fix(cloud): prove connected auth and runtime readiness

[BigSimmo]

Summary

• add a pre-profile, name-only raw Cloud environment probe
• keep connected RAG offline and exclude CODEX_CLOUD_GITHUB_PAT from every agent shell
• launch and close Chromium, Firefox, and WebKit during runtime acceptance
• fingerprint the Python Cloud lock, run pip check, and report medspaCy/spaCy versions
• require an expected base SHA when only a detached task HEAD is available
• treat .codex/config.toml as the disabled project template, activate audited Railway/Supabase entries in the connected host config, and keep .mcp.json as configuration-only evidence
• constrain production Supabase to prompted, read-only docs/development metadata tools (no SQL or production logs)
• distinguish Railway CLI token auth from hosted OAuth tool availability
• reclassify the PAT branch deletion helper as operator-only outside Codex Cloud
• update Railway CLI to 5.30.4 and correct the publication order to format → stage → commit → publish

Security boundary

No provider secret is added to the repository or agent environment. Hosted Railway/Supabase access still requires the corresponding OAuth plugin/connector to be installed in the host and proven in a fresh task with read-only identity calls.

Local validation

• bash -n for modified shell scripts
• node --check scripts/check-codex-cloud-setup.mjs
• Prettier 3.9.6 check for modified JS/TS/docs
• raw probe PASS with a clean environment
• raw probe FAIL reports only OPENAI_API_KEY name with a synthetic value
• policy-only setup behavior: connected host config enables Railway/Supabase; offline host config enables neither

Full repository tests are delegated to this PR's CI because the active workspace is connector-backed rather than a local checkout.

Summary by CodeRabbit

• New Features

  • Added stronger Codex Cloud checks for browser support, Python dependencies, checkout freshness, base commits, environment variables, and connected services.
  • Added safeguards to prevent provider secrets from being exposed during validation.
  • Restricted Supabase access to documentation and development metadata, with prompted approvals.
  • Added offline-only connected access defaults and managed MCP setup verification.

• Bug Fixes

  • Improved branch cleanup safeguards and restricted PAT-based cleanup to authorized operators outside Codex Cloud.
  • Updated Railway CLI compatibility to version 5.30.4.

• Documentation

  • Expanded Codex Cloud setup, troubleshooting, credential, branch cleanup, and verification guidance.
  • Updated the scripts index with the latest tooling.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:17 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 16d925d3-3bb8-4606-9fc6-9eb9d4a2f22c

📥 Commits

Reviewing files that changed from the base of the PR and between 5b81c75 and 2eddf7d.

📒 Files selected for processing (2)

• scripts/check-codex-cloud-setup.mjs
• tests/codex-cloud-setup.test.ts

📝 Walkthrough

Walkthrough

Codex Cloud setup now restricts Supabase MCP access, defaults connected mode to offline RAG, validates browsers, Python dependencies, environment variables, and Git ancestry, and enforces operator-only PAT branch deletion. Documentation and tests reflect these changes.

Changes

Codex Cloud hardening

Layer / File(s)	Summary
MCP configuration and connected setup .codex/config.toml, .mcp.json, scripts/setup-codex-cloud.sh, scripts/check-codex-cloud-setup.mjs, tests/codex-cloud-setup.test.ts	Supabase access now permits only docs and development features with prompted approval. Connected mode requires offline RAG and registers Railway and Supabase MCP servers.
Runtime and dependency validation scripts/check-codex-cloud-setup.mjs, scripts/setup-codex-cloud.sh, scripts/maintain-codex-cloud.sh, tests/codex-cloud-setup.test.ts	Runtime checks validate Playwright browser launches, Python dependencies and fingerprints, Railway token authentication, package versions, and expected Git ancestry.
Environment and PAT safeguards scripts/check-codex-cloud-raw-env.sh, scripts/delete-codex-cloud-branch-with-pat.sh, scripts/setup-codex-cloud.sh, scripts/check-codex-cloud-setup.mjs, tests/codex-cloud-setup.test.ts, AGENTS.md	Raw environment checks report credential names without values. PAT branch deletion rejects Codex Cloud execution and requires operator credentials.
Documentation and script index updates docs/codex-cloud.md, docs/scripts-index.md, AGENTS.md	Documentation covers the new acceptance checks, MCP boundaries, credential rules, and script index changes.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
participant Setup as setup-codex-cloud.sh
participant Checker as check-codex-cloud-setup.mjs
participant Environment as check-codex-cloud-raw-env.sh
participant Runtime as Cloud runtime
Setup->>Runtime: Configure offline mode and MCP servers
Checker->>Environment: Scan inherited provider variables
Environment-->>Checker: Return names without values
Checker->>Runtime: Validate browsers, Python dependencies, and Git ancestry
Runtime-->>Checker: Return validation results

Loading

Possibly related PRs

• BigSimmo/Database#1497: Modifies the same Codex Cloud setup checker, setup script, and tests.
• BigSimmo/Database#1561: Modifies Codex Cloud MCP configuration and validation.
• BigSimmo/Database#1581: Modifies Codex Cloud PAT safeguards and credential-boundary checks.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description provides a detailed summary and validation evidence but omits the required Verification, Risk and rollout, Clinical Governance Preflight, and Notes sections.	Add the missing template sections and record verification results, risks, rollback, provider effects, governance checks, and relevant notes.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main changes: connected authentication proof and runtime readiness validation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:473861f8d1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devin-ai-integration]

Devin Review found 3 potential issues.

View 1 additional finding in Devin Review.

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Unit coverage — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #7908 (cancelled).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/check-codex-cloud-setup.mjs`:
- Line 288: Update sanitizedCloudCapabilityLines and its approvedModeValue
inputs so both Cloud profiles use RAG_PROVIDER_MODE=offline, matching the Cloud
profile contract. Remove the auto/openai values from this capability-reporting
path so invalid modes are not marked approved.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5b57bdc6-49fd-4cb1-bec4-1113f3578d84

📥 Commits

Reviewing files that changed from the base of the PR and between c34b1a2 and 620ecc9.

📒 Files selected for processing (9)

• .codex/config.toml
• .mcp.json
• docs/codex-cloud.md
• docs/scripts-index.md
• scripts/check-codex-cloud-raw-env.sh
• scripts/check-codex-cloud-setup.mjs
• scripts/delete-codex-cloud-branch-with-pat.sh
• scripts/setup-codex-cloud.sh
• tests/codex-cloud-setup.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/check-codex-cloud-setup.mjs`:
- Line 440: Update the capability output construction around
checkout.expectedBase so CODEX_CLOUD_EXPECTED_BASE_SHA is validated and
normalized to a full commit ID before being assigned to git.expected_base. Emit
invalid for malformed or newline-containing values and unset when no value is
provided, and add coverage for arbitrary and newline-containing inputs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40526c99-bc51-44db-a18d-9ae3773706b9

📥 Commits

Reviewing files that changed from the base of the PR and between 620ecc9 and 5b81c75.

📒 Files selected for processing (6)

• AGENTS.md
• docs/codex-cloud.md
• scripts/check-codex-cloud-setup.mjs
• scripts/maintain-codex-cloud.sh
• scripts/setup-codex-cloud.sh
• tests/codex-cloud-setup.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• scripts/setup-codex-cloud.sh
• docs/codex-cloud.md