@@ -6,7 +6,7 @@ This plugin is currently **beta**. APIs may change between minor releases. Impor
 :::
 <!-- AUTO-GENERATED: stability-banner-end -->
 
-The `omnigent` plugin embeds [Omnigent](https://github.com/omnigent-ai/omnigent), the open-source agent meta-harness, in a Databricks AppKit app. Your users get Claude Agent SDK, Pi and OpenAI Agents SDK sessions inside the app, with model calls going through Unity AI Gateway as the app's service principal.
+The `omnigent` plugin embeds [Omnigent](https://github.com/omnigent-ai/omnigent), the open-source agent meta-harness, in a Databricks AppKit app. Your users get Claude Agent SDK, Codex, Pi and OpenAI Agents SDK sessions inside the app, with model calls going through Unity AI Gateway as the app's service principal.
 
 Omnigent owns the agent loop: sessions, history, approvals. The plugin runs it safely inside a Databricks App. Use the [`agents`](./agents.md) plugin when you want AppKit to own the loop against one serving endpoint. Use `omnigent` when you want the harnesses themselves.
 
@@ -27,21 +27,21 @@ await createApp({
 The app also needs:
 
 - **Python.** Add a `pyproject.toml` with `requires-python = ">=3.12,<3.13"` and `omnigent[databricks]`, plus a `uv.lock`. Databricks Apps then builds a Python 3.12 venv next to `npm install`. A plain `requirements.txt` gets Python 3.11, which Omnigent does not support. The lockfile must reference public PyPI.
-- **Harness CLIs.** Add them to your `package.json`, so you pin their versions: `@anthropic-ai/claude-code` and `@earendil-works/pi-coding-agent`. The plugin only offers harnesses whose CLI is installed. The Claude Agent SDK's bundled CLI is too old for current Claude models, so add `@anthropic-ai/claude-code` even though the SDK ships one.
+- **Harness CLIs.** Add them to your `package.json`, so you pin their versions: `@anthropic-ai/claude-code`, `@openai/codex` and `@earendil-works/pi-coding-agent`. The plugin only offers harnesses whose CLI is installed. The Claude Agent SDK's bundled CLI is too old for current Claude models, so add `@anthropic-ai/claude-code` even though the SDK ships one.
 - **Start with `node`.** In `app.yaml`, use `command: ["node", "server.js"]`, not `npm run start`. npm does not pass SIGTERM on, so the plugin never gets to stop its child processes. As a backstop, each child also exits when Node does, so a redeploy still succeeds.
 
 ## Configuration
 
 | Option | Default | |
 |---|---|---|
 | `instructions` | a generic assistant prompt | System instructions for every session |
-| `harnesses` | `claude-sdk`, `pi`, `openai-agents` | Harnesses users may pick |
+| `harnesses` | `claude-sdk`, `codex`, `pi`, `openai-agents` | Harnesses users may pick |
 | `defaultHarness`, `defaultModel` | first available | |
 | `runtime.python` | `./.venv/bin/python` | |
 | `runtime.home` | `$TMPDIR/appkit-omnigent` | The plugin's state directory |
 | `runtime.hostIdleMs` | 30 min | Stop a user's Omnigent host after this long idle |
 
-Each harness is offered the Unity AI Gateway `system.ai` models whose API it speaks: Claude Agent SDK the Anthropic Messages API, Pi the Codex Responses API, OpenAI Agents SDK the OpenAI Responses API.
+Each harness is offered the Unity AI Gateway `system.ai` models whose API it speaks: Claude Agent SDK the Anthropic Messages API, Codex and Pi the Codex Responses API, OpenAI Agents SDK the OpenAI Responses API.
 
 ## Routes
 
@@ -55,15 +55,22 @@ All routes are under `/api/omnigent` and scoped to the signed-in user.
 | `POST /sessions/:id/messages` | `{ "text": "..." }` |
 | `GET /sessions/:id/stream` | Server-sent events (Omnigent's session stream, which replays from `Last-Event-ID`) |
 | `POST /sessions/:id/interrupt` | Stop the current turn |
-| `GET /status` | Runtime health: hosts, gateway counters |
+| `GET /status` | Runtime health: sandbox, hosts, gateway counters |
 
 ## How it works
 
 - **One Omnigent server, one host per user.** The server listens on loopback in Omnigent's header-auth mode, under a random header name only the plugin knows. Each active user gets their own host process, registered as that user; Omnigent only runs a session on its owner's host. An idle host stops after `runtime.hostIdleMs`.
-- **No credential in any child process.** The harnesses' Databricks profile points at a model gateway inside the plugin, on loopback, with a placeholder token. The gateway forwards only model-serving paths to the workspace and adds the service principal's token. Every other path returns 403.
+- **No credential in any child process.** The harnesses' Databricks profile points at a model gateway inside the plugin, on loopback, with a placeholder token. The gateway forwards only model-serving paths to the workspace and adds the service principal's token. Every other path returns 403. Codex only trusts public TLS roots, so it reaches the gateway over plain http on loopback; the others use https with a certificate the plugin generates.
+- **Codex runs sandboxed.** Codex has its own shell. Its binary runs through a bubblewrap wrapper that gives it:
+  - its own PID namespace
+  - the plugin's state directory masked
+  - only the user's home and work directory bound in
+  - the `/proc` entries of the app's own processes hidden
+
+  Without bubblewrap on `PATH` (or bundled with Codex), Codex is not offered.
 
 ## Limits
 
 - **Sessions live in the container.** Omnigent keeps them in SQLite under the plugin's state directory, so they survive a process restart but not a redeploy.
-- **Only gateway harnesses.** Harnesses that sign in with their vendor (Cursor, Copilot, Gemini and others) bypass Unity AI Gateway, so they are not offered. Native terminal harnesses (`claude-native`, `pi-native`) are not offered yet: they need tmux and a terminal client.
+- **Only gateway harnesses.** Harnesses that sign in with their vendor (Cursor, Copilot, Gemini and others) bypass Unity AI Gateway, so they are not offered. Native terminal harnesses (`claude-native`, `codex-native`, `pi-native`) are not offered yet: they need tmux and a terminal client.
 - **Shared gateway limits.** All users' model traffic uses the service principal's gateway limits.
@@ -2,6 +2,8 @@ import type { OmnigentHarness } from "./types";
 
 interface HarnessInfo {
   label: string;
+  /** Runs its own shell (so it needs the sandbox). */
+  shell: boolean;
   /**
    * Unity AI Gateway API types it calls (a UC model service's
    * `supported_api_types`); a model must support one of them.
@@ -20,18 +22,27 @@ interface HarnessInfo {
 const GATEWAY_HARNESSES: Readonly<Record<string, HarnessInfo>> = {
   "claude-sdk": {
     label: "Claude Agent SDK",
+    shell: false,
     apis: ["anthropic/v1/messages"],
     preferred: ["system.ai.claude-sonnet-5", "system.ai.claude-opus-5-5"],
   },
+  codex: {
+    label: "Codex",
+    shell: true,
+    apis: ["codex/v1/responses"],
+    preferred: ["system.ai.gpt-5-5"],
+  },
   pi: {
     label: "Pi",
+    shell: false,
     // Pi reaches Databricks models through the Codex responses API; on the
     // chat-completions path Gemini fails with an empty 400 (tested).
     apis: ["codex/v1/responses"],
     preferred: ["system.ai.gpt-5-5"],
   },
   "openai-agents": {
     label: "OpenAI Agents SDK",
+    shell: false,
     apis: ["openai/v1/responses"],
     preferred: ["system.ai.gpt-5-5"],
   },
@@ -53,11 +64,13 @@ export interface HarnessOffer extends OmnigentHarness {
 
 /**
  * What a user can pick: the allowed gateway harnesses their host reports as
- * usable, each with the models whose API it speaks.
+ * usable, minus shell harnesses when they cannot be sandboxed, each with the
+ * models whose API it speaks.
  */
 export function offerHarnesses(opts: {
   allowed: string[];
   configured: Record<string, boolean | string>;
+  shellAllowed: boolean;
   models: GatewayModel[];
 }): HarnessOffer[] {
   const out: HarnessOffer[] = [];
@@ -68,12 +81,14 @@ export function offerHarnesses(opts: {
     // "needs-auth" is advisory for gateway harnesses: their auth comes from the profile.
     if (ready === undefined || ready === false || ready === "binary-missing")
       continue;
+    if (info.shell && !opts.shellAllowed) continue;
     const models = opts.models
       .filter((m) => m.apiTypes.some((t) => info.apis.includes(t)))
       .map((m) => m.name);
     out.push({
       id,
       label: info.label,
+      shell: info.shell,
       ready,
       models,
       defaultModel: info.preferred.find((m) => models.includes(m)) ?? models[0],
 
@@ -2,7 +2,7 @@
   "$schema": "https://databricks.github.io/appkit/schemas/plugin-manifest.schema.json",
   "name": "omnigent",
   "displayName": "Omnigent Plugin",
-  "description": "Embedded Omnigent agent runtime: Claude Agent SDK, Pi and OpenAI Agents SDK harnesses through Unity AI Gateway",
+  "description": "Embedded Omnigent agent runtime: Claude Agent SDK, Codex, Pi and OpenAI Agents SDK harnesses through Unity AI Gateway",
   "stability": "beta",
   "resources": {
     "required": [],
@@ -12,7 +12,7 @@
     "rules": {
       "must": [
         "Add pyproject.toml (python >=3.12,<3.13) with omnigent[databricks] and a uv.lock that uses public PyPI",
-        "Add harness CLIs to package.json: @anthropic-ai/claude-code, @earendil-works/pi-coding-agent",
+        "Add harness CLIs to package.json: @anthropic-ai/claude-code, @openai/codex, @earendil-works/pi-coding-agent",
         "Start the app with node, not npm run, so SIGTERM reaches the plugin and it can stop its child processes"
       ]
     }
 
@@ -17,7 +17,7 @@ import {
   type HarnessOffer,
 } from "./harnesses";
 import manifest from "./manifest.json";
-import { GATEWAY_PROFILE } from "./runtime/env";
+import { profileFor } from "./runtime/env";
 import { OmnigentRuntime } from "./runtime/runtime";
 import type { CreateSessionRequest, IOmnigentConfig } from "./types";
 
@@ -37,7 +37,7 @@ export class OmnigentPlugin extends Plugin {
   static manifest = defineManifest<"omnigent">(manifest);
 
   protected static description =
-    "Embedded Omnigent: Claude Agent SDK, Pi and OpenAI Agents SDK, through Unity AI Gateway";
+    "Embedded Omnigent: Claude Agent SDK, Codex, Pi and more, through Unity AI Gateway";
   declare protected config: IOmnigentConfig;
 
   private runtime?: OmnigentRuntime;
@@ -163,6 +163,7 @@ export class OmnigentPlugin extends Plugin {
     return offerHarnesses({
       allowed: this.allowedHarnesses(),
       configured: mine?.configured_harnesses ?? {},
+      shellAllowed: rt.shellHarnessesAllowed,
       models: await this.servedModels(),
     });
   }
@@ -184,7 +185,7 @@ export class OmnigentPlugin extends Plugin {
       description: "AppKit app agent",
       harness,
       model,
-      profile: GATEWAY_PROFILE,
+      profile: profileFor(harness),
       instructions: this.instructions(email),
     });
   }
@@ -521,7 +522,7 @@ export class OmnigentPlugin extends Plugin {
 
   exports() {
     return {
-      /** Runtime health: server, hosts, gateway counters. */
+      /** Runtime health: server, sandbox, hosts, gateway counters. */
       status: () => this.rt().status(),
     };
   }
 
@@ -0,0 +1,59 @@
+import fs from "node:fs";
+import path from "node:path";
+
+interface CodexTools {
+  /** The Codex binary from the app's `@openai/codex` package. */
+  bin?: string;
+  /** A usable `bwrap`, to sandbox it. */
+  bwrap?: string;
+}
+
+function readdir(dir: string): string[] {
+  try {
+    return fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+
+function onPath(name: string): string | undefined {
+  for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
+    const p = path.join(dir, name);
+    try {
+      fs.accessSync(p, fs.constants.X_OK);
+      if (dir) return p;
+    } catch {}
+  }
+  return undefined;
+}
+
+/** Finds the Codex binary (to wrap it) and bubblewrap (PATH, else the one Codex's package ships). */
+export function findCodex(appDir: string): CodexTools {
+  const nm = path.join(appDir, "node_modules", "@openai");
+  let bin: string | undefined;
+  // vendor/<triple>/bin/codex (0.15x+) or vendor/<triple>/codex/codex (older).
+  for (const pkg of readdir(nm).filter((d) => d.startsWith("codex-"))) {
+    for (const triple of readdir(path.join(nm, pkg, "vendor"))) {
+      const base = path.join(nm, pkg, "vendor", triple);
+      bin =
+        [
+          path.join(base, "bin", "codex"),
+          path.join(base, "codex", "codex"),
+        ].find((p) => fs.existsSync(p)) ?? bin;
+    }
+  }
+  let bwrap = onPath("bwrap");
+  if (!bwrap && bin) {
+    const shipped = path.resolve(
+      path.dirname(bin),
+      "..",
+      "codex-resources",
+      "bwrap",
+    );
+    if (fs.existsSync(shipped)) {
+      fs.chmodSync(shipped, 0o755);
+      bwrap = shipped;
+    }
+  }
+  return { bin, bwrap };
+}
@@ -2,18 +2,24 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
-/** The Databricks profile the children use; it points at the model gateway. */
-export const GATEWAY_PROFILE = "appkit-omnigent";
+/** Databricks profile names the children use; both point at the model gateway. */
+const PROFILE_HTTPS = "appkit-omnigent";
+const PROFILE_HTTP = "appkit-omnigent-http";
+
+/** Harnesses whose TLS stack only trusts public roots use the plain-http listener. */
+export function profileFor(harness: string): string {
+  return harness.startsWith("codex") ? PROFILE_HTTP : PROFILE_HTTPS;
+}
 
 /**
  * Directory layout under the runtime root:
  *
- *   server/            Omnigent server data
+ *   server/            Omnigent server data (masked from harnesses)
  *   users/<id>/home    one user's $HOME: Databricks profile, Omnigent config
  *   users/<id>/data    that user's host data
  *   work/<id>          that user's workspace (sessions' cwd)
- *   bin/               public: CA bundle
- *   tls/               gateway key
+ *   bin/               public: sandbox wrappers, CA bundle
+ *   tls/               gateway key (masked)
  *   logs/
  */
 export class RuntimeLayout {
@@ -57,28 +63,34 @@ export class RuntimeLayout {
 
 interface GatewayEndpoints {
   httpsUrl: string;
+  httpUrl: string;
   placeholder: string;
 }
 
 /**
- * Writes a user's `$HOME` config: a `.databrickscfg` whose profile points at
- * the gateway with the placeholder token (no real credential), and an
- * Omnigent `config.yaml` that authenticates through that profile.
+ * Writes a user's `$HOME` config: a `.databrickscfg` whose two profiles point
+ * at the gateway with the placeholder token (no real credential), and an
+ * Omnigent `config.yaml` that authenticates through the https one.
  */
 export function writeUserConfig(home: string, gw: GatewayEndpoints): void {
   fs.mkdirSync(path.join(home, ".config", "omnigent"), { recursive: true });
   const cfg = [
-    `[${GATEWAY_PROFILE}]`,
+    `[${PROFILE_HTTPS}]`,
     `host = ${gw.httpsUrl}`,
     `token = ${gw.placeholder}`,
     "auth_type = pat",
     "",
+    `[${PROFILE_HTTP}]`,
+    `host = ${gw.httpUrl}`,
+    `token = ${gw.placeholder}`,
+    "auth_type = pat",
+    "",
   ].join("\n");
   fs.writeFileSync(path.join(home, ".databrickscfg"), cfg, { mode: 0o600 });
   const omnigentConfig = [
     "auth:",
     "  type: databricks",
-    `  profile: ${GATEWAY_PROFILE}`,
+    `  profile: ${PROFILE_HTTPS}`,
     "",
   ].join("\n");
   fs.writeFileSync(