fix(Codex CLI): 強化認證驗證與安全執行

entrypoint.sh

@@ -15,11 +15,28 @@ fi
 CODEX_HOME="${CODEX_HOME:-/root/.codex}"
 PROMPT="${PROMPT:-請自我介紹}"
 mkdir -p "$CODEX_HOME"
-printf '%s' "$OAUTH" | base64 -d > "$CODEX_HOME/auth.json"
-chmod 600 "$CODEX_HOME/auth.json"
 
-codex exec --dangerously-bypass-approvals-and-sandbox --model "$MODEL" "$PROMPT"
+auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
+trap 'rm -f "$auth_file"' EXIT
+
+if ! printf '%s' "$OAUTH" | base64 -d > "$auth_file"; then
+  echo "OAUTH must be valid base64 encoded Codex auth.json." >&2
+  exit 1
+fi
+
+if ! jq -e 'type == "object"' "$auth_file" >/dev/null; then
+  echo "Decoded OAUTH must be a JSON object." >&2
+  exit 1
+fi
+
+mv "$auth_file" "$CODEX_HOME/auth.json"
+chmod 600 "$CODEX_HOME/auth.json"
+trap - EXIT
+
+codex exec \
+  --model "$MODEL" \
+  "$PROMPT"
 
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  echo "text=completed" >> "$GITHUB_OUTPUT"
+  echo "status=completed" >> "$GITHUB_OUTPUT"
 fi