mirror of
https://github.com/openai/codex.git
synced 2026-05-25 13:34:51 +00:00
51bfb5f3b1
## Why PR #21843 removed the TCP websocket app-server listener, but that also removed functionality that still needs to exist. Restoring it as-is would reopen the old remote exposure problem, so this keeps the restored listener while making remote and non-loopback usage require explicit auth. ## What Changed - Mostly reverts #21843 and reapplies the small merge-conflict resolutions needed on top of current main. - Restores ws://IP:PORT parsing, the app-server TCP websocket acceptor, websocket auth CLI flags, and the associated tests. - The only intentional behavior change from the restored code is that non-loopback websocket listeners now fail startup unless --ws-auth capability-token or --ws-auth signed-bearer-token is configured. Loopback listeners remain available for local and SSH-forwarding workflows. ## Reviewer Focus Please focus review on the small auth-enforcement delta layered on top of the revert: - codex-rs/app-server-transport/src/transport/websocket.rs: start_websocket_acceptor now rejects unauthenticated non-loopback websocket binds before accepting connections. - codex-rs/app-server-transport/src/transport/auth.rs: helper logic classifies unauthenticated non-loopback listeners. - codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs: tests cover unauthenticated ws://0.0.0.0 startup rejection and authenticated non-loopback capability-token startup. Everything else is intended to be revert/merge-conflict restoration rather than new product behavior. ## Verification - Manually verified that TUI remoting is restored and that auth is enforced for non-localhost urls.
60 lines
1.6 KiB
TOML
60 lines
1.6 KiB
TOML
[package]
|
|
name = "codex-app-server-transport"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_app_server_transport"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
"ws",
|
|
] }
|
|
base64 = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
codex-api = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-core = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-model-provider = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-uds = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-rustls-provider = { workspace = true }
|
|
constant_time_eq = { workspace = true }
|
|
futures = { workspace = true }
|
|
gethostname = { workspace = true }
|
|
hmac = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
owo-colors = { workspace = true, features = ["supports-colors"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
time = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"rt-multi-thread",
|
|
] }
|
|
tokio-tungstenite = { workspace = true }
|
|
tokio-util = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
url = { workspace = true }
|
|
uuid = { workspace = true, features = ["serde", "v7"] }
|
|
|
|
[dev-dependencies]
|
|
chrono = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|