alvis
9094d71e2f
Retires the Moonshot/Kimi subscription in favour of the already-paid ChatGPT plan. Both CLI wrappers now run `codex exec`; the kimi-agent container is gone. adolf-llm + hindsight-llm: - runKimi -> runCodex (`codex exec --json --skip-git-repo-check`), resume via `codex exec resume <thread_id>`. - MCP moves from a per-session .mcp.json (a workaround for Kimi having no --mcp-config-file flag) to a $CODEX_HOME/config.toml generated once at startup from shared-mcp.json. Field translation is load-bearing: bearerTokenEnvVar -> bearer_token_env_var, enabledTools -> enabled_tools. - approval_policy="never" + sandbox_mode required, or unattended turns block on an approval prompt nobody can answer. kimi-agent removed. It was the ONLY large-tier deployment behind LiteLLM, so deleting it outright would have silently degraded every large-tier request to the local 4B model via the existing fallbacks. tier-large, the auto_router complex-reasoning route and their fallbacks now point at the codex-backed adolf-llm wrapper (model_name: codex-agent). Three environment blockers fixed along the way: - OpenAI geo-blocks this host (403 unsupported_country_region_territory). Both containers now egress via the host xray proxy, with NO_PROXY keeping MCP and *.alogins.net traffic off the tunnel. - node:22-slim ships no system CA store; the Rust codex binary validates TLS against it, so every HTTPS call failed with a generic transport error while Node's own fetch worked. ca-certificates added to both images. - `codex exec resume` rejects -C/--cd (plain `codex exec` accepts it), which broke follow-up turns while first turns succeeded. Known regression: Kimi's managed-usage API has no Codex equivalent, so the /usage route returns 501 and there is no quota probe for the codex model. The two quota plugins degrade quietly to no output. Also: stop tracking cognee.env (live LLM + JWT secrets) and gitignore it. The secrets remain in earlier history and should be rotated. Verified live: plain turn, SSE streaming, session resume, MCP tool call, bearer-token MCP call, and completions through both LiteLLM routes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff
25 lines
822 B
Docker
25 lines
822 B
Docker
FROM node:22-slim
|
|
|
|
# ca-certificates is REQUIRED, not optional: node:22-slim ships no system CA
|
|
# store. Node bundles its own so JS fetch works, but the Codex CLI is a Rust
|
|
# binary and validates TLS against the system store — without this every HTTPS
|
|
# call (incl. `codex login`) dies after the TCP/proxy connect with a generic
|
|
# "error sending request". Cost us a long debug; do not drop it.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN npm install -g @openai/codex
|
|
|
|
WORKDIR /workspace
|
|
|
|
COPY server.js /app/server.js
|
|
|
|
# Codex reads auth + config from $CODEX_HOME (default ~/.codex). Pinned
|
|
# explicitly so the compose volume mount and the config writer agree.
|
|
ENV CODEX_HOME=/root/.codex
|
|
|
|
EXPOSE 8010
|
|
|
|
ENTRYPOINT ["node", "/app/server.js"]
|