fix(terminal): bootstrap the codex runtime in-sandbox + fix exec auth/sandbox flags#271
Merged
Merged
Conversation
…/sandbox flags (#159) The terminal-product live rung failed because the stock E2B image has no codex on PATH (exit 127). Ports the proven fixes from the sibling oss-meta-lab lane instead of assuming a preinstalled binary: - unkeyed in-sandbox bootstrap step (ensure Node via NodeSource 22 with passwordless sudo, 5-min timeout since the SDK default is 60s), recorded in the lifecycle ledger, fail-closed as a structured lane error - pin the runtime: npx -y @openai/codex@latest exec (never the bare ambient binary) - --dangerously-bypass-approvals-and-sandbox: the E2B sandbox is the trust boundary; codex's redundant inner sandbox would block the study mission's network/file access (same flag the oss-meta-lab lane already carries) - exec auth: prefer CODEX_API_KEY, and when only OPENAI_API_KEY is exported inject the value under both names so codex exec's documented single-invocation auth channel is always populated (the June bearer-auth receipt showed job-wide OPENAI_API_KEY alone failing) Credential boundary unchanged and re-verified: bootstrap is unkeyed, the value still lands only in the single keyed exec call, metadata/ledger record names only and now list exactly what was injected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Toward closing #159.
The terminal-product live rung was red: the stock E2B image has no
codexon PATH (codex exec-> exit 127), and a job-wideOPENAI_API_KEYfailed codex's bearer auth (both dated in-repo receipts). This ports the fixes the siblingoss-meta-lablane already proved, so the lane can actually run an agent once a dedicated test E2B key is available.What
npx -y @openai/codex@latest execinstead of a bare ambientcodex.--dangerously-bypass-approvals-and-sandbox— the E2B sandbox is the trust boundary; codex's inner sandbox would deny the study mission's network/file access (the review caught this; the oss-meta-lab lane carries the same flag).CODEX_API_KEY; when onlyOPENAI_API_KEYis exported, inject the value under both names so codex exec's single-invocation auth channel is populated. Names-only metadata now lists exactly what was injected.Credential boundary (re-verified in review)
Three
commands.runcalls: readiness probe (unkeyed), bootstrap (unkeyed), keyed exec (the onlyenvscarrier).Sandbox.createcarries noenvs. The reviewer drove the real orchestrator end-to-end with dual-key injection and grepped all 10 persisted artifacts for the key value: zero hits, names only.Proof
pnpm check: 885 passed / 10 skipped, build OK.pnpm public-surface:scan: ok.Remaining for the live receipt (operator moment, not this PR)
A real live rung under
docs/goals/terminal-product-lane/receipts/needs a dedicated test E2B key (a separate E2B team, per #159's isolation ask) plusCODEX_API_KEY/OPENAI_API_KEYandHOMUN_LIVE_CODEX=1. This PR makes that rung runnable; it does not itself produce the receipt.🤖 Generated with Claude Code