455fbc656e
Two things: 1. The host scripts are first-class verbs now — 'box setup-host', 'box teardown-host [--purge-incus]', 'box migrate-host --box <n>'. Nobody should have to run ~/.local/share/box/host/<script>.sh; that read like an external script and exposed an install path. Each verb execs the installed script with its flags passed through (same pattern as 'box doctor'). README, doctor hints, and the uninstall section point at the verbs now. 2. The repo-runbook convention is '.box/', not '.claudebox/'. Renamed across docs and the templates' agent briefing; the briefing tells the agent to read either, and box-recipe.md notes the rename, so repos still shipping '.claudebox/' keep working through the transition. (Consuming repos rename their own folder — tracked separately.) Also widened the help command column for the longer verb names, and fixed one sed-casualty where a broad '.claudebox'→'.box' pass had turned the README's legacy user.claudebox tag into user.box.
60 lines
2.4 KiB
YAML
60 lines
2.4 KiB
YAML
#cloud-config
|
|
users:
|
|
- name: codex
|
|
shell: /bin/bash
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
lock_passwd: true
|
|
write_files:
|
|
- path: /home/codex/.codex/AGENTS.md
|
|
owner: "codex:codex"
|
|
permissions: '0644'
|
|
defer: true
|
|
content: |
|
|
# You are running inside a box (template: codex)
|
|
|
|
A box is a trust-less, network-isolated, ephemeral VM created by the
|
|
`box` CLI. Keep this context in mind:
|
|
|
|
- **Creds-free by default.** The box starts with no OpenAI and no git
|
|
credentials. If you need to authenticate Codex, the operator runs the
|
|
login flow (`codex`) interactively. For git, the operator adds their own
|
|
credentials (a PAT or `gh auth login`). Never assume credentials are
|
|
present; never ask for or store secrets on disk beyond what the operator
|
|
sets up.
|
|
- **Isolated.** The box reaches the public internet but nothing on the host
|
|
or local network. There is no inbound path.
|
|
- **Disposable.** Nothing here is backed up. State is discarded when the box
|
|
is removed; the operator persists work via git push and via `box snapshot`.
|
|
- **Bootstrap runbook.** If the repository you are working in contains a
|
|
`.box/` folder (older repos may use `.claudebox/`), read it as your setup runbook — how to install
|
|
dependencies, start services, template environment files, seed data, and
|
|
smoke-test — and follow it. It is documentation for you, not a script the
|
|
host runs.
|
|
package_update: true
|
|
packages:
|
|
- git
|
|
- gh
|
|
- curl
|
|
- ca-certificates
|
|
- gnupg
|
|
- ripgrep
|
|
- jq
|
|
- tmux
|
|
- age
|
|
- unzip
|
|
- build-essential
|
|
runcmd:
|
|
- curl -fsSL https://get.docker.com | sh
|
|
- usermod -aG docker codex
|
|
# Codex CLI is an npm global and needs Node 22+ (verified upstream:
|
|
# npmjs.com/package/@openai/codex — the SCOPED @openai/codex, not the
|
|
# unrelated 2012 'codex' package).
|
|
- curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
|
|
- apt-get install -y nodejs
|
|
- npm install -g @openai/codex
|
|
# 'box exec <b> -- codex …' runs a NON-interactive shell that reads no
|
|
# rc files — npm's global bin must be reachable from every shell. Symlink
|
|
# the installed binary into /usr/local/bin (the same fix the claude
|
|
# template needed for its own CLI).
|
|
- ln -sf "$(npm prefix -g)/bin/codex" /usr/local/bin/codex
|
|
- echo 'export PATH="$(npm prefix -g)/bin:$PATH"' >> /home/codex/.bashrc
|