Add Codex support with separate Docker image

[thepagent]

Summary

Add a separate Docker image for OpenAI Codex as an agent backend, alongside the existing kiro-cli image.

Approach

• Separate Dockerfile (Dockerfile.codex) — same agent-broker binary, different CLI installed
• Publish as ghcr.io/thepagent/agent-broker-codex (or tag convention 0.x.x-codex)
• Codex needs Node.js + npm runtime, different from kiro-cli standalone binary
• Auth via OPENAI_API_KEY env var instead of OAuth device flow

Helm usage

image:
  repository: ghcr.io/thepagent/agent-broker-codex
agent:
  command: codex
  args: ["--acp"]
env:
  OPENAI_API_KEY: "${OPENAI_API_KEY}"

Why separate images

• Different runtimes (standalone binary vs Node.js)
• Different auth mechanisms
• Independent update cadences
• Smaller image size for users who only need one backend

[thepagent]

Update: Codex CLI does not natively support ACP

Tested locally with codex-cli 0.114.0 — there is no --acp flag.

Codex has app-server (stdio/websocket) but it uses its own protocol, not ACP JSON-RPC.

Options

1. cola-io/codex-acp — Third-party ACP bridge that wraps Codex runtime. Most promising path.
2. codex exec — Non-interactive single-turn mode. Simple but no multi-turn sessions.
3. Wait for native ACP — OpenAI may add --acp in a future release.

Option 1 (codex-acp) is likely the best approach for now.

[thepagent]

Update: Use @zed-industries/codex-acp adapter

Codex CLI does not have native --acp. The correct approach (used by OpenClaw and Zed) is the official Zed-maintained ACP adapter:

agent:
  command: npx
  args: ["-y", "@zed-industries/codex-acp@0.9.5"]
env:
  OPENAI_API_KEY: "${OPENAI_API_KEY}"

Reference

• OpenClaw acpx built-in agent commands
• zed-industries/codex-acp