Two new templates: codex (OpenAI Codex CLI) and grok (xAI's CLI) #54

New issue

Closed

opened 2026-07-14 15:47:19 +00:00 by dan-claude-bot · 0 comments

dan-claude-bot commented

2026-07-14 15:47:19 +00:00

(Migrated from github.com)

#52 made the Claude box one template among several — these are the second and third real tenants, and the first proof that the template mechanic carries a workload it wasn't built around.

What each is

Mirror templates/claude/ exactly in shape — a box.env and a verbatim user-data.yaml, nothing else:

templates/codex/ — Debian 13 + the OpenAI Codex CLI, BOX_USER="codex". Same creds-free contract: the box ships with the CLI installed and NO credentials; the operator authenticates interactively inside (codex login flow), then snapshots — log in once, clone forever.
templates/grok/ — Debian 13 + xAI's CLI, BOX_USER="grok". Same deal.

Both inherit the placement contract structurally — same box-net profile, same isolation, nothing to design. Resources: start from the claude template's values; trim if the toolchains are lighter.

The rules the claude template already learned

Verify the install commands upstream, from inside a live box — do not trust memory or docs for the package names/install one-liners of either CLI (this repo has shipped exactly one design decision from an unverified assumption, and it took ten drill runs to unwind). Whatever the current supported install is for each CLI at implementation time is what goes in user-data.
BOX_USER and the user created in user-data.yaml agree by hand — the file is verbatim, the duplication is deliberate.
The CLI must land on the non-interactive exec PATH (box exec <b> -- codex --version must work) — the claude template hit this exact bug (#15 findings): a PATH exported only in shell rc files is invisible to box exec. Symlink into /usr/local/bin like claude's user-data does.
The in-box context file (claude's ~/.claude/CLAUDE.md) should get its analog if the CLI has one (e.g. an AGENTS.md-style file for Codex) — telling the agent it lives in a disposable, isolated, creds-free box changed behavior for the better in the claude template.

Acceptance

box templates lists four; each new template mints, its CLI answers --version via box exec, and the box carries no credentials.
Drill: extend the templates-listing check to expect the new names; the deep blank-template checks (metadata, placement, user, isolation parity) already prove the mechanic generically and need no duplication per template — one --version-via-exec check per new template is enough.

🤖 Generated with Claude Code

#52 made the Claude box one template among several — these are the second and third real tenants, and the first proof that the template mechanic carries a workload it wasn't built around. ## What each is Mirror `templates/claude/` exactly in shape — a `box.env` and a verbatim `user-data.yaml`, nothing else: - **`templates/codex/`** — Debian 13 + the OpenAI Codex CLI, `BOX_USER="codex"`. Same creds-free contract: the box ships with the CLI installed and NO credentials; the operator authenticates interactively inside (`codex` login flow), then snapshots — log in once, clone forever. - **`templates/grok/`** — Debian 13 + xAI's CLI, `BOX_USER="grok"`. Same deal. Both inherit the placement contract structurally — same `box-net` profile, same isolation, nothing to design. Resources: start from the claude template's values; trim if the toolchains are lighter. ## The rules the claude template already learned - **Verify the install commands upstream, from inside a live box** — do not trust memory or docs for the package names/install one-liners of either CLI (this repo has shipped exactly one design decision from an unverified assumption, and it took ten drill runs to unwind). Whatever the current supported install is for each CLI at implementation time is what goes in user-data. - `BOX_USER` and the user created in `user-data.yaml` agree by hand — the file is verbatim, the duplication is deliberate. - The CLI must land on the non-interactive exec PATH (`box exec <b> -- codex --version` must work) — the claude template hit this exact bug (#15 findings): a PATH exported only in shell rc files is invisible to `box exec`. Symlink into `/usr/local/bin` like claude's user-data does. - The in-box context file (claude's `~/.claude/CLAUDE.md`) should get its analog if the CLI has one (e.g. an `AGENTS.md`-style file for Codex) — telling the agent it lives in a disposable, isolated, creds-free box changed behavior for the better in the claude template. ## Acceptance - `box templates` lists four; each new template mints, its CLI answers `--version` via `box exec`, and the box carries no credentials. - Drill: extend the templates-listing check to expect the new names; the deep blank-template checks (metadata, placement, user, isolation parity) already prove the mechanic generically and need no duplication per template — one `--version`-via-exec check per new template is enough. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#54

No description provided.