mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-09-01 09:43:32 +02:00
b2ada7e4a7
* claude_desktop: add optional Codex CLI with device-code login and MCP bridge Adds OpenAI's Codex CLI to the add-on as an opt-in fourth tool, so a Claude session can delegate work to ChatGPT Codex as an independent second agent. Install (install_codex_cli, default off): Codex is deliberately not baked into the image -- its Linux binary is ~310 MB extracted, which is not worth carrying in every installation for an off-by-default option, and updating it would then need an add-on rebuild. A new 81-codex_cli.sh downloads the pinned static-musl release (ENV CODEX_VERSION) into /data/codex/bin instead. That prefix is outside $HOME on purpose: the managed-MCP merge treats any command under $HOME as user-installed and refuses to manage it. Staging happens under /data rather than the default /tmp, which here is a RAM-backed tmpfs mounted noexec -- holding 420 MB there during boot is a risk on a small host, and the binary could not be verified there at all. The download fails open like the Claude Desktop update check and validates the new binary by running it before replacing the old one. Login (codex-login): Codex's default sign-in serves an OAuth callback on localhost:1455 and expects a local browser, which cannot work in this add-on. The helper runs `codex login --device-auth` instead -- the flow OpenAI documents for headless machines -- printing a URL and one-time code to approve elsewhere. It drops to the abc runtime user first so auth.json is not created root-owned. MCP (codex mcp-server): registered through the existing managed-MCP merge rather than a second copy of it, so it inherits that code's idempotence, no-clobber and removal-when-disabled behaviour. A managed CLAUDE.md block explains when a second agent is worth the round-trip. New codex_sandbox_mode (default danger-full-access) is applied both as -c overrides on the MCP command and as a managed block at the top of ~/.codex/config.toml; Codex's own Landlock/bubblewrap sandbox is unreliable inside the container, which is already the security boundary. Verified against the real 0.145.0 binary: tools/list returns `codex` and `codex-reply` (hyphen, not the underscore upstream docs report), an invalid -c sandbox_mode is rejected by name, the installer lifecycle behaves correctly on re-run and on a bad pin, and the device code is flushed within seconds while still polling, which is the non-TTY case that matters. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * claude_desktop: harden Codex subscription MCP setup * claude_desktop: use runtime home for Codex login * claude_desktop: reconcile runtime user home ownership * claude_desktop: report verified Codex subscription setup * claude_desktop: track latest Codex at runtime * claude_desktop: document subscription-only Codex MCP * claude_desktop: enforce Codex runtime identity * claude_desktop: persist Codex in runtime home * claude_desktop: prevent Codex auth override bypass * claude_desktop: default Codex to workspace write * claude_desktop: redact Codex authentication diagnostics * claude_desktop: document safer Codex MCP defaults * claude_desktop: validate Codex candidate as runtime user * claude_desktop: align Codex sandbox fallback --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>