mirror of
https://github.com/openai/codex.git
synced 2026-05-03 02:46:39 +00:00
dee5f5ea38
## Summary This PR hardens package-manager usage across the repo to reduce dependency supply-chain risk. It also removes the stale `codex-cli` Docker path, which was already broken on `main`, instead of keeping a bitrotted container workflow alive. ## What changed - Updated pnpm package manager pins and workspace install settings. - Removed stale `codex-cli` Docker assets instead of trying to keep a broken local container path alive. - Added uv settings and lockfiles for the Python SDK packages. - Updated Python SDK setup docs to use `uv sync`. ## Why This is primarily a security hardening change. It reduces package-install and supply-chain risk by ensuring dependency installs go through pinned package managers, committed lockfiles, release-age settings, and reviewed build-script controls. For `codex-cli`, the right follow-up was to remove the local Docker path rather than keep patching it: - `codex-cli/Dockerfile` installed `codex.tgz` with `npm install -g`, which bypassed the repo lockfile and age-gated pnpm settings. - The local `codex-cli/scripts/build_container.sh` helper was already broken on `main`: it called `pnpm run build`, but `codex-cli/package.json` does not define a `build` script. - The container path itself had bitrotted enough that keeping it would require extra packaging-specific behavior that was not otherwise needed by the repo. ## Gaps addressed - Global npm installs bypassed the repo lockfile in Docker and CLI reinstall paths, including `codex-cli/Dockerfile` and `codex-cli/bin/codex.js`. - CI and Docker pnpm installs used `--frozen-lockfile`, but the repo was missing stricter pnpm workspace settings for dependency build scripts. - Python SDK projects had `pyproject.toml` metadata but no committed `uv.lock` coverage or uv age/index settings in `sdk/python` and `sdk/python-runtime`. - The secure devcontainer install path used npm/global install behavior without a local locked package-manager boundary. - The local `codex-cli` Docker helper was already broken on `main`, so this PR removes that stale Docker path instead of preserving a broken surface. - pnpm was already pinned, but not to the current repo-wide pnpm version target. ## Verification - `pnpm install --frozen-lockfile` - `.devcontainer/codex-install`: `pnpm install --prod --frozen-lockfile` - `.devcontainer/codex-install`: `./node_modules/.bin/codex --version` - `sdk/python`: `uv lock --check`, `uv sync --locked --all-extras --dry-run`, `uv build` - `sdk/python-runtime`: `uv lock --check`, `uv sync --locked --dry-run`, `uv build --wheel` - `pnpm -r --filter ./sdk/typescript run build` - `pnpm -r --filter ./sdk/typescript run lint` - `pnpm -r --filter ./sdk/typescript run test` - `node --check codex-cli/bin/codex.js` - `docker build -f .devcontainer/Dockerfile.secure -t codex-secure-test .` - `cargo build -p codex-cli` - repo-wide package-manager audit
68 lines
1.8 KiB
JSON
68 lines
1.8 KiB
JSON
{
|
|
"name": "@openai/codex-sdk",
|
|
"version": "0.0.0-dev",
|
|
"description": "TypeScript SDK for Codex APIs.",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/openai/codex.git",
|
|
"directory": "sdk/typescript"
|
|
},
|
|
"keywords": [
|
|
"openai",
|
|
"codex",
|
|
"sdk",
|
|
"typescript",
|
|
"api"
|
|
],
|
|
"license": "Apache-2.0",
|
|
"type": "module",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"module": "./dist/index.js",
|
|
"types": "./dist/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"import": "./dist/index.js",
|
|
"types": "./dist/index.d.ts"
|
|
}
|
|
},
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"sideEffects": false,
|
|
"scripts": {
|
|
"clean": "rm -rf dist",
|
|
"build": "tsup",
|
|
"build:watch": "tsup --watch",
|
|
"lint": "pnpm eslint \"src/**/*.ts\" \"tests/**/*.ts\"",
|
|
"lint:fix": "pnpm eslint --fix \"src/**/*.ts\" \"tests/**/*.ts\"",
|
|
"test": "jest",
|
|
"test:watch": "jest --watch",
|
|
"coverage": "jest --coverage",
|
|
"format": "prettier --check .",
|
|
"format:fix": "prettier --write .",
|
|
"prepare": "pnpm run build"
|
|
},
|
|
"devDependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.24.0",
|
|
"@types/jest": "^29.5.14",
|
|
"@types/node": "^20.19.18",
|
|
"eslint": "^9.36.0",
|
|
"eslint-config-prettier": "^9.1.2",
|
|
"eslint-plugin-jest": "^29.0.1",
|
|
"eslint-plugin-node-import": "^1.0.5",
|
|
"jest": "^29.7.0",
|
|
"prettier": "^3.6.2",
|
|
"ts-jest": "^29.3.4",
|
|
"ts-jest-mock-import-meta": "^1.3.1",
|
|
"ts-node": "^10.9.2",
|
|
"tsup": "^8.5.0",
|
|
"typescript": "^5.9.2",
|
|
"typescript-eslint": "^8.45.0",
|
|
"zod": "^3.24.2",
|
|
"zod-to-json-schema": "^3.24.6"
|
|
},
|
|
"packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319"
|
|
}
|