mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: render agentrun codex config from yaml

Browse Source
This commit is contained in:
Codex
2026-07-09 08:58:34 +02:00
parent 3c9227c1ce
commit b9bc21d847
6 changed files with 220 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/agentrun/secrets.ts
+63 -5
View File
@@ -21,6 +21,7 @@ import {
agentRunSourceSnapshotRef,
agentRunSourceSnapshotStageRefPrefix,
resolveAgentRunLaneTarget,
type AgentRunCodexConfigSpec,
type AgentRunCancelLifecycleSpec,
type AgentRunLaneSpec,
} from "../agentrun-lanes";
@@ -705,9 +706,10 @@ export function yamlLaneGitMirrorStatusScript(spec: AgentRunLaneSpec): string {
export type LaneSecretSource = {
id: string;
sourceRef: string;
sourceMode: "env" | "file";
sourceMode: "env" | "file" | "codex-config";
sourceKey: string | null;
sourceFormat?: "env" | "raw-token" | null;
codexConfig?: AgentRunCodexConfigSpec | null;
targetRef: { namespace: string; name: string; key: string };
transform?: "local-postgres-database" | "local-postgres-user" | "local-postgres-database-url";
};
@@ -715,14 +717,19 @@ export type LaneSecretSource = {
export function readSecretSourceValue(spec: AgentRunLaneSpec, source: LaneSecretSource): { redactedPath: string; value: string; valueBytes: number; fingerprint: string } {
const { sourceRef } = source;
if (sourceRef.includes("..")) throw new Error(`secret sourceRef must not contain ..: ${sourceRef}`);
const sourcePath = sourceRef.startsWith("/")
const sourcePath = source.sourceMode === "codex-config" ? null : sourceRef.startsWith("/")
? sourceRef
: join(resolveSecretSourceRoot(spec), ...sourceRef.split("/"));
if (!existsSync(sourcePath)) throw new Error(`secret source ${sourceRef} is missing`);
if (sourcePath !== null && !existsSync(sourcePath)) throw new Error(`secret source ${sourceRef} is missing`);
let value: string;
if (source.sourceMode === "file") {
if (source.sourceMode === "codex-config") {
if (source.codexConfig === undefined || source.codexConfig === null) throw new Error(`secret source ${sourceRef} is missing codexConfig`);
value = renderCodexConfigToml(source.codexConfig);
} else if (source.sourceMode === "file") {
if (sourcePath === null) throw new Error(`secret source ${sourceRef} has no source path`);
value = readFileSync(sourcePath, "utf8");
} else {
if (sourcePath === null) throw new Error(`secret source ${sourceRef} has no source path`);
if (source.sourceKey === null) throw new Error(`secret source ${sourceRef} is missing sourceKey`);
const text = readFileSync(sourcePath, "utf8");
const envValue = source.sourceFormat === "raw-token" ? text.trim() : parseEnvFile(text).get(source.sourceKey);
@@ -732,13 +739,63 @@ export function readSecretSourceValue(spec: AgentRunLaneSpec, source: LaneSecret
if (value.length === 0) throw new Error(`secret source ${sourceRef} is empty`);
value = transformSecretSourceValue(spec, source, value);
return {
redactedPath: sourceRef.startsWith("/") ? redactAbsoluteSecretPath(sourceRef) : `.state/secrets/${sourceRef}`,
redactedPath: source.sourceMode === "codex-config" ? sourceRef : sourceRef.startsWith("/") ? redactAbsoluteSecretPath(sourceRef) : `.state/secrets/${sourceRef}`,
value,
valueBytes: Buffer.byteLength(value, "utf8"),
fingerprint: sha256Fingerprint(value),
};
}
function renderCodexConfigToml(config: AgentRunCodexConfigSpec): string {
const lines = [
`model_provider = ${tomlString(config.modelProvider)}`,
`model = ${tomlString(config.model)}`,
...(config.reviewModel === null ? [] : [`review_model = ${tomlString(config.reviewModel)}`]),
...(config.modelReasoningEffort === null ? [] : [`model_reasoning_effort = ${tomlString(config.modelReasoningEffort)}`]),
...(config.disableResponseStorage === null ? [] : [`disable_response_storage = ${tomlBoolean(config.disableResponseStorage)}`]),
...(config.networkAccess === null ? [] : [`network_access = ${tomlString(config.networkAccess)}`]),
...(config.windowsWslSetupAcknowledged === null ? [] : [`windows_wsl_setup_acknowledged = ${tomlBoolean(config.windowsWslSetupAcknowledged)}`]),
...(config.serviceTier === null ? [] : [`service_tier = ${tomlString(config.serviceTier)}`]),
"",
];
for (const provider of config.modelProviders) {
lines.push(
`[model_providers.${tomlKeySegment(provider.id)}]`,
`name = ${tomlString(provider.name)}`,
`base_url = ${tomlString(provider.baseUrl)}`,
`wire_api = ${tomlString(provider.wireApi)}`,
...(provider.requiresOpenaiAuth === null ? [] : [`requires_openai_auth = ${tomlBoolean(provider.requiresOpenaiAuth)}`]),
"",
);
}
if (Object.keys(config.features).length > 0) {
lines.push("[features]");
for (const [key, value] of Object.entries(config.features)) lines.push(`${tomlKeySegment(key)} = ${tomlBoolean(value)}`);
lines.push("");
}
for (const project of config.projects) {
lines.push(`[projects.${tomlKeySegment(project.path)}]`, `trust_level = ${tomlString(project.trustLevel)}`, "");
}
if (Object.keys(config.tuiModelAvailabilityNux).length > 0) {
lines.push("[tui.model_availability_nux]");
for (const [key, value] of Object.entries(config.tuiModelAvailabilityNux)) lines.push(`${tomlKeySegment(key)} = ${value}`);
lines.push("");
}
return `${lines.join("\n").trimEnd()}\n`;
}
function tomlString(value: string): string {
return JSON.stringify(value);
}
function tomlBoolean(value: boolean): string {
return value ? "true" : "false";
}
function tomlKeySegment(value: string): string {
return /^[A-Za-z0-9_-]+$/u.test(value) ? value : tomlString(value);
}
function transformSecretSourceValue(spec: AgentRunLaneSpec, source: LaneSecretSource, rawValue: string): string {
if (source.transform === undefined) return rawValue;
const localPostgres = spec.deployment.localPostgres;
@@ -843,6 +900,7 @@ export function collectLaneSecretSources(spec: AgentRunLaneSpec): LaneSecretSour
sourceMode: secret.sourceMode,
sourceKey: secret.sourceKey,
sourceFormat: secret.sourceFormat,
codexConfig: secret.codexConfig,
targetRef: secret.targetRef,
});
}