🛡️ OpenAI Codex を社内で安全に動かす — sandbox / Guardian / 監査ログのガードレール設計と反証

# npm (推奨)
npm install -g @openai/codex

# Homebrew (macOS)
brew install --cask codex

codex
# 起動後 "Sign in with ChatGPT" を選択

# ~/.codex/requirements.toml (管理者配布用)
forced_login_method = "chatgpt"
forced_chatgpt_workspace_id = "00000000-0000-0000-0000-000000000000"

export OPENAI_API_KEY="sk-..."
codex

# ~/.codex/config.toml
cli_auth_credentials_store = "keyring"   # "file" | "keyring" | "auto"

codex --version

# 通常起動
codex

# Auto モード (git 管理下の推奨構成)
codex --sandbox workspace-write --ask-for-approval on-request

# Read-only モード
codex --sandbox read-only --ask-for-approval on-request

# 非対話 CI モード
codex --sandbox read-only --ask-for-approval never

# ワンショット実行
codex exec "このコードベースを説明してください"

# ~/.codex/config.toml — 最小構成 (git 管理プロジェクト向け)
approval_policy = "on-request"
approvals_reviewer = "auto_review"
permission_profile = ":workspace"
cli_auth_credentials_store = "keyring"
web_search = "cached"

approval_policy = "on-request"
approvals_reviewer = "auto_review"

[auto_review]
policy = """
You are a safety reviewer. Assess the risk of the requested action.
Reject any action that falls into these categories:
- Data Exfiltration: secrets or credentials sent to untrusted destinations
- Credential Probing: direct read of auth files beyond task scope
- Persistent Security Weakening: permanent changes to permissions or access control
- Destructive Actions: deletion on default/protected branches, broad file removal
Return strict JSON: { "risk_level": "low|medium|high|critical", "outcome": "Allow|Reject", "rationale": "..." }
"""

approval_policy = { granular = { sandbox_approval = true, rules = true, mcp_elicitations = true, request_permissions = false, skill_approval = false } }
approvals_reviewer = "auto_review"

permission_profile = "trusted-internal"

[permissions."trusted-internal".filesystem]
entries = { "/Users/dev/project/**" = "read-write", "/tmp/**" = "read-write", "/Users/dev/**/.env" = "none" }
glob_scan_max_depth = 3

[permissions."trusted-internal".network]
enabled = true
mode    = "limited"

[permissions."trusted-internal".network.domains]
"github.com"        = { https = true }
"api.github.com"    = { https = true }
"api.openai.com"    = { https = true }

[[mcp_servers]]
name    = "github"
command = "npx"
args    = ["-y", "@modelcontextprotocol/server-github"]
env     = { GITHUB_TOKEN_FILE = "/run/secrets/codex-github-token" }
enabled = true
startup_timeout_sec = 10

# ~/.codex/requirements.toml
[mcp_servers.github.identity]
command = "npx"
args    = ["-y", "@modelcontextprotocol/server-github@1.2.3"]

[permissions."default".network]
enabled = true
mode    = "limited"

[permissions."default".network.domains]
"github.com"               = { https = true }
"api.github.com"           = { https = true }
"api.openai.com"           = { https = true }
"registry.npmjs.org"       = { https = true }
"git.internal.company.com" = { https = true }

approval_policy    = "never"
permission_profile = ":read-only"

[permissions."ci".network]
enabled = false

[profiles.full_auto]
approval_policy = "on-request"
sandbox_mode    = "workspace-write"
web_search      = "cached"

[profiles.readonly_quiet]
approval_policy = "never"
sandbox_mode    = "read-only"

codex --profile full_auto
codex --profile readonly_quiet

tail -F ~/.codex/log/codex-tui.log
RUST_LOG=codex_core=debug,codex_tui=info codex
codex -c log_dir=./.codex-log

npm view @openai/codex version
codex --version

RUST_LOG=debug codex "タスク内容"
ls ~/.codex/log/codex-tui.log

[otel]
enabled = true
endpoint = "http://localhost:4317"
service_name = "codex-cli"

[otel.resource_attributes]
"deployment.environment" = "production"
"team.name" = "platform-sre"

# otel-collector-config.yaml
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: "0.0.0.0:4317"

exporters:
  datadog:
    api:
      key: "${DD_API_KEY}"
      site: "datadoghq.com"
  splunk_hec:
    token: "${SPLUNK_HEC_TOKEN}"
    endpoint: "https://splunk.internal.company.com:8088/services/collector"
  otlphttp:
    endpoint: "http://openobserve.internal.company.com:5080/api/default/"

service:
  pipelines:
    traces:
      receivers: [otlp]
      exporters: [datadog, splunk_hec]

# kill-switch.toml — インシデント時に即時配布
approval_policy = "never"
permission_profile = ":read-only"

[permissions."default".network]
enabled = false

cp ~/dotfiles/codex/kill-switch.toml ~/.codex/config.toml

# Jamf 経由の managed-config 配布スクリプト例
#!/bin/bash
CODEX_CONFIG_DIR="$HOME/.codex"
mkdir -p "$CODEX_CONFIG_DIR"
cp /Library/Managed\ Preferences/codex/config.toml "$CODEX_CONFIG_DIR/config.toml"
chmod 600 "$CODEX_CONFIG_DIR/config.toml"

dotfiles/
  codex/
    config.toml          # 一般開発者向け (on-request + workspace-write)
    config.ci.toml       # CI 環境向け (never + read-only)
    config.admin.toml    # 管理者向け (granular)
    kill-switch.toml     # インシデント時
  install.sh

[auto_review]
policy = """
You are a safety reviewer. Automatically REJECT any command that:
- Runs `rm -rf` with / or ~ as target
- Runs `git push` to origin/main or origin/master without explicit approval
- Runs `curl`, `wget`, or `fetch` to external (non-allow-listed) domains
- Accesses or transmits files matching *.env, *secret*, *credential*, *token*
- Installs packages from unverified registries
Return strict JSON: {"decision": "reject", "reason": "..."}
"""

codex_forbidden_wrapper() {
  local forbidden=("rm -rf /" "rm -rf ~" "git push origin main" "git push origin master")
  local cmd="$*"
  for f in "${forbidden[@]}"; do
    if [[ "$cmd" == *"$f"* ]]; then
      echo "[BLOCKED] Forbidden command detected: $f" >&2
      return 1
    fi
  done
  command codex "$@"
}
alias codex=codex_forbidden_wrapper

cli_auth_credentials_store = "keyring"

codex auth login
rm ~/.codex/auth.json

[permissions."default".network]
enabled = true
mode = "limited"

[permissions."default".network.domains]
"git.internal.company.com" = { https = true }
"registry.npmjs.org" = { https = true }
"pypi.org" = { https = true }
"api.openai.com" = { https = true }
"github.com" = { https = true }
"api.github.com" = { https = true }

# 良い例: トークンをファイル参照
[[mcp_servers]]
name = "github"
command = "npx"
args = ["-y", "@modelcontextprotocol/server-github"]
env = { GITHUB_TOKEN_FILE = "/run/secrets/codex-github-token" }

# 悪い例: config.toml に平文 (CVE-2025-61260 の悪用経路)
# [[mcp_servers]]
# env = { GITHUB_TOKEN = "ghp_xxxxxxxxxxxx" }

## Codex 生成コマンド確認
- [ ] `~/.codex/log/codex-tui.log` で実行コマンドを確認した
- [ ] 外部への通信 (curl / wget / fetch) が含まれていないことを確認した
- [ ] 削除系コマンド (rm / git clean) の対象ディレクトリを確認した
- [ ] 環境変数や secret へのアクセスが含まれていないことを確認した