From 8e3166681cbaa1987aca856ac317586d21b55995 Mon Sep 17 00:00:00 2001
From: Jeffery <jiantw83@yahoo.com>
Date: Wed, 24 Jun 2026 10:57:12 +0000
Subject: [PATCH] =?UTF-8?q?fix(Codex=20CLI):=20=E6=94=B9=E7=94=A8=20flock?=
 =?UTF-8?q?=20=E7=AE=A1=E7=90=86=20auth=20=E9=8E=96=E5=AE=9A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Dockerfile    | 10 +++++-----
 entrypoint.sh | 28 ++++++++++------------------
 2 files changed, 15 insertions(+), 23 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index dc7f435..7044671 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,13 @@
 FROM alpine:latest
 
-# 安裝必要的工具
-RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git jq
-
 # 設定安裝用的環境變數
 ENV CODEX_NON_INTERACTIVE=1
 ENV CODEX_INSTALL_DIR=/usr/local/bin
 ENV CODEX_HOME=/root/.codex
+ENV CODEX_PLUGINS="jsc@doc jsc@code-review"
+
+# 安裝必要的工具
+RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git jq util-linux
 
 # 安裝 Codex CLI 工具
 RUN install_script="$(mktemp)" \
@@ -18,9 +19,8 @@ RUN install_script="$(mktemp)" \
 
 # 安裝技能
 RUN codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/doc.git \
-    && codex plugin add jsc@doc \
     && codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/code-review.git \
-    && codex plugin add jsc@code-review
+    && for plugin in $CODEX_PLUGINS; do codex plugin add "$plugin"; done
 
 COPY entrypoint.sh /entrypoint.sh
 
diff --git a/entrypoint.sh b/entrypoint.sh
index af34afe..5b5f268 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -8,8 +8,7 @@ die() {
 }
 
 cleanup() {
-  rm -f "${auth_file:-}" "${auth_path:-}" "${codex_output:-}"
-  rmdir "${auth_lock:-}" 2>/dev/null || true
+  rm -f "${auth_file:-}" "${auth_path:-}" "${auth_lock:-}" "${codex_output:-}"
 }
 
 trap cleanup EXIT
@@ -29,9 +28,10 @@ umask 077
 
 auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
 auth_path="$CODEX_HOME/auth.json"
-auth_lock="$CODEX_HOME/auth.lock"
+auth_lock="$(mktemp "$CODEX_HOME/auth.lock.XXXXXX")"
 
-mkdir "$auth_lock" || die "Unable to lock Codex auth.json."
+exec 9>"$auth_lock"
+flock -n 9 || die "Unable to lock Codex auth.json."
 
 if ! printf '%s\n' "$OAUTH" | base64 -d > "$auth_file"; then
   die "OAUTH must be valid base64 encoded Codex auth.json."
@@ -50,22 +50,14 @@ rm -f "$auth_file"
 
 codex_output="$(mktemp)"
 
-run_codex() {
-  set +e
-  codex exec \
-    --dangerously-bypass-approvals-and-sandbox \
-    --skip-git-repo-check \
-    --model "$MODEL" \
-    "$PROMPT" 2>&1 | tee "$codex_output"
-  local status="${PIPESTATUS[0]}"
-  set -e
-  return "$status"
-}
-
-if run_codex; then
+if codex exec \
+  --dangerously-bypass-approvals-and-sandbox \
+  --skip-git-repo-check \
+  --model "$MODEL" \
+  "$PROMPT" 2>&1 | tee "$codex_output"; then
   codex_status=0
 else
-  codex_status="$?"
+  codex_status="${PIPESTATUS[0]}"
 fi
 
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then