mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Anton Panasenko
c274a83f8b
## Why
Codex can run a remote exec server through the Noise relay, but the
normal
environment-manager path could not establish an
environment-registry-backed
harness connection. Signed rendezvous URLs and harness authorizations
are
short-lived, so reconnects must fetch a fresh bundle instead of
retaining
stale connection credentials. A stalled registry request must also fail
within
the regular remote connection deadline, without exposing these
credentials in
debug logs.
Issue: N/A (internal environment-service integration).
## What Changed
- Add environment-manager configuration for a registry-backed Noise
rendezvous
environment.
- Request a fresh bundle from
`/cloud/environment/{environment_id}/connect` for every physical harness
connection, using the existing 10-second remote connection timeout.
- Share the Environment Registry register, connect, and validate wire
payloads
through `codex-exec-server` and `codex-core-api`.
- Redact the signed rendezvous URL and harness authorization from the
public
connect response's `Debug` output.
- Add focused coverage for registry bundle retrieval, stalled requests,
and
credential redaction.
69 lines
2.5 KiB
Rust
69 lines
2.5 KiB
Rust
use serde::Deserialize;
|
|
use serde::Serialize;
|
|
|
|
use crate::NoiseChannelPublicKey;
|
|
|
|
/// Request body for registering an executor with the environment registry.
|
|
#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
|
|
pub struct EnvironmentRegistryRegistrationRequest {
|
|
pub security_profile: String,
|
|
pub executor_public_key: NoiseChannelPublicKey,
|
|
}
|
|
|
|
/// Environment registry response returned after executor registration.
|
|
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
|
|
pub struct EnvironmentRegistryRegistrationResponse {
|
|
pub environment_id: String,
|
|
pub url: String,
|
|
pub security_profile: String,
|
|
pub executor_registration_id: String,
|
|
}
|
|
|
|
/// Request body for connecting a harness key with the environment registry.
|
|
#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
|
|
pub struct EnvironmentRegistryConnectRequest {
|
|
pub harness_public_key: NoiseChannelPublicKey,
|
|
}
|
|
|
|
/// Environment registry response returned after connecting a harness key.
|
|
#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
|
|
pub struct EnvironmentRegistryConnectResponse {
|
|
pub environment_id: String,
|
|
pub url: String,
|
|
pub security_profile: String,
|
|
pub executor_registration_id: String,
|
|
pub executor_public_key: NoiseChannelPublicKey,
|
|
pub harness_key_authorization: String,
|
|
}
|
|
|
|
impl std::fmt::Debug for EnvironmentRegistryConnectResponse {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.debug_struct("EnvironmentRegistryConnectResponse")
|
|
.field("environment_id", &self.environment_id)
|
|
.field("url", &"<redacted>")
|
|
.field("security_profile", &self.security_profile)
|
|
.field("executor_registration_id", &self.executor_registration_id)
|
|
.field("executor_public_key", &self.executor_public_key)
|
|
.field("harness_key_authorization", &"<redacted>")
|
|
.finish()
|
|
}
|
|
}
|
|
|
|
/// Request body for authorizing a harness key with the environment registry.
|
|
#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
|
|
pub struct EnvironmentRegistryHarnessKeyValidationRequest {
|
|
pub executor_registration_id: String,
|
|
pub harness_public_key: NoiseChannelPublicKey,
|
|
pub harness_key_authorization: String,
|
|
}
|
|
|
|
/// Environment registry response returned after harness key validation.
|
|
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
|
|
pub struct EnvironmentRegistryHarnessKeyValidationResponse {
|
|
pub valid: bool,
|
|
}
|
|
|
|
#[cfg(test)]
|
|
#[path = "environment_registry_tests.rs"]
|
|
mod tests;
|