From 6e771e2e5233b6e53a5e226f844e7d7df61ba186 Mon Sep 17 00:00:00 2001
From: Jeffery <h3285@evertrust.com.tw>
Date: Mon, 29 Jun 2026 12:48:48 +0800
Subject: [PATCH] =?UTF-8?q?fix(codex):=20=E6=94=B9=E7=94=A8=20codex=20app-?=
 =?UTF-8?q?server=20account/read=20=E5=8F=96=E5=BE=97=E7=99=BB=E5=85=A5?=
 =?UTF-8?q?=E5=B8=B3=E8=99=9F=20email=20=E9=A9=97=E8=AD=89=E8=BA=AB?=
 =?UTF-8?q?=E5=88=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

不解析本地 OAuth token，改透過 codex 自身的 app-server JSON-RPC
account/read（即 TUI /status 的 Account 來源）取得登入帳號 email，
新增 email output；CI 以 steps.codex.outputs.email 比對 vars.CODEX_EMAIL
確認是正確帳號。codex exec 仍保留以確保 token 實際有效。
---
 .gitea/workflows/ci.yaml |  4 ++--
 action.yml               | 45 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 6b8066b..373af0d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -30,6 +30,6 @@ jobs:
       with:
         oauth: ${{ secrets.CODEX_OAUTH }}
         prompt: "請自我介紹"
-    - name: 檢查登入
-      if: ${{ steps.codex.outputs.text == '' }}
+    - name: 檢查登入帳號
+      if: ${{ steps.codex.outputs.email != vars.CODEX_EMAIL }}
       run: exit 1
diff --git a/action.yml b/action.yml
index 78beab2..51f1987 100644
--- a/action.yml
+++ b/action.yml
@@ -13,6 +13,9 @@ outputs:
   text:
     description: '輸出的文字'
     value: ${{ steps.codex.outputs.text }}
+  email:
+    description: '目前登入帳號的電子郵件（由 codex app-server account/read 取得）'
+    value: ${{ steps.account.outputs.email }}
 runs:
   using: 'composite'
   steps:
@@ -46,3 +49,45 @@ runs:
         echo 'CODEX_OUTPUT'
       } >> "$GITHUB_OUTPUT"
     shell: bash
+  - name: 取得登入帳號
+    id: account
+    run: |
+      cat > "$RUNNER_TEMP/codex_account.py" <<'PY'
+      import json, subprocess, time
+
+      p = subprocess.Popen(
+          ["codex", "app-server"],
+          stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+          stderr=subprocess.DEVNULL, text=True, bufsize=1,
+      )
+
+      def send(obj):
+          p.stdin.write(json.dumps(obj) + "\n")
+          p.stdin.flush()
+
+      send({"jsonrpc": "2.0", "id": 1, "method": "initialize",
+            "params": {"clientInfo": {"name": "ci", "version": "1.0"}}})
+      send({"jsonrpc": "2.0", "method": "initialized", "params": {}})
+      send({"jsonrpc": "2.0", "id": 2, "method": "account/read", "params": {}})
+
+      email = ""
+      deadline = time.time() + 25
+      while time.time() < deadline:
+          line = p.stdout.readline()
+          if not line:
+              break
+          try:
+              msg = json.loads(line)
+          except Exception:
+              continue
+          if msg.get("id") == 2:
+              account = (msg.get("result") or {}).get("account") or {}
+              email = account.get("email") or ""
+              break
+
+      p.terminate()
+      print(email)
+      PY
+      email="$(python3 "$RUNNER_TEMP/codex_account.py")"
+      printf 'email=%s\n' "$email" >> "$GITHUB_OUTPUT"
+    shell: bash