Codex

boxer adds a hook to Codex that rewrites each intercepted command to boxer run. Codex sees the normal output and exit code.

Set up

boxer install codex
git add .codex .agents
git commit -m "Run Codex's commands in boxer"

Codex reads project hooks from the main checkout's files, not from the branch a worktree is on. Every worktree of this checkout uses them either way. Committing them shares them with your team.

Then do two things boxer install cannot:

1. Trust the project hooks. Codex loads project hooks only from a trusted project. Run /hooks once in Codex. For codex exec, pass --dangerously-bypass-hook-trust.

2. Turn off Codex's own sandbox. A hypervisor cannot start inside Codex's seatbelt or landlock sandbox, so boxer cannot create one from there. boxer replaces it: intercepted commands run in the microVM. Run Codex with --sandbox danger-full-access, or --dangerously-bypass-approvals-and-sandbox under codex exec. To set it once, add sandbox_mode = "danger-full-access" to ~/.codex/config.toml. That also covers Codex when an orchestrator starts it.

   With it, build and test commands run in boxer's microVM instead of Codex's sandbox. git, gh, ssh and any command not in intercept run on your machine without Codex's sandbox around them. Security lists what stays on the host.

These steps are tested with the Codex CLI. The Codex desktop app is not tested.

Secrets

Codex drops environment variables whose names contain KEY, SECRET or TOKEN from the commands it runs, so a variable listed in secrets never reaches boxer run. Let them through in ~/.codex/config.toml:

[shell_environment_policy]
ignore_default_excludes = true

What it writes

To give Codex the boxer_run tool, add the MCP server to .codex/config.toml:

[mcp_servers.boxer]
command = "boxer"
args = ["mcp", "--harness", "codex"]

Check it

boxer doctor

Then ask Codex to run node -p process.platform. It prints linux.

Options

• No trust step: boxer install codex --user writes the hooks to ~/.codex/config.toml, which Codex trusts. Use this under an orchestrator, where no one can approve project hooks.
• Run Codex itself in the sandbox: boxer shell codex. See Inside mode.
• Block the shell instead: set [harness.codex] mode = "tool".

Tested in the matrix with hook rewrite, tool mode, PATH shims and inside mode. PATH shims do not work if Codex starts a login shell.