mirror of
https://github.com/openai/codex.git
synced 2026-05-04 03:16:31 +00:00
dee5f5ea38
## Summary This PR hardens package-manager usage across the repo to reduce dependency supply-chain risk. It also removes the stale `codex-cli` Docker path, which was already broken on `main`, instead of keeping a bitrotted container workflow alive. ## What changed - Updated pnpm package manager pins and workspace install settings. - Removed stale `codex-cli` Docker assets instead of trying to keep a broken local container path alive. - Added uv settings and lockfiles for the Python SDK packages. - Updated Python SDK setup docs to use `uv sync`. ## Why This is primarily a security hardening change. It reduces package-install and supply-chain risk by ensuring dependency installs go through pinned package managers, committed lockfiles, release-age settings, and reviewed build-script controls. For `codex-cli`, the right follow-up was to remove the local Docker path rather than keep patching it: - `codex-cli/Dockerfile` installed `codex.tgz` with `npm install -g`, which bypassed the repo lockfile and age-gated pnpm settings. - The local `codex-cli/scripts/build_container.sh` helper was already broken on `main`: it called `pnpm run build`, but `codex-cli/package.json` does not define a `build` script. - The container path itself had bitrotted enough that keeping it would require extra packaging-specific behavior that was not otherwise needed by the repo. ## Gaps addressed - Global npm installs bypassed the repo lockfile in Docker and CLI reinstall paths, including `codex-cli/Dockerfile` and `codex-cli/bin/codex.js`. - CI and Docker pnpm installs used `--frozen-lockfile`, but the repo was missing stricter pnpm workspace settings for dependency build scripts. - Python SDK projects had `pyproject.toml` metadata but no committed `uv.lock` coverage or uv age/index settings in `sdk/python` and `sdk/python-runtime`. - The secure devcontainer install path used npm/global install behavior without a local locked package-manager boundary. - The local `codex-cli` Docker helper was already broken on `main`, so this PR removes that stale Docker path instead of preserving a broken surface. - pnpm was already pinned, but not to the current repo-wide pnpm version target. ## Verification - `pnpm install --frozen-lockfile` - `.devcontainer/codex-install`: `pnpm install --prod --frozen-lockfile` - `.devcontainer/codex-install`: `./node_modules/.bin/codex --version` - `sdk/python`: `uv lock --check`, `uv sync --locked --all-extras --dry-run`, `uv build` - `sdk/python-runtime`: `uv lock --check`, `uv sync --locked --dry-run`, `uv build --wheel` - `pnpm -r --filter ./sdk/typescript run build` - `pnpm -r --filter ./sdk/typescript run lint` - `pnpm -r --filter ./sdk/typescript run test` - `node --check codex-cli/bin/codex.js` - `docker build -f .devcontainer/Dockerfile.secure -t codex-secure-test .` - `cargo build -p codex-cli` - repo-wide package-manager audit
84 lines
2.7 KiB
Markdown
84 lines
2.7 KiB
Markdown
# Python SDK Examples
|
|
|
|
Each example folder contains runnable versions:
|
|
|
|
- `sync.py` (public sync surface: `Codex`)
|
|
- `async.py` (public async surface: `AsyncCodex`)
|
|
|
|
All examples intentionally use only public SDK exports from `codex_app_server`.
|
|
|
|
## Prerequisites
|
|
|
|
- Python `>=3.10`
|
|
- Install SDK dependencies for the same Python interpreter you will use to run examples
|
|
|
|
Recommended setup (from `sdk/python`):
|
|
|
|
```bash
|
|
uv sync
|
|
source .venv/bin/activate
|
|
```
|
|
|
|
When running examples from this repo checkout, the SDK source uses the local
|
|
tree and does not bundle a runtime binary. The helper in `examples/_bootstrap.py`
|
|
uses the installed `openai-codex-cli-bin` runtime package.
|
|
|
|
If the pinned `openai-codex-cli-bin` runtime is not already installed, the bootstrap
|
|
will download the matching GitHub release artifact, stage a temporary local
|
|
`openai-codex-cli-bin` package, install it into your active interpreter, and clean up
|
|
the temporary files afterward.
|
|
|
|
Current pinned runtime version: `0.116.0-alpha.1`
|
|
|
|
## Run examples
|
|
|
|
From `sdk/python`:
|
|
|
|
```bash
|
|
python examples/<example-folder>/sync.py
|
|
python examples/<example-folder>/async.py
|
|
```
|
|
|
|
The examples bootstrap local imports from `sdk/python/src` automatically, so no
|
|
SDK wheel install is required. You only need the Python dependencies for your
|
|
active interpreter and an installed `openai-codex-cli-bin` runtime package (either
|
|
already present or automatically provisioned by the bootstrap).
|
|
|
|
## Recommended first run
|
|
|
|
```bash
|
|
python examples/01_quickstart_constructor/sync.py
|
|
python examples/01_quickstart_constructor/async.py
|
|
```
|
|
|
|
## Index
|
|
|
|
- `01_quickstart_constructor/`
|
|
- first run / sanity check
|
|
- `02_turn_run/`
|
|
- inspect full turn output fields
|
|
- `03_turn_stream_events/`
|
|
- stream a turn with a small curated event view
|
|
- `04_models_and_metadata/`
|
|
- discover visible models for the connected runtime
|
|
- `05_existing_thread/`
|
|
- resume a real existing thread (created in-script)
|
|
- `06_thread_lifecycle_and_controls/`
|
|
- thread lifecycle + control calls
|
|
- `07_image_and_text/`
|
|
- remote image URL + text multimodal turn
|
|
- `08_local_image_and_text/`
|
|
- local image + text multimodal turn using a generated temporary sample image
|
|
- `09_async_parity/`
|
|
- parity-style sync flow (see async parity in other examples)
|
|
- `10_error_handling_and_retry/`
|
|
- overload retry pattern + typed error handling structure
|
|
- `11_cli_mini_app/`
|
|
- interactive chat loop
|
|
- `12_turn_params_kitchen_sink/`
|
|
- structured output with a curated advanced `turn(...)` configuration
|
|
- `13_model_select_and_turn_params/`
|
|
- list models, pick highest model + highest supported reasoning effort, run turns, print message and usage
|
|
- `14_turn_controls/`
|
|
- separate best-effort `steer()` and `interrupt()` demos with concise summaries
|