Update entrypoint.sh

entrypoint.sh

@@ -1,24 +1,10 @@
 #!/bin/bash
 set -e
 
-# 导出环境变量供子进程使用
-export CURSOR_API_KEY="${CURSOR_API_KEY:-}"
-
-# 检查并包装 claude 二进制，让其每次执行都强制携带跳过权限参数
-CLAUDE_BIN=$(which claude 2>/dev/null || echo "/usr/local/bin/claude")
-if [ -f "$CLAUDE_BIN" ] && [ ! -f "${CLAUDE_BIN}.orig" ]; then
-    mv "$CLAUDE_BIN" "${CLAUDE_BIN}.orig"
-    cat << 'EOF' > "$CLAUDE_BIN"
-#!/bin/sh
-exec "$0.orig" --dangerously-skip-permissions "$@"
-EOF
-    chmod +x "$CLAUDE_BIN"
-fi
-
 # 1. 创建持久化挂载目录
-mkdir -p /data/.claude /data/.codex /data/.cloudcli /data/app /data/.taskmaster /data/.cursor /data/.config/cursor
+mkdir -p /data/.claude /data/.cloudcli /data/app /data/.taskmaster /data/.codex_data/sessions
 
-# 2. 软链接映射到持久化盘
+# 2. 软链接映射（常规目录）
 if [ ! -L "$HOME/.claude" ]; then
     rm -rf "$HOME/.claude"
     ln -s /data/.claude "$HOME/.claude"
@@ -34,23 +20,23 @@ if [ ! -L "$HOME/.taskmaster" ]; then
     ln -s /data/.taskmaster "$HOME/.taskmaster"
 fi
 
-if [ ! -L "$HOME/.codex" ]; then
-    rm -rf "$HOME/.codex"
-    ln -s /data/.codex "$HOME/.codex"
-fi
-
-if [ ! -L "$HOME/.cursor" ]; then
-    rm -rf "$HOME/.cursor"
-    ln -s /data/.cursor "$HOME/.cursor"
+# ==================== 针对 .codex 的 SQLite 隔离 ====================
+if [ -L "$HOME/.codex" ]; then
+    rm -f "$HOME/.codex"
 fi
+mkdir -p "$HOME/.codex"
+# 清理持久盘上可能残留的历史损坏 SQLite
+rm -f /data/.codex/*.sqlite* 2>/dev/null || true
 
-mkdir -p "$HOME/.config"
-if [ ! -L "$HOME/.config/cursor" ]; then
-    rm -rf "$HOME/.config/cursor"
-    ln -s /data/.config/cursor "$HOME/.config/cursor"
+# 只持久化会话日志文本
+mkdir -p "$HOME/.codex/sessions"
+if [ ! -L "$HOME/.codex/sessions" ]; then
+    rm -rf "$HOME/.codex/sessions"
+    ln -s /data/.codex_data/sessions "$HOME/.codex/sessions"
 fi
+# ===================================================================
 
-# 3. 自动生成 Claude 配置
+# 3. 自动生成 Claude Code 配置
 mkdir -p "$HOME/.claude"
 cat <<EOF > "$HOME/.claude/settings.json"
 {
@@ -63,79 +49,251 @@ cat <<EOF > "$HOME/.claude/settings.json"
     "DISABLE_INSTALLATION_CHECKS": "1",
     "CLAUDE_CODE_PROXY_RESOLVES_HOSTS": "1",
     "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1",
-    "ENABLE_TOOL_SEARCH": "0",
+    "ENABLE_TOOL_SEARCH": "true",
     "DISABLE_AUTOUPDATER": "1",
-    "API_TIMEOUT_MS": "1200000",
-    "CLAUDE_STREAM_IDLE_TIMEOUT_MS": "1200000",
-    "CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS": "1200000",
-    "CLAUDE_BYTE_STREAM_IDLE_TIMEOUT_MS": "1200000",
-    "BASH_DEFAULT_TIMEOUT_MS": "1800000",
-    "IS_SANDBOX": "1",
-    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-sonnet-d",
-    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-sonnet-d",
-    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-d",
-    "ANTHROPIC_MODEL": "claude-sonnet-d",
-    "ANTHROPIC_REASONING_MODEL": "claude-sonnet-d"
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-sonnet-x[1m]",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-sonnet-x[1m]",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-x[1m]",
+    "ANTHROPIC_MODEL": "claude-sonnet-x[1m]",
+    "ANTHROPIC_REASONING_MODEL": "claude-sonnet-x[1m]"
   },
   "permissions": {
-    "defaultMode": "bypassPermissions",
-    "additionalDirectories": [
-      "/home/node",
-      "/data",
-      "/data/app",
-      "/home/node/app"
-    ],
     "allow": [
+      "Read",
+      "Write",
+      "Edit",
       "Bash(*)",
-      "Read(*)",
-      "Write(*)",
-      "Edit(*)",
-      "MultiEdit(*)",
-      "Glob(*)",
-      "Grep(*)",
-      "LS(*)",
-      "*"
+      "Glob",
+      "Grep",
+      "Agent",
+      "WebFetch",
+      "WebSearch",
+      "NotebookEdit"
     ]
   },
-  "hasCompletedOnboarding":true,
-  "dangerouslySkipPermissions": true,
-  "skipDangerousModePermissionPrompt": true,
-  "skipWebFetchPreflight": true
+  "model": "sonnet[1m]",
+  "skipWebFetchPreflight": true,
+  "effortLevel": "high",
+  "autoUpdatesChannel": "latest"
 }
 EOF
 
-# 4. 自动生成 Codex 配置
-mkdir -p "$HOME/.codex"
+# 4. 自动生成 Codex 配置（依据 readme.md 实测结论修复 bwrap 命名空间报错）
+# 修复要点：
+#   a. 顶层键必须位于任何 [table] 段之前，否则键被归入 table 导致配置失效（实测注意点）；
+#   b. hfspace 容器 seccomp 拦截 CLONE_NEWUSER 且无 bwrap，沙箱双路径全阻断，
+#      必须 sandbox_mode="danger-full-access" + approval_policy="never" 让 Codex 完全跳过沙箱；
+#   c. 通道用实测可用的中转网关：wire_api="chat"、env_key="OPENAI_API_KEY"（移除 requires_openai_auth）；
+#   d. 凭证解析：优先 CODEX_API_KEY 环境变量，其次 /data/.codex/gw_token（持久盘凭证文件）。
+CODEX_KEY_RESOLVED="${CODEX_API_KEY:-}"
+if [ -z "$CODEX_KEY_RESOLVED" ] && [ -f /data/.codex/gw_token ]; then
+    CODEX_KEY_RESOLVED="$(head -n 1 /data/.codex/gw_token | tr -d '[:space:]')"
+fi
+if [ -n "$CODEX_KEY_RESOLVED" ]; then
+    export OPENAI_API_KEY="$CODEX_KEY_RESOLVED"
+fi
+
 cat <<EOF > "$HOME/.codex/config.toml"
 cli_auth_credentials_store = "file"
 model_provider = "${CODEX_PROVIDER:-custom}"
-model = "${CODEX_MODEL:-gpt-5.6-sol}"
+model = "${CODEX_MODEL:-gpt-5.6-luna}"
+sandbox_mode = "danger-full-access"
+approval_policy = "never"
+
 [model_providers.custom]
 name = "Custom"
-base_url = "${CODEX_BASE_URL:-https://api.openai.com/v1}"
-wire_api = "responses"
-requires_openai_auth = true
+base_url = "${CODEX_BASE_URL:-https://cpa.freecode.eu.cc/v1}"
+wire_api = "chat"
+env_key = "OPENAI_API_KEY"
 EOF
 
 cat <<EOF > "$HOME/.codex/auth.json"
 {
-  "OPENAI_API_KEY": "${CODEX_API_KEY:-sk-dummy-key}"
+  "OPENAI_API_KEY": "${CODEX_KEY_RESOLVED:-sk-dummy-key}"
 }
 EOF
 
-# 5. 生成 Cursor 全路径凭证 (核心修复点)
-# 基础目录创建
-mkdir -p "$HOME/.cursor"
-cat <<EOF > "$HOME/.cursor/cli-config.json"
-{
-  "permissions": {
-    "allow": ["Shell(*)", "Read", "Write"],
-    "deny": []
-  },
-  "version": 1
-}
-EOF
+# 5. 创建 codex wrapper 兜底（task-master-ai 内置 codex 不在 PATH 中；
+#    集成端无环境变量启动时，wrapper 自动从 gw_token 注入凭证）
+if [ -w /usr/local/bin ] && [ ! -e /usr/local/bin/codex ] && [ -x /usr/local/lib/node_modules/task-master-ai/node_modules/.bin/codex ]; then
+    cat <<'WEOF' > /usr/local/bin/codex
+#!/bin/bash
+if [ -z "$OPENAI_API_KEY" ] && [ -f /data/.codex/gw_token ]; then
+    export OPENAI_API_KEY="$(head -n 1 /data/.codex/gw_token)"
+fi
+exec /usr/local/lib/node_modules/task-master-ai/node_modules/.bin/codex "$@"
+WEOF
+    chmod +x /usr/local/bin/codex 2>/dev/null || true
+fi
+
+# 6. 全局读写赋权（随后收紧 gw_token 权限，维持 600 保密要求）
+chown -R 1000:1000 /data "$HOME" 2>/dev/null || true
+chmod -R 777 /data "$HOME" 2>/dev/null || true
+chmod 600 /data/.codex/gw_token 2>/dev/null || true
 
-# 6. 切换工作目录并启动
+# 7. 切换并启动
 cd /data/app
-exec "$@"
+exec "$@"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+# cc、cursor可用版本
+# #!/bin/bash
+# set -e
+
+# # 导出环境变量供子进程使用
+# export CURSOR_API_KEY="${CURSOR_API_KEY:-}"
+
+# # 检查并包装 claude 二进制，让其每次执行都强制携带跳过权限参数
+# CLAUDE_BIN=$(which claude 2>/dev/null || echo "/usr/local/bin/claude")
+# if [ -f "$CLAUDE_BIN" ] && [ ! -f "${CLAUDE_BIN}.orig" ]; then
+#     mv "$CLAUDE_BIN" "${CLAUDE_BIN}.orig"
+#     cat << 'EOF' > "$CLAUDE_BIN"
+# #!/bin/sh
+# exec "$0.orig" --dangerously-skip-permissions "$@"
+# EOF
+#     chmod +x "$CLAUDE_BIN"
+# fi
+
+# # 1. 创建持久化挂载目录
+# mkdir -p /data/.claude /data/.codex /data/.cloudcli /data/app /data/.taskmaster /data/.cursor /data/.config/cursor
+
+# # 2. 软链接映射到持久化盘
+# if [ ! -L "$HOME/.claude" ]; then
+#     rm -rf "$HOME/.claude"
+#     ln -s /data/.claude "$HOME/.claude"
+# fi
+
+# if [ ! -L "$HOME/.cloudcli" ]; then
+#     rm -rf "$HOME/.cloudcli"
+#     ln -s /data/.cloudcli "$HOME/.cloudcli"
+# fi
+
+# if [ ! -L "$HOME/.taskmaster" ]; then
+#     rm -rf "$HOME/.taskmaster"
+#     ln -s /data/.taskmaster "$HOME/.taskmaster"
+# fi
+
+# if [ ! -L "$HOME/.codex" ]; then
+#     rm -rf "$HOME/.codex"
+#     ln -s /data/.codex "$HOME/.codex"
+# fi
+
+# if [ ! -L "$HOME/.cursor" ]; then
+#     rm -rf "$HOME/.cursor"
+#     ln -s /data/.cursor "$HOME/.cursor"
+# fi
+
+# mkdir -p "$HOME/.config"
+# if [ ! -L "$HOME/.config/cursor" ]; then
+#     rm -rf "$HOME/.config/cursor"
+#     ln -s /data/.config/cursor "$HOME/.config/cursor"
+# fi
+
+# # 3. 自动生成 Claude 配置
+# mkdir -p "$HOME/.claude"
+# cat <<EOF > "$HOME/.claude/settings.json"
+# {
+#   "cleanupPeriodDays": 720,
+#   "env": {
+#     "ANTHROPIC_BASE_URL": "${ANTHROPIC_BASE_URL:-}",
+#     "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN:-}",
+#     "CLAUDE_CODE_ATTRIBUTION_HEADER": "0",
+#     "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
+#     "DISABLE_INSTALLATION_CHECKS": "1",
+#     "CLAUDE_CODE_PROXY_RESOLVES_HOSTS": "1",
+#     "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1",
+#     "ENABLE_TOOL_SEARCH": "0",
+#     "DISABLE_AUTOUPDATER": "1",
+#     "API_TIMEOUT_MS": "1200000",
+#     "CLAUDE_STREAM_IDLE_TIMEOUT_MS": "1200000",
+#     "CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS": "1200000",
+#     "CLAUDE_BYTE_STREAM_IDLE_TIMEOUT_MS": "1200000",
+#     "BASH_DEFAULT_TIMEOUT_MS": "1800000",
+#     "IS_SANDBOX": "1",
+#     "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-sonnet-d",
+#     "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-sonnet-d",
+#     "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-d",
+#     "ANTHROPIC_MODEL": "claude-sonnet-d",
+#     "ANTHROPIC_REASONING_MODEL": "claude-sonnet-d"
+#   },
+#   "permissions": {
+#     "defaultMode": "bypassPermissions",
+#     "additionalDirectories": [
+#       "/home/node",
+#       "/data",
+#       "/data/app",
+#       "/home/node/app"
+#     ],
+#     "allow": [
+#       "Bash(*)",
+#       "Read(*)",
+#       "Write(*)",
+#       "Edit(*)",
+#       "MultiEdit(*)",
+#       "Glob(*)",
+#       "Grep(*)",
+#       "LS(*)",
+#       "*"
+#     ]
+#   },
+#   "hasCompletedOnboarding":true,
+#   "dangerouslySkipPermissions": true,
+#   "skipDangerousModePermissionPrompt": true,
+#   "skipWebFetchPreflight": true
+# }
+# EOF
+
+# # 4. 自动生成 Codex 配置
+# mkdir -p "$HOME/.codex"
+# cat <<EOF > "$HOME/.codex/config.toml"
+# cli_auth_credentials_store = "file"
+# model_provider = "${CODEX_PROVIDER:-custom}"
+# model = "${CODEX_MODEL:-gpt-5.6-sol}"
+# [model_providers.custom]
+# name = "Custom"
+# base_url = "${CODEX_BASE_URL:-https://api.openai.com/v1}"
+# wire_api = "responses"
+# requires_openai_auth = true
+# EOF
+
+# cat <<EOF > "$HOME/.codex/auth.json"
+# {
+#   "OPENAI_API_KEY": "${CODEX_API_KEY:-sk-dummy-key}"
+# }
+# EOF
+
+# # 5. 生成 Cursor 全路径凭证 (核心修复点)
+# # 基础目录创建
+# mkdir -p "$HOME/.cursor"
+# cat <<EOF > "$HOME/.cursor/cli-config.json"
+# {
+#   "permissions": {
+#     "allow": ["Shell(*)", "Read", "Write"],
+#     "deny": []
+#   },
+#   "version": 1
+# }
+# EOF
+
+# # 6. 切换工作目录并启动
+# cd /data/app
+# exec "$@"