Daniel Kim eff59cd1a5 Codex harness: resolve bin symlinks, grant git dir + network in Auto sandbox (v0.1.49) (#51)
* Codex harness: resolve bin symlinks, grant git dir + network in Auto sandbox

Two fixes for headless codex-cli 0.144 under orx:

1. find_codex() now canonicalizes the PATH hit. Codex >= 0.144 locates its
   codex-code-mode-host helper as a sibling of the *invoked* path without
   dereferencing symlinks, and installers drop only a lone `codex` symlink
   into ~/.local/bin — so every spawn via the symlink died with "No such
   file or directory" before running a single command.

2. Auto mode (sandbox_mode=workspace-write) now also passes
   sandbox_workspace_write.network_access=true and declares the repo's
   `git rev-parse --git-common-dir` as a writable root. Codex's sandbox
   blocks network by default (DNS included — git fetch/push, package
   installs, and the orx CLI's localhost API all fail) and denies every
   git metadata write (in-workspace .git is marked read-only; a worktree's
   real metadata lives in the hub clone, outside the workspace). The
   interactive TUI escalates both denials to approval prompts; codex exec
   has no approval channel, so they were hard failures. All behavior
   verified against codex-cli 0.144 via `codex sandbox` (no model calls)
   in plain clones and worktrees.

* Bump version to 0.1.49
2026-07-12 15:19:24 -07:00
…
…
…
…

OpenResearch CLI (orx)

A small command-line interface for OpenResearch. Log in via the browser, then query your projects from the terminal.

Requirements

  • Rust (stable) with Cargo. Install via rustup:

    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
    

Build & run

# Build (debug):
cargo build

# Run during development:
cargo run -- login
cargo run -- projects

# Build an optimized release binary at target/release/orx:
cargo build --release
./target/release/orx login

# Or install `orx` onto your PATH (~/.cargo/bin):
cargo install --path .
orx login
orx projects

Run the tests with cargo test.

Commands

Command Description
orx login [--api-url <url>] Opens your browser, authenticates, and stores a personal access token.
orx logout Removes the stored token.
orx install-skills [--agent claude|codex|opencode|cursor|all] Installs the orx skill shim into local coding agents (Claude Code, Codex, OpenCode, Cursor) so they auto-discover the CLI (orx login also offers this).
orx projects [--all] Lists your projects, grouped by organization. --all includes archived.
orx compute [--gpu <id>] [--count <n>] [--provider <name>] | --cpu] Lists the GPU compute catalog across all providers and regions, or CPU-only offers with --cpu, sorted by price.
orx instance create <orgId> (--gpu <id> [--count <n>] [--disk <gb>] [--provider <name>] | --cpu <flavor> [--vcpus <n>]) Spins up a standalone instance in an organization (not tied to an experiment), like the dashboard's "Spin up".
orx exp status <expId> Shows an experiment's status, branch, parent, run command, and latest run, plus a local git diff recipe for what the run changed.
orx exp cmd <expId> [--set <command>] Views or sets the experiment's run command.
orx exp run <expId> (--gpu <id> [--count <n>] [--disk <gb>] [--provider <name>] | --cpu <flavor> [--vcpus <n>] | --sandbox <id>) Launches a run on new GPU, new CPU-only, or existing compute.
orx exp cancel <expId> Cancels the in-flight run.
orx lit "<query>" [--limit <n>] [--json] Full-text search alphaXiv's paper corpus (no login required).
orx paper <id|url> [--full] Fetch a paper's machine-readable report, or its full text with --full.
orx version [--check] [--json] Prints the CLI version; --check compares it to the latest release.
orx update [--dry-run] [--force] Updates orx by re-running the release installer (installer installs only).

Updating

orx update only manages binaries installed by the release installer script (it checks the cargo-dist install receipt at ${XDG_CONFIG_HOME:-~/.config}/openresearch-cli/). If you installed with cargo install, update the same way instead. In interactive terminals orx also checks for new releases in the background at most once a day and prints a one-line notice to stderr; set ORX_NO_UPDATE_CHECK=1 (or OPENRESEARCH_CLI_DISABLE_UPDATE=1) to turn that off. Agents, scripts, pipes, and CI never see the notice.

Configuration

  • API URL resolves from --api-url → OPENRESEARCH_API_URL → the built-in default (http://localhost:4000). Point it at the production API host for real use:

    export OPENRESEARCH_API_URL=https://api.openresearch.sh
    
  • Credentials are stored at ${XDG_CONFIG_HOME:-~/.config}/openresearch/credentials.json (mode 0600).

How login works

orx login starts a temporary HTTP listener on a random 127.0.0.1 port, opens {api}/auth/cli/login in your browser, and waits for the API to redirect back with a freshly minted personal access token after you authenticate. The token is sent as Authorization: Bearer … on every subsequent request.

S
Description
GitHub Trending: alphaXiv/OpenResearch
Readme MIT
937 MiB
Languages
Rust 71.6%
TypeScript 20.4%
JavaScript 6.3%
Python 0.7%
HTML 0.3%
Other 0.6%