mirror of
https://github.com/openai/codex.git
synced 2026-05-15 16:53:05 +00:00
0d418f478d
## Why The external startup/login surface for this auth path should talk about an access token instead of exposing the internal Agent Identity terminology. Users should pass `CODEX_ACCESS_TOKEN` or pipe a token into `codex login --with-access-token`; the old external env/flag spellings are removed so there is only one supported user-facing path. ## What Changed - Added `CODEX_ACCESS_TOKEN` as the supported environment variable for this auth path. - Added `codex login --with-access-token` as the supported stdin-based login command. - Removed the legacy `CODEX_AGENT_IDENTITY` env-var fallback and hidden `--with-agent-identity` CLI alias. - Updated CLI error, status, and stdin prompts to use access-token language. - Added coverage for access-token env loading, CLI login failure behavior, and renamed login status text. ## Validation - `cargo test -p codex-login` - `cargo test -p codex-cli` - `just fix -p codex-login` - `just fix -p codex-cli`
130 lines
4.2 KiB
Rust
130 lines
4.2 KiB
Rust
pub(crate) mod debug_sandbox;
|
|
mod exit_status;
|
|
pub(crate) mod login;
|
|
|
|
use clap::Parser;
|
|
use codex_utils_absolute_path::AbsolutePathBuf;
|
|
use codex_utils_cli::CliConfigOverrides;
|
|
use std::path::PathBuf;
|
|
|
|
pub use debug_sandbox::run_command_under_landlock;
|
|
pub use debug_sandbox::run_command_under_seatbelt;
|
|
pub use debug_sandbox::run_command_under_windows;
|
|
pub use login::read_access_token_from_stdin;
|
|
pub use login::read_api_key_from_stdin;
|
|
pub use login::run_login_status;
|
|
pub use login::run_login_with_access_token;
|
|
pub use login::run_login_with_api_key;
|
|
pub use login::run_login_with_chatgpt;
|
|
pub use login::run_login_with_device_code;
|
|
pub use login::run_login_with_device_code_fallback_to_browser;
|
|
pub use login::run_logout;
|
|
|
|
// TODO: Deduplicate these shared sandbox options if we remove the explicit
|
|
// `codex sandbox <os>` platform subcommands.
|
|
#[derive(Debug, Parser)]
|
|
pub struct SeatbeltCommand {
|
|
/// Named permissions profile to apply from the active configuration stack.
|
|
#[arg(long = "permissions-profile", value_name = "NAME")]
|
|
pub permissions_profile: Option<String>,
|
|
|
|
/// Working directory used for profile resolution and command execution.
|
|
#[arg(
|
|
short = 'C',
|
|
long = "cd",
|
|
value_name = "DIR",
|
|
requires = "permissions_profile"
|
|
)]
|
|
pub cwd: Option<PathBuf>,
|
|
|
|
/// Include managed requirements while resolving an explicit permissions profile.
|
|
#[arg(
|
|
long = "include-managed-config",
|
|
default_value_t = false,
|
|
requires = "permissions_profile"
|
|
)]
|
|
pub include_managed_config: bool,
|
|
|
|
/// Allow the sandboxed command to bind/connect AF_UNIX sockets rooted at this path. Relative paths are resolved against the current directory. Repeat to allow multiple paths.
|
|
#[arg(long = "allow-unix-socket", value_parser = parse_allow_unix_socket_path)]
|
|
pub allow_unix_sockets: Vec<AbsolutePathBuf>,
|
|
|
|
/// While the command runs, capture macOS sandbox denials via `log stream` and print them after exit
|
|
#[arg(long = "log-denials", default_value_t = false)]
|
|
pub log_denials: bool,
|
|
|
|
#[clap(skip)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
|
|
/// Full command args to run under seatbelt.
|
|
#[arg(trailing_var_arg = true)]
|
|
pub command: Vec<String>,
|
|
}
|
|
|
|
fn parse_allow_unix_socket_path(raw: &str) -> Result<AbsolutePathBuf, String> {
|
|
AbsolutePathBuf::relative_to_current_dir(raw)
|
|
.map_err(|err| format!("invalid path {raw}: {err}"))
|
|
}
|
|
|
|
#[derive(Debug, Parser)]
|
|
pub struct LandlockCommand {
|
|
/// Named permissions profile to apply from the active configuration stack.
|
|
#[arg(long = "permissions-profile", value_name = "NAME")]
|
|
pub permissions_profile: Option<String>,
|
|
|
|
/// Working directory used for profile resolution and command execution.
|
|
#[arg(
|
|
short = 'C',
|
|
long = "cd",
|
|
value_name = "DIR",
|
|
requires = "permissions_profile"
|
|
)]
|
|
pub cwd: Option<PathBuf>,
|
|
|
|
/// Include managed requirements while resolving an explicit permissions profile.
|
|
#[arg(
|
|
long = "include-managed-config",
|
|
default_value_t = false,
|
|
requires = "permissions_profile"
|
|
)]
|
|
pub include_managed_config: bool,
|
|
|
|
#[clap(skip)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
|
|
/// Full command args to run under the Linux sandbox.
|
|
#[arg(trailing_var_arg = true)]
|
|
pub command: Vec<String>,
|
|
}
|
|
|
|
#[derive(Debug, Parser)]
|
|
pub struct WindowsCommand {
|
|
/// Named permissions profile to apply from the active configuration stack.
|
|
#[arg(long = "permissions-profile", value_name = "NAME")]
|
|
pub permissions_profile: Option<String>,
|
|
|
|
/// Working directory used for profile resolution and command execution.
|
|
#[arg(
|
|
short = 'C',
|
|
long = "cd",
|
|
value_name = "DIR",
|
|
requires = "permissions_profile"
|
|
)]
|
|
pub cwd: Option<PathBuf>,
|
|
|
|
/// Include managed requirements while resolving an explicit permissions profile.
|
|
#[arg(
|
|
long = "include-managed-config",
|
|
default_value_t = false,
|
|
requires = "permissions_profile"
|
|
)]
|
|
pub include_managed_config: bool,
|
|
|
|
#[clap(skip)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
|
|
/// Full command args to run under Windows restricted token sandbox.
|
|
#[arg(trailing_var_arg = true)]
|
|
pub command: Vec<String>,
|
|
}
|