mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
Dmitriy Kovalenko
b91f2515f5
## What changed - Include `codex-exec-server` in canonical CLI and app-server packages and advertise its path through `execServer` in `codex-package.json`. - Build and sign the executor in release workflows, preserve signed prebuilt inputs, and verify packaged signatures. Use empty entitlements for the macOS executor. - Have installers check for the executor when package metadata advertises it, while continuing to accept older packages. - Omit the standalone executor and its manifest entry from npm packages to stay within npm's package size limit. Keep `codex exec-server` and its runtime helpers available. ## Testing Add package smoke tests for executor initialization, version reporting, filesystem and process sandbox enforcement, and invalid-argument/configuration parity with `codex exec-server`. Extend archive, npm staging, and macOS signing tests to cover executor contents, executable permissions, preserved bytes, and entitlement verification. GitOrigin-RevId: bc741fe7faa6fe631d076de18d448c55247c23c7
30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
# npm releases
|
|
|
|
Use the staging helper in the repo root to generate npm tarballs for a release. For
|
|
example, to stage the CLI, responses proxy, and SDK packages for version `0.6.0`:
|
|
|
|
```bash
|
|
./scripts/stage_npm_packages.py \
|
|
--release-version 0.6.0 \
|
|
--package codex \
|
|
--package codex-responses-api-proxy \
|
|
--package codex-sdk
|
|
```
|
|
|
|
This downloads the required native package archive artifacts, hydrates `vendor/` for
|
|
each package, and writes tarballs to `dist/npm/`.
|
|
|
|
When `--package codex` is provided, the staging helper builds the lightweight
|
|
`@openai/codex` meta package plus all platform-native `@openai/codex` variants
|
|
that are later published under platform-specific dist-tags.
|
|
|
|
The npm variants omit the standalone `codex-exec-server` executable and its
|
|
`execServer` manifest entry to keep uploads within npm's package size limit.
|
|
They retain `codex exec-server` through the CLI, the code-mode host, and the
|
|
platform sandbox helpers. Canonical release archives retain the standalone
|
|
executor; npm staging changes only the package copy.
|
|
|
|
Direct `build_npm_package.py` invocations are still useful for package-specific
|
|
debugging, but native packages expect `--vendor-src` to point at a prehydrated
|
|
`vendor/` tree. Release packaging should use `scripts/stage_npm_packages.py`
|