Install Codex CLI with file-based auth

.devcontainer/Dockerfile

@@ -166,6 +166,7 @@ RUN mkdir -p /build_ray \
 # Layer 6: setuptools, uv, Claude, gcc symlinks, git config, sudoers, permissions
 RUN /home/devuser/miniconda/bin/pip install --no-cache-dir setuptools uv scikit-build \
     && curl -fsSL https://claude.ai/install.sh | HOME=/home/devuser bash \
+    && curl -fsSL https://chatgpt.com/codex/install.sh | HOME=/home/devuser bash \
     && if [ -n "${GCC_SUFFIX}" ]; then \
            rm -f /usr/bin/gcc /usr/bin/g++ \
            && ln -s "/usr/bin/gcc${GCC_SUFFIX}" /usr/bin/gcc \

.devcontainer/agent.Dockerfile

@@ -91,6 +91,7 @@ ENV PATH=/home/devuser/miniconda/bin:${PATH}
 # Layer 6: setuptools, uv, Claude, gcc symlinks, git config, sudoers, permissions
 RUN /home/devuser/miniconda/bin/pip install --no-cache-dir setuptools uv scikit-build \
     && curl -fsSL https://claude.ai/install.sh | HOME=/home/devuser bash \
+    && curl -fsSL https://chatgpt.com/codex/install.sh | HOME=/home/devuser bash \
     && if [ -n "${GCC_SUFFIX}" ]; then \
            rm -f /usr/bin/gcc /usr/bin/g++ \
            && ln -s "/usr/bin/gcc${GCC_SUFFIX}" /usr/bin/gcc \

.devcontainer/nvshmem.Dockerfile

@@ -163,6 +163,7 @@ RUN mkdir -p /build_ray \
 # Layer 6: setuptools, uv, Claude, gcc symlinks, git config, sudoers, permissions
 RUN /home/devuser/miniconda/bin/pip install --no-cache-dir setuptools uv scikit-build \
     && curl -fsSL https://claude.ai/install.sh | HOME=/home/devuser bash \
+    && curl -fsSL https://chatgpt.com/codex/install.sh | HOME=/home/devuser bash \
     && if [ -n "${GCC_SUFFIX}" ]; then \
            rm -f /usr/bin/gcc /usr/bin/g++ \
            && ln -s "/usr/bin/gcc${GCC_SUFFIX}" /usr/bin/gcc \

create_dev_user.sh

@@ -13,6 +13,7 @@ while true; do
   read -p "Enter openshift username: " USERNAME
   read -e -p "Enter ssh private key path for github: " SSH_KEY_PATH
   read -e -p "Enter gcloud application default credentials path: " GCLOUD_CREDENTIALS
+  read -e -p "Enter codex auth.json path: " CODEX_AUTH
   read -e -i "${ANTHROPIC_VERTEX_PROJECT_ID:-}" -p "Enter vertex project ID: " PROJECT_ID
 
   NAMESPACE=$(echo "$USERNAME" | tr '[:upper:]' '[:lower:]')
@@ -22,6 +23,7 @@ while true; do
   echo "  Username (namespace): $NAMESPACE"
   echo "  SSH private key path: $SSH_KEY_PATH"
   echo "  gcloud credentials:   $GCLOUD_CREDENTIALS"
+  echo "  codex auth.json:      $CODEX_AUTH"
   echo "  Vertex Project ID:    $PROJECT_ID"
   echo ""
   read -p "Is this correct? (y/n): " CONFIRM
@@ -56,6 +58,16 @@ oc create secret generic $NAMESPACE-gcloud-config \
   --namespace=$NAMESPACE \
   --from-file=$GCLOUD_CREDENTIALS
 
+# create codex authentication secret (file auth: mounted at ~/.codex/auth.json in
+# the pod); if one already exists, delete it first so we upload the latest credentials
+if oc get secret $NAMESPACE-codex-config --namespace=$NAMESPACE >/dev/null 2>&1; then
+  echo "Secret $NAMESPACE-codex-config already exists, deleting it to upload the latest credentials."
+  oc delete secret $NAMESPACE-codex-config --namespace=$NAMESPACE
+fi
+oc create secret generic $NAMESPACE-codex-config \
+  --namespace=$NAMESPACE \
+  --from-file=auth.json=$CODEX_AUTH
+
 # apply the DRA resource templates
 oc apply -f <(sed "s/<username>/$NAMESPACE/g" resourceClaimTemplates/rct_gpu.yml)
 # inject the vertex project ID env var into the container (reads YAML on stdin,

deployment/deployment-rdma.yml

@@ -33,6 +33,10 @@ spec:
           secret:
             secretName: <username>-gcloud-config
             defaultMode: 0640
+        - name: codex-config
+          secret:
+            secretName: <username>-codex-config
+            defaultMode: 0640
         - name: pytorch-eco-data
           persistentVolumeClaim:
             claimName: pytorch-py3-10-<username>
@@ -121,6 +125,10 @@ spec:
             - name: gcloud-config
               readOnly: true
               mountPath: /home/devuser/.config/gcloud
+            - name: codex-config
+              readOnly: true
+              mountPath: /home/devuser/.codex/auth.json
+              subPath: auth.json
             - name: bazelrc
               mountPath: /home/devuser/.bazelrc
               subPath: .bazelrc

deployment/deployment.yml

@@ -32,6 +32,10 @@ spec:
           secret:
             secretName: <username>-gcloud-config
             defaultMode: 0640
+        - name: codex-config
+          secret:
+            secretName: <username>-codex-config
+            defaultMode: 0640
         - name: pytorch-eco-data
           persistentVolumeClaim:
             claimName: pytorch-<pydash>-<username>
@@ -103,6 +107,10 @@ spec:
             - name: gcloud-config
               readOnly: true
               mountPath: /home/devuser/.config/gcloud
+            - name: codex-config
+              readOnly: true
+              mountPath: /home/devuser/.codex/auth.json
+              subPath: auth.json
             - name: bazelrc
               mountPath: /home/devuser/.bazelrc
               subPath: .bazelrc