sbx/codex-sessions:latest

schemaVersion: "3"
displayName: Codex host sessions
author: Docker, Inc. https://docker.com
description: Retain Codex session state on the host across sandbox removal
sourceUrl: https://github.com/docker-hardened-images/definitions
version: 1.1.0
licenses:
    - Apache-2.0
kind: mixin
requires:
    - codex
capabilities:
    - type: com.docker.sandbox/host-mount@1
      config:
        mode: "0700"
        path: /home/agent/codex-history
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -eu
                case "${SANDBOX_NAME:-}" in
                  "" | . | .. | */*)
                    printf 'SANDBOX_NAME must be one path segment, got: "%s"\n' "${SANDBOX_NAME:-}" >&2
                    exit 1
                    ;;
                esac
                state="/home/agent/.codex"
                history="/home/agent/codex-history/$SANDBOX_NAME"
                mkdir -p "$state"
                for name in sessions archived_sessions; do
                  link="$state/$name"
                  target="$history/$name"
                  mkdir -p "$target"
                  if [ -L "$link" ]; then
                    if [ "$(readlink "$link")" != "$target" ]; then
                      printf 'Refusing to replace unexpected symlink: %s\n' "$link" >&2
                      exit 1
                    fi
                    continue
                  fi
                  # rmdir preserves existing sessions and refuses mounted volumes.
                  if [ -e "$link" ]; then
                    if ! rmdir "$link"; then
                      printf 'Cannot replace %s; move existing state to the host directory first.\n' "$link" >&2
                      exit 1
                    fi
                  fi
                  ln -s "$target" "$link"
                done
              description: Link Codex session state to this sandbox's host-shared directory
              env:
                - SANDBOX_NAME
              user: agent
args:
    version:
        required: true
        description: Revision of the session-linking hook
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: VERSION