@openai/codex
Advanced tools
Sorry, the diff of this file is not supported yet
Sorry, the diff of this file is not supported yet
+12
-18
| { | ||
| "name": "@openai/codex", | ||
| "version": "0.113.0-alpha.1", | ||
| "version": "0.113.0-alpha.1-darwin-arm64", | ||
| "license": "Apache-2.0", | ||
| "bin": { | ||
| "codex": "bin/codex.js" | ||
| }, | ||
| "type": "module", | ||
| "engines": { | ||
| "node": ">=16" | ||
| }, | ||
| "os": [ | ||
| "darwin" | ||
| ], | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "files": [ | ||
| "bin" | ||
| "vendor" | ||
| ], | ||
@@ -20,11 +19,6 @@ "repository": { | ||
| }, | ||
| "packageManager": "pnpm@10.29.3+sha512.498e1fb4cca5aa06c1dcf2611e6fafc50972ffe7189998c409e90de74566444298ffe43e6cd2acdc775ba1aa7cc5e092a8b7054c811ba8c5770f84693d33d2dc", | ||
| "optionalDependencies": { | ||
| "@openai/codex-linux-x64": "npm:@openai/codex@0.113.0-alpha.1-linux-x64", | ||
| "@openai/codex-linux-arm64": "npm:@openai/codex@0.113.0-alpha.1-linux-arm64", | ||
| "@openai/codex-darwin-x64": "npm:@openai/codex@0.113.0-alpha.1-darwin-x64", | ||
| "@openai/codex-darwin-arm64": "npm:@openai/codex@0.113.0-alpha.1-darwin-arm64", | ||
| "@openai/codex-win32-x64": "npm:@openai/codex@0.113.0-alpha.1-win32-x64", | ||
| "@openai/codex-win32-arm64": "npm:@openai/codex@0.113.0-alpha.1-win32-arm64" | ||
| } | ||
| "engines": { | ||
| "node": ">=16" | ||
| }, | ||
| "packageManager": "pnpm@10.29.3+sha512.498e1fb4cca5aa06c1dcf2611e6fafc50972ffe7189998c409e90de74566444298ffe43e6cd2acdc775ba1aa7cc5e092a8b7054c811ba8c5770f84693d33d2dc" | ||
| } |
-229
| #!/usr/bin/env node | ||
| // Unified entry point for the Codex CLI. | ||
| import { spawn } from "node:child_process"; | ||
| import { existsSync } from "fs"; | ||
| import { createRequire } from "node:module"; | ||
| import path from "path"; | ||
| import { fileURLToPath } from "url"; | ||
| // __dirname equivalent in ESM | ||
| const __filename = fileURLToPath(import.meta.url); | ||
| const __dirname = path.dirname(__filename); | ||
| const require = createRequire(import.meta.url); | ||
| const PLATFORM_PACKAGE_BY_TARGET = { | ||
| "x86_64-unknown-linux-musl": "@openai/codex-linux-x64", | ||
| "aarch64-unknown-linux-musl": "@openai/codex-linux-arm64", | ||
| "x86_64-apple-darwin": "@openai/codex-darwin-x64", | ||
| "aarch64-apple-darwin": "@openai/codex-darwin-arm64", | ||
| "x86_64-pc-windows-msvc": "@openai/codex-win32-x64", | ||
| "aarch64-pc-windows-msvc": "@openai/codex-win32-arm64", | ||
| }; | ||
| const { platform, arch } = process; | ||
| let targetTriple = null; | ||
| switch (platform) { | ||
| case "linux": | ||
| case "android": | ||
| switch (arch) { | ||
| case "x64": | ||
| targetTriple = "x86_64-unknown-linux-musl"; | ||
| break; | ||
| case "arm64": | ||
| targetTriple = "aarch64-unknown-linux-musl"; | ||
| break; | ||
| default: | ||
| break; | ||
| } | ||
| break; | ||
| case "darwin": | ||
| switch (arch) { | ||
| case "x64": | ||
| targetTriple = "x86_64-apple-darwin"; | ||
| break; | ||
| case "arm64": | ||
| targetTriple = "aarch64-apple-darwin"; | ||
| break; | ||
| default: | ||
| break; | ||
| } | ||
| break; | ||
| case "win32": | ||
| switch (arch) { | ||
| case "x64": | ||
| targetTriple = "x86_64-pc-windows-msvc"; | ||
| break; | ||
| case "arm64": | ||
| targetTriple = "aarch64-pc-windows-msvc"; | ||
| break; | ||
| default: | ||
| break; | ||
| } | ||
| break; | ||
| default: | ||
| break; | ||
| } | ||
| if (!targetTriple) { | ||
| throw new Error(`Unsupported platform: ${platform} (${arch})`); | ||
| } | ||
| const platformPackage = PLATFORM_PACKAGE_BY_TARGET[targetTriple]; | ||
| if (!platformPackage) { | ||
| throw new Error(`Unsupported target triple: ${targetTriple}`); | ||
| } | ||
| const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex"; | ||
| const localVendorRoot = path.join(__dirname, "..", "vendor"); | ||
| const localBinaryPath = path.join( | ||
| localVendorRoot, | ||
| targetTriple, | ||
| "codex", | ||
| codexBinaryName, | ||
| ); | ||
| let vendorRoot; | ||
| try { | ||
| const packageJsonPath = require.resolve(`${platformPackage}/package.json`); | ||
| vendorRoot = path.join(path.dirname(packageJsonPath), "vendor"); | ||
| } catch { | ||
| if (existsSync(localBinaryPath)) { | ||
| vendorRoot = localVendorRoot; | ||
| } else { | ||
| const packageManager = detectPackageManager(); | ||
| const updateCommand = | ||
| packageManager === "bun" | ||
| ? "bun install -g @openai/codex@latest" | ||
| : "npm install -g @openai/codex@latest"; | ||
| throw new Error( | ||
| `Missing optional dependency ${platformPackage}. Reinstall Codex: ${updateCommand}`, | ||
| ); | ||
| } | ||
| } | ||
| if (!vendorRoot) { | ||
| const packageManager = detectPackageManager(); | ||
| const updateCommand = | ||
| packageManager === "bun" | ||
| ? "bun install -g @openai/codex@latest" | ||
| : "npm install -g @openai/codex@latest"; | ||
| throw new Error( | ||
| `Missing optional dependency ${platformPackage}. Reinstall Codex: ${updateCommand}`, | ||
| ); | ||
| } | ||
| const archRoot = path.join(vendorRoot, targetTriple); | ||
| const binaryPath = path.join(archRoot, "codex", codexBinaryName); | ||
| // Use an asynchronous spawn instead of spawnSync so that Node is able to | ||
| // respond to signals (e.g. Ctrl-C / SIGINT) while the native binary is | ||
| // executing. This allows us to forward those signals to the child process | ||
| // and guarantees that when either the child terminates or the parent | ||
| // receives a fatal signal, both processes exit in a predictable manner. | ||
| function getUpdatedPath(newDirs) { | ||
| const pathSep = process.platform === "win32" ? ";" : ":"; | ||
| const existingPath = process.env.PATH || ""; | ||
| const updatedPath = [ | ||
| ...newDirs, | ||
| ...existingPath.split(pathSep).filter(Boolean), | ||
| ].join(pathSep); | ||
| return updatedPath; | ||
| } | ||
| /** | ||
| * Use heuristics to detect the package manager that was used to install Codex | ||
| * in order to give the user a hint about how to update it. | ||
| */ | ||
| function detectPackageManager() { | ||
| const userAgent = process.env.npm_config_user_agent || ""; | ||
| if (/\bbun\//.test(userAgent)) { | ||
| return "bun"; | ||
| } | ||
| const execPath = process.env.npm_execpath || ""; | ||
| if (execPath.includes("bun")) { | ||
| return "bun"; | ||
| } | ||
| if ( | ||
| __dirname.includes(".bun/install/global") || | ||
| __dirname.includes(".bun\\install\\global") | ||
| ) { | ||
| return "bun"; | ||
| } | ||
| return userAgent ? "npm" : null; | ||
| } | ||
| const additionalDirs = []; | ||
| const pathDir = path.join(archRoot, "path"); | ||
| if (existsSync(pathDir)) { | ||
| additionalDirs.push(pathDir); | ||
| } | ||
| const updatedPath = getUpdatedPath(additionalDirs); | ||
| const env = { ...process.env, PATH: updatedPath }; | ||
| const packageManagerEnvVar = | ||
| detectPackageManager() === "bun" | ||
| ? "CODEX_MANAGED_BY_BUN" | ||
| : "CODEX_MANAGED_BY_NPM"; | ||
| env[packageManagerEnvVar] = "1"; | ||
| const child = spawn(binaryPath, process.argv.slice(2), { | ||
| stdio: "inherit", | ||
| env, | ||
| }); | ||
| child.on("error", (err) => { | ||
| // Typically triggered when the binary is missing or not executable. | ||
| // Re-throwing here will terminate the parent with a non-zero exit code | ||
| // while still printing a helpful stack trace. | ||
| // eslint-disable-next-line no-console | ||
| console.error(err); | ||
| process.exit(1); | ||
| }); | ||
| // Forward common termination signals to the child so that it shuts down | ||
| // gracefully. In the handler we temporarily disable the default behavior of | ||
| // exiting immediately; once the child has been signaled we simply wait for | ||
| // its exit event which will in turn terminate the parent (see below). | ||
| const forwardSignal = (signal) => { | ||
| if (child.killed) { | ||
| return; | ||
| } | ||
| try { | ||
| child.kill(signal); | ||
| } catch { | ||
| /* ignore */ | ||
| } | ||
| }; | ||
| ["SIGINT", "SIGTERM", "SIGHUP"].forEach((sig) => { | ||
| process.on(sig, () => forwardSignal(sig)); | ||
| }); | ||
| // When the child exits, mirror its termination reason in the parent so that | ||
| // shell scripts and other tooling observe the correct exit status. | ||
| // Wrap the lifetime of the child process in a Promise so that we can await | ||
| // its termination in a structured way. The Promise resolves with an object | ||
| // describing how the child exited: either via exit code or due to a signal. | ||
| const childResult = await new Promise((resolve) => { | ||
| child.on("exit", (code, signal) => { | ||
| if (signal) { | ||
| resolve({ type: "signal", signal }); | ||
| } else { | ||
| resolve({ type: "code", exitCode: code ?? 1 }); | ||
| } | ||
| }); | ||
| }); | ||
| if (childResult.type === "signal") { | ||
| // Re-emit the same signal so that the parent terminates with the expected | ||
| // semantics (this also sets the correct exit code of 128 + n). | ||
| process.kill(process.pid, childResult.signal); | ||
| } else { | ||
| process.exit(childResult.exitCode); | ||
| } |
Sorry, the diff of this file is not supported yet
Empty package
Supply chain riskPackage does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.
Found 1 instance in 1 package
Native code
Supply chain riskContains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.
Found 1 instance in 1 package
Major refactor
Supply chain riskPackage has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 4 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
105966588
820900.91%0
-100%0
-100%0
-100%4
Infinity%No
NaN