feat: copy agent credentials into sandboxes

Author: lox

README.md

@@ -230,16 +230,36 @@ agents:
     command: mise exec -- codex
     test: mise exec -- codex --version >/dev/null 2>&1
     install: mise use -g npm:@openai/codex
+    credentials:
+      - source: ~/.codex/auth.json
+        target: ~/.codex/auth.json
+      - source: ~/.codex/config.toml
+        target: ~/.codex/config.toml
   claude:
     command: mise exec -- claude
     test: mise exec -- claude --version >/dev/null 2>&1
     install: mise use -g npm:@anthropic-ai/claude-code
+    credentials:
+      - source: ~/.claude
+        target: ~/.claude
   gemini:
     command: mise exec -- gemini
     test: mise exec -- gemini --version >/dev/null 2>&1
     install: mise use -g npm:@google/gemini-cli
+    credentials:
+      - source: ~/.gemini
+        target: ~/.gemini
+  opencode:
+    command: mise exec -- opencode
+    test: mise exec -- opencode --version >/dev/null 2>&1
+    install: mise use -g npm:opencode-ai
+    credentials:
+      - source: ~/.config/opencode
+        target: ~/.config/opencode
 ```
 
+Credential paths are copied into the sandbox before the agent starts. Missing credential files are skipped, and copied files remain in a kept sandbox until that sandbox is terminated.
+
 The Debian agents image uses the same package sources with pinned versions for reproducible image builds, then symlinks the resulting mise shims into `/usr/local/bin`.
 
 For Codex inside cleanroom, prefer device-code auth or API-key auth. Browser/ChatGPT sign-in is not supported in the sandbox yet because it expects a localhost OAuth callback.
@@ -464,14 +484,32 @@ agents:
     command: mise exec -- codex
     test: mise exec -- codex --version >/dev/null 2>&1
     install: mise use -g npm:@openai/codex
+    credentials:
+      - source: ~/.codex/auth.json
+        target: ~/.codex/auth.json
+      - source: ~/.codex/config.toml
+        target: ~/.codex/config.toml
   claude:
     command: mise exec -- claude
     test: mise exec -- claude --version >/dev/null 2>&1
     install: mise use -g npm:@anthropic-ai/claude-code
+    credentials:
+      - source: ~/.claude
+        target: ~/.claude
   gemini:
     command: mise exec -- gemini
     test: mise exec -- gemini --version >/dev/null 2>&1
     install: mise use -g npm:@google/gemini-cli
+    credentials:
+      - source: ~/.gemini
+        target: ~/.gemini
+  opencode:
+    command: mise exec -- opencode
+    test: mise exec -- opencode --version >/dev/null 2>&1
+    install: mise use -g npm:opencode-ai
+    credentials:
+      - source: ~/.config/opencode
+        target: ~/.config/opencode
 backends:
   firecracker:
     binary_path: firecracker

internal/cli/agent.go

@@ -1,9 +1,17 @@
 package cli
 
 import (
+	"archive/tar"
+	"bytes"
+	"context"
 	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
 	"strings"
 
+	"github.com/buildkite/cleanroom/internal/controlclient"
 	"github.com/buildkite/cleanroom/internal/runtimeconfig"
 )
 
@@ -25,6 +33,10 @@ func (a *AgentCommand) Run(ctx *runtimeContext) error {
 	if err != nil {
 		return err
 	}
+	credentials, err := agentCredentialArchive(a.Command, ctx.Config.Agents)
+	if err != nil {
+		return err
+	}
 
 	console := ConsoleCommand{
 		clientFlags:   a.clientFlags,
@@ -35,6 +47,11 @@ func (a *AgentCommand) Run(ctx *runtimeContext) error {
 		LaunchSeconds: a.LaunchSeconds,
 		Command:       []string{"sh", "-lc", command},
 	}
+	if len(credentials) > 0 {
+		console.preAttach = func(callCtx context.Context, client *controlclient.Client, sandboxID string) error {
+			return extractAgentCredentialArchive(callCtx, client, sandboxID, credentials)
+		}
+	}
 	return console.Run(ctx)
 }
 
@@ -85,6 +102,156 @@ func agentShellCommand(name string, rawArgs []string, agents map[string]runtimec
 	return script.String(), nil
 }
 
+func agentCredentialArchive(name string, agents map[string]runtimeconfig.Agent) ([]byte, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return nil, nil
+	}
+
+	credentials := agentCredentials(name, agents)
+	if len(credentials) == 0 {
+		return nil, nil
+	}
+
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	wrote := false
+	for _, credential := range credentials {
+		source, err := expandHomePath(credential.Source)
+		if err != nil {
+			return nil, err
+		}
+		info, err := os.Lstat(source)
+		if err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+			return nil, fmt.Errorf("read agent credential %q: %w", credential.Source, err)
+		}
+		target, err := guestCredentialPath(credential.Target)
+		if err != nil {
+			return nil, err
+		}
+		if err := addCredentialToArchive(tw, source, target, info); err != nil {
+			return nil, err
+		}
+		wrote = true
+	}
+	if err := tw.Close(); err != nil {
+		return nil, fmt.Errorf("write agent credential archive: %w", err)
+	}
+	if !wrote {
+		return nil, nil
+	}
+	return buf.Bytes(), nil
+}
+
+func agentCredentials(name string, agents map[string]runtimeconfig.Agent) []runtimeconfig.AgentCredential {
+	if agent, ok := agents[name]; ok && len(agent.Credentials) > 0 {
+		return append([]runtimeconfig.AgentCredential(nil), agent.Credentials...)
+	}
+	return nil
+}
+
+func extractAgentCredentialArchive(ctx context.Context, client *controlclient.Client, sandboxID string, archive []byte) error {
+	if err := extractSandboxArchive(ctx, client, sandboxID, "/", bytes.NewReader(archive)); err != nil {
+		return fmt.Errorf("copy agent credentials: %w", err)
+	}
+	return nil
+}
+
+func addCredentialToArchive(tw *tar.Writer, source, target string, info fs.FileInfo) error {
+	if info.IsDir() {
+		return filepath.WalkDir(source, func(path string, entry fs.DirEntry, err error) error {
+			if err != nil {
+				return fmt.Errorf("walk agent credential %q: %w", source, err)
+			}
+			entryInfo, err := entry.Info()
+			if err != nil {
+				return fmt.Errorf("stat agent credential %q: %w", path, err)
+			}
+			rel, err := filepath.Rel(source, path)
+			if err != nil {
+				return err
+			}
+			entryTarget := target
+			if rel != "." {
+				entryTarget = filepath.ToSlash(filepath.Join(target, rel))
+			}
+			return writeCredentialArchiveEntry(tw, path, entryTarget, entryInfo)
+		})
+	}
+	return writeCredentialArchiveEntry(tw, source, target, info)
+}
+
+func writeCredentialArchiveEntry(tw *tar.Writer, source, target string, info fs.FileInfo) error {
+	link := ""
+	if info.Mode()&os.ModeSymlink != 0 {
+		var err error
+		link, err = os.Readlink(source)
+		if err != nil {
+			return fmt.Errorf("read agent credential symlink %q: %w", source, err)
+		}
+	}
+	header, err := tar.FileInfoHeader(info, link)
+	if err != nil {
+		return fmt.Errorf("create agent credential archive header %q: %w", source, err)
+	}
+	header.Name = target
+	if err := tw.WriteHeader(header); err != nil {
+		return fmt.Errorf("write agent credential archive header %q: %w", source, err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil
+	}
+	file, err := os.Open(source)
+	if err != nil {
+		return fmt.Errorf("open agent credential %q: %w", source, err)
+	}
+	defer file.Close()
+	if _, err := io.Copy(tw, file); err != nil {
+		return fmt.Errorf("write agent credential %q: %w", source, err)
+	}
+	return nil
+}
+
+func expandHomePath(path string) (string, error) {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return "", fmt.Errorf("agent credential source is required")
+	}
+	if path == "~" || strings.HasPrefix(path, "~/") {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return "", fmt.Errorf("resolve home directory: %w", err)
+		}
+		if path == "~" {
+			return home, nil
+		}
+		return filepath.Join(home, path[2:]), nil
+	}
+	return path, nil
+}
+
+func guestCredentialPath(path string) (string, error) {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return "", fmt.Errorf("agent credential target is required")
+	}
+	switch {
+	case path == "~":
+		path = "/root"
+	case strings.HasPrefix(path, "~/"):
+		path = "/root/" + path[2:]
+	}
+	path = filepath.ToSlash(filepath.Clean(path))
+	path = strings.TrimPrefix(path, "/")
+	if path == "." || path == "" || strings.HasPrefix(path, "../") || path == ".." {
+		return "", fmt.Errorf("invalid agent credential target %q", path)
+	}
+	return path, nil
+}
+
 func shellQuote(s string) string {
 	if s == "" {
 		return "''"

internal/cli/agent_integration_test.go

@@ -1,6 +1,8 @@
 package cli
 
 import (
+	"archive/tar"
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -15,6 +17,7 @@ import (
 	"github.com/buildkite/cleanroom/internal/controlclient"
 	"github.com/buildkite/cleanroom/internal/endpoint"
 	cleanroomv1 "github.com/buildkite/cleanroom/internal/gen/cleanroom/v1"
+	"github.com/buildkite/cleanroom/internal/runtimeconfig"
 )
 
 func runAgentWithCapture(cmd AgentCommand, stdinData string, ctx runtimeContext) execOutcome {
@@ -100,7 +103,6 @@ func TestAgentIntegrationStartsPersistentSandbox(t *testing.T) {
 			return &backend.ExecutionResult{
 				ExecutionID: req.ExecutionID,
 				ExitCode:    0,
-				Stdout:      "codex-ready\n",
 				Message:     "ok",
 			}, nil
 		},
@@ -222,6 +224,92 @@ func TestAgentIntegrationPassesArgsToCommand(t *testing.T) {
 	assertAgentShellCommand(t, gotCommand, "codex", "exec codex 'exec' '--yolo' 'fix lint failures'")
 }
 
+func TestAgentIntegrationCopiesConfiguredCredentialsBeforeAttach(t *testing.T) {
+	hostHome := t.TempDir()
+	sourcePath := filepath.Join(hostHome, ".codex", "auth.json")
+	if err := os.MkdirAll(filepath.Dir(sourcePath), 0o700); err != nil {
+		t.Fatalf("mkdir credentials: %v", err)
+	}
+	if err := os.WriteFile(sourcePath, []byte(`{"token":"redacted"}`), 0o600); err != nil {
+		t.Fatalf("write credential: %v", err)
+	}
+
+	adapter := &agentCredentialCopyAdapter{
+		integrationAdapter: &integrationAdapter{
+			runStreamFn: func(_ context.Context, req backend.ExecutionRequest, _ backend.OutputStream) (*backend.ExecutionResult, error) {
+				if !req.TTY {
+					return nil, errors.New("expected agent execution to use tty")
+				}
+				return &backend.ExecutionResult{
+					ExecutionID: req.ExecutionID,
+					ExitCode:    0,
+					Message:     "ok",
+				}, nil
+			},
+		},
+	}
+
+	host, _ := startIntegrationServer(t, adapter)
+	cwd := t.TempDir()
+	outcome := runAgentWithCapture(AgentCommand{
+		clientFlags: clientFlags{Host: host},
+		Chdir:       cwd,
+		Command:     "codex",
+	}, "", runtimeContext{
+		CWD:    cwd,
+		Loader: integrationLoader{},
+		Config: runtimeconfig.Config{
+			Agents: map[string]runtimeconfig.Agent{
+				"codex": {
+					Command: "codex",
+					Credentials: []runtimeconfig.AgentCredential{
+						{Source: sourcePath, Target: "~/.codex/auth.json"},
+					},
+				},
+			},
+		},
+	})
+
+	if outcome.cause != nil {
+		t.Fatalf("capture failure: %v", outcome.cause)
+	}
+	if outcome.err != nil {
+		t.Fatalf("AgentCommand.Run returned error: %v", outcome.err)
+	}
+	if got, want := adapter.archiveDestination, "/"; got != want {
+		t.Fatalf("unexpected credential archive destination: got %q want %q", got, want)
+	}
+	assertAgentShellCommand(t, adapter.runReq.Command, "codex", "exec codex")
+
+	tr := tar.NewReader(bytes.NewReader(adapter.archive.Bytes()))
+	header, err := tr.Next()
+	if err != nil {
+		t.Fatalf("read credential archive header: %v", err)
+	}
+	if got, want := header.Name, "root/.codex/auth.json"; got != want {
+		t.Fatalf("unexpected credential archive path: got %q want %q", got, want)
+	}
+	body, err := io.ReadAll(tr)
+	if err != nil {
+		t.Fatalf("read credential archive body: %v", err)
+	}
+	if got, want := string(body), `{"token":"redacted"}`; got != want {
+		t.Fatalf("unexpected credential archive body: got %q want %q", got, want)
+	}
+}
+
+type agentCredentialCopyAdapter struct {
+	*integrationAdapter
+
+	archiveDestination string
+	archive            bytes.Buffer
+}
+
+func (a *agentCredentialCopyAdapter) ExtractSandboxArchive(_ context.Context, _ string, destination string, r io.Reader) (int64, error) {
+	a.archiveDestination = destination
+	return io.Copy(&a.archive, r)
+}
+
 func TestAgentIntegrationReusesProvidedSandboxWithoutLoadingPolicy(t *testing.T) {
 	var gotCommand []string
 	host, _ := startIntegrationServer(t, &integrationAdapter{

internal/cli/config_init_test.go

@@ -74,6 +74,12 @@ func TestConfigInitWritesRuntimeConfig(t *testing.T) {
 	if got, want := cfg.Agents["gemini"].Install, "mise use -g npm:@google/gemini-cli"; got != want {
 		t.Fatalf("expected generated config to include gemini install command %q, got %q", want, got)
 	}
+	if got, want := cfg.Agents["opencode"].Install, "mise use -g npm:opencode-ai"; got != want {
+		t.Fatalf("expected generated config to include opencode install command %q, got %q", want, got)
+	}
+	if got := cfg.Agents["codex"].Credentials; len(got) == 0 {
+		t.Fatal("expected generated config to include codex credential paths")
+	}
 	if strings.Contains(string(raw), "default_backend:") {
 		t.Fatalf("expected generated config to omit default_backend when only one backend is defined, got:\n%s", raw)
 	}