: bool,
build_bwrap: bool,
build_codex_command_runner: bool,
build_codex_windows_sandbox_setup: bool,
@@ -133,8 +120,6 @@ def source_binaries_for_target(
binaries.append(variant.cargo_bin)
if build_code_mode_host:
binaries.append("codex-code-mode-host")
- if build_exec_server:
- binaries.append("codex-exec-server")
if build_bwrap:
binaries.append("bwrap")
if build_codex_command_runner:
@@ -201,7 +186,6 @@ def validate_source_outputs(outputs: SourceBuildOutputs) -> None:
for path in [
outputs.entrypoint_bin,
outputs.code_mode_host_bin,
- outputs.exec_server_bin,
outputs.bwrap_bin,
outputs.codex_command_runner_bin,
outputs.codex_windows_sandbox_setup_bin,
diff --git a/scripts/codex_package/cli.py b/scripts/codex_package/cli.py
index 41e3caddc8..6a99ccb91e 100644
--- a/scripts/codex_package/cli.py
+++ b/scripts/codex_package/cli.py
@@ -140,11 +140,6 @@ def create_parser() -> argparse.ArgumentParser:
"the host is built with Cargo."
),
)
- parser.add_argument(
- "--exec-server-bin",
- type=Path,
- help="Optional prebuilt codex-exec-server executable. If omitted, build it with Cargo.",
- )
parser.add_argument(
"--bwrap-bin",
type=Path,
@@ -215,11 +210,6 @@ def assemble_package(args: argparse.Namespace) -> Path:
"prebuilt code-mode host executable",
"--code-mode-host-bin",
),
- exec_server_bin=resolve_optional_input_path(
- args.exec_server_bin,
- "prebuilt executor executable",
- "--exec-server-bin",
- ),
bwrap_bin=resolve_optional_input_path(
args.bwrap_bin,
"prebuilt Linux bwrap executable",
@@ -239,7 +229,6 @@ def assemble_package(args: argparse.Namespace) -> Path:
inputs = PackageInputs(
entrypoint_bin=source_outputs.entrypoint_bin,
code_mode_host_bin=source_outputs.code_mode_host_bin,
- exec_server_bin=source_outputs.exec_server_bin,
rg_bin=resolve_rg_bin(spec, args.rg_bin),
bwrap_bin=source_outputs.bwrap_bin,
codex_command_runner_bin=source_outputs.codex_command_runner_bin,
@@ -250,7 +239,6 @@ def assemble_package(args: argparse.Namespace) -> Path:
for filename, prebuilt in (
(variant.entrypoint_name(spec), args.entrypoint_bin),
(f"codex-code-mode-host{spec.exe_suffix}", args.code_mode_host_bin),
- (f"codex-exec-server{spec.exe_suffix}", args.exec_server_bin),
):
if args.strip == "all" or (
args.strip == "auto"
diff --git a/scripts/codex_package/layout.py b/scripts/codex_package/layout.py
index ccb54313f4..f93d8da64c 100644
--- a/scripts/codex_package/layout.py
+++ b/scripts/codex_package/layout.py
@@ -55,11 +55,6 @@ def build_package_dir(
bin_dir / f"codex-code-mode-host{spec.exe_suffix}",
is_windows=spec.is_windows,
)
- copy_executable(
- inputs.exec_server_bin,
- bin_dir / f"codex-exec-server{spec.exe_suffix}",
- is_windows=spec.is_windows,
- )
copy_executable(inputs.rg_bin, path_dir / spec.rg_name, is_windows=spec.is_windows)
if inputs.bwrap_bin is not None:
@@ -85,7 +80,6 @@ def build_package_dir(
"target": spec.target,
"variant": variant.name,
"entrypoint": f"bin/{entrypoint_name}",
- "execServer": f"bin/codex-exec-server{spec.exe_suffix}",
"resourcesDir": "codex-resources",
"pathDir": "codex-path",
}
@@ -119,7 +113,6 @@ def validate_package_dir(
"target": spec.target,
"variant": variant.name,
"entrypoint": f"bin/{variant.entrypoint_name(spec)}",
- "execServer": f"bin/codex-exec-server{spec.exe_suffix}",
"resourcesDir": "codex-resources",
"pathDir": "codex-path",
}
@@ -133,7 +126,6 @@ def validate_package_dir(
required_files = [
Path("bin") / variant.entrypoint_name(spec),
Path("bin") / f"codex-code-mode-host{spec.exe_suffix}",
- Path("bin") / f"codex-exec-server{spec.exe_suffix}",
Path("codex-path") / spec.rg_name,
]
executable_files = list(required_files)
diff --git a/scripts/codex_package/smoke_tests/fixtures.py b/scripts/codex_package/smoke_tests/fixtures.py
index 742b6c479f..52e8838c46 100644
--- a/scripts/codex_package/smoke_tests/fixtures.py
+++ b/scripts/codex_package/smoke_tests/fixtures.py
@@ -208,12 +208,7 @@ def code_mode_host_debug_symbols(
tmp_path_factory: pytest.TempPathFactory,
) -> Path:
target = pytestconfig.getoption("package_target")
- binaries = {
- "codex",
- "codex-app-server",
- "codex-code-mode-host",
- "codex-exec-server",
- }
+ binaries = {"codex", "codex-app-server", "codex-code-mode-host"}
if "windows" in target:
binaries.update({"codex-command-runner", "codex-windows-sandbox-setup"})
diff --git a/scripts/codex_package/smoke_tests/test_codex_package.py b/scripts/codex_package/smoke_tests/test_codex_package.py
index 0abd78cf5f..ee613a1290 100644
--- a/scripts/codex_package/smoke_tests/test_codex_package.py
+++ b/scripts/codex_package/smoke_tests/test_codex_package.py
@@ -4,8 +4,7 @@ ROOT_OF_EXTRACTED_PACKAGE
├── bin
│ ├── codex[.exe] # CLI package only
│ ├── codex-app-server[.exe] # app-server package only
-│ ├── codex-code-mode-host[.exe]
-│ └── codex-exec-server[.exe]
+│ └── codex-code-mode-host[.exe]
├── codex-package.json
├── codex-path
│ └── rg[.exe]
@@ -19,13 +18,11 @@ Each package contains one entrypoint, not both codex and codex-app-server.
"""
import json
-import os
import re
import shutil
import subprocess
import sys
import tomllib
-from concurrent.futures import ThreadPoolExecutor
from pathlib import Path
import pytest
@@ -70,261 +67,6 @@ def test_cli_version_matches_release_sources(package: SmokePackage) -> None:
assert package.run("--version").stdout == f"codex-cli {version}\n"
-@pytest.mark.parametrize("variant", ["cli_root", "app_server_root"])
-def test_packaged_executor_initializes_and_enforces_sandbox(
- package: SmokePackage, variant: str
-) -> None:
- """Each package re-enters its executor helpers and enforces filesystem/process policy."""
- root = getattr(package, variant)
- windows = "windows" in package.target
- suffix = ".exe" if windows else ""
- executor = root / "bin" / f"codex-exec-server{suffix}"
- directory = package.directory / f"{variant}-executor-sandbox"
- directory.mkdir()
- workspace = directory / "workspace"
- workspace.mkdir()
- home = directory / "home"
- home.mkdir()
- blocked = directory / "blocked.txt"
- blocked.write_text("unchanged")
- environment = {**package.environment, "CODEX_HOME": str(home)}
- if windows:
- # Elevated mode must discover the setup/runner in this package's resources.
- # Exclude build outputs and host Codex installations from helper fallback.
- environment["PATH"] = str(Path(os.environ["SystemRoot"]) / "System32")
- sandbox = {
- "permissions": {
- "type": "managed",
- "file_system": {
- "type": "restricted",
- "entries": [
- {
- "path": {"type": "special", "value": {"kind": "root"}},
- "access": "read",
- },
- {
- "path": {"type": "path", "path": workspace.as_uri()},
- "access": "write",
- },
- ],
- },
- "network": "restricted",
- },
- "cwd": workspace.as_uri(),
- "windowsSandboxLevel": "elevated" if windows else "disabled",
- }
- version = (
- subprocess.check_output(
- [str(executor), "--version"], env=package.environment, text=True, timeout=45
- )
- .strip()
- .split()[-1]
- )
- assert version == package.run("--version").stdout.strip().split()[-1]
- with (
- ThreadPoolExecutor(max_workers=1) as reader,
- subprocess.Popen(
- [str(executor), "--listen", "stdio"],
- cwd=package.directory,
- env=environment,
- stdin=subprocess.PIPE,
- stdout=subprocess.PIPE,
- text=True,
- ) as process,
- ):
- assert process.stdin is not None and process.stdout is not None
- try:
- process.stdin.write(
- json.dumps(
- {
- "id": 1,
- "method": "initialize",
- "params": {"clientName": "package-smoke"},
- }
- )
- + "\n"
- )
- process.stdin.flush()
- initialized = json.loads(
- reader.submit(process.stdout.readline).result(timeout=45)
- )
- assert initialized["id"] == 1
- assert initialized["result"]["sessionId"]
- reported_environment = initialized["result"]["environmentInfo"]
- metadata = json.loads((root / "codex-package.json").read_text())
- assert reported_environment["executorVersion"] == metadata["version"]
- process.stdin.write('{"method":"initialized","params":{}}\n')
-
- # Restricted writes always launch the filesystem helper, even when allowed.
- for request_id, path in [(2, workspace / "allowed.txt"), (3, blocked)]:
- process.stdin.write(
- json.dumps(
- {
- "id": request_id,
- "method": "fs/writeFile",
- "params": {
- "path": path.as_uri(),
- "dataBase64": "b2s=",
- "sandbox": sandbox,
- },
- }
- )
- + "\n"
- )
- process.stdin.flush()
- # The first Windows helper can provision sandbox accounts before replying.
- response = json.loads(
- reader.submit(process.stdout.readline).result(
- timeout=180 if windows and request_id == 2 else 45
- )
- )
- if request_id == 2:
- assert response == {"id": 2, "result": {}}, response
- assert path.read_text() == "ok"
- else:
- assert response["id"] == 3 and "error" in response, response
- assert blocked.read_text() == "unchanged"
-
- command = (
- [
- str(Path(os.environ["SystemRoot"]) / "System32" / "cmd.exe"),
- "/D",
- "/S",
- "/C",
- r"echo process>process.txt & echo forbidden>..\blocked.txt & exit /b 0",
- ]
- if windows
- else [
- "/bin/sh",
- "-c",
- "printf process >process.txt; printf forbidden >../blocked.txt; exit 0",
- ]
- )
- process.stdin.write(
- json.dumps(
- {
- "id": 4,
- "method": "process/start",
- "params": {
- "processId": "package-sandbox",
- "argv": command,
- "cwd": workspace.as_uri(),
- "env": {
- key: value
- for key, value in environment.items()
- if key.casefold() in {"path", "systemroot"}
- },
- "sandbox": sandbox,
- "tty": False,
- "pipeStdin": False,
- "arg0": None,
- },
- }
- )
- + "\n"
- )
- process.stdin.flush()
- started = False
- exit_code = None
- notifications = []
- while not started or exit_code is None:
- response = json.loads(
- reader.submit(process.stdout.readline).result(timeout=45)
- )
- notifications.append(response)
- if response.get("id") == 4:
- expected_type = (
- "windowsRestrictedToken"
- if windows
- else "macosSeatbelt"
- if "apple-darwin" in package.target
- else "linuxSeccomp"
- )
- assert response["result"]["sandboxType"] == expected_type, response
- started = True
- if response.get("method") == "process/exited":
- exit_code = response["params"]["exitCode"]
- assert exit_code == 0, notifications
- assert (workspace / "process.txt").is_file(), notifications
- assert (workspace / "process.txt").read_text().strip() == "process"
- assert blocked.read_text() == "unchanged"
- process.stdin.close()
- assert process.wait(timeout=45) == 0
- finally:
- if process.poll() is None:
- process.kill()
-
-
-def test_packaged_executor_matches_subcommand_startup(
- package: SmokePackage,
- tmp_path: Path,
-) -> None:
- """Both binaries reject the same invalid executor arguments and config."""
- home = tmp_path / "home"
- temporary = tmp_path / "tmp"
- home.mkdir()
- temporary.mkdir()
- (home / "config.toml").write_text("unknown_executor_option = true\n")
- # Release builds require the helper directory to live outside their temp root.
- environment = {
- **package.environment,
- "CODEX_HOME": str(home),
- "TMPDIR": str(temporary),
- "TEMP": str(temporary),
- "TMP": str(temporary),
- }
- suffix = ".exe" if "windows" in package.target else ""
- executor = package.cli_root / "bin" / f"codex-exec-server{suffix}"
- for arguments in [
- ["--strict-config", "--listen", "stdio"],
- ["-c", "unknown_executor_option=true", "--strict-config", "--listen", "stdio"],
- ["--listen", "http://127.0.0.1:0"],
- ["--concurrent-requests", "0"],
- [
- "--aws-sigv4",
- "--remote",
- "https://example.openai.com",
- "--environment-id",
- "env-1",
- ],
- ["--remote-transport", "direct"],
- ["forward", "--connect", "ws://127.0.0.1:0"],
- [
- "-c",
- "unknown_executor_option=true",
- "forward",
- "-c",
- "analytics.enabled=false",
- "--strict-config",
- "--connect",
- "ws://127.0.0.1:0",
- "--remote",
- "https://example.openai.com",
- "--environment-id",
- "env-1",
- ],
- ]:
- outputs = []
- for command in ([str(package.cli), "exec-server"], [str(executor)]):
- result = subprocess.run(
- [*command, *arguments],
- cwd=tmp_path,
- env=environment,
- capture_output=True,
- text=True,
- timeout=45,
- )
- assert result.returncode != 0, arguments
- outputs.append(
- (
- result.returncode,
- result.stdout,
- result.stderr.replace("codex exec-server", "codex-exec-server"),
- )
- )
- assert outputs[0] == outputs[1], arguments
-
-
@pytest.mark.parametrize("entrypoint", ["codex", "codex-app-server"])
def test_app_server_runs_code_mode_through_python_sdk(
package: SmokePackage,
diff --git a/scripts/codex_package/targets.py b/scripts/codex_package/targets.py
index 028f0724fc..eedf7b03b1 100644
--- a/scripts/codex_package/targets.py
+++ b/scripts/codex_package/targets.py
@@ -45,7 +45,6 @@ class PackageVariant:
class PackageInputs:
entrypoint_bin: Path
code_mode_host_bin: Path
- exec_server_bin: Path
rg_bin: Path
bwrap_bin: Path | None
codex_command_runner_bin: Path | None
diff --git a/scripts/codex_package/test_cargo.py b/scripts/codex_package/test_cargo.py
index 2e52a9256d..1a4a572b9b 100644
--- a/scripts/codex_package/test_cargo.py
+++ b/scripts/codex_package/test_cargo.py
@@ -21,7 +21,6 @@ class SourceBinariesForTargetTest(unittest.TestCase):
PACKAGE_VARIANTS["codex"],
build_entrypoint=False,
build_code_mode_host=False,
- build_exec_server=False,
build_bwrap=False,
build_codex_command_runner=False,
build_codex_windows_sandbox_setup=False,
@@ -38,7 +37,6 @@ class SourceBinariesForTargetTest(unittest.TestCase):
PACKAGE_VARIANTS["codex"],
build_entrypoint=False,
build_code_mode_host=False,
- build_exec_server=False,
build_bwrap=False,
build_codex_command_runner=False,
build_codex_windows_sandbox_setup=False,
@@ -55,7 +53,6 @@ class SourceBinariesForTargetTest(unittest.TestCase):
PACKAGE_VARIANTS["codex"],
build_entrypoint=False,
build_code_mode_host=False,
- build_exec_server=False,
build_bwrap=False,
build_codex_command_runner=False,
build_codex_windows_sandbox_setup=False,
@@ -70,7 +67,6 @@ class SourceBinariesForTargetTest(unittest.TestCase):
PACKAGE_VARIANTS["codex"],
build_entrypoint=False,
build_code_mode_host=False,
- build_exec_server=False,
build_bwrap=False,
build_codex_command_runner=True,
build_codex_windows_sandbox_setup=True,
@@ -85,12 +81,11 @@ class SourceBinariesForTargetTest(unittest.TestCase):
PACKAGE_VARIANTS["codex-app-server"],
build_entrypoint=False,
build_code_mode_host=True,
- build_exec_server=True,
build_bwrap=False,
build_codex_command_runner=False,
build_codex_windows_sandbox_setup=False,
),
- ["codex-code-mode-host", "codex-exec-server"],
+ ["codex-code-mode-host"],
)
def test_build_uses_prebuilt_windows_helpers_without_running_cargo(self) -> None:
@@ -108,7 +103,6 @@ class SourceBinariesForTargetTest(unittest.TestCase):
profile="release",
entrypoint_bin=entrypoint,
code_mode_host_bin=code_mode_host,
- exec_server_bin=code_mode_host,
bwrap_bin=None,
codex_command_runner_bin=command_runner,
codex_windows_sandbox_setup_bin=sandbox_setup,
diff --git a/scripts/codex_package/test_layout.py b/scripts/codex_package/test_layout.py
index dfa197227a..2682b8325d 100644
--- a/scripts/codex_package/test_layout.py
+++ b/scripts/codex_package/test_layout.py
@@ -2,8 +2,6 @@
from pathlib import Path
import hashlib
-import io
-import tarfile
import json
import shutil
import subprocess
@@ -14,7 +12,6 @@ import unittest
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
from build_winget_package import prepare_winget_package
-from codex_package.archive import write_archive, resolve_zstd_command
from codex_package.layout import build_package_dir
from codex_package.layout import validate_package_dir
from codex_package.targets import PACKAGE_VARIANTS
@@ -66,7 +63,6 @@ int main(void) {
flags = [
"--entrypoint-bin",
"--code-mode-host-bin",
- "--exec-server-bin",
"--rg-bin",
]
if "linux" in target:
@@ -77,7 +73,7 @@ int main(void) {
# Preserved prebuilt inputs must not even need a strip tool.
command.extend(("--strip-tool", str(root / "absent-strip")))
subprocess.run(command, check=True, capture_output=True)
- for name in ("codex", "codex-code-mode-host", "codex-exec-server"):
+ for name in ("codex", "codex-code-mode-host"):
executable = package / "bin" / name
self.assertEqual(
subprocess.check_output([str(executable)]),
@@ -101,7 +97,6 @@ int main(void) {
files = {
"bin/codex.exe": b"signed CLI",
"bin/codex-code-mode-host.exe": b"signed code mode host",
- "bin/codex-exec-server.exe": b"signed executor",
"codex-resources/codex-command-runner.exe": b"signed runner",
"codex-resources/codex-windows-sandbox-setup.exe": b"signed setup",
"codex-resources/voice/bin/codex-voice-host.exe": b"signed voice host",
@@ -177,7 +172,6 @@ int main(void) {
code_mode_host_bin=touch_executable(
root / "codex-code-mode-host"
),
- exec_server_bin=rg_bin,
rg_bin=rg_bin,
bwrap_bin=None,
codex_command_runner_bin=None,
@@ -186,41 +180,13 @@ int main(void) {
build_package_dir(package_dir, "1.2.3", variant, spec, inputs)
validate_package_dir(package_dir, variant, spec)
- for suffix in (".tar.gz", ".tar.zst"):
- archive_path = root / f"package{suffix}"
- write_archive(package_dir, archive_path, force=False)
- data = (
- subprocess.check_output(
- [
- *resolve_zstd_command(),
- "-d",
- "--stdout",
- str(archive_path),
- ]
- )
- if suffix == ".tar.zst"
- else archive_path.read_bytes()
- )
- with tarfile.open(
- fileobj=io.BytesIO(data), mode="r:*"
- ) as archive:
- member = archive.getmember("bin/codex-exec-server")
- self.assertTrue(member.mode & 0o111)
- self.assertEqual(
- archive.extractfile(member).read(),
- rg_bin.read_bytes(),
- )
self.assertEqual(
{
"rg": (package_dir / "codex-path" / "rg").read_bytes(),
- "executor": (
- package_dir / "bin/codex-exec-server"
- ).read_bytes(),
},
{
"rg": b"signed ripgrep binary",
- "executor": b"signed ripgrep binary",
},
)
@@ -232,7 +198,6 @@ int main(void) {
inputs = PackageInputs(
entrypoint_bin=touch_executable(root / "codex-app-server"),
code_mode_host_bin=touch_executable(root / "codex-code-mode-host"),
- exec_server_bin=touch_executable(root / "codex-exec-server"),
rg_bin=touch_executable(root / "rg"),
bwrap_bin=touch_executable(root / "bwrap"),
codex_command_runner_bin=None,
diff --git a/scripts/install/install.ps1 b/scripts/install/install.ps1
index 6ae0840bf5..e9d0bc8057 100644
--- a/scripts/install/install.ps1
+++ b/scripts/install/install.ps1
@@ -772,16 +772,6 @@ function Test-PackageContentsAreComplete {
"codex-resources\codex-command-runner.exe",
"codex-resources\codex-windows-sandbox-setup.exe"
)
- try {
- $metadataPath = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath((Join-Path $PackageDir "codex-package.json"))
- $metadata = [System.IO.File]::ReadAllText($metadataPath)
- # Older canonical packages do not advertise or contain the executor.
- if ([regex]::IsMatch($metadata, '"execServer"\s*:')) {
- $expectedFiles += "bin\codex-exec-server.exe"
- }
- } catch {
- return $false
- }
foreach ($name in $expectedFiles) {
if (-not (Test-Path -LiteralPath (Join-Path $PackageDir $name) -PathType Leaf)) {
return $false
diff --git a/scripts/install/install.sh b/scripts/install/install.sh
index b79970f9c1..fff99229a5 100755
--- a/scripts/install/install.sh
+++ b/scripts/install/install.sh
@@ -1125,9 +1125,6 @@ install_package_release() {
if [ -f "$stage_release/codex-resources/bwrap" ]; then
chmod 0755 "$stage_release/codex-resources/bwrap"
fi
- if [ -f "$stage_release/bin/codex-exec-server" ]; then
- chmod 0755 "$stage_release/bin/codex-exec-server"
- fi
ln -sf "bin/codex" "$stage_release/codex"
if [ -e "$release_dir" ] || [ -L "$release_dir" ]; then
@@ -1181,10 +1178,6 @@ release_dir_is_complete() {
[ -x "$release_dir/codex" ] &&
[ -x "$release_dir/codex-path/rg" ] ||
return 1
- # Older canonical packages do not advertise or contain the executor.
- if grep -Eq '"execServer"[[:space:]]*:' "$release_dir/codex-package.json"; then
- [ -x "$release_dir/bin/codex-exec-server" ] || return 1
- fi
;;
legacy-platform-npm)
[ -x "$release_dir/codex" ] &&
diff --git a/scripts/install/test_install_sh.py b/scripts/install/test_install_sh.py
index bac85ed277..7cd18deb44 100644
--- a/scripts/install/test_install_sh.py
+++ b/scripts/install/test_install_sh.py
@@ -995,7 +995,6 @@ def run_installer_in(
root: Path,
release: str,
*,
- installer_path: Path = INSTALL_SCRIPT,
metadata_failure: bool = False,
metadata_json: str | None = None,
releases_metadata_json: str | None = None,
@@ -1187,7 +1186,7 @@ def run_installer_in(
"TRUE" if use_mirror else "false"
)
result = subprocess.run(
- ["/bin/sh", str(installer_path)],
+ ["/bin/sh", str(INSTALL_SCRIPT)],
capture_output=True,
check=False,
env=env,
@@ -1214,17 +1213,14 @@ def create_package_release(
metadata_version: str = VERSION,
binary_version: str = VERSION,
target: str = "aarch64-apple-darwin",
- include_exec_server: bool = False,
) -> tuple[Path, Path, str]:
package_dir = root / "package"
(package_dir / "bin").mkdir(parents=True)
(package_dir / "codex-path").mkdir()
- metadata = {"version": binary_version, "target": target, "entrypoint": "bin/codex"}
- if include_exec_server:
- metadata["execServer"] = "bin/codex-exec-server"
- write_executable(package_dir / "bin/codex-exec-server", "#!/bin/sh\nexit 0\n")
(package_dir / "codex-package.json").write_text(
- json.dumps(metadata),
+ json.dumps(
+ {"version": binary_version, "target": target, "entrypoint": "bin/codex"}
+ ),
encoding="utf-8",
)
write_executable(