codex

fix: try building the npm package in CI (#2043 )

Historically, the release process for the npm module has been:

- I run `codex-rs/scripts/create_github_release.sh` to kick off a
release for the native artifacts.
- I wait until it is done.
- I run `codex-cli/scripts/stage_rust_release.py` to build the npm
release locally
- I run `npm publish` from my laptop

It has been a longstanding issue to move the npm build to CI. I may
still have to do the `npm publish` manually because it requires 2fac
with `npm`, though I assume we can work that out later.

Note I asked Codex to make these updates, and while they look pretty
good to me, I'm not 100% certain, but let's just merge this and I'll
kick off another alpha build and we'll see what happens?

Michael Bolin · 2025-08-08 15:17:54 -07:00

39a4d4ed8e

feat: include Windows binary of the CLI in the npm release (#2040 )

To date, the build scripts in `codex-cli` still supported building the
old TypeScript version of the Codex CLI to give Windows users something
they can run, but we are just going to have them use the Rust version
like everyone else, so:

- updates `codex-cli/bin/codex.js` so that we run the native binary or
throw if the target platform/arch is not supported (no more conditional
usage based on `CODEX_RUST`, `use-native` file, etc.)
- drops the `--native` flag from `codex-cli/scripts/stage_release.sh`
and updates all the code paths to behave as if `--native` were passed
(i.e., it is the only way to run it now)

Tested this by running:

```
./codex-cli/scripts/stage_rust_release.py --release-version 0.20.0-alpha.2
```

Michael Bolin · 2025-08-08 14:44:35 -07:00

d0cf036799

docs: clarify the build process for the npm release (#1568 )

It appears that `0.5.0` was built with `stage_release.sh` instead of
`stage_rust_release.py`, so add docs to clarify this and recommend
running `--version` on the release candidate to verify the right thing
was built.

Michael Bolin · 2025-07-14 09:41:11 -07:00

9c0b413fd1

chore: create a release script for the Rust CLI (#1479 )

This is a stopgap solution before migrating the build for the npm
release to GitHub Actions (which is ultimately what should be done to
ensure hermetic builds).

The idea is that instead of continuing to create PRs like
https://github.com/openai/codex/pull/1472 where I have to check in a
change to the `WORKFLOW_URL`, this script uses `gh run list` to get the
`WORKFLOW_URL` dynamically and then threads the value through to
`install_native_deps.sh`.

To create the 0.3.0 release on npm, I ran:

```shell
./codex-cli/scripts/stage_rust_release.py --release-version 0.3.0
```

and then did `npm publish --dry-run` followed by `npm publish` in the
temp directory created by `stage_rust_release.py`.

Michael Bolin · 2025-07-07 23:51:34 -07:00

0b9cb2b9e7

chore: update release scripts for the TypeScript CLI (#1472 )

This introduces two changes to make a quick fix so we can deploy the
Rust CLI for `0.2.0` of `@openai/codex` on npm:

- Updates `WORKFLOW_URL` to point to
https://github.com/openai/codex/actions/runs/15981617627, which is the
GitHub workflow run used to create the binaries for the `0.2.0` release
we published to Homebrew.
- Adds a `--version` option to `stage_release.sh` to specify what the
`version` field in the `package.json` will be.

Locally, I ran the following:

```
./codex-cli/scripts/stage_release.sh --native --version 0.2.0
```

Previously, we only used the `--native` flag to publish to the `native`
tag of `@openai/codex` (e.g., `npm publish --tag native`), but we should
just publish this as the default tag for `0.2.0` to be consistent with
what is in Homebrew.

We can still publish one "final" version of the TypeScript CLI as 0.1.x
later.

Under the hood, this release will still contain `dist/cli.js`,
`bin/codex-linux-sandbox-x64`, and `bin/codex-x86_64-apple-darwin`,
which are not strictly necessary, but we'll fix that in `0.3.0`.

Michael Bolin · 2025-07-07 09:43:03 -07:00

bd5a9e8ba9

chore: ensure next Node.js release includes musl binaries for arm64 Linux (#1232 )

Target a workflow with more recent binary artifacts.

Michael Bolin · 2025-06-05 23:14:10 -07:00

a80240cfdc

fix: use aarch64-unknown-linux-musl instead of aarch64-unknown-linux-gnu (#1228 )

Now that we have published a GitHub Release that contains arm64 musl
artifacts for Linux, update the following scripts to take advantage of
them:

- `dotslash-config.json` now uses musl artifacts for the `linux-aarch64`
target
- `install_native_deps.sh` for the TypeScript CLI now includes
`codex-linux-sandbox-aarch64-unknown-linux-musl` instead of
`codex-linux-sandbox-aarch64-unknown-linux-gnu` for sandboxing
- `codex-cli/bin/codex.js` now checks for `aarch64-unknown-linux-musl`
artifacts instead of `aarch64-unknown-linux-gnu` ones

Michael Bolin · 2025-06-05 22:45:45 -07:00

2d5246050a

chore: update the WORKFLOW_URL in install_native_deps.sh to the latest release (#1190 )

Michael Bolin · 2025-05-31 10:30:50 -07:00

7896b1089d

chore: update GitHub workflow for native artifacts for npm release (#1162 )

Among other things, this picks up this UI treatment fix:

https://github.com/openai/codex/pull/1161

Michael Bolin · 2025-05-29 15:34:06 -07:00

8c1902b562

fix: update install_native_deps.sh to pick up the latest release (#1136 )

Michael Bolin · 2025-05-27 10:06:41 -07:00

eba0e32909

fix: for the @native release of the Node module, use the Rust version by default (#1084 )

Added logic so that when we run `./scripts/stage_release.sh --native`
(for the `@native` version of the Node module), we drop a `use-native`
file next to `codex.js`. If present, `codex.js` will now run the Rust
CLI.

Ran `./scripts/stage_release.sh --native` and verified that when the
running `codex.js` in the staged folder:

```
$ /var/folders/wm/f209bc1n2bd_r0jncn9s6j_00000gp/T/tmp.efvEvBlSN6/bin/codex.js --version
codex-cli 0.0.2505220956
```

it ran the expected Rust version of the CLI, as desired.

While here, I also updated the Rust version to one that I cut today,
which includes the new shell environment policy config option:
https://github.com/openai/codex/pull/1061. Note this may "break" some
users if the processes spawned by Codex need extra environment
variables. (We are still working to determine what the right defaults
should be for this option.)

Michael Bolin · 2025-05-22 13:42:55 -07:00

63deb7c369

chore: update install_native_deps.sh to use rust-v0.0.2505171051 (#995 )

Use a more recent built of the Rust binaries to include with the Node
module.

Michael Bolin · 2025-05-17 11:25:24 -07:00

f3bde21759

chore: introduce new --native flag to Node module release process (#844 )

This PR introduces an optional build flag, `--native`, that will build a
version of the Codex npm module that:

- Includes both the Node.js and native Rust versions (for Mac and Linux)
- Will run the native version if `CODEX_RUST=1` is set
- Runs the TypeScript version otherwise

Note this PR also updates the workflow URL to
https://github.com/openai/codex/actions/runs/14872557396, as that is a
build from today that includes everything up through
https://github.com/openai/codex/pull/843.

Test Plan:

In `~/code/codex/codex-cli`, I ran:

```
pnpm stage-release --native
```

The end of the output was:

```
Staged version 0.1.2505121317 for release in /var/folders/wm/f209bc1n2bd_r0jncn9s6j_00000gp/T/tmp.xd2p5ETYGN
Test Node:
    node /var/folders/wm/f209bc1n2bd_r0jncn9s6j_00000gp/T/tmp.xd2p5ETYGN/bin/codex.js --help
Test Rust:
    CODEX_RUST=1 node /var/folders/wm/f209bc1n2bd_r0jncn9s6j_00000gp/T/tmp.xd2p5ETYGN/bin/codex.js --help
Next:  cd "/var/folders/wm/f209bc1n2bd_r0jncn9s6j_00000gp/T/tmp.xd2p5ETYGN" && npm publish --tag native
```

I verified that running each of these commands ran the expected version
of Codex.

While here, I also added `bin` to the `files` list in `package.json`,
which should have been done as part of
https://github.com/openai/codex/pull/757, as that added new entries to
`bin` that were matched by `.gitignore` but should have been included in
a release.

Michael Bolin · 2025-05-12 13:38:10 -07:00

73fe1381aa

chore: make build process a single script to run (#757 )

This introduces `./codex-cli/scripts/stage_release.sh`, which is a shell
script that stages a release for the Node.js module in a temp directory.
It updates the release to include these native binaries:

```
bin/codex-linux-sandbox-arm64
bin/codex-linux-sandbox-x64
```

though this PR does not update Codex CLI to use them yet.

When doing local development, run
`./codex-cli/scripts/install_native_deps.sh` to install these in your
own `bin/` folder.

This PR also updates `README.md` to document the new workflow.

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/757).
* #763
* __->__ #757

Michael Bolin · 2025-05-01 08:36:07 -07:00

3f5975ad5a

feat: add common package registries domains to allowed-domains list (#414 )

feat: add common package registries domains to allowed-domains list

Matan Yemini · 2025-04-29 12:07:00 -07:00

237f8a11e1

fix: update scripts/build_container.sh to use pnpm instead of npm (#631 )

I suspect this is why some contributors kept accidentally including a
new `codex-cli/package-lock.json` in their PRs.

Note the `Dockerfile` still uses `npm` instead of `pnpm`, but that
appears to be fine. (Probably nicer to globally install as few things as
possible in the image.)

Michael Bolin · 2025-04-24 16:38:57 -07:00

bb2d411043

fix: do not grant "node" user sudo access when using run_in_container.sh (#627 )

This exploration came out of my review of
https://github.com/openai/codex/pull/414.

`run_in_container.sh` runs Codex in a Docker container like so:


https://github.com/openai/codex/blob/bd1c3deed9f4f103e755baa3f3a45e7a1c1a134b/codex-cli/scripts/run_in_container.sh#L51-L58

But then runs `init_firewall.sh` to set up the firewall to restrict
network access.

Previously, we did this by adding `/usr/local/bin/init_firewall.sh` to
the container and adding a special rule in `/etc/sudoers.d` so the
unprivileged user (`node`) could run the privileged `init_firewall.sh`
script to open up the firewall for `api.openai.com`:


https://github.com/openai/codex/blob/31d0d7a305305ad557035a2edcab60b6be5018d8/codex-cli/Dockerfile#L51-L56

Though I believe this is unnecessary, as we can use `docker exec --user
root` from _outside_ the container to run
`/usr/local/bin/init_firewall.sh` as `root` without adding a special
case in `/etc/sudoers.d`.

This appears to work as expected, as I tested it by doing the following:

```
./codex-cli/scripts/build_container.sh
./codex-cli/scripts/run_in_container.sh 'what is the output of `curl https://www.openai.com`'
```

This was a bit funny because in some of my runs, Codex wasn't convinced
it had network access, so I had to convince it to try the `curl`
request:


![image](https://github.com/user-attachments/assets/80bd487c-74e2-4cd3-aa0f-26a6edd8d3f7)

As you can see, when it ran `curl -s https\://www.openai.com`, it a
connection failure, so the network policy appears to be working as
intended.

Note this PR also removes `sudo` from the `apt-get install` list in the
`Dockerfile`.

Michael Bolin · 2025-04-24 14:25:02 -07:00

61805a832d

Fix #371 Allow multiple containers on same machine (#373 )

- Docker container name based on work  directory
- Centralize container removal logic
- Improve quoting for command arguments
- Ensure workdir is always set and normalized

Resolves: #371 

Signed-off-by: BadPirate <badpirate@gmail.com>

Signed-off-by: BadPirate <badpirate@gmail.com>

BadPirate · 2025-04-18 16:48:07 -07:00

bec3947058

(fix) update Docker container scripts (#47 )

* Fix Docker container scripts

Signed-off-by:: Eric Burke <eburke@openai.com>

* Build codex TGZ

* fix run_in_container

---------

Co-authored-by: Kyle Kosic <kylekosic@openai.com>

Eric Burke · 2025-04-16 12:02:41 -07:00

b6846ce07f

Initial commit

Signed-off-by: Ilan Bigio <ilan@openai.com>

Ilan Bigio · 2025-04-16 12:56:08 -04:00

59a180ddec

20 Commits