mirror of
https://github.com/affaan-m/ECC.git
synced 2026-10-14 20:25:26 +02:00
haelyraandClaude Fable 5
ac7812ab17
codex login binds its callback server to container loopback, so the host browser redirect to localhost:1455 is refused. Publish 127.0.0.1:1455 on the opt-in networked service only and bridge it to loopback with a small node relay. Document the flow, fresh-state retry, and token lifetime in the hardened-harness skill. Follow-up to #2625. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
37 lines
1.2 KiB
JavaScript
37 lines
1.2 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* Codex OAuth login relay for the hardened harness.
|
|
*
|
|
* `codex login` binds its callback server to 127.0.0.1:1455 inside the
|
|
* container. A Docker port publish forwards to the container interface, not
|
|
* loopback, so the host browser's redirect to http://localhost:1455 is
|
|
* refused. This bridges the published interface to loopback:
|
|
*
|
|
* host 127.0.0.1:1455 -> container 0.0.0.0:1456 (this relay) -> 127.0.0.1:1455
|
|
*
|
|
* Run inside the networked session before `codex login`:
|
|
* node /ecc/docker/plugin-setup/codex-auth-relay.js &
|
|
*
|
|
* Env: ECC_RELAY_LISTEN (default 1456), ECC_RELAY_TARGET (default 1455).
|
|
*/
|
|
|
|
'use strict';
|
|
|
|
const net = require('net');
|
|
|
|
const listenPort = Number(process.env.ECC_RELAY_LISTEN || 1456);
|
|
const targetPort = Number(process.env.ECC_RELAY_TARGET || 1455);
|
|
|
|
net.createServer(client => {
|
|
const upstream = net.connect(targetPort, '127.0.0.1');
|
|
client.pipe(upstream).pipe(client);
|
|
const drop = () => {
|
|
client.destroy();
|
|
upstream.destroy();
|
|
};
|
|
client.on('error', drop);
|
|
upstream.on('error', drop);
|
|
}).listen(listenPort, '0.0.0.0', () => {
|
|
console.log(`codex-auth-relay: 0.0.0.0:${listenPort} -> 127.0.0.1:${targetPort}`);
|
|
});
|