c6bb6cb0e0
Two coding-CLI templates mirroring claude's shape: a box.env + verbatim cloud-init, inheriting the box-net placement contract structurally, no new design. - codex: OpenAI Codex CLI via 'npm i -g @openai/codex' (the SCOPED package; needs Node 22), symlinked onto the non-interactive exec PATH via 'npm prefix -g' — the same PATH fix the claude template needed. - grok: xAI Grok Build via the official 'curl x.ai/cli/install.sh', run AS the grok user (the installer drops into $HOME); the binary is found and symlinked to /usr/local/bin. Install commands verified upstream at implementation time, per the issue's rule (npmjs.com/package/@openai/codex, x.ai/cli). Each gets an AGENTS.md-style context file telling the agent it lives in a disposable, isolated, creds-free box. Drill: templates listing now expects four; a compact per-template smoke (mint, '<cli> --version' via box exec, remove) validates each payload installs and lands on the exec PATH — the generic mechanic is already proven by blank+claude and not repeated. Closes #54
60 lines
2.4 KiB
YAML
60 lines
2.4 KiB
YAML
#cloud-config
|
|
users:
|
|
- name: codex
|
|
shell: /bin/bash
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
lock_passwd: true
|
|
write_files:
|
|
- path: /home/codex/.codex/AGENTS.md
|
|
owner: "codex:codex"
|
|
permissions: '0644'
|
|
defer: true
|
|
content: |
|
|
# You are running inside a box (template: codex)
|
|
|
|
A box is a trust-less, network-isolated, ephemeral VM created by the
|
|
`box` CLI. Keep this context in mind:
|
|
|
|
- **Creds-free by default.** The box starts with no OpenAI and no git
|
|
credentials. If you need to authenticate Codex, the operator runs the
|
|
login flow (`codex`) interactively. For git, the operator adds their own
|
|
credentials (a PAT or `gh auth login`). Never assume credentials are
|
|
present; never ask for or store secrets on disk beyond what the operator
|
|
sets up.
|
|
- **Isolated.** The box reaches the public internet but nothing on the host
|
|
or local network. There is no inbound path.
|
|
- **Disposable.** Nothing here is backed up. State is discarded when the box
|
|
is removed; the operator persists work via git push and via `box snapshot`.
|
|
- **Bootstrap runbook.** If the repository you are working in contains a
|
|
`.claudebox/` folder, read it as your setup runbook — how to install
|
|
dependencies, start services, template environment files, seed data, and
|
|
smoke-test — and follow it. It is documentation for you, not a script the
|
|
host runs.
|
|
package_update: true
|
|
packages:
|
|
- git
|
|
- gh
|
|
- curl
|
|
- ca-certificates
|
|
- gnupg
|
|
- ripgrep
|
|
- jq
|
|
- tmux
|
|
- age
|
|
- unzip
|
|
- build-essential
|
|
runcmd:
|
|
- curl -fsSL https://get.docker.com | sh
|
|
- usermod -aG docker codex
|
|
# Codex CLI is an npm global and needs Node 22+ (verified upstream:
|
|
# npmjs.com/package/@openai/codex — the SCOPED @openai/codex, not the
|
|
# unrelated 2012 'codex' package).
|
|
- curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
|
|
- apt-get install -y nodejs
|
|
- npm install -g @openai/codex
|
|
# 'box exec <b> -- codex …' runs a NON-interactive shell that reads no
|
|
# rc files — npm's global bin must be reachable from every shell. Symlink
|
|
# the installed binary into /usr/local/bin (the same fix the claude
|
|
# template needed for its own CLI).
|
|
- ln -sf "$(npm prefix -g)/bin/codex" /usr/local/bin/codex
|
|
- echo 'export PATH="$(npm prefix -g)/bin:$PATH"' >> /home/codex/.bashrc
|