139 lines
5.1 KiB
Markdown
139 lines
5.1 KiB
Markdown
# Autonomous Codex
|
|
|
|
Use the project launcher to run Codex with the `azi4a2-autonomous` permission
|
|
profile:
|
|
|
|
```sh
|
|
./codex-auto
|
|
```
|
|
|
|
Start a fresh session with this command. Running plain `codex`, opening Codex
|
|
through an editor integration, or continuing an already-running session does
|
|
not automatically activate this profile.
|
|
|
|
For a non-interactive task:
|
|
|
|
```sh
|
|
./codex-auto exec "Continue the Astro migration, verify the build and audits, and document unresolved issues."
|
|
```
|
|
|
|
The launcher automatically permits non-interactive runs in this mounted
|
|
workspace even when Codex cannot discover its Git metadata.
|
|
|
|
The profile:
|
|
|
|
- never pauses for approval
|
|
- automatically permits configured Playwright and OpenAI documentation MCP tools
|
|
- limits filesystem access to minimal runtime files plus this project
|
|
- allows writes in this project
|
|
- keeps `.codex` and `www.azinstitute4autism.com` read-only
|
|
- permits read-only Git inspection
|
|
- enables live web search and outbound network retrievals
|
|
|
|
Outbound network access is domain-unrestricted because package installation and
|
|
retrieval sources vary. The sandbox cannot distinguish a retrieval from another
|
|
outbound request, so do not place secrets in project files or task prompts.
|
|
|
|
The profile is stored outside the workspace at:
|
|
|
|
```txt
|
|
~/.codex/azi4a2-autonomous.config.toml
|
|
```
|
|
|
|
Do not add `--sandbox`; legacy sandbox flags override the custom permission
|
|
profile. Do not use `--dangerously-bypass-approvals-and-sandbox`.
|
|
|
|
The launcher also applies these session overrides:
|
|
|
|
```txt
|
|
approval_policy="never"
|
|
mcp_servers.playwright.default_tools_approval_mode="approve"
|
|
mcp_servers.playwright.tool_timeout_sec=300
|
|
mcp_servers.openaiDeveloperDocs.default_tools_approval_mode="approve"
|
|
mcp_servers.openaiDeveloperDocs.tool_timeout_sec=300
|
|
```
|
|
|
|
The server-level `approve` settings pre-approve MCP tools without writing
|
|
incompatible per-tool approval tables into the profile. These settings allow
|
|
MCP tools to run without approval prompts and give
|
|
long-running browser operations up to five minutes. An MCP server may still
|
|
fail or time out. MCP elicitations that inherently require user input are
|
|
rejected rather than shown as unattended prompts.
|
|
|
|
Do not persist an individual MCP tool approval when prompted by an older or
|
|
misconfigured session. Codex CLI 0.133.0 may write a per-tool table that the
|
|
profile-v2 parser rejects on the next launch.
|
|
|
|
## Verification
|
|
|
|
The nested setup smoke test confirmed that the project is readable and
|
|
`~/.codex/auth.json` is not readable. In the current host session, sandboxed
|
|
shell retrievals resolved domains but were reset by the beta network proxy.
|
|
After launching `./codex-auto` directly, verify shell retrievals with:
|
|
|
|
```sh
|
|
curl -fsS https://registry.npmjs.org/astro >/dev/null
|
|
```
|
|
|
|
Live web search is separate from shell network access and remains enabled.
|
|
|
|
In the current environment, the beta network proxy permits retrievals but
|
|
sandboxed command-line tools may fail HTTPS certificate verification. Do not
|
|
disable certificate verification for package installation or sensitive
|
|
retrievals; use live web search or review the retrieval from the host instead.
|
|
|
|
## Optional local browser environment
|
|
|
|
The repository now provides a Linux-only `browser` development shell, separate
|
|
from the default content-editing shell. In a normal host terminal, from the
|
|
repository root:
|
|
|
|
```sh
|
|
nix --extra-experimental-features "nix-command flakes" develop .#browser
|
|
```
|
|
|
|
It supplies a lockfile-matched Playwright driver, Chromium, headless shell and
|
|
font configuration. New processes launched inside this shell inherit
|
|
`PLAYWRIGHT_MODULE` and `PLAYWRIGHT_BROWSERS_PATH`; existing sessions do not.
|
|
For a guarded real-page smoke test, run from `www`:
|
|
|
|
```sh
|
|
TMPDIR=/tmp npm run build
|
|
TMPDIR=/tmp node tools/playwright-smoke.mjs
|
|
```
|
|
|
|
Preview and browser run in the same process environment, avoiding dependence on
|
|
remote MCP transport or cross-execution loopback access. All non-loopback and
|
|
non-GET/HEAD browser requests are blocked. Results/screenshots stay in `/tmp`.
|
|
The tool does not grant access to files or sockets denied by the autonomous
|
|
profile. If Nix realization, Chromium startup or loopback access is denied, keep
|
|
that result as an environment limitation and use the normal host terminal;
|
|
do not weaken TLS, identity, signing or sandbox configuration. No global MCP
|
|
configuration or launcher permissions were changed for this setup.
|
|
|
|
## Git limitation
|
|
|
|
Codex always protects `.git` recursively in its `workspace-write` sandbox.
|
|
Agents can inspect Git state and diffs, but cannot stage or commit. This cannot
|
|
be overridden by a permissions profile.
|
|
|
|
For autonomous commits, use an outer container or VM as the security boundary,
|
|
mount only this project into it, and run Codex with full access inside that
|
|
isolated environment. Otherwise, review and commit agent changes from the host.
|
|
|
|
Writes that appear to succeed directly under `/home/alice` are made to the
|
|
sandbox's temporary in-memory root. They do not modify the host home directory.
|
|
|
|
Check the startup banner before assigning work. It should report:
|
|
|
|
```txt
|
|
approval: never
|
|
sandbox: workspace-write ... (network access enabled)
|
|
```
|
|
|
|
Then check the MCP configuration:
|
|
|
|
```txt
|
|
/mcp verbose
|
|
```
|