feat(engine): render the codex CODEX_HOME config per run - #6
Merged
Merged
Conversation
WriteConfig renders a codex config.toml into a CODEX_HOME from non-secret provider settings (model, base URL, provider name, wire API), referencing the API key only by the name of the environment variable that holds it. This is how the Actions runtime produces a config per job (docs/setup.md): the values are non-secret, the key never touches the file, and the whole CODEX_HOME is discarded when the job ends. Hermetic tests assert the rendered fields, the applied defaults, required-field validation, and that no key value is ever written.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Next codex-adapter increment: generate the
CODEX_HOMEconfig rather than hand-write it.WriteConfig(codexHome, ProviderConfig)rendersconfig.tomlfrom non-secret settings (model, base URL, provider name, wire API) and references the API key only by the name of the env var that holds it. This is the "config rendered per job" design indocs/setup.md: non-secret values in the file, the key injected as an env var at runtime, the wholeCODEX_HOMEdiscarded when the job ends.Hermetic tests assert the rendered fields and defaults, required-field validation, and — importantly — that no key value is ever written to the file.
Next: per-role prompt assembly,
--jsontoken/cost capture,--output-schemaverdicts, and wiring the adapter into the loop.No secrets or private material in the diff.