feat: ship bubblewrap in the base image for the Codex CLI sandbox

[BrettKinny]

Why

The OpenAI Codex CLI's Linux sandbox uses the first bwrap executable it finds on PATH. When none exists it warns at startup (⚠ Codex could not find system bubblewrap at /usr/bin/bwrap) and falls back to a bundled helper that still depends on unprivileged user-namespace support. Upstream's recommended setup is to install the distribution's bubblewrap package (Codex sandboxing docs, openai/codex#14963).

What

• Dockerfile: add bubblewrap to the base APT package layer, with a comment recording the Codex rationale.
• scripts/e2e-test.sh: add bwrap to the always-present core command inventory so the Candidate suite gates on it.
• README.md: document bubblewrap in the CLI tools table.
• CHANGELOG.md: note the addition under Unreleased.

Placement rationale

Image tier rather than Box tier: assistants install into the Managed home (mise-managed Node, npm globals), so after Box replacement --reconcile-box skips install_codex when the codex binary survives — a Box-tier apt_install bubblewrap hung off that path would silently go missing on every Box replacement. Shipping it in the image keeps bwrap present unconditionally with no reconcile logic, at ~1 MB of image cost, and it benefits any Codex selection made at any time.

Validation

• All 17 local tests/test-*.sh suites pass.
• Docker is unavailable in this session; the image build and e2e-test.sh smoke (which now asserts bwrap presence via tools.core.bwrap) run in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GiQdQXNUM2Wca7VcWrByhS

---

Generated by Claude Code

[BrettKinny]

@claude should it only be bundled if codex has been selected?

[BrettKinny]

I considered that, and I'd recommend keeping it unconditional in the image. The problem with tying it to the Codex Selection is Box replacement: Codex itself lives in the Managed home (mise Node + npm global), so it survives replacement, and --reconcile-box deliberately skips install_codex when the codex binary is already present. A Box-tier apt_install bubblewrap hung off that path would therefore vanish on every Box replacement and never be reconciled — Codex would silently degrade to its bundled fallback helper.

Making it reconcile correctly would mean adding a bwrap presence check that runs outside the assistant skip logic, plus a runtime apt/network dependency at setup time for the sandbox to work. Against that, the unconditional cost is ~1 MB in the image and the package is inert when Codex isn't selected. It also matches how other cross-cutting runtime deps (gpg, libatomic1) are shipped image-tier rather than tied to the Selection that needs them.

Happy to rework it Box-tier with the reconcile handling if you'd rather keep the image minimal — just say the word.

---

Generated by Claude Code