mirror of
https://github.com/openai/codex.git
synced 2026-09-04 15:08:45 +00:00
ef500f4d23
Split the code-mode protocol and client from the V8-backed runtime so core and
app-server no longer link codex-code-mode in production. ThreadManager now
provisions durable code-mode sessions through a shared external host process,
while tests can still inject the in-process provider.
The IPC protocol uses a persistent stdin/stdout transport. Each frame is a
4-byte big-endian length followed by JSON, with a 16 MiB frame limit. Client
requests carry u64 request IDs so create, execute, wait, terminate, and shutdown
operations can be multiplexed over one process. Session IDs isolate durable
stored values. Execute returns an ExecutionStarted response immediately and an
asynchronous InitialResponse when the initial yield or completion is available.
Nested tool calls and notifications travel from the host back to the client as
delegate requests with their own IDs. Delegate responses, cancellation, and
cell-closed lifecycle messages use the same framed channel. Wire operations
encode errors as Result values. A dead connection fails pending operations,
cancels outstanding delegates, and lets the provider spawn a new host for later
sessions.
Build codex-code-mode-host with V8 pointer-compression sandbox support and add
it to canonical primary and app-server packages, legacy Linux and Windows
bundles, signing verification, installers, Python runtime packages, and release
CI for macOS, Linux, and Windows. The host is discovered next to the current
executable, through CODEX_CODE_MODE_HOST_PATH, or on PATH. OS-level seccomp or
seatbelt restrictions remain a follow-up to this cross-platform process split.
Benchmarks were run from release builds on Linux x86_64 with the V8 sandbox
profile and a text('ok') workload. Cold measurements used 30 samples, warm
session provisioning used 200, and warm command execution used 500. Values are
mean/p50/p95 in milliseconds:
- session startup: in-process 0.002/0.002/0.005, IPC 2.623/2.599/2.894
- fresh-session command: in-process 1.831/1.758/1.915, IPC 7.428/7.252/8.306
- warm session provisioning: in-process 0.002/0.002/0.003,
IPC 0.471/0.463/0.581
- warm command: in-process 1.759/1.757/1.940, IPC 2.005/2.001/2.166
The steady-state median command overhead is approximately 0.244 ms. The median
fresh host plus first command cost is 7.252 ms.
Validation:
- 62/62 core code-mode integration tests passed against the external host
- focused protocol, client, runtime, host, tools, and trace tests passed
- Cargo and Bazel real-process host IPC tests passed
- 11/11 package builder tests passed
- Bazel lock verification, scoped Clippy fixes, and repository formatting passed
79 lines
3.8 KiB
Markdown
79 lines
3.8 KiB
Markdown
# Codex package builder
|
|
|
|
This package contains the implementation behind `scripts/build_codex_package.py`.
|
|
The top-level script is the stable executable entry point; these modules keep the
|
|
package-building logic split by responsibility.
|
|
|
|
The builder creates a canonical Codex package directory:
|
|
|
|
```text
|
|
.
|
|
├── codex-package.json
|
|
├── bin
|
|
│ ├── <entrypoint>[.exe]
|
|
│ └── codex-code-mode-host[.exe]
|
|
├── codex-resources
|
|
│ ├── bwrap # Linux only
|
|
│ ├── zsh/bin/zsh # supported Unix targets only
|
|
│ ├── codex-command-runner.exe # Windows only
|
|
│ └── codex-windows-sandbox-setup.exe # Windows only
|
|
└── codex-path
|
|
└── rg[.exe]
|
|
```
|
|
|
|
The package directory is the primary artifact. Archive formats such as
|
|
`.tar.gz`, `.tar.zst`, and `.zip` are serializations of that directory.
|
|
|
|
If `--target` is omitted, the builder uses the release target for the current
|
|
host platform. On Linux, that default is a musl target to match Codex release
|
|
artifacts; pass a GNU Linux target explicitly for native glibc local builds. If
|
|
`--package-dir` is omitted, the builder creates a new temporary directory and
|
|
prints its path after the package is built.
|
|
|
|
The `--variant` flag selects the package entrypoint. Supported variants are
|
|
`codex` and `codex-app-server`. The `version` field in `codex-package.json` is
|
|
read from `[workspace.package].version` in `codex-rs/Cargo.toml`.
|
|
|
|
## Source-built artifacts
|
|
|
|
Artifacts built from this repository are built by the package builder in one
|
|
grouped `cargo build` command per package when they are needed and no prebuilt
|
|
override was provided:
|
|
|
|
- all targets: the selected entrypoint, unless `--entrypoint-bin` is provided
|
|
- all targets: `codex-code-mode-host`, unless `--code-mode-host-bin` is provided
|
|
- Linux targets: `bwrap`, unless `--bwrap-bin` is provided
|
|
- Windows targets: `codex-command-runner` and `codex-windows-sandbox-setup`,
|
|
unless the corresponding prebuilt helper flags are provided
|
|
|
|
The default cargo profile is `dev-small` because local iteration should favor
|
|
fast, small builds. Release jobs should pass `--cargo-profile release` and an
|
|
explicit target. Release jobs that already built and signed/notarized the
|
|
entrypoint should pass `--entrypoint-bin` so the package contains that exact
|
|
binary instead of rebuilding it.
|
|
|
|
Release jobs that already built package resource binaries should also pass the
|
|
corresponding resource flags: `--bwrap-bin` for Linux packages, and
|
|
`--codex-command-runner-bin` plus `--codex-windows-sandbox-setup-bin` for
|
|
Windows packages. This keeps package archive creation as a pure staging step
|
|
after signing instead of rebuilding resources.
|
|
|
|
When the builder source-builds an entrypoint for a Darwin or Linux target, it
|
|
downloads and verifies the matching Codex-built V8 release pair before invoking
|
|
Cargo and sets `RUSTY_V8_ARCHIVE` plus `RUSTY_V8_SRC_BINDING_PATH` for that
|
|
build. Windows targets keep Cargo's release-build MSVC artifact path. Explicit
|
|
overrides remain authoritative when both variables are already set. Set
|
|
`V8_FROM_SOURCE=1` to leave the build with the `v8` crate source-build path.
|
|
|
|
`rg` is not built from this repository, so the builder fetches it from the
|
|
DotSlash manifest at `scripts/codex_package/rg`. Downloaded archives are cached
|
|
under `$TMPDIR/codex-package/<target>-rg` and are reused only after the recorded
|
|
size and SHA-256 digest have been verified. Pass `--rg-bin` to use a local
|
|
ripgrep executable instead.
|
|
|
|
The patched zsh fork used by `shell_zsh_fork` is fetched from the DotSlash
|
|
manifest at `scripts/codex_package/codex-zsh` when the selected target has a
|
|
matching prebuilt artifact. Downloaded archives are cached under
|
|
`$TMPDIR/codex-package/<target>-zsh` and installed at
|
|
`codex-resources/zsh/bin/zsh`.
|