improve codex coverage in base sandbox (#54)

Author: ben-cobb

sandboxes/base/Dockerfile

@@ -74,7 +74,7 @@ RUN npm install -g \
         tar@7.5.11 \
         @hono/node-server@1.19.11 \
         opencode-ai@1.2.18 \
-        @openai/codex@0.111.0 \
+        @openai/codex@0.117.0 \
         @github/copilot@1.0.9
 
 # GitHub CLI

sandboxes/base/README.md

@@ -56,3 +56,13 @@ FROM ${BASE_IMAGE}
 ```
 
 See `sandboxes/openclaw/` for an example.
+
+## Codex authentication
+
+For remote or headless OpenShell environments, if browser login hangs, try authenticating Codex with:
+
+```bash
+codex login --device-auth
+```
+
+If device-code login is unreliable in your environment, you can authenticate on another machine and copy ~/.codex/auth.json into the sandbox.

sandboxes/base/policy.yaml

@@ -172,3 +172,14 @@ network_policies:
     - { host: default.exp-tas.com, port: 443 }
     binaries:
     - { path: /usr/lib/node_modules/@github/copilot/node_modules/@github/**/copilot }
+
+  codex:
+    name: codex
+    endpoints:
+      - { host: api.openai.com,  port: 443 }
+      - { host: auth.openai.com, port: 443 }
+      - { host: chatgpt.com,     port: 443 }
+    binaries:
+      - { path: /usr/bin/codex }
+      - { path: /usr/bin/node }
+      - { path: "/usr/lib/node_modules/@openai/**" }