mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Celia Chen
1cd3ad1f49
## Summary Add first-class Amazon Bedrock Mantle provider support so Codex can keep using its existing Responses API transport with OpenAI-compatible AWS-hosted endpoints such as AOA/Mantle. This is needed for the AWS launch path, where provider traffic should authenticate with AWS credentials instead of OpenAI bearer credentials. Requests are authenticated immediately before transport send, so SigV4 signs the final method, URL, headers, and body bytes that `reqwest` will send. ## What Changed - Added a new `codex-aws-auth` crate for loading AWS SDK config, resolving credentials, and signing finalized HTTP requests with AWS SigV4. - Added a built-in `amazon-bedrock` provider that targets Bedrock Mantle Responses endpoints, defaults to `us-east-1`, supports region/profile overrides, disables WebSockets, and does not require OpenAI auth. - Added Amazon Bedrock auth resolution in `codex-model-provider`: prefer `AWS_BEARER_TOKEN_BEDROCK` when set, otherwise use AWS SDK credentials and SigV4 signing. - Added `AuthProvider::apply_auth` and `Request::prepare_body_for_send` so request-signing providers can sign the exact outbound request after JSON serialization/compression. - Determine the region by taking the `aws.region` config first (required for bearer token codepath), and fallback to SDK default region. ## Testing Amazon Bedrock Mantle Responses paths: - Built the local Codex binary with `cargo build`. - Verified the custom proxy-backed `aws` provider using `env_key = "AWS_BEARER_TOKEN_BEDROCK"` streamed raw `responses` output with `response.output_text.delta`, `response.completed`, and `mantle-env-ok`. - Verified a full `codex exec --profile aws` turn returned `mantle-env-ok`. - Confirmed the custom provider used the bearer env var, not AWS profile auth: bogus `AWS_PROFILE` still passed, empty env var failed locally, and malformed env var reached Mantle and failed with `401 invalid_api_key`. - Verified built-in `amazon-bedrock` with `AWS_BEARER_TOKEN_BEDROCK` set passed despite bogus AWS profiles, returning `amazon-bedrock-env-ok`. - Verified built-in `amazon-bedrock` SDK/SigV4 auth passed with `AWS_BEARER_TOKEN_BEDROCK` unset and temporary AWS session env credentials, returning `amazon-bedrock-sdk-env-ok`.
481 lines
14 KiB
TOML
481 lines
14 KiB
TOML
[workspace]
|
|
members = [
|
|
"aws-auth",
|
|
"analytics",
|
|
"backend-client",
|
|
"ansi-escape",
|
|
"async-utils",
|
|
"app-server",
|
|
"app-server-client",
|
|
"app-server-protocol",
|
|
"app-server-test-client",
|
|
"debug-client",
|
|
"apply-patch",
|
|
"arg0",
|
|
"feedback",
|
|
"features",
|
|
"install-context",
|
|
"codex-backend-openapi-models",
|
|
"code-mode",
|
|
"cloud-requirements",
|
|
"cloud-tasks",
|
|
"cloud-tasks-client",
|
|
"cloud-tasks-mock-client",
|
|
"cli",
|
|
"collaboration-mode-templates",
|
|
"connectors",
|
|
"config",
|
|
"device-key",
|
|
"shell-command",
|
|
"shell-escalation",
|
|
"skills",
|
|
"core",
|
|
"core-plugins",
|
|
"core-skills",
|
|
"hooks",
|
|
"secrets",
|
|
"exec",
|
|
"exec-server",
|
|
"execpolicy",
|
|
"execpolicy-legacy",
|
|
"keyring-store",
|
|
"file-search",
|
|
"linux-sandbox",
|
|
"lmstudio",
|
|
"login",
|
|
"codex-mcp",
|
|
"mcp-server",
|
|
"model-provider-info",
|
|
"models-manager",
|
|
"network-proxy",
|
|
"ollama",
|
|
"process-hardening",
|
|
"protocol",
|
|
"realtime-webrtc",
|
|
"rollout",
|
|
"rollout-trace",
|
|
"rmcp-client",
|
|
"responses-api-proxy",
|
|
"response-debug-context",
|
|
"sandboxing",
|
|
"stdio-to-uds",
|
|
"otel",
|
|
"tui",
|
|
"tools",
|
|
"v8-poc",
|
|
"utils/absolute-path",
|
|
"utils/cargo-bin",
|
|
"git-utils",
|
|
"utils/cache",
|
|
"utils/image",
|
|
"utils/json-to-toml",
|
|
"utils/home-dir",
|
|
"utils/pty",
|
|
"utils/readiness",
|
|
"utils/rustls-provider",
|
|
"utils/string",
|
|
"utils/cli",
|
|
"utils/elapsed",
|
|
"utils/sandbox-summary",
|
|
"utils/sleep-inhibitor",
|
|
"utils/approval-presets",
|
|
"utils/oss",
|
|
"utils/output-truncation",
|
|
"utils/path-utils",
|
|
"utils/plugins",
|
|
"utils/fuzzy-match",
|
|
"utils/stream-parser",
|
|
"utils/template",
|
|
"codex-client",
|
|
"codex-api",
|
|
"state",
|
|
"terminal-detection",
|
|
"test-binary-support",
|
|
"thread-store",
|
|
"uds",
|
|
"codex-experimental-api-macros",
|
|
"plugin",
|
|
"model-provider",
|
|
]
|
|
resolver = "2"
|
|
|
|
[workspace.package]
|
|
version = "0.0.0"
|
|
# Track the edition for all workspace crates in one place. Individual
|
|
# crates can still override this value, but keeping it here means new
|
|
# crates created with `cargo new -w ...` automatically inherit the 2024
|
|
# edition.
|
|
edition = "2024"
|
|
license = "Apache-2.0"
|
|
|
|
[workspace.dependencies]
|
|
# Internal
|
|
app_test_support = { path = "app-server/tests/common" }
|
|
codex-analytics = { path = "analytics" }
|
|
codex-ansi-escape = { path = "ansi-escape" }
|
|
codex-api = { path = "codex-api" }
|
|
codex-aws-auth = { path = "aws-auth" }
|
|
codex-app-server = { path = "app-server" }
|
|
codex-app-server-client = { path = "app-server-client" }
|
|
codex-app-server-protocol = { path = "app-server-protocol" }
|
|
codex-app-server-test-client = { path = "app-server-test-client" }
|
|
codex-apply-patch = { path = "apply-patch" }
|
|
codex-arg0 = { path = "arg0" }
|
|
codex-async-utils = { path = "async-utils" }
|
|
codex-backend-client = { path = "backend-client" }
|
|
codex-chatgpt = { path = "chatgpt" }
|
|
codex-cli = { path = "cli" }
|
|
codex-client = { path = "codex-client" }
|
|
codex-collaboration-mode-templates = { path = "collaboration-mode-templates" }
|
|
codex-cloud-requirements = { path = "cloud-requirements" }
|
|
codex-cloud-tasks-client = { path = "cloud-tasks-client" }
|
|
codex-cloud-tasks-mock-client = { path = "cloud-tasks-mock-client" }
|
|
codex-code-mode = { path = "code-mode" }
|
|
codex-config = { path = "config" }
|
|
codex-connectors = { path = "connectors" }
|
|
codex-core = { path = "core" }
|
|
codex-core-plugins = { path = "core-plugins" }
|
|
codex-core-skills = { path = "core-skills" }
|
|
codex-device-key = { path = "device-key" }
|
|
codex-exec = { path = "exec" }
|
|
codex-exec-server = { path = "exec-server" }
|
|
codex-execpolicy = { path = "execpolicy" }
|
|
codex-experimental-api-macros = { path = "codex-experimental-api-macros" }
|
|
codex-features = { path = "features" }
|
|
codex-feedback = { path = "feedback" }
|
|
codex-install-context = { path = "install-context" }
|
|
codex-file-search = { path = "file-search" }
|
|
codex-git-utils = { path = "git-utils" }
|
|
codex-hooks = { path = "hooks" }
|
|
codex-keyring-store = { path = "keyring-store" }
|
|
codex-linux-sandbox = { path = "linux-sandbox" }
|
|
codex-lmstudio = { path = "lmstudio" }
|
|
codex-login = { path = "login" }
|
|
codex-mcp = { path = "codex-mcp" }
|
|
codex-mcp-server = { path = "mcp-server" }
|
|
codex-model-provider-info = { path = "model-provider-info" }
|
|
codex-models-manager = { path = "models-manager" }
|
|
codex-network-proxy = { path = "network-proxy" }
|
|
codex-ollama = { path = "ollama" }
|
|
codex-otel = { path = "otel" }
|
|
codex-plugin = { path = "plugin" }
|
|
codex-model-provider = { path = "model-provider" }
|
|
codex-process-hardening = { path = "process-hardening" }
|
|
codex-protocol = { path = "protocol" }
|
|
codex-realtime-webrtc = { path = "realtime-webrtc" }
|
|
codex-responses-api-proxy = { path = "responses-api-proxy" }
|
|
codex-response-debug-context = { path = "response-debug-context" }
|
|
codex-rmcp-client = { path = "rmcp-client" }
|
|
codex-rollout = { path = "rollout" }
|
|
codex-sandboxing = { path = "sandboxing" }
|
|
codex-secrets = { path = "secrets" }
|
|
codex-shell-command = { path = "shell-command" }
|
|
codex-shell-escalation = { path = "shell-escalation" }
|
|
codex-skills = { path = "skills" }
|
|
codex-state = { path = "state" }
|
|
codex-stdio-to-uds = { path = "stdio-to-uds" }
|
|
codex-terminal-detection = { path = "terminal-detection" }
|
|
codex-test-binary-support = { path = "test-binary-support" }
|
|
codex-thread-store = { path = "thread-store" }
|
|
codex-tools = { path = "tools" }
|
|
codex-tui = { path = "tui" }
|
|
codex-uds = { path = "uds" }
|
|
codex-utils-absolute-path = { path = "utils/absolute-path" }
|
|
codex-utils-approval-presets = { path = "utils/approval-presets" }
|
|
codex-utils-cache = { path = "utils/cache" }
|
|
codex-utils-cargo-bin = { path = "utils/cargo-bin" }
|
|
codex-utils-cli = { path = "utils/cli" }
|
|
codex-utils-elapsed = { path = "utils/elapsed" }
|
|
codex-utils-fuzzy-match = { path = "utils/fuzzy-match" }
|
|
codex-utils-home-dir = { path = "utils/home-dir" }
|
|
codex-utils-image = { path = "utils/image" }
|
|
codex-utils-json-to-toml = { path = "utils/json-to-toml" }
|
|
codex-utils-oss = { path = "utils/oss" }
|
|
codex-utils-output-truncation = { path = "utils/output-truncation" }
|
|
codex-utils-path = { path = "utils/path-utils" }
|
|
codex-utils-plugins = { path = "utils/plugins" }
|
|
codex-utils-pty = { path = "utils/pty" }
|
|
codex-utils-readiness = { path = "utils/readiness" }
|
|
codex-utils-rustls-provider = { path = "utils/rustls-provider" }
|
|
codex-utils-sandbox-summary = { path = "utils/sandbox-summary" }
|
|
codex-utils-sleep-inhibitor = { path = "utils/sleep-inhibitor" }
|
|
codex-utils-stream-parser = { path = "utils/stream-parser" }
|
|
codex-utils-string = { path = "utils/string" }
|
|
codex-utils-template = { path = "utils/template" }
|
|
codex-v8-poc = { path = "v8-poc" }
|
|
codex-windows-sandbox = { path = "windows-sandbox-rs" }
|
|
core_test_support = { path = "core/tests/common" }
|
|
mcp_test_support = { path = "mcp-server/tests/common" }
|
|
|
|
# External
|
|
age = "0.11.1"
|
|
allocative = "0.3.3"
|
|
ansi-to-tui = "7.0.0"
|
|
anyhow = "1"
|
|
arboard = { version = "3", features = ["wayland-data-control"] }
|
|
arc-swap = "1.9.0"
|
|
assert_cmd = "2"
|
|
assert_matches = "1.5.0"
|
|
async-channel = "2.3.1"
|
|
async-io = "2.6.0"
|
|
async-stream = "0.3.6"
|
|
async-trait = "0.1.89"
|
|
aws-config = "1"
|
|
aws-credential-types = "1"
|
|
aws-sigv4 = "1"
|
|
aws-types = "1"
|
|
axum = { version = "0.8", default-features = false }
|
|
base64 = "0.22.1"
|
|
bm25 = "2.3.2"
|
|
bytes = "1.10.1"
|
|
chardetng = "0.1.17"
|
|
chrono = "0.4.43"
|
|
clap = "4"
|
|
clap_complete = "4"
|
|
color-eyre = "0.6.3"
|
|
constant_time_eq = "0.3.1"
|
|
crossbeam-channel = "0.5.15"
|
|
crossterm = "0.28.1"
|
|
csv = "1.3.1"
|
|
ctor = "0.6.3"
|
|
deno_core_icudata = "0.77.0"
|
|
derive_more = "2"
|
|
diffy = "0.4.2"
|
|
dirs = "6"
|
|
dns-lookup = "3.0.1"
|
|
dotenvy = "0.15.7"
|
|
dunce = "1.0.4"
|
|
encoding_rs = "0.8.35"
|
|
env-flags = "0.1.1"
|
|
env_logger = "0.11.9"
|
|
eventsource-stream = "0.2.3"
|
|
futures = { version = "0.3", default-features = false }
|
|
gethostname = "1.1.0"
|
|
gix = { version = "0.81.0", default-features = false, features = ["sha1"] }
|
|
glob = "0.3"
|
|
globset = "0.4"
|
|
hmac = "0.12.1"
|
|
http = "1.3.1"
|
|
iana-time-zone = "0.1.64"
|
|
icu_decimal = "2.1"
|
|
icu_locale_core = "2.1"
|
|
icu_provider = { version = "2.1", features = ["sync"] }
|
|
ignore = "0.4.23"
|
|
image = { version = "^0.25.9", default-features = false }
|
|
include_dir = "0.7.4"
|
|
indexmap = "2.12.0"
|
|
insta = "1.46.3"
|
|
inventory = "0.3.19"
|
|
itertools = "0.14.0"
|
|
jsonwebtoken = "9.3.1"
|
|
keyring = { version = "3.6", default-features = false }
|
|
landlock = "0.4.4"
|
|
lazy_static = "1"
|
|
libc = "0.2.182"
|
|
log = "0.4"
|
|
lru = "0.16.3"
|
|
maplit = "1.0.2"
|
|
mime_guess = "2.0.5"
|
|
multimap = "0.10.0"
|
|
notify = "8.2.0"
|
|
nucleo = { git = "https://github.com/helix-editor/nucleo.git", rev = "4253de9faabb4e5c6d81d946a5e35a90f87347ee" }
|
|
once_cell = "1.20.2"
|
|
openssl-sys = "*"
|
|
opentelemetry = "0.31.0"
|
|
opentelemetry-appender-tracing = "0.31.0"
|
|
opentelemetry-otlp = "0.31.0"
|
|
opentelemetry-semantic-conventions = "0.31.0"
|
|
opentelemetry_sdk = "0.31.0"
|
|
os_info = "3.12.0"
|
|
owo-colors = "4.3.0"
|
|
path-absolutize = "3.1.1"
|
|
pathdiff = "0.2"
|
|
p256 = "0.13.2"
|
|
portable-pty = "0.9.0"
|
|
predicates = "3"
|
|
pretty_assertions = "1.4.1"
|
|
pulldown-cmark = "0.10"
|
|
quick-xml = "0.38.4"
|
|
rand = "0.9"
|
|
ratatui = "0.29.0"
|
|
ratatui-macros = "0.6.0"
|
|
regex = "1.12.3"
|
|
regex-lite = "0.1.8"
|
|
reqwest = { version = "0.12", features = ["cookies"] }
|
|
rmcp = { version = "0.15.0", default-features = false }
|
|
runfiles = { git = "https://github.com/dzbarsky/rules_rust", rev = "b56cbaa8465e74127f1ea216f813cd377295ad81" }
|
|
rustls = { version = "0.23", default-features = false, features = [
|
|
"ring",
|
|
"std",
|
|
] }
|
|
rustls-native-certs = "0.8.3"
|
|
rustls-pki-types = "1.14.0"
|
|
schemars = "0.8.22"
|
|
seccompiler = "0.5.0"
|
|
semver = "1.0"
|
|
sentry = "0.46.0"
|
|
serde = "1"
|
|
serde_json = "1"
|
|
serde_path_to_error = "0.1.20"
|
|
serde_with = "3.17"
|
|
serde_yaml = "0.9"
|
|
serial_test = "3.2.0"
|
|
sha1 = "0.10.6"
|
|
sha2 = "0.10"
|
|
shlex = "1.3.0"
|
|
similar = "2.7.0"
|
|
socket2 = "0.6.1"
|
|
sqlx = { version = "0.8.6", default-features = false, features = [
|
|
"chrono",
|
|
"json",
|
|
"macros",
|
|
"migrate",
|
|
"runtime-tokio-rustls",
|
|
"sqlite",
|
|
"time",
|
|
"uuid",
|
|
] }
|
|
starlark = "0.13.0"
|
|
strum = "0.27.2"
|
|
strum_macros = "0.28.0"
|
|
supports-color = "3.0.2"
|
|
syntect = "5"
|
|
sys-locale = "0.3.2"
|
|
tempfile = "3.23.0"
|
|
test-log = "0.2.19"
|
|
textwrap = "0.16.2"
|
|
thiserror = "2.0.17"
|
|
time = "0.3.47"
|
|
tiny_http = "0.12"
|
|
tokio = "1"
|
|
tokio-stream = "0.1.18"
|
|
tokio-test = "0.4"
|
|
tokio-tungstenite = { version = "0.28.0", features = [
|
|
"proxy",
|
|
"rustls-tls-native-roots",
|
|
] }
|
|
tokio-util = "0.7.18"
|
|
toml = "0.9.5"
|
|
toml_edit = "0.24.0"
|
|
tracing = "0.1.44"
|
|
tracing-appender = "0.2.3"
|
|
tracing-opentelemetry = "0.32.0"
|
|
tracing-subscriber = "0.3.22"
|
|
tracing-test = "0.2.5"
|
|
tonic = { version = "0.14.3", default-features = false, features = ["channel", "codegen"] }
|
|
tonic-prost = "0.14.3"
|
|
tree-sitter = "0.25.10"
|
|
tree-sitter-bash = "0.25"
|
|
ts-rs = "11"
|
|
tungstenite = { version = "0.27.0", features = ["deflate", "proxy"] }
|
|
uds_windows = "1.1.0"
|
|
unicode-segmentation = "1.12.0"
|
|
unicode-width = "0.2"
|
|
url = "2"
|
|
urlencoding = "2.1"
|
|
uuid = "1"
|
|
v8 = "=146.4.0"
|
|
vt100 = "0.16.2"
|
|
walkdir = "2.5.0"
|
|
webbrowser = "1.0"
|
|
which = "8"
|
|
whoami = "1.6.1"
|
|
wildmatch = "2.6.1"
|
|
winapi-util = "0.1.11"
|
|
zip = "2.4.2"
|
|
zstd = "0.13"
|
|
|
|
wiremock = "0.6"
|
|
zeroize = "1.8.2"
|
|
|
|
[workspace.lints]
|
|
rust = {}
|
|
|
|
[workspace.lints.clippy]
|
|
await_holding_invalid_type = "deny"
|
|
await_holding_lock = "deny"
|
|
expect_used = "deny"
|
|
identity_op = "deny"
|
|
manual_clamp = "deny"
|
|
manual_filter = "deny"
|
|
manual_find = "deny"
|
|
manual_flatten = "deny"
|
|
manual_map = "deny"
|
|
manual_memcpy = "deny"
|
|
manual_non_exhaustive = "deny"
|
|
manual_ok_or = "deny"
|
|
manual_range_contains = "deny"
|
|
manual_retain = "deny"
|
|
manual_strip = "deny"
|
|
manual_try_fold = "deny"
|
|
manual_unwrap_or = "deny"
|
|
needless_borrow = "deny"
|
|
needless_borrowed_reference = "deny"
|
|
needless_collect = "deny"
|
|
needless_late_init = "deny"
|
|
needless_option_as_deref = "deny"
|
|
needless_question_mark = "deny"
|
|
needless_update = "deny"
|
|
redundant_clone = "deny"
|
|
redundant_closure = "deny"
|
|
redundant_closure_for_method_calls = "deny"
|
|
redundant_static_lifetimes = "deny"
|
|
trivially_copy_pass_by_ref = "deny"
|
|
uninlined_format_args = "deny"
|
|
unnecessary_filter_map = "deny"
|
|
unnecessary_lazy_evaluations = "deny"
|
|
unnecessary_sort_by = "deny"
|
|
unnecessary_to_owned = "deny"
|
|
unwrap_used = "deny"
|
|
|
|
# cargo-shear cannot see the platform-specific openssl-sys usage, so we
|
|
# silence the false positive here instead of deleting a real dependency.
|
|
[workspace.metadata.cargo-shear]
|
|
ignored = [
|
|
"icu_provider",
|
|
"openssl-sys",
|
|
"codex-utils-readiness",
|
|
"codex-utils-template",
|
|
"codex-v8-poc",
|
|
]
|
|
|
|
[profile.dev]
|
|
# Keep line tables/backtraces while avoiding expensive full variable debug info
|
|
# across local dev builds.
|
|
debug = 1
|
|
|
|
[profile.dev-small]
|
|
inherits = "dev"
|
|
opt-level = 0
|
|
debug = 0
|
|
strip = true
|
|
|
|
[profile.release]
|
|
lto = "fat"
|
|
split-debuginfo = "off"
|
|
# Because we bundle some of these executables with the TypeScript CLI, we
|
|
# remove everything to make the binary as small as possible.
|
|
strip = "symbols"
|
|
|
|
# See https://github.com/openai/codex/issues/1411 for details.
|
|
codegen-units = 1
|
|
|
|
[profile.ci-test]
|
|
debug = 1 # Reduce debug symbol size
|
|
inherits = "test"
|
|
opt-level = 0
|
|
|
|
[patch.crates-io]
|
|
# Uncomment to debug local changes.
|
|
# ratatui = { path = "../../ratatui" }
|
|
crossterm = { git = "https://github.com/nornagon/crossterm", rev = "87db8bfa6dc99427fd3b071681b07fc31c6ce995" }
|
|
ratatui = { git = "https://github.com/nornagon/ratatui", rev = "9b2ad1298408c45918ee9f8241a6f95498cdbed2" }
|
|
tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungstenite", rev = "132f5b39c862e3a970f731d709608b3e6276d5f6" }
|
|
tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }
|
|
|
|
# Uncomment to debug local changes.
|
|
# rmcp = { path = "../../rust-sdk/crates/rmcp" }
|
|
|
|
[patch."ssh://git@github.com/openai-oss-forks/tungstenite-rs.git"]
|
|
tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }
|