mirror of
https://github.com/openai/codex.git
synced 2026-11-13 06:45:07 +00:00
johnl-oai
dcfcb570b2
## What changed - Add a client for the packaged Windows sandbox provisioning service that verifies the named-pipe server belongs to the running `CodexSandboxService` process before exchanging a versioned provisioning request. - Treat an absent, busy, timed-out, or disconnected service as unavailable while surfacing provisioning and authentication failures. - Send the complete `WindowsSandboxProvisioningSettings` and classify inherited HTTP and SOCKS proxy listeners separately for managed-policy validation. - Share bounded frame-readiness handling between runner and provisioning IPC. ## Testing - Extend proxy environment tests to cover network-enabled profiles, mixed HTTP and SOCKS listeners, explicit proxy-port overrides, case-insensitive schemes, and unclassified protocols. GitOrigin-RevId: 6ff6741fc3ecd76314a7a045523a8d7a7e7af686
73 lines
2.4 KiB
Rust
73 lines
2.4 KiB
Rust
//! Dedicated protocol exchanged with the Windows sandbox provisioning service.
|
|
|
|
use crate::WindowsSandboxProvisioningSettings;
|
|
use anyhow::Result;
|
|
use serde::Deserialize;
|
|
use serde::Serialize;
|
|
use std::io::Read;
|
|
use std::io::Write;
|
|
|
|
/// Protocol version shared by provisioning clients and the Windows service.
|
|
pub const PROVISIONING_PROTOCOL_VERSION: u8 = 1;
|
|
|
|
/// Named pipe used by the machine-wide Windows sandbox provisioning service.
|
|
pub const SANDBOX_PROVISIONING_PIPE_NAME: &str = r"\\.\pipe\OpenAI.CodexSandbox";
|
|
|
|
/// Versioned provisioning-service message carried in a length-prefixed JSON frame.
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
pub struct FramedProvisioningMessage {
|
|
pub version: u8,
|
|
#[serde(flatten)]
|
|
pub message: ProvisioningMessage,
|
|
}
|
|
|
|
/// Request and response messages exchanged with the provisioning service.
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
#[serde(tag = "type", rename_all = "snake_case")]
|
|
pub enum ProvisioningMessage {
|
|
ProvisionSandboxRequest {
|
|
payload: SandboxProvisioningRequest,
|
|
},
|
|
ProvisionSandboxResponse {
|
|
payload: SandboxProvisioningResponse,
|
|
},
|
|
}
|
|
|
|
/// Sandbox setup parameters sent to the provisioning service.
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct SandboxProvisioningRequest {
|
|
pub codex_home: String,
|
|
pub settings: WindowsSandboxProvisioningSettings,
|
|
pub listeners: WindowsSandboxProxyListeners,
|
|
}
|
|
|
|
/// Known proxy protocols used for managed-policy validation, separate from firewall settings.
|
|
#[derive(Clone, Debug, Default, Deserialize, Serialize, Eq, PartialEq)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct WindowsSandboxProxyListeners {
|
|
pub http_ports: Vec<u16>,
|
|
pub socks_ports: Vec<u16>,
|
|
}
|
|
|
|
/// Result returned by the sandbox provisioning service.
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
#[serde(tag = "status", rename_all = "snake_case")]
|
|
pub enum SandboxProvisioningResponse {
|
|
Ok,
|
|
Error { message: String },
|
|
}
|
|
|
|
/// Write a length-prefixed provisioning-service message.
|
|
pub fn write_provisioning_frame<W: Write>(
|
|
writer: W,
|
|
message: &FramedProvisioningMessage,
|
|
) -> Result<()> {
|
|
crate::framed_io::write_frame(writer, message)
|
|
}
|
|
|
|
/// Read a length-prefixed provisioning-service message, returning `None` on EOF.
|
|
pub fn read_provisioning_frame<R: Read>(reader: R) -> Result<Option<FramedProvisioningMessage>> {
|
|
crate::framed_io::read_frame(reader)
|
|
}
|