Optional OpenAI Codex CLI (INSTALL_CODEX, off by default) - #8
Merged
Conversation
Adds an opt-in so rebuilds can install Codex CLI alongside Claude Code without changing the repo's Claude-Code-first identity. INSTALL_CODEX (secrets.env, empty/0 by default) → setup-user stages a normalized 0/1 flag → remote-setup installs @openai/codex (npm, npm already on PATH from the node section) plus bubblewrap (its Linux sandbox), both guarded for idempotency. Auth stays a separate one-time 'codex login' (documented in the README auth table). Adversarial review refuted all six attack surfaces (npm-on-PATH, case-redirect fail-direction, set -e OR-chain safety, staged-file shipping, default-off, residue); fresh-install path verified live by uninstalling codex and re-running setup (reinstalled + auth intact + real turn). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Codex CLI pairs naturally with the box next to Claude Code. Adding it to the recipe keeps repo/live parity, but forcing a second provider's CLI on everyone who clones a Claude-Code-branded repo would be presumptuous — so it's opt-in.
What
INSTALL_CODEXin secrets.env (empty/0 by default). When set, setup-user stages a normalized 0/1 flag and remote-setup installs@openai/codex(npm) +bubblewrap(its Linux sandbox), both guarded for idempotency. Auth remains a one-timecodex login(device flow), documented in the README auth table. Default-off: a fresh clone installs nothing extra.Verified
make check green. Adversarial refute pass over all surfaces found nothing (fails safe: missing/empty flag → skip; failed install → WARN, never aborts the health-timer/git steps that follow). Fresh-install path proven live — uninstalled codex on the box, re-ran setup with INSTALL_CODEX=1, it reinstalled and a real
codex execturn confirmed auth intact.🤖 Generated with Claude Code