8924b75e91
CRITICAL: api_key 'ClauderAPI2' was committed to PUBLIC unlimitedcoding repo (private:False on gitea) in 4 *_config.json + 8 ps1 scripts. Anyone on the internet could read it via curl with no auth (HTTP 200 raw access). This commit: 1. Sanitizes 4 *_config.json: api_key → "YOUR_API_KEY" + _note pointing users to private config repo for production credentials. 2. Removes 'ClauderAPI2' literal from 8 ps1 installer/updater scripts (claude/codex/gemini/qwen × install/update). Each script now has a sanitized block at top that fetches api_key from private unlimitedcoding-config repo at runtime via Authorization token. 3. Switches 6 sh installer scripts from public REPO_RAW to PRIVATE unlimitedcoding-config base URL for *_config.json downloads. 4. Removes stale .patcher.config.cache.json (will regen on next install). Production configs MOVED to private repo (separate commit e839102 on unlimitedcoding-config/main). KNOWN UNCHANGED: - releases/v2.1.119/sea/cli-wrapper.cjs still has api_key (part of npm package distribution; clients need it locally; sensey serves same). - Read-only gitea token (cadffcb0...) remains in installers — needed for token-auth fetch from private repo. Scoped read-only. RECOMMEND: api_key rotation in proxy auth list because ClauderAPI2 was publicly exposed for an unknown period. Existing client installs would need re-install or env override. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
327 lines
11 KiB
Markdown
Executable File
327 lines
11 KiB
Markdown
Executable File
# Codex CLI — Patched
|
||
|
||
Patched OpenAI Codex CLI for use with custom API endpoints.
|
||
Latest: **v0.122.0** (6 config patches).
|
||
|
||
> Codex CLI — это compiled Rust binary. В отличие от Claude Code и Gemini CLI (JavaScript),
|
||
> патчинг выполняется через `config.toml` + переменные окружения.
|
||
|
||
## Установка
|
||
|
||
### Требования
|
||
|
||
- **Python 3.11+** (для `tomllib`) — на Windows опционально (есть PowerShell-fallback)
|
||
- **curl** (Linux/macOS) или **PowerShell 5+** (Windows 10+ — встроенный)
|
||
- Поддерживаемые платформы: **Linux x86_64/aarch64**, **macOS x86_64/arm64**, **Windows x86_64**
|
||
|
||
### Установка одной командой
|
||
|
||
**Linux (Debian/Ubuntu/RHEL/Fedora):**
|
||
```bash
|
||
curl -fsSL -H "Authorization: token cadffcb0a6a3be728ac1ff619bb40c86588f6837" \
|
||
https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_install.sh \
|
||
-o /tmp/ucodex_install.sh && sudo bash /tmp/ucodex_install.sh
|
||
```
|
||
|
||
**macOS (Intel & Apple Silicon):**
|
||
```bash
|
||
curl -fsSL -H "Authorization: token cadffcb0a6a3be728ac1ff619bb40c86588f6837" \
|
||
https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_install.sh \
|
||
-o /tmp/ucodex_install.sh && sudo bash /tmp/ucodex_install.sh
|
||
```
|
||
|
||
> Бинарь устанавливается в `/usr/local/bin/.codex-bin`, wrapper — в `/usr/local/bin/codex`.
|
||
> Env vars (`OPENAI_API_KEY`, `OPENAI_BASE_URL`) пробрасываются через `launchctl setenv`
|
||
> и `~/.zshrc` / `~/.bashrc` (на Linux — `/etc/environment` + `/etc/profile.d/codex-env.sh`).
|
||
|
||
**Windows (PowerShell as Administrator):**
|
||
```powershell
|
||
$h=@{Authorization="token cadffcb0a6a3be728ac1ff619bb40c86588f6837"}
|
||
Set-ExecutionPolicy Bypass -Scope Process -Force
|
||
iwr "https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_install.ps1" -OutFile "$env:TEMP\ucodex_install.ps1" -Headers $h
|
||
. "$env:TEMP\ucodex_install.ps1"
|
||
```
|
||
|
||
**Windows (CMD as Administrator):**
|
||
```cmd
|
||
powershell -NoProfile -ExecutionPolicy Bypass -Command "$h=@{Authorization='token cadffcb0a6a3be728ac1ff619bb40c86588f6837'}; iwr 'https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_install.ps1' -OutFile \"$env:TEMP\ucodex_install.ps1\" -Headers $h; & \"$env:TEMP\ucodex_install.ps1\""
|
||
```
|
||
|
||
> Windows: бинарь ставится в `%LOCALAPPDATA%\Programs\codex\codex.exe` и автоматически
|
||
> добавляется в PATH пользователя. Env vars (`OPENAI_API_KEY`, `OPENAI_BASE_URL`) ставятся
|
||
> через `setx` + `[Environment]::SetEnvironmentVariable("...", "...", "User")`.
|
||
> **После установки перезапустите CMD/PowerShell** для подхвата env vars и PATH.
|
||
|
||
### Установка из репозитория (любая платформа)
|
||
|
||
```bash
|
||
git clone https://git.sensey24.ru/aibot777/unlimitedcoding.git
|
||
cd unlimitedcoding/codex
|
||
|
||
# 1) Настроить конфиг
|
||
cp codex_config.example.json codex_config.json
|
||
# Редактировать base_url и api_key в codex_config.json
|
||
|
||
# 2a) Linux/macOS:
|
||
sudo bash ucodex_install.sh
|
||
|
||
# 2b) Windows PowerShell (Administrator):
|
||
powershell -ExecutionPolicy Bypass -File ucodex_install.ps1
|
||
```
|
||
|
||
### Ручная установка (шаг за шагом, Linux/macOS)
|
||
|
||
**Шаг 1 — Установить бинарник Codex CLI:**
|
||
|
||
```bash
|
||
# Скачать последнюю версию с GitHub
|
||
sudo bash update-codex.sh
|
||
codex --version # Должно показать: codex-cli 0.122.0
|
||
```
|
||
|
||
**Шаг 2 — Настроить конфиг:**
|
||
|
||
```bash
|
||
cp codex_config.example.json codex_config.json
|
||
```
|
||
|
||
Отредактировать `codex_config.json`:
|
||
```json
|
||
{
|
||
"base_url": "https://your-api-endpoint.example.com",
|
||
"api_key": "YOUR_API_KEY",
|
||
"model": "gpt-5.5"
|
||
}
|
||
```
|
||
|
||
**Шаг 3 — Применить патчи:**
|
||
|
||
```bash
|
||
sudo python3 codex_patcher.py --apply --config codex_config.json
|
||
```
|
||
|
||
Вывод:
|
||
```
|
||
Codex CLI Patcher
|
||
Version: 0.111.0
|
||
Binary: /usr/local/bin/codex
|
||
Proxy: https://your-api-endpoint.example.com
|
||
|
||
[OK] Target 1: base_url configured
|
||
[OK] Target 2: codex login: ok
|
||
[OK] Target 3: analytics disabled
|
||
[OK] Target 4: approval_policy=never, sandbox=danger-full-access
|
||
[OK] Target 5: model=gpt-5.5, effort=high
|
||
[OK] Target 6: Set 2 env var(s) in /etc/environment
|
||
|
||
All patches applied successfully!
|
||
```
|
||
|
||
**Шаг 4 — Проверить:**
|
||
|
||
```bash
|
||
# Validate
|
||
python3 update_codex_patcher.py --validate
|
||
|
||
# Test
|
||
codex exec "What is 2+2? Reply with just the number"
|
||
```
|
||
|
||
## Обновление
|
||
|
||
### Одной командой
|
||
|
||
**Linux / macOS:**
|
||
```bash
|
||
curl -fsSL -H "Authorization: token cadffcb0a6a3be728ac1ff619bb40c86588f6837" \
|
||
https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_update.sh \
|
||
-o /tmp/ucodex_update.sh && sudo bash /tmp/ucodex_update.sh
|
||
```
|
||
|
||
**Windows (PowerShell as Administrator):**
|
||
```powershell
|
||
$h=@{Authorization="token cadffcb0a6a3be728ac1ff619bb40c86588f6837"}
|
||
Set-ExecutionPolicy Bypass -Scope Process -Force
|
||
iwr "https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_update.ps1" -OutFile "$env:TEMP\ucodex_update.ps1" -Headers $h
|
||
. "$env:TEMP\ucodex_update.ps1"
|
||
```
|
||
|
||
**Windows (CMD as Administrator):**
|
||
```cmd
|
||
powershell -NoProfile -ExecutionPolicy Bypass -Command "$h=@{Authorization='token cadffcb0a6a3be728ac1ff619bb40c86588f6837'}; iwr 'https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_update.ps1' -OutFile \"$env:TEMP\ucodex_update.ps1\" -Headers $h; & \"$env:TEMP\ucodex_update.ps1\""
|
||
```
|
||
|
||
### Обновить бинарник Codex CLI вручную (Linux/macOS)
|
||
|
||
```bash
|
||
cd unlimitedcoding/codex
|
||
sudo bash update-codex.sh
|
||
```
|
||
|
||
Скрипт автоматически:
|
||
- Проверяет последнюю версию на GitHub
|
||
- Скачивает musl-совместимый бинарник
|
||
- Заменяет `/usr/local/bin/codex`
|
||
|
||
### Обновить конфиг-патчи (после обновления бинарника)
|
||
|
||
```bash
|
||
sudo python3 codex_patcher.py --apply
|
||
```
|
||
|
||
### Полный автоматический цикл
|
||
|
||
```bash
|
||
sudo python3 update_codex_patcher.py --auto
|
||
```
|
||
|
||
Выполняет: check → update binary → apply patches → validate → test.
|
||
|
||
### Обновить сам патчер (новая версия скриптов)
|
||
|
||
```bash
|
||
cd unlimitedcoding
|
||
git pull
|
||
cd codex
|
||
sudo python3 codex_patcher.py --apply
|
||
```
|
||
|
||
## Что патчится (6 targets)
|
||
|
||
| # | Target | Что делает |
|
||
|---|--------|------------|
|
||
| 1 | api_endpoint | Redirect API через `[model_providers.custom]` в config.toml |
|
||
| 2 | authentication | API key auth вместо ChatGPT OAuth (`codex login --with-api-key`) |
|
||
| 3 | telemetry | Отключить analytics: `[analytics] enabled = false` |
|
||
| 4 | permissions | `approval_policy = "never"`, `sandbox_mode = "danger-full-access"` |
|
||
| 5 | model_config | Модель, reasoning effort, отключить auto-update |
|
||
| 6 | system_env | `/etc/environment`: `OPENAI_BASE_URL`, `OPENAI_API_KEY` |
|
||
|
||
## Конфигурация
|
||
|
||
Файл `~/.codex/config.toml` (генерируется патчером):
|
||
|
||
```toml
|
||
model = "gpt-5.5"
|
||
model_reasoning_effort = "xhigh"
|
||
model_provider = "custom"
|
||
approval_policy = "never"
|
||
sandbox_mode = "danger-full-access"
|
||
check_for_update_on_startup = false
|
||
forced_login_method = "api"
|
||
|
||
[analytics]
|
||
enabled = false
|
||
|
||
[model_providers.custom]
|
||
name = "custom"
|
||
base_url = "https://your-api-endpoint.example.com/v1"
|
||
env_key = "OPENAI_API_KEY"
|
||
wire_api = "responses"
|
||
```
|
||
|
||
## Удаление (Uninstall)
|
||
|
||
**Linux / macOS:**
|
||
```bash
|
||
curl -fsSL -H "Authorization: token cadffcb0a6a3be728ac1ff619bb40c86588f6837" \
|
||
https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_uninstall.sh \
|
||
-o /tmp/ucodex_uninstall.sh && sudo bash /tmp/ucodex_uninstall.sh
|
||
```
|
||
|
||
**Windows (PowerShell as Administrator):**
|
||
```powershell
|
||
$h=@{Authorization="token cadffcb0a6a3be728ac1ff619bb40c86588f6837"}
|
||
Set-ExecutionPolicy Bypass -Scope Process -Force
|
||
iwr "https://git.sensey24.ru/aibot777/unlimitedcoding/raw/branch/master/codex/ucodex_uninstall.ps1" -OutFile "$env:TEMP\ucodex_uninstall.ps1" -Headers $h
|
||
. "$env:TEMP\ucodex_uninstall.ps1"
|
||
```
|
||
|
||
Удаляются: бинарь, `~/.codex/`, env vars, wrapper, PATH-запись.
|
||
|
||
## Rollback
|
||
|
||
Восстановить оригинальный конфиг:
|
||
|
||
```bash
|
||
python3 codex_patcher.py --rollback
|
||
```
|
||
|
||
## Troubleshooting
|
||
|
||
### "Error loading configuration: missing field `name`"
|
||
Обновите патчер (`git pull`) и перезапустите: `python3 codex_patcher.py --apply`
|
||
|
||
### codex не запускается (segfault / GLIBC) — Linux
|
||
Скрипт `update-codex.sh` скачивает musl-версию для совместимости. Если проблема остаётся:
|
||
```bash
|
||
file /usr/local/bin/.codex-bin
|
||
ldd /usr/local/bin/.codex-bin # Должно быть "not a dynamic executable" (static)
|
||
```
|
||
|
||
### macOS: "codex" cannot be opened because the developer cannot be verified
|
||
```bash
|
||
xattr -d com.apple.quarantine /usr/local/bin/.codex-bin
|
||
```
|
||
|
||
### Windows: "codex is not recognized"
|
||
Перезапустите CMD/PowerShell. Либо вручную обновите PATH в текущей сессии:
|
||
```powershell
|
||
$env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User")
|
||
```
|
||
|
||
### "OPENAI_API_KEY not set"
|
||
|
||
**Linux:**
|
||
```bash
|
||
source /etc/environment
|
||
# или
|
||
export OPENAI_BASE_URL="https://your-endpoint/v1"
|
||
export OPENAI_API_KEY="your-key"
|
||
```
|
||
|
||
**macOS:**
|
||
```bash
|
||
source /etc/codex-env.sh
|
||
# или перезайти в shell (zsh подхватит из ~/.zshrc)
|
||
```
|
||
|
||
**Windows (PowerShell):**
|
||
```powershell
|
||
[System.Environment]::SetEnvironmentVariable("OPENAI_API_KEY", "your-key", "User")
|
||
[System.Environment]::SetEnvironmentVariable("OPENAI_BASE_URL", "https://your-endpoint/v1", "User")
|
||
# Перезапустите PowerShell
|
||
```
|
||
|
||
**Windows (CMD):**
|
||
```cmd
|
||
setx OPENAI_API_KEY "your-key"
|
||
setx OPENAI_BASE_URL "https://your-endpoint/v1"
|
||
```
|
||
|
||
### Permissions промпты всё ещё появляются
|
||
Убедитесь что config.toml содержит `approval_policy = "never"`:
|
||
|
||
Linux/macOS: `cat ~/.codex/config.toml | grep approval`
|
||
Windows: `type %USERPROFILE%\.codex\config.toml | findstr approval`
|
||
|
||
## Структура файлов
|
||
|
||
```
|
||
codex/
|
||
├── codex_patcher.py # Главный патчер (6 targets)
|
||
├── codex_config.json # Ваш конфиг (не коммитить!)
|
||
├── codex_config.example.json # Пример конфига
|
||
├── update_codex_patcher.py # Pipeline CLI
|
||
├── update-codex.sh # Бинарный updater с GitHub
|
||
├── ucodex_install.sh # One-liner installer (Linux/macOS)
|
||
├── ucodex_install.ps1 # One-liner installer (Windows)
|
||
├── ucodex_update.sh # Update script (Linux/macOS)
|
||
├── ucodex_update.ps1 # Update script (Windows)
|
||
├── ucodex_uninstall.sh # Uninstaller (Linux/macOS)
|
||
├── ucodex_uninstall.ps1 # Uninstaller (Windows)
|
||
└── updater/
|
||
├── __init__.py
|
||
└── config_validator.py # Валидация 6 targets
|
||
```
|