Fix CodeRabbit auth in local Codex worktrees

[nehal-a2z]

Summary

• run the trusted host-installed CodeRabbit CLI through Codex's command-scoped sandbox escalation in local desktop, CLI, and worktree sessions
• start reviews directly and handle authentication only after an explicit auth error
• prohibit reading, copying, printing, or injecting Keychain credentials
• keep Codex Cloud on credentials configured inside its remote environment
• stop automatic CLI installation and browser-login launches
• update the two legacy -t examples to the current CLI scope flags
• bump the plugin patch version to 1.1.2

Before → After

Before: The published skill ran coderabbit auth status --agent inside Codex's Seatbelt sandbox before every review. The sandbox could not see the credential already stored for the host CLI, so the skill classified an authenticated user as logged out and opened another browser login—often once per worktree or loop.

After: Local Codex resolves a trusted host-installed CLI and runs the requested review directly through a command-scoped sandbox escalation. The CLI reads its existing host credential itself. Authentication is checked only after an explicit review auth failure, and only the user can initiate login.

Codex Cloud is called out separately because it cannot reuse a Mac host Keychain.

Root cause

A Codex Git worktree keeps the same host home and credential store. The failing boundary is the command sandbox, not the worktree: the exact same CLI and cwd reported authenticated:false inside Seatbelt and authenticated:true through command-scoped host execution.

Network access alone does not cross that credential boundary. Extracting the Keychain token would cross it unsafely, so this change keeps the token entirely inside the trusted CLI process.

Safety boundaries

• resolve and invoke an absolute host-installed CLI path
• reject repository/workspace executables, aliases, and wrappers
• escalate only the exact CodeRabbit CLI command; never change global sandbox settings
• never query or relay a host credential
• never ask for an API key in conversation
• never auto-install the CLI or launch authentication

Validation

• CodeRabbit CLI review --help confirmed --committed, --uncommitted, and --include-untracked
• skill quick_validate.py: passed
• plugin manifest jq empty: passed
• git diff --check: passed
• exact local regression smoke: sandbox false → command-scoped host true, with no browser or token access
• independent local-worktree and Codex Cloud forward tests followed the intended credential boundaries
• CodeRabbit reviewed both changed files with --agent --uncommitted: 0 issues

Source and related work

• ENG-4340
• Slack investigation
• Ports the corrected execution boundary from coderabbitai/skills#25 to the repository that publishes the live Codex plugin.
• Supersedes #7: making auth reactive alone still leaves the actual review inside Seatbelt.
• Does not include the separate timeout/concurrency rewrite in #6.

Summary by CodeRabbit

• New Features
  • Added support for reviewing untracked files.
  • Review scope options now use clearer long-form command-line flags.
  • Added handling for credentials and remote development environments.
• Bug Fixes
  • Improved tool setup by using trusted host installations and validating supported versions.
  • Authentication is now requested only when required, reducing unnecessary prompts.
• Security
  • Host tool execution is more isolated to help protect the local environment.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 31f5078f-f024-4cc0-b4ca-f638dceff14a

📥 Commits

Reviewing files that changed from the base of the PR and between 0f66928 and 4b2cc01.

⛔ Files ignored due to path filters (1)

• plugins/coderabbit/.codex-plugin/plugin.json is excluded by !**/*.json

📒 Files selected for processing (1)

• plugins/coderabbit/skills/coderabbit-review/SKILL.md

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Walkthrough

The review skill now resolves trusted host executables, validates versions, and requires host-sandbox execution. It limits credential-store use and directs authentication only after an authentication error. It also adds separate guidance for remote environments. Review scope commands now use --committed and --uncommitted, with support for --include-untracked.

Poem

I’m a rabbit with a trusted tool,
Checking versions by the burrow rule.
Auth waits for an error to appear,
Untracked files hop into view here.
Long options guide each review trail.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nehal/fix-codex-host-auth

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch nehal/fix-codex-host-auth

---

_{Comment @coderabbitai help to get the list of available commands.}