fix(Codex CLI): 改用 flock 管理 auth 鎖定

Dockerfile

@@ -1,12 +1,13 @@
 FROM alpine:latest
 
-# 安裝必要的工具
-RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git jq
-
 # 設定安裝用的環境變數
 ENV CODEX_NON_INTERACTIVE=1
 ENV CODEX_INSTALL_DIR=/usr/local/bin
 ENV CODEX_HOME=/root/.codex
+ENV CODEX_PLUGINS="jsc@doc jsc@code-review"
+
+# 安裝必要的工具
+RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git jq util-linux
 
 # 安裝 Codex CLI 工具
 RUN install_script="$(mktemp)" \
@@ -18,9 +19,8 @@ RUN install_script="$(mktemp)" \
 
 # 安裝技能
 RUN codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/doc.git \
-    && codex plugin add jsc@doc \
     && codex plugin marketplace add https://gitea.jsc.idv.tw/plugins/code-review.git \
-    && codex plugin add jsc@code-review
+    && for plugin in $CODEX_PLUGINS; do codex plugin add "$plugin"; done
 
 COPY entrypoint.sh /entrypoint.sh
 

entrypoint.sh

@@ -8,8 +8,7 @@ die() {
 }
 
 cleanup() {
-  rm -f "${auth_file:-}" "${auth_path:-}" "${codex_output:-}"
+  rm -f "${auth_file:-}" "${auth_path:-}" "${auth_lock:-}" "${codex_output:-}"
-  rmdir "${auth_lock:-}" 2>/dev/null || true
 }
 
 trap cleanup EXIT
@@ -29,9 +28,10 @@ umask 077
 
 auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
 auth_path="$CODEX_HOME/auth.json"
-auth_lock="$CODEX_HOME/auth.lock"
+auth_lock="$(mktemp "$CODEX_HOME/auth.lock.XXXXXX")"
 
-mkdir "$auth_lock" || die "Unable to lock Codex auth.json."
+exec 9>"$auth_lock"
+flock -n 9 || die "Unable to lock Codex auth.json."
 
 if ! printf '%s\n' "$OAUTH" | base64 -d > "$auth_file"; then
   die "OAUTH must be valid base64 encoded Codex auth.json."
@@ -50,22 +50,14 @@ rm -f "$auth_file"
 
 codex_output="$(mktemp)"
 
-run_codex() {
+if codex exec \
-  set +e
-  codex exec \
   --dangerously-bypass-approvals-and-sandbox \
   --skip-git-repo-check \
   --model "$MODEL" \
-    "$PROMPT" 2>&1 | tee "$codex_output"
+  "$PROMPT" 2>&1 | tee "$codex_output"; then
-  local status="${PIPESTATUS[0]}"
-  set -e
-  return "$status"
-}
-
-if run_codex; then
   codex_status=0
 else
-  codex_status="$?"
+  codex_status="${PIPESTATUS[0]}"
 fi
 
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then