chore(#6920): pin Codex CLI 0.152.1 in the sandbox image, add a codex runtime stub - #6923
Conversation
PR Summary by QodoPin Codex CLI 0.152.1 and register a guarded runtime stub
AI Description
Diagram
High-Level Assessment
Files changed (16)
|
|
🤖 Review · Commit: |
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Site previewPreview: https://c0468b1b-site.fullsend-ai.workers.dev Commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ac3c933 to
f74c5e2
Compare
|
🤖 Review · Commit: |
|
🤖 Finished Review · ✅ Success · Started 7:10 PM UTC · Completed 7:29 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.24 |
|
Risk Assessment: moderate (2/5) DetailsPreserving prior score of 2 (moderate). Tier 1 signals are effectively unchanged from the prior assessment (same medium blast radius, 2 protected paths, similar test ratio 0.41 vs 0.44). This is still an additive stub runtime plus image pin as the first and simplest slice of the 5-PR stack. Tier 2 git history shows active churn and fix density in the runtime/sandbox area, but no instability signal specific to this change. Previous runRisk Assessment: moderate (2/5) DetailsPreserving prior score of 2 (moderate). Tier 1 signals are effectively unchanged from the prior assessment (same medium blast radius, 2 protected paths, similar test ratio 0.41 vs 0.44). This is still an additive stub runtime plus image pin as the first and simplest slice of the 5-PR stack. Previous run (2)Risk Assessment: moderate (2/5) DetailsModerate risk: medium-sized additive PR (stub runtime + image pin) as the first slice of a planned 5-PR stack with good test coverage (0.44 ratio), but touching high-churn sandbox files with elevated fix/revert history and 2 protected paths. |
ReviewFindingsMedium
Low
Next steps:
Previous runReviewFindingsMedium
Low
Next steps:
Previous run (2)ReviewFindingsMedium
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 7:55 PM UTC · Completed 8:12 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.03 |
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
… stub The OpenShell base image already installs @openai/codex under the same npm prefix the sandbox uses (/usr, binary /usr/bin/codex) — 0.117.0 on the base we pin today — so the version that ran was whatever the base happened to carry. Pin it with ARG CODEX_VERSION and a Renovate manager, point /usr/local/bin/codex at the npm install, and fail the build unless `codex --version` reports the pin. The symlink is the shadow-proofing half. /usr/local/bin precedes npm's global bin on the sandbox PATH, which is exactly how the base image's own Claude Code silently outranked CLAUDE_CODE_VERSION until #6612. No codex shadow exists there today; the symlink plus the build-time assertion make sure one cannot appear unnoticed on a base image bump. CODEX_HOME is created owned by the sandbox user and baked as an ENV default: codex refuses to start when it does not exist, and an ad-hoc `codex` from Bash should land in the same runner-owned directory the runtime will use. Like pi's ENV block this is a hygiene default, not a boundary — the sandbox egress policy and credential placeholders are. CodexRuntime itself is a stub: registered in Resolve() for dev and testing, deliberately absent from config.ValidRuntimes(), so no org or per-repo config can select it until Bootstrap and Run exist. System() is "openai" rather than the runtime name, because unlike pi and opencode codex serves a single model vendor. The security-matrix columns are stubbed as "N/A — stub" and filled in when the runtime is implemented. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
- Bake the managed System config layer (/etc/codex/config.toml, root-owned 0644) with check_for_update_on_startup, [analytics] and [feedback] disabled. codex has no environment switches for the hygiene defaults pi gets from PI_OFFLINE and friends, and the System layer applies whatever CODEX_HOME points at, so an ad-hoc `codex` from Bash starts no update check either. The runner-written $CODEX_HOME/config.toml layers on top. - Install with --ignore-scripts and clean the npm cache in the same layer. Neither the launcher nor its per-platform variant declares install scripts today, so this only keeps a future Renovate bump from introducing one unreviewed. - Say in the Containerfile that the native binary is a *version* of the same package (@openai/codex@<ver>-linux-<arch>, aliased as the optionalDependency), not a separate package. - Document the stub in the places that enumerate runtimes: the status table in docs/runtimes.md, the sandbox workspace layout tree, and the fullsend-sandbox row in sandbox-topology.md. The matrix's Bootstrap cell now says what codex must wire (hooks.json + adapter) rather than a bare "N/A — stub". - Assert SandboxCodexConfig in TestConstants and that codex wants no CLAUDE.md bridge (it reads AGENTS.md natively). - Keep the stub-rejection coverage on the per-repo path only: per-org installation mode is deprecated (ADR 0044), so the org-config cases added with the stub are dropped rather than extended. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
The workspace layout credited CodexRuntime.Bootstrap with writing codex-config/, which is only true once the runtime lands. At this point in the stack the sandbox image creates the directory — codex refuses to start without it — and nothing populates it yet. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
- Cover the agents: entry path for codex in TestAgentSettings_Validate, parallel to the opencode row: codex is registered in Resolve() but not in ValidRuntimes(), so an entry naming it must be rejected. One table row, so the PR that makes codex selectable has a single obvious place to flip. - Keep the runtime config directories contiguous: SandboxCodexConfig now sits between SandboxClaudeConfig and SandboxPiConfig instead of after the pi extensions dir. - Name codex alongside OpenCode as a stub in the glossary's Agent Runtime entry. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
8acd863 to
ffcb86f
Compare
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Review · ✅ Success · Started 10:29 PM UTC · Completed 10:48 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.19 |
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Finished Retro · ✅ Success · Started 11:19 PM UTC · Completed 11:32 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.57 |
|
PR #6923 pinned Codex CLI 0.152.1 in the sandbox image and added a stub The human reviewer (ralphbean) approved the final commit. The review agent's docs-currency finding — that the CLI internals guide's Sandbox Constants code block omits the new The final review run ($7.19) rediscovered the same 2 findings from the prior run and submitted CHANGES_REQUESTED ~2 hours after human approval. This provides evidence for several existing issues:
Proposals filed
|
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
…ectable PR #6923 added a TestAgentSettings_Validate row asserting an agents: entry cannot select codex while it was a stub. This PR adds codex to ValidRuntimes(); the positive coverage lives in TestPerRepoConfigValidate_Runtime, TestResolveFromPerRepoConfig and TestResolveForAgent_RejectsStubRuntimes, so the rejection row goes. Refs #6920 Assisted-by: Claude (implementation) Signed-off-by: Wayne Sun <gsun@redhat.com>
PR fullsend-ai#6923 added SandboxCodexConfig to internal/sandbox/sandbox.go but did not update the Sandbox Constants code block in the CLI internals guide. Add the missing constant between SandboxClaudeConfig and SandboxPiConfig to match the source ordering. Closes fullsend-ai#6941
2 participants
Summary
Pins the Codex CLI in the sandbox image the way Claude Code is pinned, and registers a
codexruntime stub so the following PRs can build on it.ARG CODEX_VERSION=0.152.1, installed withnpm install -g --ignore-scripts(cache cleaned). The OpenShell base image already ships@openai/codex@0.117.0under the same npm prefix (/usr, binary/usr/bin/codex), so the pinned install replaces it in place./usr/local/bin/codexis re-pointed at the pinned install and the build assertscodex --versionreports the pin — same shape as the Claude Code fix in sandbox: the OpenShell base image ships its own Claude Code (2.1.156) which shadows the CLAUDE_CODE_VERSION pin #6612, so a base-image change cannot bring a shadow binary back.automerge: false(codex minors change theexec --jsonwire shape and hook payloads; fixtures and the hook adapter must be re-verified per bump).ENV CODEX_HOME=/sandbox/codex-configwith the directory created for the sandbox user (codex refuses to start without it), and a root-owned managed layer at/etc/codex/config.tomlturning off the update check, analytics and feedback — hygiene, not a boundary.sandbox.SandboxCodexConfig,CodexRuntimestub registered inruntime.Resolve()only (not inconfig.ValidRuntimes()until PR E), image tests, aCodex (stub)column in the security matrix, docs rows.Review rounds
Codex gpt-5.6-sol and Grok 4.6 reviewed the branch; every finding applied in the third commit (docs rows and layout tree,
/etc/codexhygiene layer, matrix wording, test asserts, platform-package comment, org-mode test additions dropped per ADR 0044,--ignore-scripts+ cache clean).Verification
podman build, pin assertion, probes (which -a codex,codex --version=codex-cli 0.152.1, symlink target,CODEX_HOMEowned bysandbox, managed config present).go build/vet/testfor sandbox/runtime/config green.Part of a five-PR stack for #6920 (Codex as an agent runtime): A image pin → B stream parser → C OpenAI credential seeder → D runtime core (ADR 0099) → E enable + docs. Each PR is reviewable on its own diff; they merge bottom-up. Plan and verified Codex facts:
research/fullsend-codex-runtime-plan.mdin the ai-workspace-public research repo (to be linked once pushed).Refs #6920
Assisted-by: Claude (implementation and review orchestration), Codex gpt-5.6-sol (review), Grok 4.6 (review)