mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
79b7606803
## Why App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output. ## What changed - Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`. - Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens. - Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories. ## Testing - Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs. GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc
57 lines
1.6 KiB
TOML
57 lines
1.6 KiB
TOML
[package]
|
|
name = "codex-app-server-protocol"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_app_server_protocol"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
codex-experimental-api-macros = { workspace = true }
|
|
codex-app-server-protocol-noop-macros = { workspace = true }
|
|
codex-extension-items = { workspace = true }
|
|
codex-history = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-rollout = { workspace = true }
|
|
codex-secrets = { workspace = true }
|
|
codex-shell-command = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
codex-utils-redacted-string = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
serde_with = { workspace = true }
|
|
strum_macros = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"base64",
|
|
"macros",
|
|
"server",
|
|
] }
|
|
inventory = { workspace = true }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true, features = ["serde", "v7"] }
|
|
zstd = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"base64",
|
|
"macros",
|
|
"schemars",
|
|
"server",
|
|
] }
|
|
schemars = { workspace = true }
|
|
similar = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
ts-rs = { workspace = true }
|