host
5827716a3a
1. Worker _fallback_token correction: real host.py never returns status='404'; a failed turn is status='failed' with the real error (e.g. '404 model not found') in text/error. The old code returned host_status verbatim, so 'failed' blocked every real fallback and the old event-only branch did too. Now: if host_status itself is a fallbackable code it is used; otherwise the code is extracted from turn JSON text/error, stdout, stderr or runner error, and 'failed' alone never counts as a signal. Tests: failed-turn JSON with 404 in text falls back and succeeds; with 401 it never falls back. 2. Docker config codex_home: /var/lib/codex-app-server/codex-home, mounted at the same path into the container, is the only home that holds the real relay config (xcmapi provider, base_url, env_key). Pointing codex_home at a fresh empty dir made codex POST to api.openai.com with no auth header and loop on connect timeouts until host.py's 600s turn timeout. The /app/work codex-home from PR #17 was necessary to get past initialize but insufficient for a real turn; this replaces it.
1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"_note": "Docker 执行器专用配置（容器内路径，绝不是宿主路径）：state 必须用相对路径 work/host-state.json——相对配置文件所在目录 /app 解析，得到 /app/work/host-state.json，经额外挂载落到宿主 /opt/codex-app-server/work/host-state.json，属主是 codexsvc（uid 1003，与容器 --user 1003:1004 一致），容器可写。绝不能用默认的 /app/host-state.json（/app 是只读挂载，锁一开就报 Read-only file system），也绝不能用 /work/host-state.json（/work 挂载的宿主目录由 docker 自动创建、属主 root，容器用户写不进去，同样 1 秒内失败）。此文件曾因 deploy 清理被删过（不在仓库里），导致 Docker 派发静默全灭，所以它必须进仓库、随部署一起发。sandbox 用 danger-full-access：主机内核禁止不可信 user namespace，Docker + 内层 bwrap 双重沙箱不可行，生产隔离层就是 Docker 本身。API key 绝不放这里，只走环境变量。 默认仓库是宿主测试仓库：没有 repo_url 的项目走它；有 repo_url 的项目 worker 会把解析出的检出经 --repo 传进去，覆盖它。 codex_home 必须指到 /var/lib/codex-app-server/codex-home（经额外挂载同路径进容器）：那里才有真正的 relay 配置（model_provider xcmapi、base_url、env_key），容器 codex 靠它才知道走 relay；指到空目录会让 codex 直接去 api.openai.com 且无 auth，turn 在连接超时里循环重试直到 host.py 600 秒超时。/var/lib 挂载属主是 codexsvc（uid 1003，与容器 --user 一致），可写。", "approval": "deny", "approval_policy": "never", "effort": "low", "model": "gpt-6.1-sol", "sandbox": "danger-full-access", "state": "work/host-state.json", "repo": "/var/lib/codex-app-server/test-repo", "codex_home": "/var/lib/codex-app-server/codex-home"} |