codex-task 0.2.2 → 0.2.4

package/examples/mobile/README.md

@@ -0,0 +1,69 @@
+# CodexTask 手机端示例
+
+这里的 Android Kotlin 和 iOS Swift 客户端调用已经运行的 `codex-task serve`。推荐连接可信局域网、Tailscale/WireGuard，或带 HTTPS 的反向代理。
+
+不要把生产 Service Token 提交到 Git，也不要硬编码到公开 App。示例构造器接收 token，私有 App 可以从 Android Keystore、iOS Keychain、受管配置或用户输入中读取。
+
+## 完整示例流程
+
+两个 `MealWorkflow` 都会实际串起四类任务：
+
+1. `POST /v1/image`：根据文字和 `style.md` 生成健身营养餐。
+2. 轮询 job，读取 `result.artifacts[0].downloadUrl`，携带同一 token 下载图片。
+3. `POST /v1/text`：把图片和 JSON Schema 一起上传，做图生文营养分析。
+4. `POST /v1/task`：把营养 JSON、参考图片和服务器上的项目目录交给 Codex SDK 修改。
+5. 如果返回 `needs_input`，使用 `result.taskId` 调用 `POST /v1/tasks/:taskId/resume`。
+
+所有提交先返回 `202`、`jobId` 和 `statusUrl`。客户端轮询 `GET statusUrl`，直到 `completed`、`needs_input`、`failed` 或 `cancelled`。这种设计不会让手机保持一个可能持续数十分钟的 HTTP 请求。
+
+命名 prompt 文档格式为 `{name, content}`；图片格式为 `{name, mimeType, dataBase64}`。text、image、task 和 resume 都能组合文本、多份文档与多张图片。
+
+## Android
+
+文件：
+
+- [`android/CodexTaskClient.kt`](./android/CodexTaskClient.kt)：OkHttp + coroutines 客户端，包含四类提交、轮询与 artifact 下载。
+- [`android/MealWorkflow.kt`](./android/MealWorkflow.kt)：完整营养餐流程。
+
+Gradle 依赖：
+
+```kotlin
+implementation("com.squareup.okhttp3:okhttp:4.12.0")
+implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.10.2")
+```
+
+从 ViewModel 或协程中调用：
+
+```kotlin
+val client = CodexTaskClient("http://192.168.1.50:7777", tokenFromKeystore)
+val result = runMealWorkflow(client, "/absolute/server/path/to/meal-app")
+```
+
+Android 默认阻止明文 HTTP。生产环境应使用 HTTPS 或 VPN；仅在可信局域网开发时，才通过范围收窄的 Network Security Config 放行指定主机，不要全局允许明文流量。
+
+## iOS
+
+文件：
+
+- [`ios/CodexTaskClient.swift`](./ios/CodexTaskClient.swift)：Foundation `URLSession` async/await 客户端。
+- [`ios/MealWorkflow.swift`](./ios/MealWorkflow.swift)：与 Android 相同的完整流程。
+
+调用示例：
+
+```swift
+let client = CodexTaskClient(baseURL: URL(string: "http://192.168.1.50:7777")!, token: tokenFromKeychain)
+let result = try await runMealWorkflow(client: client, serverProjectPath: "/absolute/server/path/to/meal-app")
+```
+
+iOS App Transport Security 默认阻止明文 HTTP。生产环境应使用 HTTPS 或 VPN；局域网调试时只为目标域名配置 ATS 开发例外。
+
+## 服务地址
+
+`0.0.0.0` 是电脑的监听地址，不是手机可以访问的目标地址。App 应配置电脑可达的地址，例如：
+
+```text
+http://192.168.1.50:7777
+https://codex-task.example.internal
+```
+
+平台安装脚本打印的 token 通过 `Authorization: Bearer <token>` 发送。持有 token 的手机可以触发服务器上该用户权限范围内的 CodexTask；尤其要谨慎开放 `/v1/task`。

package/examples/mobile/android/CodexTaskClient.kt

@@ -0,0 +1,126 @@
+package xin.wangye.codextask
+
+import android.util.Base64
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.withContext
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONArray
+import org.json.JSONObject
+
+data class PromptDocument(val name: String, val content: String)
+data class RemoteImage(val name: String, val mimeType: String, val bytes: ByteArray)
+data class JobReceipt(val jobId: String, val statusUrl: String)
+
+class CodexTaskClient(
+    baseUrl: String,
+    private val token: String,
+    private val http: OkHttpClient = OkHttpClient(),
+) {
+    private val baseUrl = baseUrl.trimEnd('/')
+    private val jsonMediaType = "application/json; charset=utf-8".toMediaType()
+    private val terminal = setOf("completed", "needs_input", "failed", "cancelled")
+
+    suspend fun submitText(
+        prompt: String,
+        promptFiles: List<PromptDocument> = emptyList(),
+        images: List<RemoteImage> = emptyList(),
+        schema: JSONObject? = null,
+    ): JobReceipt = submit("/v1/text", payload(prompt, promptFiles, images).apply {
+        put("backend", "direct")
+        put("reasoning", "medium")
+        if (schema != null) put("schema", schema)
+    })
+
+    suspend fun submitImage(
+        prompt: String,
+        promptFiles: List<PromptDocument> = emptyList(),
+        images: List<RemoteImage> = emptyList(),
+        quality: String = "high",
+    ): JobReceipt = submit("/v1/image", payload(prompt, promptFiles, images).apply {
+        put("backend", "direct")
+        put("quality", quality)
+        put("count", 1)
+    })
+
+    suspend fun submitTask(
+        prompt: String,
+        workingDirectory: String,
+        promptFiles: List<PromptDocument> = emptyList(),
+        images: List<RemoteImage> = emptyList(),
+    ): JobReceipt = submit("/v1/task", payload(prompt, promptFiles, images).apply {
+        put("workingDirectory", workingDirectory)
+        put("sandboxMode", "danger-full-access")
+        put("networkAccess", true)
+    })
+
+    suspend fun resume(
+        taskId: String,
+        answer: String,
+        promptFiles: List<PromptDocument> = emptyList(),
+        images: List<RemoteImage> = emptyList(),
+    ): JobReceipt = submit("/v1/tasks/$taskId/resume", payload(answer, promptFiles, images))
+
+    suspend fun awaitJob(receipt: JobReceipt, pollEveryMillis: Long = 1_000): JSONObject {
+        while (true) {
+            val snapshot = getJson(receipt.statusUrl)
+            if (snapshot.getString("status") in terminal) return snapshot
+            delay(pollEveryMillis)
+        }
+    }
+
+    suspend fun downloadArtifact(downloadUrl: String): ByteArray = withContext(Dispatchers.IO) {
+        val request = authorized(Request.Builder().url(resolve(downloadUrl))).get().build()
+        http.newCall(request).execute().use { response ->
+            if (!response.isSuccessful) error("Artifact download failed: HTTP ${response.code}")
+            response.body?.bytes() ?: error("Artifact response is empty")
+        }
+    }
+
+    private suspend fun submit(path: String, body: JSONObject): JobReceipt {
+        val json = postJson(path, body)
+        return JobReceipt(json.getString("jobId"), json.getString("statusUrl"))
+    }
+
+    private suspend fun postJson(path: String, body: JSONObject): JSONObject = withContext(Dispatchers.IO) {
+        val request = authorized(Request.Builder().url(resolve(path)))
+            .post(body.toString().toRequestBody(jsonMediaType))
+            .build()
+        executeJson(request)
+    }
+
+    private suspend fun getJson(path: String): JSONObject = withContext(Dispatchers.IO) {
+        executeJson(authorized(Request.Builder().url(resolve(path))).get().build())
+    }
+
+    private fun executeJson(request: Request): JSONObject {
+        http.newCall(request).execute().use { response ->
+            val text = response.body?.string().orEmpty()
+            if (!response.isSuccessful) error("CodexTask HTTP ${response.code}: $text")
+            return JSONObject(text)
+        }
+    }
+
+    private fun payload(
+        prompt: String,
+        promptFiles: List<PromptDocument>,
+        images: List<RemoteImage>,
+    ): JSONObject = JSONObject().apply {
+        put("prompt", prompt)
+        put("promptFiles", JSONArray(promptFiles.map { JSONObject().put("name", it.name).put("content", it.content) }))
+        put("images", JSONArray(images.map {
+            JSONObject()
+                .put("name", it.name)
+                .put("mimeType", it.mimeType)
+                .put("dataBase64", Base64.encodeToString(it.bytes, Base64.NO_WRAP))
+        }))
+    }
+
+    private fun authorized(builder: Request.Builder): Request.Builder =
+        builder.header("Authorization", "Bearer $token")
+
+    private fun resolve(path: String): String = if (path.startsWith("http")) path else "$baseUrl$path"
+}

package/examples/mobile/android/MealWorkflow.kt

@@ -0,0 +1,51 @@
+package xin.wangye.codextask
+
+import org.json.JSONObject
+
+suspend fun runMealWorkflow(
+    client: CodexTaskClient,
+    serverProjectPath: String,
+): JSONObject {
+    val imageJob = client.submitImage(
+        prompt = "生成一张俯拍的健身营养餐：煎鸡胸肉、糙米、西兰花、牛油果，写实摄影，干净背景",
+        promptFiles = listOf(PromptDocument("style.md", "自然光，食物边界清楚，不要文字和水印")),
+    )
+    val imageResult = client.awaitJob(imageJob)
+    check(imageResult.getString("status") == "completed")
+    val imageDownloadUrl = imageResult
+        .getJSONObject("result")
+        .getJSONArray("artifacts")
+        .getJSONObject(0)
+        .getString("downloadUrl")
+    val mealPng = client.downloadArtifact(imageDownloadUrl)
+    val meal = RemoteImage("meal.png", "image/png", mealPng)
+    val nutritionSchema = JSONObject(
+        """{"type":"object","properties":{"foods":{"type":"array"},"totalCalories":{"type":"number"}},"required":["foods","totalCalories"],"additionalProperties":false}""",
+    )
+
+    val textJob = client.submitText(
+        prompt = "识别食物并估算总热量，只返回 JSON",
+        images = listOf(meal),
+        schema = nutritionSchema,
+    )
+    val nutrition = client.awaitJob(textJob)
+    check(nutrition.getString("status") == "completed")
+
+    val taskJob = client.submitTask(
+        prompt = "根据营养分析实现餐食详情页并运行测试",
+        workingDirectory = serverProjectPath,
+        promptFiles = listOf(PromptDocument("nutrition.json", nutrition.getJSONObject("result").getString("text"))),
+        images = listOf(meal),
+    )
+    val task = client.awaitJob(taskJob)
+    if (task.getString("status") != "needs_input") return task
+
+    val taskId = task.getJSONObject("result").getString("taskId")
+    return client.awaitJob(
+        client.resume(
+            taskId = taskId,
+            answer = "按单人份展示热量",
+            images = listOf(meal),
+        ),
+    )
+}

package/examples/mobile/ios/CodexTaskClient.swift

@@ -0,0 +1,163 @@
+import Foundation
+
+struct PromptDocument {
+    let name: String
+    let content: String
+}
+
+struct RemoteImage {
+    let name: String
+    let mimeType: String
+    let data: Data
+}
+
+struct JobReceipt {
+    let jobId: String
+    let statusURL: String
+}
+
+enum CodexTaskClientError: Error {
+    case invalidResponse
+    case http(Int, String)
+    case server(String)
+}
+
+final class CodexTaskClient {
+    private let baseURL: URL
+    private let token: String
+    private let session: URLSession
+    private let terminalStatuses = Set(["completed", "needs_input", "failed", "cancelled"])
+
+    init(baseURL: URL, token: String, session: URLSession = .shared) {
+        self.baseURL = baseURL
+        self.token = token
+        self.session = session
+    }
+
+    func submitText(
+        prompt: String,
+        promptFiles: [PromptDocument] = [],
+        images: [RemoteImage] = [],
+        schema: [String: Any]? = nil
+    ) async throws -> JobReceipt {
+        var body = payload(prompt: prompt, promptFiles: promptFiles, images: images)
+        body["backend"] = "direct"
+        body["reasoning"] = "medium"
+        if let schema { body["schema"] = schema }
+        return try await submit(path: "/v1/text", body: body)
+    }
+
+    func submitImage(
+        prompt: String,
+        promptFiles: [PromptDocument] = [],
+        images: [RemoteImage] = []
+    ) async throws -> JobReceipt {
+        var body = payload(prompt: prompt, promptFiles: promptFiles, images: images)
+        body["backend"] = "direct"
+        body["quality"] = "high"
+        body["count"] = 1
+        return try await submit(path: "/v1/image", body: body)
+    }
+
+    func submitTask(
+        prompt: String,
+        workingDirectory: String,
+        promptFiles: [PromptDocument] = [],
+        images: [RemoteImage] = []
+    ) async throws -> JobReceipt {
+        var body = payload(prompt: prompt, promptFiles: promptFiles, images: images)
+        body["workingDirectory"] = workingDirectory
+        body["sandboxMode"] = "danger-full-access"
+        body["networkAccess"] = true
+        return try await submit(path: "/v1/task", body: body)
+    }
+
+    func resume(
+        taskId: String,
+        answer: String,
+        promptFiles: [PromptDocument] = [],
+        images: [RemoteImage] = []
+    ) async throws -> JobReceipt {
+        try await submit(
+            path: "/v1/tasks/\(taskId)/resume",
+            body: payload(prompt: answer, promptFiles: promptFiles, images: images)
+        )
+    }
+
+    func awaitJob(_ receipt: JobReceipt, pollEveryNanoseconds: UInt64 = 1_000_000_000) async throws -> [String: Any] {
+        while true {
+            let snapshot = try await getJSON(path: receipt.statusURL)
+            if let status = snapshot["status"] as? String, terminalStatuses.contains(status) { return snapshot }
+            try await Task.sleep(nanoseconds: pollEveryNanoseconds)
+        }
+    }
+
+    func downloadArtifact(path: String) async throws -> Data {
+        var request = URLRequest(url: try resolve(path))
+        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        let (data, response) = try await session.data(for: request)
+        try validate(response: response, data: data)
+        return data
+    }
+
+    private func submit(path: String, body: [String: Any]) async throws -> JobReceipt {
+        let json = try await postJSON(path: path, body: body)
+        guard let jobId = json["jobId"] as? String, let statusURL = json["statusUrl"] as? String else {
+            throw CodexTaskClientError.invalidResponse
+        }
+        return JobReceipt(jobId: jobId, statusURL: statusURL)
+    }
+
+    private func postJSON(path: String, body: [String: Any]) async throws -> [String: Any] {
+        var request = URLRequest(url: try resolve(path))
+        request.httpMethod = "POST"
+        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.httpBody = try JSONSerialization.data(withJSONObject: body)
+        return try await executeJSON(request)
+    }
+
+    private func getJSON(path: String) async throws -> [String: Any] {
+        var request = URLRequest(url: try resolve(path))
+        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        return try await executeJSON(request)
+    }
+
+    private func executeJSON(_ request: URLRequest) async throws -> [String: Any] {
+        let (data, response) = try await session.data(for: request)
+        try validate(response: response, data: data)
+        guard let json = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            throw CodexTaskClientError.invalidResponse
+        }
+        return json
+    }
+
+    private func validate(response: URLResponse, data: Data) throws {
+        guard let http = response as? HTTPURLResponse else { throw CodexTaskClientError.invalidResponse }
+        guard (200..<300).contains(http.statusCode) else {
+            throw CodexTaskClientError.http(http.statusCode, String(data: data, encoding: .utf8) ?? "")
+        }
+    }
+
+    private func payload(
+        prompt: String,
+        promptFiles: [PromptDocument],
+        images: [RemoteImage]
+    ) -> [String: Any] {
+        [
+            "prompt": prompt,
+            "promptFiles": promptFiles.map { ["name": $0.name, "content": $0.content] },
+            "images": images.map {
+                ["name": $0.name, "mimeType": $0.mimeType, "dataBase64": $0.data.base64EncodedString()]
+            },
+        ]
+    }
+
+    private func resolve(_ path: String) throws -> URL {
+        if let absolute = URL(string: path), absolute.scheme != nil { return absolute }
+        guard let resolved = URL(string: path, relativeTo: baseURL)?.absoluteURL else {
+            throw CodexTaskClientError.server("Invalid URL: \(path)")
+        }
+        return resolved
+    }
+}

package/examples/mobile/ios/MealWorkflow.swift

@@ -0,0 +1,55 @@
+import Foundation
+
+func runMealWorkflow(
+    client: CodexTaskClient,
+    serverProjectPath: String
+) async throws -> [String: Any] {
+    let imageReceipt = try await client.submitImage(
+        prompt: "生成一张俯拍的健身营养餐：煎鸡胸肉、糙米、西兰花、牛油果，写实摄影，干净背景",
+        promptFiles: [PromptDocument(name: "style.md", content: "自然光，食物边界清楚，不要文字和水印")]
+    )
+    let imageResult = try await client.awaitJob(imageReceipt)
+    guard imageResult["status"] as? String == "completed",
+          let generated = imageResult["result"] as? [String: Any],
+          let artifacts = generated["artifacts"] as? [[String: Any]],
+          let downloadPath = artifacts.first?["downloadUrl"] as? String else {
+        return imageResult
+    }
+    let mealPNG = try await client.downloadArtifact(path: downloadPath)
+    let meal = RemoteImage(name: "meal.png", mimeType: "image/png", data: mealPNG)
+    let schema: [String: Any] = [
+        "type": "object",
+        "properties": [
+            "foods": ["type": "array"],
+            "totalCalories": ["type": "number"],
+        ],
+        "required": ["foods", "totalCalories"],
+        "additionalProperties": false,
+    ]
+
+    let textReceipt = try await client.submitText(
+        prompt: "识别食物并估算总热量，只返回 JSON",
+        images: [meal],
+        schema: schema
+    )
+    let nutrition = try await client.awaitJob(textReceipt)
+    guard nutrition["status"] as? String == "completed" else { return nutrition }
+
+    let result = nutrition["result"] as? [String: Any]
+    let nutritionText = result?["text"] as? String ?? "{}"
+    let taskReceipt = try await client.submitTask(
+        prompt: "根据营养分析实现餐食详情页并运行测试",
+        workingDirectory: serverProjectPath,
+        promptFiles: [PromptDocument(name: "nutrition.json", content: nutritionText)],
+        images: [meal]
+    )
+    let task = try await client.awaitJob(taskReceipt)
+    guard task["status"] as? String == "needs_input",
+          let taskResult = task["result"] as? [String: Any],
+          let taskId = taskResult["taskId"] as? String else {
+        return task
+    }
+    return try await client.awaitJob(
+        try await client.resume(taskId: taskId, answer: "按单人份展示热量", images: [meal])
+    )
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-task",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Unofficial agent-to-agent text, image, and workspace task runner for Codex",
   "type": "module",
   "author": "wang121ye",
@@ -44,9 +44,11 @@
   "files": [
     "dist",
     "skills",
+    "scripts/service",
+    "examples/mobile",
     ".codex-plugin",
     "README.md",
-    "README.zh-CN.md",
+    "README_EN.md",
     "LICENSE",
     "THIRD_PARTY_NOTICES.md"
   ],

package/scripts/service/Install-Windows.ps1

@@ -0,0 +1,47 @@
+param(
+  [string]$HostAddress = $(if ($env:CODEX_TASK_SERVICE_HOST) { $env:CODEX_TASK_SERVICE_HOST } else { "0.0.0.0" }),
+  [int]$Port = $(if ($env:CODEX_TASK_SERVICE_PORT) { [int]$env:CODEX_TASK_SERVICE_PORT } else { 7777 }),
+  [int]$MaxConcurrency = $(if ($env:CODEX_TASK_SERVICE_CONCURRENCY) { [int]$env:CODEX_TASK_SERVICE_CONCURRENCY } else { 2 })
+)
+
+$ErrorActionPreference = "Stop"
+$TaskName = "CodexTask"
+$ServiceDir = Join-Path $env:APPDATA "codex-task\service"
+$TokenFile = Join-Path $ServiceDir "token"
+$Runner = Join-Path $ServiceDir "run.cmd"
+$LogFile = Join-Path $ServiceDir "service.log"
+
+if (-not (Get-Command npm -ErrorAction SilentlyContinue)) { throw "npm is required" }
+npm install -g codex-task@latest
+if ($LASTEXITCODE -ne 0) { throw "npm install -g codex-task@latest failed" }
+$CodexTask = (Get-Command codex-task.cmd -ErrorAction SilentlyContinue).Source
+if (-not $CodexTask) { $CodexTask = (Get-Command codex-task -ErrorAction Stop).Source }
+
+New-Item -ItemType Directory -Path $ServiceDir -Force | Out-Null
+if (-not (Test-Path $TokenFile) -or (Get-Item $TokenFile).Length -eq 0) {
+  $Token = node -e "process.stdout.write(require('node:crypto').randomBytes(32).toString('base64url'))"
+  [System.IO.File]::WriteAllText($TokenFile, $Token)
+}
+icacls $TokenFile /inheritance:r /grant:r "$env:USERNAME`:(R,W)" | Out-Null
+
+$RunnerBody = @"
+@echo off
+"$CodexTask" serve --host "$HostAddress" --port "$Port" --token-file "$TokenFile" --max-concurrency "$MaxConcurrency" >> "$LogFile" 2>&1
+"@
+[System.IO.File]::WriteAllText($Runner, $RunnerBody)
+
+$UserId = if ($env:USERDOMAIN) { "$env:USERDOMAIN\$env:USERNAME" } else { $env:USERNAME }
+$Action = New-ScheduledTaskAction -Execute (Join-Path $env:SystemRoot "System32\cmd.exe") -Argument "/d /c `"$Runner`""
+$Trigger = New-ScheduledTaskTrigger -AtLogOn -User $UserId
+$Principal = New-ScheduledTaskPrincipal -UserId $UserId -LogonType Interactive -RunLevel Limited
+$Settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero)
+$Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings -Description "Authenticated CodexTask HTTP service"
+Register-ScheduledTask -TaskName $TaskName -InputObject $Task -Force | Out-Null
+Start-ScheduledTask -TaskName $TaskName
+
+Write-Host "CodexTask scheduled task installed."
+Write-Host "URL: http://${HostAddress}:$Port"
+Write-Host "Token: $([System.IO.File]::ReadAllText($TokenFile))"
+Write-Host "Token file: $TokenFile"
+Write-Host "Log: $LogFile"
+Write-Host "The task starts when $UserId logs in so it can reuse that user's Codex environment."

package/scripts/service/Uninstall-Windows.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference = "Stop"
+$TaskName = "CodexTask"
+$ServiceDir = Join-Path $env:APPDATA "codex-task\service"
+
+Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
+Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
+Remove-Item -LiteralPath $ServiceDir -Recurse -Force -ErrorAction SilentlyContinue
+
+Write-Host "CodexTask scheduled task removed. The global npm package and Codex data were preserved."

package/scripts/service/install-macos.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+service_host="${CODEX_TASK_SERVICE_HOST:-0.0.0.0}"
+service_port="${CODEX_TASK_SERVICE_PORT:-7777}"
+service_concurrency="${CODEX_TASK_SERVICE_CONCURRENCY:-2}"
+service_dir="$HOME/Library/Application Support/codex-task/service"
+token_file="$service_dir/token"
+runner="$service_dir/run.sh"
+log_file="$service_dir/service.log"
+label="com.wangyendt.codex-task"
+plist="$HOME/Library/LaunchAgents/$label.plist"
+
+command -v npm >/dev/null 2>&1 || { echo "npm is required" >&2; exit 1; }
+npm install -g codex-task@latest
+codex_task_bin="$(command -v codex-task)"
+
+mkdir -p "$service_dir" "$HOME/Library/LaunchAgents"
+chmod 700 "$service_dir"
+if [[ ! -s "$token_file" ]]; then
+  node -e 'process.stdout.write(require("node:crypto").randomBytes(32).toString("base64url"))' > "$token_file"
+fi
+chmod 600 "$token_file"
+
+quoted_path="$(printf '%q' "$PATH")"
+quoted_bin="$(printf '%q' "$codex_task_bin")"
+quoted_host="$(printf '%q' "$service_host")"
+quoted_port="$(printf '%q' "$service_port")"
+quoted_token="$(printf '%q' "$token_file")"
+quoted_concurrency="$(printf '%q' "$service_concurrency")"
+cat > "$runner" <<EOF
+#!/usr/bin/env bash
+export PATH=$quoted_path
+exec $quoted_bin serve --host $quoted_host --port $quoted_port --token-file $quoted_token --max-concurrency $quoted_concurrency
+EOF
+chmod 700 "$runner"
+
+xml_escape() {
+  printf '%s' "$1" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g; s/'"'"'/\&apos;/g'
+}
+
+cat > "$plist" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>$label</string>
+  <key>ProgramArguments</key>
+  <array><string>$(xml_escape "$runner")</string></array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>$(xml_escape "$log_file")</string>
+  <key>StandardErrorPath</key><string>$(xml_escape "$log_file")</string>
+</dict>
+</plist>
+EOF
+plutil -lint "$plist" >/dev/null
+
+launchctl bootout "gui/$(id -u)/$label" 2>/dev/null || true
+launchctl bootstrap "gui/$(id -u)" "$plist"
+
+echo "CodexTask LaunchAgent installed."
+echo "URL: http://$service_host:$service_port"
+echo "Token: $(<"$token_file")"
+echo "Token file: $token_file"
+echo "Log: $log_file"

package/scripts/service/install-ubuntu.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+service_host="${CODEX_TASK_SERVICE_HOST:-0.0.0.0}"
+service_port="${CODEX_TASK_SERVICE_PORT:-7777}"
+service_concurrency="${CODEX_TASK_SERVICE_CONCURRENCY:-2}"
+service_dir="${XDG_CONFIG_HOME:-$HOME/.config}/codex-task/service"
+user_unit_dir="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
+token_file="$service_dir/token"
+runner="$service_dir/run.sh"
+unit_file="$user_unit_dir/codex-task.service"
+
+command -v npm >/dev/null 2>&1 || { echo "npm is required" >&2; exit 1; }
+command -v systemctl >/dev/null 2>&1 || { echo "systemd user services are required" >&2; exit 1; }
+
+npm install -g codex-task@latest
+codex_task_bin="$(command -v codex-task)"
+
+mkdir -p "$service_dir" "$user_unit_dir"
+chmod 700 "$service_dir"
+if [[ ! -s "$token_file" ]]; then
+  node -e 'process.stdout.write(require("node:crypto").randomBytes(32).toString("base64url"))' > "$token_file"
+fi
+chmod 600 "$token_file"
+
+quoted_path="$(printf '%q' "$PATH")"
+quoted_bin="$(printf '%q' "$codex_task_bin")"
+quoted_host="$(printf '%q' "$service_host")"
+quoted_port="$(printf '%q' "$service_port")"
+quoted_token="$(printf '%q' "$token_file")"
+quoted_concurrency="$(printf '%q' "$service_concurrency")"
+cat > "$runner" <<EOF
+#!/usr/bin/env bash
+export PATH=$quoted_path
+exec $quoted_bin serve --host $quoted_host --port $quoted_port --token-file $quoted_token --max-concurrency $quoted_concurrency
+EOF
+chmod 700 "$runner"
+
+cat > "$unit_file" <<EOF
+[Unit]
+Description=CodexTask authenticated HTTP service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart="$runner"
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+EOF
+
+systemctl --user daemon-reload
+systemctl --user enable --now codex-task.service
+
+echo "CodexTask service installed."
+echo "URL: http://$service_host:$service_port"
+echo "Token: $(<"$token_file")"
+echo "Token file: $token_file"
+echo "Status: systemctl --user status codex-task.service"
+echo "For boot-time start before login, an administrator may run: loginctl enable-linger $USER"