mirror of
https://github.com/openai/codex.git
synced 2026-10-31 19:28:49 +00:00
tgrue-openai
582a8812e0
## Why ChatGPT credentials can rotate while a remote executor is idle. Registry requests need to follow stored rotations without continuing after logout or switching the executor's identity. Concurrent refreshes must also avoid overwriting newer credentials. ## What changed - Reload and validate ChatGPT credentials before registry requests, pinning the credential mode, account, user, and workspace policy. Reuse cached metadata for unchanged personal access tokens. - Retry registration when temporary credential resolution failures prevent a request from being sent. Bound credential resolution and block reuse of a token generation whose refresh outcome is unknown. - Restrict supported authentication modes before executor startup loads credentials or cloud configuration. - Serialize persistent credential writes across cooperating processes and compare stored credentials before committing refreshed tokens. - Replace `auth.json` atomically so overlapping readers see a complete document, preserving symlink targets and protecting file permissions, including Windows access controls. ## Testing Add coverage for credential rotation, logout, identity changes, cancelled refresh callers, temporary metadata failures, registration retries, concurrent credential writes, and atomic file replacement. GitOrigin-RevId: 6b210944bf8eba2f45bc27113f901d2c3cb06b48
61 lines
1.9 KiB
TOML
61 lines
1.9 KiB
TOML
[package]
|
|
name = "codex-exec-server-cli"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "codex-exec-server"
|
|
path = "src/main.rs"
|
|
|
|
[lib]
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true, features = ["derive", "env"] }
|
|
codex-api = { workspace = true }
|
|
codex-app-server = { workspace = true }
|
|
codex-arg0 = { workspace = true }
|
|
codex-aws-auth = { workspace = true }
|
|
codex-build-info = { workspace = true }
|
|
codex-cloud-config = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-core = { workspace = true }
|
|
codex-exec-server = { workspace = true }
|
|
codex-http-client = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-model-provider = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-sandboxing = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-cli = { workspace = true }
|
|
codex-websocket-auth = { workspace = true }
|
|
http = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread", "signal", "sync", "time"] }
|
|
toml = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true, features = ["env-filter"] }
|
|
url = { workspace = true }
|
|
|
|
[target.'cfg(all(target_os = "linux", target_env = "musl", any(target_arch = "x86_64", target_arch = "aarch64")))'.dependencies]
|
|
tikv-jemallocator = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
assert_matches = { workspace = true }
|
|
chrono = { workspace = true }
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
codex-utils-process = { workspace = true }
|
|
futures = { workspace = true }
|
|
insta = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["io-util", "process"] }
|
|
wiremock = { workspace = true }
|