Dmitriy Kovalenko
b91f2515f5
## What changed - Include `codex-exec-server` in canonical CLI and app-server packages and advertise its path through `execServer` in `codex-package.json`. - Build and sign the executor in release workflows, preserve signed prebuilt inputs, and verify packaged signatures. Use empty entitlements for the macOS executor. - Have installers check for the executor when package metadata advertises it, while continuing to accept older packages. - Omit the standalone executor and its manifest entry from npm packages to stay within npm's package size limit. Keep `codex exec-server` and its runtime helpers available. ## Testing Add package smoke tests for executor initialization, version reporting, filesystem and process sandbox enforcement, and invalid-argument/configuration parity with `codex exec-server`. Extend archive, npm staging, and macOS signing tests to cover executor contents, executable permissions, preserved bytes, and entitlement verification. GitOrigin-RevId: bc741fe7faa6fe631d076de18d448c55247c23c7
npm releases
Use the staging helper in the repo root to generate npm tarballs for a release. For
example, to stage the CLI, responses proxy, and SDK packages for version 0.6.0:
./scripts/stage_npm_packages.py \
--release-version 0.6.0 \
--package codex \
--package codex-responses-api-proxy \
--package codex-sdk
This downloads the required native package archive artifacts, hydrates vendor/ for
each package, and writes tarballs to dist/npm/.
When --package codex is provided, the staging helper builds the lightweight
@openai/codex meta package plus all platform-native @openai/codex variants
that are later published under platform-specific dist-tags.
The npm variants omit the standalone codex-exec-server executable and its
execServer manifest entry to keep uploads within npm's package size limit.
They retain codex exec-server through the CLI, the code-mode host, and the
platform sandbox helpers. Canonical release archives retain the standalone
executor; npm staging changes only the package copy.
Direct build_npm_package.py invocations are still useful for package-specific
debugging, but native packages expect --vendor-src to point at a prehydrated
vendor/ tree. Release packaging should use scripts/stage_npm_packages.py