codex/app/main.js

#!/usr/bin/env node

const fs = require("fs");
const path = require("path");
const crypto = require("crypto");
const { spawn } = require("child_process");

const DEFAULT_PROMPT = "請自我介紹";
const FILE_MODE_PRIVATE = 0o600;
const DIR_MODE_PRIVATE = 0o700;
const DEFAULT_CODEX_TIMEOUT_MS = 30 * 60 * 1000;
const DEFAULT_OUTPUT_LIMIT_BYTES = 1024 * 1024;

class TempFileRegistry {
  constructor() {
    this.files = new Set();
    this.dirs = new Set();
  }

  trackFile(filePath) {
    this.files.add(filePath);
  }

  trackDir(dirPath) {
    this.dirs.add(dirPath);
  }

  removeFile(filePath) {
    if (!filePath || !this.files.has(filePath)) {
      return;
    }

    try {
      fs.rmSync(filePath, { force: true });
      this.files.delete(filePath);
    } catch (error) {
      console.error(`Unable to remove temporary file: ${error.message}`);
    }
  }

  cleanup() {
    for (const filePath of Array.from(this.files).reverse()) {
      this.removeFile(filePath);
    }

    for (const dirPath of Array.from(this.dirs).reverse()) {
      try {
        fs.rmSync(dirPath, { force: true, recursive: true });
        this.dirs.delete(dirPath);
      } catch (error) {
        console.error(`Unable to remove temporary directory: ${error.message}`);
      }
    }
  }
}

const tempFiles = new TempFileRegistry();

function cleanup() {
  tempFiles.cleanup();
}

function makeTempDir(dir) {
  const tempDir = fs.mkdtempSync(path.join(dir, ".codex-action-"));
  fs.chmodSync(tempDir, DIR_MODE_PRIVATE);
  tempFiles.trackDir(tempDir);
  return tempDir;
}

function makeTempFile(dir, prefix) {
  const random = crypto.randomBytes(16).toString("hex");
  const filePath = path.join(dir, `${prefix}.${random}`);
  const fd = fs.openSync(filePath, "wx", FILE_MODE_PRIVATE);
  fs.closeSync(fd);
  tempFiles.trackFile(filePath);
  return filePath;
}

function appendGithubOutput(status, output) {
  const outputFile = process.env.GITHUB_OUTPUT;
  if (!outputFile) {
    return;
  }

  let delimiter;
  do {
    delimiter = `CODEX_OUTPUT_${crypto.randomBytes(12).toString("hex")}`;
  } while (output.includes(delimiter));

  fs.appendFileSync(
    outputFile,
    `status=${status}\noutput<<${delimiter}\n${output}${output.endsWith("\n") ? "" : "\n"}${delimiter}\n`,
    { encoding: "utf8", mode: FILE_MODE_PRIVATE },
  );
}

function fail(message, code = 1) {
  console.error(message);
  appendGithubOutput("failed", message);
  cleanup();
  process.exit(code);
}

function validateAuth(encodedAuth, authFile) {
  const normalizedAuth = encodedAuth.replace(/\s+/g, "");
  const decoded = Buffer.from(encodedAuth, "base64");
  const normalizedDecoded = decoded.toString("base64").replace(/=+$/, "");
  const normalizedInput = normalizedAuth.replace(/=+$/, "");

  if (decoded.length === 0 && normalizedAuth.length > 0) {
    fail("OAUTH must be valid base64 encoded Codex auth.json.");
  }

  if (normalizedDecoded !== normalizedInput) {
    fail("OAUTH must be valid base64 encoded Codex auth.json.");
  }

  fs.writeFileSync(authFile, decoded, { mode: FILE_MODE_PRIVATE });

  let parsed;
  try {
    parsed = JSON.parse(decoded.toString("utf8"));
  } catch {
    fail("Decoded OAUTH must be a JSON object.");
  }

  if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") {
    fail("Decoded OAUTH must be a JSON object.");
  }
}

function parsePositiveInteger(value, fallback) {
  const parsed = Number.parseInt(value || "", 10);
  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
}

function truncateOutput(chunks, nextChunk, maxBytes) {
  const currentSize = chunks.reduce((total, chunk) => total + chunk.length, 0);
  const available = maxBytes - currentSize;

  if (available <= 0) {
    return false;
  }

  chunks.push(nextChunk.length > available ? nextChunk.subarray(0, available) : nextChunk);
  return nextChunk.length <= available;
}

function runCodex(model, prompt) {
  return new Promise((resolve) => {
    const timeoutMs = parsePositiveInteger(process.env.CODEX_TIMEOUT_MS, DEFAULT_CODEX_TIMEOUT_MS);
    const outputLimitBytes = parsePositiveInteger(process.env.CODEX_OUTPUT_LIMIT_BYTES, DEFAULT_OUTPUT_LIMIT_BYTES);
    const workspace = process.env.GITHUB_WORKSPACE || process.cwd();

    // This Docker Action runs inside an ephemeral CI container where Codex must be
    // able to edit the checked-out workspace without interactive approvals.
    const child = spawn(
      "codex",
      [
        "exec",
        "--dangerously-bypass-approvals-and-sandbox",
        "--skip-git-repo-check",
        "--model",
        model,
        prompt,
      ],
      { cwd: workspace, stdio: ["ignore", "pipe", "pipe"] },
    );

    const outputChunks = [];
    let outputTruncated = false;
    const appendOutput = (chunk) => {
      if (!truncateOutput(outputChunks, chunk, outputLimitBytes)) {
        outputTruncated = true;
      }
      return Buffer.concat(outputChunks).toString();
    };

    const timeout = setTimeout(() => {
      child.kill("SIGTERM");
      appendOutput(Buffer.from(`Codex execution timed out after ${timeoutMs} ms.\n`));
    }, timeoutMs);

    child.stdout.pipe(process.stdout);
    child.stderr.pipe(process.stdout);

    child.stdout.on("data", (chunk) => {
      if (!truncateOutput(outputChunks, chunk, outputLimitBytes)) {
        outputTruncated = true;
      }
    });

    child.stderr.on("data", (chunk) => {
      if (!truncateOutput(outputChunks, chunk, outputLimitBytes)) {
        outputTruncated = true;
      }
    });

    child.on("error", (error) => {
      clearTimeout(timeout);
      const output = appendOutput(Buffer.from(`${error.message}\n`));
      resolve({ status: 1, output });
    });

    child.on("close", (code) => {
      clearTimeout(timeout);
      const truncationMessage = outputTruncated ? "\n[Output truncated]\n" : "";
      const output = `${Buffer.concat(outputChunks).toString()}${truncationMessage}`;
      resolve({ status: code ?? 1, output });
    });
  });
}

function registerCleanupHandlers() {
  process.on("exit", cleanup);
  process.on("SIGINT", () => {
    cleanup();
    process.exit(130);
  });
  process.on("SIGTERM", () => {
    cleanup();
    process.exit(143);
  });
}

function readConfig() {
  const oauth = process.env.OAUTH || "";
  const model = process.env.MODEL || "";
  const codexHome = process.env.CODEX_HOME || "/root/.codex";
  const prompt = process.env.PROMPT || DEFAULT_PROMPT;

  if (!oauth) {
    fail("OAUTH is required: provide base64 encoded Codex auth.json.");
  }

  if (!model) {
    fail("MODEL is required.");
  }

  return { oauth, model, codexHome, prompt };
}

function setupAuth(oauth, codexHome) {
  try {
    fs.mkdirSync(codexHome, { recursive: true, mode: DIR_MODE_PRIVATE });
  } catch {
    fail("Unable to create CODEX_HOME.");
  }

  const tempDir = makeTempDir(codexHome);
  const authFile = makeTempFile(tempDir, "auth");
  const authPath = path.join(codexHome, "auth.json");
  const lockName = crypto.createHash("sha256").update(codexHome).digest("hex");
  const lockPath = path.join(codexHome, `.codex-auth-${lockName}.lock`);

  let lockHandle;
  try {
    lockHandle = fs.openSync(lockPath, "wx", FILE_MODE_PRIVATE);
    tempFiles.trackFile(lockPath);
  } catch {
    fail("Unable to lock Codex auth.json.");
  }

  validateAuth(oauth, authFile);

  if (fs.existsSync(authPath)) {
    fail("Refusing to overwrite existing Codex auth.json.");
  }

  fs.renameSync(authFile, authPath);
  fs.chmodSync(authPath, FILE_MODE_PRIVATE);
  tempFiles.trackFile(authPath);

  return lockHandle;
}

async function runCodexAction({ oauth, model, codexHome, prompt }) {
  const lockHandle = setupAuth(oauth, codexHome);
  const result = await runCodex(model, prompt);
  appendGithubOutput(result.status === 0 ? "completed" : "failed", result.output);

  if (lockHandle !== undefined) {
    fs.closeSync(lockHandle);
  }

  cleanup();
  process.exit(result.status);
}

async function main() {
  registerCleanupHandlers();
  await runCodexAction(readConfig());
}

main().catch((error) => {
  fail(error instanceof Error ? error.message : String(error));
});