fix(codex): trust bottle workspace on launch

bot_bottle/backend/docker/provision/provider_auth.py

@@ -3,29 +3,72 @@
 from __future__ import annotations
 
 import os
+import shlex
 import subprocess
 
 from ..bottle_plan import DockerBottlePlan
 
 
-def provision_provider_auth(plan: DockerBottlePlan, target: str) -> None:
-    """Copy a dummy Codex auth marker when host credentials are
-    forwarded through egress.
+_CODEX_WORKSPACE = "/home/node/workspace"
 
-    The file contains no real access or refresh token values; it only
+
+def provision_provider_auth(plan: DockerBottlePlan, target: str) -> None:
+    """Prepare Codex home state inside a Docker bottle.
+
+    Every Codex bottle gets a minimal config.toml that trusts the
+    in-container workspace path. When host credentials are forwarded,
+    auth.json contains no real access or refresh token values; it only
     nudges Codex into the same user/device auth branch as the host.
     """
-    if not plan.codex_auth_file:
+    if plan.agent_provider_template != "codex":
         return
     container_home = os.environ.get("BOT_BOTTLE_CONTAINER_HOME", "/home/node")
     auth_dir = f"{container_home}/.codex"
-    auth_path = f"{auth_dir}/auth.json"
 
     subprocess.run(
         ["docker", "exec", "-u", "0", target, "mkdir", "-p", auth_dir],
         stdout=subprocess.DEVNULL,
         check=True,
     )
+    subprocess.run(
+        ["docker", "exec", "-u", "0", target, "chown", "node:node", auth_dir],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+    subprocess.run(
+        ["docker", "exec", "-u", "0", target, "chmod", "700", auth_dir],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+    config_path = f"{auth_dir}/config.toml"
+    config = (
+        f'[projects."{_CODEX_WORKSPACE}"]\n'
+        'trust_level = "trusted"\n'
+    )
+    subprocess.run(
+        [
+            "docker", "exec", "-u", "0", target,
+            "sh", "-c",
+            f"printf %s {shlex.quote(config)} > {shlex.quote(config_path)}",
+        ],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+    subprocess.run(
+        ["docker", "exec", "-u", "0", target, "chown", "node:node", config_path],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+    subprocess.run(
+        ["docker", "exec", "-u", "0", target, "chmod", "600", config_path],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+
+    if not plan.codex_auth_file:
+        return
+
+    auth_path = f"{auth_dir}/auth.json"
     subprocess.run(
         ["docker", "cp", str(plan.codex_auth_file), f"{target}:{auth_path}"],
         stdout=subprocess.DEVNULL,

bot_bottle/backend/smolmachines/provision/provider_auth.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import os
+import shlex
 
 from ....log import die
 from .. import smolvm as _smolvm
@@ -10,16 +11,18 @@ from ..bottle_plan import SmolmachinesBottlePlan
 
 
 _DEFAULT_GUEST_HOME = "/home/node"
+_CODEX_WORKSPACE = "/home/node/workspace"
 
 
 def provision_provider_auth(plan: SmolmachinesBottlePlan, target: str) -> None:
-    """Copy a dummy Codex auth marker when host credentials are
-    forwarded through egress.
+    """Prepare Codex home state inside the smolmachine.
 
-    The real host access token remains in the egress bundle env; this
-    file only selects Codex's user/device auth code path.
+    Every Codex bottle gets a minimal config.toml that trusts the
+    in-guest workspace path. When host credentials are forwarded, the
+    real host access token remains in the egress bundle env; auth.json
+    only selects Codex's user/device auth code path.
     """
-    if not plan.codex_auth_file:
+    if plan.agent_provider_template != "codex":
         return
     guest_home = os.environ.get("BOT_BOTTLE_GUEST_HOME", _DEFAULT_GUEST_HOME)
     auth_dir = plan.guest_env.get("CODEX_HOME", f"{guest_home}/.codex")
@@ -65,6 +68,29 @@ def provision_provider_auth(plan: SmolmachinesBottlePlan, target: str) -> None:
             detail = f": {detail}"
         die(f"codex host credentials: could not reset runtime db files{detail}")
 
+    config_path = f"{auth_dir}/config.toml"
+    config = (
+        f'[projects."{_CODEX_WORKSPACE}"]\n'
+        'trust_level = "trusted"\n'
+    )
+    result = _smolvm.machine_exec(
+        target,
+        [
+            "sh", "-c",
+            f"printf %s {shlex.quote(config)} > {shlex.quote(config_path)}",
+        ],
+    )
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout).strip()
+        if detail:
+            detail = f": {detail}"
+        die(f"codex host credentials: could not write {config_path}{detail}")
+    _smolvm.machine_exec(target, ["chown", "node:node", config_path])
+    _smolvm.machine_exec(target, ["chmod", "600", config_path])
+
+    if not plan.codex_auth_file:
+        return
+
     auth_path = f"{auth_dir}/auth.json"
     _smolvm.machine_cp(str(plan.codex_auth_file), f"{target}:{auth_path}")
     _smolvm.machine_exec(target, ["chown", "node:node", auth_path])