[neekolas]

Summary

Adds opt-in Codex login for the Docker Sandboxes VM. With dev/sbx/sandbox start --codex, Codex in the VM uses the host's ChatGPT subscription, and the OAuth tokens never enter the VM. Every VM still has the Codex CLI installed. A plain start never reads or creates an OpenAI secret.

Before: the Codex kit writes ~/.codex/config.toml and auth.json once, at VM creation, from whatever OpenAI secret the host has at that moment. The wrapper had no way to set one up, so a VM created without it had no Codex login. Fixing that meant destroying and recreating the VM.

After: start --codex checks for a global OpenAI secret before creating a VM. If there is none, it runs sbx secret set openai --oauth, Docker's host-side ChatGPT sign-in. The kit then seeds Codex with the oai-oat01-proxy-managed sentinel, and the sandbox proxy swaps in the real token on requests to chatgpt.com. If sign-in fails, or the secret lookup fails or returns malformed output, start stops before creating anything. --api-key values are format-checked while parsing options, so a bad key also stops start before the VM exists. On an existing VM, --codex only prints a note, because the login is fixed at creation.

sbxenv.yaml can't do this alone. Env-file secrets: support value, ref, or command sources but not OAuth, and bindings: only approve injection domains (which the file already declares for openai).

The README documents --codex, the recreate step for VMs created without it, and the API-key alternative with its existing isolation caveat. It also notes that the OAuth secret is global: once it exists, a VM created without --codex still gets Codex login until the secret is removed with sbx secret rm openai.

Verification

• dev/nix-shell 'python3.11 -B dev/sbx/test_sandbox.py': 20 tests pass, using the fake sbx, never a live VM.
• New tests cover:
  • a plain start neither reads nor creates an OpenAI secret;
  • --codex (mixed with --api-key) signs in before env run and still registers keys;
  • --codex skips sign-in when a global secret or the VM already exists;
  • a failed sign-in creates nothing;
  • a failed or malformed secret lookup creates nothing and never signs in;
  • malformed --api-key values (including --codex in a value slot) create nothing.
• Against main, the --codex tests fail. Against a version that always signs in, the plain-start test also fails.
• just lint-config, just lint-markdown, just lint-treefmt, and shellcheck dev/sbx/sandbox pass.

Follow-ups

• Not run end to end against a live VM. The existing sandbox is in use, and the OAuth flow is interactive.
• The secret check reads .secrets from sbx secret ls --global --service openai --json (sbx 0.50). I could not see how an OAuth entry is listed without creating one. If OAuth secrets are listed elsewhere, the only effect is that start --codex asks for sign-in again when it creates a VM.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TBX7J21wEKRkvxUkk1tEdp

Note

Add opt-in Codex login to sandbox start via --codex

• start now accepts a --codex flag plus repeated --api-key HOST PLACEHOLDER options, parsed and validated before VM creation in sandbox
• If no global OpenAI secret exists, start --codex runs host-side OAuth setup (sbx secret set openai --oauth) before creating the VM; on failure, nothing is created. If the VM already exists, the current login is kept
• Host and placeholder format checks moved into a shared validate_key helper used by both parsing and registration
• Adds mock OpenAI secret/OAuth responses and tests covering sign-in ordering, skipped sign-in, failure cases, and malformed key rejection in test_sandbox.py
• Behavioral Change: unknown or incomplete start options now fail during parsing, before VM creation; docs updated in README.md

^{Macroscope summarized 3c8f06a.}

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — The new --codex option provisions host-side OAuth before VM creation, with failure checks and added tests. Human review must confirm the intended global credential scope, which lets local Codex-kit sandboxes use the developer’s ChatGPT subscription.

^{You can add or adjust custom eligibility rules. Learn more.}