docker/hsp:codex-kit-latest

schemaVersion: "2"
kind: sandbox
name: codex-hsp-kit
displayName: Codex (HSP Steering)
description: 'HSP-capable variant of the built-in `codex` sandbox kit -- the same `codex` CLI, plus a wrapper entrypoint and sidecar shim (this repo''s `codex/`) that expose the Harness Steering Protocol (hsp/1) by attaching to Codex''s own `app-server` as a second JSON-RPC client and steering the live thread the human TUI is on. Built to test/demo the Agentic Platform''s custom-kit-only HSP capability (APT-1382). Everything below this point through the `agentInstructions` block is copied verbatim from the built-in `codex` kit spec (docker/sandboxes, sandboxlib/agentkits/agents/codex/spec.yaml) -- see this repo''s codex/README.md ("Codex CLI adapter and sandbox kit: codex-hsp-kit"), for the diff summary; the only changes are this description, `sandbox.image`, and `sandbox.entrypoint`.'
sandbox:
    image: docker.io/docker/hsp:codex-base-image-latest
    entrypoint:
        - codex-hsp
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - api.openai.com:443
            - openai.com:443
            - auth.openai.com:443
            - chatgpt.com:443
            - files.openai.com:443
            - registry.npmjs.org:443
            - api.github.com:443
            - github.com:443
            - codeload.github.com:443
            - archive.ubuntu.com:80
            - security.ubuntu.com:80
            - ports.ubuntu.com:80
            - download.docker.com:443
credentials:
    - service: openai
      apiKey:
        name: OPENAI_API_KEY
        inject:
            - domain: api.openai.com
              header: Authorization
              format: Bearer %s
            - domain: openai.com
              header: Authorization
              format: Bearer %s
      oauth:
        tokenEndpoint:
            host: auth.openai.com
            path: /oauth/token
        resourceHosts:
            - chatgpt.com
        sentinels:
            accessToken: oai-oat01-proxy-managed
            refreshToken: oai-ort01-proxy-managed
        skipIfEnv:
            - OPENAI_API_KEY
environment:
    variables:
        BROWSER: xdg-open
        CODEX_HOME: /home/agent/.codex
        GIT_TERMINAL_PROMPT: "0"
setup:
    install:
        - command: |
            set -e
            mkdir -p /home/agent/.codex /home/agent/.agents
            MODE="${SBX_CRED_OPENAI_MODE:-none}"
            cat > /home/agent/.codex/config.toml << 'EOF'
            # Codex configuration for Docker sandbox
            # This configuration enables "yolo mode" - no approvals, full access

            approval_policy = "never"
            sandbox_mode = "danger-full-access"
            mcp_oauth_credentials_store = "file"
            EOF
            # Managed modes must not let remote clients replace the proxy placeholder
            # with sandbox-local ChatGPT OAuth. None mode deliberately permits login.
            case "$MODE" in
              oauth|apikey)
                cat >> /home/agent/.codex/config.toml << 'EOF'
            forced_login_method = "api"
            EOF
                ;;
            esac
            if [ "$MODE" = oauth ]; then
              cat >> /home/agent/.codex/config.toml << 'EOF'

            model_provider = "sandboxd"

            [model_providers.sandboxd]
            name = "Sandbox Proxy"
            base_url = "https://chatgpt.com/backend-api/codex"
            experimental_bearer_token = "oai-oat01-proxy-managed"
            requires_openai_auth = false
            EOF
            fi
            case "$MODE" in
              oauth|apikey)
                cat > /home/agent/.codex/auth.json << 'EOF'
            {
              "OPENAI_API_KEY": "proxy-managed"
            }
            EOF
                ;;
              *)
                rm -f /home/agent/.codex/auth.json
                ;;
            esac
          user: agent
          description: Seed Codex config/auth from SBX_CRED_OPENAI_MODE
    startup:
        - command:
            - sh
            - -c
            - |
              set -e
              [ -n "$MCP_GATEWAY_URL" ] || exit 0
              cfg="$HOME/.codex/config.toml"
              touch "$cfg"
              tmp="$cfg.mcp-gateway-upgrade.tmp"
              awk -v url="$MCP_GATEWAY_URL" -v token="$MCP_SENTINEL_TOKEN_NAME" '
              $0 == "[mcp_servers.mcp-gateway]" { print; in_table = 1; found = 1; next }
              in_table && /^\[/ {
                if (!seen) print "omit_tools_from = [\"deferred\"]"
                in_table = 0
              }
              in_table && /^omit_tools_from[ \t]*=/ { seen = 1 }
              { print }
              END {
                if (in_table && !seen) print "omit_tools_from = [\"deferred\"]"
                if (!found) {
                  print ""
                  print "[mcp_servers.mcp-gateway]"
                  print "omit_tools_from = [\"deferred\"]"
                  print "type = \"http\""
                  print "url = \"" url "\""
                  print "[mcp_servers.mcp-gateway.http_headers]"
                  print "Authorization = \"Bearer " token "\""
                }
              }
              ' "$cfg" > "$tmp"
              mv "$tmp" "$cfg"
          user: agent
          description: Register the sandbox MCP gateway in ~/.codex/config.toml with direct tool exposure (omit_tools_from=["deferred"])