fix(Codex CLI): 改用 flock 管理 auth 鎖定

entrypoint.sh

@@ -8,8 +8,7 @@ die() {
 }
 
 cleanup() {
-  rm -f "${auth_file:-}" "${auth_path:-}" "${codex_output:-}"
-  rmdir "${auth_lock:-}" 2>/dev/null || true
+  rm -f "${auth_file:-}" "${auth_path:-}" "${auth_lock:-}" "${codex_output:-}"
 }
 
 trap cleanup EXIT
@@ -29,9 +28,10 @@ umask 077
 
 auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
 auth_path="$CODEX_HOME/auth.json"
-auth_lock="$CODEX_HOME/auth.lock"
+auth_lock="$(mktemp "$CODEX_HOME/auth.lock.XXXXXX")"
 
-mkdir "$auth_lock" || die "Unable to lock Codex auth.json."
+exec 9>"$auth_lock"
+flock -n 9 || die "Unable to lock Codex auth.json."
 
 if ! printf '%s\n' "$OAUTH" | base64 -d > "$auth_file"; then
   die "OAUTH must be valid base64 encoded Codex auth.json."
@@ -50,22 +50,14 @@ rm -f "$auth_file"
 
 codex_output="$(mktemp)"
 
-run_codex() {
-  set +e
-  codex exec \
-    --dangerously-bypass-approvals-and-sandbox \
-    --skip-git-repo-check \
-    --model "$MODEL" \
-    "$PROMPT" 2>&1 | tee "$codex_output"
-  local status="${PIPESTATUS[0]}"
-  set -e
-  return "$status"
-}
-
-if run_codex; then
+if codex exec \
+  --dangerously-bypass-approvals-and-sandbox \
+  --skip-git-repo-check \
+  --model "$MODEL" \
+  "$PROMPT" 2>&1 | tee "$codex_output"; then
   codex_status=0
 else
-  codex_status="$?"
+  codex_status="${PIPESTATUS[0]}"
 fi
 
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then