@bryanhu/codexly 0.22.1 → 0.24.0

package/CHANGELOG.md

@@ -4,6 +4,38 @@
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-09-20
+
+### 新增
+
+- 支持在 Docker 部署中保留宿主工作区绝对路径、挂载全局 Git 配置与 SSH 凭据，便于复用已有项目和访问远程仓库。
+- 持久化 Thread 历史附件元数据与正文，使附件在任务恢复、分叉和服务重启后仍可安全读取。
+
+### 优化
+
+- 升级内置 Codex 至 `0.155.1`，刷新 App Server Schema 基线并适配 Thread Attachment 通知协议。
+
+### 修复
+
+- 放宽自定义局域网密码对 Shell 特殊字符的限制，并限制局域网客户端调用仅适用于宿主设备的操作。
+- 修复流式 Markdown 强调标记跨片段到达时可能错误渲染的问题。
+
+### 工程
+
+- 升级 Docker 构建、登录、元数据与多架构模拟相关 GitHub Actions。
+
+## [0.23.0] - 2026-09-18
+
+### 新增
+
+- 添加生产级 Docker 镜像与可独立下载的 Docker Compose 配置，支持自定义工作区、Codex Home、端口、配对密码及会话期限。
+- 扩展发布流程，在 npm 包通过验证后同步发布带 SBOM 和 provenance 的 `linux/amd64`、`linux/arm64` GHCR 镜像。
+
+### 修复
+
+- 限制项目选择只能落在配置工作区的真实路径内，阻止通过符号链接越过工作区边界。
+- 修复运行中切换自定义 API 后仍复用旧 ChatGPT 认证、导致部分自定义模型不可用的问题。
+
 ## [0.22.1] - 2026-09-16
 
 ### 修复

package/README.md

@@ -10,7 +10,7 @@
   <img src="https://img.shields.io/badge/TypeScript-6.0-3178c6" alt="TypeScript" />
   <img src="https://img.shields.io/badge/Vite-8-646cff" alt="Vite" />
   <img src="https://img.shields.io/badge/Fastify-5-000000" alt="Fastify" />
-  <img src="https://img.shields.io/badge/OpenAI_Codex-0.154.0-412991" alt="OpenAI Codex" />
+  <img src="https://img.shields.io/badge/OpenAI_Codex-0.155.1-412991" alt="OpenAI Codex" />
   <a href="./LICENSE">
     <img src="https://img.shields.io/badge/License-MIT-0f766e" alt="MIT" />
   </a>
@@ -55,7 +55,7 @@
 - Node.js >=22.14.0
 - Chrome/Chromium 116+, Firefox 124+, or Safari 17.4+
 
-Codexly includes Codex CLI `0.154.0` through `@openai/codex`; a separate installation is not required. External binaries supplied through `--codex-bin <path>` or `CODEXLY_CODEX_BIN` must satisfy `>=0.154.0,<0.155.0`.
+Codexly includes Codex CLI `0.155.1` through `@openai/codex`; a separate installation is not required. External binaries supplied through `--codex-bin <path>` or `CODEXLY_CODEX_BIN` must satisfy `>=0.155.0,<0.156.0`.
 
 ## Quick Start
 
@@ -80,6 +80,47 @@ codexly
 
 The installation command tries the China mirror first, falls back to the official registry on failure, reuses the npm cache, and revalidates stale package metadata. `||` works in Bash, Zsh, cmd, and PowerShell 7+. In Windows PowerShell 5.1, run the command to the right of `||` separately if the first command fails.
 
+## Docker
+
+Download the user-facing Compose file and start the published image:
+
+```bash
+mkdir codexly && cd codexly
+curl -fsSLO https://raw.githubusercontent.com/BryanHoo/Codexly/main/compose.yaml
+curl -fsSLo .env.example https://raw.githubusercontent.com/BryanHoo/Codexly/main/.env.example
+cp .env.example .env
+docker compose pull
+docker compose up --detach
+docker compose logs --tail=50 codexly
+```
+
+Open `http://127.0.0.1:3210` and use the random pairing code printed in the logs. The default named volume preserves Codex login data and Codexly's SQLite state. On Linux and macOS, the Compose file mounts the host root at `/workspace`, so every mounted disk is available to the project picker. Set `CODEXLY_WORKSPACE` to expose only one directory and preserve its absolute path inside the container:
+
+```bash
+CODEXLY_WORKSPACE=/path/to/projects docker compose up --detach
+```
+
+When binding the host `CODEXLY_CODEX_HOME`, also set `CODEXLY_WORKSPACE` to a common parent of the existing projects. Their absolute paths then remain identical on the host and in the container.
+
+The container does not automatically inherit the host Git identity. Set `CODEXLY_GIT_CONFIG` to a global Git config file visible inside the container. With an identity-mapped Linux or macOS workspace, use the absolute path to the host `~/.gitconfig` directly. For SSH remotes, set `CODEXLY_SSH_HOME` to the absolute path of the host `~/.ssh` directory.
+
+Docker can only access host paths shared with the Docker engine. On Windows, set `CODEXLY_WORKSPACE` to a shared drive such as `C:/` and set `CODEXLY_WORKSPACE_TARGET=/workspace`. Windows and Linux container paths use different absolute path formats, so a Codex Home containing host project records cannot be reused directly. Add extra bind mounts and repeat `--workspace` in `command` when multiple drives are required.
+
+| Variable                   | Purpose                                                                |
+| -------------------------- | ---------------------------------------------------------------------- |
+| `CODEXLY_VERSION`          | Select the GHCR image tag; defaults to `latest`                        |
+| `CODEXLY_PORT`             | Set both the host and container port; defaults to `3210`               |
+| `CODEXLY_WORKSPACE`        | Restrict the workspace and preserve its absolute path; defaults to `/` |
+| `CODEXLY_WORKSPACE_TARGET` | Override the container path; use `/workspace` on Windows               |
+| `CODEXLY_GIT_CONFIG`       | Select a container-visible global Git config file                      |
+| `CODEXLY_SSH_HOME`         | Mount host SSH config, keys, and `known_hosts` read-only               |
+| `CODEXLY_CODEX_HOME`       | Bind a host Codex home instead of the managed `codexly-data` volume    |
+| `CODEXLY_LAN_PASSWORD`     | Set a strong fixed access password instead of the logged random code   |
+| `CODEXLY_ALLOWED_HOSTS`    | Allow comma-separated exact reverse proxy domains                      |
+| `CODEXLY_SESSION_TTL`      | Set a fixed session lifetime such as `12h`                             |
+
+The image entrypoint accepts all normal CLI arguments, so orchestration platforms can replace `command` when needed. See the [complete Docker Compose deployment guide](docs/docker-deployment.md) for workspace, multiple-disk, Codex Home, update, backup, and troubleshooting instructions. Run `pnpm docker:build && pnpm docker:test` in a development checkout to build and smoke-test the local image.
+
 ## Usage
 
 Select **New task** for work that does not need a project. For repository work, add one or more host directories as ordered project roots, create a task, and submit your request with any required files, images, project references, or Skills. Archived tasks can be restored or permanently deleted from the project task list.
@@ -101,9 +142,10 @@ The terminal prints the LAN address and a random access password. Common options
 | Option                      | Purpose                                                                                    |
 | --------------------------- | ------------------------------------------------------------------------------------------ |
 | `--port <port>`             | Choose the starting port; occupied ports are skipped automatically                         |
-| `--lan-password <password>` | Set a 16-128 character password containing uppercase, lowercase, number, and symbol        |
+| `--lan-password <password>` | Set a 16-128 character password containing uppercase, lowercase, and number                |
 | `--allowed-host <domain>`   | Allow an exact reverse proxy domain; repeat the option for multiple domains                |
 | `--session-ttl <duration>`  | Set a fixed LAN session lifetime such as `12h`; omitted sessions last until server restart |
+| `--workspace <path>`        | Restrict project selection to this absolute root; repeat for multiple roots                |
 
 Quote passwords containing shell-special characters. LAN mode uses unencrypted HTTP, so use it only on a trusted network and never expose it directly to the internet. Restarting Codexly invalidates the password and all sessions.
 

package/README.zh-CN.md

@@ -25,7 +25,7 @@ Codexly 是一个在浏览器中使用 Codex 的本地 AI 编程工作台。它
 - Node.js >=22.14.0
 - Chrome/Chromium 116+、Firefox 124+ 或 Safari 17.4+
 
-Codexly 通过 `@openai/codex` 自带 Codex CLI `0.154.0`，无需单独安装。通过 `--codex-bin <path>` 或 `CODEXLY_CODEX_BIN` 指定的外部版本必须满足 `>=0.154.0,<0.155.0`。
+Codexly 通过 `@openai/codex` 自带 Codex CLI `0.155.1`，无需单独安装。通过 `--codex-bin <path>` 或 `CODEXLY_CODEX_BIN` 指定的外部版本必须满足 `>=0.155.0,<0.156.0`。
 
 ## 快速开始
 
@@ -50,6 +50,47 @@ codexly
 
 安装命令优先使用国内镜像，失败后回退官方源，复用 npm 缓存并重新校验过期的包元数据。`||` 适用于 Bash、Zsh、cmd 和 PowerShell 7+；Windows PowerShell 5.1 请在第一条命令失败后单独执行 `||` 右侧的命令。
 
+## Docker 部署
+
+下载用户版 Compose 配置并启动已发布镜像：
+
+```bash
+mkdir codexly && cd codexly
+curl -fsSLO https://raw.githubusercontent.com/BryanHoo/Codexly/main/compose.yaml
+curl -fsSLo .env.example https://raw.githubusercontent.com/BryanHoo/Codexly/main/.env.example
+cp .env.example .env
+docker compose pull
+docker compose up --detach
+docker compose logs --tail=50 codexly
+```
+
+打开 `http://127.0.0.1:3210`，使用日志中的随机配对码。默认命名卷会持久化 Codex 登录数据和 Codexly SQLite 状态。在 Linux 和 macOS 上，Compose 默认把宿主根目录挂载到 `/workspace`，项目选择器可读取所有已挂载磁盘。设置 `CODEXLY_WORKSPACE` 后只暴露指定目录，并在容器中保留其绝对路径：
+
+```bash
+CODEXLY_WORKSPACE=/path/to/projects docker compose up --detach
+```
+
+绑定宿主 `CODEXLY_CODEX_HOME` 时，应同时把 `CODEXLY_WORKSPACE` 设置为已有项目的公共父目录。Codex 保存的项目绝对路径随后可在宿主和容器中保持一致。
+
+容器不会自动继承宿主 Git 身份。将 `CODEXLY_GIT_CONFIG` 设置为容器可见的全局 Git 配置文件；在 Linux 和 macOS 的同路径工作区中可直接填写宿主 `~/.gitconfig` 的绝对路径。使用 SSH 远程时，将 `CODEXLY_SSH_HOME` 设置为宿主 `~/.ssh` 的绝对路径。
+
+Docker 只能访问 Docker Engine 已共享的宿主路径。Windows 需将 `CODEXLY_WORKSPACE` 设置为已共享盘符（例如 `C:/`），并设置 `CODEXLY_WORKSPACE_TARGET=/workspace`。Windows 与 Linux 容器的绝对路径格式不同，不能直接复用包含宿主项目记录的 Codex Home；需要多个盘符时，在 Compose 中增加 bind mount，并在 `command` 中重复传入 `--workspace`。
+
+| 变量                       | 用途                                                |
+| -------------------------- | --------------------------------------------------- |
+| `CODEXLY_VERSION`          | 指定 GHCR 镜像标签，默认 `latest`                   |
+| `CODEXLY_PORT`             | 同时设置宿主与容器端口，默认 `3210`                 |
+| `CODEXLY_WORKSPACE`        | 限制工作区并在容器内保留相同绝对路径，默认 `/`      |
+| `CODEXLY_WORKSPACE_TARGET` | 覆盖容器工作区路径，Windows 使用 `/workspace`       |
+| `CODEXLY_GIT_CONFIG`       | 指定容器可见的全局 Git 配置文件                     |
+| `CODEXLY_SSH_HOME`         | 只读挂载宿主 SSH 配置、私钥和 `known_hosts`         |
+| `CODEXLY_CODEX_HOME`       | 绑定宿主 Codex Home，替代默认 `codexly-data` 命名卷 |
+| `CODEXLY_LAN_PASSWORD`     | 设置固定强密码，替代日志中生成的随机配对码          |
+| `CODEXLY_ALLOWED_HOSTS`    | 设置逗号分隔的反向代理精确域名                      |
+| `CODEXLY_SESSION_TTL`      | 设置固定会话期限，例如 `12h`                        |
+
+镜像入口支持全部 CLI 参数，编排平台可按需覆盖 `command`。工作区、多磁盘、Codex Home、更新、备份和故障排查参见[完整 Docker Compose 部署指南](docs/docker-deployment.md)。开发仓库可运行 `pnpm docker:build && pnpm docker:test` 构建并冒烟测试本地镜像。
+
 ## 使用方式
 
 不依赖项目时，直接选择“新建任务”。处理仓库时，先添加一个或多个运行端目录作为有序的项目根，再创建任务，并按需附加文件、图片、项目引用或 Skills 后提交需求。归档的任务可以从项目任务列表中恢复或永久删除。
@@ -68,12 +109,13 @@ codexly start --lan
 
 终端会输出局域网地址和随机访问密码。常用选项如下：
 
-| 选项                        | 用途                                                  |
-| --------------------------- | ----------------------------------------------------- |
-| `--port <port>`             | 指定起始端口；端口被占用时自动尝试后续端口            |
-| `--lan-password <password>` | 设置 16 至 128 位密码，必须包含大小写字母、数字和符号 |
-| `--allowed-host <domain>`   | 允许精确的反向代理域名；多个域名可重复传入            |
-| `--session-ttl <duration>`  | 设置固定会话期限，如 `12h`；省略时持续到 Server 重启  |
+| 选项                        | 用途                                                 |
+| --------------------------- | ---------------------------------------------------- |
+| `--port <port>`             | 指定起始端口；端口被占用时自动尝试后续端口           |
+| `--lan-password <password>` | 设置 16 至 128 位密码，必须包含大小写字母和数字      |
+| `--allowed-host <domain>`   | 允许精确的反向代理域名；多个域名可重复传入           |
+| `--session-ttl <duration>`  | 设置固定会话期限，如 `12h`；省略时持续到 Server 重启 |
+| `--workspace <path>`        | 限制项目选择的绝对根目录；多个根目录可重复传入       |
 
 密码含 Shell 特殊字符时请使用引号。局域网模式使用未加密 HTTP，只能用于可信网络，禁止直接暴露到互联网。重启 Codexly 会使密码和全部会话失效。