docker/sbx-kit-codex-mixin:1.0.0

schemaVersion: "3"
displayName: Codex (mixin)
description: OpenAI's Codex CLI as a mixin — the CLI in an overlay, with the OpenAI credential (API key or ChatGPT OAuth), scoped egress, and the config and auth seeds the agent needs. Layer it onto a shell base and run `codex`.
version: 1.0.0
kind: mixin
provides:
    - codex
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.openai.com
                - openai.com
                - auth.openai.com
                - chatgpt.com
                - files.openai.com
                - '*.chatgpt.com'
                - '*.oaiusercontent.com'
                - registry.npmjs.org
                - releases.openai.com
                - api.github.com
                - github.com
                - codeload.github.com
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.openai.com
                  format: Bearer %s
                  header: Authorization
                - domain: openai.com
                  format: Bearer %s
                  header: Authorization
            name: OPENAI_API_KEY
        oauth:
            resourceHosts:
                - chatgpt.com
            sentinels:
                accessToken: oai-oat01-proxy-managed
                refreshToken: oai-ort01-proxy-managed
            tokenEndpoint:
                host: auth.openai.com
                path: /oauth/token
        phase: runtime
        service: openai
      description: OpenAI API access (API key or ChatGPT OAuth)
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -e
                # ~/.codex is CODEX_HOME; ~/.agents is where Codex looks for the
                # cross-agent skills tree (~/.agents/skills). Both are created up
                # front so nothing later has to create them as root.
                mkdir -p /home/agent/.codex /home/agent/.agents
                MODE="${SBX_CRED_OPENAI_MODE:-none}"
                cat > /home/agent/.codex/config.toml << 'EOF'
                # Codex configuration for a Docker sandbox.
                # The container is the sandbox, so Codex's own approval gate and
                # filesystem sandbox are turned off: there is nobody to answer a
                # prompt, and the isolation is already provided from the outside.

                approval_policy = "never"
                sandbox_mode = "danger-full-access"
                mcp_oauth_credentials_store = "file"
                EOF
                # In a managed mode the placeholder in auth.json is the whole auth
                # story, so a remote client must not be able to replace it with a
                # sandbox-local ChatGPT login. `none` mode deliberately permits that
                # login — it is the only way to authenticate at all there.
                case "$MODE" in
                  oauth|apikey)
                    cat >> /home/agent/.codex/config.toml << 'EOF'
                forced_login_method = "api"
                EOF
                    ;;
                esac
                if [ "$MODE" = oauth ]; then
                  cat >> /home/agent/.codex/config.toml << 'EOF'

                model_provider = "sandboxd"

                [model_providers.sandboxd]
                name = "Sandbox Proxy"
                base_url = "https://chatgpt.com/backend-api/codex"
                experimental_bearer_token = "oai-oat01-proxy-managed"
                requires_openai_auth = false
                EOF
                fi
                case "$MODE" in
                  oauth|apikey)
                    cat > /home/agent/.codex/auth.json << 'EOF'
                {
                  "OPENAI_API_KEY": "proxy-managed"
                }
                EOF
                    ;;
                  *)
                    rm -f /home/agent/.codex/auth.json
                    ;;
                esac
              description: Seed Codex config/auth from SBX_CRED_OPENAI_MODE
              env:
                - SBX_CRED_OPENAI_MODE
              user: agent
        startup:
            - command:
                - sh
                - -c
                - |
                  set -e
                  [ -n "$MCP_GATEWAY_URL" ] || exit 0
                  mkdir -p "$HOME/.codex"
                  cfg="$HOME/.codex/config.toml"
                  touch "$cfg"
                  grep -q "^\[mcp_servers.mcp-gateway\]" "$cfg" && exit 0
                  cat >> "$cfg" <<EOF

                  [mcp_servers.mcp-gateway]
                  type = "http"
                  url = "$MCP_GATEWAY_URL"
                  [mcp_servers.mcp-gateway.http_headers]
                  Authorization = "Bearer $MCP_SENTINEL_TOKEN_NAME"
                  EOF
              description: Register the sandbox MCP gateway in ~/.codex/config.toml
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-skills@1
      optional: true
      config:
        path: /home/agent/.agents/skills
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/codex-mixin/codex-mixin-context.md