mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
45060f4492
* chore(gator): add gator gate skill * chore(gator): add sandbox launcher scaffold * chore(gator): add codex image and docs checks * chore(gator): fold approved provider policy rules * chore(gator): add deterministic reviewer runner * chore(gator): clarify ok-to-test comments * chore(gator): structure launcher harnesses * chore(gator): require e2e for dependabot * chore(gator): add codex refresh profile * chore(gator): wip manifest agent launcher * feat(agents): supervise watch cycles in sandbox * fix(agents): preserve gateway refresh state * fix(gator): continue human response threads * fix(agents): keep watch supervisor retrying * fix(agents): use refreshed Codex credential aliases * fix(gator): avoid misleading gh auth checks * docs(agents): remove architecture build update * fix(gator): use REST-backed GitHub writes * fix(agents): bake immutable agent payloads * fix(agents): upload writable agent workspace * fix(agents): surface gator watch progress * fix(agents): prevent codex stdin hang * fix(agents): align codex subagent input * fix(agents): heartbeat during active cycles * fix(agents): clean up heartbeat sleep * fix(agents): disable gh telemetry in codex harness * fix(agents): reconcile closed gator PRs * fix(agents): query closed gator PR labels separately * fix(agents): tolerate rotated credential placeholders * fix(agents): enforce gator same-sha comment guard Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): scope gator trusted commentary Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * fix(gator): treat reviewer failures as transient Signed-off-by: Evan Lezar <elezar@nvidia.com> * feat(agents): refine gator supervised workflow Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * fix(agents): stream codex prompts via stdin Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): clarify trusted gator responses Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * refactor(agents): scope gator PR to scripts Signed-off-by: John Myers <johntmyers@users.noreply.github.com> --------- Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: Evan Lezar <elezar@nvidia.com>
105 lines
2.9 KiB
Bash
Executable File
105 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $# -ne 1 ]]; then
|
|
echo "usage: exec.sh <prompt-file>" >&2
|
|
exit 2
|
|
fi
|
|
|
|
require_env() {
|
|
local name="$1"
|
|
[[ -n "${!name:-}" ]] || { echo "missing required env: $name" >&2; exit 1; }
|
|
}
|
|
|
|
require_env CODEX_AUTH_ACCESS_TOKEN
|
|
require_env CODEX_AUTH_ACCOUNT_ID
|
|
require_env GITHUB_TOKEN
|
|
|
|
PROMPT_FILE="$1"
|
|
export GH_TOKEN="$GITHUB_TOKEN"
|
|
export GH_PROMPT_DISABLED=1
|
|
export GH_NO_UPDATE_NOTIFIER=1
|
|
export GH_NO_EXTENSION_UPDATE_NOTIFIER=1
|
|
export GH_TELEMETRY=false
|
|
export DO_NOT_TRACK=1
|
|
export HOME=/sandbox/home
|
|
|
|
echo "openshell-agent: preparing Codex harness auth and workspace" >&2
|
|
mkdir -p "$HOME/.codex"
|
|
node - <<'NODE'
|
|
const fs = require("fs");
|
|
const path = `${process.env.HOME}/.codex/auth.json`;
|
|
const b64u = (obj) => Buffer.from(JSON.stringify(obj)).toString("base64url");
|
|
const providerPlaceholder = (envName) => {
|
|
const value = process.env[envName];
|
|
if (value && value.startsWith("openshell:resolve:env:")) {
|
|
return `openshell:resolve:env:${envName}`;
|
|
}
|
|
return value;
|
|
};
|
|
const now = Math.floor(Date.now() / 1000);
|
|
const fallbackIdToken = [
|
|
b64u({ alg: "none", typ: "JWT" }),
|
|
b64u({
|
|
iss: "https://auth.openai.com",
|
|
aud: "codex",
|
|
sub: "openshell-agent",
|
|
email: "agent@openshell.local",
|
|
iat: now,
|
|
exp: now + 3600,
|
|
}),
|
|
"placeholder",
|
|
].join(".");
|
|
|
|
fs.writeFileSync(path, JSON.stringify({
|
|
auth_mode: "chatgpt",
|
|
OPENAI_API_KEY: null,
|
|
tokens: {
|
|
id_token: providerPlaceholder("CODEX_AUTH_ID_TOKEN") || fallbackIdToken,
|
|
access_token: providerPlaceholder("CODEX_AUTH_ACCESS_TOKEN"),
|
|
refresh_token: providerPlaceholder("CODEX_AUTH_REFRESH_TOKEN") || "gateway-managed-refresh-token",
|
|
account_id: providerPlaceholder("CODEX_AUTH_ACCOUNT_ID"),
|
|
},
|
|
last_refresh: new Date().toISOString(),
|
|
}, null, 2));
|
|
NODE
|
|
chmod 600 "$HOME/.codex/auth.json"
|
|
|
|
WORK="$(mktemp -d)"
|
|
cd "$WORK"
|
|
|
|
CODEX_BIN="${CODEX_BIN:-codex}"
|
|
ADAPTER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PAYLOAD_DIR="$(cd "$ADAPTER_DIR/../../.." && pwd)"
|
|
if [[ -x "$PAYLOAD_DIR/runtime/harnesses/codex/codex" ]]; then
|
|
CODEX_BIN="$PAYLOAD_DIR/runtime/harnesses/codex/codex"
|
|
fi
|
|
CODEX_MODEL="${CODEX_MODEL:-gpt-5.5}"
|
|
CODEX_REASONING="${CODEX_REASONING:-high}"
|
|
|
|
echo "openshell-agent: invoking Codex bounded cycle (model=$CODEX_MODEL, reasoning=$CODEX_REASONING)" >&2
|
|
|
|
CODEX_EXEC_ARGS=(
|
|
exec
|
|
--skip-git-repo-check
|
|
--sandbox danger-full-access
|
|
--ephemeral
|
|
)
|
|
|
|
if "$CODEX_BIN" exec --help 2>/dev/null | grep -q -- "--ignore-user-config"; then
|
|
CODEX_EXEC_ARGS+=(--ignore-user-config)
|
|
fi
|
|
if "$CODEX_BIN" exec --help 2>/dev/null | grep -q -- "--ignore-rules"; then
|
|
CODEX_EXEC_ARGS+=(--ignore-rules)
|
|
fi
|
|
|
|
exec "$CODEX_BIN" "${CODEX_EXEC_ARGS[@]}" \
|
|
-c "model=\"${CODEX_MODEL}\"" \
|
|
-c "model_reasoning_effort=\"${CODEX_REASONING}\"" \
|
|
- \
|
|
< "$PROMPT_FILE"
|