codex.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Example provider profile. OpenShell does not load it; import it explicitly:
#   openshell provider profile lint   -f providers/codex.yaml
#   openshell provider profile import -f providers/codex.yaml --global
#
# Copy and edit this file rather than importing it unchanged. `binaries` is the
# least-privilege control that decides which processes may reach the endpoints
# below, so it has to name the paths in *your* image.
#
# Client binaries:   codex.
# Reference layout:  /usr/bin/codex or /usr/local/bin/codex, plus the npm global
#                    install at /usr/lib/node_modules/@openai/**. The npm path is
#                    one reference image layout; check where `npm root
#                    -g` points in your image.
# Credential scope:  the CODEX_AUTH_* OAuth tokens and account id. They are
#                    injected into the sandbox environment for the codex CLI to
#                    read; only the endpoints below are reachable with them.
# Endpoint access:   api.openai.com and chatgpt.com for inference,
#                    auth.openai.com for token refresh, ab.chatgpt.com for the
#                    CLI's experiment lookups.
# Smoke test:        openshell sandbox create --provider <name> -- \
#                      codex exec 'reply with OK'

id: codex
display_name: Codex
description: OpenAI Codex CLI
category: agent
inference_capable: true
credentials:
  - name: access_token
    description: Codex OAuth access token
    env_vars: [CODEX_AUTH_ACCESS_TOKEN]
    required: true
  - name: refresh_token
    description: Codex OAuth refresh token
    env_vars: [CODEX_AUTH_REFRESH_TOKEN]
    required: true
  - name: account_id
    description: Codex account identifier
    env_vars: [CODEX_AUTH_ACCOUNT_ID]
    required: true
  - name: id_token
    description: Codex OAuth ID token
    env_vars: [CODEX_AUTH_ID_TOKEN]
discovery:
  credentials: [access_token, refresh_token, account_id, id_token]
endpoints:
  - host: api.openai.com
    port: 443
    protocol: rest
    access: read-write
    enforcement: enforce
  - host: auth.openai.com
    port: 443
    protocol: rest
    access: read-write
    enforcement: enforce
  - host: chatgpt.com
    port: 443
    protocol: rest
    access: read-write
    enforcement: enforce
  - host: ab.chatgpt.com
    port: 443
    protocol: rest
    access: read-write
    enforcement: enforce
binaries: [/usr/bin/codex, /usr/local/bin/codex, /usr/lib/node_modules/@openai/**]