Zayden-Jung/foundry-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Start the configured Codex worker during Foundry deployment

Browse Source
This commit is contained in:
Codex Bot
2026-11-05 11:36:46 +08:00
parent 9e5d805f5a
commit d80854deae
2 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -4
View File
@@ -51,10 +51,11 @@ On the deployment host, provision `/opt/endoleap-infra/foundry/codex` with:
Keep this home dedicated to the worker. Supply the login only and keep user
configuration, MCP servers, skills, and other workload files out of it.
Start the single worker with `bash deploy/codex-worker.sh /absolute/path/to/foundry`
using the Linux binary built by ces-control. To replace the worker, stop and remove
the existing `foundry-codex-worker` container first. The next normal Foundry
deployment mounts the worker socket and grants directory read-only. The worker
With that directory configured, the next normal Foundry deployment starts the
worker using the Linux binary built by ces-control and mounts the worker socket
and grants directory read-only. To replace an existing worker, stop and remove
its container, then run `bash deploy/codex-worker.sh /absolute/path/to/foundry`
with the desired ces-control build. The worker
runs the installed Codex CLI with fixed read-only, no-approval arguments and
disables command execution tools. It receives prompts via stdin and returns
the final agent message. The worker has no published port and Foundry receives
deploy/release.sh
+11
View File
@@ -47,6 +47,13 @@ export HOST=0.0.0.0 PORT=8080 PUBLIC_ORIGIN="$origin"
codex_mounts=()
codex_dir=$foundry/codex
if [[ -d "$codex_dir" ]]; then
if ! docker inspect -f '{{.State.Running}}' foundry-codex-worker 2>/dev/null | grep -qx true; then
bash "$(dirname "$0")/codex-worker.sh" "$release/foundry" >/dev/null
fi
for attempt in {1..20}; do
[[ ! -S "$codex_dir/run/worker.sock" ]] || break
sleep 0.25
done
test -S "$codex_dir/run/worker.sock"
test -s "$codex_dir/grants/projects.json"
codex_mounts=(
@@ -87,6 +94,10 @@ docker exec "$candidate" node -e '
const project = Object.keys(JSON.parse(process.env.FOUNDRY_PROJECTS))[0];
const route = base + "/projects/" + encodeURIComponent(project) + "/auth";
assert.equal((await fetch(route + "/me")).status, 401);
if (process.env.FOUNDRY_CODEX_SOCKET) {
const exec = base + "/projects/" + encodeURIComponent(project) + "/codex/exec";
assert.equal((await fetch(exec, {method: "POST"})).status, 401);
}
}
verify().catch(() => { console.error("Foundry readiness or anonymous access check failed"); process.exit(1); });
'