@seele00/seele 0.1.60

package/scripts/deploy/bootstrap.sh

@@ -0,0 +1,318 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
+
+ENV_FILE=""
+CLI_AUTH_MODE=""
+START_AFTER=0
+SKIP_BUILD=0
+
+usage() {
+  cat <<'EOF'
+Usage: ./scripts/deploy/bootstrap.sh [options]
+
+Options:
+  --env PATH             Load deployment environment variables from PATH.
+  --auth MODE            device | auth-json | token | none. Defaults to device.
+  --start                Start Seele Codex after bootstrap succeeds.
+  --skip-build           Skip pnpm install/build.
+  -h, --help             Show this help.
+
+Typical first run:
+
+  cp scripts/deploy/seele.env.example seele.env
+  ./scripts/deploy/bootstrap.sh --env ./seele.env --auth device --start
+EOF
+}
+
+main() {
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --env)
+      ENV_FILE="${2:-}"
+      shift 2
+      ;;
+    --auth)
+      CLI_AUTH_MODE="${2:-}"
+      shift 2
+      ;;
+    --start)
+      START_AFTER=1
+      shift
+      ;;
+    --skip-build)
+      SKIP_BUILD=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [ -n "$ENV_FILE" ]; then
+  if [ ! -f "$ENV_FILE" ]; then
+    echo "Environment file not found: $ENV_FILE" >&2
+    exit 1
+  fi
+  set -a
+  # shellcheck disable=SC1090
+  . "$ENV_FILE"
+  set +a
+fi
+
+if [ -z "${SEELE_ROOT:-}" ]; then
+  echo "SEELE_ROOT is required for this deployment test." >&2
+  echo "Ask the package owner or target-environment owner for the Seele root directory and put it in seele.env." >&2
+  exit 1
+fi
+export SEELE_ROOT
+AUTH_MODE="${CLI_AUTH_MODE:-${SEELE_DEPLOY_AUTH_MODE:-device}}"
+RUNTIME_DIR="${SEELE_RUNTIME_DIR:-$SEELE_ROOT/.runtime}"
+export SEELE_RUNTIME_DIR="$RUNTIME_DIR"
+export CODEX_HOME="${CODEX_HOME:-$RUNTIME_DIR/codex-home}"
+export CODEX_INSTALL_DIR="$RUNTIME_DIR/bin"
+export SEELE_CODEX_WORKSPACE_ROOT="${SEELE_CODEX_WORKSPACE_ROOT:-$SEELE_ROOT/workspaces}"
+export SEELE_CODEX_WEB_DIST="${SEELE_CODEX_WEB_DIST:-$ROOT_DIR/web/dist}"
+export SEELE_PUBLIC_BASE_PATH="$(normalize_base_path "${SEELE_PUBLIC_BASE_PATH:-/}")"
+export PATH="$CODEX_INSTALL_DIR:$PATH"
+
+if [ -z "${SEELE_PROXY:-}" ]; then
+  echo "SEELE_PROXY is required for this deployment test." >&2
+  echo "Ask the package owner for the proxy value, put it in seele.env, then rerun bootstrap." >&2
+  exit 1
+fi
+
+normalize_proxy_env
+
+mkdir -p "$RUNTIME_DIR" "$CODEX_HOME" "$CODEX_INSTALL_DIR" "$SEELE_CODEX_WORKSPACE_ROOT"
+chmod 700 "$CODEX_HOME"
+
+ensure_node
+ensure_codex_cli
+write_codex_config
+authenticate_codex "$AUTH_MODE"
+
+if [ "$SKIP_BUILD" -eq 0 ]; then
+  ensure_pnpm
+  pnpm install --frozen-lockfile
+  pnpm build
+fi
+
+cat <<EOF
+Seele Codex bootstrap completed.
+
+Runtime directory: $RUNTIME_DIR
+Codex home: $CODEX_HOME
+Codex install dir: $CODEX_INSTALL_DIR
+Workspace root: $SEELE_CODEX_WORKSPACE_ROOT
+EOF
+
+if [ "$START_AFTER" -eq 1 ]; then
+  if [ -n "$ENV_FILE" ]; then
+    exec "$ROOT_DIR/scripts/deploy/start.sh" --env "$ENV_FILE"
+  fi
+  exec "$ROOT_DIR/scripts/deploy/start.sh"
+fi
+}
+
+normalize_proxy_env() {
+  export NO_PROXY="${NO_PROXY:-127.0.0.1,localhost,.svc,.cluster.local}"
+  export no_proxy="$NO_PROXY"
+}
+
+with_runtime_proxy() {
+  if [ -n "${SEELE_PROXY:-}" ]; then
+    ALL_PROXY="$SEELE_PROXY" \
+      HTTP_PROXY="$SEELE_PROXY" \
+      HTTPS_PROXY="$SEELE_PROXY" \
+      all_proxy="$SEELE_PROXY" \
+      http_proxy="$SEELE_PROXY" \
+      https_proxy="$SEELE_PROXY" \
+      "$@"
+    return
+  fi
+
+  "$@"
+}
+
+normalize_base_path() {
+  local value="$1"
+  if [ -z "$value" ]; then
+    value="/"
+  fi
+  value="/${value#/}"
+  value="${value%/}/"
+  printf '%s' "$value"
+}
+
+replace_path_atomically() {
+  node -e 'require("node:fs").renameSync(process.argv[1], process.argv[2])' "$1" "$2"
+}
+
+ensure_node() {
+  if ! command -v node >/dev/null 2>&1; then
+    echo "node is required. Install Node.js 24 LTS before running this script." >&2
+    exit 1
+  fi
+
+  node -e 'const major = Number(process.versions.node.split(".")[0]); if (major !== 24) { console.error(`Node.js 24 LTS is required. Current: ${process.version}`); process.exit(1); }'
+}
+
+ensure_pnpm() {
+  if command -v pnpm >/dev/null 2>&1; then
+    return
+  fi
+
+  if ! command -v corepack >/dev/null 2>&1; then
+    echo "pnpm is required, or corepack must be available to install pnpm." >&2
+    exit 1
+  fi
+
+  corepack enable
+  corepack prepare pnpm@9.15.0 --activate
+}
+
+ensure_codex_cli() {
+  if [ -x "$CODEX_INSTALL_DIR/codex" ]; then
+    local current_version_output=""
+    if current_version_output="$("$CODEX_INSTALL_DIR/codex" --version 2>/dev/null)"; then
+      echo "Using Seele-managed Codex CLI: $current_version_output"
+      return
+    fi
+    echo "WARNING: The existing Seele-managed Codex CLI is not runnable on this platform." >&2
+    echo "Start Seele, open Settings > Runtime > Check Update, and explicitly start the reinstall." >&2
+    return
+  fi
+
+  if ! command -v npm >/dev/null 2>&1; then
+    echo "npm is required to install Codex CLI automatically." >&2
+    exit 1
+  fi
+
+  local codex_root="$RUNTIME_DIR/codex"
+  local versions_dir="$codex_root/versions"
+  local staging_dir="$codex_root/.staging-bootstrap-$$"
+  mkdir -p "$versions_dir"
+  rm -rf "$staging_dir"
+
+  echo "Installing Codex CLI into staging: $staging_dir"
+  with_runtime_proxy npm install \
+    --global \
+    --prefix "$staging_dir" \
+    --no-audit \
+    --no-fund \
+    @openai/codex@latest
+
+  local staging_bin="$staging_dir/bin/codex"
+  if [ ! -x "$staging_bin" ]; then
+    echo "Codex CLI installation completed, but the staged binary was not found at $staging_bin." >&2
+    exit 1
+  fi
+
+  local version_output
+  local version
+  version_output="$("$staging_bin" --version)"
+  version="${version_output#codex-cli }"
+  case "$version" in
+    ""|*[!0-9A-Za-z._-]*)
+      echo "Unable to determine a safe Codex CLI version from: $version_output" >&2
+      exit 1
+      ;;
+  esac
+
+  local platform
+  local architecture
+  platform="$(node -p 'process.platform')"
+  architecture="$(node -p 'process.arch')"
+  local version_dir="$versions_dir/$version-$platform-$architecture"
+  if [ -e "$version_dir" ]; then
+    if [ ! -x "$version_dir/bin/codex" ] || [ "$("$version_dir/bin/codex" --version)" != "$version_output" ]; then
+      echo "Existing Codex CLI version directory is invalid: $version_dir" >&2
+      exit 1
+    fi
+    rm -rf "$staging_dir"
+  else
+    mv "$staging_dir" "$version_dir"
+  fi
+
+  local current_next="$codex_root/current.next-$$"
+  local launcher_next="$CODEX_INSTALL_DIR/codex.next-$$"
+  ln -s "versions/$version" "$current_next"
+  replace_path_atomically "$current_next" "$codex_root/current"
+  ln -s "../codex/current/bin/codex" "$launcher_next"
+  replace_path_atomically "$launcher_next" "$CODEX_INSTALL_DIR/codex"
+  hash -r
+
+  if [ ! -x "$CODEX_INSTALL_DIR/codex" ]; then
+    echo "Codex CLI activation failed at $CODEX_INSTALL_DIR/codex." >&2
+    exit 1
+  fi
+  echo "Codex CLI: $("$CODEX_INSTALL_DIR/codex" --version)"
+}
+
+write_codex_config() {
+  local config_file="$CODEX_HOME/config.toml"
+  if [ -f "$config_file" ]; then
+    return
+  fi
+
+  cat > "$config_file" <<'EOF'
+cli_auth_credentials_store = "file"
+EOF
+  chmod 600 "$config_file"
+}
+
+authenticate_codex() {
+  local mode="$1"
+  local auth_file="$CODEX_HOME/auth.json"
+
+  if [ "${SEELE_FORCE_CODEX_LOGIN:-0}" != "1" ] && [ -s "$auth_file" ]; then
+    echo "Codex auth cache already exists at $auth_file; skipping login."
+    return
+  fi
+
+  case "$mode" in
+    device)
+      echo "Starting Codex device-code login."
+      echo "Open the printed URL in your local browser and enter the code shown by Codex."
+      with_runtime_proxy codex login --device-auth
+      ;;
+    auth-json)
+      if [ -z "${CODEX_AUTH_JSON:-}" ]; then
+        echo "CODEX_AUTH_JSON is required when --auth auth-json is used." >&2
+        exit 1
+      fi
+      if [ ! -f "$CODEX_AUTH_JSON" ]; then
+        echo "CODEX_AUTH_JSON file not found: $CODEX_AUTH_JSON" >&2
+        exit 1
+      fi
+      cp "$CODEX_AUTH_JSON" "$auth_file"
+      chmod 600 "$auth_file"
+      ;;
+    token)
+      if [ -z "${CODEX_ACCESS_TOKEN:-}" ]; then
+        echo "CODEX_ACCESS_TOKEN is required when --auth token is used." >&2
+        exit 1
+      fi
+      printf '%s' "$CODEX_ACCESS_TOKEN" | with_runtime_proxy codex login --with-access-token
+      ;;
+    none)
+      echo "Skipping Codex authentication."
+      ;;
+    *)
+      echo "Unknown auth mode: $mode" >&2
+      exit 1
+    ;;
+  esac
+}
+
+main "$@"

package/scripts/deploy/npm/postinstall.mjs

@@ -0,0 +1,10 @@
+import { mkdir, rm, symlink } from "node:fs/promises";
+import path from "node:path";
+
+const packageRoot = path.resolve(import.meta.dirname, "../../..");
+const scopeDir = path.join(packageRoot, "node_modules", "@seele-codex");
+const linkPath = path.join(scopeDir, "codex");
+
+await mkdir(scopeDir, { recursive: true });
+await rm(linkPath, { force: true, recursive: true });
+await symlink(path.join(packageRoot, "codex"), linkPath, "dir");

package/scripts/deploy/prepare-proxy.sh

@@ -0,0 +1,273 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# prepare-proxy.sh
+#
+# Prepare a clean LOCAL no-auth proxy entrypoint for Codex.
+#
+# Why this exists:
+#   Some Codex HTTP clients (models refresh, MCP / ps/mcp) issue a bare
+#   HTTP CONNECT to the configured proxy WITHOUT forwarding proxy credentials.
+#   If the upstream proxy requires authentication it answers 407 and resets
+#   the stream, surfacing as `stream disconnected before completion` /
+#   `Transport channel closed`. The main response path uses SOCKS5 with creds
+#   and works, which is why only those two auxiliary features break.
+#
+# Fix (no Codex change, purely at the proxy layer):
+#   Run a LOCAL no-auth proxy listener. Codex sends its bare CONNECT to this
+#   local listener (no auth required -> accepted). The local listener then
+#   forwards upstream WITH the credentials taken from SEELE_UPSTREAM_PROXY.
+#
+#   codex --bare CONNECT (no creds)--> 127.0.0.1:<port> (no auth)
+#         --with creds--> SEELE_UPSTREAM_PROXY (socks5 exit) --> OpenAI
+#
+# IMPORTANT config model:
+#   The Seele server injects SEELE_PROXY into the Codex environment
+#   (ALL_PROXY/HTTP_PROXY/...). So Codex uses SEELE_PROXY directly. Therefore:
+#     SEELE_PROXY           = the LOCAL no-auth entrypoint (http://127.0.0.1:<port>)
+#     SEELE_UPSTREAM_PROXY  = the real credentialed upstream (socks5 exit)
+#   Codex talks to the local no-auth entrypoint; only this script holds the
+#   upstream credentials and forwards to the real exit.
+#
+# After running this, the Codex runtime (via SEELE_PROXY) and any other script
+# can simply use:
+#   http://127.0.0.1:<port>
+# as their proxy, without ever handling credentials themselves.
+#
+# This replaces all the network-layer workarounds explored earlier
+# (WireGuard tunnel, MTU tweaks, custom routes): none of them are needed,
+# the upstream SOCKS5 exit is directly reachable.
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
+
+ENV_FILE=""
+ACTION="start"
+
+usage() {
+  cat <<'EOF'
+Usage: ./scripts/deploy/prepare-proxy.sh [--env PATH] [--status|--stop]
+
+Prepares a local no-auth proxy entrypoint that forwards to the credentialed
+upstream (SEELE_UPSTREAM_PROXY), so Codex (via SEELE_PROXY) and other scripts
+can use http://127.0.0.1:<port> without handling credentials.
+
+Options:
+  --env PATH   Load configuration from an env file (e.g. ./seele.env).
+  --status     Show whether the local proxy is running and exit.
+  --stop       Stop the local proxy and exit.
+  -h, --help   Show this help.
+
+Relevant variables (from --env file or environment):
+  SEELE_UPSTREAM_PROXY     Real upstream proxy WITH credentials (required).
+                           Format: scheme://user:pass@host:port
+                           e.g. socks5h://user:pass@47.77.237.69:28888
+  SEELE_LOCAL_PROXY_PORT   Local listen port for the no-auth entrypoint.
+                           Default: 55860
+  SEELE_LOCAL_PROXY_ADDR   Local proxy URL other components should use.
+                           Default: http://127.0.0.1:<SEELE_LOCAL_PROXY_PORT>
+                           Set SEELE_PROXY to this value so Codex uses it.
+  SEELE_GOST_BIN           Path to the gost binary. Default: looked up on
+                           PATH, then $SEELE_ROOT/gost, then ./gost.
+  SEELE_PROXY_PID_FILE     PID file. Default: $SEELE_ROOT/.runtime/prepare-proxy.pid
+                           (falls back to /tmp/seele-prepare-proxy.pid).
+  SEELE_PROXY_LOG_FILE     Log file. Default: $SEELE_ROOT/.runtime/prepare-proxy.log
+                           (falls back to /tmp/seele-prepare-proxy.log).
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --env)
+      ENV_FILE="${2:-}"
+      shift 2
+      ;;
+    --status)
+      ACTION="status"
+      shift
+      ;;
+    --stop)
+      ACTION="stop"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [ -n "$ENV_FILE" ]; then
+  if [ ! -f "$ENV_FILE" ]; then
+    echo "Environment file not found: $ENV_FILE" >&2
+    exit 1
+  fi
+  set -a
+  # shellcheck disable=SC1090
+  . "$ENV_FILE"
+  set +a
+fi
+
+LOCAL_PORT="${SEELE_LOCAL_PROXY_PORT:-55860}"
+LOCAL_ADDR="${SEELE_LOCAL_PROXY_ADDR:-http://127.0.0.1:${LOCAL_PORT}}"
+
+# Choose a writable runtime location for pid/log.
+RUNTIME_BASE=""
+if [ -n "${SEELE_ROOT:-}" ] && [ -d "${SEELE_ROOT}/.runtime" ]; then
+  RUNTIME_BASE="${SEELE_ROOT}/.runtime"
+elif [ -n "${SEELE_RUNTIME_DIR:-}" ] && [ -d "${SEELE_RUNTIME_DIR}" ]; then
+  RUNTIME_BASE="${SEELE_RUNTIME_DIR}"
+fi
+if [ -n "$RUNTIME_BASE" ]; then
+  PID_FILE="${SEELE_PROXY_PID_FILE:-${RUNTIME_BASE}/prepare-proxy.pid}"
+  LOG_FILE="${SEELE_PROXY_LOG_FILE:-${RUNTIME_BASE}/prepare-proxy.log}"
+else
+  PID_FILE="${SEELE_PROXY_PID_FILE:-/tmp/seele-prepare-proxy.pid}"
+  LOG_FILE="${SEELE_PROXY_LOG_FILE:-/tmp/seele-prepare-proxy.log}"
+fi
+
+is_running() {
+  # Returns 0 if a local proxy we manage is still alive.
+  if [ -f "$PID_FILE" ]; then
+    local pid
+    pid="$(cat "$PID_FILE" 2>/dev/null || true)"
+    if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+port_listening() {
+  if command -v ss >/dev/null 2>&1; then
+    ss -tlnH "( sport = :${LOCAL_PORT} )" 2>/dev/null | grep -q ":${LOCAL_PORT}"
+  else
+    return 1
+  fi
+}
+
+stop_proxy() {
+  if is_running; then
+    local pid
+    pid="$(cat "$PID_FILE")"
+    kill "$pid" 2>/dev/null || true
+    sleep 1
+    kill -9 "$pid" 2>/dev/null || true
+  fi
+  rm -f "$PID_FILE"
+}
+
+case "$ACTION" in
+  status)
+    if is_running; then
+      echo "local proxy: RUNNING (pid $(cat "$PID_FILE"), $LOCAL_ADDR)"
+      exit 0
+    fi
+    if port_listening; then
+      echo "local proxy: port ${LOCAL_PORT} is listening but not managed by this script"
+      exit 0
+    fi
+    echo "local proxy: NOT running"
+    exit 1
+    ;;
+  stop)
+    stop_proxy
+    echo "local proxy: stopped"
+    exit 0
+    ;;
+esac
+
+# --- start ---
+
+if [ -z "${SEELE_UPSTREAM_PROXY:-}" ]; then
+  echo "SEELE_UPSTREAM_PROXY is required (real upstream proxy WITH credentials)." >&2
+  echo "Set it in seele.env, e.g.:" >&2
+  echo "  SEELE_UPSTREAM_PROXY=socks5h://user:password@47.77.237.69:28888" >&2
+  echo "And set SEELE_PROXY to the local entrypoint so Codex uses it:" >&2
+  echo "  SEELE_PROXY=${LOCAL_ADDR}" >&2
+  exit 1
+fi
+
+# Guard against a misconfiguration where the upstream points back at the
+# local entrypoint (would create a forwarding loop).
+case "$SEELE_UPSTREAM_PROXY" in
+  *127.0.0.1:${LOCAL_PORT}*|*localhost:${LOCAL_PORT}*)
+    echo "SEELE_UPSTREAM_PROXY must point at the real upstream exit, not the" >&2
+    echo "local entrypoint (${LOCAL_ADDR}). Fix seele.env." >&2
+    exit 1
+    ;;
+esac
+
+# Normalize the upstream URL into a gost -F forward URL.
+# gost forwarder does not understand the "h" suffix (socks5h); it always
+# resolves the destination at the proxy side, so socks5h -> socks5.
+UPSTREAM="$SEELE_UPSTREAM_PROXY"
+case "$UPSTREAM" in
+  socks5h://*) UPSTREAM="socks5://${UPSTREAM#socks5h://}" ;;
+esac
+
+# Locate gost binary.
+GOST_BIN="${SEELE_GOST_BIN:-}"
+if [ -z "$GOST_BIN" ]; then
+  if command -v gost >/dev/null 2>&1; then
+    GOST_BIN="$(command -v gost)"
+  elif [ -n "${SEELE_ROOT:-}" ] && [ -x "${SEELE_ROOT}/gost" ]; then
+    GOST_BIN="${SEELE_ROOT}/gost"
+  elif [ -x "${ROOT_DIR}/gost" ]; then
+    GOST_BIN="${ROOT_DIR}/gost"
+  fi
+fi
+if [ -z "$GOST_BIN" ] || [ ! -x "$GOST_BIN" ]; then
+  echo "gost binary not found." >&2
+  echo "Install gost and either put it on PATH, set SEELE_GOST_BIN," >&2
+  echo "or place it at \$SEELE_ROOT/gost." >&2
+  exit 1
+fi
+
+# Idempotent: if already running, restart cleanly to pick up config changes.
+if is_running; then
+  echo "local proxy already running (pid $(cat "$PID_FILE")), restarting..."
+  stop_proxy
+fi
+
+if port_listening; then
+  echo "Port ${LOCAL_PORT} is already in use by another process." >&2
+  echo "Set SEELE_LOCAL_PROXY_PORT to a free port, or stop the other process." >&2
+  exit 1
+fi
+
+# Start the local no-auth HTTP+SOCKS entrypoint (-L=http://:PORT has no creds)
+# forwarding to the credentialed upstream (-F).
+nohup "$GOST_BIN" -L="http://:${LOCAL_PORT}" -F="$UPSTREAM" \
+  > "$LOG_FILE" 2>&1 &
+echo $! > "$PID_FILE"
+
+# Wait for the listener to come up.
+ok=0
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  if port_listening; then ok=1; break; fi
+  sleep 0.3
+done
+
+if [ "$ok" != "1" ]; then
+  echo "local proxy failed to start; see $LOG_FILE" >&2
+  tail -n 20 "$LOG_FILE" >&2 || true
+  exit 1
+fi
+
+echo "local proxy ready."
+echo "  listen  : ${LOCAL_ADDR}  (no auth)"
+echo "  upstream: ${UPSTREAM%%@*}@***  (creds from SEELE_UPSTREAM_PROXY)"
+echo "  pid     : $(cat "$PID_FILE")"
+echo "  log     : ${LOG_FILE}"
+echo
+echo "Make sure seele.env has SEELE_PROXY pointing at this entrypoint:"
+echo "  SEELE_PROXY=${LOCAL_ADDR}"
+echo
+echo "Other scripts can use this proxy directly:"
+echo "  export HTTP_PROXY=${LOCAL_ADDR} HTTPS_PROXY=${LOCAL_ADDR} ALL_PROXY=${LOCAL_ADDR}"

package/scripts/deploy/seele.env.example

@@ -0,0 +1,75 @@
+# Copy this file to seele.env and edit it on the target Linux host or pod.
+# Do not commit seele.env. It can contain proxy credentials and Codex auth data.
+
+# Confirm these with the package owner or target-environment owner before
+# running bootstrap.sh. Do not invent them.
+#
+# Public listen address and port for the single Seele Codex service.
+# Use 0.0.0.0 only when the service must be reachable from outside the pod.
+SEELE_CODEX_HOST=0.0.0.0
+SEELE_CODEX_PORT=3000
+
+# Required to bootstrap the first admin when SEELE_CODEX_HOST is not loopback.
+# Store it in the deployment secret store or the uncommitted seele.env file.
+SEELE_AUTH_USERNAME=admin
+SEELE_AUTH_PASSWORD=
+# SEELE_AUTH_SESSION_TTL_SECONDS=2592000
+
+# Public base path used by the reverse proxy. Use "/" only when exposed at
+# domain root. If exposed under a subpath, use the actual externally visible
+# prefix confirmed by the deployment owner.
+SEELE_PUBLIC_BASE_PATH=/
+
+# Required: confirm this with the package owner or target-environment owner.
+# SEELE_ROOT is the single root directory for this Seele deployment:
+#   Codex runtime state: $SEELE_ROOT/.runtime
+#   Seele workspace data: $SEELE_ROOT/workspaces
+SEELE_ROOT=
+
+# Advanced overrides. Leave these unset unless the package owner confirms a
+# different layout.
+# SEELE_RUNTIME_DIR=$SEELE_ROOT/.runtime
+# SEELE_CODEX_WORKSPACE_ROOT=$SEELE_ROOT/workspaces
+
+# SEELE_PROXY is injected into the Codex subprocess (ALL_PROXY/HTTP_PROXY/...).
+# Some Codex HTTP clients (models refresh / MCP) issue a bare HTTP CONNECT
+# WITHOUT proxy credentials; an upstream proxy that requires auth replies 407
+# and resets the stream (models/MCP fail while the main answer still works).
+#
+# Solution: point SEELE_PROXY at a LOCAL no-auth entrypoint, and let
+# scripts/deploy/prepare-proxy.sh run a local gost that forwards to the real
+# authenticated upstream. Run prepare-proxy.sh before start.sh.
+#
+#   SEELE_PROXY           -> local no-auth entrypoint Codex talks to
+#   SEELE_UPSTREAM_PROXY  -> real upstream with credentials (only the script holds it)
+#
+# Default local entrypoint port is 55860 (override via SEELE_LOCAL_PROXY_PORT).
+SEELE_PROXY=http://127.0.0.1:55860
+
+# Real upstream proxy with credentials. Used ONLY by prepare-proxy.sh as the
+# gost forward target (-F). Ask the package owner for the exact value.
+# Format: scheme://username:password@host:port  (socks5h:// or http:// etc.)
+# Example:
+# SEELE_UPSTREAM_PROXY=socks5h://user:password@proxy.example.com:28888
+SEELE_UPSTREAM_PROXY=
+NO_PROXY=127.0.0.1,localhost,.svc,.cluster.local
+
+# Authentication mode for bootstrap.sh:
+#   device    Run `codex login --device-auth` if CODEX_HOME/auth.json is missing.
+#   auth-json Copy CODEX_AUTH_JSON into CODEX_HOME/auth.json.
+#   token     Pipe CODEX_ACCESS_TOKEN to `codex login --with-access-token`.
+#   none      Skip Codex authentication.
+SEELE_DEPLOY_AUTH_MODE=device
+
+# Required only for SEELE_DEPLOY_AUTH_MODE=auth-json.
+# CODEX_AUTH_JSON=/path/to/auth.json
+
+# Required only for SEELE_DEPLOY_AUTH_MODE=token.
+# CODEX_ACCESS_TOKEN=
+
+# Optional Codex home. The managed CLI path is always
+# $SEELE_RUNTIME_DIR/bin/codex so bootstrap and Seele's updater use the same file.
+# CODEX_HOME=$SEELE_ROOT/.runtime/codex-home
+
+# Optional corporate CA bundle for Codex login and HTTPS calls.
+# CODEX_CA_CERTIFICATE=/path/to/company-ca.pem