Harden runtime identity handling and repository hygiene

.github/workflows/ci.yml

@@ -17,12 +17,22 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Install CI tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck podman
+
       - name: Check runtime shell syntax
         run: |
-          bash -n scripts/lib-codexcli-runtime.sh
-          bash -n scripts/codexcli
-          bash -n scripts/codexcli-login
-          bash -n scripts/codexcli-strict
+          bash -n scripts/*
+
+      - name: Run ShellCheck
+        run: |
+          shellcheck -x scripts/*
+
+      - name: Build runtime image
+        run: |
+          podman build -t codexcli-runtime-ci-smoke .
 
       - name: Check expected files
         run: |

Containerfile

@@ -28,9 +28,5 @@ WORKDIR /workspace
 
 ENV HOME=/home/codex
 ENV CODEX_HOME=/home/codex/.codex
-ENV GIT_AUTHOR_NAME="Timo Bigdon"
-ENV GIT_AUTHOR_EMAIL="timo@bigdon.de"
-ENV GIT_COMMITTER_NAME="Timo Bigdon"
-ENV GIT_COMMITTER_EMAIL="timo@bigdon.de"
 
 CMD ["codex"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Timo Bigdon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -24,7 +24,11 @@ The wrappers keep Codex state in
 image tag.
 
 The image includes Poppler PDF text extraction tools such as `pdftotext`,
-`pdfinfo`, and likely `pdftohtml`.
+`pdfinfo`, and `pdftohtml`.
+
+`templates/codex-home/AGENTS.md` is a starter policy file for Codex home
+directories. Copy it into `~/.local/share/codexcli/codex-home/AGENTS.md` if you
+want these operating rules to apply across sessions.
 
 ## Modes
 
@@ -53,3 +57,6 @@ exists; inspect or remove that container explicitly before retrying.
 Do not run two agents in the same checkout. Container separation does not
 prevent both agents from editing the same files, index, or branch, so changes
 can be overwritten or combined unpredictably. Use one Git worktree per agent.
+
+See `docs/runtime-notes.md` for runtime caveats, including Git hook handling in
+mounted repositories.

docs/runtime-notes.md

@@ -10,3 +10,14 @@ retained to compare whether those settings cause the apply_patch/devpts issue.
 PDF migration workflows must extract text from the actual source PDFs. If
 `pdftotext` is unavailable, or extraction is empty or unusable, Codex must stop
 rather than reconstructing content from memory.
+
+## Git hooks and repository trust
+
+The runtime sets `core.hooksPath=/dev/null` inside the container so Git commands
+run by Codex do not execute repository hooks. Normal mode still mounts the
+workspace and Git common directory writable. An agent can write hook files or
+modify `.git/config` in mounted repositories.
+
+Treat `.git/hooks` and `.git/config` as agent-writable after a session in an
+untrusted workspace. Review them before host-side commits, checkouts, or other
+Git operations that may execute hooks or rely on repository-local config.

scripts/codexcli

@@ -6,7 +6,7 @@ if command -v readlink >/dev/null 2>&1; then
   SCRIPT_PATH="$(readlink -f "$SCRIPT_PATH")"
 fi
 SCRIPT_DIR="$(cd -- "$(dirname -- "$SCRIPT_PATH")" && pwd)"
-# shellcheck source=lib-codexcli-runtime.sh
+# shellcheck source=scripts/lib-codexcli-runtime.sh
 source "$SCRIPT_DIR/lib-codexcli-runtime.sh"
 
 CODEXCLI_IMAGE="${CODEXCLI_IMAGE:-eigen-codexcli:latest}"

scripts/codexcli-login

@@ -6,9 +6,11 @@ if command -v readlink >/dev/null 2>&1; then
   SCRIPT_PATH="$(readlink -f "$SCRIPT_PATH")"
 fi
 SCRIPT_DIR="$(cd -- "$(dirname -- "$SCRIPT_PATH")" && pwd)"
-# shellcheck source=lib-codexcli-runtime.sh
+# shellcheck source=scripts/lib-codexcli-runtime.sh
 source "$SCRIPT_DIR/lib-codexcli-runtime.sh"
 
 CODEXCLI_IMAGE="${CODEXCLI_IMAGE:-eigen-codexcli:latest}"
+# CODEXCLI_LOGIN_PORT is consumed by functions in lib-codexcli-runtime.sh.
+# shellcheck disable=SC2034
 CODEXCLI_LOGIN_PORT=true
 codexcli_run "$@"

scripts/codexcli-strict

@@ -6,9 +6,11 @@ if command -v readlink >/dev/null 2>&1; then
   SCRIPT_PATH="$(readlink -f "$SCRIPT_PATH")"
 fi
 SCRIPT_DIR="$(cd -- "$(dirname -- "$SCRIPT_PATH")" && pwd)"
-# shellcheck source=lib-codexcli-runtime.sh
+# shellcheck source=scripts/lib-codexcli-runtime.sh
 source "$SCRIPT_DIR/lib-codexcli-runtime.sh"
 
 CODEXCLI_IMAGE="${CODEXCLI_IMAGE:-eigen-codexcli:latest}"
+# CODEXCLI_STRICT is consumed by functions in lib-codexcli-runtime.sh.
+# shellcheck disable=SC2034
 CODEXCLI_STRICT=true
 codexcli_run "$@"

scripts/lib-codexcli-runtime.sh

@@ -31,8 +31,30 @@ codexcli_check_container_name() {
   fi
 }
 
+codexcli_git_config_value() {
+  local key value
+
+  key="$1"
+  value="$(git -C "$CODEXCLI_WORKSPACE" config --get "$key" 2>/dev/null || true)"
+  if [ -z "$value" ]; then
+    value="$(git config --global --get "$key" 2>/dev/null || true)"
+  fi
+
+  printf '%s' "$value"
+}
+
+codexcli_require_git_identity() {
+  CODEXCLI_GIT_USER_NAME="$(codexcli_git_config_value user.name)"
+  CODEXCLI_GIT_USER_EMAIL="$(codexcli_git_config_value user.email)"
+
+  if [ -z "$CODEXCLI_GIT_USER_NAME" ] || [ -z "$CODEXCLI_GIT_USER_EMAIL" ]; then
+    codexcli_die "Git identity is not configured. Set git config --global user.name and user.email on the host."
+  fi
+}
+
 codexcli_run() {
   local doctor=false
+  local git_common_mount workspace_mount
   local -a podman_args
 
   if [ "${1-}" = "--doctor" ]; then
@@ -51,8 +73,17 @@ codexcli_run() {
     || codexcli_die "could not resolve Git common directory"
   CODEXCLI_CONTAINER_NAME="$(codexcli_container_name)"
   CODEXCLI_HOME_HOST="${HOME}/.local/share/codexcli/codex-home"
+  codexcli_require_git_identity
+
+  if [ "$doctor" = false ]; then
+    mkdir -p "$CODEXCLI_HOME_HOST"
+    workspace_mount="$CODEXCLI_WORKSPACE:/workspace:Z"
+    git_common_mount="$CODEXCLI_GIT_COMMON_DIR:$CODEXCLI_GIT_COMMON_DIR:Z"
+  else
+    workspace_mount="$CODEXCLI_WORKSPACE:/workspace:ro"
+    git_common_mount="$CODEXCLI_GIT_COMMON_DIR:$CODEXCLI_GIT_COMMON_DIR:ro"
+  fi
 
-  mkdir -p "$CODEXCLI_HOME_HOST"
   codexcli_check_container_name
 
   podman_args=(
@@ -64,16 +95,28 @@ codexcli_run() {
     --network slirp4netns:allow_host_loopback=false
     -e HOME=/home/codex
     -e CODEX_HOME=/home/codex/.codex
-    -e 'GIT_AUTHOR_NAME=Timo Bigdon'
-    -e GIT_AUTHOR_EMAIL=timo@bigdon.de
-    -e 'GIT_COMMITTER_NAME=Timo Bigdon'
-    -e GIT_COMMITTER_EMAIL=timo@bigdon.de
-    -v "$CODEXCLI_WORKSPACE:/workspace:Z"
-    -v "$CODEXCLI_HOME_HOST:/home/codex/.codex:Z"
+    -e GIT_CONFIG_COUNT=3
+    -e GIT_CONFIG_KEY_0=user.name
+    -e "GIT_CONFIG_VALUE_0=$CODEXCLI_GIT_USER_NAME"
+    -e GIT_CONFIG_KEY_1=user.email
+    -e "GIT_CONFIG_VALUE_1=$CODEXCLI_GIT_USER_EMAIL"
+    -e GIT_CONFIG_KEY_2=core.hooksPath
+    -e GIT_CONFIG_VALUE_2=/dev/null
+    -e "GIT_AUTHOR_NAME=$CODEXCLI_GIT_USER_NAME"
+    -e "GIT_AUTHOR_EMAIL=$CODEXCLI_GIT_USER_EMAIL"
+    -e "GIT_COMMITTER_NAME=$CODEXCLI_GIT_USER_NAME"
+    -e "GIT_COMMITTER_EMAIL=$CODEXCLI_GIT_USER_EMAIL"
+    -v "$workspace_mount"
   )
 
+  if [ "$doctor" = true ]; then
+    podman_args+=(--security-opt label=disable -e GIT_OPTIONAL_LOCKS=0)
+  else
+    podman_args+=(-v "$CODEXCLI_HOME_HOST:/home/codex/.codex:Z")
+  fi
+
   if [ -f "$CODEXCLI_WORKSPACE/.git" ]; then
-    podman_args+=(-v "$CODEXCLI_GIT_COMMON_DIR:$CODEXCLI_GIT_COMMON_DIR:Z")
+    podman_args+=(-v "$git_common_mount")
   fi
 
   if [ "${CODEXCLI_LOGIN_PORT:-false}" = true ]; then
@@ -86,19 +129,21 @@ codexcli_run() {
   if [ "$doctor" = true ]; then
     exec podman "${podman_args[@]}" "$CODEXCLI_IMAGE" bash -lc '
       set -Eeuo pipefail
-      git config --global user.name "Timo Bigdon"
-      git config --global user.email "timo@bigdon.de"
-      git config --local user.name "Timo Bigdon"
-      git config --local user.email "timo@bigdon.de"
+      print_git_config() {
+        printf "%s: " "$1"
+        git config --get "$2" || printf "<not configured>\n"
+      }
+
       pwd
       python3 --version
       node --version
       npm --version
       pdftotext -v 2>&1 | sed -n "1p"
       pdfinfo -v 2>&1 | sed -n "1p"
       codex --version
-      git config user.name
-      git config user.email
+      print_git_config "git user.name" user.name
+      print_git_config "git user.email" user.email
+      print_git_config "git core.hooksPath" core.hooksPath
       git branch --show-current
       git status --short
     '
@@ -107,10 +152,6 @@ codexcli_run() {
   podman_args+=(-it)
   exec podman "${podman_args[@]}" "$CODEXCLI_IMAGE" bash -lc '
     set -Eeuo pipefail
-    git config --global user.name "Timo Bigdon"
-    git config --global user.email "timo@bigdon.de"
-    git config --local user.name "Timo Bigdon"
-    git config --local user.email "timo@bigdon.de"
     exec codex --cd /workspace --sandbox workspace-write \
       --ask-for-approval on-request "$@"
   ' bash "$@"

templates/codex-home/AGENTS.md

@@ -1,5 +1,9 @@
 # Codex operating rules
 
+This file is a template for a shared Codex home policy. Copy it to
+`~/.local/share/codexcli/codex-home/AGENTS.md` to apply these rules across
+runtime sessions.
+
 ## Working style
 
 * Diagnose before editing.