mirror of
https://github.com/openai/codex.git
synced 2026-10-20 17:38:45 +00:00
Benjamin Carlsson
b707714ae4
## What changed Add `codex-cloud-client`, a reusable Rust client for `ThreadService.Resume` and live `ThreadService.Attach` over HTTP/2. Callers supply the native gRPC origin, bearer token, account ID, and `HttpClientFactory`. - Reuse shared proxy, custom CA, and network policy handling for HTTPS. Reject redirects and allow plaintext HTTP only on direct loopback with unrestricted, unmanaged policy. - Preserve notification and server-request protobuf payloads as opaque bytes and expose native gRPC status details while redacting credentials, payloads, and error details from diagnostics. - Bound resume and attach setup to 150 seconds without retrying requests or imposing an idle deadline on live streams. Attach ends on its first error and provides no history or automatic reconnect. - Select Rustls in `HttpClientBuilder::http2_prior_knowledge()` so HTTPS advertises `h2` through ALPN. Include a standalone attach example and documentation of admission semantics and stream behavior. ## Testing Add HTTP/2 fixture tests for protobuf framing, authentication metadata, status trailers, event preservation, malformed responses, stream cancellation, redirect rejection, and diagnostic redaction. Add checks for unsafe origins, network policy restrictions, and TLS `h2` advertisement. GitOrigin-RevId: 55db70438bb5e59272c6995c67a46ced5fa28ff4
41 lines
2.4 KiB
Markdown
41 lines
2.4 KiB
Markdown
# Codex cloud client
|
|
|
|
Reusable Rust client for native ThreadService gRPC over HTTP/2, with no TUI,
|
|
conventional app-server or private monorepo dependency. This slice supports
|
|
`Resume` and live `Attach`. It does not use the HTTP `/grpc` JSON gateway.
|
|
|
|
The caller supplies a trusted native gRPC origin (scheme/host/port, no path),
|
|
ChatGPT bearer token, selected account ID and configured `HttpClientFactory`.
|
|
HTTPS is required except for direct loopback HTTP with an unrestricted, unmanaged
|
|
factory. This exception bypasses proxies to keep plaintext credentials local.
|
|
For HTTPS, the shared HTTP client supplies proxy,
|
|
custom CA and network policy handling; redirects are rejected. Tonic supplies
|
|
gRPC framing, protobuf encoding, message bounds (64 MiB) and status/trailer handling.
|
|
Bind factory policy before loading credentials; rebuild on login/account changes.
|
|
|
|
`ResumeRequest.wait = false` acknowledges admission, not readiness. Requests are
|
|
never retried by this crate: a timeout or disconnect can leave work admitted.
|
|
`Attach` has no history snapshot or replay guarantee. Dropping it detaches without
|
|
stopping the thread or answering approvals. Streams end after their first error.
|
|
Resume and Attach setup have a 150-second local deadline; live streams have no idle
|
|
deadline. Setup does not send a gRPC deadline that would expire a healthy stream.
|
|
|
|
Event variants distinguish notifications and server requests; payloads remain the
|
|
complete nested protobuf message bytes, preserving unknown fields. These are not
|
|
ProtoJSON or app-server JSON-RPC. Native status code, message and binary details
|
|
are available explicitly; credentials, event and error diagnostics are redacted.
|
|
Full payload typing, history, approval replies and reconnect are subsequent slices.
|
|
The minimal envelopes in `wire.rs` and `ResumeRequest` mirror ThreadService field
|
|
numbers; no monorepo checkout or protobuf compiler is required to build this crate.
|
|
|
|
Provide `CODEX_CLOUD_ACCESS_TOKEN` and `CODEX_CLOUD_ACCOUNT_ID` through your environment, then run
|
|
this standalone consumer from `codex-rs`:
|
|
|
|
```sh
|
|
cargo run -p codex-cloud-client --example attach -- "$CODEX_CLOUD_GRPC_ENDPOINT" "$CODEX_CLOUD_THREAD_ID"
|
|
```
|
|
|
|
Use an existing authorized thread and native gRPC origin. No production URL is
|
|
assumed. Public native ingress is a rollout assumption, not proved by fixture
|
|
tests. This change does not publish a package to a registry.
|