v1.2.6

Author: CoderLuii

.github/SECURITY.md

@@ -20,10 +20,14 @@ These are required for Chromium to function and are standard across Playwright,
 
 | Mode | Default? | What it means |
 |------|----------|--------------|
-| `allowEdits` | **Yes** | Claude can edit files freely, asks before running shell commands |
-| `bypassPermissions` | No | Claude runs any command without confirmation |
+| `acceptEdits` | **Yes** | Claude Code can edit files freely, with shell commands still following Claude Code's current prompt behavior |
+| `bypassPermissions` | No | The agent runs commands without confirmation |
 
-The default `allowEdits` mode is safe for most users. `bypassPermissions` is documented for power users who understand the implications.
+The default `acceptEdits` mode is right for most users. `bypassPermissions` is documented for power users who understand the implications.
+
+Codex support uses configurable near-parity modes, not identical security. `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE` controls CloudCLI Codex chat at runtime, while `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE` only seeds a new raw `codex` CLI `~/.codex/config.toml` on first boot. Valid values are `default`, `acceptEdits`, and `bypassPermissions`; `acceptEdits` is recommended.
+
+Do not expose CloudCLI directly to the public internet, especially with any bypass mode enabled. Docker limits access to the container and mounted volumes, but CloudCLI still exposes an interactive coding environment with credentials and mounted workspace files.
 
 ## Credential Storage
 

Dockerfile

@@ -172,6 +172,7 @@ COPY vendor/artifacts/siteboon-claude-code-ui-1.26.3.tgz /tmp/vendor/siteboon-cl
 # ---------- CloudCLI (web UI for Claude Code) ----------
 RUN npm i -g /tmp/vendor/siteboon-claude-code-ui-1.26.3.tgz && rm -f /tmp/vendor/siteboon-claude-code-ui-1.26.3.tgz
 COPY scripts/patch-cloudcli-apprise-notifications.mjs /tmp/patch-cloudcli-apprise-notifications.mjs
+COPY scripts/patch-cloudcli-codex-permissions.mjs /tmp/patch-cloudcli-codex-permissions.mjs
 RUN touch /usr/local/lib/node_modules/@siteboon/claude-code-ui/.env
 
 # ---------- Patch: preserve WebSocket frame type in plugin proxy (Issue #11) ----------
@@ -229,6 +230,9 @@ RUN CLOUDCLI_BUNDLE="/usr/local/lib/node_modules/@siteboon/claude-code-ui/dist/a
 # patch: bridge Codex CloudCLI lifecycle events to Apprise (issue #17)
 RUN node /tmp/patch-cloudcli-apprise-notifications.mjs && rm -f /tmp/patch-cloudcli-apprise-notifications.mjs
 
+# patch: configure Codex CloudCLI chat permission mode (issue #18)
+RUN node /tmp/patch-cloudcli-codex-permissions.mjs && rm -f /tmp/patch-cloudcli-codex-permissions.mjs
+
 # ---------- CloudCLI plugins (baked into image) ----------
 USER claude
 RUN mkdir -p /home/claude/.claude-code-ui/plugins && \

README.md

@@ -408,6 +408,15 @@ services:
       # - GEMINI_API_KEY=your_key
       # - OPENAI_API_KEY=your_key
       # - CURSOR_API_KEY=your_key
+      #
+      # CODEX PERMISSION MODES (optional)
+      # CloudCLI Codex chat reads HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE at runtime.
+      # Raw codex CLI reads HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE only when first creating ~/.codex/config.toml.
+      # Valid values: default, acceptEdits, bypassPermissions. Recommended: acceptEdits.
+      # bypassPermissions gives full access with no approval. Use it only for trusted local workspaces.
+      #
+      # - HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE=acceptEdits
+      # - HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE=acceptEdits
 ```
 
 Then:
@@ -474,6 +483,8 @@ The complete reference. Every variable, what it defaults to, what it does.
 | `GEMINI_API_KEY` | *(unset)* | Google Gemini API key |
 | `OPENAI_API_KEY` | *(unset)* | OpenAI API key (for Codex CLI, or use `codex login --device-auth` for ChatGPT subscription) |
 | `CURSOR_API_KEY` | *(unset)* | Cursor API key |
+| `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE` | `acceptEdits` | CloudCLI Codex chat runtime mode. Valid: `default`, `acceptEdits`, `bypassPermissions` |
+| `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE` | `default` | Raw `codex` CLI first-boot mode for new `~/.codex/config.toml` only. Valid: `default`, `acceptEdits`, `bypassPermissions` |
 
 <p align="right">
   <a href="#top">↑ back to top</a>
@@ -821,6 +832,19 @@ This is how I personally run it. Edit `./data/claude/settings.json` on your host
 
 > **Bypass mode means Claude executes commands without confirmation.** It is powerful, but it can also run destructive commands quickly. Keep the shipped `acceptEdits` default unless you trust the workspace and every prompt you run.
 
+### Codex Permission Modes
+
+HolyClaude also ships configurable near-parity permission modes for Codex, with separate controls for CloudCLI Codex chat and the raw `codex` CLI.
+
+| Setting | Applies to | Default | When it is read |
+|---------|------------|---------|-----------------|
+| `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE` | CloudCLI Codex chat in the browser | `acceptEdits` | Runtime container config, read by the CloudCLI Codex provider |
+| `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE` | Raw `codex` CLI config at `~/.codex/config.toml` | `default` | First boot only, when the file does not already exist |
+
+Valid values for both are `default`, `acceptEdits`, and `bypassPermissions`. `acceptEdits` is recommended. For CloudCLI Codex chat, the value is runtime container configuration, so changing it and recreating the container changes future chat runs. For the raw `codex` CLI, the value only seeds a new `~/.codex/config.toml`; existing configs are not overwritten, and the generated value persists until you edit that file yourself.
+
+`bypassPermissions` maps Codex to full access with no approval. Inside Docker, that still runs within the container and mounted volumes, but it can read and change anything reachable through those mounts, especially `/workspace` and persisted config under `/home/claude`. Use it only for trusted local workspaces, and don't expose CloudCLI directly to the public internet.
+
 <p align="right">
   <a href="#top">↑ back to top</a>
 </p>

THIRD-PARTY-NOTICES

@@ -30,6 +30,9 @@ build.
   `server/routes/commands.js` into the bundled browser code, update the
   selected Claude model on model events, and keep a custom model option visible
   in the selector.
+- Codex permission-mode compatibility backport: adds HolyClaude's
+  `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE` runtime mapping for CloudCLI Codex
+  chat, including `default`, `acceptEdits`, and `bypassPermissions` modes.
 
 The unmodified upstream source is available from the links above, and the
 HolyClaude modifications are visible in the public Dockerfile.

config/claude-memory-full.md

@@ -73,7 +73,7 @@ The `--break-system-packages` flag is required (no venv in container context).
 |-----|---------|-------|
 | **Claude Code** | `claude` | Primary — you are running inside this |
 | **Gemini CLI** | `gemini` | Requires `GEMINI_API_KEY` env var. Config persists across rebuilds. Notifications via Apprise. |
-| **OpenAI Codex** | `codex` | `OPENAI_API_KEY` or ChatGPT subscription (`codex login --device-auth`). Pre-configured with on-request approval. Auth persists across rebuilds. Notifications via Apprise. |
+| **OpenAI Codex** | `codex` | `OPENAI_API_KEY` or ChatGPT subscription (`codex login --device-auth`). Raw CLI config is seeded on first boot. Auth persists across rebuilds. Notifications via Apprise. |
 | **Cursor** | `cursor` | Requires `CURSOR_API_KEY` env var. Config persists across rebuilds. |
 | **TaskMaster AI** | `task-master` | Task planning and management |
 | **Junie** | `junie` | JetBrains AI coding agent (requires JetBrains account) |
@@ -149,6 +149,11 @@ Claude Code runs in `acceptEdits` mode by default:
 - Shell commands: follow Claude Code's current permission prompt behavior
 - To enable full bypass: change `acceptEdits` to `bypassPermissions` in `~/.claude/settings.json`
 
+Codex has separate configurable near-parity controls:
+- CloudCLI Codex chat: `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE`, read at runtime by CloudCLI. Valid values: `default`, `acceptEdits`, `bypassPermissions`. Recommended: `acceptEdits`.
+- Raw `codex` CLI: `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE`, used only when creating a new `~/.codex/config.toml` on first boot. Existing configs are not overwritten, and the generated value persists until you edit it.
+- `bypassPermissions` gives full access with no approval inside the Docker container and mounted volumes. Use it only for trusted local workspaces.
+
 ## Container Lifecycle
 
 - **First boot:** Bootstrap runs once — copies settings, memory, configures git

config/claude-memory-slim.md

@@ -112,7 +112,7 @@ These take longer to install (~1-2 minutes) because they require system dependen
 |-----|---------|-------|
 | **Claude Code** | `claude` | Primary — you are running inside this |
 | **Gemini CLI** | `gemini` | Requires `GEMINI_API_KEY` env var |
-| **OpenAI Codex** | `codex` | Requires `OPENAI_API_KEY` env var |
+| **OpenAI Codex** | `codex` | `OPENAI_API_KEY` or ChatGPT subscription (`codex login --device-auth`). Raw CLI config is seeded on first boot. |
 | **Cursor** | `cursor` | Requires `CURSOR_API_KEY` env var |
 | **TaskMaster AI** | `task-master` | Task planning and management |
 
@@ -181,6 +181,11 @@ Claude Code runs in `acceptEdits` mode by default:
 - Shell commands: follow Claude Code's current permission prompt behavior
 - To enable full bypass: change `acceptEdits` to `bypassPermissions` in `~/.claude/settings.json`
 
+Codex has separate configurable near-parity controls:
+- CloudCLI Codex chat: `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE`, read at runtime by CloudCLI. Valid values: `default`, `acceptEdits`, `bypassPermissions`. Recommended: `acceptEdits`.
+- Raw `codex` CLI: `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE`, used only when creating a new `~/.codex/config.toml` on first boot. Existing configs are not overwritten, and the generated value persists until you edit it.
+- `bypassPermissions` gives full access with no approval inside the Docker container and mounted volumes. Use it only for trusted local workspaces.
+
 ## Container Lifecycle
 
 - **First boot:** Bootstrap runs once — copies settings, memory, configures git

docker-compose.full.yaml

@@ -66,3 +66,12 @@ services:
       # - GEMINI_API_KEY=
       # - OPENAI_API_KEY=
       # - CURSOR_API_KEY=
+
+      # --- Codex permission modes (optional) ---
+      # CloudCLI Codex chat runtime mode. Valid: default, acceptEdits, bypassPermissions.
+      # Recommended: acceptEdits. bypassPermissions gives full access with no approval;
+      # use it only for trusted local workspaces inside your Docker volume boundary.
+      # - HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE=acceptEdits
+      # Raw codex CLI first-boot mode. Only used when creating a new ~/.codex/config.toml.
+      # Existing Codex configs are not overwritten.
+      # - HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE=acceptEdits

docs/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to HolyClaude will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.2.6] - 05/28/2026
+
+### Added
+- Added configurable near-parity Codex permission modes for CloudCLI Codex chat with `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE`.
+- Added first-boot raw `codex` CLI permission-mode seeding through `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE`.
+
+### Changed
+- Documented Codex permission behavior, safety caveats, compose examples, and CloudCLI modification notices.
+
 ## [1.2.5] - 05/27/2026
 
 ### Fixed

docs/configuration.md

@@ -94,6 +94,17 @@ Claude Code can authenticate via web UI (OAuth) or `ANTHROPIC_API_KEY`. Other AI
 | `OPENAI_API_KEY` | (unset) | OpenAI API key |
 | `CURSOR_API_KEY` | (unset) | Cursor API key |
 
+### Codex Permission Modes
+
+HolyClaude provides configurable near-parity permission modes for Codex. These settings are intentionally split because CloudCLI Codex chat and the raw `codex` CLI read configuration through different paths.
+
+| Variable | Default | Valid values | Applies to | Behavior |
+|----------|---------|--------------|------------|----------|
+| `HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE` | `acceptEdits` | `default`, `acceptEdits`, `bypassPermissions` | CloudCLI Codex chat | Runtime container config read by the CloudCLI Codex provider. Recreate the container after changing it. |
+| `HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE` | `default` | `default`, `acceptEdits`, `bypassPermissions` | Raw `codex` CLI | First-boot-only seed for new `~/.codex/config.toml`. Existing configs are not overwritten, and the generated value persists until you edit the file. |
+
+`acceptEdits` is the recommended value for both settings. `bypassPermissions` gives Codex full access with no approval. Docker still limits access to the container and mounted volumes, but anything reachable through `/workspace`, `/home/claude`, and other mounts can be read or changed. Use bypass only for trusted local workspaces.
+
 ---
 
 ## Volumes
@@ -110,6 +121,7 @@ Claude Code can authenticate via web UI (OAuth) or `ANTHROPIC_API_KEY`. Other AI
 | `settings.json` | Claude Code settings (permissions, hooks, model) |
 | `CLAUDE.md` | Claude's global memory — customize with your preferences |
 | `.credentials.json` | Anthropic API authentication (auto-created) |
+| `.codex/config.toml` | Raw Codex CLI config, created on first boot if missing |
 | `.holyclaude-bootstrapped` | Sentinel file — delete to re-run first-boot setup |
 
 ---

scripts/bootstrap.sh

@@ -42,14 +42,35 @@ echo "[bootstrap] Configured git as '$GIT_USER_NAME <$GIT_USER_EMAIL>'"
 
 # ---------- Codex CLI default configuration ----------
 if [ ! -f "$CLAUDE_HOME/.codex/config.toml" ]; then
-    cat > "$CLAUDE_HOME/.codex/config.toml" <<'TOML'
-approval_policy = "on-request"
-sandbox_mode = "workspace-write"
+    CODEX_CLI_APPROVAL_POLICY="on-request"
+    CODEX_CLI_SANDBOX_MODE="workspace-write"
+    CODEX_CLI_CONFIG_LABEL="on-request approval, workspace-write sandbox"
+
+    case "${HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE:-default}" in
+        ""|default)
+            ;;
+        acceptEdits)
+            CODEX_CLI_APPROVAL_POLICY="never"
+            CODEX_CLI_CONFIG_LABEL="never approval, workspace-write sandbox"
+            ;;
+        bypassPermissions)
+            CODEX_CLI_APPROVAL_POLICY="never"
+            CODEX_CLI_SANDBOX_MODE="danger-full-access"
+            CODEX_CLI_CONFIG_LABEL="never approval, danger-full-access sandbox"
+            ;;
+        *)
+            echo "[bootstrap] Warning: invalid HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE; using default Codex CLI config"
+            ;;
+    esac
+
+    cat > "$CLAUDE_HOME/.codex/config.toml" <<TOML
+approval_policy = "$CODEX_CLI_APPROVAL_POLICY"
+sandbox_mode = "$CODEX_CLI_SANDBOX_MODE"
 
 [features]
 codex_hooks = true
 TOML
-    echo "[bootstrap] Created Codex CLI config (on-request approval, workspace-write sandbox, hooks enabled)"
+    echo "[bootstrap] Created Codex CLI config ($CODEX_CLI_CONFIG_LABEL, hooks enabled)"
 elif ! grep -q '^\[features\]' "$CLAUDE_HOME/.codex/config.toml"; then
     printf '\n[features]\ncodex_hooks = true\n' >> "$CLAUDE_HOME/.codex/config.toml"
     echo "[bootstrap] Added [features] section to existing Codex config"