From d80854deae4ef36ca15cce11ceaf03fc32786ce3 Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Thu, 5 Nov 2026 11:36:46 +0800 Subject: [PATCH] Start the configured Codex worker during Foundry deployment --- README.md | 9 +++++---- deploy/release.sh | 11 +++++++++++ 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 017cc29..f797b83 100644 --- a/README.md +++ b/README.md @@ -51,10 +51,11 @@ On the deployment host, provision `/opt/endoleap-infra/foundry/codex` with: Keep this home dedicated to the worker. Supply the login only and keep user configuration, MCP servers, skills, and other workload files out of it. -Start the single worker with `bash deploy/codex-worker.sh /absolute/path/to/foundry` -using the Linux binary built by ces-control. To replace the worker, stop and remove -the existing `foundry-codex-worker` container first. The next normal Foundry -deployment mounts the worker socket and grants directory read-only. The worker +With that directory configured, the next normal Foundry deployment starts the +worker using the Linux binary built by ces-control and mounts the worker socket +and grants directory read-only. To replace an existing worker, stop and remove +its container, then run `bash deploy/codex-worker.sh /absolute/path/to/foundry` +with the desired ces-control build. The worker runs the installed Codex CLI with fixed read-only, no-approval arguments and disables command execution tools. It receives prompts via stdin and returns the final agent message. The worker has no published port and Foundry receives diff --git a/deploy/release.sh b/deploy/release.sh index fed1fd4..202127e 100644 --- a/deploy/release.sh +++ b/deploy/release.sh @@ -47,6 +47,13 @@ export HOST=0.0.0.0 PORT=8080 PUBLIC_ORIGIN="$origin" codex_mounts=() codex_dir=$foundry/codex if [[ -d "$codex_dir" ]]; then + if ! docker inspect -f '{{.State.Running}}' foundry-codex-worker 2>/dev/null | grep -qx true; then + bash "$(dirname "$0")/codex-worker.sh" "$release/foundry" >/dev/null + fi + for attempt in {1..20}; do + [[ ! -S "$codex_dir/run/worker.sock" ]] || break + sleep 0.25 + done test -S "$codex_dir/run/worker.sock" test -s "$codex_dir/grants/projects.json" codex_mounts=( @@ -87,6 +94,10 @@ docker exec "$candidate" node -e ' const project = Object.keys(JSON.parse(process.env.FOUNDRY_PROJECTS))[0]; const route = base + "/projects/" + encodeURIComponent(project) + "/auth"; assert.equal((await fetch(route + "/me")).status, 401); + if (process.env.FOUNDRY_CODEX_SOCKET) { + const exec = base + "/projects/" + encodeURIComponent(project) + "/codex/exec"; + assert.equal((await fetch(exec, {method: "POST"})).status, 401); + } } verify().catch(() => { console.error("Foundry readiness or anonymous access check failed"); process.exit(1); }); '